webos21 · Nov 11, 2026 · Nov 11, 2026
diff --git a/HISTORY.md b/HISTORY.md
@@ -41,6 +41,13 @@ pass. No native tests, CI jobs or release artifacts were rebuilt or rerun;
 product sources, workflows, pins and project locks are unchanged. Current scope:
 [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11).
 
+### Gate `main` on a single CI check and verify it
+
+`paths-ignore` is replaced by an in-workflow change classification and an always-running `CI gate`, because a workflow that never starts would leave a required check pending on documentation-only pull
+requests. The Linux/arm64 leg passed on a real pull request and on `push` to `main`. Ruleset `27002916` requires `CI gate` on `main` (no deletion or force push; administrators bypass so direct documentation commits keep
+working). Two draft verification pull requests, closed unmerged: a documentation-only change leaves the matrix skipped, the gate green and the pull request `CLEAN`; a deliberately failing test fails all five legs and the gate and the pull
+request is `BLOCKED`. The administrator bypass means a rejected push or merge was not observed. [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11).
+
 ### Add the Linux/arm64 CI leg
 
 `ci.yml` has a required `linux-arm64` leg on `ubuntu-26.04-arm`: the pinned published Linux/aarch64 CLI Preview acquires the public Linux/aarch64 Dev SDK, builds the checked-out sources and the four

diff --git a/README.md b/README.md
@@ -123,8 +123,8 @@ packages are out; default/project pin adoption is next; CI covers Linux/x86_64,
 Windows/arm64 D3 remains a separate qualification target.
 
 CI's five required jobs have a passing manual run, with Linux/x86_64 on two
-Ubuntu versions. The newly added Linux/arm64 leg still needs observed push/PR
-events; [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11)
+Ubuntu versions. The Linux/arm64 leg has also passed on push and pull-request events, and `main`
+requires the `CI gate` check; [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11)
 distinguishes workflow configuration, hosted results and deferred integration/release jobs.
 
 Preview qualification covers the actual packaged CLI, promoted SDK pin, trust,

diff --git a/STATUS.md b/STATUS.md
@@ -26,8 +26,9 @@ process-worker change `f49c279` is test infrastructure, not a product-source rev
 The five required GitHub CI jobs cover Ubuntu 24.04/26.04 x86_64, Ubuntu 26.04
 arm64, macOS/arm64 and Windows/x64. Manual run `42931003805` at `f6a41a8`
 succeeds on all five; its Linux/arm64 artifact is independently checked, while
-the other four retain their earlier artifact qualification. ARM64 push/PR
-events remain unobserved. [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11)
+the other four retain their earlier artifact qualification. Its push to `main` and
+pull-request events have since passed, and `main` is protected by a ruleset that
+requires the `CI gate` check. [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11)
 owns the current combinations and limits.
 
 Windows/x64's earlier concurrent-install crash was root-caused/fixed in the

diff --git a/TODO.md b/TODO.md
@@ -52,17 +52,16 @@ retain their later queues. Execution policy remains in
 
 ### GitHub CI
 
-`ci.yml` (PR and main, excluding documentation-only changes) bootstraps from
+`ci.yml` (PR and main; a documentation-only change skips the matrix inside the workflow, and
+`CI gate` is the one required check of the `main` ruleset) bootstraps from
 the pinned published Preview and is described in the
 [development guide](docs/guides/development.md#continuous-integration); completed steps live in HISTORY.
 Linux/x86_64 (`ubuntu-24.04` and `ubuntu-26.04`), Linux/arm64 (`ubuntu-26.04-arm`), macOS/arm64 (`macos-15`) and Windows/x64
 (`windows-2022`) are required legs.
 [CI acceptance](docs/acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11)
-owns the completed combinations and event scope, including both repaired Linux
-paths and the Linux/arm64 manual dispatch.
+owns the completed combinations, event scope and ruleset, including both repaired Linux
+paths and the Linux/arm64 dispatch, push and pull-request runs.
 
-- [ ] Observe the new Linux/arm64 leg on push to `main` and on a pull request;
-  its passing branch dispatch does not establish those event paths.
 - [ ] `integration.yml`: the five input-gated port suites (`port-build|store|oracle|command|project-test`) with the
   pinned independent host tools, zlib source archive and oracle, plus redirect/transport replays. Daily and manual.
 - [ ] `release.yml`: protected, manually approved packaging from a tested CI artifact, independent extraction and

diff --git a/docs/README.md b/docs/README.md
@@ -41,7 +41,7 @@ from the SDK build baseline:
 
 - [GitHub CI](acceptance/ci_acceptance.md#current-hosted-coverage-2026-11-11):
   five required hosted jobs across four host/architecture pairs, the retained
-  local and failed-run evidence, and outstanding event/integration/release gates.
+  local and failed-run evidence, the `main` ruleset, and outstanding integration/release gates.
 - [Dev SDK / CLI Preview](acceptance/preview_acceptance.md): bounded local candidate,
   published Linux/x86_64, Linux/aarch64, macOS/arm64 and Windows/x64 packages,
   actual SDK/CLI/resource identities, isolated workflows and publication limits.

diff --git a/docs/acceptance/ci_acceptance.md b/docs/acceptance/ci_acceptance.md
@@ -433,4 +433,33 @@ required: that SDK was exercised on glibc 2.43 only, so no `ubuntu-24.04-arm` le
 The `linux-arm64` artifact summary was downloaded and checked: result `pass`, glibc 2.43, LLVM/LLD 21.1.8, the same four suite counts, stage 1 and stage 2 byte-identical, bootstrap executable `9fbef825...`, SDK pin as above. The other four legs
 are unchanged inputs and were not re-verified artifact by artifact here.
 
-Not covered: pull-request and `push` events on `main` for this leg (the first run was a manual dispatch from the branch; a runner or image change fails closed), Ubuntu 24.04 arm64, other glibc versions, and the `integration.yml` and `release.yml` queues.
+Not covered by this dispatch run: pull-request and `push` events for the leg (observed afterwards, see [Current hosted coverage](#current-hosted-coverage-2026-11-11)), Ubuntu 24.04 arm64, other glibc versions, and the `integration.yml` and `release.yml` queues.
+
+## Current hosted coverage (2026-11-11)
+
+**Events.** The `linux-arm64` leg (`ubuntu-26.04-arm`) has now passed on every event path that triggers `ci.yml`, each time with all other legs green:
+
+| Event | Run | Source | Result |
+| --- | --- | --- | --- |
+| `workflow_dispatch` (branch) | `42931003805` | `f6a41a8` | success, 5 jobs |
+| `push` to `main` | `42932786276` | `6201aa6` | success, 5 jobs |
+| `pull_request` | `42946566272` | `47c3a03` (PR 1) | success, `changes`, 5 native jobs and `CI gate` |
+| `push` to `main` (merge of PR 1) | `42948410361` | `0cf5a77` | success, `CI gate` reported by `github-actions` |
+
+**Change classification.** `paths-ignore` is replaced by a `changes` job and an always-running `CI gate` (see the [development guide](../guides/development.md#continuous-integration)):
+a workflow that never starts leaves a required status check pending, which would block every documentation-only pull request. The classifier was exercised locally on a documentation-only range
+(`code=false`), a code range, a mixed range, an unreachable `before` and a manual dispatch (all `code=true`, i.e. the full matrix). Unclassifiable input runs the matrix; skipping requires a proven documentation-only change.
+
+**Ruleset.** Repository ruleset `27002916` "main requires CI gate" (`active`) targets `refs/heads/main`: required status check `CI gate` from the GitHub Actions app (`integration_id` 15368, not strict), no deletion, no non-fast-forward.
+Repository administrators bypass `always` (chosen so that the maintainer's direct documentation commits keep working); pull requests from anyone else cannot merge unless `CI gate` passes.
+Two verification pull requests were opened as drafts and closed without merging, with their branches deleted:
+
+| Pull request | Change | `CI gate` | Merge state |
+| --- | --- | --- | --- |
+| 2 | one HTML comment in `docs/README.md` | success; `changes` success, the matrix `SKIPPED` | `CLEAN` / `MERGEABLE` |
+| 3 | a deliberately failing test in `tools/test_ci_bootstrap.py` | failure; all five native jobs failed | `BLOCKED` |
+
+**Limits.** The rule's effect on a non-administrator cannot be observed from the administrator account used here: the administrator bypass means a direct push to `main` or a merge of a failing pull request would still be accepted,
+so the `BLOCKED` state is evidence of the rule, not of a rejected push. No second account tried to push. Bypass is `always`, not `pull_request`; tightening it later removes direct pushes for the maintainer too.
+A pull request needs no review (no approval rule is configured). Required checks apply to `main` only; tags and other branches are unprotected. A runner label or image change fails the leg closed rather than skipping it.
+