Outcome

Turn the current Quirk Systems pull-request portfolio into a finite exact-head closure queue. Every human-authored PR must receive one current-head disposition:

READY_FOR_MERGE
READY_FOR_HUMAN_ADMISSION
REVISE
HOLD_CANDIDATE
SUPERSEDE
CLOSE_AS_REDUNDANT

A green check, draft location, receipt, installed capability, or mergeable=true must never imply admission, Canon, runtime, release, deployment, provider, publication, financial, physical, or irreversible authority.

Scope split

Classification: MATERIAL_SCOPE_CHANGE

Wave 1 — now

Human-authored security, governance, admission, repository-ownership, evidence, runtime-boundary, and repository-safety PRs.

Wave 2 — later

Dependabot majors, generated compatibility migrations, duplicated bot PRs, and framework/toolchain upgrade trains.

Wave 2 must not delay or disguise Wave 1 closure.

Permanent repository ownership map

Quirkroot is retired as an active boundary. Historical lineage may remain, but no new catch-all work may target it.

Initial exact-head queue

• .github#9 @ c848db6cbb83c5919ca19775295d1c534bbbceaf — verify exact-range governance spine; target READY_FOR_HUMAN_ADMISSION; do not activate rulesets.
• Quirk#3 @ 0d3415c5d507002bbb7f9f7b581e0b334f657c0f — target SUPERSEDE; create an extraction ledger by owning repository; preserve lineage.
• Quirk#4 @ fb728da472a39bcf29a25d1500fb80f989b6e63c — target REVISE; retain Civic Surface registry/UI, remove installer/provider-acquisition behavior.
• Quirk#5 @ 6a5139bb30fd9da4dcc8b099d6413fee12272504 — resolve secret-scanning incident, create clean successor head, rerun exact-head consumer proof; target READY_FOR_HUMAN_ADMISSION only.
• quirk-os#70 @ 0909ad85415bf860aa3c6008028c6b6f034e3743 — preserve APPROVE_CANON_BOUNDARY for boundary commit only; split candidate evidence before any Git admission discussion.
• quirk-os#71 @ 381a2df04f6c1986f9d921459bdfbdeb869d2e8c — resolve five review questions and run the two-format bakeoff; remain candidate-only.
• quirk-run#2 @ 850e5718377751d40cff68cde2db7c943b4b7e6b — prove behavioral fixtures and independent review; no Cloudflare deployment.
• quirk-data#2 @ 02599cd0014c49d8e4a9dcb372add9e00d54668f — add missing negative pgTAP proof and independent review; no Supabase migration.
• Sweep every remaining human-authored open PR through the same disposition contract.
• Start Wave 2 only after Wave 1 has zero unclassified PRs.

Any head change makes the recorded evidence and disposition stale.

PR Closure Harness v0.1

Canonical owner: Quirk-Systems/.github.

The first implementation must operate in read-only/shadow mode and emit one machine-readable Proof Passport:

subject:
  repository: owner/repository
  pull_request: 1
  base_sha: full-40-character-sha
  head_sha: full-40-character-sha
scope:
  classification: CONTEXT_ONLY | IMPLEMENTATION_DETAIL | MATERIAL_SCOPE_CHANGE | AUTHORITY_CHANGE
  owner_valid: true
  fingerprint: sha256:...
blockers:
  reproduced: []
  unresolved: []
  hidden_checks: []
  open_review_threads: 0
proof:
  native_tests: PASS | FAIL | NOT_EXECUTED
  adversarial_fixtures: PASS | FAIL | NOT_EXECUTED
  exact_head_verified: true
  claims_reviewed: true
  external_writes: 0
authority:
  ceiling: candidate | boundary_only | merge_candidate
  merge_granted: false
  canon_granted: false
  runtime_granted: false
disposition:
  value: READY_FOR_MERGE | READY_FOR_HUMAN_ADMISSION | REVISE | HOLD_CANDIDATE | SUPERSEDE | CLOSE_AS_REDUNDANT
  required_next: []
  stale_when_head_changes: true

Required loop:

OBSERVE → CLASSIFY → LOCK → REPRODUCE → CHEAPEST DISPROOF
→ ISOLATE → RED → REPAIR → VERIFY → ATTACK → REVIEW
→ PASSPORT → WARRANT → HUMAN GATE → POST-MERGE PROOF → RE-SNAPSHOT

Companion-method boundaries

Code Ontology Companion

Use for repository ownership, entity/relation, contract dependency, evidence lineage, lifecycle, and authority-edge analysis. It must not claim TypeScript execution, runtime coverage, or admission from ontology consistency.

Cloudflare

Cloudflare remains a bounded adapter/runtime seam in quirk-run. Wave 1 may typecheck, bundle, dry-run, and execute hermetic fixtures. It may not deploy, create routes, provision bindings, or mutate world state.

Agent Ready

Fresh scan 4L8pJOcmAE for https://quirk.systems returned a failed/zero baseline: zero pages scanned, no llms.txt, no sitemap, no AGENTS.md, and an HTTPS handshake timeout. Treat this as a public-surface evidence input, not proof that the repository or TLS owner is known. Create owner-specific successor work only after the serving repository/domain boundary is established.

Sentry

Define observability as a candidate contract before any project/DSN provisioning: stable event names, release/head binding, redaction, sampling, environment separation, no secret capture, and no authority inference from telemetry.

EvalDossier

An EvalDossier must bind repository, PR, exact head, exact external audience, evaluator identity, rubric version, nonce, commands, artifacts, limitations, withheld claims, and disposition. It cannot infer economic value, admission, authority, or real-world outcomes from synthetic evidence.

Plugin Eval

Create a deterministic custom metric pack for the Closure Harness. Stable checks should cover exact-head binding, owner validity, stale evidence, authority leakage, negative-fixture coverage, claim/evidence parity, external-write count, open review threads, and disposition completeness. Metrics supplement but never overwrite the core evaluation result.

Stop and split rules

Return MATERIAL_SCOPE_CHANGE → PAUSE → SPLIT when ownership, objective, files/repos, dependencies, data surface, external systems, or human owner materially change.

Return AUTHORITY_CHANGE → PAUSE → RE_AUTHORIZE whenever a change adds merge, Canon, runtime, release, deployment, publication, provider, financial, physical, personal-identity, or irreversible effect.

Stop a repair loop when:

• a candidate mixes boundary admission with runtime implementation;
• more than three unrelated blocker classes are found;
• two repair iterations fail without reducing blocker count;
• a provider write becomes necessary;
• the exact head changes after evidence or review.

Definition of wrapped up

• zero unclassified human-authored PRs;
• zero superseded PRs left open without successor links;
• zero merge/admission candidates with unresolved review threads;
• zero merge/admission candidates with stale evidence;
• zero wrong-owner changes awaiting extraction;
• every held candidate has a named owner, issue, cheapest disproof, and required-next list;
• all final decisions are exact-head bound;
• no new architecture PR enters Wave 1 during the closure sweep;
• post-merge verification is required separately and is never inferred from candidate CI.

Authority ceiling

This issue authorizes planning, read-only inspection, bounded fixture execution, draft successor creation, exact-head evidence packets, and review requests only.

It does not authorize merge, close, Canon admission, ruleset activation, deployment, Cloudflare routing, Supabase migration, Sentry provisioning, provider execution, publication, ownership transfer, financial action, physical action, or irreversible mutation.

Originally posted by @bryansayler in #13