From 968a7b473d3408b413736192e115666d7eb6db81 Mon Sep 17 00:00:00 2001 From: James3014 <185240413+James3014@users.noreply.github.com> Date: Wed, 14 Oct 2026 14:14:32 +0800 Subject: [PATCH 1/2] ci(core): derive the Issue evidence universe from trusted config (#518) Move the Core issue-gate, receipt-verify and both nexus-certify-ref pins to nexus-core 3f3dc38 and set issue-gate evidence-universe: trusted-config, as Nexus-new did in #2033. Issues no longer need the NEXUS_CORE_EVIDENCE_UNIVERSE marker; an open Issue and the PR-body NEXUS_CORE_ISSUE marker stay required. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/ISSUE_TEMPLATE/task.md | 7 +++---- .github/workflows/nexus-core-issue-completion.yml | 9 +++++---- AGENTS.md | 2 +- HANDOFF.md | 2 +- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/task.md b/.github/ISSUE_TEMPLATE/task.md index e44586cdd..7848a0f73 100644 --- a/.github/ISSUE_TEMPLATE/task.md +++ b/.github/ISSUE_TEMPLATE/task.md @@ -1,11 +1,10 @@ --- name: Task -about: Issue bound to the Nexus Core gate (marker pre-filled) +about: Issue bound to the Nexus Core gate title: "" --- - - + ## Problem diff --git a/.github/workflows/nexus-core-issue-completion.yml b/.github/workflows/nexus-core-issue-completion.yml index 2c15ed972..b09b47193 100644 --- a/.github/workflows/nexus-core-issue-completion.yml +++ b/.github/workflows/nexus-core-issue-completion.yml @@ -43,9 +43,10 @@ jobs: issue-number: ${{ steps.gate.outputs.issue-number }} steps: - id: gate - uses: James3014/nexus-core/.github/actions/issue-gate@8fd7548605bb3b5d1b8695dd37acb18d5a2f1147 # pin: full 40-hex nexus-core commit + uses: James3014/nexus-core/.github/actions/issue-gate@3f3dc38de7120b66f25eb246d22ef29d5d5971d9 # pin: full 40-hex nexus-core commit with: - nexus-certify-ref: "8fd7548605bb3b5d1b8695dd37acb18d5a2f1147" # same sha as above + nexus-certify-ref: "3f3dc38de7120b66f25eb246d22ef29d5d5971d9" # same sha as above + evidence-universe: trusted-config verify: name: Nexus Core issue completion # the required status check @@ -57,7 +58,7 @@ jobs: contents: read actions: read steps: - - uses: James3014/nexus-core/.github/actions/receipt-verify@8fd7548605bb3b5d1b8695dd37acb18d5a2f1147 # pin: same sha + - uses: James3014/nexus-core/.github/actions/receipt-verify@3f3dc38de7120b66f25eb246d22ef29d5d5971d9 # pin: same sha with: artifact-name: ${{ needs.run.outputs.artifact-name }} # This very workflow file, on the default branch. @@ -66,4 +67,4 @@ jobs: head-sha: ${{ github.event.pull_request.head.sha }} base-sha: ${{ github.event.pull_request.base.sha }} issue-number: ${{ needs.run.outputs.issue-number }} - nexus-certify-ref: "8fd7548605bb3b5d1b8695dd37acb18d5a2f1147" # same sha + nexus-certify-ref: "3f3dc38de7120b66f25eb246d22ef29d5d5971d9" # same sha diff --git a/AGENTS.md b/AGENTS.md index fbb63a4f7..74e0d0842 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -134,7 +134,7 @@ Start at the boundary named by the problem and follow the data. Keep policy in D - This binding is Evidence Trust + Completion only. It does not select the execution lane, route, worker/model, Candidate acceptance, merge, release, deployment, or production authority. - DIRECT work remains transport-neutral. A Core mutation session is not required solely because repository files are being changed. -New issues must be opened from the issue template so the Nexus Core evidence-universe marker is present (from the CLI: `gh issue create --template task.md`). After any change to `.nexus-core/config.toml`, regenerate the marker with `nexus-certify markers` and update the template. PRs bind to their issue with ``. +Issues no longer need a `NEXUS_CORE_EVIDENCE_UNIVERSE` marker: the Core gate runs with `evidence-universe: trusted-config` and derives it from the trusted base config. The issue template (`gh issue create --template task.md`) is still the preferred form. PRs bind to their issue with ``. ## Handoff diff --git a/HANDOFF.md b/HANDOFF.md index 1c6fe8d43..7da9b2aa1 100644 --- a/HANDOFF.md +++ b/HANDOFF.md @@ -22,5 +22,5 @@ ## 卡住 / 注意 - #499（download_artifact 的 host 只做前綴比對）還沒有修正 PR。 -- 多個 PR 的 Nexus Core issue gate 紅燈；送出前要確認 issue 有 `NEXUS_CORE_EVIDENCE_UNIVERSE` marker，PR body 也帶 `NEXUS_CORE_ISSUE`。 +- Nexus Core issue gate 改用 `evidence-universe: trusted-config`：issue 不再需要 `NEXUS_CORE_EVIDENCE_UNIVERSE` marker；PR body 仍要帶 `NEXUS_CORE_ISSUE`。 - 本 repo 是 fork；gate 已拿掉 `fork==false` 條件（#457），不要再加回去。 From 3a780e140aea5273c1fc6e5f9533a79413d067d2 Mon Sep 17 00:00:00 2001 From: James3014 <185240413+James3014@users.noreply.github.com> Date: Wed, 14 Oct 2026 14:37:10 +0800 Subject: [PATCH 2/2] ci(core): wire PR_ALREADY_CLOSED_SKIPPED and local trusted-config commands (#518) Review follow-up: forward the issue-gate outcome and artifact-id to receipt-verify (with pull-requests: read for its live-PR check), as Nexus-new does, so a run that starts after merge is neutral instead of red. Strip trailing whitespace on the pin lines. AGENTS.md local issue-init/issue-check now use --evidence-universe trusted-config, matching CI. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/nexus-core-issue-completion.yml | 6 ++++++ AGENTS.md | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/nexus-core-issue-completion.yml b/.github/workflows/nexus-core-issue-completion.yml index b09b47193..4377d3f7e 100644 --- a/.github/workflows/nexus-core-issue-completion.yml +++ b/.github/workflows/nexus-core-issue-completion.yml @@ -41,6 +41,8 @@ jobs: outputs: artifact-name: ${{ steps.gate.outputs.artifact-name }} issue-number: ${{ steps.gate.outputs.issue-number }} + artifact-id: ${{ steps.gate.outputs.artifact-id }} + outcome: ${{ steps.gate.outputs.outcome }} steps: - id: gate uses: James3014/nexus-core/.github/actions/issue-gate@3f3dc38de7120b66f25eb246d22ef29d5d5971d9 # pin: full 40-hex nexus-core commit @@ -57,14 +59,18 @@ jobs: permissions: contents: read actions: read + # PR_ALREADY_CLOSED_SKIPPED: receipt-verify re-reads the live PR. + pull-requests: read steps: - uses: James3014/nexus-core/.github/actions/receipt-verify@3f3dc38de7120b66f25eb246d22ef29d5d5971d9 # pin: same sha with: artifact-name: ${{ needs.run.outputs.artifact-name }} + artifact-id: ${{ needs.run.outputs.artifact-id }} # This very workflow file, on the default branch. expected-identity: https://github.com/James3014/devspace/.github/workflows/nexus-core-issue-completion.yml@refs/heads/main github-repository: ${{ github.repository }} head-sha: ${{ github.event.pull_request.head.sha }} base-sha: ${{ github.event.pull_request.base.sha }} issue-number: ${{ needs.run.outputs.issue-number }} + gate-outcome: ${{ needs.run.outputs.outcome }} nexus-certify-ref: "3f3dc38de7120b66f25eb246d22ef29d5d5971d9" # same sha diff --git a/AGENTS.md b/AGENTS.md index 74e0d0842..9a00d5d8e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -130,7 +130,7 @@ Start at the boundary named by the problem and follow the data. Keep policy in D ## Nexus Core issue-bound completion evidence - This repository is enrolled in the standalone `nexus-certify` Golden Path through `.nexus-core/config.toml`. -- For mutation work tracked by a repository-local GitHub Issue, run `nexus-certify issue-init --issue ` before relying on Issue-bound completion evidence, and run `nexus-certify issue-check --issue ` before claiming engineering completion. +- For mutation work tracked by a repository-local GitHub Issue, run `nexus-certify issue-init --issue --evidence-universe trusted-config` before relying on Issue-bound completion evidence, and run `nexus-certify issue-check --issue --evidence-universe trusted-config --require-trusted-config` before claiming engineering completion (the same mode as the CI gate; the Issue needs no `NEXUS_CORE_EVIDENCE_UNIVERSE` marker). - This binding is Evidence Trust + Completion only. It does not select the execution lane, route, worker/model, Candidate acceptance, merge, release, deployment, or production authority. - DIRECT work remains transport-neutral. A Core mutation session is not required solely because repository files are being changed.