Skip to content

feat(tri): gates required -- what the tree claims against what the ruleset requires - #2922

Merged
gHashTag merged 4 commits into
masterfrom
w753
Aug 29, 2026
Merged

feat(tri): gates required -- what the tree claims against what the ruleset requires#2922
gHashTag merged 4 commits into
masterfrom
w753

Conversation

@gHashTag

Copy link
Copy Markdown
Owner

A required status check is named in repository settings. No file in the tree
can read it, so a comment claiming a gate blocks cannot go stale against
anything. That is the only drift class here with no detector.

$ tri gates required
CLAIMED REQUIRED vs ACTUALLY REQUIRED   (gHashTag/t27, branch master)

  ruleset requires 4 context(s):
    check-now-freshness   validate   check   check-linked-issue

  Claimed required, emits no required context -- cannot block a merge:
    build-paper.yml          emits: Build LaTeX PDF
    catalog-count-gate.yml   emits: count-invariant
    coq-kernel.yml           emits: build
    damage-negatives.yml     emits: Damage negatives (false-positive fixtures)
    emit-bitexact-gate.yml   emits: emit-bitexact
    fpga-build.yml           emits: fpga-smoke, fpga-lint, fpga-synthesis, ...
    notebook-gate.yml        emits: 🔒 NotebookLM notebook required
    phi-loop-ci.yml          emits: phi-loop-check
      claimed in check_pr_branch_filters.py MERGE_CRITICAL and docs/BRANCH-PROTECTION.md
    seal-coverage.yml        emits: coverage
      claimed in check_pr_branch_filters.py MERGE_CRITICAL and docs/BRANCH-PROTECTION.md
    secret-scan.yml          emits: scan
    verilog-widths.yml       emits: Verilog widths (absurd-width ledger)

  15 claim(s), 11 of them hollow; 4 required context(s), 0 unclaimed.

Why the claims are individually true and jointly wrong

seal-coverage.yml records learning "the hard way in #2191" that renaming its
job id made a PR go BLOCKED with every visible check green. That is real evidence
its context was required — and no evidence that it still is. It is not:
coverage concluded failure on 32 of the last 40 merged pull requests, and
all 40 merged.

The parser's own trap, kept as a test

MERGE_CRITICAL appears in the checker's docstring thirty lines before the
assignment, and the gap holds an odd number of quotes — the docstring's
closing """ plus one quoted phrase. Pairing quotes from the wrong start inverts
the parity, every filename lands on an even index, and .skip(1).step_by(2) sees
none of them.

anchored on claims found
MERGE_CRITICAL 5
MERGE_CRITICAL = ( 15

the_tuple_is_found_by_its_assignment_not_its_name asserts the gap's quote count
is odd, then asserts both readings — so it fails if the fixture stops reproducing
the trap, not only if the parser regresses.

Contexts are read as GitHub matches them: a job's name: when it has one, else
its id.

Refuses rather than answering when the ruleset comes back empty, or when the tree
holds no claim at all.

Refs #2919

…ruleset requires

A required status check is named in repository settings. No file in the tree can
read it, so a comment claiming a gate blocks cannot go stale against anything.
This is the only drift class here with no detector, which is why it is a command.

    CLAIMED REQUIRED vs ACTUALLY REQUIRED   (gHashTag/t27, branch master)

      ruleset requires 4 context(s):
        check-now-freshness  validate  check  check-linked-issue

      Claimed required, emits no required context -- cannot block a merge:
        build-paper.yml          emits: Build LaTeX PDF
        catalog-count-gate.yml   emits: count-invariant
        coq-kernel.yml           emits: build
        ...
        seal-coverage.yml        emits: coverage
          claimed in check_pr_branch_filters.py MERGE_CRITICAL and docs/BRANCH-PROTECTION.md

      15 claim(s), 11 of them hollow; 4 required context(s), 0 unclaimed.

`seal-coverage.yml` records learning "the hard way in #2191" that renaming its
job id made a PR go BLOCKED with every visible check green. That is true evidence
its context WAS required and no evidence that it still is. It is not: `coverage`
concluded failure on 32 of the last 40 merged pull requests, and all 40 merged.

Contexts are read as GitHub matches them -- a job's `name:` when it has one, else
its id. Matching by file name would report every workflow as unrequired.

The parser carries its own trap as a test. `MERGE_CRITICAL` appears in the
checker's docstring thirty lines before the assignment, and the text between
holds an ODD number of quotes: the docstring's closing `"""` plus one quoted
phrase. Pairing quotes from the wrong start inverts the parity, every filename
lands on an even index, and `.skip(1).step_by(2)` sees none. Anchored on the bare
name this reported 5 claims; anchored on `MERGE_CRITICAL = (` it reports 15. The
mutation is exactly that substitution.

Refuses rather than answering when the ruleset comes back empty (a branch with no
required checks and a token that cannot read rules are different facts) or when
no claim is found in the tree at all.

Refs #2919
@github-actions

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@github-actions

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-08-29 23:33:34 UTC

Summary

Status Count
Total Open PRs 11
PRs with Failing Checks 7
PRs with All Checks Green 4
READY 3
FAILING 7
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=82e020cf95b2 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@gHashTag
gHashTag enabled auto-merge (squash) August 29, 2026 23:33
@github-actions

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-08-29 23:37:06 UTC

Summary

Status Count
Total Open PRs 9
PRs with Failing Checks 7
PRs with All Checks Green 2
READY 0
FAILING 7
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=82e020cf95b2 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@github-actions

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

# Conflicts:
#	cli/tri/src/gates.rs
@github-actions

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@github-actions

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-08-29 23:50:33 UTC

Summary

Status Count
Total Open PRs 8
PRs with Failing Checks 7
PRs with All Checks Green 1
READY 0
FAILING 7
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=82e020cf95b2 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@github-actions

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@github-actions

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-08-29 23:53:02 UTC

Summary

Status Count
Total Open PRs 8
PRs with Failing Checks 7
PRs with All Checks Green 1
READY 0
FAILING 7
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=82e020cf95b2 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@gHashTag
gHashTag merged commit 70db31b into master Aug 29, 2026
27 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant