Wire or remove the unproven claim_authors fallback in gate-state trust check #180

Background

PR #177 (issue #166) shipped the durable per-issue gate-state substrate, including isTrustedGateStateAuthor(login, trust). The primary trust rule is login === trust.self_login, where self_login comes out of band from gh api user --jq .login and cannot be forged by a commenter. There is a documented fallback, trust.claim_authors, intended for GitHub App installation tokens where gh api user 403s, restricted to authors of a claim comment that is fresh (< CLAIM_STALE_SECONDS) or whose batch: matches the current run's target.

Confirmed still true at HEAD: the pinned jq in the gate-state probe (gateStateProbeCommandLine) only ever selects ## Gate State blocks, never claim comments, so every production call site passes claim_authors: []. docs/architecture/gate-hygiene.md describes the fallback as if it functions for installation-token deployments, but in the shipped code it's dead — the fallback branch is fed by no one.

Two compounding issues to resolve together

1. No producer. Either extend the pinned jq with a second projection to fetch claim blocks (e.g. claim_blocks: [.comments[] | select((.body|startswith("## Ticketmill Claimed")) or (.body|startswith("## Batch Processing Claimed"))) | {body, author_login: .author.login}] | .[-2:]) so JS can derive claim_authors deterministically with the freshness/batch restriction, or drop the fallback from the trust check and correct gate-hygiene.md to stop describing it as functional.

2. Fail-open on empty self_login. If self_login is empty (the gh api user 403 case this fallback exists for) and a block's author_login is also missing, login === trust.self_login evaluates '' === '' — true — so an empty read makes everything trusted. This is the opposite of the intended fail-closed direction. Require a non-empty self_login before any comparison, and give the "blocks exist but none is trusted" case its own name in the state table (code review's suggestion: malformed with trusted: false) with a covering fixture.

Impact today

Zero — this repo's PAT-based self_login resolves fine, and the current failure direction (unresolved trust check degrades a block to found (untrusted author), never silently-trusted) is safe for PAT deployments. This becomes load-bearing the moment the consumer-wiring follow-up (seeding ctx.metrics/ctx.settled from parsed gate state) lands, so it should be resolved before or alongside that tier, and is required before any installation-token deployment.

Source

Raised in spec review iteration 1 and code review (non-blocking notes) on PR #177, and as a major finding in contrarian approach-challenge iteration 3 on issue #166.