ADR 0307: CI reports checkpoint review and Proof retains drops

Status: accepted

Checkpoint declarations live in a worktree's Git administrative state. A fresh pull-request checkout cannot read a developer worktree's open questions or declarations. Strict discern done can therefore refuse before machine jobs even when the developer already reviewed the question. Putting declaration flags in workflow YAML would turn a judgment into an unconditional assertion.

Checkpoint enforcement also has evidence-loss paths. Policy, diff, when, subject, or local-store uncertainty previously survived mainly as advisory text. A green result could outlive that transient account, leaving the owner unable to tell which checkpoint was not enforced.

Continuous integration has an explicit report lane, and every checkpoint evidence drop is structured Proof evidence.

• discern done --ci selects report mode. Environment variables may tailor a strict refusal hint but never select the mode.
• Report mode evaluates the same governing policy and obligations, runs when during an actual run, and runs the same Gate jobs. Fired stop checkpoints await review. Machine jobs alone control the exit.
• Report mode accepts no declaration flags and writes no open question, declaration, or checkpoint lifecycle observation. Its Proof states that review was reported and was not enforced.
• Report Proof has its own identity. Status reports it as report_only; acceptance preview, acceptance apply, validation during execution, and durable-note writing all reject it. Ordinary discern done is required before landing. A report run on the same HEAD preserves an already honored strict marker instead of replacing stronger local evidence with report-only evidence.
• One typed registry classifies checkpoint drops. A checkpoint-level record carries id, mode, governing policy commit, reason, and a normalized account of at most 500 characters. A policy-level record uses null for unknowable id and mode and carries the policy commit only when known.
• Every Gate, Proof, status, acceptance review, and DSSE projection derives from those records. A green evidence drop does not become a variance, and a dropped indeterminate stop prevents Proof reuse.

• A required pull-request job can run all machine checks and expose relevant questions without counterfeiting review.
• Passing CI proves the machine Gate and reports checkpoint review state. It does not prove that an agent reviewed a question.
• Owners can audit a green Proof for enforcement lost to uncertainty, including the reason and governing identity available at the failure point.
• Strict local behavior and its existing marker shape remain unchanged. Push-to-trunk CI normally sees an empty effort diff.
• Declaration transport remains a later owner design. This decision adds no remote store, signed review bundle, workflow conclusion, or implicit environment switch.

• Transport local declarations into CI. Deferred: identity, signature, replay, and owner trust policy need a separate design.
• Treat machine success as checkpoint success. Rejected: machine results cannot answer judgment questions.
• Skip checkpoints silently in CI. Rejected: a green check would conceal the policy that was not enforced.
• Make every drop block. Rejected: policy-level evidence loss is not itself an authored review question. Executable stop uncertainty is the narrower exception: it serves the governed question rather than inventing a predicate answer.