Skip to content

fix(tri): reachability is not staleness, and withdraw a claim of mine - #2960

Merged
gHashTag merged 5 commits into
masterfrom
w794
Aug 30, 2026
Merged

fix(tri): reachability is not staleness, and withdraw a claim of mine#2960
gHashTag merged 5 commits into
masterfrom
w794

Conversation

@gHashTag

Copy link
Copy Markdown
Owner

A claim of mine was wrong, and the correction is the finding

Yesterday's skill section 389 and the header of harness-scratch.yml both said:

emit-bitexact-gate.yml is on: pull_request with a paths: filter and no
push:. It has therefore never run on master.

It has run on master. Twice.

$ gh run list --repo gHashTag/t27 --workflow emit-bitexact-gate.yml \
    --branch master -L 20 --json event,conclusion,createdAt
  2026-08-28  workflow_dispatch  success   run 33150988445
  2026-08-20  workflow_dispatch  failure   run 32319733329

The most recent is a success from two days before the change I was judging
exactly the baseline I said did not exist, and I went and borrowed one from sibling
branches instead.

How the wrong reading was produced

I ran gh run list --repo <r> --branch master -L 40 --json name,conclusion, filtered
by workflow name, found nothing, and wrote it up as "never runs on master".

That is a window over all workflows, forty runs deep — under an hour on this
repository. A workflow absent from it has not been shown to be absent from the branch.
The per-workflow query costs the same and answers a different question.

Worse: the instrument already existed and would have said so. tri gates unmeasured
queries per workflow, by lifetime, through the API's total_count — and it does not list
emit-bitexact precisely because its 2026-08-28 dispatch is recent. I reached for a raw
gh run list window instead of the command in this repository written for this question.

What the tool was actually missing

unmeasured reports staleness. There is a second, orthogonal fact it never printed:
whether a workflow can produce a default-branch run at all without a human. A
workflow dispatched by hand yesterday is not stale and is still structurally incapable of
taking tomorrow's reading by itself — which is exactly the state emit-bitexact was in,
and why its absence from the stale table read as health.

tri gates unmeasured now prints that as its own section:

17 workflow(s) can NEVER produce a default-branch run on their own -- no
`push:` covering `master`. Their default-branch history exists only where a
human dispatched them, so "is it red on the default branch too?" has no
standing answer when one of them goes red on a pull request.

  LAST        dispatch   WORKFLOW
  2026-04-08  yes        Issue Gate
  2026-08-19  yes        Auto Merge Ready PRs
  2026-08-20  yes        Catalog Count Invariant (CI-01)
  2026-08-28  yes        Emit Bit-Exact Gate (CI-02)
  2026-08-28  yes        L1 TRACEABILITY Check
  2026-08-28  yes        PHI Loop CI
  2026-08-29  yes        Check Now Freshness
  ... 10 more

Five of the 18 merge-critical workflows are in that list
catalog-count-gate, check-now-freshness, emit-bitexact-gate, issue-gate,
phi-loop-ci. check-now-freshness is one of the four contexts the ruleset actually
requires
, and it has no standing master reading. Issue Gate's last default-branch run
is 2026-04-08, nearly five months ago.

All 17 carry workflow_dispatch: yes, so every one of these readings can be taken
rather than inferred. That is the actionable half, and it is what this repository's own
gate-topology.yml header says workflow_dispatch is for.

The parsing, and the two counterexamples it needed

has_auto_default_run is read by line, matching the two helpers beside it, and has
eleven tests. Two of them are counterexamples that a review would not have produced:

  • A push: inside a comment is not a trigger. harness-scratch.yml's own header
    recommends push: branches: [master] in prose. A scan that trims whitespace and looks
    for push: reads that advice as compliance.
  • A push nested deeper than the first level inside on: — in a paths: list, or a
    run: git push in a job — is not the trigger either.

Also covered: a bare push: with no branch list (fires on every branch, so it counts),
the inline on: [push, pull_request] form, block-list branches, a '**' wildcard, and
the default branch as a parameter rather than the literal master. One test reads every
workflow file in the tree and refuses to pass if it read fewer than ten — a test that
reads nothing passes vacuously.

What survives from the original lesson

The part that was right is the part worth acting on: no push: means no baseline is
produced automatically
, and the ordinary run of days then leaves nothing to compare
against. Borrowing a baseline from sibling branches still works and still gave the correct
verdict. It is a good second instrument and it should not have been the first.

Section 389 is rewritten in place rather than corrected beside itself, and now names the
three statements that look identical in a terminal:

statement how to establish it
"it has not run recently" a window: gh run list --branch master -L N
"it has not run on this branch, ever" per-workflow: --workflow <file> --branch master
"it cannot run on this branch" read the on: block

Reporting the third when you measured the first is the error.

Refs #2957


Closes #2959 · Refs #2957

🤖 Generated with Claude Code

Skill 389 and the header of harness-scratch.yml both said emit-bitexact
"has NEVER run on master". It has run on master twice:

    2026-08-28  workflow_dispatch  success   run 33150988445
    2026-08-20  workflow_dispatch  failure   run 32319733329

The 2026-08-28 success is from two days before the change I was judging
-- the baseline I said did not exist, while I borrowed one from sibling
branches instead.

The wrong reading came from `gh run list --branch master -L 40 --json
name,conclusion` filtered by workflow name. That is a WINDOW over all
workflows, forty runs deep, which on this repository is under an hour. A
workflow absent from it has not been shown to be absent from the branch.

And the instrument already existed: `tri gates unmeasured` queries per
workflow by lifetime through the API's total_count, and does not list
emit-bitexact precisely because its dispatch is recent. I reached for a
raw gh window instead of the command written here for this question.

What the tool DID lack is orthogonal to staleness: whether a workflow can
produce a default-branch run at all without a human. One dispatched by
hand yesterday is not stale and still cannot take tomorrow's reading by
itself -- exactly the state emit-bitexact was in, and why its absence
from the stale table read as health.

`unmeasured` now prints that as its own section. Measured: 17 workflows
have no `push:` covering master, 5 of them merge-critical
(catalog-count-gate, check-now-freshness, emit-bitexact-gate, issue-gate,
phi-loop-ci). check-now-freshness is one of the four contexts the ruleset
requires and has no standing master reading; Issue Gate's last one is
2026-04-08. All 17 carry workflow_dispatch, so every missing reading can
be TAKEN rather than inferred.

has_auto_default_run is read by line, matching the two helpers beside it,
with 11 tests. Two are counterexamples a review would not produce: a
`push:` inside a COMMENT is not a trigger -- harness-scratch.yml's own
header recommends `push: branches: [master]` in prose, and a naive scan
reads its own advice as compliance -- and a `push` nested below the first
level inside `on:` is not one either. Also covered: bare `push:`, the
inline `on: [push, ...]` form, block lists, a `'**'` wildcard, and the
default branch as a parameter rather than the literal master. One test
reads every workflow in the tree and fails if it read fewer than ten,
because a test that reads nothing passes vacuously.

Section 389 is rewritten IN PLACE, not corrected beside itself, and now
names the three statements that look identical in a terminal: has not run
recently (a window), has never run on this branch (per-workflow), cannot
run on this branch (the `on:` block). Reporting the third when you
measured the first is the error.

Closes #2959
Refs #2957

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@github-actions

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-08-30 15:53:41 UTC

Summary

Status Count
Total Open PRs 9
PRs with Failing Checks 7
PRs with All Checks Green 2
READY 0
FAILING 7
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=4d82ec850541 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

The first version tested branch names for equality, so `branches: ['ma*']`
would have read as "does not cover master" and reported a workflow
structurally unmeasurable while it runs on every push. No workflow here
uses such a pattern today -- an independent yaml+fnmatch reader agrees
with this function on all 49 files -- so equality was correct here and
wrong in principle, which is the worst kind of correct.

GitHub's subset implemented: `*` matches within one path segment, `**`
across them. `?` and character classes are treated as literals, which
errs toward REPORTING a workflow as uncovered: a false entry in a work
list is visible, a wrong silence is not.

Five more tests, including the live shape that separates the two
questions. notebook-sync.yml pushes on four patterns and none is master,
so counting the push KEY gives 16 files without one and counting COVERAGE
gives 17. 17 is the number that answers "can this produce a baseline",
and it is where an independent sweep's 16 and this command's 17 turned
out to agree rather than conflict -- they were answering different
questions.

Refs #2959

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@github-actions

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-08-30 16:01:39 UTC

Summary

Status Count
Total Open PRs 8
PRs with Failing Checks 7
PRs with All Checks Green 1
READY 0
FAILING 7
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=4d82ec850541 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

A correction to a message this command printed for about an hour. It
said "dispatch: yes means the missing reading can be TAKEN" -- and for
five of the seventeen it says that about, dispatching starts the
workflow and measures nothing, because the check's subject IS a pull
request.

tools/check_now_entry_shape.py is explicit and deliberately so: on any
event that is not pull_request it prints "NOT APPLICABLE ... Nothing was
checked and nothing is claimed" and exits 0. Honest in its log, green in
the checks list -- and `check` is one of the four contexts the ruleset
requires.

New `pr-only` column, measured by the pull-request context the workflow
passes down. Of the 17: 12 takeable, 5 not -- Check Now Freshness, Issue
Gate, L1 TRACEABILITY, NotebookLM Auto-Sync, PR Dashboard. Three of those
five are merge-critical or required.

The grep is weaker than reading the scripts each workflow calls, and it
errs toward marking FEWER files: a false `-` sends someone to dispatch a
gate that declines, which is recoverable; a false `YES` would tell them
not to bother taking a reading that was available. A test pins that
direction.

Refs #2959

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@github-actions

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-08-30 16:05:24 UTC

Summary

Status Count
Total Open PRs 8
PRs with Failing Checks 7
PRs with All Checks Green 1
READY 0
FAILING 7
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=4d82ec850541 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

`ci.yml` does not exist on origin/master. Its registration is still
active and its 23 lifetime runs are all on `dev`, the last of them
2026-04-22. With the README's own `?branch=master` the badge renders NO
STATUS; drop that one parameter and it renders PASSING off April's dev
history. The repository's most public claim about its own CI is one query
parameter from a false green and cannot ever go red.

Repointed at bootstrap-tests.yml -- the compiler's own test suite, 97
master runs. Reviewable: seal-coverage (914 master runs, 593 green),
corpus-ratchet (409/182), schema-validation (428/426), secret-scan
(711/707), gate-topology (351/351) and cli-tri (119/103) were the
alternatives measured. cli-tri was rejected because #2903 records that it
builds `-p tri` behind a `cli/**` filter, so a change to cli/tri-mcp
turns a different crate green.

The version badge said 0.1.0; bootstrap/Cargo.toml says 0.2.0 and the tag
t27c-v0.2.0 exists.

Deregistering the twelve fileless registrations appears unavailable --
GitHub keeps them after the file is deleted and exposes no delete
endpoint -- so the consumer is what gets fixed.

Refs #2961

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@gHashTag

Copy link
Copy Markdown
Owner Author

Three commits were added after this PR was opened, each with its own measurement:

branch filters are patterns — the first version compared branch names for equality, so branches: ['ma*'] would have read as "does not cover master". No workflow here uses such a pattern, so equality was correct here and wrong in principle. An independent yaml+fnmatch reader agrees with the Rust one on all 49 files, at 17.

'can be started' is not 'can be measured' — a correction to a message this command printed for about an hour. It said dispatch: yes means the reading can be taken; for 5 of the 17 it says that about, dispatching starts the workflow and measures nothing, because the check's subject is a pull request. New pr-only column. Three of those five are merge-critical or required.

the CI badge pointed at a workflow that is not on masterci.yml does not exist on origin/master; 0 master runs, 23 lifetime, all on dev, last 2026-04-22. Repointed at bootstrap-tests.yml (97 master runs), with the alternatives and their numbers in the commit message. The version badge said 0.1.0 against Cargo.toml's 0.2.0.

Filed alongside: #2961 — two of the four required contexts produce no master reading, and for check none is obtainable: tools/check_now_entry_shape.py exits 0 on non-PR events printing "Nothing was checked and nothing is claimed". That is the case which breaks the advice this PR adds, which is why the pr-only column exists.

@gHashTag
gHashTag enabled auto-merge (squash) August 30, 2026 16:08
@github-actions

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-08-30 16:08:23 UTC

Summary

Status Count
Total Open PRs 8
PRs with Failing Checks 7
PRs with All Checks Green 1
READY 0
FAILING 7
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=4d82ec850541 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@github-actions

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@github-actions

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-08-30 16:15:04 UTC

Summary

Status Count
Total Open PRs 8
PRs with Failing Checks 7
PRs with All Checks Green 1
READY 0
FAILING 7
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=4d82ec850541 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@gHashTag
gHashTag merged commit 7071b07 into master Aug 30, 2026
29 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Withdrawn: emit-bitexact HAS run on master. A window was read as a lifetime, and 5 of 18 merge-critical gates have no automatic baseline

1 participant