feat(kanban): wire the Done column into the automation (backend#1411)

[LukasWodka]

Closes tracebloc/backend#1411. Unblocked by #124 landing, which is what put #1412's fail-closed assertions on main — the ordering the work order requires.

Two of these were live exposure, not latent

Done was added to the board on 2026-08-01 and no code knew it existed. Two cards already sit there (backend#1262, #1371), so:

file	what it did
advance-deploy-env.ymlrank()	Done/Cancelled both returned 0, inverting the monotonic guard — so the next push carrying an old commit demoted a Done card. staging → develop back-merges re-carry old commits routinely, so this was not hypothetical.
fr-gate.ymlrank()	both fell through to "" and then to strict equality, so a single Done card blocked every prod promotion carrying it.
kanban-archive.yml	archived only Prod/Cancelled, so Done cards would never leave the board.
kanban-reconcile.yml	filed hand-closed completed issues as Prod — asserting a deployment that never happened.
kanban-closure-router.yml	set nothing at all for a hand-closed completed issue.

Verified rather than read

Both rank() functions extracted and run over the full column set, instead of eyeballing the case arms:

Backlog 1 · On dev 6 · FR on staging 7 · Ready for prod 8 · Prod 9 · Done 10 · Cancelled 10 · unknown 0/""

10 > 9 is what makes them terminal: nothing can demote them, and fr-gate's "Ready for prod (8) or later" is now satisfied rather than blocked.

The router change, and why its old objection no longer holds

The router previously left a hand-closed completed issue alone, with the comment "Do not invent a deploy state here." That was right — and it is precisely why Done is the correct answer now: Done is not a deploy state. It means completed with nothing deployed, which is exactly what a hand-closed issue is.

Doing it on the close event rather than delegating to kanban-reconcile's cron makes the card terminal immediately. Reconcile stays as the backstop for anything the event misses, and its own rule changes from Prod to Done for the same reason.

Semantics throughout are RFC-BACKEND-1405 D8: Prod = something deployed · Done = completed but nothing deployed · Cancelled = not planned.

Ordering

Deliberately after#1412, which #124 promoted to main. The work order sequences it that way because arming those fail-closed assertions after wiring Done would enlarge the mutation population on the first run and turn a warning into a red cron. With #1412 already live, this lands against armed guards.

Note for the reviewer

This repo has no test harness, so actionlint and check are the only automated verification — hence the manual rank extraction above. Worth knowing that the epic's own #1415 would be the place to change that; four of the five files touched here have had a defect found by review rather than by CI.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes board Status mutations and prod FR-gate behavior across five workflows; mis-routing could hide cards (archive) or leave closed issues in wrong columns, though deploy-column guards and unreadable-closer handling reduce that risk.

Overview
Wires the Done column into engineer-kanban automation per RFC-BACKEND-1405 D8 (completed, nothing deployed vs Prod).

rank() in advance-deploy-env.yml and fr-gate.yml now maps Done and Cancelled to 10 (above Prod). Previously they ranked as 0 or unknown, which could demote Done cards on back-merge pushes and block prod promotions that carried a Done card.

kanban-archive.yml archives Done alongside Prod/Cancelled so terminal hand-completed work leaves the board.

kanban-closure-router.yml sets hand-closed completed issues to Done immediately (not left for reconcile). Adds PROJECTS_KANBAN_TOKEN to the closer GraphQL step so PR-based routing actually runs. Distinguishes lookup errors from no closer so transient failures do not incorrectly set Done (and get archived). Skips setting Done when the card is already in a deploy column (On dev through Prod).

kanban-reconcile.yml terminalizes closed-completed issues to Done instead of Prod, with the same deploy-column skip as the router.

^{Reviewed by Cursor Bugbot for commit 1832db6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

Both fixed, and both were mine — same root cause

Each finding is a consequence of putting Done where "leave it alone" used to be. That is the interesting part: neither site was wrong before this PR, and neither diff looks wrong in isolation.

Closer lookup failure sets Done (High) — the sharpest of the two. The lookup mapped any GraphQL or transport failure to NONE, which was harmless while NONE meant "leave Status unchanged". Now NONE means Done, so a transient API error on a PR-closed issue moves it to Done — and kanban-archive, which this same PR taught to archive Done, hides it the next day. I converted a fail-open default into a fail-wrong one, which is worse than either.

ERROR is now distinct from NONE, and the closer type is checked against an allowlist so an empty or unexpected read also leaves Status alone with a warning. Verified by extracting the decision and running every input rather than reading the branches:

closer	base	→
PullRequest	main	Prod
PullRequest	develop	On dev
Commit	–	On dev
NONE	–	Done
ERROR	–	unchanged
(empty)	–	unchanged

Reconcile Done ignores closing PRs (Medium) — also right. Blanket Done labelled deployed work as "completed, nothing deployed" and overwrote what the router had correctly set. Only a card with no deploy state qualifies now.

A D8 conflict this surfaces, which I have not resolved

Skipping deploy-column cards leaves a closed card in a non-terminal column — which D8's third invariant explicitly forbids ("no closed item may sit in a non-terminal column"), while D8's own routing table says "closed completed, closed by a PR merged to develop/staging → follow the PR's stage".

Those two rules genuinely conflict for work that shipped to dev or staging and then stopped. There is no reading of D8 that satisfies both. I have chosen the option that does not assert something false, logged the skip, and raised it on backend#1411 rather than picking a winner in a workflow file. It wants a decision, and it is the same open question the RFC lists as unsettled.

[LukasWodka]

Fixed — and this is the asymmetry my previous fix created

Correct, and the finding is sharper than it looks: your last review made me add the deploy-column guard to kanban-reconcile.yml, and I did not apply it to the router. Two files, same rule, disagreeing — and the router is the one that fires on the close event, so it wins the race.

The path is real: reopen, then hand-close an issue sitting in On dev / FR on staging / Ready for prod → the deploy state is overwritten → kanban-archive.yml, which this PR taught to archive Done, hides the card the next day.

The item lookup now also reads the card's current Status, and Done is refused when that Status records a deployment. Only Done is guarded — a PR-derived Status is a deploy fact and may advance a card normally:

setting	current column	outcome
Done	On dev / FR on staging / Ready for prod / Prod	skip, notice, exit 0
Done	anything else, or unknown	apply
Prod / On dev / FR on staging (from a PR)	any	apply

Verified by extracting the guard and running the table, not by reading the case arm.

The pattern across all three findings on this PR

Every one is the same shape, and none of them is in a line this PR set out to change:

1. an error handler that meant "change nothing" and now means "assert Done"
2. a reconcile path that meant "terminalise everything" and now mislabels deployed work
3. a router path that meant "change nothing" and now overwrites a deploy state

Introducing a new terminal value into a state machine means every path that previously ended in "leave it alone" has to be re-examined — including the ones in files the diff doesn't touch. I checked the five sites the ticket named and not the paths that reach them. That is the actual lesson from #1411, and it is worth more than the change itself.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a19d5cb. Configure here.}