fix(queen,ci): verify Corona evidence and repair fork validation

.github/workflows/brain-ci.yml

@@ -46,6 +46,9 @@ jobs:
         with:
           submodules: recursive
 
+      - name: CI gate specification and conformance
+        run: node scripts/ci-gate-from-spec.mjs --check && node qa/ci-corona-pr-gate.mjs
+
       - name: Build TRI Binary
         run: |
           # `zig build tri` is a RUN step -- build.zig declares it as
@@ -134,7 +137,7 @@ jobs:
           fi
 
       - name: Comment Health on PR
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
         uses: actions/github-script@v7
         with:
           script: |
@@ -355,7 +358,7 @@ jobs:
           echo "brain stress: $TESTS_PASSED/$TESTS_TOTAL tests passed, 0 leaked"
 
       - name: Comment Stress Test on PR
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
         uses: actions/github-script@v7
         with:
           script: |
@@ -488,38 +491,15 @@ jobs:
     if: always()
     timeout-minutes: 5
     steps:
-      - name: Generate Health Report
-        run: |
-          echo "# 🧠 S³AI Brain Health Report" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          # Each row shows the job's real result (success / failure /
-          # cancelled / skipped). The old table printed "FAIL" for anything
-          # but success, so a job that never ran because an earlier one failed
-          # read as a second failure. Jobs here have no `if:` of their own, so
-          # "skipped" means an upstream job failed.
-          echo "| Phase | Result | Details |" >> $GITHUB_STEP_SUMMARY
-          echo "|-------|--------|---------|" >> $GITHUB_STEP_SUMMARY
-          echo "| Health Check | ${{ needs.brain-health-check.result }} | tri stress --health score vs threshold |" >> $GITHUB_STEP_SUMMARY
-          echo "| Build | ${{ needs.build-check.result }} | zig build -Dci=true |" >> $GITHUB_STEP_SUMMARY
-          echo "| Unit Tests | ${{ needs.brain-unit.result }} | test-basal-ganglia, test-reticular-formation, test-locus-coeruleus |" >> $GITHUB_STEP_SUMMARY
-          echo "| Integration | ${{ needs.brain-integration.result }} | test-brain |" >> $GITHUB_STEP_SUMMARY
-          echo "| Stress Test | ${{ needs.brain-stress.result }} | test-brain-stress, all tests pass, none leak |" >> $GITHUB_STEP_SUMMARY
-          echo "| CLI Smoke | ${{ needs.cli-smoke.result }} | tri stress --health, every probe passes |" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
+      - name: Checkout Trinity
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
-          echo "## Verdict" >> $GITHUB_STEP_SUMMARY
-          if [ "${{ needs.brain-health-check.result }}" == "success" ] && \
-             [ "${{ needs.build-check.result }}" == "success" ] && \
-             [ "${{ needs.brain-unit.result }}" == "success" ] && \
-             [ "${{ needs.brain-integration.result }}" == "success" ] && \
-             [ "${{ needs.brain-stress.result }}" == "success" ] && \
-             [ "${{ needs.cli-smoke.result }}" == "success" ]; then
-            echo "### X Brain Circuit HEALTHY — Safe to merge" >> $GITHUB_STEP_SUMMARY
-            exit 0
-          else
-            echo "### ! Brain Circuit DAMAGE — Fix required before merge" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
+      - name: Generate Health Report
+        env:
+          BRAIN_RESULTS: ${{ toJSON(needs) }}
+        run: node scripts/ci-gate-from-spec.mjs --check && node scripts/ci-brain-gate.mjs
 
       # On a push there is no PR, so context.issue.number is undefined and the
       # call becomes POST /repos/.../issues//comments -> 404.
@@ -531,7 +511,7 @@ jobs:
       # "the health check did not pass". Guarding it removes the noise, not the
       # signal -- the aggregator still fails the job on its own.
       - name: Critical State Notification
-        if: failure() && github.event_name == 'pull_request'
+        if: failure() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
         uses: actions/github-script@v7
         with:
           script: |

.github/workflows/dev-enforcement.yml

@@ -74,7 +74,7 @@ jobs:
     continue-on-error: true
     steps:
       - name: Mark in progress
-        if: github.event.action == 'opened' || github.event.action == 'synchronize'
+        if: github.event.pull_request.head.repo.full_name == github.repository && (github.event.action == 'opened' || github.event.action == 'synchronize')
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
@@ -84,7 +84,7 @@ jobs:
       # 'closed' while the workflow only listened for [opened, synchronize].
       # 'closed' is now in the trigger list, so the label finally comes off.
       - name: Mark completed on merge
-        if: github.event.action == 'closed' && github.event.pull_request.merged == true
+        if: github.event.pull_request.head.repo.full_name == github.repository && github.event.action == 'closed' && github.event.pull_request.merged == true
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
@@ -94,8 +94,14 @@ jobs:
             --add-label "status:completed"
 
       - name: Drop in-progress on a close without merge
-        if: github.event.action == 'closed' && github.event.pull_request.merged != true
+        if: github.event.pull_request.head.repo.full_name == github.repository && github.event.action == 'closed' && github.event.pull_request.merged != true
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: gh pr edit "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --remove-label "status:in-progress"
+
+      - name: Report read-only fork metadata
+        if: github.event.pull_request.head.repo.full_name != github.repository
+        run: |
+          echo 'Fork PR: labels cannot be written with its read-only GITHUB_TOKEN.' >> "$GITHUB_STEP_SUMMARY"
+          echo 'Title and source checks still execute; no label update is claimed.' >> "$GITHUB_STEP_SUMMARY"

.github/workflows/docs-check.yml

@@ -14,19 +14,35 @@ on:
     branches: [main, fix/*, feat/*]
     paths:
       - 'README.md'
-      - 'docs/**.md'
+      - 'docs/**'
       - 'CLAUDE.md'
       - 'AGENTS.md'
       - 'CONTRIBUTING.md'
       - '.github/workflows/docs-check.yml'
+      - 'specs/ci/**'
+      - '.trinity/seals/ci_ci_*.json'
+      - 'conformance/ci_*.json'
+      - 'scripts/ci-*'
+      - 'scripts/docs-*'
+      - 'qa/ci-corona-pr-gate.mjs'
+      - 'qa/docs-reference-gate.mjs'
   pull_request:
     branches: [main]
     paths:
       - 'README.md'
-      - 'docs/**.md'
+      - 'docs/**'
       - 'CLAUDE.md'
       - 'AGENTS.md'
       - 'CONTRIBUTING.md'
+      - '.github/workflows/docs-check.yml'
+      - '.markdown-link-check.json'
+      - 'specs/ci/**'
+      - '.trinity/seals/ci_ci_*.json'
+      - 'conformance/ci_*.json'
+      - 'scripts/ci-*'
+      - 'scripts/docs-*'
+      - 'qa/ci-corona-pr-gate.mjs'
+      - 'qa/docs-reference-gate.mjs'
 
 permissions:
   contents: read
@@ -35,19 +51,38 @@ jobs:
   markdown-link-check:
     name: Check Documentation Links
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Link Checker
-        uses: gaurav-nelson/github-action-markdown-link-check@v1
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: docs/package-lock.json
+
+      - name: Install locked docsite dependencies
+        run: npm ci --prefix docs --ignore-scripts
+
+      - name: Build real docsite routes
+        run: npm run build --prefix docs
+
+      - name: Reference specification and conformance
+        run: node scripts/docs-gate-from-spec.mjs --check && node qa/docs-reference-gate.mjs
+
+      - name: Check tracked documentation targets
+        run: node scripts/docs-reference-check.mjs --external --report work/docs-reference-report.json
+
+      - name: Upload individual reference observations
+        if: always()
+        uses: actions/upload-artifact@v4
         with:
-          use-quiet-mode: 'yes'
-          use-verbose-mode: 'yes'
-          config-file: '.markdown-link-check.json'
-          folder-path: 'docs'
-          file-extension: '.md'
-          check-modified-files-only: 'no'
+          name: documentation-reference-observations
+          path: work/docs-reference-report.json
+          if-no-files-found: warn
+          retention-days: 30
 
   docs-structure:
     name: Validate Documentation Structure
@@ -156,21 +191,24 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Check T-JEPA status consistency
-        run: |
-          echo "Checking T-JEPA implementation status across docs..."
-          TJEPA_FILES="src/hslm/tjepa.zig src/hslm/tjepa_trainer.zig"
+      - name: CI gate specification and conformance
+        run: node scripts/ci-gate-from-spec.mjs --check && node qa/ci-corona-pr-gate.mjs
 
-          for file in $TJEPA_FILES; do
-            if [ -f "$file" ]; then
-              echo "✅ $file exists (T-JEPA implemented)"
-            else
-              echo "❌ $file not found"
-              exit 1
-            fi
-          done
+      - name: Read pinned model source
+        id: training
+        run: node scripts/docs-model-consistency.mjs --policy
 
-          echo "Note: If T-JEPA files exist, docs should reflect 'implemented' status"
+      - name: Checkout moved T-JEPA source
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ steps.training.outputs.repo }}
+          ref: ${{ steps.training.outputs.rev }}
+          path: work/docs-training
+          persist-credentials: false
+          sparse-checkout: src/hslm
+
+      - name: Check T-JEPA status consistency
+        run: node scripts/docs-model-consistency.mjs --check work/docs-training
 
       - name: Check version consistency
         run: |

.github/workflows/website-checks.yml

@@ -294,7 +294,7 @@ jobs:
       # and the nightly t27 world scan -- the only place these ran -- then
       # failed for three nights. Pure, no browser.
       - name: Queen map close-ups stay readable
-        run: npm run check:queen-displays && npm run check:queen-continuous
+        run: npm run check:queen-displays && npm run check:queen-continuous && npm run check:queen-issue-proof && npm run check:queen-worlds
       # The PASSPORT argues a result is worthless without the record of how it
       # was taken, so its own figures must not drift from its own prose: every
       # plotted quantity carries the literal the text prints for it, in both

.trinity/seals/ci_ci_corona_pr_gate.json

@@ -0,0 +1,12 @@
+{
+  "gen_hash_c": "sha256:b02f5751bc7a7e0f235466d05f6a65bcae9facbd16aa66952782c51e86021ed9",
+  "gen_hash_rust": "sha256:3012c8a8ace08b4d8b5b6c34d48a087967f1688cb642f489f906d0e978174ad8",
+  "gen_hash_verilog": "sha256:11d561f8530eb497610ca1089bc6feef492030cc4e211e8b66c05d8649ee93b1",
+  "gen_hash_zig": "sha256:15b0cc5880133be2ca49e08eb98d5c9fcf745ad0503dbec0363e7df5984e66ac",
+  "module": "ci_corona_pr_gate",
+  "ring": 12,
+  "sealed_at": "2026-10-04T14:33:38Z",
+  "sealed_by": "t27c-bootstrap@0.4.0",
+  "spec_hash": "sha256:047077fb240de41e41e83b0b4c8ae67b5146ee30f9ce112fe604972dbde12734",
+  "spec_path": "specs/ci/corona_pr_gate.t27"
+}

.trinity/seals/ci_ci_docs_reference_gate.json

@@ -0,0 +1,12 @@
+{
+  "gen_hash_c": "sha256:612f7c26d728b6aa393933f4354190821d60b6dc80e4a5bb99010057f6b341de",
+  "gen_hash_rust": "sha256:0aa0e22e03c583175ae59f886a6ae7d9858da13347ea8f7d2ad291c372bf2f9a",
+  "gen_hash_verilog": "sha256:90fce96f8cf826970612fa66528234bc60164087b63c9cd4cd82f856137b5128",
+  "gen_hash_zig": "sha256:aa43ac0759a5d77124ea72e9206d228523af122d01f55677bf01a9b2e29d6123",
+  "module": "ci_docs_reference_gate",
+  "ring": 12,
+  "sealed_at": "2026-10-04T15:27:42Z",
+  "sealed_by": "t27c-bootstrap@0.4.0",
+  "spec_hash": "sha256:0117fc00bc1bf158cdf5be11571c4a65c10e7be51b6283e059500a94d4bc62e4",
+  "spec_path": "specs/ci/docs_reference_gate.t27"
+}

CONTRIBUTING.md

@@ -232,7 +232,7 @@ Closes #N
 
 - **Documentation**: [docs/DOCUMENTATION_INDEX.md](docs/DOCUMENTATION_INDEX.md)
 - **Issues**: [GitHub Issues](https://github.com/gHashTag/trinity/issues)
-- **Discussions**: [GitHub Discussions](https://github.com/gHashTag/trinity/discussions)
+- **Discussions**: [GitHub Issues](https://github.com/gHashTag/trinity/issues)
 
 ### Asking Questions
 

README.md

@@ -29,7 +29,7 @@
   <a href="https://github.com/gHashTag/trinity/pkgs/container/trinity"><img src="https://img.shields.io/github/actions/workflow/status/gHashTag/trinity/docker-cli.yml?label=Docker&style=flat-square&logo=docker" alt="Docker"></a>
   <img src="https://img.shields.io/badge/Zig-0.15.x-F7A41D?style=flat-square&logo=zig" alt="Zig 0.15.x">
   <img src="https://img.shields.io/badge/License-MIT-yellow?style=flat-square" alt="MIT License">
-  <a href="https://github.com/gHashTag/trinity/stargazers"><img src="https://img.shields.io/github/stars/gHashTag/trinity?style=flat-square" alt="Stars"></a>
+  <a href="https://github.com/gHashTag/trinity"><img src="https://img.shields.io/github/stars/gHashTag/trinity?style=flat-square" alt="Stars"></a>
   <a href="https://github.com/gHashTag/trinity/graphs/contributors"><img src="https://img.shields.io/github/contributors/gHashTag/trinity?style=flat-square" alt="Contributors"></a>
   <a href="https://github.com/gHashTag/trinity/commits/main"><img src="https://img.shields.io/github/last-commit/gHashTag/trinity?style=flat-square" alt="Last Commit"></a>
       <a href="https://doi.org/10.5281/zenodo.18947017"><img src="https://zenodo.org/badge/DOI/10.5281/zenodo.18947017.svg" alt="DOI"></a>

SOUL.md

@@ -1,8 +1,10 @@
-# QUEEN hive status-fill agent
+# Corona issue proof reader
 
 - Type: Custom / UI
-- Bound GitHub issue: gHashTag/trinity#890
-- Mission: implement truthful, overview-readable issue-status hex fills.
+- Bound GitHub issue: gHashTag/trinity#1360
+- Evidence dependency: gHashTag/tt-trinity-corona#12.
+- Mission: show honey only for a closed allowlisted issue whose exact native
+  seal, conformance vectors, verifier and CI match the current canonical source.
 - Allowed: scoped local source/tests/docs/skill edits, read-only repository and
   public browser inspection, local test/build/preview, issue-bound journaling.
 - Stop: unrelated changes, unavailable provenance, external publication/secrets

apps/website/.trinity/seals/queen_queen_issue_proof.json

@@ -0,0 +1,12 @@
+{
+  "gen_hash_c": "sha256:56d15f88b0b37a71296c97ce16dd2267e8c23256cc85fb05b43e79cacf1b02f2",
+  "gen_hash_rust": "sha256:a8d8d79054dd2d1bb7e9d6123aa542dbd134ba6546ec268fbf092b2ef4fa4ffd",
+  "gen_hash_verilog": "sha256:94017e65333be620a7d0574b8f2fdadef995c07bef477c0d6471a434756f145a",
+  "gen_hash_zig": "sha256:afd70f46deb15a09a5966cfdeb756860cff3f3dae2141b45a54ed864d067908a",
+  "module": "queen_issue_proof",
+  "ring": 12,
+  "sealed_at": "2026-10-04T13:34:55Z",
+  "sealed_by": "t27c-bootstrap@0.4.0",
+  "spec_hash": "sha256:aefcb400627c6006d3c9fafb5466ee8722d1d2ca768feba501bdd759eb8f4390",
+  "spec_path": "specs/queen/issue_proof.t27"
+}

apps/website/conformance/queen_issue_proof.json

@@ -0,0 +1,70 @@
+{
+  "spec_path": "specs/queen/issue_proof.t27",
+  "spec_hash": "aefcb400627c6006d3c9fafb5466ee8722d1d2ca768feba501bdd759eb8f4390",
+  "vectors": [
+    {
+      "mask": 0,
+      "expected": 0
+    },
+    {
+      "mask": 1,
+      "expected": 0
+    },
+    {
+      "mask": 2,
+      "expected": 0
+    },
+    {
+      "mask": 3,
+      "expected": 0
+    },
+    {
+      "mask": 4,
+      "expected": 0
+    },
+    {
+      "mask": 5,
+      "expected": 0
+    },
+    {
+      "mask": 6,
+      "expected": 0
+    },
+    {
+      "mask": 7,
+      "expected": 0
+    },
+    {
+      "mask": 8,
+      "expected": 0
+    },
+    {
+      "mask": 9,
+      "expected": 0
+    },
+    {
+      "mask": 10,
+      "expected": 0
+    },
+    {
+      "mask": 11,
+      "expected": 0
+    },
+    {
+      "mask": 12,
+      "expected": 0
+    },
+    {
+      "mask": 13,
+      "expected": 0
+    },
+    {
+      "mask": 14,
+      "expected": 0
+    },
+    {
+      "mask": 15,
+      "expected": 1
+    }
+  ]
+}