fix(queen): the Linux copy of the policy had drifted, and its gate ran nowhere

.github/workflows/queen-dashboard.yml

@@ -0,0 +1,47 @@
+name: queen dashboard
+
+# THE PUBLIC FACE HAD A CONTRACT AND NO WORKFLOW.
+#
+# `trios/apps/website` is the t27.ai dashboard - the page anyone reads to see
+# what the Queen is doing. It carries `qa/queen-review-lifecycle-contract.mjs`,
+# which imports the REAL page module (the same `src/pages/Queen.tsx` the site
+# builds) and pins the review lifecycle against the closed set of states the
+# server publishes: 194 checks.
+#
+# Measured 2026-09-06: the string `apps/website` appeared in NO workflow in this
+# repository. Typecheck, the contract and the build all pass and always had -
+# nothing was broken. What was missing was anything that would notice when the
+# server's published states and the page's copy of them stop agreeing, which is
+# the one thing this contract exists to catch.
+#
+# ITS OWN WORKFLOW, not a job in `trios logic`: that one runs a macOS Swift job,
+# and a paragraph of website CSS should not wake a Mac runner. The path filter
+# is the point of putting it here.
+on:
+  pull_request:
+    paths:
+      - 'trios/apps/website/**'
+      - '.github/workflows/queen-dashboard.yml'
+
+jobs:
+  contract:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      # `--frozen-lockfile`, because a gate that quietly resolves a different
+      # dependency tree than the one committed is testing a build nobody ships.
+      - name: Install
+        working-directory: trios/apps/website
+        run: bun install --frozen-lockfile
+      # Separate steps, so the answer says WHICH of the three failed. `bun run
+      # check` chains all three with `&&` and reports only the first.
+      - name: Types
+        working-directory: trios/apps/website
+        run: bun run typecheck
+      - name: The review lifecycle contract, against the real page module
+        working-directory: trios/apps/website
+        run: bun run qa
+      - name: The page still builds
+        working-directory: trios/apps/website
+        run: bun run build

.github/workflows/trios-logic.yml

@@ -10,12 +10,152 @@ on:
     paths:
       - 'trios/rings/**'
       - 'trios/tests/**'
+      # The Linux copy of the policy, so a change to EITHER side of the
+      # duplication wakes the gate below. Watching only the ring would let a
+      # hand-edit of the copy drift in unwatched, which is the same hole in the
+      # other direction.
+      - 'trios/agent-server/queen-core/**'
       - 'trios/agent-server/apps/server/src/agent/**'
       - 'trios/Makefile'
       - 'trios/tests/fixtures/**'
       - '.github/workflows/trios-logic.yml'
 
 jobs:
+  # ELEVEN POLICY FILES EXIST TWICE AND THE GATE FOR IT RAN NOWHERE.
+  #
+  # `make queen-core-sync` compares rings/SR-00 with the copy the Docker build
+  # compiles for Linux, byte for byte, and its own comment says why: "the copy
+  # is compiled by the Linux stage and the original by the app, and a policy
+  # that differs between them is two arbiters of the same rule."
+  #
+  # It appeared in no workflow. Measured 2026-09-06: QueenLocalisation.swift had
+  # already drifted - the ring gained a string-aware literal view on 2026-09-05
+  # (#1176, a `/*` inside a quoted branch glob opened a phantom comment and
+  # blanked 6,726 lines of evidence) and the copy that ships to Linux was last
+  # touched on 2026-08-29. The fix never crossed. Twelve of thirteen files were
+  # identical; one was not, and nothing was looking.
+  #
+  # Ubuntu and no Swift: this is `cmp`, and it costs seconds. The comparison
+  # does not need the compiler that consumes its result.
+  # FOUR MORE GATES THAT RAN NOWHERE, from the same audit.
+  #
+  # 68 make targets, 11 invoked by a workflow. Most of the rest should be local -
+  # `make` builds an app, `relaunch` needs a window server - but these five need
+  # no desktop at all, and each was MEASURED against the shipping ref before
+  # being wired here rather than assumed to pass:
+  #
+  #   sources-drift              the build's source list against the tree
+  #   sources-drift-selftest     ...and the proof that gate can still fail
+  #   binary-drift               the shipped binary against what the tree builds
+  #   run-completeness-selftest  the test-run parser, against known transcripts
+  #
+  # NOT drift-guard, which the same audit surfaced: it is one line invoking
+  # run_chat_sse_e2e.sh with an extra scenario enabled, it drives the Swift
+  # compiler, and it did not finish inside four minutes. Its own comment says it
+  # is "slow, explicit, never accidental". The script it wraps already runs in
+  # swift-logic below.
+  portable-gates:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # Separate steps, not one `make a b c d`: make stops at the first failure,
+      # and a single step would report one broken gate and hide the state of the
+      # three behind it. Which gate failed is the whole content of the answer.
+      - name: The Linux copy of the policy matches the ring, byte for byte
+        working-directory: trios
+        run: make queen-core-sync
+      - name: The build's source list matches the tree
+        working-directory: trios
+        run: make sources-drift
+      - name: ...and that gate can still fail
+        working-directory: trios
+        run: make sources-drift-selftest
+      - name: The shipped binary matches what the tree builds
+        working-directory: trios
+        run: make binary-drift
+      - name: The test-run parser reads a known transcript correctly
+        working-directory: trios
+        run: make run-completeness-selftest
+      # THREE MORE, FOUND BY READING THE REPOSITORY'S OWN DECLARATION.
+      #
+      # `make check` names its gate suite in one line of prerequisites: 24 of
+      # them, of which CI ran 8. A word-list audit had missed these three
+      # entirely, because they are named after their SUBJECT rather than their
+      # function - nothing in `type-floor` or `vendor-step` says "gate". When
+      # the system under audit declares the thing you are inferring, read the
+      # declaration.
+      - name: The type floor
+        working-directory: trios
+        run: make type-floor
+      - name: No backticks in a recipe
+        working-directory: trios
+        run: make recipe-backticks
+      - name: Every skill has its frontmatter
+        working-directory: trios
+        run: make skill-frontmatter
+      #
+      # NOT t27-rings, and the reason is worth writing down. It is the best gate
+      # in the suite - it generates Verilog from `rings/T27-00/queen_core.t27`,
+      # compiles it with iverilog, simulates under vvp and checks the answers
+      # against the Swift table, on top of the 460-case Rust parity. It passes.
+      #
+      # It cannot be wired here. `t27c` is built from `$(T27_ROOT)/bootstrap`,
+      # which lives in a SEPARATE repository this checkout does not contain, and
+      # the target is written to SKIP rather than fail when the toolchain is
+      # absent. Wiring it would produce a green job that runs nothing - which is
+      # precisely the defect the rest of this file was added to end. Vendoring
+      # or fetching t27c is a real change and belongs in its own.
+
+  # THE RINGS, ANSWERED BY THREE LANGUAGES AND A SIMULATOR.
+  #
+  # `t27-rings` generates Rust from `rings/T27-00/queen_core.t27` and checks 14
+  # rows and 21 constants against the Swift table, does the same for the A2A
+  # rules in T27-01, then generates VERILOG from the same source, compiles it
+  # with iverilog and simulates it under vvp. It is the strongest claim this
+  # repository makes about itself, and it ran nowhere.
+  #
+  # It was left unwired one round ago on purpose, because `t27c` is built from a
+  # SEPARATE repository and the target SKIPS - exit 0 - when that toolchain is
+  # absent. Wiring it as-is would have produced a green job that measured
+  # nothing. The repository is public, so the honest version is to fetch it.
+  #
+  # AND THEN PROVE IT MEASURED. The target says `[SKIP] ... NOT MEASURED` in
+  # plain words when it cannot run, which is good manners and useless to CI: the
+  # exit code is still 0. The last step reads the log and fails on that phrase,
+  # and additionally demands both halves by name. A gate that can silently skip
+  # needs a second gate on top of it, and this is that.
+  t27-rings:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # Public, and read-only here: cloned into the runner's temp, never into the
+      # checkout, and nothing writes back to it. `--depth 1` because the history
+      # of the compiler is not part of the claim.
+      - name: Fetch the T27 compiler sources
+        run: git clone --depth 1 https://github.com/gHashTag/t27.git "$RUNNER_TEMP/t27"
+      - name: Verilog toolchain
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends iverilog
+      - name: The rings answer the same as the policy
+        working-directory: trios
+        env:
+          T27_ROOT: ${{ runner.temp }}/t27
+        run: |
+          set -euo pipefail
+          make t27-rings 2>&1 | tee "$RUNNER_TEMP/t27-rings.log"
+          log="$RUNNER_TEMP/t27-rings.log"
+          if grep -q 'NOT MEASURED' "$log"; then
+            echo "::error::t27-rings skipped instead of measuring - the toolchain it needs was not there"
+            grep -A2 'NOT MEASURED' "$log"
+            exit 1
+          fi
+          # Both halves by name, so a future edit that quietly drops one cannot
+          # pass by leaving the other green.
+          grep -q 'OK] ring00_parity' "$log"
+          grep -q 'OK] ring01_rules' "$log"
+          grep -q 'OK] ring00_verilog' "$log"
+
   server-units:
     runs-on: ubuntu-latest
     steps: