brain-seal-refresh.yml cannot succeed: its last step is a push this repository's own ruleset rejects #2915

Eight runs since 2026-04-07. Eight failures. No successes.

The failure is identical every time, and it is not situational:

[master 7c64d50] chore: refresh brain seals from experience aggregation (Refs #1440)
 2 files changed, 9 insertions(+), 9 deletions(-)
remote: error: GH013: Repository rule violations found for refs/heads/master.
remote: - Changes must be made through a pull request.
remote: - 4 of 4 required status checks are expected.
 ! [remote rejected] master -> master (push declined due to repository rule violations)

The workflow computes the refresh, commits it, and then performs the one action
ruleset t27-master-protection exists to forbid. bypass_actors is empty, so
there is no actor for which this could work — including the owner.

The brain seals have therefore never been refreshed by this automation.
Whatever the aggregation produces has been built and discarded eight times.

Two halves of a design that never met

now-sync-gate.yml and issue-gate.yml — two of the four required checks —
carry a trusted-bot bypass:

  - name: Trusted-bot bypass (no-op pass)
    if: env(IS_BOT) == 'true'
    run: echo "Trusted bot PR -- gate passes as no-op. Closes 1031."

keyed on github-actions[bot]. That bypass exists so bot-authored PRs can merge
without a NOW entry or an issue reference. But no workflow in the tree opens a
PR (grep -l 'gh pr create\|create-pull-request' is empty), and all 100 most
recent merged PRs are authored by gHashTag. The bypass has never been taken.

So the repository has a path built for bot PRs and a bot that pushes directly
instead — and the direct push is exactly what the ruleset rejects. Turning the
push into a PR would use the bypass that already exists.

That is a change to what this workflow does in the world, so it is not made here.

Refs #2908

Boundary

• .github/workflows/brain-seal-refresh.yml
• .github/workflows/issue-gate.yml
• .github/workflows/now-sync-gate.yml