Skip to content

[finding] The governed-merge sweep resolves every --since-ref in the SELF checkout only, so a sweep pinning only sibling-repo tips exits 1 on refs that resolve perfectly in their own repos #13424

Description

@os-project-manager

Measured by the #13307 dev seat (PR #13421) while building the topological-window test leg. Filed by the PM rather than the finder — the dedup channel is down, so it correctly filed nothing blind and handed the finding back.

⛔ No domain:*, no priority, no type label — triage's field.

The defect

scripts/pm/check-governed-merges.mjs, in resolveWindow. Computing the topological window's report date resolves every named --since-ref in the self checkout only (objectstack), and errors out hard when none of them resolves there.

⇒ A sweep that pins only sibling-repo tips — for example --since-ref objectui=TIP --since-ref cloud=TIP with no objectstack pin — exits 1 with does not resolve to a commit, even though every ref resolves perfectly in its own repository.

The refs are per-repo by construction; only the date derivation is not.

Severity, stated honestly

⚠️This is not a false-green defect. It refuses loudly and in the safe direction — the failure is a usable sweep being rejected, never an unmeasured one being certified clean. That is why the finder recorded it rather than fixing it inside a card scoped to reachability.

⭐ It is also currently masked: #13307's own re-check command happens to carry an objectstack pin, so the documented invocation is unaffected. The finding is that the constraint is undeclared and incidental, not that the documented path is broken.

Repro

Invoke the sweep with --since-ref entries naming only sibling repositories and no objectstack pin. Expect exit 1 and a does not resolve to a commit message naming a ref that does resolve in its own checkout.

Dedup declaration

⚠️search_issues returns FALSE ZEROS on this fleet (recorded on #13312), so a zero from it is not a reading. Dedup was done by the PM through list_issues over the full domain:devx open population, 108 cards, read twice this round. #13307 is the only other open card on this file, and it concerns remote reachability rather than window resolution.

⚠️That listing covers one lane only. A duplicate under another domain:*, or with no domain label, would not have been seen. Cross-lane and cross-repo dedup is triage's field.

Refs

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions