tbd_ship takes an optional `issue`; the PR is squash-merged only when CI is fully green, the base is not review-protected AND the issue carries exactly one risk/ label, risk/low. No issue, no label, several labels, an unknown value, risk/medium, risk/high or an unreadable issue all fail closed to PR-only with a reason, and the result reports the tier. The zero tier is not low. Tests: gate table incl. every non-low tier, classifyRisk table, end-to-end cases (green+medium, lookup 500/404/403, label case, containment), nine mutants flip-tested red. Limit: the gate enforces the tier of the issue the caller names; it cannot prove it is the right issue. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SZkhi49hfeSqBp5aZJNXsM