Repository navigation
Prepare claim-fence arming packet - #2824
Conversation
|
Post-merge obligation completed on 2026-08-22: the hub The existing obligation and merged-PR provenance are unchanged. The typed forced takeover moved the sole winning claim from inactive worker The complete paginated all-open census was repeated from scratch after PRs #2828 and #2818 settled. It contained zero open Both no-write plans succeeded immediately before activation: the hub reported Activation succeeded in the required order. The hub apply reported Independent live after-set read-back passed on all eight repositories. PR #2824 remains merged at |
|
✅ This PR stays inside the touch-set its issue declared. |
|
{ |
|
{ |
|
{ |
|
{"acceptedExceptions":[],"baseSha":null,"claimGeneration":null,"critic":"godwit-886f","diffAuditReceipts":[],"diffAuditRequired":false,"digest":"3cfc07802f95985042ce98cf48a92850c28a2c7055765894f7e844c64b2f290c","headSha":"81baec150032d2e62c4f6fb38f3f9a4057378086","initialReview":null,"kind":"initial","policyVersion":"structured-decisions/1","precedingReview":null,"previousDigest":null,"revision":1,"round":0,"routeApplicability":"meaningful","routeEvidence":["BUILT ARTIFACT: detached review worktree /tmp/fsgg-2723-review.y7h9df at exact pushed head 81baec1, containing the production workflow .github/workflows/fsgg-claim-fence.yml, receiver reusable workflow .github/workflows/kit-materialize.yml, scripts/check-claim-fence.py, scripts/repos.sh, and the SDD/arming packet. Verification: git worktree add --detach /tmp/fsgg-2723-review.y7h9df 81baec1; git diff --name-status 48d5e55..81baec1; live PR GET https://api.github.com/repos/FS-GG/.github/pulls/2824 returned the same head and base immediately before recording.","EXECUTED COMMAND: PATH=/home/developer/fsgg-driver/.operator-tools/bin:$PATH bash tests/claim-fence/run.sh =\u003E 107 passed, 0 failed; PATH=... bash tests/repos-registry/run.sh =\u003E 182 passed, 0 failed; fsgg-sdd validate --text =\u003E 287 passed, 0 failed, 143 intentionally skipped, 0 coverage gaps, 0 not validated; PATH=... scripts/repos.sh validate =\u003E 9 repos, 6 capabilities, 9 kit items; python3 scripts/check-ship-verdict-provenance.py =\u003E 41 verdicts with no unverifiable sourcesDigest; git diff --check base..head =\u003E exit 0. Verification: all commands executed by critic godwit-886f in the detached exact-head worktree; exact-head CI GET/gh pr checks showed 45 passing, 1 skipped, and only claim-generation failing at https://github.com/FS-GG/.github/actions/runs/32565488245/job/97013402015 because the live authorization marker has not yet been written.","COMPARED ROUTES: (1) scripts/check-claim-fence.py\u0027s substantive stale/missing/unreadable authorization verdict against the production fsgg-claim-fence workflow result that branch protection consumes; (2) the binding design\u0027s hub-first-then-each-receiver arming route against this PR\u0027s exact post-merge arm-claim-fence obligation and documented commands. Verification: tests/claim-fence/run.sh executed the real parsed workflow and reported B1 missing marker -\u003E check 1, C1 stale head -\u003E check 2, E3 stale claim, I1/I2 no-verdict, while K1 reported the job is incapable of failing on a verdict and L4 reported the finding step exits 0; docs/reports/2026-08-04-github-native-executor-fencing-design.md:526-534 and :604 require hub first then per receiver; docs/coordination/reusable-workflow-contract.md:409-450 and PR comment https://github.com//pull/2824#issuecomment-5379573945 name only hub context claim-fence.","OBSERVED RESULT: CHANGES REQUIRED. M1 (Critical): requiring claim-fence as proposed does not arm the authorization predicate. The production workflow explicitly reports success unconditionally and every finding/no-verdict branch ends after warning/summary output without non-zero exit, so a missing marker, stale head/claim, permission failure, outage, or unclassified result remains a successful required check. Verification: .github/workflows/fsgg-claim-fence.yml:13-27, :189-193, :213-299 at the reviewed head; exact executed fixture K1 and L4 above; exact-head CI claim-fence itself is success at https://github.com/FS-GG/.github/actions/runs/32565488112/job/97013401644. M2 (High): the slice closes after a hub-only apply and never arms the seven receiver-side materialize / receiver-validate contexts, despite the binding specification requiring hub first and then each receiver and identifying receiver harm as the incident boundary. The receiver job also still neutralizes every substantive verdict with exit 0. Verification: design :532 and :604; docs packet :439-445; kit-materialize.yml:694-707, :803-805, :1311-1325; live required-status reads for FS.GG.SDD, Rendering, Governance, Templates, Game, Audio, and Net contain no materialize / receiver-validate, while six independently sampled current PR heads reported that context by name. M1 and M2 are repairable in this PR after widening Paths to the producer workflow/tests as needed; no separate issue was filed. Verification: REST cause searches across open/closed FS-GG/.github issues and PRs returned only the governing slice rows/PRs (#2719/#2723/#1858/#266 and PRs #2740/#2763/#2824), not a distinct actionable row. Validated facts that do not block: delivery-route show returns current sdd-required receipt revision 1/digest 5dbcb1fb...; verify-paths reports OK; App installation 143110413 reports administration:write; ship verdict provenance is stripped; the exact-head arm-claim-fence declaration is syntactically bound to 81baec..., but its live zero-unmarked precondition is currently false: PRs #2824, #2825, and #2818 are missing authorization and #2809 carries stale head 2fb051d... against ff04546.... Verification: scripts/fsgg-coord delivery-route show .github#2723 --json; scripts/fsgg-coord verify-paths --pr 2824 --repo .github; GET /orgs/FS-GG/installations; GET /repos/FS-GG/.github/pulls?state=open\u0026per_page=100 paginated plus per-PR body scans; obligation comment https://github.com//pull/2824#issuecomment-5379573945."],"schema":"fsgg.coord.review-decision/v2","subject":"#2723/pr/2824","succession":null,"timestamp":"2026-08-22T09:59:37Z","verdict":"changes-required"} |
|
{ |
|
{ |
|
{"acceptedExceptions":[],"baseSha":null,"claimGeneration":null,"critic":"heron-dfb7","diffAuditReceipts":[],"diffAuditRequired":false,"digest":"ae44fdf017a4c75a358063319c24d45e19c9ffd402805fc40e8cc640233cd20b","headSha":"9b84fe51dc32d23569a856a3e683afbcbf1d2f75","initialReview":"https://github.com/FS-GG/.github/pull/2824#issuecomment-5379664704","kind":"confirmation","policyVersion":"structured-decisions/1","precedingReview":"https://github.com/FS-GG/.github/pull/2824#issuecomment-5379664704","previousDigest":"3cfc07802f95985042ce98cf48a92850c28a2c7055765894f7e844c64b2f290c","revision":2,"round":1,"routeApplicability":"meaningful","routeEvidence":["BUILT ARTIFACT: detached pristine critic worktree /tmp/fsgg-2723-pristine.kpEakb at exact pushed head 9b84fe5, containing the repaired production hub workflow, shared receiver workflow, arming packet, obligation declaration, SDD package, and bounded fixtures. Verification: git worktree add --detach /tmp/fsgg-2723-pristine.kpEakb 9b84fe5; git rev-parse HEAD returned the same SHA; live GET /repos/FS-GG/.github/pulls/2824 returned the same head immediately before review.","EXECUTED COMMAND: the repaired exact-head gates and lifecycle checks pass: claim-fence 108/0, receiver-validate 74/0, repos-registry 182/0, SDD validate 287/0 with 143 intentional skips and 0 coverage gaps, repository registry validation 9 repos/6 capabilities/9 kit items, ship provenance 41 clean verdicts, verify-paths OK, and git diff --check clean. Verification: PATH=/home/developer/fsgg-driver/.operator-tools/bin:$PATH bash tests/claim-fence/run.sh; bash tests/receiver-validate/run.sh; bash tests/repos-registry/run.sh; fsgg-sdd validate --json; scripts/repos.sh validate; python3 scripts/check-ship-verdict-provenance.py; FSGG_WORKER=heron-dfb7 scripts/fsgg-coord verify-paths --pr 2824 --repo .github; git diff --check 48d5e55..HEAD, all executed against the pristine detached worktree except the live path check.","COMPARED ROUTES: (1) hub gate verdicts 0/1/2/3/unclassified through the parsed fsgg-claim-fence workflow and the branch-protection-consumed claim-fence check; (2) receiver authorization verdicts through the extracted production receiver-validate run block and the materialize / receiver-validate context selected for every coordination-kit receiver; (3) dry-run arming versus live protection state. Verification: claim-fence K1/R21 and live Actions job 97017805835 show only verdict 0 passes and missing authorization reaches Enforce with RC=1; receiver D1/D2 show missing authorization exits 1 and neutralizing exit $rc exposes green; live no-write require-context commands reported hub 1 would-add/0 failed and exactly FS.GG.SDD, Rendering, Governance, Templates, Game, Audio, Net 7 would-add/0 failed; live main protection still omits both new contexts.","OBSERVED RESULT: PASS; both prior material findings are repaired and no unresolved material finding remains. Verification: .github/workflows/fsgg-claim-fence.yml:183-307 reports before enforcing and maps only 0 to success; .github/workflows/kit-materialize.yml:803-822 and :1311-1322 publishes then consumes the receiver verdict without continue-on-error; docs/coordination/reusable-workflow-contract.md:409-467 and obligation comment #2824 (comment) bind hub-first activation and all seven receiver contexts to a post-merge repeat census/read-back with no apply while dirty. The repeated live census found #2826, #2825, #2824, and #2818 missing authorization plus #2809 stale, while live dry runs still report WOULD-ADD, so no protection was applied. Exact-head current CI has the designed pre-authorization claim-fence and claim-generation reds and all other current gh pr checks passing or intentionally skipped; Verification: https://github.com/FS-GG/.github/actions/runs/32567348932/job/97017805835, https://github.com/FS-GG/.github/actions/runs/32567349090/job/97017806409, GET /commits/9b84fe51dc32d23569a856a3e683afbcbf1d2f75/check-runs, and gh pr checks 2824. Architecture-map reconcile passed at https://github.com/FS-GG/.github/actions/runs/32567348930/job/97017805839; all 26 changed files match the issue Paths declaration by the exact base/head inventory. The committed readiness records report implementationReady, verificationReady, and shipReady with 12 observed evidence obligations and zero invalid or blocking evidence; Verification: readiness/2723-fence-arming-premise-rot/analysis.json, verify.json, ship.json, and ship-verdict.json at the reviewed head. Diff audit is not required because this is not a bulk semantic replacement; Verification: exact base/head diff inventory and initial record #2824 (comment) both classify diffAuditRequired=false."],"schema":"fsgg.coord.review-decision/v2","subject":"#2723/pr/2824","succession":null,"timestamp":"2026-08-22T10:28:08Z","verdict":"pass"} |
|
{ |
|
{"acceptedExceptions":[],"baseSha":"48d5e5566fc8caac63bdae454264b3c4d2f54e8d","claimGeneration":"5379528817","critic":"heron-dfb7","diffAuditReceipts":[],"diffAuditRequired":false,"digest":"63e339dc14327f68b7668ffe4396363d661646122b1dca764ad89e4b4792e3ed","headSha":"9b84fe51dc32d23569a856a3e683afbcbf1d2f75","initialReview":"https://github.com/FS-GG/.github/pull/2824#issuecomment-5379664704","kind":"acceptance","policyVersion":"structured-decisions/1","precedingReview":"https://github.com/FS-GG/.github/pull/2824#issuecomment-5379766975","previousDigest":"ae44fdf017a4c75a358063319c24d45e19c9ffd402805fc40e8cc640233cd20b","revision":3,"round":1,"routeApplicability":"meaningful","routeEvidence":["Fresh successor critic PASS at exact head: https://github.com/FS-GG/.github/pull/2824#issuecomment-5379766975","Matching durable wait completed: https://github.com/FS-GG/.github/pull/2824#issuecomment-5379767738","Host issued the live delivery authorization at the accepted head; a fresh check read then found zero non-success/non-skipped checks. Verification: FSGG_WORKER=plover-49c0 scripts/fsgg-coord delivery .github#2723 --pr 2824 --json; gh pr checks 2824 --repo FS-GG/.github --json name,state,link --jq filter returned [].","The exact-head obligation remains a post-merge no-apply-until-clean arming operation: https://github.com/FS-GG/.github/pull/2824#issuecomment-5379573945"],"schema":"fsgg.coord.review-decision/v2","subject":"FS-GG/.github#2723/pr/2824","succession":null,"timestamp":"2026-08-22T10:32:37Z","verdict":"accepted"} |
|
No description provided. |
Closes #2723
Summary
claim-fencecontext fail closed: verdict 0 passes; findings, retryable/permanent no-verdicts, and unclassified codes fail after diagnostics render.Verification:
tests/claim-fence/run.shexecutes gate exits 0/1/2/3/7 under both supported shells and reports 108 passed, 0 failed; mutation R21 replaces the consumed refusal with success and is caught on head9b84fe51dc32d23569a856a3e683afbcbf1d2f75.materialize / receiver-validatecontexts in the activation packet.Verification:
tests/receiver-validate/run.shreports 74 passed, 0 failed across positive, missing, stale, unreadable, malformed, crash, and fail-open inversion paths; the live no-write receiver dry run selected exactly SDD, Rendering, Governance, Templates, Game, Audio, and Net and reported7 would-add, 0 unchanged, 0 failed.Verification: the live hub dry run reported
1 would-add, 0 unchanged, 0 failed; the current open-item census found Fix delivery path admission parity #2825, Prepare claim-fence arming packet #2824, and Extract lifecycle command family #2818 without current markers and Fix exhausted review chains with advancing heads #2809 with a stale head, so no--applycommand was run; the order and rollback are recorded indocs/coordination/reusable-workflow-contract.md.scripts/repos.shcredential premise and complete thesdd-requiredpackage.Verification:
tests/repos-registry/run.shreports 182 passed, 0 failed;fsgg-sdd validatereports 287 passed, 0 failed, 143 intentional skips, and 0 coverage gaps; analyze/evidence/verify/ship reportimplementationReady/evidenceReady/verificationReady/shipReady; provenance reports 41 clean verdicts.Verification
PATH=/home/developer/fsgg-driver/.operator-tools/bin:$PATH bash tests/claim-fence/run.sh— 108 passed, 0 failed.PATH=/home/developer/fsgg-driver/.operator-tools/bin:$PATH bash tests/receiver-validate/run.sh— 74 passed, 0 failed.PATH=/home/developer/fsgg-driver/.operator-tools/bin:$PATH bash tests/repos-registry/run.sh— 182 passed, 0 failed.PATH=/home/developer/fsgg-driver/.operator-tools/bin:$PATH fsgg-sdd validate --json— 287 passed, 0 failed, 143 skipped, 0 coverage gaps.PATH=/home/developer/fsgg-driver/.operator-tools/bin:$PATH scripts/repos.sh validate— 9 repos, 6 audited capabilities, 9 kit items, authorityFS-GG/.github.PATH=/home/developer/fsgg-driver/.operator-tools/bin:$PATH python3 scripts/check-ship-verdict-provenance.py— 41 clean verdicts.git diff --check— clean.