fix(gate): fail-open guard, shared osv diff-mode, required-checks rename

Andrew Dunnrequested to merge
fix/automerge-gate-fail-open-and-input-rename into main

What

Three correctness and consistency fixes that align the public-sector gate components with the dunn.dev and nomograph estate catalogs. From an adversarial review of the automerge-gate components across all three estates.

DO NOT MERGE without human review. This is a customer-facing catalog and the gate governs customer-shipping artifacts.

Fixes

  1. Fail-open guard. The gate aggregation loop ran under set -uo pipefail with no guard that any check executed. If required-checks rendered empty or was typo'd, the loop body never ran; non-shipping classes then fell through to GATE GREEN / exit 0, a fail-OPEN hole. The gate now tracks an evaluated counter and blocks (exit 1) when zero checks were evaluated, before the customer-shipping floor and the non-shipping path.

  2. Shared OSV diff-mode semantics. osv-verdict did a bare checkout of the merge-base and full-scanned on a shallow-clone miss or base-scan error, producing a divergent verdict for identical input (it blocked on PRE-EXISTING findings). This ports ensure_base_reachable (deepen / fetch the base SHA / unshallow) and fail-closes when the base stays unreachable, matching dunn.dev and nomograph so all three catalogs share one diff-mode semantics.

  3. Input-name drift. The gate input was required_checks (underscore); dunn.dev and nomograph use required-checks (hyphen). Standardized on the hyphen form, updating the sim consumers and README references.

Proof

Verified locally across all gate paths:

  • empty required-checks, customer_shipping=false -> exit 1 (blocked by the fail-open guard before the non-shipping path)
  • osv=pass, customer_shipping=false -> exit 0 (GREEN)
  • osv=pass, customer_shipping=true -> exit 1 (human review required; floor holds)

Notes

  • There is an existing unmerged remote branch fix-osv-verdict-merge-base-reachability. This MR supersedes it by porting the same reachability logic; that branch can be closed.
  • Once merged, public-sector needs a release tag that includes the gate components (osv-verdict + automerge-gate) so consumers can pin them. The current latest tag is v4.0.2; the gate components are not in any released tag yet.

Merge request reports