name: INV-INT9 issue.status write-ownership

# Hard gate for INV-INT9 (legal-ai docs/spec/X7-paperclip-client-params.md
# §4): `issue.status` has exactly one legitimate writer — the
# `sync-case-status` scheduled job (`ctx.jobs.register("sync-case-status", …)`
# in src/worker.ts), which mirrors legal-ai's case status onto the linked
# Paperclip issue. Built after legal-ai issue #446, where a second, unnoticed
# writer flip-flopped an issue `done → in_progress` — nobody caught it because
# nothing enforced write-ownership. This gate makes sure a third writer never
# lands the same way again: any `ctx.issues.update(...)` call that touches
# `status` outside the `sync-case-status` job fails the build, unless it
# carries an explicit, justified `// noqa: INT9 — <reason>` (a bare noqa with
# no reason is itself a violation — exceptions must be argued in writing).
#
# Pure Node, zero dependencies (scripts/int9-guard.mjs) — no `npm ci` needed.

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  int9-guard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: INV-INT9 — issue.status write-ownership guard
        run: node scripts/int9-guard.mjs

      - name: Self-test — הוכחה שהשער נושך (AC5)
        run: node scripts/int9-guard.mjs --self-test