grim7/12/2026, 12:40:07 AM

queue #10 (maintainer-exemption integration test failing) was ENVIRONMENTAL,
not a code regression — TRIPWIRE_DISABLE_EXEMPTION had leaked into the process
env during a live-test pre-flight; the worker reads it at run time, so the
maintainer test saw a run. verified: passes 12/12 on a clean env.

- exemption.ts: isExemptionDisabled(env) is pure and REFUSES the flag under
  NODE_ENV=production (resolveAuthPosture pattern — fails toward keeping
  maintainers exempt, never gated in prod by a stray flag)
- run-workflows uses it + logs a loud warn when the flag is refused in prod
- worker integration tests (process-event, toggles) delete/restore the flag in
  setup — proven: the maintainer test passes even with the flag set ambiently
- exemption.test.ts: refusal in prod + the affordance (flag set in dev ⇒ disabled)
- VERIFICATION-QUEUE #10 closed with root cause; all-summaries session entry

checks: biome clean · 12/12 typecheck · boundaries ok · 145 tests, 0 fail

Parentef9b797