Ruleset gate-deadlock: Hypatia enforces structurally-unsatisfiable required checks (regenerate on every run)

[hyperpolymath]

Handoff → Hypatia lane: ruleset gate-deadlock (structurally-unsatisfiable required checks)

From: estate PR-backlog remediation (farm/governance lane), 2026-07-06
To: Hypatia lane (owner of hypatia — other bot's exclusive territory; this is a
cross-lane spec, NOT a change made by us)
Why you: Hypatia writes these GitHub rulesets directly — adapters/src/github.rs
PUTs required_status_checks bodies (lines ~239/376/386/529). The farm is not in the
write path (instant-sync's FARM_DISPATCH_TOKEN is dead, and no farm workflow PUTs these
gates), so this can only be fixed at source, in Hypatia.

The defect

Hypatia enforces a per-repo canonical ruleset with required status-check contexts. On a
non-trivial number of repos, one or more of those required contexts cannot ever report a
passing result, so every PR deadlocks (admin-merge only). Because Hypatia re-enforces on a
schedule, manually removing the gate is futile — it regenerates (observed: HAR's Base
ruleset rewritten 2026-07-06 17:08 with the gate set expanded, adding llvm-cov line coverage, after we'd removed analyze (rust, none) hours earlier).

The specific unsatisfiable patterns

1. code_scanning rule / CodeQL on non-code repos — CodeQL runs, finds nothing
   analysable, uploads an empty SARIF and reports "unsuccessful execution." A required
   code_scanning rule (or required analyze (...) context) then waits forever.
2. Phantom / filepath-shaped contexts — e.g. a required context literally named
   .github/dependabot.yml (seen on knot-rider). No job ever emits a check by that name →
   permanent pending.
3. governance / Validate Hypatia Baseline — required, but skips/never consumes the
   baseline JSON (hypatia#566) → never reports success → blocks.
4. Language/coverage gates on repos lacking that capability — analyze (rust) /
   llvm-cov line coverage required on a repo with no Rust / no tests.

Scale (from the 2026-07-06 estate triage of 97 open PRs)

Gate-deadlock was the dominant blocking cause. Genuinely-blocked PRs cleared manually
this session by removing the unsatisfiable gates: HAR #76, #77; knot-rider #3 (all now
merged) — but they will re-deadlock on the next enforcement run.

The fix (proposed — Hypatia's call on the shape)

Make required gates capability-conditional and never emit unsatisfiable/phantom ones:

• CodeQL / code_scanning: require ONLY where CodeQL produces a real result (a supported
  compiled language actually present + build succeeds). Where it reports "unsuccessful
  execution," keep CodeQL running (Security-tab signal) but not required.
• Coverage / analyze (<lang>): gate on detected language/test presence, not applied
  uniformly.
• Never emit a filepath-shaped required context (.github/*, *.yml/.yaml/.json).
• Validate Hypatia Baseline: fix hypatia#566 (consume the baseline JSON) OR make it
  advisory until it does.
• Emit required contexts using the exact names the jobs report (the farm's
  ci-deadlock-realign-rulesets.sh currently patches name-drift after the fact — better to
  emit correctly at source).

What the governance lane already ships (for reference, not a substitute)

• .git-private-farm/scripts/ci-deadlock-realign-rulesets.sh — remaps required-context
  name drift to the emitted name (keeps the real check counting).
• .git-private-farm/scripts/ci-deadlock-degate.sh — NEW (PR chore(deps): bump subprocess from 0.2.15 to 1.0.0 #106): owner-gated manual
  removal of the two unsatisfiable classes above. This is remediation only — it loses to
  Hypatia's re-enforcement until this source fix lands.

Net: the durable fix is here, in Hypatia's enforcement logic. The farm can only mop up
after the fact.