fix(kanban): "no ClosedEvent" is not a hand-close (backend#1411)

[LukasWodka]

Bugbot found this on #127 (High), after the promotion's head advanced to f7a50e8. It is real, and it is the same mistake as its earlier finding on #126 — one level further in, on the success path this time.

Five answers, one token

The closer lookup's --jq collapsed five distinct situations into NONE, and NONE now means Done, which kanban-archive hides the next day. Verified by running the old filter against each response shape:

response	old filter
ClosedEvent present, closer: null — genuinely hand-closed	NONE|
no ClosedEvent at all (nodes: [])	NONE|
nodes: null	NONE|
issue: null	NONE|
repository: null	NONE|

Only the first is evidence of a hand-close. The rest are absence of evidence, and any one of them happening once — a close-event race, a null read — terminalizes shipped work and then archives it.

Command failure was already separated out as ERROR by #128. This is the identical hazard inside the responses that succeed.

The filter answers three ways now

if $e == null then "NOEVENT|" else <typename>|<baseRef> end

Neither decision needed changing. Both shells already fail closed on an unrecognised token, so NOEVENT lands where it belongs on its own:

kanban-closure-router	not in the PullRequest|Commit|NONE allowlist → UNREADABLE → Status unchanged
kanban-reconcile	no NONE / PullRequest / Commit arm matches → SKIP, no Done asserted

That is the allowlist doing the job it was written for. The only behaviour change is that a no-evidence read stops masquerading as a hand-close.

Two log lines that would now lie

reconcile called NOEVENT a failed lookup when the read succeeded and simply found nothing; the router's warning said "could not read the closer" for a case where it read fine. NOEVENT gets its own message, and the router's now says "could not confirm".

Verified by running it, not by reading it

Extracted both decision blocks verbatim from the workflows and pushed every token through them under bash -e:

jq filter	9 response shapes, including last-event-wins → correct token each
router	PR→develop/staging/main → On dev/FR on staging/Prod; Commit → On dev; NONE → Done; NOEVENT/ERROR/empty → unchanged + warning
reconcile	NONE → Done; PR/Commit → stage derived; NOEVENT/ERROR → SKIP
actionlint	clean on both files

Touches only the two kanban workflows, so it does not overlap #132 (repo-inventory.yml).

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes only CI workflow shell/jq logic for kanban status routing, but wrong classification still affects which issues get Done/archived versus left unchanged.

Overview
Fixes a fail-wrong path in kanban issue-close routing: the GraphQL closer --jq filter used to emit NONE for both a real hand-close (ClosedEvent with closer: null) and several “no evidence” shapes (empty timeline, null nodes, missing issue/repo). With NONE now mapping to Done (and Done archiving), those ambiguous reads could wrongly terminalize and hide shipped work.

Both kanban-closure-router and kanban-reconcile now return NOEVENT| when there is no ClosedEvent on the timeline; only a present event with a null closer stays NONE. NOEVENT is treated as unreadable in the router (status unchanged + warning) and explicitly skipped in reconcile (no Done move). Router warning text is tightened from “could not read” to “could not confirm” the closer.

^{Reviewed by Cursor Bugbot for commit 35ef161. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 35ef161. Configure here.}