feat(factory): wire the software factory — gate config, Action, issue template

[schmug]

Adopts the autonomous issue→fix→merge loop from schmug/shipofclaudius#63.

⚠️ WIRED, NOT ARMED

secrets.FACTORY_GH_TOKEN does not exist, so the advance and land jobs no-op with a clear notice rather than half-running. Nothing can auto-merge today, and three independent things still gate that — see .factory/README.md:

1. fix-verified is human-minted. requireFixtureEvidence: false because this repo has no reproduction harness, so the reproduce phase has no mechanical definition of done.
2. The write token must be a distinct identity from @schmug. GitHub forbids self-approval, so a code-owner token can never satisfy require_code_owner_review on main-protection. That's claude-routines bot-identity split: run overnight routines as a non-admin GitHub identity #299.
3. There is no rollback lever. Production deploys leave GitHub entirely via the Cloudflare Git integration, so a bad auto-merged change can't be reverted from here.

What's here

.factory/gate.json — the merge gate's config, read from main on every run and never from the PR. The denylist mirrors .github/CODEOWNERS and adds the security/money paths that aren't currently code-owned: src/auth/**, src/account/**, src/billing/**, src/webhooks/**, src/rate-limit-do.ts, mta-sts-worker/**, scripts/routine-gate/**. .factory/**, .github/workflows/** and CODEOWNERS are added automatically by the gate and cannot be removed by this file — a PR must never be able to widen the rules it's judged by.

.github/workflows/factory.yml — killswitch → advance → land.

The land job runs no model at all: it's gh plus a zero-dependency Node program, so text injected into a public issue body has nothing to act on — an injected instruction cannot move a <= comparison. It checks out the base ref, never the PR head, which is what makes the pull_request_target trigger safe; there's no npm ci and no build step in it. workflow_dispatch inputs are allowlist-validated before they reach the driver's prompt, and all GitHub context flows through env:, never interpolated into run: bodies. Action SHAs match the existing pins so the action-pin integrity check passes.

.github/ISSUE_TEMPLATE/ — the repo had none at all. The bug form makes the ```scope block required, which is the gate's single most common escalation cause.

Verified end to end

Ran the real gate binary against this exact .factory/gate.json:

Case	Result
A clean, in-scope PR	exit 0 — merge
Real PR #653 (dependabot)	exit 2 — unallowlisted author, no fix-verified, no Closes #N, mta-sts-worker/** risk path, 382 lines > 250, no scope block
Self-editing .factory/** / .github/workflows/** / CODEOWNERS	exit 2 — no_risk_paths
Touching src/analyzers/** · src/shared/scoring.ts · src/billing/**	exit 2 — no_risk_paths
Scope drift · oversize · pending required check · BLOCKED merge state	exit 2 — the matching condition

That exercise also caught a real bug in the gate package (gh api takes no -R, which would have failed ci_green on every PR forever) — fixed upstream in shipofclaudius#63 before this PR was opened.

Settled empirically while wiring this

.github/CODEOWNERS is enforcing, not advisory. The main-protection ruleset is active with require_code_owner_review: true, required_approving_review_count: 0, one required check (check), and no bypass actors. CLAUDE.md is correct; MAINTAINERS.md, docs/OSPS-DEVIATIONS.md and .claude/workflows/pr-triage.js all say advisory and are wrong. Filed separately rather than mixed into this PR.

Not in this PR

The reproduction harness, the coverage floor, the rollback lever, the bot identity, and the src/index.ts bottleneck are filed as follow-up issues.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	dmarcheck	1d9b108	Aug 05 2026, 12:02 PM