Skip to content

ci: coordinate long exact-base confirmation with concurrent main merges #2111

Closed
Closed
ci: coordinate long exact-base confirmation with concurrent main merges#2111
Labels
agent-readyContext and acceptance criteria are complete enough for an agent to take this unattended.area: ciCI workflows, the gates they run, release scripts, packaging.type: choreTooling, CI, release plumbing, dependencies.
Milestone
0.44.0

Description

@schlessera
schlessera
opened on Oct 16, 2026

Later successful integrated-tree qualification — 2026-10-20

Ordinary PR #2449 exercised the unchanged reservation controller delivered by #2197 through exact-candidate confirmation, verified squash and owned release. Independent source comparison confirms identical integrate.ts, integration-proof.ts and integration-reservation.ts blobs across #2197's squash, #2449's tested head and #2449's squash. The surrounding workflow/build/test inputs changed; this does not establish whole-suite equivalence with the earlier delivery.

Confirmation 39377232609, attempt 1, passed all 17 jobs on synthetic 79b3af810f16d39792e7e35c724871379e69412b, parents 510c2909b666b37880999fc50e5759c11591db33 and 1eafd54e6256400134a4071958ebea9b4eb8ea99. The guarded squash e9bd4621486fa07ced9c2c576e03603fd7f0eba1 has the expected base parent and matching tree 14ec0d2d77cb10abfcbdaf18f33c733b961934d2. Automatic main 39379334227, attempt 1, independently passed all 17 jobs on that exact squash. All 34 actual checkout logs and both aggregates were verified: all nine categories fresh, no retained proof, four unit/three browser/two layout shards. The saved canonical readback at 228c8781f9bb7323767d329ae2c3fd9c00ba74dc records release of lease 42e30bb3c750dae8e362a59f1808863e with no active reservation.

This establishes a complete successful ordinary-controller window on the later integrated tree. Candidate/main elapsed costs are 1,284/1,229 seconds, summed job costs 9,814/10,450 seconds, event-to-first-job 2/3 seconds, with zero cancellations. These are attributed execution costs, not causal savings. No new runtime or hosted run was needed for this source/receipt audit.

Original main run 39333870950 remains FAILURE, with its exact source and hook-timeout receipt below. Later success neither identifies nor repairs #2342's intermittent lifecycle failure. Sequential use for a different PR also does not prove simultaneous distinct-PR contention. #2111 remains OPEN and waits on #2342, with distinct-PR qualification still outstanding. The claim stays released and milestone 0.44.0 is retained. No original criterion is waived or historical result relabeled.

Delivered controller and remaining qualification — 2026-10-20

PR #2197 merged through the shared controller at 1f88a7a3018fc669f0dd8d97bd36572d8b315b03 (GitHub merge time 2026-10-19 22:17:19Z). Its actual parent is cea53611ddea4916ac323060bfef42ec18118fea and tree is 2b199682366c8009d60a79d3ead2c4e15b2a0bd2, exactly matching the passing candidate. Immutable GitHub commit data and local fetched Git agree; the squash is an ancestor of origin/main. Issue and PR retain release 0.44.0. This is a Refs delivery; the issue remains open.

Ready confirmation run 39331233256, attempt 1, passed all 17 selected jobs with no skips or retained domains. Every actual job checkout log names bd4388e36b1d116f7996587a768e94284f89c028, whose parents are the recorded base and head d11d554530d65f6e3dc96927f2e8d6210674493f. The independently inspected aggregate binds that checkout and all nine selected categories, four unit shards, three browser shards and two layout shards. Contract checks passed. Earlier cheap draft successes are not counted as confirmation.

The real canonical reservation admits exactly one of two concurrent same-candidate clients. Explicit renewal, audited revocation, former-owner refusal and successor fencing passed before confirmation. During automatic confirmation, 21 renewal state commits retained the original hard cap. The controller verified proof, milestones and final live authority, performed the matching-head squash, checked its parent/tree/ancestry, then released its own lease. Readback at coordination commit 77b0dc4f1987c84e0ffe8b5ac59c10ba16c3ddd5 has no active owner. The owned interval was 1,321 seconds (22m01s), including confirmation and merge. The controller's exit 2 is intentional pending separate main proof, not a failed candidate or failed merge.

Measured confirmation costs: event to first job 4 seconds; event to completed run 1,228 seconds (20m28s); summed job elapsed 10,004 seconds (166m44s); zero cancelled jobs/consumption. Longest job unit (3) took 1,127 seconds (18m47s). Per-job and per-step durations are retained. Summed concurrent job time is not CPU or elapsed critical-path time; event-to-first-job includes scheduling/startup and is not isolated runner queue time. A single window proves attributed successful coordination, not causal whole-CI savings.

Automatic main run 39333870950 has a confirmed unit (4) failure on the actual squash: the real-socket handshake case reaches a 30,220.60 ms beforeEach/afterEach hook timeout; three dangling processes are killed. The existing #2342 investigation now carries this distinct-case recurrence. No protocol assertion failure or blocking teardown phase is established. The preceding candidate remains passed; automatic main proof is not green. No unchanged retry is requested. The original run has now completed: all 17 job checkout logs name the exact squash; fifteen jobs pass, unit (4) fails and the integrated/exhaustive aggregate correctly rejects the unit failure. No skips or cancellations. Main elapsed is 1,266 seconds (21m06s), summed job time 9,973 seconds (166m13s), event-to-first-job 3 seconds. Full final logs and per-job durations are retained separately from candidate proof.

The distinct-PR competing-candidate demonstration also remains: previous live contention used two clients for the same PR. Choose another eligible, coordinated ordinary PR when available; do not take over another worker or start a blocked candidate. Local candidate-change/refusal tests retain their existing scope. Native stack-prefix support remains excluded.

This is a documented blocked handoff. Parent releases only claim e1849-2111-20261019-r3; the integration reservation was already released successfully. Resume after the #2342 prerequisite has actionable evidence/repair, retain failed main attribution, and qualify any correction through a new branch. Earlier preparation descriptions below are historical source-attributed evidence.

Out of scope

Do not weaken exact-head/base candidate freshness, selected coverage, native/endurance obligations, offline guards, image pins or aggregate checks. No passing-result cache, forced merge, deadline/shard increase, repository ownership migration or invented native GitHub merge queue. The maintainer selected the automated expiring reservation policy below; all policy questions are resolved. The ordinary-candidate implementation is delivered by #2197 for release 0.44.0; remaining qualification is recorded above.

Observed context

While validating #1836 in PR #2062, main advanced during three proof windows:

validateCandidate (scripts/candidate-proof.ts:6-29) at 9506026705425653a40608395aa756cae2a344b2 correctly compares the actual merge parents/tree with the requested and live head/base. A changed live base is rejected. The two later runs were stopped after live-base observation, before claiming their aggregate had produced a stale-base error; no historical gate failure is asserted. Cancelled/unfinished jobs remain incomplete proof. This is evidence of repeated invalidation and consumed verification work, not proof that eventual completion is impossible or that any test failed.

The current process requires another complete confirmation event after every base advance. Long global/native confirmation and runner queues can overlap the next merge. User-owned repository limitations and the decision against inventing a native queue remain binding in docs/decisions/ci-utility.md. Relevant cost/control-plane context is #1849 and delivered #1854/#1862.

Maintainer decisions

  1. Resolved (maintainer, 2026-10-16): choose option C: an automated, expiring integration reservation with a visible owner and expiry. Coordinate expensive candidate confirmation and competing main merges without weakening exact-head/base proof. This is a reservation, not approval for a native GitHub merge queue, repository ownership migration or a generic passing-result cache.

  2. Resolved (maintainer, 2026-10-16): choose option A for reservation scope: one exact PR candidate identified by PR, head SHA and base SHA, with a recorded responsible actor. A changed head or base invalidates that reservation; the changed candidate must acquire a new reservation and request confirmation. A reservation does not cover an agent session, updates to the candidate or a batch of PRs.

  3. Resolved (maintainer, 2026-10-16): choose option B for lifecycle: a renewable 5-minute lease, renewed every minute, with a hard 60-minute total limit from acquisition. The total includes runner queueing, proof and the final merge window; renewal never resets the cap. Acquire before requesting expensive confirmation. Release on successful merge, terminal proof failure/cancellation, explicit abandonment or candidate head/base invalidation. A missed renewal expires the lease after its last granted 5-minute term; continued activity does not revive an expired or superseded reservation. These timings are selected starting values, not measured optimal limits.

  4. Resolved (maintainer, 2026-10-16): choose option A for competing acquisition: return a visible busy result identifying the current owner/candidate and expiry; callers retry with bounded backoff. No persistent queue or guaranteed FIFO ordering. Nonowners may continue implementation and fast feedback but must hold competing main merges and expensive candidate confirmation until they acquire the reservation. Concurrent requests must never grant two active owners.

  5. Resolved (maintainer, 2026-10-16): choose option A for enforcement: a shared merge command and mandatory contributor/agent merge procedure. Immediately before merging, the command checks the live reservation's ownership, unexpired lease/hard cap and exact PR/head/base identity, plus all existing candidate proof and milestone requirements. Preserve actual squash parent/tree and main-proof verification afterward. Direct merges can bypass this cooperative procedure under existing permissions; do not describe it as an atomic GitHub branch lock. No branch-protection/ruleset or merge-permission change is authorized by this choice.

  6. Resolved (maintainer, 2026-10-16): choose option B for overrides: explicit maintainer revocation with a recorded reason. Record the actor, time, reason and revoked reservation/candidate. Revocation immediately removes the former owner's merge authority; it cannot renew, merge under the old reservation or modify a successor's reservation. A replacement candidate must acquire its own reservation and pass required candidate confirmation. Revocation never waives proof, freshness or milestone requirements.

All policy questions are resolved. The issue is agent-ready for the scoped continuation; draft implementation is not completed hosted qualification.

Scope

Implement automated exclusive acquisition, inspection, bounded renewal, release and explicit maintainer revocation for the exact-candidate reservation policy above. Provide the shared merge command and update the contributor/agent merge procedure. Use authoritative shared coordination state and test real concurrent acquisition; local files or comment-only claims are not proof of exclusive ownership. Choice of implementation mechanism must satisfy these requirements without adding a native merge queue or changing repository protection/permissions.

Update docs/decisions/ci-utility.md in the implementation to record the selected reservation policy and reconcile the existing no-queue rule. Preserve exact freshness checks and actual integrated-tree evidence throughout.

Acceptance criteria

  • Preserve the named run/attempt/checkout and main-advance identities and existing measured follow-up comments. Quantify queue, executed time, cancellation consumption and critical path to evaluate the selected mechanism; distinguish historical costs from controlled improvement evidence.
  • Implement the selected automated expiring reservation for one exact PR/head/base candidate Use the selected 5-minute lease, 1-minute renewal and 60-minute hard cap. Record a visible owner and expiry and demonstrate that competing acquisition cannot silently grant two active owners.
  • Provide a shared merge command and update the mandatory contributor/agent merge procedure. Prove that missing, expired, superseded, wrong-owner or mismatched-candidate reservations block the command before merge, alongside existing proof/freshness/milestone requirements. Preserve final live checks and actual integrated-tree verification; document the remaining direct-merge bypass and race limits. No new branch protection or permission change is selected.
  • Prove exclusive acquisition under concurrent requests and a busy result exposing the active owner/candidate and expiry. Contenders use bounded backoff without a persistent queue or FIFO guarantee; nonowners may continue coding/fast feedback but cannot start competing confirmation or merge.
  • Provide explicit maintainer revocation that records actor, time, reason and the revoked reservation/candidate. Prove immediate invalidation and rejection of subsequent old-owner renewal/merge attempts, including after a successor acquires. Replacement candidates must acquire their own reservation and pass required confirmation; no override waives proof/freshness/milestones.
  • Prove 5-minute lease expiry, 1-minute renewal, the 60-minute hard cap including queue/merge time, terminal failure/cancellation/abandonment release and recovery after missed heartbeats. An expired or superseded owner cannot renew or release another owner's reservation or merge under its former authority. No new reservation may bypass exact-candidate confirmation requirements.
  • Record the PR, immutable head/base identities and responsible actor. Reject use of a reservation after either identity changes; reacquisition and new confirmation are required. Demonstrate this for both head updates and competing main merges.
  • Preserve exact candidate freshness and actual integrated-tree verification; a reservation is coordination evidence, not a substitute for passing proof or an atomic GitHub branch lock.
  • Any implementation follows the ruling, preserves current proof/freshness requirements and demonstrates both competing-candidate handling and successful completion on the actual integrated tree.
  • No unrelated product behavior, resource budget, test assertion or mandatory scenario is changed to obtain green.

Verification

Focused reservation-state and shared merge-command tests with meaningful failing-first/mutation receipts; real concurrent acquisitions and expired/superseded/revoked-owner attempts; workflow/proof invariants; bun run check:pr --base origin/main; and a controlled hosted confirmation/merge demonstration recording actual head/base/tree identities and queue/execution/cancellation costs. Tests remain offline and keyless. No existing proof, offline guard or mandatory runtime scenario may be weakened.

Contract impact

None selected. This is a coordination/policy decision. No public package, CLI/MCP/wire or retained-proof contract changes are approved.

2026-10-16 maintainer rulings resolved: automated reservation (C); exact PR/head/base scope (A); 5-minute lease, 1-minute renewal, 60-minute total cap (B); busy responses with bounded retries (A); shared merge command and mandatory procedure under current permissions (A); explicit maintainer revocation with recorded reason (B). Folded all choices into current scope and acceptance criteria, preserving historical evidence in context and comments. Implementation and the binding decision-record update remain outstanding; no release commitment or proof waiver is selected.

Historical preparation and local qualification — 2026-10-19

Draft #2197 is refreshed from c99c78a2b32054144c57467e664d5f2f993cb46d onto inspected main cea53611ddea4916ac323060bfef42ec18118fea; current head is d11d554530d65f6e3dc96927f2e8d6210674493f, tree 2b199682366c8009d60a79d3ead2c4e15b2a0bd2. The original twelve-file ordinary-candidate scope remains. Main integrated without conflicts, including delivered #2365/#2374 and #2373/#2388 fixture repairs, draft-readiness protection, browser capacity/shard policy, and automatic Git-maintenance suppression. The prior blocker is resolved; original source-bound failure and mutation receipts remain in comments.

The merge verifier now consumes the delivered shared browser/layout shard table (verifyIntegrationProof, scripts/integration-proof.ts:26-70); its independently literal three-browser-job executable control fails before correction and passes afterward. Missing third-shard evidence still prevents merge (test("shared merge executable requires all three delivered browser shards", tests/integration-command.test.ts:132-140). No production qualification pin, required job, offline guard, deadline, image or native-prefix boundary was weakened.

The old pinned self-test was reproduced before integration: COMPLETE_NATIVE_QUALIFICATION_WITHOUT_DOCKER_OR_IMAGE_LOOKUP expected 859 and received undefined. The delivered independent frozen positive plus actual-current drift controls pass after refresh. A fresh owned frozen copyfile installation on Bun 1.4.2 reproduces dependency identity 0c2758c046f2b69d5f33b66521baf3098db5f44256b73ec96961c98d381e6245 (843 packages, 59,516 files, 1,833,832,361 bytes).

Current local proof: 21 reservation/controller/aggregate tests / 490 assertions; 115 explicitly selected native/generated/browser-binding/candidate/workflow guard tests / 52,432 assertions at refresh commit eb0494654606d434741589b1df0c7a86002241c2 (the final two-file shard correction changes none of those guard inputs); strict types pass. Unconditional remote force again grants both real Git contenders and fails ONLY_ONE_REMOTE_ACQUISITION_SUCCEEDS; omitting the final live authority check actually dispatches the revoked merge and fails NO_MERGE_WITH_INVALID_AUTHORITY:revoked-during-proof. Both are restored byte-for-byte and the complete focused set passes. Required bun run check:pr --base origin/main passes all contribution gates, 959 fast tests / 6,361 assertions, and 36 affected feedback tests / 555 assertions on the final committed head.

Eleven timed setup/proof commands cost 576.27 summed wall seconds / 475.72 process CPU seconds (user plus system, including children). Preflight contributes 220.87 wall / 224.72 CPU seconds; final focused execution contributes 54.88 / 40.20. The two short shard controls include local workspace-lease waits: 18.97/46.84 command-wall seconds versus 1.194/3.170 Bun test seconds. Queue duration was not independently instrumented; do not call all that overhead queue time. No hosted queue, execution, cancellation or main cost was incurred by this preparation. API/source inspection and the standalone dependency digest are outside the timed total; overlapping command wall times are not elapsed session time. These are local fixture and qualification costs, not live hosted coordination or a controlled CI saving. Historical run costs above and in comments keep their actual sources.

Maintainer ruling — 2026-10-18: A main refresh may merge when the exact inspected delta plausibly cannot affect the testing outcome. Preserve actual old/new identities and the relevance assessment. This does not weaken the implemented exact-candidate/authority gates or make an old receipt proof of the refreshed tree.

2026-10-20 correction: reconciled delivered squash, complete candidate proof, real reservation lifecycle and measured costs; replaced obsolete draft handoff with actual remaining main and distinct-candidate verification.

2026-10-22: reworded prose mentions of other dependencies so the declaration lines alone name this issue's blockers. No dependency changed.

2026-10-22: removed the Blocked by #2342 declaration under the maintainer ruling of 2026-10-22: #2342 is an unreproduced real-socket teardown flake, not a dependency of the controller. No other blocker remains.

Activity

  1. schlessera
    added
    type: choreTooling, CI, release plumbing, dependencies.
    area: ciCI workflows, the gates they run, release scripts, packaging.
    needs: decisionBlocked on a maintainer or designer ruling, not on code.
    on Oct 16, 2026
  2. schlessera
    added a parent issue on Oct 16, 2026

  3. schlessera commented on Oct 16, 2026

    @schlessera
    schlessera
    on Oct 16, 2026
    OwnerAuthor

    Confirmation run 38893723223 requested and actually checked out the same candidate: merge 08ee46c1eb79a0b8533ebdda446656117a0aa7c3, parents 9506026705425653a40608395aa756cae2a344b2 and head 140966ea0761f787203e3a58b0d9dc8031ec70c1, tree 0e0e632957ab336faa70a1dd039c84f2ad5247cc. Metadata explicitly recorded the matching requested base and head. Packaging, verification, native runtime, both browser shards and both layout shards completed successfully.

    Main then advanced to b67b1b84e8ceacf8f0df3aee8f23f8bf32a91703 through #2067 while other selected jobs were running. That commit changes only inherited-pipe descendant cleanup in packages/ui-server/tests/boot-probe-deadline.test.ts; the file-mask implementation is unchanged. The current exact-base gate nevertheless requires a new combined candidate. The remaining run was deliberately cancelled after observing the live-base change, before claiming any aggregate stale-base failure. Cancelled or unfinished jobs are incomplete evidence, and the completed jobs retain their original candidate identity.

    The PR is draft again. Current main is integrated locally; fresh preflight and a later coordinated confirmation turn are pending. #2111 tracks the cross-session coordination question; this receipt does not select a new protocol or weaken freshness.

  4. schlessera commented on Oct 16, 2026

    @schlessera
    schlessera
    on Oct 16, 2026
    OwnerAuthor

    Measured follow-up for run 38893723223, attempt 1: GitHub created the event at 11:25:53Z; metadata began at 11:28:04Z (131 seconds initial runner wait); cancellation completed at 11:45:04Z (1,151 seconds event elapsed). Fourteen executing category jobs consumed 6,840 job seconds between their recorded start/completion times: eight succeeded and six were cancelled. The six cancelled jobs account for 3,335 of those seconds. The aggregate never executed; its cancellation timestamps are not included in execution cost. These are GitHub job elapsed seconds, including setup/teardown, rather than CPU time or a causal comparison.

    Completed checkout logs, including metadata, runtime, browser, layout, packaging and verification, agree on 08ee46c1eb79a0b8533ebdda446656117a0aa7c3 with the original 950602670 base. The later live-main advance remains a separate freshness invalidation. No coordination mechanism or release commitment is inferred from this measurement.

  5. schlessera commented on Oct 16, 2026

    @schlessera
    schlessera
    on Oct 16, 2026
    OwnerAuthor

    Decision (maintainer, 2026-10-16): For the coordination approach, choose option C: an automated, expiring integration reservation with a visible owner and expiry.

    The reservation coordinates candidate admission and competing main merges while preserving exact head/base freshness, required selected proof and actual integrated-tree verification. This does not authorize a native GitHub merge queue, ownership migration or treating an advisory reservation check as an atomic branch lock.

    The issue body and acceptance criteria now reflect that approach. Ownership/candidate identity, start/renewal/expiry/release, competing-candidate enforcement and override handling still need rulings. Retain needs: decision and leave agent-ready absent. Implementation must update the binding CI decision and applicable contributor/agent merge procedure after those rulings are complete.

  6. schlessera commented on Oct 16, 2026

    @schlessera
    schlessera
    on Oct 16, 2026
    OwnerAuthor

    Additional #2022/#2065 receipt: run 38895995663, attempt 1, passed all fourteen selected jobs and the final candidate gate. Every actual job checkout is e3fd4e7bf030b3c50ce4edd08a0da51b56ef9c05, parents base b67b1b84e8ceacf8f0df3aee8f23f8bf32a91703 and head 4c115f70afb2a605e755c791557f1cd94a5cb686, tree 0ba17a5273d44cac3149f90cfb34ff7121ffd445. The ready-event candidate receipt names those same values. Twelve API-digest-verified archives reconcile 960 unit files exactly once, complete browser/layout/endurance discovery, and all healthy native cells. No failed selected job or aggregate stale-base failure is claimed.

    GitHub created the run at 11:46:26Z, its first job began after 23 seconds, and its last job completed at 12:12:26Z: 1,560 event-to-completion seconds. Fifteen executed jobs, including metadata and aggregate, consumed 10,195 summed job elapsed seconds. Unit shard 2 (job 116956894408) was the longest at 1,438 seconds and determined the final selected-category completion. These include setup/teardown and are neither CPU time nor a causal performance comparison. This successful run has no cancelled jobs; earlier draft/cancelled runs are separate.

    Main advanced afterward, at 12:13:51Z, through #2062 to 2e362cc12aa3d2bda38145b6da23d0ac232281b2. The final live-ref read before squash caught that change; no merge was issued. Thus the aggregate correctly passed its original candidate before the later advance. #2062 changes measured layout costs and shard harness inputs; native/product implementation is unchanged. #2065 returned to draft, integrated that base and is preparing fresh confirmation. The previous green run remains evidence only for its original combined tree; any valid retention must be established by the normal validator. This records cross-session invalidation during the final audit/merge window without selecting a new coordination mechanism or weakening freshness.

  7. schlessera commented on Oct 16, 2026

    @schlessera
    schlessera
    on Oct 16, 2026
    OwnerAuthor

    Decision (maintainer, 2026-10-16): For reservation scope, choose option A: one exact PR candidate, identified by PR, head SHA and base SHA, with a recorded responsible actor.

    A change to either head or base invalidates that reservation. The changed candidate must acquire a new reservation and request fresh candidate confirmation; it does not inherit the prior reservation or passing proof. This does not reserve an agent session, permit candidate updates within the same reservation or cover a batch.

    Updated the body and acceptance criteria. Reservation lifecycle, competing-candidate admission/enforcement and override handling remain open, so retain needs: decision.

  8. schlessera commented on Oct 16, 2026

    @schlessera
    schlessera
    on Oct 16, 2026
    OwnerAuthor

    Decision (maintainer, 2026-10-16): For lifecycle, choose option B with the proposed timings: a 5-minute lease renewed every minute, with a hard 60-minute total limit from acquisition.

    Acquire before requesting expensive candidate confirmation. Count runner queueing, proof and the final merge in the total; renewals cannot reset the cap. Release on merge, terminal proof failure/cancellation, explicit abandonment or candidate head/base invalidation. If the owner stops renewing, the lease expires after its last granted term. Expired/superseded owners cannot revive their old reservation or modify a successor's reservation.

    These timings are initial policy values, not measured optima. Updated the body and acceptance criteria. Competing-candidate admission/enforcement and maintainer override rules remain open, so retain needs: decision.

  9. schlessera commented on Oct 16, 2026

    @schlessera
    schlessera
    on Oct 16, 2026
    OwnerAuthor

    Second #2022/#2065 invalidation: renewed run 38899465213, attempt 1, was created at 12:17:16Z. Metadata requested base 2e362cc12aa3d2bda38145b6da23d0ac232281b2 and head 9c1529f88c7e07cbc15999dab74dc9d2f1510076; its actual checkout was f8b23b799c4e1f8de0d8b1a3a6bf28d86b31116a, with those exact parents and tree 27b0e5ceba79c1251cb1d2ebb9bb537aef640600. The actual checkout log precedes the next main advance; the requested base and checkout agree.

    #1997 merged at 12:17:31Z, advancing main to 3fc6fea5e22304df2810348074c32b1983fbea46. Its fourteen changed files are workflow documentation/skills, with product/runtime/test-harness inputs unchanged. The later live-ref read detected the mismatch. The run was deliberately cancelled and PR #2065 returned to draft. No aggregate stale-base failure is claimed; cancelled or unfinished categories do not qualify the new combined tree.

    Cancellation completed at 12:21:21Z, 245 seconds after the event. Fourteen actually started jobs consumed 2,025 summed job elapsed seconds; the twelve cancelled executing jobs account for 1,925 seconds. Metadata and verification succeeded. The aggregate did not execute, and no cancellation timestamp for an unexecuted aggregate is counted. These job elapsed values include setup/teardown and are not CPU consumption or a causal comparison. The original full passing run 38895995663 remains separately attributed to its earlier base.

    Further expensive confirmation is stopped pending the remaining reservation lifecycle, competing-candidate enforcement and override rulings here. #2022 records this declared dependency and a concrete resume/evidence handoff; its implementation and draft PR remain preserved. No reservation protocol or freshness exemption is inferred from the selected approach/scope rulings.

  10. schlessera commented on Oct 16, 2026

    @schlessera
    schlessera
    on Oct 16, 2026
    OwnerAuthor

    Decision (maintainer, 2026-10-16): For competing candidates, choose option A: return busy and let the caller retry with bounded backoff.

    The busy result identifies the active owner/candidate and expiry. Successful acquisition must be exclusive under concurrent requests. There is no persistent queue or guaranteed FIFO order. Nonowners may continue implementation and fast checks, but hold competing main merges and expensive candidate confirmation until acquisition.

    Updated the body and acceptance criteria. Merge enforcement and maintainer override handling remain open, so retain needs: decision.

  11. schlessera commented on Oct 16, 2026

    @schlessera
    schlessera
    on Oct 16, 2026
    OwnerAuthor

    Decision (maintainer, 2026-10-16): For merge enforcement, choose option A: a shared merge command and mandatory contributor/agent procedure.

    Immediately before merging, verify live reservation ownership, expiry/hard cap and exact PR/head/base identity alongside the existing candidate proof, live freshness and milestone requirements. Preserve actual squash parent/tree verification and automatic main-proof reconciliation afterward. Tests must reject missing, expired, superseded, wrong-owner and mismatched reservations before merge execution.

    This is cooperative enforcement under existing repository permissions. Direct API/UI merges can bypass it; it is not an atomic branch lock. No branch-protection/ruleset, required-check or merge-permission change is selected.

    Updated the body and acceptance criteria. Only maintainer override/emergency handling remains open; retain needs: decision.

  12. schlessera commented on Oct 16, 2026

    @schlessera
    schlessera
    on Oct 16, 2026
    OwnerAuthor

    Decision (maintainer, 2026-10-16): For overrides, choose option B: explicit maintainer revocation with a recorded reason.

    Record the maintainer actor, time, reason and revoked reservation/candidate. Revocation immediately invalidates the old reservation: the former owner cannot renew it, merge under it or alter a successor's reservation. A replacement candidate must acquire a new reservation and pass required confirmation. Revocation never waives proof, candidate freshness or milestone requirements.

    All six policy questions are resolved (C/A/B/A/A/B). The current issue body now includes the complete selected policy, implementation scope, acceptance criteria and verification, including the required update to docs/decisions/ci-utility.md and contributor/agent merge procedure. Remove needs: decision and add agent-ready. This records implementation readiness, not delivery or completed CI evidence; no release milestone is committed by this ruling.

  13. schlessera
    removed
    needs: decisionBlocked on a maintainer or designer ruling, not on code.
    on Oct 16, 2026

  14. 23 remaining items

  15. schlessera commented on Oct 19, 2026

    @schlessera
    schlessera
    on Oct 19, 2026
    OwnerAuthor

    2026-10-19 — parent review and live controller qualification.

    Independent review of the refreshed twelve-file contribution found no actionable defect. Local source/mutation/preflight receipts are retained at their recorded heads. Current draft gates and contract checks pass; they are not complete candidate proof. Before confirmation, live main and PR base agree on cea53611ddea4916ac323060bfef42ec18118fea, head is d11d554530d65f6e3dc96927f2e8d6210674493f, and fetched synthetic bd4388e36b1d116f7996587a768e94284f89c028 has those exact parents and tree 2b199682366c8009d60a79d3ead2c4e15b2a0bd2; local Git and immutable API agree. PR/issue both retain 0.44.0.

    Read-only inspection found the canonical coordination ref absent. Two independent real acquisition clients contended for this same candidate: exactly one succeeded, and the other exhausted its bounded retries with the actual owner/candidate/expiry. Their walls were 10.386 and 19.065 seconds (overlapping). Explicit renewal extended expiry without changing the hard cap. Audited revocation refused old-owner renewal and merge; successor acquisition then refused old-owner renewal, release and merge while preserving the successor exactly. Owned successor release succeeded and final remote state has no active lease. No ready event or merge occurred during these lifecycle controls. They prove same-candidate hosted contention and lifecycle behavior, not a demonstration using two different PR candidates, and do not replace the remaining automatic lifecycle/confirmation proof.

    Now requesting the prepared candidate through bun scripts/integrate.ts confirm 2197 --issues schlessera/brain-kit#2111. This is the product controller under qualification: it acquires a fresh exact-candidate lease, requests confirmation, renews at the selected cadence and attempts the guarded squash only after complete proof. A failure or invalidation releases ownership without an unchanged retry. Actual squash/main receipts and measured queue/execution/cancellation costs remain required, as does separately attributed different-candidate handling. #2111 remains open under Refs. Parent holds claim e1849-2111-20261019-r3; no other worker's candidate or lease was altered.

  16. schlessera commented on Oct 19, 2026

    @schlessera
    schlessera
    on Oct 19, 2026
    OwnerAuthor

    Delivered controller and remaining qualification — 2026-10-20

    PR #2197 merged through the shared controller at 1f88a7a3018fc669f0dd8d97bd36572d8b315b03 (GitHub merge time 2026-10-19 22:17:19Z). Its actual parent is cea53611ddea4916ac323060bfef42ec18118fea and tree is 2b199682366c8009d60a79d3ead2c4e15b2a0bd2, exactly matching the passing candidate. Immutable GitHub commit data and local fetched Git agree; the squash is an ancestor of origin/main. Issue and PR retain release 0.44.0. This is a Refs delivery; the issue remains open.

    Ready confirmation run 39331233256, attempt 1, passed all 17 selected jobs with no skips or retained domains. Every actual job checkout log names bd4388e36b1d116f7996587a768e94284f89c028, whose parents are the recorded base and head d11d554530d65f6e3dc96927f2e8d6210674493f. The independently inspected aggregate binds that checkout and all nine selected categories, four unit shards, three browser shards and two layout shards. Contract checks passed. Earlier cheap draft successes are not counted as confirmation.

    The real canonical reservation admits exactly one of two concurrent same-candidate clients. Explicit renewal, audited revocation, former-owner refusal and successor fencing passed before confirmation. During automatic confirmation, 21 renewal state commits retained the original hard cap. The controller verified proof, milestones and final live authority, performed the matching-head squash, checked its parent/tree/ancestry, then released its own lease. Readback at coordination commit 77b0dc4f1987c84e0ffe8b5ac59c10ba16c3ddd5 has no active owner. The owned interval was 1,321 seconds (22m01s), including confirmation and merge. The controller's exit 2 is intentional pending separate main proof, not a failed candidate or failed merge.

    Measured confirmation costs: event to first job 4 seconds; event to completed run 1,228 seconds (20m28s); summed job elapsed 10,004 seconds (166m44s); zero cancelled jobs/consumption. Longest job unit (3) took 1,127 seconds (18m47s). Per-job and per-step durations are retained. Summed concurrent job time is not CPU or elapsed critical-path time; event-to-first-job includes scheduling/startup and is not isolated runner queue time. A single window proves attributed successful coordination, not causal whole-CI savings.

    Remaining: automatic main push run 39333870950 is in progress on the exact squash. Reconcile all selected jobs, their actual checkouts, aggregate and costs when it finishes. The distinct-PR competing-candidate demonstration also remains: previous live contention used two clients for the same PR. Choose another eligible, coordinated ordinary PR when available; do not take over another worker or start a blocked candidate. Local candidate-change/refusal tests retain their existing scope. No hosted retry or proof waiver is requested.

    Parent retains coordinating claim e1849-2111-20261019-r3 during this unfinished verification; the integration reservation itself is released. Native stack-prefix support remains excluded. Earlier preparation descriptions below are historical source-attributed evidence.

  17. schlessera
    added
    blockedWaiting on another issue or an upstream dependency. Say which in the body.
    on Oct 19, 2026

  18. schlessera commented on Oct 19, 2026

    @schlessera
    schlessera
    on Oct 19, 2026
    OwnerAuthor

    2026-10-20: automatic main verification after #2197 is not green. Unit (4) job118338611982 on exact squash 1f88a7a3018fc669f0dd8d97bd36572d8b315b03 reports the real-socket handshake lifecycle-hook timeout at30,220.60ms, with three dangling processes killed. This recurrence is recorded in existing #2342; no protocol assertion or root cause is established. Candidate run39331233256 remains passed and actual squash identity remains verified. No unchanged rerun or merged-branch edit. #2111 remains open, blocked by #2342; distinct-PR contention evidence is also still required. Own coordinating claim is released at this blocked handoff. #2319 continues independently.

  19. schlessera
    removed their assignment
    on Oct 19, 2026

  20. schlessera commented on Oct 19, 2026

    @schlessera
    schlessera
    on Oct 19, 2026
    OwnerAuthor

    2026-10-20 final automatic-main reconciliation: run 39333870950, attempt 1, completed FAILURE. All 17 job logs independently identify checkout 1f88a7a3018fc669f0dd8d97bd36572d8b315b03 (tree 2b199682366c8009d60a79d3ead2c4e15b2a0bd2). Fifteen jobs passed; unit (4) failed on the recorded real-socket lifecycle timeout, and integrated/exhaustive proof correctly rejected unit: selected proof did not pass (failure). No other selected job failed, skipped or was cancelled. #2342 retains the observed timeout and unresolved cause.

    Main costs: event to first job 3 seconds; elapsed run 1,266 seconds (21m06s); summed job time 9,973 seconds (166m13s); zero cancellations. Longest job unit (3) passed in 1,210 seconds. These are actual-main execution costs, separate from the passed candidate's 1,228-second window; no controlled performance improvement is inferred. Full logs, immutable identities and per-job durations are retained. No unchanged retry was requested.

    #2111 remains open, blocked by #2342, with its claim released and release 0.44.0 retained. Distinct-PR competition qualification also remains open; the delivered controller and passed ready-candidate proof keep their exact recorded scope.

  21. schlessera commented on Oct 20, 2026

    @schlessera
    schlessera
    on Oct 20, 2026
    OwnerAuthor

    Later successful integrated-tree qualification — 2026-10-20

    Ordinary PR #2449 exercised the unchanged reservation controller delivered by #2197 through exact-candidate confirmation, verified squash and owned release. Independent source comparison confirms identical integrate.ts, integration-proof.ts and integration-reservation.ts blobs across #2197's squash, #2449's tested head and #2449's squash. The surrounding workflow/build/test inputs changed; this does not establish whole-suite equivalence with the earlier delivery.

    Confirmation 39377232609, attempt 1, passed all 17 jobs on synthetic 79b3af810f16d39792e7e35c724871379e69412b, parents 510c2909b666b37880999fc50e5759c11591db33 and 1eafd54e6256400134a4071958ebea9b4eb8ea99. The guarded squash e9bd4621486fa07ced9c2c576e03603fd7f0eba1 has the expected base parent and matching tree 14ec0d2d77cb10abfcbdaf18f33c733b961934d2. Automatic main 39379334227, attempt 1, independently passed all 17 jobs on that exact squash. All 34 actual checkout logs and both aggregates were verified: all nine categories fresh, no retained proof, four unit/three browser/two layout shards. The saved canonical readback at 228c8781f9bb7323767d329ae2c3fd9c00ba74dc records release of lease 42e30bb3c750dae8e362a59f1808863e with no active reservation.

    This establishes a complete successful ordinary-controller window on the later integrated tree. Candidate/main elapsed costs are 1,284/1,229 seconds, summed job costs 9,814/10,450 seconds, event-to-first-job 2/3 seconds, with zero cancellations. These are attributed execution costs, not causal savings. No new runtime or hosted run was needed for this source/receipt audit.

    Original main run 39333870950 remains FAILURE, with its exact source and hook-timeout receipt below. Later success neither identifies nor repairs #2342's intermittent lifecycle failure. Sequential use for a different PR also does not prove simultaneous distinct-PR contention. #2111 remains OPEN and blocked by #2342, with distinct-PR qualification still outstanding. The claim stays released and milestone 0.44.0 is retained. No original criterion is waived or historical result relabeled.

  22. schlessera
    removed
    blockedWaiting on another issue or an upstream dependency. Say which in the body.
    on Oct 22, 2026

  23. schlessera commented on Oct 22, 2026

    @schlessera
    schlessera
    on Oct 22, 2026
    OwnerAuthor

    Maintainer ruling 2026-10-22: the #2342 edge is dropped. #2342 is an unreproduced real-socket teardown flake in a test #2197 did not change, and main has been green on the same controller since. Removed Blocked by #2342 and the blocked label; no other blocker remains. The remaining criteria (distinct-PR contention evidence and the queue/execution/cancellation measurement) are unchanged.

  24. schlessera
    self-assigned this
    on Oct 22, 2026

  25. schlessera commented on Oct 22, 2026

    @schlessera
    schlessera
    on Oct 22, 2026
    OwnerAuthor

    Claim bk044-2111-evidence-20261022-c18fad2c on branch as/document-confirmation-contention is released. The requested read-only audit is handed back to the coordinator; its evidence comment remains a draft for review. No repository changes or hosted actions were requested. The coordinator retains all live reservation, readiness and merge operations.

  26. schlessera
    removed their assignment
    on Oct 22, 2026

  27. schlessera commented on Oct 22, 2026

    @schlessera
    schlessera
    on Oct 22, 2026
    OwnerAuthor

    2026-10-22 read-only qualification audit: no implementation gap remains. Acceptance criteria 2, 3, 5, 6, 7, 8 and 10 are met by the shipped controller and its recorded controls. Controller blobs are identical across #2197, #2449 and inspected main 7b8a755. Successful actual integrated-tree completion is recorded at #2111 (comment). The #2342 edge was dropped by the maintainer ruling at #2111 (comment); the original failed main outcome remains unchanged.

    Criterion 1 has observational cost receipts available through #2476 / PR #2477. Archived attempt-1 snapshots independently reproduce run 38893723223: 131 seconds request-to-first-job, 1,151 seconds until the last executed cancellation, 6,840 summed job-seconds, including 3,335 in six cancelled jobs; the never-executed aggregate is excluded. For #2449 candidate 39377232609 / main 39379334227: request-to-first-job 2/3 seconds, summed job time 9,814/10,450 seconds, zero cancellations, request-to-last-observed-job 1,283/1,228 seconds. Unit (3) determines the observed tail at 1,192/1,157 seconds; metadata-to-category-start gaps are 3-8/3-4 seconds. Historical run-completion elapsed 1,284/1,229 seconds remains separately attributed. Scheduling gaps do not isolate runner queue pressure, summed job time is not CPU time, and different-SHA observations do not establish causal savings.

    Canonical history through e156150 contains 43 acquisitions with no grant over an existing live owner. At 09:25:00Z inspect reports live #2171 lease 95e466b04e4d734aab0b54012f5951aa, head d02a570, base 7b8a755, actor 83631, acquired 09:05:44Z, expiry 09:29:54Z, hard cap 10:05:44Z. The earlier #2171 lease ff59a4c74664fa13dd5b41b8f8b86115 ran 08:34:59-08:41:11Z and released after an API-rate-limit infrastructure error, not a test failure. This is serialized ownership evidence.

    Distinct-PR contention receipt (criteria 4 and 9), 2026-10-22. While #2171's lease 95e466b04e4d734aab0b54012f5951aa was live (head d02a570df030e582d6b154294f3876a5bcf79cc1, base 7b8a755ea329bd48a11b790e916c417b6f608eee, expiry 09:31:54Z after renewal, hard cap 10:05:44Z), the coordinator ran bun scripts/integrate.ts acquire 2548 --issues schlessera/brain-kit#2380 at 09:27:22Z for distinct PR #2548 (head 04a6921887b0738b62bda53c62dfdfbcab4f759f). It made bounded retries and refused with exit 1: Integration busy: {"id":"95e466b04e4d734aab0b54012f5951aa", … "pr":2171, "head":"d02a570d…", "base":"7b8a755e…", "expires":1792661514000, "cap":1792663544000}. inspect at 09:27:31Z showed the same live owner, unchanged. The refused call published no reservation commit, consistent with the design. The #2171 window then ended in an owned release by its holder.

    Remaining gap: the refused PR's own subsequent owned acquisition never ran. The maintainer moved the 0.44.0 wave to merging on local proof, and #2548 merged as 6438852ca28f7d82e252053f20b8da9ab64d9f60 without a reservation window. Whether that last receipt is still required is a maintainer call.

  28. schlessera commented on Oct 22, 2026

    @schlessera
    schlessera
    on Oct 22, 2026
    OwnerAuthor

    Maintainer ruling 2026-10-22: the refused PR's own subsequent owned window is not required. The distinct-PR busy refusal, with exact candidate identities, live owner, expiry and an unchanged lease, is recorded at #2111 (comment), and the remaining criteria are covered by the shipped controller and the receipts linked there. Closing as delivered.

  29. schlessera
    closed this as completedon Oct 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    agent-readyContext and acceptance criteria are complete enough for an agent to take this unattended.area: ciCI workflows, the gates they run, release scripts, packaging.type: choreTooling, CI, release plumbing, dependencies.

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions