fix(ci): follow the server after the reviewer context was de-required (BACKLOG #1452)

[wshallwshall]

What

The owner removed a reviewer has read this from main's branch protection on 2026-09-04. The checked-in claim did not follow, so .github/required-contexts.txt over-reported the required set by exactly one context. This makes the file, its pinned count, and the four other in-repo claims reconciled against it agree with the server again.

Filed as BACKLOG #1452, whose row is the last commit here.

The server, re-measured rather than taken on trust

gh api repos/MEFORORG/MessageFoundry/branches/main/protection, read at 2026-09-04 18:48 CDT:

Reading	Value
required contexts	13
the file named	14
the difference	exactly a reviewer has read this; the other twelve matched both ways
strict	TRUE
enforce_admins	TRUE
required_approving_review_count	0

Why this is wider than two lines

Removing one context from the canonical file moves five in-repo claims reconciled against it. I found them by running the suite and reading its failures, not by guessing.

File	What moved
.github/required-contexts.txt	the context line, the set-equal header read, and a new DELIBERATELY NOT REQUIRED entry recording the de-requiring and its cost
tests/test_required_contexts.py	the pinned count, 14 to 13, plus the module docstring
docs/CI.md	the required-checks bullet and the review-gate paragraph
tests/test_security_posture.py	13 contexts resolving to 11 distinct jobs, was 14 over 12
tests/negative_controls.toml	the review-gate control entry, since the registry refuses a control naming a context nobody requires
tests/test_merge_gate_controls.py	header prose, and one assertion that the context is required

The negative controls were de-registered, not deleted. review-gate.yml still runs, so the nine nodes that entry named still hold its real behaviour inside the required test legs. test_the_review_gate_still_reports_under_the_required_context_string did assert the context was required, which is now false; it kept its three structural assertions and was renamed to ..._under_its_declared_context_string. A re-arm is still caught, by the registry reconciliation failing on a required context with no control.

An unrequired gate caught this, and the required suite could not

tests/test_required_contexts.py compares in-repo text to in-repo text, so all nine tests stayed green while the claim was false. scripts/ci/check_required_contexts_drift.py reads the server and fails closed, and it was red on main for this drift. It is deliberately not one of the 13, so it reported and blocked nothing.

Watched fail rather than argued:

• pre-fix file: exit 1, naming a reviewer has read this under NAMED IN THE FILE, NOT REQUIRED ON THE SERVER
• corrected file: exit 0, 13 against 13

Checks

Check	Result
ruff check .	passed
ruff format --check .	1241 files already formatted
mypy messagefoundry	no issues in 267 source files
pytest tests/test_required_contexts.py	9 passed
pytest tests/test_push_guard.py	passed
the seven coupled suites together	143 passed
check_required_contexts_drift.py	exit 0, and exit 1 on the pre-fix file
backlog_status_check.py	OK, 666 items each declaring one status
backlog_citation_check.py --base origin/main	OK, 0 citations in scope
pre-commit, both commits	all hooks passed, no --no-verify

Not run locally: the hosted-runner-only legs. windows-service-smoke and the server-DB legs need reading after CI reports.

Expect a red a reviewer has read this on this PR

The workflow still exists and still reddens an unlabelled pull request. It blocks nothing now. Do not label this PR to silence it, and do not treat it as a failure of this change.

CI is queue-deep at the time of writing, so every check will sit pending for roughly forty minutes. Pending is not nearly-green.

Deliberately not done

• Branch protection is untouched. That is the Lander's.
• review-gate.yml is untouched. Whether it is retired is an open owner decision.
• CLAUDE.md is not rewritten here. It is now stale on this subject: section 5 still describes the Reviewer seat and still states that the reviewed label gates a merge. No test I had to satisfy forced the edit, so it stays a named follow-on rather than an unreviewed rewrite folded into a drift fix. .github/workflows/unread-signal.yml and scripts/ci/check_unread_prs.py are the same shape: they notify a reviewer about a gate that no longer blocks. The #1452 row records all three.

Two burned numbers, named so nobody reads three defects

• 1449 was allocated by a peer seat for this same drift and left unfiled.
• 1451 this seat allocated from the primary checkout by mistake. Ledger ownership keys on the allocating worktree or its branch and is non-transferable, so it is claimed by main in a tree that must never commit it. Unusable, and recorded rather than hidden.
• 1452 was re-allocated from this worktree and is the only one naming this work. scripts/coord/alloc_strand_sweep.py already exists for stranded allocations.

🤖 Generated with Claude Code