feat(self-eval): enforce the gate on config changes + worker-driven run (Phase A wiring)

[QuintinBotes]

Self-Eval Gate enforcement — wiring (A1 + A4)

Builds on the substrate merged in #65 (baseline persistence + live ProductionEvalRunner). This makes the Self-Eval Gate an actually-enforced gate.

A1 — enforce the gate on AO config changes

PUT /ao/role-config/{role} and PUT /ao/settings now consult the Self-Eval Gate before applying a change:

• self_eval_enforce setting (default OFF) gates the whole path; also a no-op on cold start (no baseline / no private suite).
• Regression → 409, the block is written to the tamper-evident audit log (ao.config.self_eval_blocked), and the mutation is never applied.
• ?force=true lets an admin override; audited (ao.config.self_eval_forced), commits atomically with the change.
• Gate injected via Depends(get_self_eval_gate) — real baseline lookup + an eval runner. The default runner is a no-op (a live private-suite eval is minutes-long, agent-driven, worker-owned, and apps/api can't import forge_worker without a cycle). The gate mechanism is fully wired and tested by injecting a runner.

A4 — worker-driven self-eval run + baseline recording

• execute_self_eval_run — the run → record loop; drives the live runner and persists the score as the workspace baseline, recording nothing when there's no score (never a bogus baseline).
• forge.self_eval.run Celery task — wires the real ProductionEvalRunner + SelfEvalService.record_baseline, resolving the published private suite + on-disk case dir + local repo clone. An honest no-op (scored: false + missing-prereq reason) until an operator provisions FORGE_BENCHMARK_DIR + FORGE_SELF_EVAL_REPO_ROOT/<repo_id> + a BYOK model — the foundation ships no repo-clone manager, and nothing is faked.
• The parked POST /runs docstring is updated: the "no EvalRunner substrate" rationale is gone (the substrate now exists); the public F35 router remains the external submit/verify/rank path for shared community suites.

Verification

• A1: 6 tests (regression blocked + audited + not-applied, passing allowed, force overrides + audits, flag-off + cold-start no-op, settings gated too). Existing AO router tests still green after the sync→async endpoint change (15 passed).
• A4: execute_self_eval_run records a baseline (fake + real in-memory SelfEvalService), records nothing on a None score; the task registers under forge.self_eval.run.
• make typecheck — 587 files, no issues.

Honest status

The gate mechanism, enforcement, audit, force override, run task, and baseline loop are all real and tested. The one remaining gap to a fully-live default deployment is a repo-clone manager (a local checkout of a workspace's connected repo for the sandboxed run) — deliberately not faked; until it exists, live runs no-op and the gate stays off by default.

🤖 Generated with Claude Code