CI: Required CI gate passes when the lifecycle gate fails (skipped jobs read as green) #796

Problem

Required CI gate (the only required check on main) can pass when the lifecycle gate fails and no tests run.

Seen on #795 at bb1d80f2: Lifecycle gate and trust failed, yet SpecSync implementation ready and Required CI gate were green. test, audit, coverage and spec-check never ran.

Cause (.github/workflows/ci.yml on main)

• test, audit, coverage and spec-check have needs: [classify, lifecycle-gate]. When lifecycle-gate fails they end up skipped, not failed.
• implementation-gate (if: always()) has needs: [classify, test, fmt, hi-check, validate-action, action-consumer, spec-check, audit, coverage, site, vscode-extension, corvid-pet]. That list has neither lifecycle-gate nor preflight, and its check accepts success|skipped for every job.
• ci-gate only requires implementation-gate == success.

So a failed lifecycle gate turns into skipped downstream jobs, and those read as green.

Expected

The required gate fails whenever preflight or lifecycle-gate fails, or whenever a job was skipped because something upstream failed rather than because classify deselected it.

Suggested fix

• Add preflight and lifecycle-gate to implementation-gate.needs, and require success from them. Allow skipped only where classify legitimately skips them, for example for archive-only or review-only PRs.
• For each selected job, accept skipped only when classify's outputs say the job wasn't selected.
• Add a regression test or workflow check that fails if a new gated job is added to the workflow without also being added to implementation-gate.needs.

Found by orc while shipping #795. The workaround until this is fixed: check the whole CI rollup, not just the required gate.

🤖 Generated with Claude Code