[Hafeok]

Completes: #277

What this changes, and why

Step 1 of the chain-builds work: ADR 0243 point 10, LandingTrains. It is stacked on #280 (step 0, the ADR), which stacks on #261 → #260 → #259. Its own commits are the last four: af72d1d, 12cc6c1, a0375e0 and the record.

Today each landing costs one full CI run and moves main under every other pull request. A train lands several approved heads after one run.

• eng/land.cs -- --train N1 N2 …
  • Refuses before building anything when:
    • a member's head has no approve for its exact sha. A single landing only warns; a train refuses, because its verdict rests on each member's own;
    • a member's head is not green on every check ruleset 1 requires;
    • a member's Completes: line is unmet by its own commits (land.cs: list the issues a landing closes, and refuse a PR whose declared issue has no closing trailer #209, per member);
    • the train has fewer than two members;
    • more than one member adds a release descriptor, or the one that does is not last;
    • a descriptor is dated more than three days before landing.
  • Builds the train by git merge-tree --write-tree and git commit-tree, onto main, in the order given. Each merge carries Landing-only: merge and is dated at the newest commit it joins, so building twice gives the same head. A conflict refuses the train and prints the train without the member at fault.
  • Pushes to land/train-N1-N2-…, or to land/release-<version> when the last member carries the descriptor, so the release dry run still runs.
  • --main verifies land/<name> before it moves anything: the first-parent line down to main, each merge's trailer and tree, and the second parents equal to the members' current heads. Then it fast-forwards main and checks every closing issue is closed. When the push to main is refused, it prints the train without its last member.
  • --delegated-by <who> adds ADR 0239 point 4's trailer to the merges.
• eng/agent-review.cs admits a train on a land/ push, by the same rule in main's own copy. Every merge's second parent must be an approved pull request's head, by the existing check-run test. On a push, the workflow checks out main with its whole history (fetch-depth: 0), so that git can read the pushed merges as data. This only takes effect once it is on main.
• Docs: AGENTS.md's landing section, Commands, and the Landing / After landing bullets. docs/releases.md §3: a release rides last in a train, and the head guard holds for a train's head.

The release workflow, dco, issue-refs and release-pending need no change. They skip merges, or read agent review's run.

What was measured

• land.cs --fixtures tests/fixtures/land: 22 cases, 0 judged wrong. There were 12 before. The ten new train cases are built for real, in a scratch bare repository.

  ok   pass-train-two-members.json: the train #11, #12 is 1cff507ebbf6, 2 `Landing-only: merge` merges (Merge #11 into the train for main; Merge #12 into the train for main), built twice the same, land/train-11-12
  ok   fail-train-merge-conflicts.json: #13 conflicts with the train before it (#11, #12 on main) in README.md; a train's merge is never resolved by hand. land: the train without #13: dotnet run eng/land.cs -- --train 11 12
  ok   fail-train-merge-edited-by-hand.json: … 's tree is not `git merge-tree` of its parents: it was resolved or edited by hand
  

• The failure path: a pass- train case copied as fail- gave 23 cases, 2 judged wrong, exit 1.
• agent-review-tamper: every part holds, including four new train cases:
  • approved members: success;
  • a member that is no approved head: failure;
  • a merge edited by hand: failure;
  • a merge without the trailer: failure.
• A real dry run, land.cs -- --train 266 265 --print, refused both members, each for no approval of its head, checks still running, and no Completes: line.
• licence-headers, land, issue-refs and dco pass. The full test pipeline is left to CI.

What was found

• A train would have been red on agent review without the judge's change. It admitted a land/ head only when the head is an approved pull request's head. This was in the plan on Landing trains: several approved heads land in one run #277.
• The release workflow needs no change: its head guard reads the agent review run, and the land push now posts that run on a train's head.

What is left

• When both members are chain branches, the trial-merge record should be consulted. That is step 5's.
• Who may land a train is today's rule (ADR 0239). ADR proposal: agent grants in the identity map (what an agent may do under its human) #246 is where that would change.
• Question (also on Landing trains: several approved heads land in one run #277): a one-member --train is refused, with a pointer to land.cs -- N. Say if you want it to fall through to a plain landing instead.

Head: 440a0cf82bba.

---

Checklist

• Issue referenced: Refs #277 on each commit, and Closes #277 on the docs commit.
• ADR cited: ADR 0243 point 10 (filed unaccepted in ADR 0243: chain builds ahead of main, and landing trains (#230, step 0; filed unaccepted) #280); ADRs 0087 and 0088 applied.
• Specification updated, or n/a: docs/releases.md §3.
• API baseline updated, or n/a: n/a.
• Conformance baseline updated, or n/a: n/a.
• Tests: fixtures on every eng/ci.cs run; tamper cases.
• A new gate's failure path was proven by running it: quoted above.
• Signed off: by the commit-msg hook.
• A traceability record exists: docs/traceability/2026-11-11-issue-277-landing-trains.md, plus the session close-out docs/sessions/2026-11-chain-builds.md.
• dotnet run eng/ci.cs passes locally: only the process gates and fixtures were run.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NbWSYNzDrbT3ENstGnmH3N

[Hafeok]

What the tamper cases cover

The four train cases in the first head (440a0cf):

#	Case	Expected
1	A train of two approved heads	success
2	A member whose head is no approved pull request's head	failure
3	A merge whose tree was edited by hand (a file added)	failure
4	A merge without the Landing-only: merge trailer	failure

Neither of your two cases was among them, so both are added at d1c6d99:

#	Case	Fails because
5	An extra commit on the first-parent line between the merges	… is not a merge of two parents
6	A train built on a main that has since moved (the stand-in's main is a commit after the one the train was built on)	the walk passes the old main: … is not a merge of two parents, and main is not below it on its first-parent line

Every failure case now also requires its own reason in the judge's output, so a case cannot pass by failing for something else. All six hold under main's copy.

Also in d1c6d99:

• the pinned merge settings, the same in land.cs and agent-review.cs (detail on Landing trains: several approved heads land in one run #277);

• three land fixtures:

  • attributes read from the train's tree;
  • a local info/attributes refused;
  • a failed two-member train printing the plain landing command.

  land-fixtures: 25 cases, 0 judged wrong.

New head: d1c6d9911eb1. Step 0 (#280) moved to d6ffddca8f50 for the ADR's line on the pinned merge, and was merged forward into this branch (cda68dc), not rebased.

The full eng/ci.cs is running on both heads; I will post the results here and on #280.

---

Generated by Claude Code

[Hafeok]

dotnet run eng/ci.cs at d1c6d9911eb1: all 66 jobs pass, exit 0, 17 min 6 s

Run in this branch's checkout, with the W3C submodules initialised, on a 4-core Linux container. This is the whole pipeline: no --only, nothing skipped.

• Process gates:
  • issue-refs: 19 commits reference an issue, and every closing keyword is a trailer;
  • dco: 19 commits checked, 4 merges skipped;
  • decision-sets and the other process gates pass.
• Fixtures:
  • land-fixtures passes: 25 cases, 0 judged wrong;
  • agent-review-tamper passes, with its six train cases, each failing for its own stated reason;
  • land passes.
• Build: restore, build (warnings as errors) and build-benchmarks pass.
• Tests: all 29 test-* jobs pass, test-store taking 349 s.
• Ratchet: conformance passes.
• Packaging: pack and decision-report pass.

Test counts:

• land-fixtures: 12 → 25 cases;
• tamper train cases: 0 → 6;
• no test project changed.

Not run here: the CI-only legs, which are GitHub's. agent review's train path takes effect only once it is on main.

---

Generated by Claude Code