queen(app): t27-bees as a CI/CD gate -- check runs, re-run, CI triage, merge queue #7834

Problem

t27-bees is public since 2026-10-08, but as a CI/CD tool it can only leave a review comment. It cannot gate a merge, cannot be re-run from the Checks tab, does not explain a red CI run, and does not run in a merge queue. Today "this red check is not this PR's, it is red on master too" was decided by hand (t27b-native-ratchet on #7802). tools/bees/manifest.json still describes a private app with no webhook and no events.

Spec

specs/queen/app.t27, extended without moving any existing code (the deployed supervisor keeps working):

• three events appended: check_run.rerequested, workflow_run.completed, merge_group.checks_requested;
• ci_reaction: re-review on a Re-run, triage on a failed CI run, a check on a merge group;
• check_conclusion: the gate -- a checked fact (a broken or vacuous spec) fails it, the model's opinion is neutral with annotations, a diff too big to read is neutral;
• triage_owner: a failure red on the base head too is not this pull request's;
• the subscribed events and permissions the manifest must carry (checks: write, actions: read).

Tests

t27c test-report specs/queen/app.t27: the existing tests unchanged, plus tests for each new event, reaction, conclusion and triage rule; an invariant that the new codes never move either.

Acceptance

• PR merged with the spec, its seal and tools/bees/manifest.json synced (public, webhook https://api.t27.ai/queen/app/webhook, events, permissions).
• Follow-up in gHashTag/BrowserOS: re-pin app.t27/app.wasm and act on the new reactions (check runs, triage).

User Scenarios

• Given a pull request with a failing t27-bees check run, when a user clicks "Re-run" in the Checks tab, then the app receives check_run.rerequested and performs a re-review.
• Given a pull request where CI fails on the PR head but also fails on the base branch head, when workflow_run.completed fires, then the app triages the failure as "not this PR's" via triage_owner.
• Given a pull request entering a merge queue, when merge_group.checks_requested fires, then the app produces a check_conclusion that gates the merge.

Requirements

FR-001: The spec specs/queen/app.t27 MUST declare three new subscribed events: check_run.rerequested, workflow_run.completed, merge_group.checks_requested.
FR-002: The spec MUST define a ci_reaction that routes each new event to the correct reaction: re-review, triage, or merge-group check.
FR-003: The spec MUST define a check_conclusion rule: a broken or vacuous spec fails the check; the model's opinion is neutral with annotations; a diff too large to read is neutral.
FR-004: The spec MUST define a triage_owner rule: a failure that is also red on the base branch head is attributed to the base, not the pull request.
FR-005: The manifest tools/bees/manifest.json MUST be updated to a public app with webhook https://api.t27.ai/queen/app/webhook, the three new events, and permissions checks: write and actions: read.
FR-006: The test suite t27c test-report specs/queen/app.t27 MUST pass all existing tests and include new tests for each event, reaction, conclusion, and triage rule, plus an invariant that the new codes never move.

Boundary

• specs/queen/app.t27
• tools/bees/manifest.json