# Gate record — releases#331 H3 (peer-rig fixtures), PR #251 @ `d3582138`

Gater: doyle, 2026-09-24 10:35Z, HFENDULEAM.
Lane: hertz (test/CI). Test-only. Base `b25a037d` (W1 landed).

## Subject verified before any green was read

- `origin/test/331-peer-rig` = `d3582138f19cda055c057bda8bf9da6b2402ada4`.
- `d3582138^` = `b25a037d` — rebased onto current main, not merged into it.
- Patch-id of `b25a037d..d3582138` == patch-id of `5744839f..bb6086cb` = `9f5031b6…`. The
  rebase carried the same change; the previously-green pre-rebase run is about the same patch.
- Diff touches only `crates/spt/tests/peer_rig/{mod,inproc,signing,adapter,bundle,wait}.rs`,
  `crates/spt/tests/peer_rig_selftest.rs`, `traceable-reqs.toml`. No product source.
- Sole file overlap with what main gained since the branch's old base is `traceable-reqs.toml`;
  `git merge-tree` onto `b25a037d` was clean (tree `6101491c`).

## Conditions

| # | condition | verdict | evidence |
|---|---|---|---|
| 1 | CI green on the REBASED sha | HOLDS | run `35984979431` on `d3582138`, 5/5: changes, traceability, lint, unit Windows, unit Linux |
| 2 | traceable-reqs headers == ids after the toml merge | HOLDS | doyle measured the MERGED tree: `[[requirements]]` 946 == ids 946. (The toml tail-union hazard is why this is measured on the merge result, not the branch.) |
| 3 | rig compiles against landed W1 | HOLDS | `cargo clippy --workspace --all-targets -D warnings` green; nextest built 236 binaries |
| 4 | negative controls exist and each mutation reds only its own arm | HOLDS AS HERTZ'S TESTIMONY | PR body: flipped archive byte -> `BadSignature`; foreign signer, same key id -> `BadSignature`; wrong docs bytes -> `ArtifactMismatch`; unrostered requester -> `Refused`, stages nothing; both timeout messages pinned with `should_panic(expected)`. Mutation proof: signing `bytes[1..]` reds only the archive arm; `StreamCursor` ignoring its snapshot hangs the in-process arm's second pull to nextest TIMEOUT (the `propagate.rs` stale-row signature) |
| 5 | the selftest EXECUTES green | NOT PROVEN BY CI — hertz's local run only | see blind spot below |

## Blind spot, recorded rather than laundered

**CI never ran this rig.** The unit leg is `cargo nextest run --workspace -E 'kind(lib) + kind(bin)'`:
`Starting 3293 tests across 28 binaries (1 test and 208 binaries skipped)`. `peer_rig_selftest` is a
`tests/` integration binary — `kind(test)` — so it was built and skipped. The 5/5 green says the rig
COMPILES against landed W1; it says nothing about the rig RUNNING.

Execution evidence is hertz's local `peer_rig_selftest` 8/8 plus
`clippy -p spt --test peer_rig_selftest -D warnings` clean, reported 2026-09-24 10:03Z. That is
testimony from the lane that owns it (dispatch split: test work is hertz's), and it is specific
enough to be falsifiable — it names per-arm mutation outcomes and a known product hang signature.
It is NOT a doyle measurement and must not be cited as one.

Where it DOES execute: golden. `golden.yml` runs `cargo nextest run --workspace --no-fail-fast`
split into phase A (`not HEAVY`) and phase B (`HEAVY`) with no `kind()` filter, so integration
binaries run there. Thin-lane PR CI skipping them is ADR-0050 by design, not a defect — nothing to
register.

Consequence, stated precisely: this rig's first CI execution anywhere will be the #331 milestone
golden run. A rig defect therefore surfaces late, inside a milestone-batch golden, where it reds a
run that is expensive to repeat and hands back to triage. Until then the only thing standing behind
the fixtures is hertz's local run. If a consumer int reds at golden, the rig is a live suspect —
"is this red mine" applies with the rig in scope, not just the product diff.

## Carried forward

- `traceable-reqs` Quality audit emitted two `[must]` findings on `REQ-TEST-PEER-RIG-FIXTURES`
  (`criterion=contains-and`; `criterion=length` — title is 144 words, want 3..=25). The
  traceability job still concluded success, so these are non-gating today. The requirement's
  *title* is carrying what belongs in its description. Routed to hertz to fix in the next test lane.
- PR #251's body still describes the pre-rebase state (`@ bb6086cb on 5744839f`, treqs 943/943).
  The landed sha is `d3582138` at 946/946. Body is stale, change is not.

## Verdict

GATE PASSES for a test-only fixtures lane, with condition 5 held as hertz's testimony and the CI
blind spot recorded above. ff-land `d3582138` onto main (`d3582138^ == b25a037d`, so the push is a
true fast-forward and tested sha == merged sha).