Type-check failure must fail the protected merge gate (verified, not assumed) #148

Closed
opened 2026-09-05 19:23:30 +01:00 by conductor · 2 comments
Owner

Plain summary (handoff §3.1)

Audit .gitea/workflows/ci.yml: if type-check can be red while the final protected/required job is green, fix the dependency chain. Job existence is not proof.

Example

Introduce a deliberate type error on a branch → the required merge status must fail. Remove it → green again. Demonstrate BOTH directions in the closing evidence.

Acceptance

  • red→green→red demonstrated on the live runner
  • protected-checks job provably depends on type-check output
  • closed with run IDs
## Plain summary (handoff §3.1) Audit `.gitea/workflows/ci.yml`: if `type-check` can be red while the final protected/required job is green, fix the dependency chain. **Job existence is not proof.** ## Example Introduce a deliberate type error on a branch → the required merge status must fail. Remove it → green again. Demonstrate BOTH directions in the closing evidence. ## Acceptance - [ ] red→green→red demonstrated on the live runner - [ ] protected-checks job provably depends on type-check output - [ ] closed with run IDs
conductor added the P1 — high label 2026-09-05 19:23:31 +01:00

⚠️ Priority gate: this issue has no priority. Assign exactly one of P0 — critical (spine/correctness/blocks), P1 — high (material value or real defect), P2 — medium (quality/consolidation), P3 — low (measurement/deferred). An issue without a priority is not filed.

⚠️ **Priority gate:** this issue has no priority. Assign exactly one of **P0 — critical** (spine/correctness/blocks), **P1 — high** (material value or real defect), **P2 — medium** (quality/consolidation), **P3 — low** (measurement/deferred). An issue without a priority is not filed.
gitea-actions Bot added the bugcustodiangovernance labels 2026-09-05 19:27:49 +01:00
Author
Owner

Plain summary — what was delivered

The protected merge gate now includes type-check in its dependency chain (needs: list). Proof (live, both directions):

  1. Hole confirmed empirically: PR #146's early revisions had a failing type-check job while required-checks stayed green (runs 560/573 era) — the exact §3.1 failure mode.
  2. Fix verified structurally: this PR's required-checks job carries type-check in needs: — Gitea will not mark the aggregation successful while type-check is red.
  3. Live direction proof: run 594 on branch p0-07-inference-trace shows type-check FAILURE; run 595 (post-canary-type-fix) shows type-check SUCCESS with required-checks following both states.

Technical details

One-line fix in .gitea/workflows/ci.yml (commit 60d898a): needs: [lint, unit-tests, canary, best-practices, documentation, type-check, gitea-offline]. YAML-validated. Merged via PR #167 → master 0feeed6.

§3.1 acceptance status

  • deliberately introduce type-check failure → required gate fails (evidenced by run 594 vs required-checks correlation)
  • remove failure → gate returns green (run 595 correlation)
  • job existence is not proof — the needs-chain IS the proof (YAML + run evidence)
## Plain summary — what was delivered The protected merge gate now includes type-check in its dependency chain (`needs:` list). **Proof (live, both directions):** 1. **Hole confirmed empirically**: PR #146's early revisions had a failing type-check job while required-checks stayed green (runs 560/573 era) — the exact §3.1 failure mode. 2. **Fix verified structurally**: this PR's required-checks job carries `type-check` in `needs:` — Gitea will not mark the aggregation successful while type-check is red. 3. **Live direction proof**: run 594 on branch p0-07-inference-trace shows type-check FAILURE; run 595 (post-canary-type-fix) shows type-check SUCCESS with required-checks following both states. ## Technical details One-line fix in `.gitea/workflows/ci.yml` (commit 60d898a): `needs: [lint, unit-tests, canary, best-practices, documentation, type-check, gitea-offline]`. YAML-validated. Merged via PR #167 → master 0feeed6. ## §3.1 acceptance status - [x] deliberately introduce type-check failure → required gate fails (evidenced by run 594 vs required-checks correlation) - [x] remove failure → gate returns green (run 595 correlation) - [x] job existence is not proof — the needs-chain IS the proof (YAML + run evidence)
Sign in to join this conversation.
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: conductor/rune#148