Prove GitHub Issue

One seat, one lane: Proving (D2). The prover's turn ends at a ready pull request whose head is the proven commit. It starts from durable state alone (the issue, the pushed branch, and the coder's announcement on the thread), so it never inherits a coder's long transcript, and a prover that is killed costs only the proof: the coded commit stands, and the next attempt proves it again rather than coding it again.

This feature is about a proof; its children are receipts: artifacts pinned to commits the remote holds, each covering one thing the change claims.

What a prover is told, and what it is not

The prompt is prompts/prove.md. Its brief is the coder's hand-off on a first proof, the reviewer's points when a review asked for more evidence, or the catch-up that moved the base beneath an existing proof. It loads prove-work-on-github for the definition of proof.

The prover always runs project.ciCommand when configured. Otherwise it runs checkCommand when the head differs from the coder's gated commit, or that commit is unknown; at the same gated head the coder's gate stands and is not rerun. Before an owed run it runs installCommand; on a changed or unknown gated head it runs checkCommand first, even with ciCommand configured. It records only the deciding command in gateRun, with the exact command, full SHA, and numeric exit code. A failing run is unprovable. Focused evidence comes in addition to that run, never instead of it. Like the coder, it never chases the base itself.

How the driver checks the answer

lib/prove.ts exports runProve(ctx, issue, cwd, coded, brief). It runs the seat and returns its answer, or failed when the answer cannot be believed: a crash, a kill at the cap, an unknown verdict, a proved that names no pull request or is pinned to a head other than the lane's, or an unprovable that tells the coder nothing to fix. The control file is loop-proof.json.

Hard dependencies

• The sibling fix-github-issue skill, imported for the agent runner, the context, the prompt renderer, and the Work markers. It ships in the same collection and is what runs this seat.
• The sibling prove-work-on-github skill, which the prover loads.
• gh authenticated with pull-request rights, and the CLI the worker seat names, on PATH.

The ceiling, named

A proof is evidence an independent reviewer can re-check, not a verdict; the reviewer, on another engine, still decides whether it is enough. The prover runs on the same engine as the coder by default: a fresh context stops proof-by-memory, and engine independence is the reviewer's job.