#297 Trial P-45 (pass): Dependabot opens its pin update and pushes its head as dependabot[bot]

Trial P-45, by the working rulings on #251 (ruling 3): when a dependency bot updates an Action's pin in a workflow file, does it open the pull request and push its head under its own [bot] identity? Yes. The trial passes.

What ran, and what it showed

Set-up. Canary pull request 49 added two files:

• .github/dependabot.yml, for GitHub Actions, allowed for actions/checkout alone;
• a workflow pinning actions/checkout at v7.0.0's full sha, one release back. It runs only by hand, is granted nothing, and no one runs it.

The merge. The Maintainer merged pull request 49 at his own terminal, as P-33's merge was done. The ruleset on main was disabled for about fourteen seconds and restored. It reads active after.

What Dependabot did. It opened canary pull request 50, moving the pin to v7.0.1, and the trial read it:

Read	Answer
Author, by REST	dependabot[bot], Bot, id 49699333
Author, by GraphQL	dependabot, Bot, databaseId 49699333
The head's pushes (branch activity, P-28's read)	branch creation and a force-push, both by dependabot[bot], Bot
The head's commit	authored by dependabot[bot], committed by GitHub's web-flow
What changed	.github/workflows/p45-pinned.yml, the pin alone

So the bot is both author and last pusher, and its class is dependency under decision 0026's exact identity. The two APIs spell the account differently: the port tells it by id and type, never by a name's spelling, as adapters/pull.py already does.

What changes

• trials/P-45.json, built from redacted captures. The pass condition was written at 18:00:10Z, before anything was made.
• sim/grounding.py. a_dependency_bot_updates_a_workflow_pin names the fixture. The fake already applies it.
• The design. §6's P-45 row records the verdict.
• The test. test_a_dependency_bot_opens_and_pushes_its_update computes the pass from the reads.

The canary, step 8

• Pull request 50 is closed unmerged, and Dependabot deleted its branch.
• The trial's branch trial/p-45 is deleted.
• dependabot.yml and the pinned workflow stay on main, as the ruling says. So Dependabot will open such a pull request again on a later release of actions/checkout, which a later trial reading the canary's pull requests should expect.

Reviews and verification

• make verify passed in the worktree, with history, at SIM_SEEDS=40.
• A fresh Claude review with a security pass on 47223cb found no blocker and no major. Its minors are fixed in the second commit:
  • ran_at is the pushed commit's time, read from GitHub;
  • the contract test holds the author and the last pusher equal, as the Kernel compares them;
  • the fixture notes the bot's own force-push before the pull request;
  • the grounding comment says a Lens's own workflow was not the one updated.
• AGY and Muse: not run (the Maintainer, 2026-10-20: Kernel/hook only). Ruling 5 asks for neither.
• Token. The trials run on the Maintainer's classic token, his choice for trials.

Closes #251: P-44 merged in #271, and this is P-45.

🤖 Generated with Claude Code