I1954 — Every runner reaches the ledger, through the recording branch

✕BLOCKED wave 2 · p1 · implementation profile · runs alone

Part of test-evidence — Every verifiable claim and widget resolves to revision-bound test evidence, on every surface.

Objective

Wire the trunk's runs to the recording branch of ADR 0080 and every runner to a measured report, so that a merge to master is followed by one recording pull request that changes only the ledger (ADR 0087 decisions 1, 6 and 16).

Why

CI runs every test on every merge and keeps none of it in the tracked ledger. Until this lands, the ledger holds only local rows and the site renders mostly not_run.

Current state

No workflow records CI's executions into the tracked ledger. The suite runner's report has no reason column and no measurement, and the crate and coverage runners emit no provenance.

Desired state

A trunk run, after a merge and on a schedule, records with --origin ci and with the provenance evidence stamp measured, and opens at most one recording pull request whose diff is the ledger, by a token whose events start the required workflow; a trunk commit that the ledger committed in it already covers (the newest ci execution's commit is contained in it and nothing but the ledger changed since), as the landing of a recording pull request on the commit it measured is, starts no recording, while a ledger-only commit on top of a merge no landed recording covers is recorded; every runner's report carries its revision and the reason a case did not pass.

Scope

• .github/workflows/validate.yml
• scripts/ci/evidence-collect
• scripts/rust-check
• scripts/rust-coverage
• scripts/shell-coverage
• test/run.sh
• test/cases/94_ci_plan.sh
• test/cases/357_ci_records_evidence.sh
• test/cases
• .ai/repo/automation/inventory.jsonl
• docs/EVIDENCE.md
• docs/COVERAGE.md
• docs/CLAIMS.yaml
• docs/claims
• .ai/repo/features/evidence.md
• .ai/repo/features/ci.md
• .ai/repo/features/coverage.md

Out of scope

• Committing the ledger from a validating run
• New shell automation (ADR 0069)
• Making the required ci check depend on the evidence job

Dependencies

• I1951○READY Evidence runs are typed, and a recording carries what its run measured

What waits on this

• I1959✕BLOCKED The evidence publication is typed, bound to its build, and kept on gh-pages

Acceptance criteria

• A trunk run's executions reach the tracked ledger only through a recording pull request whose diff is the ledger alone, and at most one such pull request is open
• The recording pull request starts the required workflow, by the token the owner chose
• A covered trunk commit starts no recording, whether a merge or the schedule started its run: the newest ci execution in the ledger committed in it names a commit it contains, and nothing but .ai/repo/evidence/ledger.json changed since, so that landing a recording pull request on the commit it measured opens no further one (ADR 0087 decision 1); asserted by case 510
• A ledger-only commit that lands on top of a merge no landed recording covers is recorded, by the run its landing starts and by the schedule: case 510 lands the recording of one merge on top of a later merge whose recording was lost, and asserts that the next run records instead of stopping
• A recording job that cannot compare the ledger's commit with the trunk commit fails and says why, and neither records nor stops as covered; asserted by case 510
• Every runner's report carries the commit and tree its run measured, and a case that did not pass carries its reason

Validation

• bash test/run.sh 510_ci_evidence_reaches_the_ledger_through_a_recording_branch
• bash test/run.sh 511_every_runner_report_carries_its_revision_and_reason
• bash test/run.sh 357_ci_records_evidence
• bash test/run.sh 94_ci_plan

Evidence required

• recording_branch_wired
• recording_stops_at_a_covered_commit
• recording_resumes_over_an_unrecorded_merge
• runner_reports_measured

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

It also waits on PR #629 (the skip word), PR #587 (new shell refused), PR #566 and PR #355, and on the owner's choice of token (ADR 0087 decision 16). Each recording costs a full suite run.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I1954.yaml. Read it back with majordomus plan show I1954.