grim7/14/2026, 3:09:01 AM

Tripwire exempts anyone with write+ access, so the same-repo push flow can't
produce a verdict in production (the pusher is a maintainer). Add an env-gated
FORK MODE: set TEST_CONTRIBUTOR and the script gh-auth-switches to that account,
forks TEST_REPO, and opens a CROSS-REPO PR from the fork — a fork PR author has
read-only base access, so it's genuinely non-exempt and the gate fires on prod.
Drives all three phases as the contributor, then restores the maintainer account
(TEST_MAINTAINER) on exit. No tokens — pure gh account switching.

Optional TEST_MERGE capstone clears the PR and squash-merges it as the
maintainer. The same-repo/local flow (TRIPWIRE_DISABLE_EXEMPTION) is unchanged
when TEST_CONTRIBUTOR is unset.

Parentb679f28