feat(oath): gate cad-atlas's own real candidate, not swedsl's toy stub (#8)

oathcandidate/ is a separate Go module (mirrors swedsl's own
oath/testdata/selfcandidate pattern, keeping var-go's transitive deps
out of the deployed atlas binary) whose Build() parses the committed
.gitea/workflows/cd.yml and checks the "oath" job exists and invokes
cmd/vargo-gate. TDD: passes against the real file, fails closed on a
fixture missing the job.

Rewires the oath CI job to go-run vargo-gate from its real module path
(git.d-ma.be/mathias/swedsl/oath/cmd/vargo-gate@oath/v0.28.0, unblocked
by swedsl#35/#38) against VARGO_CANDIDATE_DIR=oathcandidate, instead of
checking out swedsl and gating its hardcoded toy fixture. Private-module
auth via a short-lived GIT_ASKPASS script (token never in argv, never
written to git config, matches act_runner's env:-block-with-secrets
gotcha).

Discovered along the way: var-go's parser needs single-line,
period-separated oath sentences with no Given/When/Then/And keyword
stripping — this repo's older oaths (incl. #1) used an unverified
multi-line keyword-prefixed style. #8's oath uses the proven format.

Still not required by branch protection pending a real-PR confirmation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/cd.yml

@@ -53,50 +53,73 @@ jobs:
       - name: Run checks
         run: task check
 
+      - name: oathcandidate module — vet + test (private dep, short-lived askpass)
+        working-directory: oathcandidate
+        run: |
+          set -euo pipefail
+          export DMABE_GITEA_API_TOKEN='${{ secrets.DMABE_GITEA_API_TOKEN }}'
+          ASKPASS=$(mktemp)
+          { echo '#!/bin/sh'
+            echo 'case "$1" in'
+            echo '  *Username*) echo oauth2 ;;'
+            echo '  *) echo "$DMABE_GITEA_API_TOKEN" ;;'
+            echo 'esac'
+          } > "$ASKPASS"
+          chmod 700 "$ASKPASS"
+          export GIT_ASKPASS="$ASKPASS" GIT_TERMINAL_PROMPT=0 GOPRIVATE=git.d-ma.be
+          go vet ./...
+          go test ./...
+          rm -f "$ASKPASS"
+
   oath:
     name: var-go/oath
     needs: guard
-    # Only a real pull_request event carries a linked-issue oath to gate (mirrors
-    # swedsl's own oath job, .gitea/workflows/ci.yml). v1 simplification (swedsl#30):
-    # the oath issue number is the PR's OWN number.
-    #
-    # DISCLOSED LIMITATION (honest-stub discipline, see docs/INCEPTION-OATH.md S3 and
-    # knowledge/swedsl-vargo-sprint1-enforcement-teeth-verdict.md): cmd/vargo-gate's
-    # candidate is a hardcoded toy self-test registry (swedsl's own #9 fixture
-    # vocabulary), not a real PR-diff checker. It will fail closed against any oath
-    # that isn't that toy vocabulary — which is every real oath, including this repo's
-    # own #1. A red or green "var-go/oath" status here currently proves the WIRING
-    # (fetch issue -> gate -> post commit status) runs end-to-end on a real PR, not
-    # that the PR satisfies its linked issue's oath. Deliberately NOT required by
-    # branch protection until cad-atlas has its own candidate matching its real oath
-    # vocabulary (#8, blocked on swedsl/oath's import path, swedsl#35) — making it
-    # required now would permanently block every cad-atlas PR.
+    # cad-atlas's own real candidate (#8): oathcandidate/ parses the committed
+    # .gitea/workflows/cd.yml and gates it against cad-atlas#8's oath — replacing the
+    # earlier wiring-only proof (#1) that always gated swedsl's toy self-test fixture
+    # and always failed closed. cmd/vargo-gate (swedsl#35/#37/#38) now go-installs
+    # cleanly from its real module path and runs the candidate module in a sandboxed
+    # subprocess (SubprocessGate, ADR-0003) — a green status here means "the committed
+    # CI config satisfies its oath", not merely "the wiring ran". Still NOT required by
+    # branch protection (#8) until proven green on a real PR.
     if: needs.guard.outputs.is_template != 'true' && github.event_name == 'pull_request'
     runs-on: self-hosted
     steps:
-      - name: Checkout swedsl (var-go source — not go-installable, module path isn't a real import path)
-        uses: actions/checkout@v4
-        with:
-          repository: mathias/swedsl
-          path: swedsl
-          token: ${{ secrets.DMABE_GITEA_API_TOKEN }}
+      - uses: actions/checkout@v4
 
       - uses: actions/setup-go@v5
         with:
-          go-version-file: swedsl/oath/go.mod
+          go-version-file: oathcandidate/go.mod
           cache: false
 
-      - name: Run vargo-gate (fetch -> gate -> post status against this PR)
-        working-directory: swedsl/oath
+      - name: Run vargo-gate (fetch linked oath -> sandboxed-gate the real candidate -> post status)
         env:
           VARGO_GITEA_BASEURL: ${{ github.server_url }}
           VARGO_GITEA_OWNER: ${{ github.repository_owner }}
           VARGO_GITEA_REPO: cad-atlas
+          # Oath issue resolution (swedsl#38): a "Closes #NN" reference in the PR body
+          # picks the linked oath issue; VARGO_GITEA_ISSUE is the fallback (PR's own
+          # number, correct only for a PR filed directly against its oath issue).
+          VARGO_PR_BODY: ${{ github.event.pull_request.body }}
           VARGO_GITEA_ISSUE: ${{ github.event.pull_request.number }}
           VARGO_GITEA_SHA: ${{ github.event.pull_request.head.sha }}
+          VARGO_CANDIDATE_DIR: oathcandidate
+          # Sandbox is ON by default (untrusted PR code runs in a fresh user+net
+          # namespace, swedsl#37); no need to set VARGO_SANDBOX here.
         run: |
+          set -euo pipefail
           export DMABE_GITEA_API_TOKEN='${{ secrets.DMABE_GITEA_API_TOKEN }}'
-          go run ./cmd/vargo-gate
+          ASKPASS=$(mktemp)
+          { echo '#!/bin/sh'
+            echo 'case "$1" in'
+            echo '  *Username*) echo oauth2 ;;'
+            echo '  *) echo "$DMABE_GITEA_API_TOKEN" ;;'
+            echo 'esac'
+          } > "$ASKPASS"
+          chmod 700 "$ASKPASS"
+          export GIT_ASKPASS="$ASKPASS" GIT_TERMINAL_PROMPT=0 GOPRIVATE=git.d-ma.be
+          go run git.d-ma.be/mathias/swedsl/oath/cmd/vargo-gate@oath/v0.28.0
+          rm -f "$ASKPASS"
 
   build:
     name: Build & Import