diff --git a/.github/ISSUE_TEMPLATE/task.md b/.github/ISSUE_TEMPLATE/task.md index e44586cdd..7848a0f73 100644 --- a/.github/ISSUE_TEMPLATE/task.md +++ b/.github/ISSUE_TEMPLATE/task.md @@ -1,11 +1,10 @@ --- name: Task -about: Issue bound to the Nexus Core gate (marker pre-filled) +about: Issue bound to the Nexus Core gate title: "" --- - - + ## Problem diff --git a/.github/workflows/nexus-core-issue-completion.yml b/.github/workflows/nexus-core-issue-completion.yml index 2c15ed972..4377d3f7e 100644 --- a/.github/workflows/nexus-core-issue-completion.yml +++ b/.github/workflows/nexus-core-issue-completion.yml @@ -41,11 +41,14 @@ jobs: outputs: artifact-name: ${{ steps.gate.outputs.artifact-name }} issue-number: ${{ steps.gate.outputs.issue-number }} + artifact-id: ${{ steps.gate.outputs.artifact-id }} + outcome: ${{ steps.gate.outputs.outcome }} steps: - id: gate - uses: James3014/nexus-core/.github/actions/issue-gate@8fd7548605bb3b5d1b8695dd37acb18d5a2f1147 # pin: full 40-hex nexus-core commit + uses: James3014/nexus-core/.github/actions/issue-gate@3f3dc38de7120b66f25eb246d22ef29d5d5971d9 # pin: full 40-hex nexus-core commit with: - nexus-certify-ref: "8fd7548605bb3b5d1b8695dd37acb18d5a2f1147" # same sha as above + nexus-certify-ref: "3f3dc38de7120b66f25eb246d22ef29d5d5971d9" # same sha as above + evidence-universe: trusted-config verify: name: Nexus Core issue completion # the required status check @@ -56,14 +59,18 @@ jobs: permissions: contents: read actions: read + # PR_ALREADY_CLOSED_SKIPPED: receipt-verify re-reads the live PR. + pull-requests: read steps: - - uses: James3014/nexus-core/.github/actions/receipt-verify@8fd7548605bb3b5d1b8695dd37acb18d5a2f1147 # pin: same sha + - uses: James3014/nexus-core/.github/actions/receipt-verify@3f3dc38de7120b66f25eb246d22ef29d5d5971d9 # pin: same sha with: artifact-name: ${{ needs.run.outputs.artifact-name }} + artifact-id: ${{ needs.run.outputs.artifact-id }} # This very workflow file, on the default branch. expected-identity: https://github.com/James3014/devspace/.github/workflows/nexus-core-issue-completion.yml@refs/heads/main github-repository: ${{ github.repository }} head-sha: ${{ github.event.pull_request.head.sha }} base-sha: ${{ github.event.pull_request.base.sha }} issue-number: ${{ needs.run.outputs.issue-number }} - nexus-certify-ref: "8fd7548605bb3b5d1b8695dd37acb18d5a2f1147" # same sha + gate-outcome: ${{ needs.run.outputs.outcome }} + nexus-certify-ref: "3f3dc38de7120b66f25eb246d22ef29d5d5971d9" # same sha diff --git a/AGENTS.md b/AGENTS.md index fbb63a4f7..9a00d5d8e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -130,11 +130,11 @@ Start at the boundary named by the problem and follow the data. Keep policy in D ## Nexus Core issue-bound completion evidence - This repository is enrolled in the standalone `nexus-certify` Golden Path through `.nexus-core/config.toml`. -- For mutation work tracked by a repository-local GitHub Issue, run `nexus-certify issue-init --issue ` before relying on Issue-bound completion evidence, and run `nexus-certify issue-check --issue ` before claiming engineering completion. +- For mutation work tracked by a repository-local GitHub Issue, run `nexus-certify issue-init --issue --evidence-universe trusted-config` before relying on Issue-bound completion evidence, and run `nexus-certify issue-check --issue --evidence-universe trusted-config --require-trusted-config` before claiming engineering completion (the same mode as the CI gate; the Issue needs no `NEXUS_CORE_EVIDENCE_UNIVERSE` marker). - This binding is Evidence Trust + Completion only. It does not select the execution lane, route, worker/model, Candidate acceptance, merge, release, deployment, or production authority. - DIRECT work remains transport-neutral. A Core mutation session is not required solely because repository files are being changed. -New issues must be opened from the issue template so the Nexus Core evidence-universe marker is present (from the CLI: `gh issue create --template task.md`). After any change to `.nexus-core/config.toml`, regenerate the marker with `nexus-certify markers` and update the template. PRs bind to their issue with ``. +Issues no longer need a `NEXUS_CORE_EVIDENCE_UNIVERSE` marker: the Core gate runs with `evidence-universe: trusted-config` and derives it from the trusted base config. The issue template (`gh issue create --template task.md`) is still the preferred form. PRs bind to their issue with ``. ## Handoff diff --git a/HANDOFF.md b/HANDOFF.md index 1c6fe8d43..7da9b2aa1 100644 --- a/HANDOFF.md +++ b/HANDOFF.md @@ -22,5 +22,5 @@ ## 卡住 / 注意 - #499（download_artifact 的 host 只做前綴比對）還沒有修正 PR。 -- 多個 PR 的 Nexus Core issue gate 紅燈；送出前要確認 issue 有 `NEXUS_CORE_EVIDENCE_UNIVERSE` marker，PR body 也帶 `NEXUS_CORE_ISSUE`。 +- Nexus Core issue gate 改用 `evidence-universe: trusted-config`：issue 不再需要 `NEXUS_CORE_EVIDENCE_UNIVERSE` marker；PR body 仍要帶 `NEXUS_CORE_ISSUE`。 - 本 repo 是 fork；gate 已拿掉 `fork==false` 條件（#457），不要再加回去。