Scoped required check: run feed coherence on PRs that change registry/dependencies.yml #5220

Parent Outcome: #5097
Work level: Delivery · Track: Follow-up · Intended Status: Ready

Owner

Root/fdev retains this Delivery through source, required CI and native acceptance.

Done when

A job in the required always-gates set runs check-feed-coherence only when a PR changes registry/dependencies.yml. It passes trivially otherwise, so it never blocks unrelated PRs. A PR can then no longer flip a registry row to an unpublished version. It is tested with a fixture PR that flips a row to a non-existent version (must fail) and an unrelated PR (must pass).

Root decision on #5217: feed itself stays non-required, because it compares live feeds.

Current deliverable

A local three-file implementation and independent source review are complete. It places the scoped feed check in the existing required projection job; the consolidated always-gates/gates job is not required. No source push, native CI or live-feed qualification is claimed yet.

Next action

Land the reviewed candidate through the qualified routine route when current CI capacity permits; retain exact-head required checks and verify both the registry-flip and unrelated-PR cases.

Blocked on

Hosted CI capacity is reserved for the current SDK and constructor sequences. No additional required-context or protection change is needed for this placement.

Acceptance evidence

Six local Git/offline-feed cases passed, including both shallow merge parents, an unpublished registry version, deleted registry, invalid revisions and unrelated changes. Independent production-command probes confirmed no feed request for an unrelated no-token case, refusal for a related no-token case, and propagation of checker failure. These are local source evidence; native fixture PR and unrelated PR readback remain owed.

Root placement decision — 2026-11-05

The gate must block an unpublished dependency-row flip while passing trivially on an unrelated PR. Following the workflow consolidation in #5182, always-gates/gates is non-required. Use the existing required projection job in coherence.yml for this check, preserving the ten current required context identities and the strict SDK profile. The step reads live feeds only when the PR diff changes registry/dependencies.yml; an unreadable diff refuses. The separate scheduled feed workflow stays non-required. This records the current implementation of the required always-run gate criterion; native CI and full acceptance remain open.