Validation and agent closeout

Part of the reintegration policy. Its Markdown source preserves the detailed contract for this domain.

Validation: branch protection and CI

GitHub branch protection and CI own validation: a pull request lands only after its required checks pass, and for Cacophony the only required check is Check & Lint. There is no daemon reintegration gate, and the CLI runs neither a broken-on-main pre-push gate nor a published-checkout gate. projects[].integration.gate and agent_defaults.reintegration_gate_timeout_secs were removed; delete either key if a project config still sets it.

--skip-hooks

--skip-hooks skips the profile's CLI before_reintegration hooks. It requires --reason and emits a reintegration_hooks_skipped audit event. --force-skip-gate was removed with the gate.

Agent responsibilities

• Commit intended work and leave the worktree clean.
• Stay current with the configured target branch using caco agent rebase when prompted.
• Resolve conflicts in the live worker session and retry the lifecycle command.
• Never force-push main or reset the daemon default branch.
• Never close a bead merely because a branch or PR exists; closure follows validated lifecycle success.

Reading a static main: quiet vs parked vs frozen

Reintegration's publish-or-refuse check already verifies reachability against the true forge tip, not the possibly-lagging daemon-local mirror. But an agent's independent "has my work landed?" read during a slow or degraded window can still mislead: a static "N-behind" / "no new commits since <head>" drift count is ambiguous on its own. It can mean (a) a genuinely quiet fleet, (b) workers parked on CI or toolchain saturation (reintegrations timing out rather than landing), or (c) a genuine egress/push freeze where lands never reach the forge — disambiguate with the true-forge tip and its age:

gh api repos/<owner>/<repo>/branches/main \
  --jq '.commit.sha + " " + .commit.commit.committer.date'
# or, from a checkout whose origin is the forge:
git fetch origin main && git log -1 --format='%H %cI' origin/main

A true-main head that is static and aging past a threshold while agents are otherwise active points to (b) or (c); a fresh-but-static head is just quiet. Report source delivery accurately during a degraded window, but bead closeout records an authorized completion decision without inspecting Git history.