feat(ci): canonical merge gate — line scope + waive rail (protoAgent#1874)

[mabry1985]

Canonicalizes the merge gate here (the parser must track reporting.ts's format) and fixes protoLabsAI/protoAgent#1874:

• Line scope: with the PR's unified diff as a third input, a finding blocks only when evidence lines intersect a changed hunk (±3 context lines). Pre-existing debt on untouched lines of a touched file drops to INFORM — ends the N-round tax on shared files (dogfooded on protoContent#424). Line-less evidence on a touched file still blocks (format drift fails closed).
• Waive rail: protopatch-waive: <findingId> — <reason> in the PR body (passed via $PROTOPATCH_WAIVERS) drops that finding to INFORM, logged loudly in the step summary — audited, never silent.
• Without the new inputs, behavior is compatible with the old file-scoped gate (consumers upgrade by adding two workflow lines; integration snippet in docs/code-review.md).
• 13 stdlib-unittest tests, wired into CI.

protoContent's vendored copy gets synced in a follow-up PR.

🤖 Generated with Claude Code

[protoquinn]

👀 Quinn is reviewing — verdict (PASS / WARN / FAIL) + findings to follow.

[protoquinn]

QA Audit — PR #8 | feat(ci): canonical merge gate — line scope + waive rail (protoAgent#1874)

VERDICT: PENDING CI — non-blocking comment; CI checks are still settling.

---

CI Status

• test: queued
• Analyze (actions): in_progress
• Analyze (typescript): in_progress

Diff Review

• New ci/protopatch-gate.py (197 lines): canonical merge-gate script with line-scope filtering and waive rail. Well-structured Python — regexes are correct, edge cases handled (pure-deletion hunks as point ranges, conservative fail-closed on line-less evidence, graceful fallback when inputs are missing).
• .github/workflows/ci.yml: wires python3 ci/test_protopatch_gate.py into the test job.
• .gitignore: adds __pycache__/.

Observations

• GAP: clawpatch structural review unavailable — protoLabsAI/protoPatch not in the project registry. Diff is 366 lines across 5 files including CI workflow; a structural pass would add cross-file confidence.
• INFO: ~170 lines of the diff (tests, possibly docs) fall outside the truncated preview — review of ci/test_protopatch_gate.py is limited to what the PR description states (13 stdlib-unittest tests).

Approve-on-green policy: once all CI checks settle terminal-green with no blocking findings on this comment, the deterministic approve-on-green policy promotes this review to APPROVED automatically and the PR merges. A promotion note posts on the PR when it fires.

— Quinn, QA Engineer

[protoquinn]

Submitted COMMENT review on protoLabsAI/protoPatch#8.

[protoquinn]

CI terminal-green, no blockers on prior review — auto-approving on green (#748).

[protoquinn]

✅ CI went terminal-green with no blockers on the prior review — promoting it to APPROVED per the approve-on-green policy (#748).

[protoquinn]

🔀 Approved and terminal-green, but GitHub's auto-merge never completed (phantom BLOCKED — ws-5sc); the reconciliation sweep completed the squash merge.