arena: #787 execution kit — owner rulings 2026-09-26 (D12, D14, D24, D29, D43)

[arena-ai-coding-agent]

What this is

The five owner-only rows held back from the 2026-09-23 batch on #787 were answered by the owner on 2026-09-26 (via selection UI). The answering session (an Arena.ai agent, read-only on the issues API) could not post the rulings itself, so this PR carries the execution kit:

• arena-session-787/owner-rulings-comment-2026-09-26.md — the ruling comment, paste-ready (house format: struck rows, verbatim owner quotes, consequence per row)
• arena-session-787/787-execution-kit.md — the three execution steps plus the two owner-only browser steps:
  1. Post the ruling comment on Owner decision sheet D1–D72: one answerable place for #637 + #715 + #709 + #658 and this week's unfiled decisions #787
  2. Strike the five rows in the issue body (exact find/replace blocks, F4a convention: strike, never delete)
  3. File the fresh D29 plugin-host issue (title + body included)
  • Owner-only, browser: the D12 GitHub for Nonprofits application; the D16 Settings → Applications glance at app IDs 1561 / 85455 / 946600

Any write-capable session may execute steps 1–3 on the owner's behalf; the rulings were given by the owner on 2026-09-26.

Verification state (2026-09-27)

• Owner decision sheet D1–D72: one answerable place for #637 + #715 + #709 + #658 and this week's unfiled decisions #787 body unchanged since 2026-09-23T17:28Z — all five Find-blocks byte-match the live body
• Based on main @ 2479cf7 (2026-09-24); markdown-only addition, no code or workflow changes

Merge optional

The kit is executable from the branch as-is; merging simply persists it in-tree. Kept as draft until the rulings land on #787 — then merge or close at owner discretion.

Note: this repo's required-check set includes gates already recorded as unsatisfiable or red on every PR (#1040, #955, #935). Any red here is expected to be pre-existing, not introduced by this PR.

Rulings given by the owner 2026-09-26 · kit assembled by an Arena.ai agent session.

---

Addendum 2026-09-27 — merge attempted on owner instruction; refused by the main gate

The owner instructed the merge. Both routes were attempted and refused:

1. Normal squash merge → X not mergeable: the base branch policy prohibits the merge.
2. Admin squash merge → Repository rule violations found — 22 of 22 required status checks are expected. Code scanning is waiting for results from CodeQL for the commits d1d40f9 or 5ae9c59.

Measured state of ruleset 23787415 ("main gate: append-only + required checks + signatures + scanning"): enforcement: active, bypass_actors: [] — no actor, including admins, may merge over it. Rules: deletion, non_fast_forward, required_status_checks, required_signatures, code_scanning.

The 22 required contexts (none reported on this PR): CodeQL · SPARK Theatre Gate · SonarCloud Code Analysis · analyze-actions / analyze · analyze-js / analyze · 14× governance / … (Actions lockfile verify, Check Workflow Staleness, Code quality + docs, Debt ratchet, Exemption ratchet, Guix packaging policy, Language/package anti-pattern policy, Licence consistency, Security policy checks, Trusted-base reduction policy, Well-Known, Workflow security linter) · scan / Hypatia Neurosymbolic Analysis · scan / gitleaks · scan / rust-secrets · scan / shell-secrets · uses ⊆ actions.lock.

The five checks that did run all passed (CodeFactor, CodeRabbit, Codeac analyze results, GitGuardian, semgrep) — none of them are in the required set.

Consequence: standards is currently merge-locked for every actor — a markdown-only PR carrying an explicit owner instruction cannot land. This is the live, measured instance of the already-filed #1040 class (a required context no PR can produce), compounded by #955 / #935 (permanently-red ratchets) and #1050 (Hypatia scan produces no SARIF at current main). Last merge on the repo: #1048, 2026-09-24.

Options on the table:

• A (doctrinal): cure the gate first — re-scope required_status_checks to contexts that actually report on PRs (D84/D86a precedent), then merge normally.
• B (expedient): owner edits/disables the ruleset, merges, restores. The "disable-to-merge" shape this estate records as a defect.
• C (interim): leave this PR open — the branch is on the remote and the kit is executable from it by any write-capable session without merging.

Merge attempts and evidence recorded by the Arena.ai agent session, 2026-09-27.

---

RESOLUTION — merged 2026-09-27T09:42:39Z

Merged by hyperpolymath (owner), squash commit 7b2060bc on main (both kit files landed). The owner executed the merge after the two refusal routes were recorded above.

Post-merge verification (2026-09-27, this session): ruleset 23787415 ("main gate") is active, 5 rules, zero bypass actors, and byte-identical to the pre-merge backup committed at arena/01a0dd13-standards@b293e92 (arena-session-787/ruleset-23787415-backup-2026-09-27.json) — the gate was fully restored after the merge. The main-branch lock from the 19/19 startup failures (D39 posture + #1037) remains a live finding for #1040/#1037/#1050 and does not affect this closed PR.

Loose end, recorded: the merge fired at head 5ae9c59 (2 files); the follow-up commit b293e92 (ruleset backup + B-protocol) was pushed seconds after the merge auto-deleted the branch (delete_branch_on_merge: true) and therefore lives only on the session branch, not on main. The B-protocol is moot now that the merge is done; the backup served its verification purpose above.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 14f55f0b-fd77-4847-b00d-48d54de4dc56

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}