name: INV-INT9 issue.status write-ownership

# Hard gate for INV-INT9 (legal-ai docs/spec/X7-paperclip-client-params.md
# §4): `issue.status` has exactly one legitimate writer — the
# `sync-case-status` scheduled job (`ctx.jobs.register("sync-case-status", …)`
# in src/worker.ts), which mirrors legal-ai's case status onto the linked
# Paperclip issue. Built after legal-ai issue #446, where a second, unnoticed
# writer flip-flopped an issue `done → in_progress` — nobody caught it because
# nothing enforced write-ownership. This gate makes sure a third writer never
# lands the same way again: any `ctx.issues.update(...)` call that touches
# `status` outside the `sync-case-status` job fails the build, unless it
# carries an explicit, justified `// noqa: INT9 — <reason>` (a bare noqa with
# no reason is itself a violation — exceptions must be argued in writing).
#
# Pure Node, zero dependencies (scripts/int9-guard.mjs) — no `npm ci` needed.
#
# ⚠️ חסום למיזוג. אין היום runner ל-Gitea Actions בהיקף הריפו הזה: ה-runner
# היחיד על nautilus רשום בהיקף-repo ל-`legal-ai` בלבד (`action_runner.repo_id = 6`),
# ולכן job שנפתח כאן לא נאסף לעולם — נמדד ב-legal-ai #618: ריצה 3200 / job 3250
# ישבה ב-`queued` עם `started_at: 1970-01-01` בזמן שה-runner היה `busy: false`.
# ה-PR הזה נשאר פתוח **בכוונה** ומשמש כמדידה: ביום שיירשם runner לריפו הזה הוא
# יהפוך לירוק מעצמו, וזו תהיה הראיה ש-AC2 של #618 סופק. עד אז השער רץ ידנית:
# `npm run int9:guard` · `npm run int9:guard:self-test`.

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  int9-guard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: INV-INT9 — issue.status write-ownership guard
        run: node scripts/int9-guard.mjs

      - name: Self-test — הוכחה שהשער נושך (AC5)
        run: node scripts/int9-guard.mjs --self-test