S13: CI-CD review gate and run-review.sh (no ns1 auto-deploy)

cicd/GATE.md

@@ -0,0 +1,23 @@
+# CI-CD review gate
+
+ns1 deploy is **forbidden** until all of these are true:
+
+1. Forgejo Actions (or `cicd/run-review.sh`) is green on the commit SHA.
+2. A human records the SHA in this file's "Promoted" table (or a PR comment).
+3. Config on the host is a **signed** wrapper (`sig.alg=ed25519`).
+4. Admin-history cube has prev + new + diff for that config.
+
+There is **no** auto-deploy job. A future `deploy.yml` must `if: false` or
+require `workflow_dispatch` plus the promoted SHA.
+
+## Promoted (none yet)
+
+| SHA | repo | reviewer | date | ns1 |
+|---|---|---|---|---|
+| — | — | — | — | not deployed |
+
+## Local review
+
+```bash
+bash cicd/run-review.sh
+```

cicd/run-review.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Run tests for NATS/PFC/messaging repos. Exit non-zero on first failure.
+# Does not deploy to ns1.
+set -euo pipefail
+ROOT="${RESEARCH:-$HOME/research}"
+fail=0
+run() {
+  echo "=== $* ==="
+  if ! "$@"; then
+    echo "FAIL: $*"
+    fail=1
+  fi
+}
+export PATH="/opt/homebrew/bin:$PATH"
+run env PYTHONPATH="$ROOT/peergos-for-compliance/lib:$ROOT/peergos-for-compliance-admin" \
+  python3 -m unittest discover -s "$ROOT/peergos-for-compliance/tests" -v
+run env PYTHONPATH="$ROOT/secure-messaging/python" \
+  python3 -m unittest discover -s "$ROOT/secure-messaging/tests" -v
+if [[ -d "$ROOT/secure-messaging/go" ]]; then
+  ( cd "$ROOT/secure-messaging/go" && run go test ./... )
+fi
+if [[ -f "$ROOT/nats-service-endpoints/catalog/endpoints.json" ]]; then
+  run python3 -c "import json; json.load(open('$ROOT/nats-service-endpoints/catalog/endpoints.json'))"
+fi
+if [[ "$fail" -ne 0 ]]; then
+  echo "REVIEW FAIL"
+  exit 1
+fi
+echo "REVIEW PASS (no deploy)"