Tier 3: Independent Evidence Runner (CI adjudicator)

[kirder24-code]

Tier 3: Independent CI adjudicator

Runcap can now recompute a pull request's merge decision in a clean CI job from
the PR's base commit, never trusting the agent or the agent's receipt. This
is the layer that turns Runcap from a single developer's terminal tool into a
required red/green PR check: an AI-generated change has to earn merge
eligibility instead of asserting it.

What this PR adds

• runcap ci --mode adjudicate - the CI-side judge. It reads the mission policy
  and the verification command (plus the files it names) from the base
  commit, applies only the diff's allowed, in-scope, regular UTF-8 text edits,
  and replays the base-pinned verifier in a throwaway worktree: the verifier
  must fail at base and pass after the change, or the verdict is not PASS.
• Three verdicts: PASS (exit 0), BLOCKED (exit 1), and
  HUMAN_APPROVAL_REQUIRED (exit 0) when the change touches the policy, a
  workflow, a verifier file, a dependency manifest/lockfile, or a protected
  path.
• examples/runcap-adjudicate.yml - a hardened consumer reference workflow
  (on: pull_request, permissions: contents: read, persist-credentials: false, every action pinned by full commit SHA, capped runtime, no needs:).
• Docs: a "CI Adjudication (v0.6)" section in docs/trust-model.md, a reframed
  README, and a CHANGELOG.md 0.6.0 entry. Version bumped 0.5.0 -> 0.6.0.

The receipt does not decide the verdict

The required gate never reads the agent's self-reported receipt. It is
neither graded nor displayed by the gate, so a forged VERIFIED_STRONG receipt
has no effect on the merge decision. The verdict is recomputed from the base
commit every time.

There is no self-adjudicating workflow in this repo

An earlier revision shipped .github/workflows/runcap-adjudicate.yml that ran
the adjudicator against this repo's own PRs. That has been removed. The
reference is now the consumer template at examples/runcap-adjudicate.yml,
which is intentionally not runnable until you insert a release SHA (the
judge action is pinned to an all-zero placeholder).

Bootstrap rule (why this PR is reviewed by a human, not by Runcap)

The judge must come from an immutable source outside the candidate PR.
This implementation PR therefore cannot self-adjudicate:

• there is no base mission policy (.runcap/mission.{yaml,yml,json}) yet, and
• base code can't be trusted to judge head code that changes the trust surface.

So the first merge of the Runcap trust surface (adjudicator, policy, verifier,
workflow) is approved by a human CODEOWNER. After a release, a separate
consumer/demo repo runs the published action pinned by a full 40-char commit
SHA - because that judge is immutable and lives outside the PR, a malicious PR
cannot rewrite its own judge to force a fake PASS.

Honest framing

The verdict is a CI-attested replay under a documented hardened GitHub
profile. It is not "unspoofable" and not "fully independent": its integrity
rests on the required GitHub setup (protected branch, required check, CODEOWNERS
for the trust surface, no merge bypass, action pinned by immutable SHA) being in
place. It does not meter LLM spend, prove network isolation, or guard against
repo admins. See docs/trust-model.md#ci-adjudication-v06 for the full
"proves / does not prove" breakdown.

Commits in this PR's security + release-prep pass

• 5fe91aa, 0823d7a, c90191a - Tier 3 security-review fixes (receipt
  excluded from the gate, comment-stripped safety regexes, removed the
  self-adjudicating workflow).
• 2076993 - release-prep docs + version bump to 0.6.0.
• 5465da6 - release-safety: adjudicate-by-default Action, truthful README, real check script.

Tests

npm test (delta, loop, loop-e2e, outcome, guard, policy, mission, adjudicate)
and npm run test:tier3 both pass locally, including adversarial cases: a head
PR that rewrites bin/runcap.mjs or src/adjudicate.mjs to fake a PASS is
still BLOCKED, because the trusted adjudicator never imports the head copy.

Not in this PR: npm publish, release tag, Marketplace publication, and the
Tier 2 demo repo - those wait for the next review.

[kirder24-code]

Security review applied (3 commits) - green CI

Addressed the proof-gate threat model before any docs/version/merge.

Why the self-running Runcap adjudicate workflow was removed (the live CI failure):
The prior run (28333774203) returned BLOCKED / exit 1 with the exact reason:
no policy (.runcap/mission.{yaml,yml,json}) found at the base commit. This is the
bootstrap paradox: Runcap's own implementation PR has no base policy to adjudicate
against, and - more importantly - a candidate PR must never judge itself. The first
merge of Tier 3 therefore requires human review. Dogfooding via the released action
(pinned by SHA) happens in a separate PR after release.

Fixes:

1. Required gate never reads the agent receipt (src/adjudicate.mjs). A forged
   VERIFIED_STRONG receipt is the very attack this gate defeats. The job neither grades
   nor displays it - parsing attacker-controlled JSON in the mandatory check is needless
   attack surface (a malformed/enormous receipt could crash the only merge gate). The
   verdict reports a frozen agent_telemetry: {present:false, influence_on_verdict:none}.
2. Consumer reference is a SHA-pinned template (examples/runcap-adjudicate.yml),
   not a self-running workflow. The judge is the released Runcap action pinned by a full
   40-char commit SHA - never node ./bin/runcap.mjs from the PR workspace, never
   uses: ./, never npm ci of the PR manifest. Checkout uses persist-credentials: false
   and every action is pinned by full SHA.
3. Security tests (scripts/adjudicate-test.mjs): adversarial receipts (malformed,
   5MB blob, bare array, path-traversal latest) cannot crash/stall the gate; the
   template never contains workspace-execution patterns and pins every action by SHA; a
   head PR rewriting bin/runcap.mjs or src/adjudicate.mjs to force PASS is still
   BLOCKED because the judge is the trusted released-action code, never the head copy.

npm test (full chain) and npm run test:tier3 both pass. Latest CI run on this branch
(28334291609) is green - only ci.yml runs now.

Still NOT done pending independent review: README/trust-model docs, version bump, merge,
npm publish, release tag, Tier 2.