ci: add an always-run roll-up job named `CI` so the queue's required check matches a real check run (#9283 Option A implementation)

[os-zhuang]

Implements the maintainer's #9283 ruling (Option A — the full suite SHOULD block the merge queue), after the first implementation attempt froze the queue for ~1h45m on 2026-08-17 (~11:30–13:15Z). Full incident record: #9283 comment.

What happened

The required check was registered as CI — the workflow name. Required status checks match check-run (job) names, and no job in ci.yml reports a check named CI, so the context was permanently "Expected": green merge groups timed out, nothing merged from 11:29Z until the maintainer removed the entry (~13:15Z). The failure mode flipped from #9283's "red merges anyway" to "green cannot merge".

Current interim posture (maintainer-set, 2026-08-17)

Required checks include the two existing aggregates Test Core (test-gate) and Dogfood Regression Gate (dogfood-gate). Four gate jobs have no aggregate covering them and are currently not required: Temporal Conformance (live PG + MySQL) — the exact job whose failure merged in #9283 — plus Build Core, Build Docs, Console Pin Gate. The PM has recommended adding those four names in settings as interim protection; this card is the durable fix.

The work

Add one roll-up job to .github/workflows/ci.yml:

• Job name: CI — the literal string, chosen so the queue's required context has one stable name that survives job renames (the [Decision] The merge queue merged a group whose full-suite CI run concluded FAILURE — measured on 77da09bac, now on main #9283 hazard class).
• needs: every gate job of the workflow: test-gate, dogfood-gate, temporal-conformance, build-core, build-docs, console-pin (re-derive the list from the file at implementation time, do not trust this card).
• if: always() — must run when needed jobs are skipped by the path filter (skips count as pass) and must fail when any needed job has failure or cancelled (read needs.*.result explicitly; do not rely on default propagation, which would skip the roll-up instead of failing it).
• Runs on both pull_request and merge_group (both already trigger the workflow).
• Runner cost: one ubuntu-latest no-op-shaped job per run — seconds.

Acceptance

1. On a docs-only PR: CI reports success (all needed jobs skipped).
2. On a PR with a failing needed job: CI reports failure.
3. Job name is exactly CI in the check-run list.

Explicitly out of scope / sequencing

• ⛔ This PR must merge through the queue before the settings change. After it lands, the maintainer (settings surface, not an agent) re-adds CI to the required checks — at that point the per-job interim entries (and even Test Core / Dogfood Regression Gate) can be pruned to the single CI entry.
• ⛔ No changes to any other workflow, and no change to what the filter job skips.
• Related: [Decision] The merge queue merged a group whose full-suite CI run concluded FAILURE — measured on 77da09bac, now on main #9283 (the ruling and both incidents), feat(docs-audit): anchor a docs page on the CLI command phrase a change implements #9290 (real Temporal Conformance failure correctly held out of the queue, needs its own triage).

[os-zhuang]

Claim: PM seat dispatch
Session: session_01NYgmGheCzM6NrHZN436Cxf
Branch: claude/issue-9318-ci-rollup-job
File surface: .github/workflows/ci.yml ONLY — one roll-up job appended; ⛔ no other workflow, no filter behavior change, no settings (the required-checks edit is the maintainer's, after this lands).
Routing authority: implements #9283's recorded maintainer ruling (Option A); the roll-up-job approach and its sequencing were reported to the maintainer in-session during the 2026-08-17 queue-freeze incident and the interim per-job posture was set by the maintainer directly.
Tier: to be derived by the implementer via node scripts/pm/dispatch-gates.mjs --tier on the changed path — the derivation output goes in the PR body, floor never clearance.

Label pm:queue → pm:dispatched in the same stroke.

---

Generated by Claude Code

[os-zhuang]

{
 "issue": 9318,
 "status": "done",
 "branch": "claude/issue-9318-ci-rollup-job",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/9346",
 "premise_still_valid": true,
 "summary": "Appended job `ci-rollup` / `name: CI` to .github/workflows/ci.yml — `if: always()`, `needs:` re-derived from the file as [filter, test-gate, dogfood-gate, temporal-conformance, build-core, build-docs, console-pin], with the verdict computed explicitly from needs.*.result over toJSON(needs) (success/skipped pass; failure/cancelled fail; an unrecognised runner lifecycle value such as #6082's `abandoned` fails closed; an empty needs context fails per #4690). The sharded matrices (test, dogfood, dogfood-verify) are deliberately NOT in needs: their verdicts arrive through the aggregate gates, which count per-shard attestations rather than reading the one aggregate word #6082 measured failing in both directions. `filter` IS in the failure logic — if it fails, every downstream `if:` evaluates against empty outputs (#4928), so the run's shape was never chosen; that reasoning is stated in the PR. Second file, outside the card's declared surface and named in the PR with its evidence: one registry row in scripts/check-required-contexts.mjs pinning ci.yml:ci-rollup → 'CI', so the most load-bearing check name in the repo is not the only required context with no rename protection (#6865). Triggers, the filter job, other workflows and all repository settings untouched; the maintainer's re-add of `CI` to the required set is called out in the PR as the step that follows this merge.",
 "tests": "All commands in the worktree; union re-run AFTER the final commit at git rev-parse --short HEAD = 9b207e0 (quoted in the PR body too). Gate families derived, not recalled: `node scripts/pm/dispatch-gates.mjs .github/workflows/ci.yml scripts/check-required-contexts.mjs` → check:node-version, check:required-contexts, check:shard-attestation, check:workflow-status-functions, node scripts/check-shard-attestation.mjs; re-deriving against BOTH actual changed paths added nothing over the single-path derivation. Union output: '✓ check-required-contexts --self-test: 55 assertions' / '✓ check-required-contexts: 10 required context name(s) pinned across 3 workflow(s).' incl. new row 'ci.yml:ci-rollup → CI'; '✓ check-shard-attestation --self-test: 92 assertions' / '✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).'; 'check-workflow-status-functions: OK (scanned 25 workflow file(s), 45 job(s), 25 job-level if: expression(s); 9 read needs.*.outputs.*, all naming a status function).'; 'check-node-version: OK (28 setup-node step(s) across 25 workflow(s), all on Node 22).'; 'check-nul-bytes: OK (scanned 6076 text file(s) ... no raw ASCII control bytes).'; eslint scripts/check-required-contexts.mjs clean. YAML validated by real parse (repo's `yaml` dep): 11 jobs, ci-rollup name \"CI\", if \"always()\", every needs entry resolves to a real job key, no strategy/matrix, no continue-on-error. REVERSE VERIFICATION of the pin, run from the COMMITTED state, predicted red and observed red: renaming the job to 'CI Roll-up' ⇒ '✗ check-required-contexts — 1 problem(s) • ci.yml: job ci-rollup is named \"CI Roll-up\", but branch protection requires the context CI. The name IS the contract…'; restored with `git checkout <branch> -- <path>` and confirmed byte-identical to HEAD (`git diff HEAD --exit-code` clean), gate green again. BEHAVIOUR: the step's real `run:` text was lifted out of the parsed ci.yml (never retyped) and executed under bash against synthetic needs contexts — 8/8 scenarios as predicted: all-green→0; docs-only PR with core gates skipped→0 (acceptance 1); every gate skipped→0; temporal-conformance failure→1 (acceptance 2, the #9283 job); a gate cancelled→1; filter itself failed→1; `abandoned`→1; empty needs→1. Acceptance 3 (name exactly `CI`) is now machine-pinned by check:required-contexts. No ablation-on-dist leg exists for this card — nothing here resolves through a package's dist/, so that clause has no meaningful artifact to report. skip-changeset handled the repo's real way (the label, per pr-automation.yml's changeset-check exemption): read-before-write union ['ci/cd','skip-changeset'] and READ BACK — PR 9346 now reports labels ['ci/cd','skip-changeset'], still draft. CI status at report time: in_progress (reporting at draft-PR time per contract; the convergence wait is the PM's).",
 "open_questions": [
 {
 "question": "Should the `CI` row in scripts/check-required-contexts.mjs land in THIS PR, ahead of the maintainer's settings change? It is the one file outside the claim's declared surface (surface amended by a follow-up comment on this issue).",
 "options": [
 "A — keep the row (as pushed): the pin is live from day one, so a later rename of the roll-up fails in the ESLint job instead of silently detaching branch protection. The registry's own header licenses an inert row ('adding a row here does NOT make a context required … merely inert, never wrong'), and the `authorized` field states the sequencing in full. Cost: for the window between merge and the settings change, the registry names a context the settings do not yet reference.",
 "B — drop the hunk, land ci.yml alone, add the row after the maintainer re-adds `CI` to the required set: the registry then only ever describes the real settings. Cost: the single most load-bearing check name in the repo has zero repo-side rename protection during exactly the window in which people are touching it, and adding it later needs a second PR nobody is currently holding."
 ],
 "recommendation": "A, because the hazard the pin exists for (#6865: a rename silently detaching a required context) is live the moment this job exists, whereas the cost of B's ordering purity is a gap in protection during the riskiest window — and the registry explicitly documents the inert-row state as correct. Dropping the hunk is a clean one-file revert if the PM prefers strict settings-first ordering; ci.yml stands alone without it."
 },
 {
 "question": "`cancelled` is treated as FAIL here, per the card, which diverges from the shard gates' treatment (#3668 passes `cancelled`). Flagging it because the divergence is deliberate and worth a reviewer's eye rather than a silent inheritance.",
 "options": [
 "A — fail on cancelled (as implemented, and as the card specifies): a cancelled gate never reached a verdict, and on a merge_group build it means the queue build was dropped.",
 "B — pass on cancelled, mirroring #3668: avoids a red on a SHA superseded by a newer push."
 ],
 "recommendation": "A — the card is explicit, and B's cost is real while A's is not: a superseded SHA's red is harmless because a newer run publishes newer contexts on the newer SHA, whereas a green `CI` over a gate that never concluded is exactly what #9283 was about. Reasoning recorded in the ci.yml comment block so it is not re-litigated from memory."
 }
 ],
 "out_of_scope_findings": []
}

Notes the JSON cannot carry:

• Attribution footer form. The dispatch prompt asked for the bare _Generated by [Claude Code](https://claude.ai/code)_; the standing contract requires the session-URL form, because the bare form is stripped from a PR body on every later edit. Contract followed, conflict recorded here rather than chosen silently.
• File-surface amendment. The claim declared .github/workflows/ci.yml ONLY. The PR also touches scripts/check-required-contexts.mjs (one registry row) — amended by a separate comment on this issue the same round, and named with its evidence in the PR body. It meets the bounded in-place exemption on all four conditions: same defect class (the required-check-name contract), mechanical with the form already pinned by nine sibling rows, no other open claim on that file (searched), and no new gate family (check:required-contexts was already in this card's derived set).
• No out-of-scope findings. Nothing unrelated was tripped over; no new issues filed.

---

Generated by Claude Code

---

Generated by Claude Code

[os-zhuang]

File-surface amendment (same round, so the serialization list stays accurate for parallel agents)

Session: session_01NYgmGheCzM6NrHZN436Cxf · Branch: claude/issue-9318-ci-rollup-job · PR: #9346

Declared surface was .github/workflows/ci.yml ONLY. Amended to:

1. .github/workflows/ci.yml — the roll-up job, as claimed.
2. scripts/check-required-contexts.mjs — one added registry row, ci.yml:ci-rollup → 'CI'. No logic touched.

Why the second file is in scope rather than a separate card:

• Same defect class. The pin (finding: lint.yml 的两个 required context 名(ESLint / TypeScript Type Check)在仓内无任何断言 —— 改名即静默丢门,而 ci.yml 的同类名字有 check:shard-attestation 守着 #6865) exists so a job rename cannot silently detach a branch-protection-required context. This card creates the context whose name is about to be the single most load-bearing string in the repo; leaving it unregistered would make CI the only required context with no repo-side rename protection — the exact hazard, on the exact name.
• Mechanical, form already pinned. Nine sibling rows fix the shape; the row adds workflow/job/context/authorized/carries and nothing else.
• No competing claim on that file (searched open PRs).
• No new gate family. check:required-contexts was already in this card's derived set (node scripts/pm/dispatch-gates.mjs .github/workflows/ci.yml), and re-deriving against both changed paths added nothing.

Sequencing is unchanged and stated in the row's own comment: the row is inert until the maintainer re-adds CI to the required set after this merges — which this registry's header explicitly licenses ("adding a row here does NOT make a context required … a pin that is merely inert, never wrong").

Reviewer's option, recorded in the report as open question 1: dropping this hunk leaves the workflow change fully functional and costs only the rename protection.

---

Generated by Claude Code

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling — roll-up job not needed; card closed. Maintainer, 2026-08-17, on PR #9346, verbatim:

应该不需要，已经改过设置了

The maintainer closed PR #9346 unmerged: the required-checks settings have already been corrected directly (per-job check names), which is the maintainer's chosen final posture for #9283 Option A — not an interim one. The settings surface is the maintainer's; ruling recorded, not re-litigated.

What this posture retains and what it forgoes, for the record:

• Rename protection still exists. The per-job required contexts (e.g. Temporal Conformance (live PG + MySQL)) are already pinned by scripts/check-required-contexts.mjs (finding: lint.yml 的两个 required context 名(ESLint / TypeScript Type Check)在仓内无任何断言 —— 改名即静默丢门,而 ci.yml 的同类名字有 check:shard-attestation 守着 #6865), so a job rename fails a repo-side gate rather than silently detaching branch protection. The roll-up was not needed for this.
• What is forgone: single-name convenience — each future gate job added to ci.yml must also be added to the required-checks settings by hand, and the settings roster is the one artifact no repo-side gate can reconcile against the workflow (the API is 403 to agents). That is the reopen condition for this card: if a future gate job lands and is discovered missing from the required set (a [Decision] The merge queue merged a group whose full-suite CI run concluded FAILURE — measured on 77da09bac, now on main #9283-shape escape), this card's roll-up design is the durable fix — reopen or re-file citing this closure.

PR #9346 closed unmerged; branch claude/issue-9318-ci-rollup-job left in place. Closing as not planned.

---

Generated by Claude Code

[os-zhuang]

此任务作废，已经改过设置了