[kyle-sexton]

No related issue: owner decision Q26 (2026-11-11 interview). The ci-status job displays as "CI Status", rolled out by GitHub Support's adopted alias plan, step A.

Draft: held until melodic-software/ci-workflows#1072 merges and this PR repins aggregate-results with alias-jobs: ci-status; without that, contract-only runs misread their shape (see Remaining).

Summary

• The gate job ci-status gets name: CI Status. Its id is unchanged, so needs: references and the github-iac verifiers that key on the id still match.
• A new alias job report-ci-status, named ci-status, needs CI Status, runs if: always(), and exits with CI Status's result. The required context ci-status therefore keeps reporting the same conclusion on pull_request and merge_group until the github-iac ci-gate ruleset requires CI Status (step B). It is removed in step C. No push trigger is added: this workflow has none by design, as documented in its header.
• Every consumer that finds the gate by its check name now looks for CI Status first and still accepts ci-status, for heads tested before this change.
• Re-runs target the CI Status job. Re-running it re-runs its dependents, so the alias re-runs too; re-running only the alias would replay its old needs result.

Fix

• Shared match: maintenance-reconcile-lost-runs/infra-failure.mjs exports GATE_CHECK, GATE_ALIAS, AGGREGATE_JOBS and gateEntries(), which returns CI Status's entries and never the alias's beside them.
• Scripts using the helper: reconcile.mjs, fix-ci-dispatch.mjs, red-main.mjs, resolve-pr.mjs, probe/replay.mjs.
• Local literals instead: clear-escalations.mjs, gate-source.mjs and review-dependency.mjs carry the two names as literals, each with a comment. Importing the helper would break the sparse hold-config checkout and the staged base-script layout, which tests already pin.
• review-dependency.mjs: reads CI Status's annotations, since only that job writes the superseded note.
• Release: release-publish-plugins/ci-status.sh reads check_name=CI Status, then ci-status.
• Rerun: pr-feedback-dispatch.yml re-runs the CI Status job.
• Gate tail query: the gate's own runner-tail query excludes both names.
• Plugins:
  • guardrails block-unresolved-pr-merge.sh reads CI Status's annotations.
  • source-control babysit babysit_merge_policy.py, babysit_postmerge.py and babysit_verify_evidence.py read CI Status first.
  • Both plugins get patch changelog fragments.
• Docs: docs/ci-runner-routing.md and the pr-verify prompt name CI Status and the alias.

Verification

All runs below are local and every one passes:

• Node suites over the touched and structure-reading files:
  • reconcile and infra-failure: 202
  • fix-ci-dispatch: 79
  • dependency: 65
  • clear-escalations, recheck, gate-source and fix-ci-context: 226
  • red-main: 29
  • resolve-pr and upstream-jobs: 171
  • replay: 13
  • decide: 61
  • log-api-budget: 70
  • callers, api-budget-coverage and dispatch-limits: 295
  • the gate-reading batch: 2633
  • pr-verify: 80
• Bash suites: ci-rerun-ci-status 285, block-unresolved-pr-merge 724, ci-lanes-pr-hold 344, ci-review-lanes 251, post-merge-demotion-alert 331, check-docs-only-gate 88, check-lane-coverage 41, plus the other scripts/ci-*.test.sh suites the gate reads.
• pytest: 1330 tests plus postmerge 362.
• Linters: actionlint, shellcheck and scripts/run-ruff.sh check are clean. check-lane-coverage.sh --check and check-docs-only-gate.sh --check pass.

Remaining

• Repin aggregate-results to the ci-workflows commit that merges feat(visualization): add on-demand visualization router plugin #1072, and pass alias-jobs: ci-status. Until then the pinned composite misreads contract-only runs with the alias:
  • job_shape reads them as full runs;
  • the sibling re-run skips them;
  • carried successes from pre-rename runs are dropped.
• Send GitHub Support's hub the merge time before and after this merges (its scripts match ci-status).

Related

• feat(github-actions-conventions): lint job, step and action display names standards#983 (lint rules, alias exception), feat(pr-require-checks): ignore gate alias jobs in run-shape reads ci-workflows#1072 (alias-aware aggregate).
• Next steps: B is the github-iac ci-gate context CI Status, once every requires-ci repository reports both contexts. C removes this alias.

Follow-ups

• Pre-existing (advisory): human guidance text still says "re-run ci-status" (merge-holds.mjs:278, :1445, pr-feedback-dispatch.yml, reconciler note). The regexes personHoldLine and RERUN_TAIL match that text, so the wording changes together with them in step C.
• Pre-existing (advisory): the scripts/check-lane-coverage.sh comment "the repo carries ZERO opt-outs" is no longer true while the alias exists.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-12T00:03:31.913600Z	d695ffb	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed d695ffbe8ef171aaa67c2b62811ba70264964fb5: read 38 of 38 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #15397, which shows the gate job as CI Status and adds a ci-status alias job

I found no security issues. I read every hunk of all 38 changed files in .claude-lane/pr.diff.

critical-findings: 0

What I checked

The new alias job report-ci-status (.github/workflows/pr-require-checks.yml).

• It has permissions: {}.
• needs.ci-status.result reaches the script only through env: RESULT, so nothing is interpolated into run:.
• The script exits successfully only when the result is success. If the gate fails, is cancelled or is skipped, the required ci-status context fails too.
• Re-running only the alias replays the gate's latest result, which cannot be green while CI Status is red. The alias cannot pass a red gate.

Merge holds (clear-escalations.mjs, gate-source.mjs, fix-ci-dispatch.mjs, the pr-require-checks.yml gate steps, babysit_verify_evidence.py and babysit_merge_policy.py). Every change adds the gate's new check name next to the old one. They are excluded from "no other check fails" tests in the same way ci-status was before, so this keeps parity rather than widening anything:

• Every other failing check still keeps its hold.
• fix-ci-dispatch.mjs gets AGGREGATE_JOBS from its existing import (line 45), so its line 302 changes the same way.
• Reads still fail closed:
  • _ci_status returns unreadable on any non-200 response.
  • The draft-run readers find no draft step when only the alias is listed, so the fail is kept.
  • heldShape returns null when more than one job matches the gate.

Gate-run selection (gateCheckRuns, gate_entries, gateEntries, ci-status.sh, babysit_merge_policy._ci_status). These now prefer CI Status and fall back to ci-status. Spoofing works the same as before: any GitHub Actions job on the head can take either name, and the PR's own workflow already controls the gate job. The GitHub Actions app filter (app_id / app.slug) is unchanged.

block-unresolved-pr-merge.sh superseded mapping. A failed ci-status alias inherits a superseded marker only when it is in the same Actions run as a GitHub Actions CI Status run that already carries a marker. An alias run with no match stays failing.

pr-feedback-dispatch.yml re-run. The job id comes from API JSON through a constant jq program, so there is no injection path.

Instruction surface. The .github/scripts/pr-verify/prompt.md change only adds that the alias is not test evidence. Nothing is softened.

Trust controls. The diff does not touch the trusted-trigger check, the lane-token scope, the kill switch, the broker or any plugin manifest.

Notes (not findings)

• Action pin (zizmor's lane, not re-reported): aggregate-results moves from 226dad3 to ac4d8780de793b20e60a66890e767df579c80d83 (pr-require-checks.yml#L6995). It is still a full-SHA pin to an org repository, and the step now passes alias-jobs: ci-status. The PR description says it is held until ci-workflows#1072 merges. I could not check whether that commit is on ci-workflows' default branch rather than an unmerged PR branch. zizmor's impostor-commit audit covers that.
• Spend: one extra job (at most 3 minutes, usually a few seconds) on a standard ubuntu-24.04 runner each time the gate runs. It is not a hold.

[github-actions]

claude-review reviewed d695ffbe8ef171aaa67c2b62811ba70264964fb5: read 38 of 38 changed file(s); 0 finding(s), 0 as inline comments.

Code review: no findings

I read every hunk of all 38 changed files. I also read the unchanged code the changed lines call, because many of them sit on trusted paths: pr-require-checks.yml, pr-feedback-dispatch.yml, infra-failure.mjs, clear-escalations.mjs, gate-source.mjs, resolve-pr.mjs and the babysit scripts. I found nothing at the blocking or advisory bar.

What I checked

• Imports resolve:
  • fix-ci-dispatch.mjs already imports AGGREGATE_JOBS from infra-failure.mjs.
  • babysit_merge_policy.py imports quote, which turns CI Status into CI%20Status as the new test expects.
  • babysit_postmerge.py imports the module as policy and babysit_verify_evidence.py as merge_policy.
  • Nothing still uses the removed CI_STATUS_CHECK or LANE_AGGREGATE_JOB constants.
• jq precedence: in the gate_job filter in pr-feedback-dispatch.yml and the gate-run select in block-unresolved-pr-merge.sh, the if length > 0 then . else null end guard lets // fall back to ci-status. Without it, an empty array would still count as a value and block the fallback. max_by(.id) // empty still returns nothing when no job matches.
• ci-status.sh error handling: under set -euo pipefail, a failed gh api read inside runs=$(gate_runs …) still exits non-zero, as the header promises.
• Preferring CI Status over the alias: gateEntries, gate_entries, gateCheckRuns and the ci-status.sh fallback all read CI Status first and use ci-status only on a head with no CI Status run. So the alias's empty annotations and replayed needs result are never read as the gate's.
• Other readers of the old name: I searched the repository for check-name reads of ci-status outside this diff. The rest key on the job id (check-docs-only-gate.sh), name the ruleset's required context, or are guidance wording the PR lists as a follow-up.
• Alias job: report-ci-status runs with permissions: {}. Its if: always() fails closed, so it never reports a skip, which branch protection would count as a pass.

Not verified (I had no shell or network access)

• The PR description says the PR is held until feat(pr-require-checks): ignore gate alias jobs in run-shape reads ci-workflows#1072 merges. Its "Remaining" section lists the aggregate-results repin as still to do. The diff already repins it to ac4d8780de793b20e60a66890e767df579c80d83 (dated 2026-11-11) and passes alias-jobs: ci-status (pr-require-checks.yml#L6995).
  • I could not confirm that this commit is the merged feat(visualization): add on-demand visualization router plugin #1072 or that the input exists at that commit.
  • If it does not, the run-shape misreads the description lists come back.
  • The description's "Remaining" section looks out of date against the diff.
• All test counts and linter results in the PR description are the author's claims; I did not run them.

Spend (not a finding): the new report-ci-status job adds one short job on a standard hosted runner to every pr-require-checks run. Its timeout is 3 minutes and it normally takes seconds. Because of always(), it also runs on cancelled runs.

No closing issue (the PR cites owner decision Q26). No plugin manifest is changed, so there are no manifest lines. The PR context contained no embedded instructions.