grim8/23/2026, 1:37:51 AM

Three live scenarios against open-git.com/boring/playground:

- english-only-block: a non-latin title blocks, then a pull_request.edited with
  a latin title FLIPS the same commit's check to success. That is the only way
  a verdict changes without a push, and it exercises change-request.updated and
  the check upsert together.
- english-only-pass: a latin title clears the gate.
- blocked-rules-decline: all eight rules open-git cannot feed, in one gate. The
  check alone cannot tell a skip from a failure, so this reads run_steps and
  asserts each rule recorded skipped WITH a reason. A rule that cannot run must
  decline; silently vouching for a change it never examined is the worst
  failure a spam gate has.

--inject posts the signed delivery straight at a local api. A quick tunnel gets
a new hostname on every restart, so the bot's webhook url goes stale and a run
dies waiting for a delivery posted into the void. It skips one hop — open-git's
outbound POST — and everything after it is real: real signature check, real
normalization, real engine, real check written back over open-git's api.

The delivery id is keyed per EVENT, not per commit. Keyed on the sha alone a
re-title looked like a replay and was discarded, which proved dedupe works and
made the edit event untestable.

Parent5360bf3