I2750 — The trunk's drift gate reads the forge before it judges

○READY wave 2 · p0 · implementation profile · parallel safe

Part of truthful-plan-surfaces — The plan's surfaces are inferred from delivery, and nothing they show is typed beside the repository.

Objective

The structure job that runs scripts/ci/plan-drift-check on the trunk records the forge first (open pull requests and merged pull request titles), and a finding the gate could not settle because the forge went unread is reported as unjudged rather than refused.

Why

On 2026-10-16 I2748 measured plan drift at origin/master d1162668036 twice: with the forge unread it reported 23 merged_not_recorded, with `majordomus prs refresh` and `majordomus served forge` run first it reported 16. The seven extra (I2059, I2114, I2123, I2124, I2132, I2282, I2288) each have an open pull request naming them, which the definition excludes. CI's checkout has no recorded forge, so every finding there says unread: forge; under blocking enforcement the trunk would turn red on work that is still in flight.

Current state

scripts/ci/plan-drift-check asks `majordomus plan drift --gate trunk` in a fresh checkout whose .ai/local holds no forge observation; the executable reports the forge unread and judges every finding without it.

Desired state

On the trunk the job runs `majordomus prs refresh` and `majordomus served forge` with the job's GH_TOKEN (pull-requests: read, deployments: read) before the gate. A finding still carrying unread: forge is PENDING with a NOTE naming the forge, never REFUSED, so an unreadable forge cannot turn the trunk red, and a settled finding past the window is refused as before.

Scope

• scripts/ci/plan-drift-check
• .github/workflows/validate.yml
• .ai/repo/ci/gates.yaml
• apps/majordomus-cli/src/plan/drift.rs
• test/cases/3101_merged_work_unrecorded_is_drift.sh

Out of scope

• A token with write access: the gate reads the forge and nothing else.

Dependencies

• I2741✓DONE Merged work the plan has not recorded is drift, and on the trunk past a window it is red

What waits on this

• I2748✕BLOCKED The drift already on the trunk is settled before the gate is made blocking

Acceptance criteria

• The trunk's plan-drift step reads the forge before it judges, and its output names how many open pull requests it read
• A merged_not_recorded finding whose forge is unread is never refused on the trunk
• A settled finding past the window is still refused under blocking enforcement

Validation

• bash test/run.sh 3101_merged_work_unrecorded_is_drift

Evidence required

• unread_forge_never_refuses

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I2750.yaml. Read it back with majordomus plan show I2750.