[CI][Control plane] ci-required cancel-in-progress on main discards the tip's evidence during a merge wave (six consecutive main runs cancelled 2026-09-04)

[Chris0Jeky]

What

ci-required.yml declares

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

with no branch condition, so on refs/heads/main every merge cancels the previous merge's push run. During a merge wave main therefore has no completed required run at all until the queue drains, and the readiness view's clause 4 ("main green") cannot be measured at the tip.

Evidence (2026-09-04)

Six consecutive push runs on main, all cancelled, none with a failing job:

Run	Head	Created	Cancelled
33923946316	df1559fd8 (#2542)	22:04:39Z	22:15:48Z
33924741549	46fb41d53 (#2567)	22:15:36Z	22:22:48Z
33925232957	7155f1042 (#2564)	22:22:28Z	22:25:03Z
33925392077	ea3e39e7d (#2566)	22:24:43Z	22:28:07Z
33925610356	0886b6c42 (#2569)	22:27:48Z	22:39:38Z
33926429510	330ccb4de (#2568)	22:39:26Z	in progress at 22:50Z

The 0886b6c42 run had 13 of 17 jobs green when it was cancelled (E2E Smoke and Secret Scan skipped by design; only the two windows-latest legs unfinished). The last completed green run on main is 33886539482 at 61e94f672 (15:21Z). Each merged PR head carried its own green required run, so nothing merged unproven; what is missing is the post-merge proof of the combined tip.

Why it matters

• Global law 1 and the readiness view measure "green at the exact head". A cancelled run is not red, but it is not evidence either, and the gap widens exactly when the lanes are most productive.
• The SC-4 observation window (20 PRs without a false red at Smart CI / Required Gate) and the CI-03 landed-commit verifier (CI-03: Smart CI / Required Gate, branch-current contract, landed-commit verifier and event topology #2327) both want a completed run per landed commit.
• A real regression introduced by merge N is invisible until the wave ends, and then it is attributed to merge N+k.

Proposed fix

Keep cancellation for PR refs, never on the default branch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

Runs on main then queue instead of cancelling, which costs hosted minutes only on Linux legs (SC-3: Windows legs are already slated for local runners). An alternative is a per-SHA group on main (${{ github.workflow }}-${{ github.ref }}-${{ github.sha }}), which runs them in parallel; queueing is the cheaper and more legible option.

Boundaries

• .github/workflows/ci-required.yml is a declared control path (ci/policy.v1.json), so the PR is T2 under the ADR-0066 amendment (2026-09-03): fresh-context review plus the maintainer's review, parked under OUTSTANDING_TASKS.md SC-10. Green is not authority.
• One-line change; the smart-ci-shadow.yml and smart-ci-self-test.yml concurrency blocks should be checked for the same shape in the same PR and changed only if they match.
• Owner: beta lane (platform integrity). Seeded by the coordinator from the 2026-09-04 readiness re-measure.

[Chris0Jeky]

[Claude lane claim v2]
lane: beta-platform-integrity (session taskdeck-beta-a5)
base: origin/main 4bf4a2e
issue: #2582
residual acceptance: ci-required.yml still cancels in-progress runs on every ref including main, so a merge wave leaves the tip with no completed required run (six consecutive cancelled main runs on 2026-09-04, and again at 01:12Z on 2026-09-05). Slice: the proposed one-line change, cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} (PR refs keep cancelling, main queues), plus a contract test in the Planner Self-Test glob pinning that expression and the group key, and the workflow header comment updated. Control-plane (T2): opened ready-for-review with one fresh-context review, then parked for the maintainer under SC-10, not merged by an agent.
owned paths/modules: .github/workflows/ci-required.yml (concurrency block and its header comment only); scripts/ci/smart-ci/required-concurrency.test.mjs (new)
shared-path leases: none (no open PR touches the concurrency block; PR #2502 rewrites uses: lines elsewhere in the file and PR #2608 touches a different workflow)
parallel-safe work: #2604 in another worktree
open PRs/branches/review threads checked: no open PR references #2582; #2327 (CI-03 landed-commit verifier) is the consumer of the completed main runs this restores
human or decision gates: the maintainer's SC-10 review is the merge gate; queued Linux minutes on main are within SC-3 (Windows legs are already slated for local runners)
status: active

[Chris0Jeky]

[Claude lane release v2]
lane: beta-platform-integrity (session taskdeck-beta-a5)
issue: #2582
PR: #2610
exact head: 0fc8fb2
result: review (parked for the maintainer under SC-10; control-plane, not agent-mergeable)
shipped outcome: nothing on main yet. PR #2610 changes ci-required.yml's concurrency block to cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} with the group key unchanged, adds scripts/ci/smart-ci/required-concurrency.test.mjs (four assertions, red-first on the unmodified workflow, wired through the Planner Self-Test glob), and nothing else. One fresh-context review (SHIP, no fix round); its MEDIUM was a wording overclaim, corrected at 0fc8fb2.
remaining residual: a precision point for the maintainer's ruling. GitHub keeps one in-progress plus one pending run per concurrency group, so this change guarantees that an in-flight main run is never killed by the next merge and that the tip runs once the wave drains; it does not give every landed commit a completed run, because intermediate pending main runs are still superseded. If a completed run per landed commit is the requirement (the CI-03 #2327 landed-commit verifier's ideal input), the alternative is a per-SHA group on main (${{ github.workflow }}-${{ github.ref }}-${{ github.sha }}), one Linux run per merge, runs in parallel. The issue's evidence table and the SC-3 minutes consideration are in the PR body.
released paths/leases: none released; the worktree is torn down and the branch stays on origin for the maintainer's review
next dependency now unblocked: none until the ruling