Add valid_for_gating watermark + reir collect --strict (review #1)

Evidence built from invalid source (error diagnostics) could still be consumed
as a passing gate input. Make that impossible to do silently:

- CiGateOutput gains `valid_for_gating` (default true) + `gating_reason`. The
  gate sets it false and forces status=Fail when the bundle contains any
  error-severity diagnostic fact, regardless of capability reconciliation.
- `reir collect --strict` refuses to emit a bundle that contains error
  diagnostics (fail closed at evidence-generation time).
- tests: an error diagnostic makes the bundle invalid_for_gating + Fail.

Together with the earlier `pkg metadata` fail-closed (3.1), review/REIR evidence
from a half-broken AST no longer reads as authoritative.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Haofei

reir/src/format.rs

@@ -184,6 +184,12 @@ pub fn format_pr_review_comment(
 pub struct CiGateOutput {
     pub schema: &'static str,
     pub status: CiGateStatus,
+    /// False when the evidence was derived from invalid source (error
+    /// diagnostics): the bundle must not be trusted as a gate input.
+    #[serde(default = "default_true")]
+    pub valid_for_gating: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub gating_reason: Option<String>,
     pub summary: CiGateSummary,
     pub required_capabilities: Vec<CiCapabilityFact>,
     pub granted_capabilities: Vec<CiCapabilityFact>,
@@ -295,6 +301,10 @@ impl Default for CiGatePolicy {
     }
 }
 
+fn default_true() -> bool {
+    true
+}
+
 /// Whether a fact's acquisition mode is an author declaration (the package author
 /// asserted it) rather than independently established evidence.
 fn is_author_declared(fact: &Fact) -> bool {
@@ -379,7 +389,17 @@ pub fn format_ci_gate_output_with_policy(
         0.0
     };
 
-    let fail = (policy.fail_on_missing && !missing.is_empty())
+    // Evidence derived from invalid source (error diagnostics) must not be
+    // trusted as a gate input, regardless of capability reconciliation.
+    let has_error_diagnostics = required_facts
+        .iter()
+        .chain(granted_facts.iter())
+        .any(|fact| fact.kind == FactKind::Diagnostic && fact.unknown_reason.is_some());
+    let valid_for_gating = !has_error_diagnostics;
+    let gating_reason = (!valid_for_gating).then(|| "error_diagnostics".to_string());
+
+    let fail = !valid_for_gating
+        || (policy.fail_on_missing && !missing.is_empty())
         || (policy.fail_on_unknown && !unknown_facts.is_empty())
         || (policy.fail_on_excess && !excess.is_empty())
         || (policy.require_verified_capabilities && !unverified_facts.is_empty());
@@ -450,6 +470,8 @@ pub fn format_ci_gate_output_with_policy(
     CiGateOutput {
         schema: "reir.ci.v0.2",
         status,
+        valid_for_gating,
+        gating_reason,
         summary: CiGateSummary {
             total_required,
             total_granted,
@@ -1517,6 +1539,24 @@ mod tests {
         assert_eq!(strict.status, CiGateStatus::Fail);
     }
 
+    #[test]
+    fn error_diagnostic_makes_bundle_invalid_for_gating() {
+        let required = capability_fact("fact.req", FactRole::Required, FactValue::True);
+        let granted = capability_fact("fact.grant", FactRole::Granted, FactValue::True);
+        let recon = crate::reconcile_capabilities(
+            std::slice::from_ref(&required),
+            std::slice::from_ref(&granted),
+        );
+        let out = format_ci_gate_output(
+            &[required, diagnostic_fact("fact.diag.error")],
+            std::slice::from_ref(&granted),
+            &recon,
+        );
+        assert!(!out.valid_for_gating);
+        assert_eq!(out.gating_reason.as_deref(), Some("error_diagnostics"));
+        assert_eq!(out.status, CiGateStatus::Fail);
+    }
+
     #[test]
     fn require_verified_capabilities_blocks_author_declared() {
         let mut required = capability_fact("fact.req.s3", FactRole::Required, FactValue::True);

reir/src/main.rs

@@ -113,10 +113,12 @@ fn try_run_collect(args: &[String]) -> Result<ExitCode, CliError> {
     let mut from = None;
     let mut out = None;
     let mut json = false;
+    let mut strict = false;
     let mut index = 0;
 
     while index < args.len() {
         match args[index].as_str() {
+            "--strict" => strict = true,
             "--producer" => producer = Some(take_value(args, &mut index, "--producer")?),
             "--review-map" => review_map = Some(take_value(args, &mut index, "--review-map")?),
             "--package-review" => {
@@ -263,6 +265,22 @@ fn try_run_collect(args: &[String]) -> Result<ExitCode, CliError> {
         package_name: package_name.as_deref(),
     })?;
 
+    if strict {
+        let error_diagnostics = bundle
+            .facts
+            .iter()
+            .filter(|fact| {
+                fact.kind == reir::FactKind::Diagnostic && fact.unknown_reason.is_some()
+            })
+            .count();
+        if error_diagnostics > 0 {
+            return Err(CliError::usage(format!(
+                "--strict: refusing to emit REIR evidence built from {error_diagnostics} error \
+                 diagnostic(s); fix the source and re-run"
+            )));
+        }
+    }
+
     if let Some(out_path) = &out {
         write_json_file(out_path, &bundle)?;
         if !json {