ci(core): derive the Issue evidence universe from trusted config (#518)

.github/ISSUE_TEMPLATE/task.md

@@ -1,11 +1,10 @@
 ---
 name: Task
-about: Issue bound to the Nexus Core gate (marker pre-filled)
+about: Issue bound to the Nexus Core gate
 title: ""
 ---
-<!-- NEXUS_CORE_EVIDENCE_UNIVERSE: sha256:067385413f215bfa515e07d7e20b27b074040c19540e48aef9ae002cd314eec9 -->
-<!-- The line above binds this issue to the Nexus Core evidence universe. Keep it as the first line, unmodified.
-Regenerate it with `nexus-certify markers` (run in the repo on main) whenever `.nexus-core/config.toml` changes. -->
+<!-- No evidence-universe marker is needed: the Core gate derives it from the trusted base config
+(issue-gate evidence-universe: trusted-config). Bind the PR with a NEXUS_CORE_ISSUE marker in the PR body. -->
 
 ## Problem
 

.github/workflows/nexus-core-issue-completion.yml

@@ -41,11 +41,14 @@ jobs:
     outputs:
       artifact-name: ${{ steps.gate.outputs.artifact-name }}
       issue-number: ${{ steps.gate.outputs.issue-number }}
+      artifact-id: ${{ steps.gate.outputs.artifact-id }}
+      outcome: ${{ steps.gate.outputs.outcome }}
     steps:
       - id: gate
-        uses: James3014/nexus-core/.github/actions/issue-gate@8fd7548605bb3b5d1b8695dd37acb18d5a2f1147  # pin: full 40-hex nexus-core commit
+        uses: James3014/nexus-core/.github/actions/issue-gate@3f3dc38de7120b66f25eb246d22ef29d5d5971d9  # pin: full 40-hex nexus-core commit
         with:
-          nexus-certify-ref: "8fd7548605bb3b5d1b8695dd37acb18d5a2f1147"  # same sha as above
+          nexus-certify-ref: "3f3dc38de7120b66f25eb246d22ef29d5d5971d9"  # same sha as above
+          evidence-universe: trusted-config
 
   verify:
     name: Nexus Core issue completion   # the required status check
@@ -56,14 +59,18 @@ jobs:
     permissions:
       contents: read
       actions: read
+      # PR_ALREADY_CLOSED_SKIPPED: receipt-verify re-reads the live PR.
+      pull-requests: read
     steps:
-      - uses: James3014/nexus-core/.github/actions/receipt-verify@8fd7548605bb3b5d1b8695dd37acb18d5a2f1147  # pin: same sha
+      - uses: James3014/nexus-core/.github/actions/receipt-verify@3f3dc38de7120b66f25eb246d22ef29d5d5971d9  # pin: same sha
         with:
           artifact-name: ${{ needs.run.outputs.artifact-name }}
+          artifact-id: ${{ needs.run.outputs.artifact-id }}
           # This very workflow file, on the default branch.
           expected-identity: https://github.com/James3014/devspace/.github/workflows/nexus-core-issue-completion.yml@refs/heads/main
           github-repository: ${{ github.repository }}
           head-sha: ${{ github.event.pull_request.head.sha }}
           base-sha: ${{ github.event.pull_request.base.sha }}
           issue-number: ${{ needs.run.outputs.issue-number }}
-          nexus-certify-ref: "8fd7548605bb3b5d1b8695dd37acb18d5a2f1147"  # same sha
+          gate-outcome: ${{ needs.run.outputs.outcome }}
+          nexus-certify-ref: "3f3dc38de7120b66f25eb246d22ef29d5d5971d9"  # same sha

AGENTS.md

@@ -130,11 +130,11 @@ Start at the boundary named by the problem and follow the data. Keep policy in D
 ## Nexus Core issue-bound completion evidence
 
 - This repository is enrolled in the standalone `nexus-certify` Golden Path through `.nexus-core/config.toml`.
-- For mutation work tracked by a repository-local GitHub Issue, run `nexus-certify issue-init --issue <N>` before relying on Issue-bound completion evidence, and run `nexus-certify issue-check --issue <N>` before claiming engineering completion.
+- For mutation work tracked by a repository-local GitHub Issue, run `nexus-certify issue-init --issue <N> --evidence-universe trusted-config` before relying on Issue-bound completion evidence, and run `nexus-certify issue-check --issue <N> --evidence-universe trusted-config --require-trusted-config` before claiming engineering completion (the same mode as the CI gate; the Issue needs no `NEXUS_CORE_EVIDENCE_UNIVERSE` marker).
 - This binding is Evidence Trust + Completion only. It does not select the execution lane, route, worker/model, Candidate acceptance, merge, release, deployment, or production authority.
 - DIRECT work remains transport-neutral. A Core mutation session is not required solely because repository files are being changed.
 
-New issues must be opened from the issue template so the Nexus Core evidence-universe marker is present (from the CLI: `gh issue create --template task.md`). After any change to `.nexus-core/config.toml`, regenerate the marker with `nexus-certify markers` and update the template. PRs bind to their issue with `<!-- NEXUS_CORE_ISSUE: N -->`.
+Issues no longer need a `NEXUS_CORE_EVIDENCE_UNIVERSE` marker: the Core gate runs with `evidence-universe: trusted-config` and derives it from the trusted base config. The issue template (`gh issue create --template task.md`) is still the preferred form. PRs bind to their issue with `<!-- NEXUS_CORE_ISSUE: N -->`.
 
 ## Handoff
 

HANDOFF.md

@@ -22,5 +22,5 @@
 
 ## 卡住 / 注意
 - #499（download_artifact 的 host 只做前綴比對）還沒有修正 PR。
-- 多個 PR 的 Nexus Core issue gate 紅燈；送出前要確認 issue 有 `NEXUS_CORE_EVIDENCE_UNIVERSE` marker，PR body 也帶 `NEXUS_CORE_ISSUE`。
+- Nexus Core issue gate 改用 `evidence-universe: trusted-config`：issue 不再需要 `NEXUS_CORE_EVIDENCE_UNIVERSE` marker；PR body 仍要帶 `NEXUS_CORE_ISSUE`。
 - 本 repo 是 fork；gate 已拿掉 `fork==false` 條件（#457），不要再加回去。