@@ -0,0 +1,47 @@
+name: final-check
+
+# TechEngineBot's final check on PRs labelled `final-check`: one comment per
+# PR, edited in place, plus a `final-check` commit status. Other repositories
+# call this as a reusable workflow (see README); TechMachine uses it directly.
+#
+# pull_request_target so the bot token is available, which is safe because
+# nothing from the PR is checked out or run — only TechMachine's own code,
+# reading what the GitHub API reports about the PR.
+on:
+  pull_request_target:
+    types: [labeled, synchronize, ready_for_review]
+  workflow_call:
+    secrets:
+      TECHENGINEBOT_TOKEN:
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: final-check-${{ github.repository }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  final-check:
+    # Only a person adding the label starts it; later pushes refresh the same
+    # comment while the label stays on.
+    if: >-
+      contains(github.event.pull_request.labels.*.name, 'final-check') &&
+      (github.event.action != 'labeled' || github.event.label.name == 'final-check')
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          repository: GetTechAPI/TechMachine
+          ref: main
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Judge and post as TechEngineBot
+        env:
+          GITHUB_TOKEN: ${{ secrets.TECHENGINEBOT_TOKEN }}
+        run: >-
+          python -m machine.final_check --publish --wait-minutes 30
+          --repo "${{ github.repository }}" --pr "${{ github.event.pull_request.number }}"
@@ -40,6 +40,45 @@ When the set of problems changes, the check comments on the issue and
 It stays quiet when the same failure recurs (the fingerprint is
 workflow + result, not the run link) and never pings for an all-clear.
 
+## Final check
+
+[TechEngineBot](https://github.com/TechEngineBot) gives important pull
+requests a last look before merge. A person asks for it by adding the
+`final-check` label; the bot then posts **one** comment (later pushes edit it,
+never add another) and a `final-check` commit status that branch protection
+can require.
+
+It blocks a draft, a merge conflict, a PR into `main` that is not a release
+from `develop` or a `hotfix/`, any other check that failed or was cancelled,
+a changed workflow that uses a personal token, and a commit no other check
+ran on at all. It waits up to 30 minutes for running checks before judging.
+It never checks out or runs the PR's code.
+
+The account was suspended once for spam, so this is its only job: it speaks
+only when asked, and only once per PR.
+
+Another repository opts in with `.github/workflows/final-check.yml`:
+
+```yaml
+name: final-check
+on:
+  pull_request_target:
+    types: [labeled, synchronize, ready_for_review]
+jobs:
+  final-check:
+    uses: GetTechAPI/TechMachine/.github/workflows/final-check.yml@main
+    secrets: inherit
+```
+
+It needs a `final-check` label in that repository and the
+`TECHENGINEBOT_TOKEN` secret: a fine-grained token of the TechEngineBot
+account with read access to contents and checks, and write access to pull
+requests (comments) and commit statuses — best as an organisation secret.
+
+```bash
+python -m machine.final_check --repo GetTechAPI/TechAPI --pr 367   # print the verdict only
+```
+
 ## Satellite repositories
 
 Categories that do not belong in TechAPI live in their own repository (games:
 
@@ -0,0 +1,184 @@
+"""Final check on an important pull request, posted as TechEngineBot.
+
+TechEngineBot is a real account and was suspended once for spam, so it keeps
+its standing by speaking rarely: only on PRs a person marks with the
+`final-check` label, as one comment per PR that later runs edit in place, plus
+one commit status. A status can be made a required check; neither edits nor
+statuses notify anyone.
+
+The verdict only reads what GitHub already knows — it never checks out or
+runs the PR's code, so it is safe under `pull_request_target`.
+
+Run with: python -m machine.final_check --repo OWNER/NAME --pr N [--publish]
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+import time
+import urllib.request
+from dataclasses import dataclass, field
+from typing import Any
+
+from machine.health import API, HEALTHY, _get, _get_text, foreign_secrets
+
+MARKER = "<!-- techenginebot:final-check -->"
+CONTEXT = "final-check"
+# git-flow: main only moves through a release from develop, or a hotfix.
+RELEASE_SOURCES = ("develop", "hotfix/")
+
+
+@dataclass
+class Verdict:
+    problems: list[str] = field(default_factory=list)
+    pending: list[str] = field(default_factory=list)
+    passed: list[str] = field(default_factory=list)
+
+    @property
+    def state(self) -> str:
+        if self.problems:
+            return "failure"
+        return "pending" if self.pending else "success"
+
+
+def evaluate(pr: dict[str, Any], check_runs: list[dict[str, Any]], statuses: list[dict[str, Any]],
+             workflow_texts: dict[str, str], allowed: set[str] = frozenset()) -> Verdict:
+    v = Verdict()
+
+    if pr.get("draft"):
+        v.problems.append("the PR is still a draft")
+
+    base, head = pr["base"]["ref"], pr["head"]["ref"]
+    if base == "main" and not head.startswith(RELEASE_SOURCES):
+        v.problems.append(f"`{head}` → `main`: main only takes a release from develop or a hotfix")
+    else:
+        v.passed.append(f"`{head}` → `{base}` follows git-flow")
+
+    if pr.get("mergeable") is False:
+        v.problems.append("merge conflicts with the base branch")
+
+    # Our own job and status would otherwise wait on themselves.
+    runs = [r for r in check_runs if CONTEXT not in r.get("name", "")]
+    others = [s for s in statuses if s.get("context") != CONTEXT]
+    unsettled = len(v.problems) + len(v.pending)
+    for run in runs:
+        if run.get("status") != "completed":
+            v.pending.append(f"check `{run['name']}` is still running")
+        elif run.get("conclusion") not in HEALTHY:
+            v.problems.append(f"check `{run['name']}`: {run.get('conclusion')}")
+    for status in others:
+        if status.get("state") == "pending":
+            v.pending.append(f"status `{status['context']}` is pending")
+        elif status.get("state") != "success":
+            v.problems.append(f"status `{status['context']}`: {status.get('state')}")
+    if not runs and not others:
+        # Passing a commit nothing has looked at would be a silent failure of its own.
+        v.problems.append("no other check ran on this commit — nothing to confirm")
+    elif len(v.problems) + len(v.pending) == unsettled:
+        v.passed.append(f"{len(runs) + len(others)} other check(s) passed")
+
+    for path, text in sorted(workflow_texts.items()):
+        names = foreign_secrets(text, allowed)
+        if names:
+            v.problems.append(f"`{path}` uses {', '.join(names)} — automation must not run as a person")
+    if workflow_texts and not any("automation must not" in p for p in v.problems):
+        v.passed.append("changed workflows use only GITHUB_TOKEN")
+    return v
+
+
+def render(v: Verdict, sha: str) -> str:
+    title = {"success": "passed", "failure": "not ready", "pending": "waiting on checks"}[v.state]
+    lines = [MARKER, f"### Final check: {title}", "", f"Checked `{sha[:7]}`.", ""]
+    lines += [f"- ❌ {p}" for p in v.problems]
+    lines += [f"- ⏳ {p}" for p in v.pending]
+    lines += [f"- ✅ {p}" for p in v.passed]
+    lines += ["", "<sub>Runs when the `final-check` label is on the PR; this comment is updated, not repeated.</sub>"]
+    return "\n".join(lines) + "\n"
+
+
+def _call(method: str, path: str, token: str, payload: dict[str, Any]) -> Any:
+    request = urllib.request.Request(f"{API}{path}", data=json.dumps(payload).encode("utf-8"),
+                                     method=method, headers={
+        "Accept": "application/vnd.github+json",
+        "Authorization": f"Bearer {token}",
+        "Content-Type": "application/json",
+    })
+    with urllib.request.urlopen(request, timeout=30) as response:
+        return json.loads(response.read().decode("utf-8") or "null")
+
+
+def _paged(url: str, token: str | None, key: str | None = None) -> list[dict[str, Any]]:
+    items: list[dict[str, Any]] = []
+    for page in range(1, 11):
+        data = _get(f"{url}{'&' if '?' in url else '?'}per_page=100&page={page}", token)
+        batch = data[key] if key else data
+        items.extend(batch)
+        if len(batch) < 100:
+            break
+    return items
+
+
+def gather(repo: str, number: int, token: str | None, allowed: set[str]) -> tuple[dict[str, Any], Verdict]:
+    pr = _get(f"{API}/repos/{repo}/pulls/{number}", token)
+    sha = pr["head"]["sha"]
+    runs = _paged(f"{API}/repos/{repo}/commits/{sha}/check-runs", token, "check_runs")
+    statuses = _get(f"{API}/repos/{repo}/commits/{sha}/status", token).get("statuses", [])
+    files = _paged(f"{API}/repos/{repo}/pulls/{number}/files", token)
+    workflows = {
+        f["filename"]: _get_text(f"{API}/repos/{repo}/contents/{f['filename']}?ref={sha}", token)
+        for f in files
+        if f["filename"].startswith(".github/workflows/") and f.get("status") != "removed"
+    }
+    return pr, evaluate(pr, runs, statuses, workflows, allowed)
+
+
+def publish(repo: str, number: int, sha: str, body: str, state: str, token: str) -> None:
+    """One comment per PR, edited in place, and one commit status."""
+    comments = _paged(f"{API}/repos/{repo}/issues/{number}/comments", token)
+    existing = next((c for c in comments if MARKER in (c.get("body") or "")), None)
+    if existing:
+        comment = _call("PATCH", f"/repos/{repo}/issues/comments/{existing['id']}", token, {"body": body})
+    else:
+        comment = _call("POST", f"/repos/{repo}/issues/{number}/comments", token, {"body": body})
+    description = {"success": "Ready to merge", "failure": "Not ready — see the comment",
+                   "pending": "Waiting on other checks"}[state]
+    _call("POST", f"/repos/{repo}/statuses/{sha}", token, {
+        "state": state, "context": CONTEXT, "description": description,
+        "target_url": comment.get("html_url", ""),
+    })
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--repo", required=True, help="OWNER/NAME")
+    parser.add_argument("--pr", type=int, required=True)
+    parser.add_argument("--publish", action="store_true", help="comment and set the status")
+    parser.add_argument("--wait-minutes", type=int, default=0,
+                        help="poll this long for other checks to finish before judging")
+    parser.add_argument("--allowed-secret", action="append", default=[])
+    args = parser.parse_args(argv)
+
+    token = os.environ.get("GITHUB_TOKEN")
+    allowed = set(args.allowed_secret)
+    deadline = time.monotonic() + args.wait_minutes * 60
+    pr, verdict = gather(args.repo, args.pr, token, allowed)
+    # Waiting here instead of posting "pending" keeps it to one meaningful update.
+    while verdict.state == "pending" and time.monotonic() < deadline:
+        time.sleep(60)
+        pr, verdict = gather(args.repo, args.pr, token, allowed)
+
+    body = render(verdict, pr["head"]["sha"])
+    print(body)
+    if args.publish:
+        if not token:
+            raise SystemExit("--publish needs GITHUB_TOKEN (TechEngineBot's token)")
+        publish(args.repo, args.pr, pr["head"]["sha"], body, verdict.state, token)
+    # The status is the gate; a red job would only repeat it.
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -0,0 +1,62 @@
+"""TechEngineBot's verdict: block what is broken, wait on what is running."""
+
+from __future__ import annotations
+
+from machine.final_check import MARKER, evaluate, render
+
+
+def _pr(base: str = "develop", head: str = "feat/x", **extra) -> dict:
+    return {"base": {"ref": base}, "head": {"ref": head, "sha": "abcdef1234"}, "draft": False,
+            "mergeable": True, **extra}
+
+
+def _run(name: str, conclusion: str | None, status: str = "completed") -> dict:
+    return {"name": name, "status": status, "conclusion": conclusion}
+
+
+def test_green_pr_passes():
+    v = evaluate(_pr(), [_run("test", "success")], [], {})
+    assert v.state == "success" and v.problems == []
+
+
+def test_failed_or_cancelled_check_blocks():
+    assert evaluate(_pr(), [_run("test", "failure")], [], {}).state == "failure"
+    assert evaluate(_pr(), [_run("validate", "cancelled")], [], {}).state == "failure"
+
+
+def test_running_check_waits():
+    assert evaluate(_pr(), [_run("test", None, status="in_progress")], [], {}).state == "pending"
+
+
+def test_its_own_check_and_status_are_ignored():
+    runs = [_run("final-check / final-check", None, status="in_progress")]
+    statuses = [{"context": "final-check", "state": "pending"}]
+    assert evaluate(_pr(), runs + [_run("test", "success")], statuses, {}).state == "success"
+
+
+def test_main_only_takes_a_release_or_hotfix():
+    assert evaluate(_pr("main", "feat/x"), [_run("test", "success")], [], {}).state == "failure"
+    assert evaluate(_pr("main", "develop"), [_run("test", "success")], [], {}).state == "success"
+    assert evaluate(_pr("main", "hotfix/pages"), [_run("test", "success")], [], {}).state == "success"
+
+
+def test_nothing_checked_is_not_a_pass():
+    # TechAPI's release PR after its workflows were removed: no evidence at all.
+    v = evaluate(_pr("main", "develop"), [], [], {})
+    assert v.state == "failure" and "nothing to confirm" in v.problems[0]
+
+
+def test_draft_and_conflicts_block():
+    assert evaluate(_pr(draft=True), [], [], {}).state == "failure"
+    assert evaluate(_pr(mergeable=False), [], [], {}).state == "failure"
+
+
+def test_workflow_with_personal_token_blocks():
+    text = "token: ${{ secrets.TECHAPI_TOKEN }}"
+    v = evaluate(_pr(), [_run("test", "success")], [], {".github/workflows/sync.yml": text})
+    assert v.state == "failure" and "TECHAPI_TOKEN" in v.problems[0]
+
+
+def test_comment_carries_the_marker_so_it_is_edited_not_repeated():
+    body = render(evaluate(_pr(), [_run("test", "success")], [], {}), "abcdef1234")
+    assert body.startswith(MARKER) and "abcdef1" in body and "passed" in body
@@ -109,6 +109,11 @@ def test_allowed_secret_is_fine():
     assert foreign_secrets("${{ secrets.SOME_API_KEY }}", {"SOME_API_KEY"}) == []
 
 
+# TechEngineBot is a machine account used only for the final check.
+BOT_SECRET = {"final-check.yml": {"TECHENGINEBOT_TOKEN"}}
+
+
 def test_techmachine_itself_uses_only_the_builtin_token():
     for path in sorted((ROOT / ".github" / "workflows").glob("*.yml")):
-        assert foreign_secrets(path.read_text(encoding="utf-8")) == [], path
+        allowed = BOT_SECRET.get(path.name, set())
+        assert foreign_secrets(path.read_text(encoding="utf-8"), allowed) == [], path