rune/docs/pipeline-registry.md

Pipeline registry

Every workflow in .gitea/workflows/ is registered here — trigger, purpose, failure mode. Governed by the workflows_are_governed henxel: a new workflow that isn't registered fails the contract. Add the registry entry IN THE SAME PR as the new workflow.

Workflow	Trigger	Purpose	Failure mode
ci.yml	PR + push to master	lint, unit tests, canaries, best-practices, documentation, type-check (ratchet), gitea-offline, required-checks aggregation	Required checks fail → protected merge blocked
pipeline-gate.yml	issue events, comment created, schedule (hourly), workflow_run	gate (deps/research-pending), teach (next-issue), research-clear (evidence floor: citations, live-fetched sources, trail, synthesis qualification), incomplete-catcher (draft PRs for abandoned work)	Rejection comments name gaps; labels stay
auto-version.yml	pull_request:closed + push to master	semver from PR title (authoritative) / push-triggered convergence safety net (scripts/version_convergence.py) → bump PR → release	Safety net reconciles slipped events; drift flagged by maintenance
maintenance.yml	schedule	drift reconciliation (release version vs tags), housekeeping	Files advisory "release drift" issue, deduped
merge-robot.yml	schedule (hourly) + CI completion	merge-on-green: PRs with success status + mergeable merge via API	405 (protection/stale) logged and skipped — known silent-failure defect under discharge (bug-fix contract)
spec-gate-headless.yml	pull_request (opened/synchronize)	headless spec-gate agent: adversarial-first review, non-blocking Conventional-Comments verdict	Agent failure posts fallback comment; deterministic floors still govern
research-stage-headless.yml	issue labeled research-pending	headless research dispatcher: 4-phase round (INWARD/OUTWARD/INNOVATION/SYNTHESIS) via run_agent_stage.py; files research/issue-N-research.md + marker comment	Tool receipt invalid (OUTWARD <2 domains) → job fails loud, label stays; lock TTL re-dispatches crashed rounds
research-backlog-sweep.yml	workflow_dispatch (dry-run default, apply=true)	idempotent research-pending backfill with gate semantics; skips already-researched, blocked, open-PR-referenced issues	Dry-run default; apply is explicit dispatch input
research-dispatcher.yml	issue labeled research-pending, workflow_dispatch	legacy stage dispatcher (SUPERSEDED by the canonical Research-to-Build pipeline, epic #257; retained until RP11 retirement)	Trigger labels removed from disposable issues 2026-09-08; no stale redispatch path
auto-label.yml	issue events	priority gate, label transitions	Gate comments on unlabelled issues
auto-backup.yml	schedule	repo backup	Journal alert on failure
deploy.yml	push to master	deploy the CI-qualified SHA to the local Rune code deployment (/mnt/workdrive/rune-code/<sha>): waits for CI Pipeline / required-checks success on that exact SHA, stages, stamps _build_identity.json, verifies (import + SHA assert + authority smoke), atomically promotes current symlink, records last-good, re-verifies through the consuming path	CI not green/timeout → deployment refused, previous deployment stays current
auto-update-gitea.yml	schedule	Gitea self-update	Binary-only rollback risk (T1.1 audit finding)

| research-stage-headless.yml | issue labeled research-pending | headless research dispatcher: 4-phase round (INWARD/OUTWARD/INNOVATION/SYNTHESIS) via run_agent_stage.py; files research/issue-N-research.md + marker comment | Tool receipt invalid (OUTWARD <2 domains) → job fails loud, label stays; lock TTL re-dispatches crashed rounds | | research-backlog-sweep.yml | workflow_dispatch (dry-run default, apply=true) | idempotent research-pending backfill with gate semantics; skips already-researched, blocked, open-PR-referenced issues | Dry-run default; apply is explicit dispatch input | | spec-gate-headless.yml | pull_request (opened/synchronize) | headless spec-gate agent: adversarial-first review, non-blocking Conventional-Comments verdict | Agent failure posts fallback comment; deterministic floors still govern |

Adding a workflow

1. Create .gitea/workflows/<name>.yml.
2. Add a row here (trigger / purpose / failure mode) in the same PR.
3. If the workflow has a canary-relevant side effect, register the canary in ci.yml (the ci_runs_all_canaries henxel enforces it).
4. Verify: python3 -c "import yaml; yaml.safe_load(open('.gitea/workflows/<name>.yml'))".

Extending the pipeline

New processes MUST be placed per docs/pipeline-extension-guide.md — placement question, event-delivery quirks (each learned by failure), and per-type checklists. Read it before adding anything.

Retired workflows (RP11/#274, 2026-09-09)

research-dispatcher.yml, research-stage-headless.yml, research-backlog-sweep.yml were removed after RP10 proved the canonical Research-to-Build pipeline (epic #257). Their trigger label (research-pending) was stripped from all disposable issues on 2026-09-08 (RP0). Historical evidence retained in research/issue-* directories and closed issues (#245, #254-#256, #260-#263).

fault-watch (.gitea/workflows/fault-watch.yml)

• Trigger: CI Pipeline completion + every 15 min schedule
• Purpose: Monitors the 5 named gates (lint/unit-tests/rust-surface/go-surface/canary) on HEAD SHA. Auto-files ci-fault issues (labeled ci-fault+bug) on failure, auto-closes when the gate goes green on a pushed commit.
• Failure mode: If the fault-watch itself fails, CI failures go undetected — the nightly cron sweep is the backstop.

local-review (.gitea/workflows/local-review.yml)

• Trigger: Pull request events (opened, synchronize)
• Purpose: Runs the local review pipeline (lint gates + parity checks) on PR branches before merge.
• Failure mode: A failure here blocks the PR merge — the required-checks job gates on it.