test: single-signature rehearsal (carry-forward robustness validation)

[rodchalski]

Rehearsal PR to validate the fix from permission-protocol/app#395.

What to verify:

1. Deploy Gate fails on first run — creates one request
2. Sign once
3. Deploy Gate re-runs automatically
4. Passes with no second request created

If it passes with a single signature, the fix is confirmed end-to-end.

[permission-protocol]

🔒 Permission Protocol

✅ Approved — human authorization recorded. View receipt

---

Approval brief

Why this change: This change is a rehearsal to validate a fix from PR #395 regarding signature carry-forward robustness, ensuring that a single signature is sufficient for the Deploy Gate to pass upon re-run

What changes for users/operators: Operators will perform a single-signature validation where the Deploy Gate is expected to fail initially, create one request, and then pass on a subsequent automatic re-run after one signature is provided

Blast radius:

• Affected: Limited to changed files shown in this PR
• Not indicated: auth, database, billing, secrets

⚠️ Why approval is required

Confirmation that the Deploy Gate passes with a single signature and does not create a redundant second request

• Risk: 🔴 High — Deploy
• Impact: Confirmation that the Deploy Gate passes with a single signature and does not create a redundant second request
• Files: deploy/rehearsal-20260503.yml
• Status: ✅ Approved — receipt

---

✅ View authorization receipt →

_{Authorization is recorded. Keep the checks below as deploy/merge verification evidence.}

---

✅ Verify before authorizing

• Does the Deploy Gate fail on the first run and create exactly one request?
• Does the Deploy Gate re-run automatically after the first signature is provided?

📋 Why was this flagged?

• The PR is a rehearsal to validate carry-forward robustness for single-signature logic.
• The change targets the production environment via a new rehearsal configuration file.
• The expected behavior is for the Deploy Gate to pass after one signature without generating a second request.

---

_{🔒 Permission Protocol · Decision: approved with human authorization}

[github-actions]

✅ Permission Protocol: Approved
View receipt →