ci: validate initial PR readiness declarations (#3302)

.github/pull_request_template.md

@@ -100,15 +100,16 @@ limits, security/privacy/containment implications, and meaningful proof gaps. --
 The PR author is the owner by default. A different owner must explicitly accept
 ownership on this PR.
 AI agents must leave these declarations to a human to dictate to them or there could be catastrophic consequences for many users of REA.
-Draft PRs may leave them unchecked. After further changes, clear the final checkbox
-until the owner reviews the updated diff and refreshes affected validation.
+Draft PRs may leave them unchecked. These declarations record initial readiness
+when opening the PR for review; later pushes do not require a new human sign-off.
+Keep the description and validation evidence current as the work changes.
 See CONTRIBUTING.md#pull-request-ownership-and-readiness. -->
 
 Human owner: <!-- @GitHub-handle -->
 
 - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
 - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
-- [ ] I declare the current revision ready for maintainer review.
+- [ ] I declare this PR ready for initial maintainer review.
 
 ## Before merge
 

.github/workflows/pr-readiness.yml

@@ -0,0 +1,51 @@
+name: PR readiness
+
+on:
+  pull_request_target:
+    branches: [main, "release/*"]
+    types:
+      [
+        opened,
+        edited,
+        synchronize,
+        reopened,
+        ready_for_review,
+        converted_to_draft,
+      ]
+  workflow_dispatch:
+    inputs:
+      pull_request_number:
+        description: Open PR to recheck
+        required: true
+        type: string
+
+permissions: {}
+
+concurrency:
+  group: pr-readiness-${{ github.event.pull_request.number || inputs.pull_request_number }}
+  cancel-in-progress: true
+
+jobs:
+  readiness:
+    name: Validate author declaration
+    runs-on: ubuntu-24.04
+    timeout-minutes: 3
+    permissions:
+      contents: read
+      pull-requests: read
+      statuses: write
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+      - name: Check initial readiness
+        uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
+        with:
+          script: |
+            const { pathToFileURL } = require("node:url");
+            const entry = pathToFileURL(
+              `${process.env.GITHUB_WORKSPACE}/scripts/ci/pr-readiness.mjs`,
+            );
+            const { runReadinessCheck } = await import(entry.href);
+            await runReadinessCheck({ github, context, core });