gHashTag · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026
@@ -250,3 +250,41 @@ jobs:
             for x in "${ok[@]}"; do gh pr view "${x%%:*}" --json closingIssuesReferences -q '.closingIssuesReferences[].number' </dev/null; done | sort -un | sed 's/^/Refs #/'; } > "$d/body"
           p=$(gh pr create --draft --label no-auto-merge --base master --head "$B" --title "claw: port batch of ${#ok[@]} pull requests" --body-file "$d/body") || exit 1; echo "batch pull request: $p" >> "$GITHUB_STEP_SUMMARY"
           gh pr ready "$p" && gh pr merge "$p" --merge --auto || echo "::warning::$p is open but its merge-commit auto-merge is not set"
+
+  # claw/criteria (#10549): the linked issues' Success Criteria a command settles. Law: specs/claw/criteria.t27, C from the BASE commit
+  # (head only while base has none). No secret: each `R <verb> <path>` the law prints is a fixed t27c argv after a path check.
+  claw-criteria:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions: {contents: read, issues: read, pull-requests: read}
+    steps:
+      - {uses: actions/checkout@v6, with: {ref: "${{ github.event.pull_request.head.sha }}", persist-credentials: false}}
+      - env: {GH_TOKEN: "${{ github.token }}", R: "${{ github.repository }}", N: "${{ github.event.pull_request.number }}"}
+        run: gh pr view "$N" -R "$R" --json closingIssuesReferences | jq -r --arg u "https://github.com/$R/issues/" '[.closingIssuesReferences[] | select(.url | startswith($u)) | .number] | .[:5][]' | while read -r i; do gh issue view "$i" -R "$R" --json body -q .body > /tmp/b < /dev/null || continue; printf 'I\t%s\t%s\n' "$i" "$(wc -c < /tmp/b)"; cat /tmp/b; done > /tmp/in
+      - env: {B: "${{ github.event.pull_request.base.sha }}"}
+        run: |
+          { git fetch -q --depth 1 origin "$B" && git show "$B:gen/c/claw/criteria.c" > /tmp/law.c; } 2> /dev/null || cp gen/c/claw/criteria.c /tmp/law.c
+          printf '#include "/tmp/law.c"\n#include <stdio.h>\n#include <stdlib.h>\nint main(int c,char**v){size_t k=1<<24,q=c>1?k:65000,m;uint8_t*b=malloc(k),*o=malloc(k);size_t n=fread(b,1,k,stdin);if(n==k)return 2;m=c>1?criteria_plan(b,n,o,q):criteria_report(b,n,o,q);if(m>q)return 3;fwrite(o,1,m,stdout);return 0;}\n' | cc -O1 -w -x c -o /tmp/law - && /tmp/law p < /tmp/in > /tmp/plan && : > /tmp/x
+          if [ -s /tmp/plan ]; then cargo build -q --release -p t27c; mkdir -p /tmp/zig; curl -fsSL https://ziglang.org/download/0.16.0/zig-x86_64-linux-0.16.0.tar.xz | tar -xJ -C /tmp/zig --strip-components=1; fi; export PATH=/tmp/zig:$PATH
+          while IFS=$'\t' read -r t v p; do e=127; : > /tmp/o; case "$v" in test|test-report|parse) set -- "$v" "$p";; seal-verify) set -- seal "$p" --verify;; *) set --;; esac
+            [[ $t = R && $p =~ ^specs/[A-Za-z0-9_./-]+\.t27$ && $p != *..* && -f $p && ! -L $p && $(realpath "$p") = "$PWD/$p" ]] || set --
+            [ $# = 0 ] || { e=0; timeout 600 ./target/release/t27c "$@" > /tmp/o 2>&1 < /dev/null || e=$?; }
+            if [ "$(wc -c < /tmp/o)" -gt 20000 ]; then { head -c 10000 /tmp/o; echo; tail -c 10000 /tmp/o; } > /tmp/o2; mv /tmp/o2 /tmp/o; fi
+            printf 'X\t%s\t%s\t%s\t%s\n' "$v" "$p" "$e" "$(wc -c < /tmp/o)" >> /tmp/x; cat /tmp/o >> /tmp/x; done < /tmp/plan
+          mkdir -p /tmp/claw; cat /tmp/in /tmp/x | /tmp/law > /tmp/claw/report; { echo '```'; cat /tmp/plan /tmp/claw/report; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
+      - {uses: actions/upload-artifact@v4, with: {name: claw-criteria, path: /tmp/claw/report}}
+
+  # Posts that report as ONE check run, claw/criteria, on the head sha. Token: the check-run row of
+  # specs/claw/github_surface.t27, checks write and nothing else; this job runs nothing from the pull request.
+  claw-criteria-post:
+    needs: claw-criteria
+    runs-on: ubuntu-24.04
+    permissions: {actions: read}
+    steps:
+      - {id: tok, continue-on-error: true, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID || secrets.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, repositories: t27, permission-checks: write}}
+      - {if: steps.tok.outcome == 'failure', run: echo "claw/criteria posted nothing - the TRI CLAW App could not mint a token with checks write; set secret CLAW_APP_PRIVATE_KEY and CLAW_APP_ID, grant the permission and accept it on the installation - docs/claw/README.md steps 1-2." >> "$GITHUB_STEP_SUMMARY"}
+      - {if: steps.tok.outputs.token, uses: actions/download-artifact@v4, with: {name: claw-criteria}}
+      - if: steps.tok.outputs.token
+        env: {GH_TOKEN: "${{ steps.tok.outputs.token }}", R: "${{ github.repository }}", S: "${{ github.event.pull_request.head.sha }}"}
+        run: jq -Rs --arg s "$S" 'split("\n") as $l | if ($l[0] | IN("success", "failure", "neutral")) then {name:"claw/criteria", head_sha:$s, status:"completed", conclusion:$l[0], output:{title:$l[1], summary:($l[2:] | join("\n"))}} else error("no conclusion") end' report | gh api -X POST "repos/$R/check-runs" --input - -q .html_url >> "$GITHUB_STEP_SUMMARY"
@@ -129,11 +129,11 @@ jobs:
           ./target/release/t27c gen-c specs/claw/sarif_feed.t27 > gen/c/claw/sarif_feed.c
           ./target/release/t27c gen-c specs/claw/suggest_feed.t27 > gen/c/claw/suggest_feed.c
           ./target/release/t27c gen-c specs/claw/refresh.t27 > gen/c/claw/refresh.c
-          ./target/release/t27c gen-c specs/claw/ledger_union.t27 > gen/c/claw/ledger_union.c; ./target/release/t27c gen-c specs/claw/merge_judge.t27 > gen/c/claw/merge_judge.c
+          ./target/release/t27c gen-c specs/claw/ledger_union.t27 > gen/c/claw/ledger_union.c; ./target/release/t27c gen-c specs/claw/merge_judge.t27 > gen/c/claw/merge_judge.c; ./target/release/t27c gen-c specs/claw/criteria.t27 > gen/c/claw/criteria.c
           ./target/release/t27c gen-c specs/policy/secret_gate.t27 > gen/c/policy/secret_gate.c
           ./target/release/t27c gen-rust specs/tri/fmt_source.t27 > bootstrap/gen/rust/tri/fmt_source.rs
           ./target/release/t27c gen-json specs/igla/own_model_board.t27 > gen/json/igla/own_model_board.json
-          git diff --exit-code -- gen/c/claw/gates.c gen/c/claw/t27f_gate.c gen/c/claw/sarif_feed.c gen/c/claw/suggest_feed.c gen/c/claw/refresh.c gen/c/claw/ledger_union.c gen/c/claw/merge_judge.c gen/c/policy/secret_gate.c bootstrap/gen/rust/tri/fmt_source.rs gen/json/igla/own_model_board.json
+          git diff --exit-code -- gen/c/claw/gates.c gen/c/claw/t27f_gate.c gen/c/claw/sarif_feed.c gen/c/claw/suggest_feed.c gen/c/claw/refresh.c gen/c/claw/ledger_union.c gen/c/claw/merge_judge.c gen/c/claw/criteria.c gen/c/policy/secret_gate.c bootstrap/gen/rust/tri/fmt_source.rs gen/json/igla/own_model_board.json
 
       # #7565: test only the specs this change can affect. specs/ci/affected.t27 picks them (the
       # changed specs and every spec that imports one through `use`, transitively); the graph is the

@@ -0,0 +1,33 @@
+{
+  "built_by": "t27c-bootstrap@0.5.2+f842cb0",
+  "closure": [
+    {
+      "spec": "specs/claw/text.t27",
+      "spec_hash": "sha256:b65da69dff231c61a6d3a48558af9e17af42e1acbe3f4763348f1f0c2f118f21"
+    }
+  ],
+  "config": "gen=c,rust,verilog,zig;tests=zig",
+  "gen_hash_c": "sha256:4d5e40544ab931606c590d9d5e5299062d6415b8e1666469110b7ed25fb0a479",
+  "gen_hash_rust": "sha256:ad6519571e66d8359ecd14ef7b43ed635dce1fb08eadb7df1a47e18f1e5baee6",
+  "gen_hash_verilog": "sha256:b74f43317079dbc70645195913defc451ecb1fc68b68812b0146598d10fd2173",
+  "gen_hash_zig": "sha256:b809fc0c2fff1d882edf8f0e08e0d43e3c1825ee19b03e0105e7e5190ea9e790",
+  "module": "ClawCriteria",
+  "ring": 12,
+  "seal_schema": 2,
+  "sealed_at": "2026-10-18T18:37:25Z",
+  "sealed_by": "t27c-bootstrap@0.5.2",
+  "spec_hash": "sha256:d672811b96add804682779162625ab9911b91c4ea049435b3b327e1e63ab315d",
+  "spec_path": "specs/claw/criteria.t27",
+  "tests": {
+    "failed": 0,
+    "failing": [],
+    "forced": false,
+    "passed": 42,
+    "total": 42,
+    "vacuous": 0
+  },
+  "toolchain": {
+    "test_runner": "sha256:8512b80da533b79289110fca4a65f3336abd7a059ca4b72ea595d5e33ff8ad10",
+    "zig": "0.16.0"
+  }
+}
@@ -1,22 +1,22 @@
 {
-  "built_by": "t27c-bootstrap@0.5.2+9448ab4be",
+  "built_by": "t27c-bootstrap@0.5.2+bcd8bb355",
   "closure": [
     {
       "spec": "specs/claw/recipes.t27",
       "spec_hash": "sha256:429ab03319e9d59f6a4aad6945693a83374d6d805e32ad72836bf7aff23d6cb3"
     }
   ],
   "config": "gen=c,rust,verilog,zig;tests=zig",
-  "gen_hash_c": "sha256:67fe08c4a7e8c4f4fe6cc676144d2f6a2674d17ea14b6bb8a26b1d6c91b90c9a",
-  "gen_hash_rust": "sha256:df9ca813fcb97d3be96814b32801c3999c0f7480f159a8c60043077db0a12583",
-  "gen_hash_verilog": "sha256:72db719c662ec54e1f30e6ef9e7da18a4de07b81af7c88b7f16ccf384cb56e98",
-  "gen_hash_zig": "sha256:31da09d08d2231e8d9929d3d457070b6af2ee769c88c1829f71747737879cc44",
+  "gen_hash_c": "sha256:a41a01cb89252953d7546d67fd3ebef35a712c9294ce69f938fc9eed18f421a0",
+  "gen_hash_rust": "sha256:f502ccfe9c15f64f9a7449fbe063bbaef2627818ed99ca91f519f16ce118e34a",
+  "gen_hash_verilog": "sha256:1f0765cff0a7f04862782b1b50e76d82364dae02df769f1e6ec4ad421c29ccd2",
+  "gen_hash_zig": "sha256:3762882f89bc11178837ee7eb234f1b00f8c088df3d6ab748d9bf3cb68247fbb",
   "module": "ClawGithubSurface",
   "ring": 12,
   "seal_schema": 2,
-  "sealed_at": "2026-10-18T22:11:43Z",
+  "sealed_at": "2026-10-18T22:24:38Z",
   "sealed_by": "t27c-bootstrap@0.5.2",
-  "spec_hash": "sha256:42b1a9b096476016af0458355081812f3ca055550ebe12c8c8fcc30e215f0f4c",
+  "spec_hash": "sha256:00bc3ee5080eea25d7854272f8ea671f8d86081348d89b6d841ce80b2924760c",
   "spec_path": "specs/claw/github_surface.t27",
   "tests": {
     "failed": 0,

@@ -199,6 +199,7 @@
   {"path": "specs/claw/check_state.t27", "t27b": "pass"},
   {"path": "specs/claw/control.t27", "t27b": "pass"},
   {"path": "specs/claw/control_pins.t27", "t27b": "pass"},
+  {"path": "specs/claw/criteria.t27", "t27b": "pass"},
   {"path": "specs/claw/engine.t27", "t27b": "pass"},
   {"path": "specs/claw/evidence.t27", "t27b": "pass"},
   {"path": "specs/claw/evidence_pins.t27", "t27b": "pass"},
@@ -208,6 +209,7 @@
   {"path": "specs/claw/lab_disk.t27", "t27b": "pass"},
   {"path": "specs/claw/lab_receipt.t27", "t27b": "pass"},
   {"path": "specs/claw/ledger_union.t27", "t27b": "pass"},
+  {"path": "specs/claw/merge_judge.t27", "t27b": "pass"},
   {"path": "specs/claw/merge_lane.t27", "t27b": "pass"},
   {"path": "specs/claw/model_route.t27", "t27b": "pass"},
   {"path": "specs/claw/move_gate.t27", "t27b": "pass"},