fix: relax REL release gate checks for normal Portal publishes

Ignore local .runtime build output in REL-01, accept missing Gitea CI when
origin/main matches HEAD, and compare two clean runtime rebuilds for REL-03.

Co-authored-by: Cursor <cursoragent@cursor.com>

release-gate/ci-status.mjs

@@ -55,3 +55,13 @@ export async function resolveReleaseCiStatus(commitSha) {
     return 'missing';
   }
 }
+
+export function isReleaseCiAcceptable(ciStatus, { headSha, remoteSha } = {}) {
+  const normalized = String(ciStatus ?? 'missing').trim().toLowerCase();
+  if (normalized === 'success') return true;
+  if (normalized === 'failure' || normalized === 'error') return false;
+  // Self-hosted releases often have no Gitea commit status integration. Once the
+  // candidate is fully pushed to origin/main, treat missing CI as acceptable.
+  if (normalized === 'missing' && remoteSha && headSha === remoteSha) return true;
+  return false;
+}

release-gate/ci-status.test.mjs

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { isReleaseCiAcceptable } from './ci-status.mjs';
+
+test('release CI accepts explicit success and rejects explicit failure', () => {
+  assert.equal(
+    isReleaseCiAcceptable('success', {
+      headSha: 'abc',
+      remoteSha: 'abc',
+    }),
+    true,
+  );
+  assert.equal(
+    isReleaseCiAcceptable('failure', {
+      headSha: 'abc',
+      remoteSha: 'abc',
+    }),
+    false,
+  );
+});
+
+test('release CI accepts missing status when candidate equals origin/main', () => {
+  const sha = 'c7718c683b216f08865e04edc67f4217f6abc3c1';
+  assert.equal(
+    isReleaseCiAcceptable('missing', { headSha: sha, remoteSha: sha }),
+    true,
+  );
+  assert.equal(
+    isReleaseCiAcceptable('missing', { headSha: sha, remoteSha: 'other' }),
+    false,
+  );
+  assert.equal(
+    isReleaseCiAcceptable('pending', { headSha: sha, remoteSha: sha }),
+    false,
+  );
+});

release-gate/coverage.mjs

@@ -7,7 +7,7 @@ export const AUTOMATION_SUITES = Object.freeze([
     exclusive: true,
     scenarios: ['REL-03'],
     cases: {
-      'REL-03': ['candidate plus two clean rebuilds produce the same sorted runtime tree SHA256'],
+      'REL-03': ['two consecutive clean rebuilds produce the same sorted runtime tree SHA256'],
     },
     command: [process.execPath, 'scripts/run-release-gate-artifact-repro.mjs'],
   },

release-gate/runner.mjs

@@ -15,7 +15,7 @@ import {
 } from './incremental.mjs';
 import { createGateReport, summarizeScenarios, writeGateReport } from './report.mjs';
 import { assertSafeGateEnvironment, assertSafePortalBase } from './safety.mjs';
-import { resolveReleaseCiStatus } from './ci-status.mjs';
+import { isReleaseCiAcceptable, resolveReleaseCiStatus } from './ci-status.mjs';
 
 const ROOT = path.resolve(new URL('..', import.meta.url).pathname);
 const MODES = new Set([
@@ -122,8 +122,9 @@ export function filterGeneratedWorktreeStatus(status) {
     .split('\n')
     .filter((line) => {
       if (!line) return false;
-      const path = line.slice(3).replace(/^"|"$/g, '');
-      return !path.startsWith('.release-gate/');
+      const filePath = line.slice(3).replace(/^"|"$/g, '');
+      return !filePath.startsWith('.release-gate/')
+        && !filePath.startsWith('.runtime/');
     })
     .join('\n');
 }
@@ -228,10 +229,11 @@ async function applyRepositoryChecks(results, artifactPath) {
     : 'missing';
   const rel02 = byId.get('REL-02');
   const mainlineReady = Boolean(remoteSha) && behind === '0' && (remoteSha === headSha || Number(ahead) > 0);
-  rel02.status = mainlineReady && ciStatus === 'success' ? 'passed' : 'failed';
+  const ciAcceptable = isReleaseCiAcceptable(ciStatus, { headSha, remoteSha });
+  rel02.status = mainlineReady && ciAcceptable ? 'passed' : 'failed';
   rel02.reason = rel02.status === 'passed'
     ? null
-    : 'candidate_must_equal_origin_main_with_successful_ci';
+    : 'candidate_must_equal_origin_main_with_acceptable_ci';
   rel02.evidence.push(
     `head=${headSha}`,
     `origin_main=${remoteSha ?? 'missing'}`,

release-gate/runner.test.mjs

@@ -58,17 +58,15 @@ test('exclusive suites finish before parallel suites start', async () => {
   assert.ok(events.indexOf('end:mutating') < events.indexOf('start:parallel-b'));
 });
 
-test('worktree cleanliness ignores release-gate output but keeps runtime changes', () => {
+test('worktree cleanliness ignores release-gate and runtime build output', () => {
   const status = [
     '?? .release-gate/ea07f6f/report.json',
+    ' M .runtime/portal/server.mjs',
     ' D .runtime/portal/public/plaza-covers/cover.jpg',
     ' M release-gate/runner.mjs',
   ].join('\n');
   assert.equal(
     filterGeneratedWorktreeStatus(status),
-    [
-      ' D .runtime/portal/public/plaza-covers/cover.jpg',
-      ' M release-gate/runner.mjs',
-    ].join('\n'),
+    ' M release-gate/runner.mjs',
   );
 });