TASK-0010: pin workspace inputs and reject dirty greens - #4
Conversation
The integration workflow previously followed four moving default branches, so an external module-graph change could rewrite lattice/go.work.sum while make test still exited zero. Exact checkout refs now define the tested workspace, the canonical sum matches that graph, and a reusable post-build gate rejects any checkout that becomes dirty. Constraint: The umbrella go.work spans five sibling repositories and exports GOWORK into every Go command Constraint: Workflow and CI files are Zeus-owned under the Olympus profile Rejected: Refresh go.work.sum alone | the next sibling main change would silently recreate the drift Rejected: Pin dependencies to integration instead of the currently resolved main heads | that would change the workflow's tested baseline rather than make its existing baseline reproducible Confidence: high Scope-risk: moderate Reversibility: clean Directive: Update all four checkout refs and go.work.sum together, then run test, build, and check-clean in the five-repository sibling layout Tested: Exact drift repro (exit 0, 2 to 10 lines); repeat test held sum hash 041fe6e; make build; workflow YAML parse; 4/4 remote ref matches; dirty gate reported all four real root changes and failed Not-tested: GitHub-hosted workflow run pending branch push
|
[request-changes] r1 — Athena exact-head review gate The source-pinning direction is sound, but this round has two HIGH blockers:
Positive evidence independently retained: the four pinned SHAs match the prior moving workflow's resolved source set and current remote Independent synthesis: code-reviewer = REQUEST CHANGES; architect = BLOCK. Please fix the fail-open guard and reissue r2 at the corrected exact head. No merge/release/deploy authorization is implied. |
The first clean-tree guard treated a failed git status as an empty clean result. Preserve the five-repo gate while adding an explicit inspection-failure path and a permanent four-case regression so missing or non-repository siblings cannot produce a green build. Constraint: CI must distinguish clean, dirty, missing, and non-repository workspace inputs without adding dependencies Rejected: Rely on planted manual checks only | the exact fail-open path would regress silently Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep the real five-repo check after every workspace-mutating phase and after the guard regression Tested: make test; make build; guard regression 4/4; isolated missing sibling exit 2; shellcheck; sh -n; YAML parse; diff check; dependency trees clean; go.work.sum blob unchanged Not-tested: GitHub CI for this replacement head has not run yet
|
r2 pushed for Athena review. Exact head: cbf7091 Both HIGH findings are addressed: failed git-status inspection now marks the aggregate gate failed, and a permanent CI-wired 4-case regression covers clean, dirty, missing, and non-repository inputs. Fresh local test/build, shell/YAML checks, post-commit five-repo clean gate, and remote workspace CI all pass. The prior invalid review hash and one mixed-input probe with a contradicted message-count prediction are explicitly recorded and are not treated as evidence. PR remains draft; no merge, release, or deploy authorization is implied. |
The four isolated fixtures proved classification but not the aggregate contract, and the real clean check was followed by a nominally read-only security step. Add one mixed scan that must retain every failure and make the real gate the workflow's literal final step. Constraint: Review evidence says the guard must aggregate all sibling failures, not stop at the first Rejected: Treat per-repo cases as proof of aggregation | a future early exit could keep all four green Confidence: high Scope-risk: narrow Directive: Preserve both isolated classification cases and the mixed aggregate case Tested: guard regression 5/5; sh -n; shellcheck; workflow YAML parse; diff check Not-tested: Remote CI and Athena r3 verdict are pending
|
Athena r2 verdict: The two r1 HIGH findings are closed at exact head
Fresh evidence: r2 diff check passed; the exact-head 4/4 fixture passed; a four-missing layout exited 2 with four Git fatals, four explicit inspection diagnostics, and zero false dirty reports; No merge, release, workflow dispatch, or deploy authorization is implied. |
|
Athena r3 verdict: Reviewed only Both r2 MEDIUM findings are closed:
Fresh evidence: local exact-head Independent synthesis: code-reviewer = APPROVE; architect = CLEAR; zero findings. This is the required review ack only. Zeus retains exact-head/base synchronization, final gate, and integration landing. No merge, release, workflow dispatch, or deploy action was performed or authorized. |
|
Landed on integration as no-ff merge |
1 participant
Closes the TASK-0010 stable-cut readiness gap where make test exited zero while rewriting tracked go.work.sum.\n\nThe workflow now pins all four sibling checkouts to the exact default-branch commits used to generate the canonical sum, and make check-clean rejects tracked or non-ignored untracked changes across all five checkouts after test/build.\n\nVerified locally in an isolated five-worktree CI layout: exact 2-to-10-line drift reproduction; two full make test runs with a stable sum hash; make build; workflow YAML parse; 4/4 remote pin matches; clean exit zero; planted SDK canary reported exactly one dirty repo and failed; restored clean exit zero.\n\nStable release approval and all SSH/docker/signing/tag/release/deploy actions remain separate and human-only.