[kinqsradio]

Summary

• The status decision is now one pure function, decideStatus, plus evaluate, which drives read, find and record the way the workflow does. Both sit between the matcher markers.
• CLA turns success only when the person is exempt, is already in the record, or the write to cla-signatures has just succeeded.
• A failed write (409 out of retries, 500, 403 token, or a failure reading CLA.md before the write) now sets failure with "Could not record your agreement. Comment /orbynAgree again to try again.", updates the one bot comment with that line, and fails the run.
• A read failure still sets error "Could not check the agreement record." and fails the run.
• A new /orbynAgree comment, or any later event, tries again from the start.
• README.md and REVIEW.md describe the status values.

Not in this PR

• The callers' pinned commit. It moves after this merges.
• Any change to the agreement text, the record format, branch protection or secrets.

Testing

• node --test scripts/*.test.mjs: 37 passing (13 new). They cover exempt, already signed, unsigned, agreement with a successful write, agreement with a rejected write (409 exhausted, 500, 403), a read error, and a second attempt after a failure that records normally. One test checks every input combination and fails if success is returned without exempt, signed, or a successful write.
• The workflow YAML parses and node --check passes on the embedded script.
• Not tested: a live run against GitHub.

AI usage

• Harness and version: Claude Code 2.1.318
• Models: claude-opus-5-5 (lead), claude-sonnet-5-5 (implementation)
• Effort: medium
• Human role: Anh asked for this fix; the coordinator set the spec.
• Sources: none