promote: staging → main (2026-10-20) — 58c6d0a43

[fedcourtsai-dev]

Drafted by the promotion train at 2026-10-20T12:46Z for promote/2026-10-20 at 58c6d0a43 over main fa29d24a2. The branch was cut from staging and never moves, so the integration evidence and an approval of this head stay valid while staging carries on. The train regenerates the block between the markers while this PR is open; write anything else outside it.

Gate status (promote/2026-10-20 at 58c6d0a43):

• freshness: not yet — freshness: no green 'ranged-reads' integration-test run at 58c6d0a;freshness: no green 'corpus-service' integration-test run at 58c6d0a;freshness: no green 'stub-cascade' integration-test run at 58c6d0a
• registry: not yet — registry: predictor codex-baseline computes sha256:70fee158526caa6870d43ace70c3781db39f644379c86c363538ebdefa57547c, which the registry does not register; run fedcourts register-process in the PR that moved it;registry: predictor gemini-baseline computes sha256:a9033e56819e775e561b802dec24bae437c17c751e5a7f5fa4b3eeb31383951f, which the registry does not register; run fedcourts register-process in the PR that moved it;registry: evaluator codex-judge computes sha256:18a76b9301aef6770b5c5f9965dd6fcabb2a929964a56be2151405ce878e0456, which the registry does not register; run fedcourts register-process in the PR that moved it
• contexts (admin read, run by hand): due — the batch changes .github/workflows/ci.yml, .github/workflows/integration-test.yml, .github/workflows/promotion-prep.yml, .github/workflows/run-analytics.yml, .github/workflows/run-backtest.yml (+9 more).
  Run scripts/promotion-gate.sh contexts with an admin-read token before merging.
  It reads main's workflows, so for the workflow changes run scripts/promotion-gate.sh contexts again once this merges.

Train: the process registry gate refuses this head, so the integration gate is not dispatched (see the run's annotations); fix it on staging and close this candidate

Next (maintainer): read the batch and approve this PR at 58c6d0a43. The train then merges it with a merge commit once the integration gate run, the required checks and the registry gate hold at this head and no predict/evaluate/back-test round is in flight. Merging it yourself instead is fine. To stop it, request changes or close it: a closed candidate is not re-cut at the same staging tip, and the next one is cut when the train is dispatched after staging moves.

The batch

• docs(security): record the case-sensitive ruleset patterns and the case-variant guard #2543: docs(security): record the case-sensitive ruleset patterns and the case-variant guard
• docs(security): align the token table, App grants and environment lists with the workflows #2544: docs(security): align the token table, App grants and environment lists with the workflows
• fix(ci): drain the credential tripwires' grep; spend ceiling to $3,000 #2545: fix(ci): drain the credential tripwires' grep; spend ceiling to $3,000
• fix(documents): bound the contact scrub's email shape; leave Ohio State Reports citations alone #2546: fix(documents): bound the contact scrub's email shape; leave Ohio State Reports citations alone
• fix(summaries): withhold staged documents the contact scrub left residuals on #2547: fix(summaries): withhold staged documents the contact scrub left residuals on
• test(ci): cut the gate's slowest tests without dropping coverage #2548: test(ci): cut the gate's slowest tests without dropping coverage
• test(ci): build the CLI's Click tree once per test process #2549: test(ci): build the CLI's Click tree once per test process
• feat(process-version): proc-v10 — codex pair → gpt-6.1-sol, gemini pair → gemini-4-argon #2550: feat(process-version): proc-v10 — codex pair → gpt-6.1-sol, gemini pair → gemini-4-argon
• config(review-hold): auto-release budget to $2,500 #2556: config(review-hold): auto-release budget to $2,500
• docs(security): the production read-write role's trust names corpus-write alone #2557: docs(security): the production read-write role's trust names corpus-write alone
• fix(sync-staging): arm auto-merge through GraphQL with a bounded retry #2558: fix(sync-staging): arm auto-merge through GraphQL with a bounded retry
• fix(live): an ancillary paper's distribution never opens the distribution moment #2559: fix(live): an ancillary paper's distribution never opens the distribution moment
• feat(release): commit a release manifest the site reads from main #2560: feat(release): commit a release manifest the site reads from main
• feat(registry-gate): refuse a batch that changes a row main has stamped #2561: feat(registry-gate): refuse a batch that changes a row main has stamped
• fix(salience): free an interim reserve slot whose occupant's docket reads disposed #2562: fix(salience): free an interim reserve slot whose occupant's docket reads disposed
• feat(summaries): withdraw summaries of a re-docketed number's earlier petition #2563: feat(summaries): withdraw summaries of a re-docketed number's earlier petition
• fix(salience): hold one interim reserve slot per application number #2564: fix(salience): hold one interim reserve slot per application number
• feat(set-aside): set aside scotus/9026000455 under a new pre-distribution-mint reason #2565: feat(set-aside): set aside scotus/9026000455 under a new pre-distribution-mint reason
• fix(evaluate): move a judge's misfiled retrieval.md/tooling.json to the cell level at stamp time #2567: fix(evaluate): move a judge's misfiled retrieval.md/tooling.json to the cell level at stamp time
• feat(schedule): publish each pending public docket's next conference #2568: feat(schedule): publish each pending public docket's next conference
• feat(votes): derive merits lineups for every recorded decision from the corpus #2569: feat(votes): derive merits lineups for every recorded decision from the corpus
• feat(corpus): a remote-writes switch only the corpus writer jobs set #2570: feat(corpus): a remote-writes switch only the corpus writer jobs set
• fix(judgment): read summary rulings, Rule 46 decrees and per-docket clauses #2572: fix(judgment): read summary rulings, Rule 46 decrees and per-docket clauses
• fix(cert): refuse partial and conditional exits, read plural grants, restore wrongly recorded exits #2573: fix(cert): refuse partial and conditional exits, read plural grants, restore wrongly recorded exits
• ci(run-repair): give the corpus job's dry run the read-only role and no write credential #2574: ci(run-repair): give the corpus job's dry run the read-only role and no write credential
• feat(stamp): audit a predict cell's logged calls for reads and writes outside its lane #2575: feat(stamp): audit a predict cell's logged calls for reads and writes outside its lane
• ci: measure coverage on pushes to main only, not on every PR run #2576: ci: measure coverage on pushes to main only, not on every PR run
• docs: map document provisioning; record the OCR sweep carve-out as decided #2580: docs: map document provisioning; record the OCR sweep carve-out as decided
• feat(cert): read probable jurisdiction noted as a direct-appeal grant #2582: feat(cert): read probable jurisdiction noted as a direct-appeal grant
• feat(public-update): a write-once weekly update history under metrics/updates for the site #2583: feat(public-update): a write-once weekly update history under metrics/updates for the site
• ci: land data-run PRs as merge commits under their PR titles #2587: ci: land data-run PRs as merge commits under their PR titles
• Sync: chore: sync main into staging #2551, chore: sync main into staging #2584

Effect checks

#2546: fix(documents): bound the contact scrub's email shape; leave Ohio State Reports citations alone

uv run pytest tests/test_documents.py -k "ohio or linear_time or not_a_contact or mailing_address" is green, and uv run fedcourts process-digest --all prints the same label and six digests at the carrying merge as at its first parent.

#2547: fix(summaries): withhold staged documents the contact scrub left residuals on

On the next summarize run after promotion, the stage job's summary line reads stage check: … kept, … removed, M document(s) withheld. A case with residual-flagged documents shows ::warning::removed scotus/<docket>/<kind> from the staged records: document withheld: <n> contact residual(s). uv run pytest tests/test_summaries.py -k stage is green.

#2550: feat(process-version): proc-v10 — codex pair → gpt-6.1-sol, gemini pair → gemini-4-argon

After the carrying promotion, the next run-predict codex and gemini cells carry process_version.label: proc-v10 with digests 7ab92dd4… / bee46e92…. Their usage.json records "model": "gpt-6.1-sol" / "gemini-4-argon", with cost lines at the new rates.

To check:

• git grep -l '"model": "gpt-6.1-sol"' origin/main -- data/cases | wc -l is greater than 0, and the same for gemini-4-argon.
• Then re-run uv run fedcourts successor-disclosures --closed proc-v8 --successor proc-v10 for the dated follow-up entry.

#2557: docs(security): the production read-write role's trust names corpus-write alone

None at run time; this is documentation. The IAM change itself is checked by the next scheduled run-pull window succeeding under corpus-write.

#2587: ci: land data-run PRs as merge commits under their PR titles

After promotion, the first data-run PR merged by its job lands as a merge commit with the PR title as its subject:

git log origin/main --first-parent --merges --format='%s' -5

This should show predict: N prediction(s) (run …) (#N)-style subjects. It should not show Merge pull request #N from ModelMirrorAI/run/… for job-merged PRs.

No effect-check note found. Add one to the feature PR's description (the next refresh picks it up) or write it below the end marker, or say there why none applies:

• docs(security): record the case-sensitive ruleset patterns and the case-variant guard #2543: docs(security): record the case-sensitive ruleset patterns and the case-variant guard
• docs(security): align the token table, App grants and environment lists with the workflows #2544: docs(security): align the token table, App grants and environment lists with the workflows
• fix(ci): drain the credential tripwires' grep; spend ceiling to $3,000 #2545: fix(ci): drain the credential tripwires' grep; spend ceiling to $3,000
• test(ci): cut the gate's slowest tests without dropping coverage #2548: test(ci): cut the gate's slowest tests without dropping coverage
• test(ci): build the CLI's Click tree once per test process #2549: test(ci): build the CLI's Click tree once per test process
• config(review-hold): auto-release budget to $2,500 #2556: config(review-hold): auto-release budget to $2,500
• fix(sync-staging): arm auto-merge through GraphQL with a bounded retry #2558: fix(sync-staging): arm auto-merge through GraphQL with a bounded retry
• fix(live): an ancillary paper's distribution never opens the distribution moment #2559: fix(live): an ancillary paper's distribution never opens the distribution moment
• feat(release): commit a release manifest the site reads from main #2560: feat(release): commit a release manifest the site reads from main
• feat(registry-gate): refuse a batch that changes a row main has stamped #2561: feat(registry-gate): refuse a batch that changes a row main has stamped
• fix(salience): free an interim reserve slot whose occupant's docket reads disposed #2562: fix(salience): free an interim reserve slot whose occupant's docket reads disposed
• feat(summaries): withdraw summaries of a re-docketed number's earlier petition #2563: feat(summaries): withdraw summaries of a re-docketed number's earlier petition
• fix(salience): hold one interim reserve slot per application number #2564: fix(salience): hold one interim reserve slot per application number
• feat(set-aside): set aside scotus/9026000455 under a new pre-distribution-mint reason #2565: feat(set-aside): set aside scotus/9026000455 under a new pre-distribution-mint reason
• fix(evaluate): move a judge's misfiled retrieval.md/tooling.json to the cell level at stamp time #2567: fix(evaluate): move a judge's misfiled retrieval.md/tooling.json to the cell level at stamp time
• feat(schedule): publish each pending public docket's next conference #2568: feat(schedule): publish each pending public docket's next conference
• feat(votes): derive merits lineups for every recorded decision from the corpus #2569: feat(votes): derive merits lineups for every recorded decision from the corpus
• feat(corpus): a remote-writes switch only the corpus writer jobs set #2570: feat(corpus): a remote-writes switch only the corpus writer jobs set
• fix(judgment): read summary rulings, Rule 46 decrees and per-docket clauses #2572: fix(judgment): read summary rulings, Rule 46 decrees and per-docket clauses
• fix(cert): refuse partial and conditional exits, read plural grants, restore wrongly recorded exits #2573: fix(cert): refuse partial and conditional exits, read plural grants, restore wrongly recorded exits
• ci(run-repair): give the corpus job's dry run the read-only role and no write credential #2574: ci(run-repair): give the corpus job's dry run the read-only role and no write credential
• feat(stamp): audit a predict cell's logged calls for reads and writes outside its lane #2575: feat(stamp): audit a predict cell's logged calls for reads and writes outside its lane
• ci: measure coverage on pushes to main only, not on every PR run #2576: ci: measure coverage on pushes to main only, not on every PR run
• docs: map document provisioning; record the OCR sweep carve-out as decided #2580: docs: map document provisioning; record the OCR sweep carve-out as decided
• feat(cert): read probable jurisdiction noted as a direct-appeal grant #2582: feat(cert): read probable jurisdiction noted as a direct-appeal grant
• feat(public-update): a write-once weekly update history under metrics/updates for the site #2583: feat(public-update): a write-once weekly update history under metrics/updates for the site

After the merge

1. Tag promotion/<YYYY-MM-DD> on the merge commit (-2 for a same-day second batch).
2. Fill the freeze-record placeholders this batch owes:
   • <FILL: census evaluations digest=a8610eec,6a88d3dc>
   • <FILL: census predictions digest=7ab92dd4,bee46e92>
   • <FILL: merge sha>
   • <FILL: merged-at>
   • <FILL: promotion tag>
3. Run the effect checks above and record what they printed.