fix(gatekeeper): declare required_reviewer_roles + roles gate (lr-9c7f47)

[clagentic-builder]

What

The repo config file .clagentic/loadout/config.yaml declared a merge section (with post_merge_steps) but no required_reviewer_roles key. Per loadout absence semantics, this made the reviewer-verdict gate fail-OPEN: merges here could land with zero reviewer/security verdict, while authorized_roles (who may merge) stayed fail-closed. This repo post_merge_steps rebuilds and reinstalls the fleet role-scoped credential-minting binary via make install PREFIX=/usr/local on every merge, so an unreviewed merge here redeploys token-issuing infrastructure fleet-wide, not just code.

Declares:

• merge.required_reviewer_roles: [reviewer, security]
• a roles section provisioning both reviewer and security (plus builder/merger/lead, mirroring the reference DEFAULT_ROLE_VERBS taxonomy) with reviewer-class verbs (git-host-api, review-post, stage-body), matching the actual PEACHES and BOBBIE verdict postings on this repo PRs.

The roles section is declared, not omitted, so security is a real provisioned role rather than merely accepted with a WARN via the default-taxonomy fallback -- once roles is present, doctor cross-check becomes load-bearing (every gate role must have a matching key there or doctor hard-fails), so both reviewer and security are included to avoid an unsatisfiable gate.

merge.post_merge_steps (cmd/description/on_failure, GOPATH/GOMODCACHE/GOCACHE/PREFIX inline) is untouched -- loadout replace-not-merge convention means adding sibling keys does not disturb it; confirmed via the pre-existing, untouched scripts validation test still passing after the change.

Why

lr-9c7f47 (P1): the clagentic-loadout lr-638945 hardening turns omission of required_reviewer_roles (when a merge section is present) into a hard doctor FAIL. This repo is in exactly that fail-open state today, and per the task comment thread the credential-minting redeploy makes this the highest-stakes instance of the gap in the fleet -- option (a), declare real roles, not the required_reviewer_roles: [] opt-out.

Verification

Before: loadout-doctor --repo-root . reported 5/6 checks passed, with a FAIL on repo_loadout_schema (merge section present but omits required_reviewer_roles).

After: loadout-doctor --repo-root . reports 6/6 checks passed, repo_loadout_schema OK (schema OK: merge, roles) -- no WARN.

go build ./... and go test ./... pass across all packages; no Go code was touched by this change.

Task

lr-9c7f47. Tests: go test ./... passed; loadout-doctor schema check passed 6/6 (was 5/6 with a FAIL).

[clagentic-reviewer]

PEACHES — clean (0 nits)

No findings. The fix correctly declares both required_reviewer_roles: [reviewer, security] and a corresponding roles: section with proper verb sets. All verbs are in KNOWN_VERBS, verb sets match DEFAULT_ROLE_VERBS for shared roles (builder, reviewer, merger, lead), the security role verb set is appropriate for a security audit, no agent names present, post_merge_steps unchanged, .crew/naomi.yaml unchanged, and authorized_roles remains absent (fail-CLOSED as designed). Comments are strong deterrents against future regression.

{"reviewer": "peaches", "review_status": "clean", "head_sha": "3d8c35b951d32b2c775da61f17a38a820b3af231", "pr_number": 29}

[clagentic-security]

BOBBIE security audit -- PR #29, .clagentic/loadout/config.yaml (single file confirmed).

Context: closes lr-9c7f47 (fail-open merge gate: required_reviewer_roles was undeclared while authorized_roles is fail-closed on absence, so this credential-mint-rebuilding repo merged with no reviewer/security verdict required).

Findings:

• .clagentic/loadout/config.yaml:46-96 -- nit -- bobbie.sast.gate-scope-doctor-only: load_required_reviewer_roles (clagentic_loadout/merge/gate_config.py) is consumed ONLY by doctor.checks.check_repo_loadout_schema (see that module BLAST RADIUS docstring). merge/verb.py step 5 (reviewer-verdict fences) is driven by --required-reviewer CLI flags, not this repo config key. This PR correctly closes the doctor-diagnostic gap and matches lr-9c7f47 scope exactly, but loadout-merge itself does not yet read this key -- a real enforcement gap remains until a separate consumption-wiring slice lands (named as future work in gate_config.py itself). Not blocking this PR; flagging so the follow-up is tracked.

Verified clean:

• required_reviewer_roles: [reviewer, security] -- both roles have real keys under the new roles: section (no unsatisfiable-gate trap).
• All gate/role tokens are role vocabulary (reviewer, security, builder, merger, lead) -- no agent identity name appears anywhere.
• security role verb set (git-host-api, review-post, stage-body) matches the minimum reviewer-class set, no over-grant; builder/reviewer/merger/lead verb sets are byte-identical to DEFAULT_ROLE_VERBS.
• post_merge_steps existing entry (make install PREFIX=/usr/local, inline GOPATH/GOMODCACHE/GOCACHE, on_failure: fail) is byte-for-byte unchanged; no new post_merge step introduced.
• authorized_roles remains absent, confirmed fail-closed on absence per gate_config.py (StaticRoleAuthorityProvider refuses on empty set) -- correctly out of scope.
• .crew/naomi.yaml untouched.
• No secret/token/hostname/credential introduced; diff is pure YAML + comments.

Scanners: gitleaks/semgrep/osv-scanner not run -- single-file YAML config diff, no reachable code sink, no dependency manifest touched (early-exit-lane reasoning; full semantic review performed manually per task instructions above scanner substitution).

review.status: clean. No blocking defect at head_sha 3d8c35b.

{"reviewer": "bobbie", "review_status": "clean", "head_sha": "3d8c35b951d32b2c775da61f17a38a820b3af231", "pr_number": 29}

[clagentic-merger]

Merged via clagentic-loadout v0.2.0

Field	Value
Gated HEAD SHA	3d8c35b951d32b2c775da61f17a38a820b3af231
Merged SHA	3d8c35b951d32b2c775da61f17a38a820b3af231
Reviews	clagentic-reviewer[bot], clagentic-security[bot]
CI status	no-runner-by-design (0 commit-status entries at HEAD)
task_id	lr-9c7f47