gate(ROCM): M4 for Qwen3.5-0.8B GDN -- the oracle-backed near-tie gate as the RED anchor of the forward-divergence fix - #559

… validates an outside contributor's trailers (#773) (#782)

Closes #773.

`check-pr-size.py` and `check-commit-trailers.py` both required the base revision
to be an ANCESTOR of head. CI passes `github.event.pull_request.base.sha`, the
TIP of the base branch, which stops being an ancestor the moment main advances
after the branch was cut -- continuously, on this repo.

Measured on three open PRs before changing anything. Base is not an ancestor in
any of them, and a merge base exists in all three:

    #506  ancestor=NO  merge-base=e1087a881
    #523  ancestor=NO  merge-base=fdd452637
    #559  ancestor=NO  merge-base=fafa16f0f

The consequence was not a noisy red check. Both checkers aborted BEFORE
examining anything, so CI had never validated commit trailers on an external
contribution: the gate enforcing FOLLOWING_AGENTS_PROTOCOL and Assisted-by:
exited before reading a single commit. Across the external PRs reviewed this
week, hand-checking by a reviewer was the only verification those trailers
received. pr-size aborted identically, so path classification and the
checker-evidence contract went unenforced on forks too.

THE FIX. Diff from the merge base, which is what a pull request IS: `git diff
A...B` is defined as `git diff $(git merge-base A B) B` and is what GitHub
shows. Two-dot diffing against a moved main is not merely stricter, it is WRONG
-- main's own commits render as reversions inside the contributor's diff, so
paths they never touched get classified and charged to them. The new pr-size
test asserts both halves: the PR's file present, main's absent.
`executable_evidence` gets the same treatment, since the BASE version of a
checker for the red-before half is the one at the merge base.

WHAT DELIBERATELY DOES NOT MOVE. The old rule conflated two situations:
ordinary divergence (merge base exists) now examines merge_base..head;
unrelated histories (no merge base) STILL RAISES. Absence of information must
never look like absence of work -- the script's own require_origin_main()
docstring already states that principle for the other input.

test_missing_and_nonancestor_objects_fail_closed uses an ORPHAN branch, so it
still raises; only its regex changed, because the message now names what is
actually wrong. Its assertRaises(ValueError) is untouched. The trailers case was
SPLIT, not deleted: its divergent-branch half built two branches off a common
root -- which share a merge base and are the ordinary shape of every PR -- so
that half now asserts it validates, with the genuinely-unrelated case asserted
separately. Nothing that used to fail closed stopped failing closed.

Range changed, contract unchanged:
test_a_bad_trailer_in_the_merge_base_range_is_still_reported puts a trailerless
commit inside the new range and requires it still be reported.

RED before on the unmodified checkers, GREEN after (74 passed, 148 subtests).
Stop conditions checked individually rather than inferred. Full tests/scripts:
9 failed / 1359 passed, all nine pre-existing and reproduced on main.

CI: agent-record and pr-size both SUCCESS on this PR -- the two checkers it
repairs passing on a live PR. Remaining red is baseline only: windows-msvc-*
are the PR-only arm (#584), and sanitize-cpu is red on main itself for #775
(test_nemotron_h_scaffold, nemotron_h_registry.cpp:112 downcasting a doctest
StubModel to NemotronHLoadedModel). This PR touches no C++.

…d of aborting the pass (#776) (#853)

Closes #776.

`test_op_parity` THREW instead of failing an assertion:

    tests/parity/test_op_parity.cpp:1989: ERROR: test case THREW exception:
    [json.exception.type_error.302] type must be string, but is null

The malformed input was tests/parity/goldens/minimax_music3_oracle/manifest.json
-- an oracle capture with no "op" key at all, the only non-op manifest among the
66 committed. Attributed decisively rather than by inference: rebuilding the
pre-fix source and moving that one directory aside turned the same binary green,
70 assertions -> 123. The throw was hiding a third of the gate.

#776 IS A DUPLICATE, AND THAT IS NOT THE END OF IT. #755 is the same defect,
closed by 043e568 (#761) eight minutes after #776 was filed, and the manifest
is already repaired on main. Reporting only that would have been accurate and
useless, because #761 closed the walker's INPUT SET and not its EXCEPTION
SURFACE. Reproduced on the FIXED tree by nulling one tensor dtype in
rmsnorm_f32_8x128:

    :2177: ERROR: test case THREW exception: [...type_error.302...]
    [doctest] assertions: 37 | 37 passed

37 where 153 should run -- 45 committed goldens never reached, on a tree where
this was supposedly closed. The gate was one bad field away from silently not
gating.

WHY THAT MATTERS: test_op_parity is the guard that refuses a golden whose
manifest names an op with no registered runner. It is what caught PR #559's
missing runner arm. A throw at manifest-read time aborts the case, so every
golden after the malformed one goes unchecked -- not merely a red job, a gate
that had stopped gating.

THE FIX, both halves. The two remaining throw sites (json::parse on the
manifest, and any runner field read) funnel through GuardGoldenStage, which
converts a std::exception into a FAIL_CHECK NAMING goldens/<case>/manifest.json,
quotes the original exception, and continues to the next golden. The dispatch
chain moved into RunGoldenCase so its `continue`s became `return false`, which
is what permits a per-case catch.

std::exception is the deliberate width: doctest::detail::TestFailureException is
NOT derived from it (third_party/doctest/doctest.h:2563). That is load-bearing
-- the "no runner for op" refusal is a FAIL, and a wider catch would have
cleared the red while REMOVING the gate.

MUTATION EVIDENCE, tree restored byte-for-byte each time (823 files, md5sum -c):

  dtype: null in a real golden -> named by path; 45 op cases STILL RAN, 152
      assertions still checked (was: THREW, 37)
  invalid JSON manifest        -> named by path; 46 cases ran, no THREW
  {"op": null} / missing "op"  -> refused by name, pass continues
  {"op": "no_such_runner_op_559"} -> FATAL ERROR: no runner for op ...
      -- the #559 guard STILL BITES

The last row is the one that mattered; without it the others would only prove
the red was silenced.

GREEN: focused 13 cases / 153 assertions, with 46 op cases + 1 non-op skip --
counts IDENTICAL to before, so the extraction changed nothing about what is
gated. sanitize-cpu (address,undefined) rebuilt with the job's own flags and run
under its env: SUCCESS. pytest tests/scripts: 1400 passed, 9 failed, all three
distinct failures reproduced on a clean origin/main worktree.

Survey: ~167 unguarded m.at(...) reads live inside runners in this file and the
guard covers them generically. Other json::parse sites in tests/ each read one
named fixture owned by their own case, so a throw there fails one already-named
test rather than a walker over an open input set. No follow-up owed.

CI: merged with checks queued -- the runner pool has been saturated for hours
and no job started on this head. The sanitize lane, which is the one this
change exists for, was reproduced locally with that job's own build flags and
environment.

Note main moved mid-gate: #840 relocated the issue table out of roadmap_v1.md
into the append-only .agents/issue-index.md. roadmap_v1.md was taken from
origin/main wholesale and the #776 row reapplied as an append to the new index.