4 months ago
8b250b5
@1 required merged change requests IN THIS repo — unsatisfiable for any
first-timer (to merge here you must open here; to open you must already
have merged here). a repo with min:1 silently banned every new
contributor forever, and its "wait" remedy was a lie.
ship @2; leave @1 FROZEN and registered (stored runs stay interpretable).
- new meaning: GLOBAL merged change requests, excluding repos the
contributor owns (`author:X is:pr is:merged -user:X`). the real signal
is "someone else accepted their work" — unforgeable by a self-created,
self-merged PR. push-to-others'-repos isn't a cheap search qualifier;
excluding by ownership closes the stated attack (recorded limitation).
- mergedInRepo becomes an EXEMPTION, not a requirement: a proven local
contributor (>= trustedAfter merges here) passes regardless of global
count. the count stays in evidence — a free trust signal.
- ForgeAdapter contributor read gains mergedElsewhere: number | null;
null (not 0) on a failed read, so the rule SKIPS rather than guesses.
- config { min: 1, trustedAfter: 1 } with .describe() on every field.
safe: the rule is non-baseline (off until enabled), and min:1 is always
satisfiable (contribute anywhere you don't own) — the property @1
lacked.
- remedy honestly "wait" with a threshold-free waitHint; publicEvidence
exposes observed counts only (leak-invariant holds).
history proven untouched: `bun run replay --corpus` = 15 runs · 13
unchanged · 2 flips · 0 skipped (both flips pre-existing, on
account-age@1). tests: @1 frozen, @2 pass/fail/skip/exempt, self-owned
merge excluded, global-unavailable ⇒ skip, registry + leak invariants.
checks: typecheck all, biome, boundaries, 223 tests.Parentc112fbe