Repository navigation
📝 docs(spec): OSS quality-signal and toolchain-consistency epics - #166
Merged
Merged
Conversation
…, CMY) CI hardening, scheduled e2e execution with failure issues, test-depth signals, toolchain consistency, dependency PR automation and community/ agent-contract hygiene. Drafts for independent review; open questions recorded in each epic.
Cut NIT-S01 in favour of E7-S07/P4-E1-S10, move failure reporting to a workflow_run reporter, store auto-merge credentials as Dependabot secrets, drop the PR-age check, defer ci-gate until a filtered job exists, cover GOTOOLCHAIN=local for go-run pins, and write every Verify command out in full.
Serialise the failure reporter and decide from open-issue state, require same-repo workflow_run heads, pin each new stage command in STAGE_BODY_PINS, add a failing-direction control for the go-toolchain check, narrow the branch-protection probe to Administration: read and make a missing auto-merge secret red.
Bump go.mod go/toolchain to the 1.27.1 line after the go-version-file switch, so the toolchain that tests and govulncheck run on equals the one shipped; restates the D-158 linter coupling.
Wire every new guard on pull_request (specs README rule), add CIH-S00 to restore green main, defer harden-runner, merge the go.mod bump into the go-version-file switch with a patch-lag sensor, rebuild bot auto-merge as a scheduled all-checks-green merger, and cut the labeler, live probe and benchmark guard.
Restore the deleted determinism test instead of dropping its name and guard that every -run name resolves; merge bot PRs only with --match-head-commit and never --auto; keep workflow-touching updates out of auto-merge; define post-merge evidence.
This was referenced Oct 5, 2026
Contributor
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
openspec/specs/, a gate-wiring rule inopenspec/specs/README.md, and abacklog.mdindex with landing order.backlog.mdand answer TCC-S05 (dependency bot).Most important things
mainis red because refactor5a01ba0deletedTestDeterminismDoubleRunwhile the determinism gate still runs it by name (Taskfile.yml:253,verify.yaml:125). The gate now runs zero times, and AUD-S18 correctly fails. The story restores an equivalent test and adds a PR-path guard so a rename can't recur.openspec/specs/README.md: every new guard, in every mode, runs onpull_requestinverify. Guards that onlyrelease-exitgateruns are howmainwent red.go-version-file: go.mod, bumped to Go 1.27.1 in the same PR. This supersedes D-158's keep-stableclause, with a tool check underGOTOOLCHAIN=localand a patch-lag sensor.main, merges--rebase --match-head-commitand never--auto, and never touches workflow files.Review history
The epics went through an author draft, an independent review, a re-review, a cold adversarial review and a fix check.
hack/check-sanitization.shpasses.Testing
hack/check-sanitization.sh. No runtime behaviour changes.