Prevent ticket and epic closeout without required acceptance evidence

[shaug]

Incident

Tuber Service epic #957 exposed a closeout defect in implement-ticket and implement-epic.

• The first closeout admitted that manual Chrome verification was unavailable and no deployment occurred.
• Later escapes included a browser bundle failure, invalid deployed BigQuery SQL, an API-transport date mismatch, and a full-shell visual layout failure.
• The second closeout had functional browser checks but no visual or computed-layout evidence.
• Several original children explicitly required manual desktop, mobile, deep-link, or legacy-bookmark checks. Merge-driven Fixes #... closure and native closed-state checks nevertheless allowed the children and parent to be treated as complete.

Merged code, green CI, clean review, and tracker closure are delivery evidence. They are not substitutes for ticket-authored acceptance evidence.

Goal

Make implement-ticket and implement-epic fail closed unless every ticket-authored required acceptance criterion and verification item is mapped to current, concrete evidence. Tracker closure must be a consequence of verified acceptance, never its source.

Scope

• Add a criterion-specific acceptance-evidence contract in the existing packet/result style where practical.
• Bind evidence to the exact candidate or deployed SHA and, when relevant, environment or URL.
• Distinguish implementation/merge state from pre-merge and post-merge acceptance state.
• Make GitHub closing-keyword selection depend on whether required acceptance can occur before merge.
• Make epic closeout revalidate child acceptance evidence and the epic's own criteria.
• Define proportional post-escape behavior for reopened tickets and epics.
• Update GitHub and Linear guidance, closeout/result guidance, tests, and result-blind forward evaluations.

Non-goals

• Do not require browser, deployment, authenticated, integration, manual, visual, or full-system evidence unless the ticket's acceptance/verification contract requires it.
• Do not expand the review skills or make babysit-pr own tracker transition, deployment, post-merge acceptance, or ticket lifecycle.
• Do not add a new terminal status or schema unless existing blocked, unresolved-obligation, and documented handoff fields cannot express the outcome safely.
• Do not change the acyclic composition: implement-epic -> implement-ticket -> (review-code-change, babysit-pr).
• Do not create an epic or change native dependency edges for this work.

Required behavior

Acceptance ledger

Before a ticket can be reported complete, map every authored acceptance criterion and required verification item to:

• criterion text or stable identity;
• whether it is required;
• required evidence category;
• exact candidate or deployed SHA;
• environment or URL when relevant;
• evidence source such as command output, CI job, deployment run, browser observation, screenshot, geometry/computed-layout observation, or tracker comment;
• pass, fail, or missing.

Reject evidence for a stale candidate SHA, stale deployment, wrong environment, or evidence category that does not satisfy the criterion. Functional browser evidence does not satisfy an explicit visual-layout requirement without screenshot or geometry/computed-layout evidence.

Pre-merge and post-merge acceptance

• Pre-merge criteria must pass before readiness or merge.
• Criteria that can only be verified after merge or deployment may remain pending through merge, but the workflow must report implementation/merge complete and acceptance pending rather than ticket complete.
• Missing required manual, deployed, authenticated, integration, or visual verification is a blocker, not a success caveat.
• A backend-only ticket without UI or deployment requirements must not acquire irrelevant gates.

GitHub auto-close

• state: CLOSED, all children closed, merged PRs, Fixes #..., green CI, clean reviews, and zero unresolved threads are not acceptance proof.
• When required acceptance occurs only after merge, use a non-closing reference such as Refs #... or Supports #..., then close manually only after the evidence ledger passes and close authority exists.
• If GitHub auto-closed a ticket while required acceptance remains missing, treat it as incomplete. Reopen it when authorized, or report missing reopen authority as a blocker.

Authority

Preserve separate authority for implementation, merge, deployment, tracker reopen/close, parent closeout, graph mutation, production mutation, and cleanup. Merge authority alone must not imply deployment or tracker/parent closure.

Epic closeout

Before parent closure:

• reread the complete live native graph;
• verify every required child's acceptance ledger, not merely state;
• verify the epic's own acceptance criteria;
• verify current-main representation and exact deployed SHA when deployment is required;
• keep the parent open when any required evidence is missing, failed, stale, or bound to the wrong environment;
• distinguish "all implementation PRs merged" from "epic accepted."

Post-escape

When a supposedly completed ticket or epic is reopened for an escaped acceptance defect:

• require a focused corrective ticket;
• require a regression test at the escaped boundary;
• revalidate the full affected customer journey, not only the latest defect;
• require renewed acceptance evidence before reclosure.

Keep revalidation proportional to the affected journey and authored requirements.

Failure and terminal behavior

• Missing, failed, unavailable, stale, or category-mismatched required evidence returns the existing equivalent of acceptance pending or blocked; it must not return successful completion.
• A merged candidate may be reported as merged delivery with explicit post-merge acceptance obligations, but the ticket remains open or is reopened until those obligations pass.
• Parent closeout remains blocked until child and parent ledgers pass.
• If required verification infrastructure or authority is unavailable, name the missing evidence/authority and the next action.

Acceptance criteria

• Every ticket-authored required criterion and verification item is represented by a criterion-specific evidence record with category, SHA, environment/URL when relevant, source, and pass/fail/missing status.
• Required missing, failed, stale, wrong-environment, or wrong-category evidence prevents ticket completion.
• Pre-merge requirements gate readiness/merge; post-merge requirements gate tracker completion without misreporting delivery state.
• GitHub closing keywords are non-closing when required acceptance occurs only after merge, and accidental auto-close does not become acceptance proof.
• implement-epic verifies every required child's acceptance evidence and the epic's own criteria before parent closure.
• Explicit visual-layout requirements require visual or geometry/computed-layout evidence; functional browser checks alone are insufficient.
• Backend-only tickets do not acquire irrelevant UI or deployment gates.
• Merge, deployment, tracker-transition, and parent-close authorities remain distinct.
• Reopened escape work requires a focused correction, regression test, affected-journey revalidation, and renewed acceptance evidence.
• Existing successful implement-ticket and implement-epic cases remain valid.

Validation and forward evaluation

Use fresh-process, result-blind packets that do not expose expected outputs or grader markers. Cover at least:

1. all children closed/merged/green/clean but required manual browser evidence missing;
2. auto-closed ticket with missing post-merge deployment evidence;
3. required authenticated deployed verification with browser unavailable;
4. functional browser pass with missing explicit visual-layout evidence;
5. all criteria satisfied at the correct SHA/environment;
6. backend-only ticket with no irrelevant UI gates;
7. merge authority present but deployment or tracker-close authority absent;
8. reopened epic with corrective child merged but affected journey not revalidated;
9. stale evidence for a prior candidate SHA or deployment;
10. existing successful workflow cases.

Run focused workflow tests and evaluations, including just eval-implement-ticket, the corresponding implement-epic evaluations, relevant schema/fixture tests, and the repository-required just format, just lint, and just test gates.

Run the repository-owned exact-head review sequence through review-code-change and address all material findings before publication and after any head-changing fix.

Terminal expectation

Completion requires a merged, current-main-represented implementation whose new issue acceptance ledger is fully evidenced by passing focused evaluations, full repository gates, current-head review, CI, and live tracker verification. Close this issue manually only after that evidence is read back and confirmed.

[shaug]

Acceptance ledger

Issue #65 is accepted against current main at a3597c25ee2d76135d1f0c8642a620e673fc8e57.

• Delivery: PR Require acceptance evidence before workflow closeout #67 was squash-merged from reviewed head 60aa3c419988ed7b1c353261f48460f887dc0a02; GitHub CI passed at that head.
• Exact-head review: the repository-owned three-lens sequence completed cleanly with no findings after the final fixes.
• Criterion records: delegated and workflow contracts now require category, authored source, stage, exact candidate or deployment identity, environment/URL where applicable, and pass/fail/missing status.
• Failure boundaries: missing, failed, unavailable, stale, wrong-source, wrong-environment, wrong-category, and wrong-identity evidence fail closed.
• Delivery versus acceptance: pre-merge evidence gates readiness; merged delivery with pending post-merge evidence remains blocked and preserves its candidate.
• GitHub closeout: PR Require acceptance evidence before workflow closeout #67 used Refs #65, leaving this issue open through merge and post-merge verification.
• Epic closeout: child and parent ledgers are revalidated, and the complete graph refreshes after every verified delivery or tracker transition even when acceptance remains pending.
• Evidence categories: explicit visual-layout requirements cannot be satisfied by functional browser evidence; backend-only cases do not acquire UI or deployment gates.
• Authority: merge, deployment, manual tracker update, automatic closing syntax, and parent closeout remain distinct; delegated merged results require caller-observed tracker state and a matching consumed-authority ledger.
• Escape recovery: focused correction, regression coverage, affected-journey revalidation, and renewed evidence remain required before reclosure.

Current-main verification

Executed from a fresh detached worktree at the merge commit:

• just eval-implement-ticket: 41/41 passed
• just eval-implement-epic: 6/6 passed
• just format: passed
• just lint: passed
• just test: passed, including 62 implement-ticket tests, 13 implement-epic tests, and 208 review-suite tests

The post-merge worktree was clean, PR #67 had no review items or unresolved threads, and the live issue remained open until this manual closeout.