Turn on automatic UK promotion under d1344

[MaxGhenis]

Merge hold: cos d1613 (security). Until 16 Oct 2026 this branch's history carried a pre-suppression aggregate-impact report (tests/fixtures/uk_metrics/budget_metrics_report.json, blobs c79f1a06 from 3ea0b19 and 6b599fb5 from b424ffb). That report published Disabled Students' Allowance, which comes from fewer than 10 records, unsuppressed. The tip now carries W3's suppressed 1.58.1 report at tool commit 228a05a3e. Max is deciding whether to rewrite the history. Don't merge, force-push or delete anything for it until d1613 is ruled.

Fixes #634

Stacked on #574. Known gaps and review bounds wait on other workstreams (scorecard#183; W3's approved aggregate-impact commit), so they land as follow-up PRs. The strict rule holds until then: no known gaps, and the current bounds only send moves to review. The base is w4/uk-candidate-qualification. It retargets to main when #574 merges.

Plan

• Replay gate policy d1344-replay-regressions-v1 (this commit; details below).
• Follow-up PR, known gaps: vendor scorecard#183's diff.base_events and the candidate's missing/unsupported lists once they merge on scorecard main, and implement the exact known-gap test. The vendored schema is closed, so receipts carrying those fields are refused until then.
• Follow-up PR, review bounds and W3's suppression rules, with the re-pin to W3's approved aggregate-impact commit and the regenerated 1.58.1 fixture.
• promotion.automatic: true, with the d1344 basis in uk.json (0b74ddb). This also fixes a dormant bug. The automatic step used gh pr merge --auto, but main is not branch-protected and the repository has allow_auto_merge off, so the call would have failed silently (check=False) and nothing would ever promote. Promotion now merges at the qualified commit only once every check on the candidate PR has passed. Skipped jobs count as passed; pending, failed or cancelled checks, none reported, or an unreadable list wait for the next run. --match-head-commit still refuses a moved branch.
• Requalify stale-baseline candidates, for liveness (3b93070). A promotable pair that advances main, but was qualified against an earlier certificate, resolves to qualify without force, once per main commit. The promotion plan names it (PromotionPlan.requalify), a new requalify command prints it, and catch-up dispatches it after finishing waiting receipts. Rejected, unaccepted and sideways pairs never requalify. Five mutants are killed.
• Independent review, then merge on the gates.

The d1344 basis

cos d1344, decided 15 October 2026: "Yes: delegate the methodology calls the CI plan raises to the workstream sessions, each with independent review agreement and receipt-recorded exceptions". The same decision turns automatic promotion on once #574 lands on its gates.

The replay call was made by W4.

• The first independent review (GPT-6.1 Sol) disagreed. It showed that incompleteness includes inertness, and that diff flags can't prove the base's state.
• W4 revised the policy. The second review agreed with changes, and W4 applied exactly those.
• W6, which owns the replay receipt, and the coordinating session agreed. The coordinator's alternative, failing any head moved past the bound, was considered and sent to review instead.

The policy text ships as src/policyengine/data/qualification/replay_policy.md. Each receipt records its id and the text's SHA-256.

Fail:

• rejected, failed or unbound receipts;
• mapping flags;
• lost results: a coverage row with a base value and no candidate value;
• lost responses: a measure-year the candidate lists as inert, or a measure-year total of exactly £0 against a base of at least max(£1m, 1%) in absolute value;
• incomplete grids.

Known gaps need positive base-side evidence. None exists yet, so there are none, and the rule is strict.

Review: every other flagged row. That includes sign reversals, construction and support flags, coverage gains and null/null rows, and base-only inertness.

Invariants (property-tested)

For every receipt:

• the gate fails exactly when a regression is recorded;
• no flagged row ever passes;
• mapping flags and lost results always fail;
• adding a flagged row never makes the verdict better (pass < needs_review < fail).

test_the_replay_policy_is_monotone_and_never_passes_a_flag checks these with Hypothesis. The decision record's regression table, the bound's edges (exactly £1m fails, £999,999 is reviewed, a negative base fails, a non-measure-year £0 is reviewed) and the first real receipt are example tests.

Differential check on real data. The 6.4.1 receipt (e3cc6521…, now a fixture) fails on exactly its four inert UC measure-years: £264.1m, £338.6m, £436.3m and £626.6m, each going to £0. Its incomplete spring_statement_2025 grid fails it too, and its other 345 flagged moves and 1 coverage gain go to review. That matches the decision record's stated effect.

Nine mutants are killed: the signed bound, a strict bound, any level, the inert list ignored, lost results as review, lost rows also reviewed, no counted flags, integrity-incomplete ignored, and incomplete events ignored.

Tests

tests/test_qualification_contracts.py, test_qualification_ledger_concurrency.py and test_uk_qualification_pipeline.py: 192 passed.

axiom: n/a: qualification CI infrastructure, no policy encoded.

🤖 Generated with Claude Code

[MaxGhenis]

Merged at reviewed head 918939b with a merge commit. Gates: gh pr checks exit 0 (13/13 pass), mergeable, no change requests. Independent review (GPT-6.1 Sol, 13 rounds): round 11 APPROVE of the substance at 69d6f1f under the stated trust boundary (main only ever becomes the exact qualified commit, on current main, after its own-tree run passed; writers' deliberate disguise is out of scope since main is unprotected), round 12 APPROVE at efd9d7c and round 13 APPROVE at 918939b (wording-only commits; syntax trees identical without docstrings). Automatic promotion is on under cos d1344 (delegated, coordinator agreed). Evidence: ~/reviews/w4-budget-ci-2026-10-11/pr635-round*-sol.md.

🤖 Generated with Claude Code