fix(ci): let the verdict line carry a trailing clause (HT-100) - #202

🟢 SAFE TO MERGE

Decision provenance

What changed

The first-line check merged in #110 required the opening line to be exactly the verdict. That rejected an ordinary opener that states the verdict and then says why (## 🔴 DO NOT MERGE — review and CI pending), training people to paste ceremony to go green.

The line still must open with the verdict — nothing may precede it — but a trailing clause is now allowed.

Follow-up commit (4d1a0e83): the trailing-clause widening let a body read ## 🟢 SAFE TO MERGE — INFERRED and pass, because the pre-existing check that looks for INFERRED only scans rows inside the Decision provenance table, never the verdict line itself. Added a guard: when the verdict is green, the first line may not itself contain the literal token INFERRED (matched case-sensitively — a case-insensitive match would fail an honest clause like "no inferred items" for using the plain word, reintroducing the exact failure this PR exists to fix).

Review history — two reviewers, two commits

CodeRabbit reviewed 368c4d3f (the initial trailing-clause widening) and found one Major: the INFERRED-on-the-verdict-line bypass above. Fixed in 4d1a0e83.

CodeRabbit: 1 finding, 1 real and fixed.

CodeRabbit's next review request on 4d1a0e83 (the guard fix itself) came back rate-limited. Ran an adversarial pass with Codex instead, pointed specifically at the new guard.

Codex (adversarial, in place of CodeRabbit — rate limited on 4d1a0e83): 6 findings, 2 verified pre-existing and filed as follow-up issues, 4 not applicable.

• Zero-width-space / homoglyph / full-width-Unicode variants of INFERRED bypass the guard — real, but the same literal-match weakness already exists in two other checks in this file (provenance-row scan, attribution scan), so it isn't specific to this guard or this PR. Filed as PR-verdict gate: Unicode evasion (zero-width, homoglyphs) bypasses literal token matching #204, with the fix belonging at a body-normalization layer rather than three separate patches.
• verdict_is() accepts ## SAFE TO MERGE (no emoji) and ## 🔴 SAFE TO MERGE (wrong emoji) as a valid green verdict — verified pre-existing, not a regression: running the same bare-marker lines through the pre-fix(ci): let the verdict line carry a trailing clause (HT-100) #202 regex (...SAFE TO MERGE[[:space:]]*$, no trailing-clause allowance) matches them identically. That reproduction is what makes this a follow-up rather than something this PR needs to fix. Filed as PR-verdict gate: verdict_is() treats the marker emoji as decorative, not authoritative #205, which carries the reproduction.
• Lowercase inferred bypasses the new guard — not a bug, the deliberate case-sensitive design choice above.
• A semantic synonym ("assumed without authorization") isn't caught — a pre-existing protocol-level limit shared by every check that looks for the literal token, not specific to this guard.
• A combining accent placed after the token — verified still caught correctly.
• Multiline/first-line extraction — no issue found.

Verification

All checks re-run against the guarded version (bash + GNU grep 3.11 under Ubuntu 24.04, matching ubuntu-latest, not just macOS): the original nine crafted bodies from #202, plus ## 🟢 SAFE TO MERGE — INFERRED (now rejected), ## 🟡 NEEDS YOUR DECISION — 2 INFERRED items (still accepted — the guard only applies to a green verdict), and a green body with INFERRED in a provenance row but not the first line (still rejected, via the pre-existing check, unmodified).