docs: close goal 0024 — ruleset verified live, all acceptance predicates evidenced (#56)

The only unchecked plan item (create the ruleset + dry-run a direct
push) was already true in production: ruleset 20723094 active with
ADR-0034's exact rules, and a live dry-run push was rejected (GH013).
Acceptance evidence (green PR #55 in budget, rejected direct push,
docs-only PR #45 fast-skip) recorded in the archived goal file.


Claude-Session: https://claude.ai/code/session_01FJ8wStsHyu7XPLTspNjMnQ

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: alicoding

docs/goals/BACKLOG.md

@@ -40,9 +40,14 @@ inline in source)**
 **Group D — Trust the substrate (2026-08-11, owner-mandated: "do it
 properly once"; ordered first because everything else ships through
 this pipeline and on this code)**
-1. [ ] [0024 — CI/CD target architecture + operating model](0024-cicd-target-architecture.md)
-   — IN FLIGHT: catch-up pushed, e2e triage + target-architecture
-   build land next, then the ruleset on a green main (ADR-0034)
+1. [x] [0024 — CI/CD target architecture + operating model](archive/0024-cicd-target-architecture.md)
+   — DELIVERED, closed 2026-08-13: all file-level work had landed
+   progressively (green maiden run 2026-08-12, budgets/sharding/
+   path-filtering/SHA-pinning); the last open item (ruleset +
+   direct-push dry-run) verified live — ruleset 20723094 active,
+   dry-run push rejected (GH013), docs-only PR #45 fast-skipped
+   with "CI gate" green; all three acceptance predicates evidenced
+   in the archived goal file
 2. [x] [0025 — Substance hardening](archive/0025-substance-hardening.md) — DELIVERED 2026-08-12 (both audit waves + LOW items) —
    fix the audited green-but-wrong class (12 silent persistence
    sites, unfailable test fake, uncovered safety-badge source);

…s/goals/0024-cicd-target-architecture.md …archive/0024-cicd-target-architecture.mddocs/goals/0024-cicd-target-architecture.md renamed to docs/goals/archive/0024-cicd-target-architecture.md docs/goals/0024-cicd-target-architecture.md renamed to docs/goals/archive/0024-cicd-target-architecture.md

@@ -43,9 +43,15 @@ explicit bar.
    same category as the ruleset in item 4, left for the orchestrator
    to flip once these files are proven green in real CI (this session
    was scoped to files only, no repo-settings access).
-4. [ ] Create the ruleset (block direct push/force-push/deletion,
+4. [x] Create the ruleset (block direct push/force-push/deletion,
    require PR + the `ci-gate` check, owner bypass "for pull requests
-   only"); dry-run a direct push to confirm rejection.
+   only"); dry-run a direct push to confirm rejection. **Done —
+   verified live 2026-08-13: ruleset 20723094 "main-protection
+   (ADR-0034)" active with rules `deletion`/`non_fast_forward`/
+   `pull_request`/`required_status_checks` (context "CI gate") and
+   admin bypass restricted to `pull_request` mode; a dry-run direct
+   push of an empty commit was rejected with GH013 naming both the
+   PR requirement and the required check.**
 5. [x] Amend ADR-0034 with the adopted budgets (≤7min target / 10min
    DORA ceiling; 3-consecutive-breach escalation rule; retry-quarantine
    policy) — un-defer its path-filtering deferral with the job-level
@@ -56,3 +62,13 @@ explicit bar.
 A PR through the new ruleset goes green inside the budget; a direct
 push to main is rejected; a docs-only PR merges via fast-skipped jobs
 without hanging any required check.
+
+**All three verified against shipped reality 2026-08-13:**
+- PR #55 (a 52-file code change) went green through the ruleset in
+  ~5min wall-clock, inside the ≤7min budget (run 31706356731).
+- The direct-push dry-run was rejected (GH013, both rules named) —
+  plan item 4's evidence above.
+- PR #45 (docs-only, `BACKLOG.md`) merged with every code job
+  (`build-go`/`e2e`/`frontend`/`lint-go`/`test-go`/`govulncheck`)
+  path-filter-skipped and the required "CI gate" check passing in 3s
+  (run 31663476641) — no required check hung on a skipped job.