[openboa]

Adds a pure Node eligibility evaluator for the public OpenBOA documentation canary. It binds the complete diff, unchanged trusted control closure, three separate CI/CodeQL/convention runs, source receipts, raw SARIF for Actions/JavaScript/Python, and the separate native Code Quality gate. Only independently classified docs-only check/desktop skips are accepted; stale, incomplete, contradictory or failed evidence denies eligibility.

Ruleset bypass evidence is explicitly limited to the current authenticated report-only collector credential. Every active applicable ruleset must have matching initial/final GET identity, source, successful request provenance and response digest, active enforcement, and current_user_can_bypass='never'. Missing/unknown/non-never evidence denies. An omitted global bypass_actors list is not synthesized as empty, and visible owner bypass entries do not contradict this caller-specific result. The purpose marker is not a token identity or attestation; a future writer must recollect using its own actual credential. No token contents or fingerprints are recorded.

The function performs no network, filesystem, shell, API write or merge operation. Inputs are not self-authenticating: authenticated collection and independently selected policy use the documented trusted solo-writer model. Inline artifact correlation is not cryptographic attestation; clean platform mergeability is aggregate readiness, not a Code Quality-specific verdict or atomic merge authorization. Workflow execution, permissions, settings and existing checks remain unchanged.

Validation at e1ec278: npm test 57 total, 56 passed and one existing macOS non-UTF8-path skip; all 25 evaluator tests passed. Independent read-only review found no blocking issue. Negative controls cover exact ruleset coverage, mixed/unknown results, changed details/provenance, principal-purpose relabeling, missing/duplicate jobs and artifacts, protected renames, stale identities, skipped/neutral mandatory lanes, external SARIF data, conversion errors, missing raw languages and attempted owner overrides. Separate focused probes confirmed 'exempt' denies in both initial and final detail reads. Fixtures are synthetic and do not establish live PR eligibility.

Exact-head hosted CI at e1ec278 (https://github.com/openboa-ai/.github/actions/runs/36728226426) completed: isolated verification passed 57/57 tests with zero skips; JavaScript CodeQL passed; Actions and the required aggregate failed. The Actions job exposed only checkout/cleanup and a generic exit-code-1 annotation, with no init/analyze/raw-gate step evidence. Its immediate cause remains unknown; it is not attributed to the inherited finding. No retry or clean hosted-analysis claim is made.

Separately, unchanged main 700dacb retains the known Actions CodeQL raw finding actions/untrusted-checkout/critical (https://github.com/openboa-ai/.github/security/code-scanning/1). The prior head's raw gate rejected one result even though PR-ref alert API returned an empty list. That baseline remains unsuppressed and is distinct from the current pre-analysis execution gap.

Draft only. No merger, workflow activation, standing auto-merge policy or new server enforcement is delivered by this change.