Repository navigation
v1.91.340.0 ship-queue: train land counts a slot as merged only when GitHub reports it MERGED (#3603) - #3613
Conversation
…tree receipt accepts the fold Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…fragments Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…CHANGELOG Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…ts; land checks the depth-checked receipt (#3567) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…cation tripwire) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…safe subset (gh shim cannot launch there) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…lds only with the key on Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
land without --no-wait now compares the pushed branch head and polls the stamp commit's checks, refuses a PR whose base is not the stamped base, releases the lock on a pre-push failure, keeps --break-lock off drift locks, resumes from a lost journal via the stamp commit's pin, honours history merge-only, and refuses a fragment whose text is already released on the base. Version Gate stops applying open claims to a fragments stamp. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
land reconciles a merge GitHub completed behind an error reply, refuses --break-lock against a holder that just entered a push or a merge, keeps a repair takeover on the lock itself (any checkout can land the repair PR), resumes --repair after a failed PR create, releases the lock on QUEUE_LAND_BASE_BUSY, never writes through a symlinked release file, keeps a package.json version source's other edits, and refuses an empty object id instead of pushing a deletion. A carried-back fragment is matched on whole released lines. Under changelog_fragments Version Gate accepts a stamped head only as a [pin, base] merge-step commit with valid fragments. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…iles refuse before restamp Under changelog_fragments, gstack-ship-queue ready records a READY receipt (refs/notes/gstack-trains) once its pregate, full_e2e and /ship receipt checks pass, and land refuses a pin without one (fix: run gstack-ship-queue ready --pr N), --dry-run included (GStack Minder ruling, 2026-10-29). The merged tree's release files may not be symlinks, so restamp never writes outside the scratch worktree. --repair adopts an existing branch only when it holds land's repair commit. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…ragments fold; docs match land and ready gstack-pregate clear and gstack-tree-receipt now classify through one classifyFiles, so under changelog_fragments a receipt for the fragment head clears the stamped head when the stamp is exactly the fold. The ship-policy reference names ready's receipt push, land's own check polling, the key-off refusal and the /ship changelog_fragments line. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…d clear applies them too Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…publishes S_i exactly; backstop covers exact trees (PR B) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…r stamped trains Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…; regenerate the doctor anchors Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…ndows-safe subset (same gh shim as the train tests) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
- train land checks commit-tree and stamps with a fixed identity and date, journals before the push, and adopts its own stamp head on a rerun; a failed commit-tree never pushes a branch deletion - a symlinked release file in the merged tree refuses before the train stamp writes - mergeStep merges a conflicted manifest three-way with the predecessor's version (mergeManifest, shared with land) - train land refuses a PR retargeted off the base and a failed base refresh - Version Gate skips a released fragment carried in by a stacked pin instead of counting its bump - bisect of a stamped train tests T0 and S_1..S_k Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…amp step after a journaled, unpushed stamp Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…stamping; a merge main does not show yet pends Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…order slot refuses without freezing; stamps never sign Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…e PR never reads as a move; reruns of landed slots confirm; T0 in the out-of-order refusal Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…ing; require changelog_fragments.required_checks green on the stamp commit Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…ume and required checks; stamped bisect; three-way manifest merges Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…PR MERGED (#3603) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
E2E Evals: ✅ PASS (flaky: 1 case(s) passed on their one rerun)125 executed, 0 reused rule/judge records | 0 manual accepted (unscored; no score-cache credit) | $32.96 rule/judge cost | reconcile exit: 0 Profile: pr / mode Full gate restored by:
Derived dependents (scripts/pr-dependencies.ts):
Rule and judge shards
Fail-closed reconciliationSliced lane: planner → duration-packed executors → fail-closed report. Behavior cases run a pre-registered 3-trial panel (PASS at 2/3 with no contract violation); a PASS 2/3 is shown with its failed trial, never as a clean pass. Reused results retain their original provenance and expiry. Flaky: failed once, passed on its one rerun (rule 16)Each failed and passed on its rerun in run 40914813461 at the attempts named above. Logged for the daily flaky-fix pass in this run's Dispatched narrow screen (gstack-ship-queue ready --screen) of merge commit |
… grant) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…n fits maxSkeletonBytes Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…91.336.0 (gstack-restamp --next --pr 3594, train gate.train-98e1977e3e71-723b73ea8970-082cfa slot 1) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…sta154-train-stamps Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…ain-stamps; CHANGELOG: main's plus this PR's [Unreleased] entry Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…ta154-land-github-merged Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
|
😎 This pull request was merged. |
…1.340.0 (gstack-restamp --next --pr 3613, train gate.train-9678d27cec77-53858424d03a-a0cea8 slot 2) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
Draft; the /ship body follows.
What changed
For a stamped train,
train landcounts a slot as merged only when GitHub reports its PR MERGED.Why
Follow-up #3603 from #3595's final review pair, which GStack Minder held back from #3595. Train land read two things straight from the train record (local, or rebuilt from
refs/notes/gstack-trains): which PR a slot is (t.slots[].pr) and which slots merged (t.merged). With slot PRs swapped and main already at S1,train land --pr 2confirmed the open #2 as merged. A forged merged entry marked the train merged, could clear a repair train's freeze, and turned a pre-landing mismatch into a freeze. GitHub's own state is the only source of either fact, so it fixes both.Blast radius
Only stamped trains (built under
changelog_fragments, landed throughtrain land) change. Plain trains andverify --trainkeep today's logic, because their slot-call flow and fixtures publish main without a GitHub MERGED read, and applying the rule there broke 8 plain-train tests. One file of product code, lib/ship-queue-train-verify.ts (confirmMerged,stopped,freezeQueue). Shared with #3594/#3595: CHANGELOG.md, docs/ship-policy.md, docs/troubleshooting.md, test/ship-queue-train-land.test.ts.Summary
confirmMergedrefuses (QUEUE_PROOF_MISSING) when GitHub does not report the landed PR MERGED, even with main's tree at its S_i, and the train's merged count includes another slot only when it has a record entry and GitHub reports it MERGED.stoppedreads every slot's GitHub state, so a record entry alone no longer makes a mismatch freeze the queue or a train read as stale, andfreezeQueuebuilds the freeze record's merged, unmerged and unreadable lists from those reads.Test Coverage
Three new tests in test/ship-queue-train-land.test.ts, each failing on the base: swapped slot PRs never confirm the open PR; a forged merged entry for an open slot leaves the train
merging(1/2); a forged merged entry does not turn a pre-landing mismatch into a freeze.Tests ran: remote free tier 23810 tests, 0 failed (tree f7abe045, after merging #3595's new head e8665fe); macOS and Windows lanes cleared by dispatched runs 41094986731 and 41094992770
Pre-Landing Review
The adversarial pass on the first version found no way for a forged record or an unreadable read to count a slot, clear a freeze or turn a mismatch into a freeze. It did flag the plain-train regression above as blocking, and scoping the rule to stamped trains fixed it. The specialist pass on the final diff came back clean, with both train test files green.
REVIEW_LOOP: passes=1 blocking_found=0 deferred=0 noted=4 fixed=0 scope=frozen dispatches=4 (the counted pass is the specialist pass on the final diff; the adversarial pass on the first version, whose blocking plain-train regression was fixed by scoping, ran before it)
Review notes
merging, and a later readable rerun restoresmerged.verifiedElsewhereandprune --stale(lib/ship-queue-train.ts:641) still read other record entries. Both fail closed and need write access to the notes ref.recordedMergedhelper.t.headvalidation, the journal-resume tree, re-checking intermediate S_i, required_checks name matching).Exploratory QA
None beyond the tests; the gh-backed paths run against the train gh shim.
Design Review
No frontend files changed — design review skipped.
Eval Results
No prompt or skill-template change.
Plan Completion
#3603 items 1 and 2, as GStack Minder scoped them.
Issues
Refs #3603
Verification Results
Focused suite (16 files: train, land, stamp, backstop, gate, Version Gate, fragments, ratchets, tripwires): 248 green, none red;
bun run gen:skill-docs && bun run buildclean.TODOS
No TODO items completed in this PR.
Documentation
Status: updated. docs/ship-policy.md (train land step 4: a slot counts as merged only when GitHub reports its PR MERGED) and docs/troubleshooting.md (a new QUEUE_PROOF_MISSING cause), written by the lane against the 9e1593d diff; CHANGELOG.md has one line.
Test plan
bun run typecheck,bun run gen:skill-docs,bun run build🤖 Generated with Claude Code