ci(codex-review): decide the gate on a required VERDICT trailer

[topcoder1]

Follow-up to #132, before any repo opts in. #132's rule is wrong in practice and this fixes it.

The problem with #132

It failed closed whenever the verdict was not recognizably clean. Codex phrases "nothing found" however it likes — three real clean verdicts observed since #132 merged:

verdict	#132 verdict
no regressions found	clean
No actionable regressions were identified	clean
The workflow consistently routes and validates Codex review outcomes, while the regression tests cover the relevant … cases.	unparseable → FAIL

The third is a genuinely clean review of domain-rank's opt-in PR. Under #132 it would have failed that PR. A gate that reddens clean PRs gets switched off — which is exactly how the comment-only signal it replaces died.

The obvious inverse — treat any prose without a regression: token as clean — is worse, and the Codex pre-review caught it on round 1: an off-format finding like "The new fallback branch has no test." would pass and restore the auto-merge bypass.

The fix: stop guessing at English

The prompt now requires the response to END with exactly VERDICT: CLEAN or VERDICT: REGRESSION, and that trailer decides.

• trailer present → it decides, except that listed findings outrank a CLEAN trailer. The trailer may not retract its own evidence.
• no trailer, but regression: findings → regression. Covers verdicts predating this prompt, and a model that reports but forgets the line.
• neither → no_verdict, fail closed. Also covers empty, whitespace-only, a missing file, and the workflow's own no-parseable-verdict sentinel.

One required output line is far more reliable to produce than a three-shape contract, and non-compliance becomes a crisp signal instead of a judgement call about prose.

Nothing below the trailer is forgiven — that's the decision

Rounds 4–6 each broke a successive attempt to whitelist trailing CLI telemetry, by writing a real finding in the same shape: "Usage: the token refresh path has no test.", then "Tokens used: 1 token can authorize every tenant". Every such filter is a hole in the final-line rule, which is the actual security property.

And it was defending a footer that does not exist — codex-cli 0.145.0 prints nothing after the response (verified against real captured output; the only tokens used matches were inside Codex's own prose describing the hypothetical).

So there is no filter. If a future CLI adds a footer, the trailer stops being last and enforcing repos go red — loud, diagnosable, fixable against a real sample — rather than silently eating a finding. A comment says not to re-add one without a real footer to match.

Two more bugs the trailer rule surfaced

• The gate now reads an untruncated verdict. The 4KB cap is a prefix cut for the PR comment, so it dropped the trailer and failed long-but-clean reviews closed. Reproduced: same verdict, capped → rc=1, full → rc=0.
• That cap truncates from a file, not a pipe. … | head -c lets head exit first and the writer take SIGPIPE, which pipefail turns into a failed step. Measured honestly: this needs the verdict to outgrow the pipe buffer (fine at 128KB, aborts at 2MB), so it is hygiene rather than a live failure — the file form is free.

Verification

• selftest/test_codex_verdict_gate.sh — 38 assertions, executes the real script. Replays the ci(risk-paths): exclude .env.example/template/sample from blocked glob #74/Required-checks audit: 2026-W22 #79 verdicts and all three live clean verdicts verbatim.
• test_workflow_guards.py — pins default: false, the env binding, comment-before-evaluate ordering, that the prompt still demands the trailer (prompt and parser are one contract), that the gate reads the untruncated file, and the no-pipe truncation.
• Full suite 45 passed; actionlint, shellcheck, prettier clean.
• Mutation-tested throughout. Latest: trailer-accepted-anywhere → 2 failures; telemetry-filter-restored (both loose variants) → 2 each; findings-cannot-override → 1; prompt-drops-trailer → guard fails.

I also found and fixed a vacuous-diagnostic bug in my own selftest: the failure detail was written with no trailing newline, gluing each following result line onto it, so a line-anchored grep '^✗' saw only the first failure. My earlier mutation counts were undercounts — the tests were stronger than reported, not weaker.

Codex rounds: 8 (findings in 1–6; 7 and 8 clean). Past the usual cap of 6 deliberately — rounds 4–6 were the same finding against successive versions of the telemetry filter, and the resolution was deleting that filter rather than patching it a fourth time.

Auto-merge rationale: manual merge — PRs to ci-workflows are always manual merge, and this touches .github/workflows/** on a reusable consumed by 27 repos via @main. Behavior is unchanged for every caller that does not set fail_on_regression: true; none do yet.

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

Risk class: blocked — manual merge required.

This PR touches one of the blocked path categories from .github/risk-paths.yml (Dockerfiles, docker-compose, .github/workflows/**, **/.env*, **/secrets*, infra/, terraform/, k8s/, or the classifier config itself).

Auto-merge is refused by claude-author-automerge.yml. A maintainer should review the diff and click "Squash and merge" themselves.

(This is a policy notice, not a code-quality failure. The classify job itself does not fail — required CI checks remain authoritative for "is the code green.")

[github-actions]

Coverage Floor — mode: enforce

metric	value
measured	100.0%
floor (current)	99.0%
target	100.0%
last bumped	2026-05-12

[claude]

No issues found. Trailer-based verdict logic is sound (findings outrank CLEAN, final-line-only, fail-closed), backwards-compat clean, and the new branches are well covered by selftests.