fix(ci): the NOW sync gate writes nothing to the clone it runs in (Refs #5482)

[dmitrii-f-t27]

Refs #5482

What was wrong

scripts/ci/now-sync-gate-diff.sh ended every passing run with setup_skill_merge_driver (added by #4728 for #3236). That function:

• appended .claude/skills/ci-gates/SKILL.md merge=union to .gitattributes, which left M .gitattributes;
• set merge.union.name and merge.union.driver (bash -c 'cat $BASE $LOCAL $RIGHT > $REMOTE') in the repository's shared .git/config.

Three callers run the script in a contributor's own clone: a direct run, tri gates preview (row check-now-freshness), and tri hooks pre-push (run by .githooks/pre-push, which CONTRIBUTING step 1 installs).

When a merge driver is configured under a name, it replaces git's built-in driver of that name. So this driver replaced the built-in union that .gitattributes uses for .trinity/experience/*.jsonl. git fills in %O %A %B in a driver command, but this command used $BASE $LOCAL $RIGHT $REMOTE, which are unset shell variables. Two branches appending to one *.jsonl file then failed to merge (bash: $REMOTE: ambiguous redirect, exit 1). With the built-in driver the same merge is clean. In CI the writes were lost when the runner was discarded.

Change

• scripts/ci/now-sync-gate-diff.sh: removed the writer. A comment now states that the gate is read-only, says why, and gives the cleanup commands.
• scripts/ci/test_now_gate_writes_nothing.py (new control): runs each caller in its own scratch repository, with an empty global config, on a range the gate passes. The writer only ran after a pass, so a refused range would prove nothing. For each caller, .git/config, .gitattributes, .git/info/attributes and git status must be byte-identical before and after the run, and a two-branch union merge of a *.jsonl log must still succeed afterwards.
  • Controls: the old writer, planted back into the script, must be caught changing both files and must break the same merge.
  • Measured against the unfixed script: all 5 callers fail on both counts (exit 1). Five more planted mutants are each caught: another config key, an unset key, .git/info/attributes, a stray untracked file, and a gate that stops passing. A no-op passes.
  • One repository per caller, because the writer is idempotent. In a first draft the callers shared one repository: the first caller wrote, and the other four rewrote the same bytes and read as clean.
• CI: untrusted-input-gate.yml runs the script's three arms, which need no Rust. cli-tri.yml runs all five callers with --tri ./target/debug/tri, right after the build.
• tools/census/shell.txt: re-blessed. run: steps went from 280 to 282 and "the runner does" from 259 to 261. These are the two new steps.
• .gitattributes: the header comment pointed to .git/config "for implementations". It now says the file uses built-in drivers only. This is a comment change only.
• docs/now/2026-10-01-the-now-gate-writes-nothing-to-the-clone.md: the NOW entry for this change.

SKILL.md conflicts are handled by the spool (ci-gates SKILL.md sections 592-593). Whether SKILL.md should get a committed merge=union line using the built-in driver is a separate decision, and this PR does not add one.

Cleaning an affected clone

git config --unset merge.union.driver
git config --unset merge.union.name
git checkout -- .gitattributes   # only if the appended line is still uncommitted

No commit on master contains the appended line. On 2026-10-01, none of the 52 open PRs touched .gitattributes.

Verified locally

• python3 scripts/ci/test_now_gate_writes_nothing.py --tri ./target/debug/tri: 20 checks ok, exit 0. Without --tri: 14 checks ok, exit 0, and the output says the two tri callers were not run.
• In this clone, tri gates preview --base origin/master and the gate script: the sha256 of the shared .git/config and of .gitattributes is the same before and after, and no merge.* keys exist.
• tri census pin --gate: PASS. test_required_gates_name_their_subject.py: ok. check_now_entry_shape.py: ok.

🤖 Generated with Claude Code

[github-actions]

📓 NotebookLM Notebook linked to this PR

• Notebook ID: b83263109fb055dc
• URL: https://notebooklm.google.com/notebook/b83263109fb055dc

This notebook contains session context, decisions, and artifacts for this work.

[github-actions]

PR Dashboard

Generated at: 2026-10-01 23:47:28 UTC

• ci(fpga-build): run the gate-precondition control when a gate it guards changes, and after a red ratchet (Refs #5453) #5489 ci(fpga-build): run the gate-precondition control when a gate it guards changes, and after a red ratchet (Refs #5453) | Created: 2026-10-01 | Updated: 2026-10-01 | 12 failing / 34 total
• fix(ci): the NOW sync gate writes nothing to the clone it runs in (Refs #5482) #5488 fix(ci): the NOW sync gate writes nothing to the clone it runs in (Refs #5482) | Created: 2026-10-01 | Updated: 2026-10-01 | 9 failing / 33 total
• Port gHashTag/trinity:fpga/openxc7-synth/led_off_test.v (Verilog, 1 module) to specs/port/trinity/fpga/openxc7-synth/led #5487 Port gHashTag/trinity:fpga/openxc7-synth/led_off_test.v (Verilog, 1 module) to specs/port/trinity/fpga/openxc7-synth/led | Created: 2026-10-01 | Updated: 2026-10-01 | 9 failing / 31 total
• Port gHashTag/trinity:src/tri/gen_work_stealing.zig (Zig, 4 functions) to specs/port/trinity/src/tri/gen_work_stealing.t #5486 Port gHashTag/trinity:src/tri/gen_work_stealing.zig (Zig, 4 functions) to specs/port/trinity/src/tri/gen_work_stealing.t | Created: 2026-10-01 | Updated: 2026-10-01 | 8 failing / 31 total
• Port gHashTag/trinity:src/tri/gen_ray.zig (Zig, 3 functions) to specs/port/trinity/src/tri/gen_ray.t27 #5484 Port gHashTag/trinity:src/tri/gen_ray.zig (Zig, 3 functions) to specs/port/trinity/src/tri/gen_ray.t27 | Created: 2026-10-01 | Updated: 2026-10-01 | 7 failing / 31 total
• fix(trinity): the S01 manifest skips build.zig comments and counts the vendored t27 copies apart (Refs #3563) #5474 fix(trinity): the S01 manifest skips build.zig comments and counts the vendored t27 copies apart (Refs #3563) | Created: 2026-10-01 | Updated: 2026-10-01 | 5 failing / 36 total
• Specify contributor key management and attribution boundaries #5473 Specify contributor key management and attribution boundaries | Created: 2026-10-01 | Updated: 2026-10-01 | 5 failing / 36 total
• fix(bootstrap): make cargo test compile again -- honest server gates, E0716 (#5448) #5455 fix(bootstrap): make cargo test compile again -- honest server gates, E0716 (#5448) | Created: 2026-10-01 | Updated: 2026-10-01 | 8 failing / 45 total
• The seal gate is back: a merge her verdict refused had made it one comment line #5454 The seal gate is back: a merge her verdict refused had made it one comment line | Created: 2026-10-01 | Updated: 2026-10-01 | 5 failing / 34 total
• The Queen's accept is the merge: dispatch.t27 says so, and its harness measures it #5452 The Queen's accept is the merge: dispatch.t27 says so, and its harness measures it | Created: 2026-10-01 | Updated: 2026-10-01 | 6 failing / 32 total
• docs(tri): mark the Solana tri-mining program and depin.prove rewards superseded by mint-on-acceptance (Closes #5412) #5413 docs(tri): mark the Solana tri-mining program and depin.prove rewards superseded by mint-on-acceptance (Closes #5412) | Created: 2026-10-01 | Updated: 2026-10-01 | 6 failing / 32 total
• feat(automation): ball-grants -- the mail cards, to others only by the owner's grant (Closes #5387) #5411 feat(automation): ball-grants -- the mail cards, to others only by the owner's grant (Closes #5387) | Created: 2026-10-01 | Updated: 2026-10-01 | 5 failing / 32 total
• spec(automation): kanban-card-chat -- a card opens its agent conversation #5389 spec(automation): kanban-card-chat -- a card opens its agent conversation | Created: 2026-10-01 | Updated: 2026-10-01 | 5 failing / 32 total
• Port gHashTag/BrowserOS:trios/agent-server/apps/server/src/lib/container/image-loader.ts (TypeScript, 2 functions) to sp #5320 Port gHashTag/BrowserOS:trios/agent-server/apps/server/src/lib/container/image-loader.ts (TypeScript, 2 functions) to sp | Created: 2026-09-30 | Updated: 2026-09-30 | 8 failing / 31 total
• A "using" in prose became an import; and the per-spec delta check compared strings #5215 A "using" in prose became an import; and the per-spec delta check compared strings | Created: 2026-09-29 | Updated: 2026-09-29 | 12 failing / 41 total
• Auto-loop 2026-09-29: silent-discard parser family + loop infrastructure #5084 Auto-loop 2026-09-29: silent-discard parser family + loop infrastructure | Created: 2026-09-28 | Updated: 2026-09-29 | 10 failing / 45 total
• Carry wave-loop-898's stranded work: green lean 24/24 (fixes red lean CI), mcp registry spec, research corpus #5081 Carry wave-loop-898's stranded work: green lean 24/24 (fixes red lean CI), mcp registry spec, research corpus | Created: 2026-09-28 | Updated: 2026-09-28 | 10 failing / 36 total
• chore: drop build artifacts tracked since ea15cd54c (#1399), ignore *.rlib #5078 chore: drop build artifacts tracked since ea15cd54c (#1399), ignore *.rlib | Created: 2026-09-28 | Updated: 2026-09-28 | 7 failing / 40 total
• Port gHashTag/BrowserOS:trios/agent-server/apps/server/src/api/services/queen-brief-shape.ts (TypeScript, 2 functions) t #4911 Port gHashTag/BrowserOS:trios/agent-server/apps/server/src/api/services/queen-brief-shape.ts (TypeScript, 2 functions) t | Created: 2026-09-27 | Updated: 2026-09-27 | 11 failing / 31 total
• spec: agent-conversations — several chats per agent, as a compiler-checked contract #4892 spec: agent-conversations — several chats per agent, as a compiler-checked contract | Created: 2026-09-27 | Updated: 2026-09-27 | 10 failing / 31 total
• Seals: 0 of 1072 specs verify, 928 with an unchanged spec_hash — gate it or remove it #4887 Seals: 0 of 1072 specs verify, 928 with an unchanged spec_hash — gate it or remove it | Created: 2026-09-27 | Updated: 2026-09-27 | 12 failing / 40 total
• spec(automation): agent-conversations — several chats per agent #4840 spec(automation): agent-conversations — several chats per agent | Created: 2026-09-26 | Updated: 2026-09-26 | 9 failing / 32 total
• Wave Loop 473 — compiler-backend aggregate tail / live cold-POR CCLK sweep #4801 Wave Loop 473 — compiler-backend aggregate tail / live cold-POR CCLK sweep | Created: 2026-09-24 | Updated: 2026-09-24 | 11 failing / 31 total
• Bare for statements: 2 loops recovered, and 235 of the 240 sites I cited were out of scope #4777 Bare for statements: 2 loops recovered, and 235 of the 240 sites I cited were out of scope | Created: 2026-09-24 | Updated: 2026-09-24 | 10 failing / 31 total
• Generic type parameters dropped from the declaration and kept in the body: -23 errors #4745 Generic type parameters dropped from the declaration and kept in the body: -23 errors | Created: 2026-09-24 | Updated: 2026-09-24 | 12 failing / 31 total
• Implement the 8 empty function bodies in specs/vsa/packed_vsa.t27 #4729 Implement the 8 empty function bodies in specs/vsa/packed_vsa.t27 | Created: 2026-09-24 | Updated: 2026-09-24 | 12 failing / 31 total
• Wave 684: occlusion four deep, and the two files no list ever reached #4660 Wave 684: occlusion four deep, and the two files no list ever reached | Created: 2026-09-23 | Updated: 2026-09-23 | 10 failing / 31 total
• Capture given/when/then and render them: 6540 clauses, and 169 specs share one unfilled placeholder #4642 Capture given/when/then and render them: 6540 clauses, and 169 specs share one unfilled placeholder | Created: 2026-09-23 | Updated: 2026-09-23 | 10 failing / 31 total
• Implement part 2 of 2 of the empty bodies in specs/git/diff.t27 (7 functions) #4634 Implement part 2 of 2 of the empty bodies in specs/git/diff.t27 (7 functions) | Created: 2026-09-23 | Updated: 2026-09-23 | 10 failing / 31 total
• feat(specs/skills): trinity/connect-accounts #4600 feat(specs/skills): trinity/connect-accounts | Created: 2026-09-22 | Updated: 2026-09-22 | 7 failing / 32 total
• Port part 1 of 2 of tools/check_withdrawn_live.py to specs/port/tools/check_withdrawn_live.t27 (8 functions) #4581 Port part 1 of 2 of tools/check_withdrawn_live.py to specs/port/tools/check_withdrawn_live.t27 (8 functions) | Created: 2026-09-22 | Updated: 2026-09-22 | 9 failing / 31 total
• Port part 1 of 2 of tools/check_coq_in_build.py to specs/port/tools/check_coq_in_build.t27 (8 functions) #4578 Port part 1 of 2 of tools/check_coq_in_build.py to specs/port/tools/check_coq_in_build.t27 (8 functions) | Created: 2026-09-22 | Updated: 2026-09-22 | 8 failing / 31 total
• Implement the 1 empty function body in specs/test_framework/verilog_bench_harness.t27 #4565 Implement the 1 empty function body in specs/test_framework/verilog_bench_harness.t27 | Created: 2026-09-21 | Updated: 2026-09-21 | 0 failing / 2 total
• Implement part 2 of 2 of the empty bodies in specs/vm/jit_semantics.t27 (4 functions) #4563 Implement part 2 of 2 of the empty bodies in specs/vm/jit_semantics.t27 (4 functions) | Created: 2026-09-21 | Updated: 2026-09-21 | 8 failing / 31 total
• The C tests handed cc a clang-only flag: 23 red on gcc, and the silent half compiled nothing #4551 The C tests handed cc a clang-only flag: 23 red on gcc, and the silent half compiled nothing | Created: 2026-09-21 | Updated: 2026-09-22 | 5 failing / 44 total
• classify: the browser could not tell a Markdown file from a broken spec (refs #2133) #4541 classify: the browser could not tell a Markdown file from a broken spec (refs #2133) | Created: 2026-09-21 | Updated: 2026-09-22 | 7 failing / 41 total
• Implement the 1 empty function body in specs/test_framework/graph_drift_detection.t27 #4536 Implement the 1 empty function body in specs/test_framework/graph_drift_detection.t27 | Created: 2026-09-21 | Updated: 2026-09-21 | 8 failing / 31 total
• Nothing builds bindings/wasm-explorer, which is how the artifact it replaces drifted in the first place #4498 Nothing builds bindings/wasm-explorer, which is how the artifact it replaces drifted in the first place | Created: 2026-09-21 | Updated: 2026-09-21 | 6 failing / 30 total
• specs/functions: render-job-run, morph-images-generate -- a failed delivery is not delivered #4123 specs/functions: render-job-run, morph-images-generate -- a failed delivery is not delivered | Created: 2026-09-17 | Updated: 2026-09-17 | 4 failing / 30 total
• specs/functions: payment-ai-server-process -- claim-invoice before crediting #4116 specs/functions: payment-ai-server-process -- claim-invoice before crediting | Created: 2026-09-17 | Updated: 2026-09-17 | 4 failing / 30 total
• specs/functions: crm-proactive-sweep -- one step per seller after the 502 runs #4113 specs/functions: crm-proactive-sweep -- one step per seller after the 502 runs | Created: 2026-09-17 | Updated: 2026-09-17 | 4 failing / 30 total
• specs/functions: withdraw five functions from the registry (code-only/unregistered) #4038 specs/functions: withdraw five functions from the registry (code-only/unregistered) | Created: 2026-09-17 | Updated: 2026-09-17 | 4 failing / 30 total
• Feed the swarm from CI, with fuel that does not run out #3978 Feed the swarm from CI, with fuel that does not run out | Created: 2026-09-17 | Updated: 2026-09-17 | 6 failing / 28 total
• specs: bind every tool and skill to the Queen, and name a domain lead #3833 specs: bind every tool and skill to the Queen, and name a domain lead | Created: 2026-09-15 | Updated: 2026-09-15 | 4 failing / 30 total
• agent-provider-chain: probe 4 of the reserve, 402 with max_tokens bounded #3683 agent-provider-chain: probe 4 of the reserve, 402 with max_tokens bounded | Created: 2026-09-15 | Updated: 2026-09-15 | 0 failing / 30 total
• specs/automation: inngest-functions-status.t27 (lastRun без проб, lastProbe отдельно) + inngest-probe-suite VERSION 2 #3593 specs/automation: inngest-functions-status.t27 (lastRun без проб, lastProbe отдельно) + inngest-probe-suite VERSION 2 | Created: 2026-09-13 | Updated: 2026-09-13 | 5 failing / 30 total
• fix(ci): make the JSON gate strict, and make the one file it refuses legal #3395 fix(ci): make the JSON gate strict, and make the one file it refuses legal | Created: 2026-09-07 | Updated: 2026-09-07 | 0 failing / 30 total
• coq(CorePhi): replace proofs that were never checked by a compiler #3343 coq(CorePhi): replace proofs that were never checked by a compiler | Created: 2026-09-06 | Updated: 2026-09-06 | 5 failing / 32 total
• chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 #3001 chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 | Created: 2026-09-01 | Updated: 2026-09-14 | 1 failing / 31 total
• chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 #3000 chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 | Created: 2026-09-01 | Updated: 2026-09-14 | 1 failing / 29 total

Summary

Status	Count
Total Open PRs	50
PRs with Failing Checks	47
PRs with All Checks Green	3
READY	3
FAILING	47
PENDING	0
NO CHECKS YET	0

Seal Status

• ⚠️ STALE -- sha256(compiler.rs)=b7d5cc5c4cf1 != manifest seal=87e5cbd3ad94.
  The committed NMSE numbers were certified against an older compiler.rs.
  Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).