fix(queen): verify canonical Corona proof before marking issue honey

[dmitrii-f-t27]

Closes #1360. Evidence dependency: gHashTag/tt-trinity-corona#13.

Website checks passed on head effe68f3e94e03091db913d7b7cb0d7606d9e262. Unrelated red documentation/credential checks and the skipped automatic review are documented in this comment. This PR is not yet approved or deployed.

Closing Corona #1 left its cell red because the public adapter always assigned unknown coverage. This adds an explicit .t27 policy and a reader that can recognize the closed Corona #1/#12 cells only after immutable source/seal/vector/verifier/Makefile/workflow hashes match and canonical push CI plus GDS succeed at the current default-branch SHA. Until the dependency is accepted, the cell stays unverified.

Spec: apps/website/specs/queen/issue_proof.t27; native seal: apps/website/.trinity/seals/queen_queen_issue_proof.json; vectors: apps/website/conformance/queen_issue_proof.json; procedure and boundaries: docs/QUEEN_CORONA_PROOF.md.

The map refreshes the supported world from GitHub, updates backlog totals only from a complete page, and links accepted evidence to its exact source and runs. Fork runs, wrong or tampered files, failed/latest CI, rate limits and reopened issues cannot grant honey. Public reads omit credentials.

{
  "version": 1,
  "head_sha": "effe68f3e94e03091db913d7b7cb0d7606d9e262",
  "summary": "The public map can consume canonical Corona Phase A proof while retaining unknown coverage until that evidence is accepted.",
  "changes": [
    "Add executable issue_proof.t27, generated policy, native compiler seal and 16 conformance vectors.",
    "Read immutable evidence and current canonical push CI/GDS; expose source links and observation time.",
    "Refresh supported world lifecycle and update its open count only from a complete response.",
    "Run rejection, cache, conformance and existing map/world contracts in website CI."
  ],
  "tests": [
    {"command":"npm run check:queen-issue-proof","status":"passed","result":"2 spec tests, 19 assertions; 35 HTTP-boundary cases and 16 conformance vectors pass.","evidence":"apps/website/qa/queen-issue-proof.mjs and scripts/issue-proof-from-spec.mjs"},
    {"command":"t27c gen specs/queen/issue_proof.t27 > issue_proof.zig && zig test issue_proof.zig","status":"passed","result":"Both generated native Zig tests pass with t27c db870cdf and Zig 0.16.0.","evidence":"apps/website/specs/queen/issue_proof.t27; native compiler-created seal checked in"},
    {"command":"npm run check:queen-worlds && npm run check:queen-displays && npm run check:queen-continuous","status":"passed","result":"Existing world identity, status color, picking and stable-map contracts pass, including complete versus partial backlog observations.","evidence":"apps/website/qa/queen-repository-worlds.mjs, queen-hive-display-contract.mjs, queen-continuous-map.mjs"},
    {"command":"npm run typecheck:ratchet","status":"passed","result":"No new errors; existing baseline is 179 errors across 26 files.","evidence":"apps/website/scripts/typecheck-ratchet.mjs"},
    {"command":"npm run build:ci","status":"passed","result":"Production Vite build completed locally; existing chunk-size warnings remain.","evidence":"Reproduce from apps/website using npm ci and npm run build:ci"},
    {"command":"BrowserOS neo: local production preview /#/queen?world=ghashtag%2Ftt-trinity-corona&task=1","status":"passed","result":"Live public GitHub lifecycle reads closed. Proof marker is absent while upstream main lacks the new evidence. Positive honey is tested with isolated HTTP fixtures, not claimed live.","evidence":"docs/QUEEN_CORONA_PROOF.md"}
  ],
  "limitations": [
    "Corona PR13 must be reviewed/merged and exact canonical push CI/GDS must pass before a live positive result is possible.",
    "Only the explicitly allowlisted Corona Phase A issues are supported. Changing pinned evidence requires another reviewed spec update.",
    "Anonymous GitHub limits or network failure retain unknown coverage. Successful evidence is cached for one minute.",
    "This is source work. app.t27.ai embeds a separately pinned Queen build; publication and live acceptance have not yet been verified.",
    "No fabricated-silicon, timing-signoff or reward/payment-settlement claim. Existing TypeScript baseline debt remains."
  ],
  "tags": ["Engineering","Verification"],
  "blog": {
    "title": "Why closing a GitHub issue did not complete its proof cell",
    "summary": "Corona exposed the difference between issue lifecycle and verified executable evidence in the public map.",
    "outline": [
      "The issue adapter always emitted unknown coverage, so closed Corona #1 remained red.",
      "An explicit spec now binds immutable evidence to canonical push CI/GDS, with rejection controls and observable source links.",
      "Local tests do not establish live acceptance: upstream review, accepted source, deployment and a live read remain separate gates."
    ],
    "reproduce": ["cd apps/website && npm ci", "npm run check:queen-issue-proof", "npm run check:queen-worlds && npm run check:queen-displays && npm run check:queen-continuous"]
  }
}

[github-actions]

X Brain Health Check

Score: 100.0/100
Status: 🟢 HEALTHY
Threshold: 80/100

X Brain is above merge threshold

[dmitrii-f-t27]

Two red checks at head effe68f3e94e03091db913d7b7cb0d7606d9e262 are outside this patch:

• Documentation Consistency fails with src/hslm/tjepa.zig not found. The unchanged base workflow requires that file; git cat-file -e 3cf399fc:src/hslm/tjepa.zig also fails on the base commit. This PR does not change that workflow or src/hslm.
• pr-opened automation fails with gh: Bad credentials (HTTP 401). This PR does not change its workflow or credentials. No secret was read or modified to bypass it.

The current-head T27 work report and Website checks are successful, including the proof/world/display/map contracts, production build and browser checks. The two external failures are documented, not represented as green or as merge approval. Dependency Corona PR13 and actual review/deployment remain required.

The green claude-review job is not a review: its log explicitly says The ZAI_API_KEY secret is not set, so this PR is not reviewed. The PR has no submitted review. A real reviewer is still required; no approval is inferred from this job's successful exit.

[github-actions]

🧪 Brain Stress Test Results

Tests: 261/261 passed, 0 leaked
Status: 🟢 PASS
Gate: every test in zig build test-brain-stress passes and none leaks

[dmitrii-f-t27]

Superseded by #1363, using the owner's personal fork and preserving this commit as its parent. The replacement additionally pins the GDS workflow source in .t27 and rejects a changed/missing gds.yml: the new regression failed against this reader, and the fixed reader passes37 HTTP cases and16 conformance vectors. Closing this duplicate is not a merge or completion: new-head CI, actual approval, Corona PR13 acceptance, deployment and a specific reward receipt remain required.