OK  source sha256 matches the certificate
OK  certificate seal recomputes
OK  gate needs match the certificate (3 jobs: changes, lint, unit-tests)
OK  gate aggregates over its needs (toJSON(needs)), so it sees exactly those jobs
OK  its failure step actually rejects a bad result
     step 'Fail if any dependency did not pass': consumes the aggregate=True, discriminates on .result=True, has a non-zero exit=True
     exercised all-pass: exit 0 as expected
     exercised one-failure: exit 1 as expected
OK  counterexample for 'contract-tests' reproduces exactly
     contract-tests fails. The gate reads changes, lint, unit-tests, none of which is contract-tests, so nothing it sees has changed. all-green reports suc

uncovered jobs claimed by the certificate:
  contract-tests           OUTSIDE THE GATE   (renders as 'contract tests')
                           job-level condition: needs.changes.outputs.api == 'true'
                           in gate needs: False   reachable to gate: False   inspected dependents: none
                           severity: latent, runs only when its condition holds

VERDICT   CLOSURE GAP CONFIRMED
          Each listed job sits outside the gate's closure: not in its
          needs, not reachable to it, and with no inspected dependent.

A confirmed gap means the job is structurally outside the gate.
It does NOT mean the job ought to be inside it: that is your policy,
and the certificate records it as unresolved.

=== instrument ===
record              record.json
instrument          gate 1.0.0
profile             report
subject             workflow example-org/example-service .github/workflows/ci.yml
claims              5  {'holds': 3, 'unresolved': 2}
  note              envelope schema: validated with jsonschema
  note              source binding verified: ci.yml
  note              gate enforcement unverified: the record does not claim this gate is required, which a workflow file cannot establish
  note              analyser cli.py committed at entry 9 on 2026-08-17T09:41:27Z
  note              analyser gexpr.py committed at entry 3 on 2026-08-16T15:38:27Z
  note              analyser counterexample.py committed at entry 10 on 2026-08-17T09:41:27Z
VERDICT             SELF_CONSISTENT_REPORT
                    (self consistency and source binding, NOT authenticity or issuance)

=== the log ===
entries            15
head               cdceb61000bb0c9e5319dbb377711eaa
anchor             public-git https://github.com/arcifact/arcifact-site
  note             head signature verified against arcifact-issuer-2026-08
VERDICT            AUTHENTIC_CHAIN
                   The entries you read are the entries the issuer signed, in
                   order and unaltered. Timestamps remain the issuer's word:
                   date the head against public git history.
