Skip to content

release-train: develop -> staging - #334

Merged
tracebloc-release-train[bot] merged 3 commits into
stagingfrom
release-train/to-staging
Aug 25, 2026
Merged

release-train: develop -> staging#334
tracebloc-release-train[bot] merged 3 commits into
stagingfrom
release-train/to-staging

Conversation

@LukasWodka

@LukasWodkaLukasWodka commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Automated promotion by the release train (RFC-0008 D14). Head is the train-managed release-train/to-staging branch (a mirror of develop), so it never collides with a human PR. Merged only when the fr-gate is green.


Note

Medium Risk
Changes the required conformance contract for multiple repos and branch protection assertions; misalignment would block merges via caller-drift/conformance-gate, but the edits track remediations rather than new policy.

Overview
Updates repo-inventory.yml so the org conformance contract matches measured GitHub reality after recent caller and protection work (backend#2498, .github#332/.github#335).

New repo: Adds a full design-system-v2 entry once the repo had a branch to audit, fixing “active in org but missing from inventory” during live-fleet caller-drift.

Caller flips:rfcs and claude-skills mark code-quality.yml as required (callers on the audit branch). claude-skills arms bugbot-gate.yml as the first org pilot and exempts fr-gate.yml because there is no promotion pipeline and the caller is absent—avoiding a permanently red required row.

Protection:rfcs/develop moves from unprotected exemption to required baseline (quality checks now armed). rfcs/main and claude-skills/main comments are corrected so empty required_checks are justified by measured state, not stale “no code-quality producer” text.

Shared anchors:bugbot_gate_rollout_pending and code_quality_caller_missing drop hand-maintained repo counts and point reviewers at anchored grep to derive who still cites each exemption.

Reviewed by Cursor Bugbot for commit 7202700. Bugbot is set up for automated code reviews on this repo. Configure here.

…h them (#332)
* fix(2498): rfcs' two stale exemptions, and the reason that rotted with them
`caller-drift` reported 2 findings on the prod mirror .github#318, both on
`rfcs`, and both the same shape as the ones fixed on 2026-08-24: the fleet moved
and `repo-inventory.yml` did not.
* `code-quality.yml` was `exempt: *code_quality_caller_missing`, and the caller
is NOT missing -- `code-quality-caller.yml` is on `rfcs/main`, which is the
branch this guard reads for a `release_train: false` repo. Measured, because
the branch decides the answer: it is NOT on `develop`, so checking the wrong
ref reads the opposite way.
* `protection.develop` was `exempt: *develop_unprotected_non_train`, whose text
says `develop` "carries no branch protection". Measured today it matches the
develop baseline on EVERY key -- classic_protection, min_reviews 1,
bypass_reviews [], strict false, force-push and deletion blocks,
conversation resolution, and exactly the three `quality / *` contexts -- so
it is `required` with no `divergent` cell. `enforce_admins` is false and the
baseline does not assert it on develop (backend#1276 D1), which is
conformant rather than divergent.
That second one is the anchor's own warning coming true. Its text says a
`develop` created and left UNPROTECTED "is not flagged ... no check was going to
surface it" -- and none did. The row went stale silently and only the promotion
audit caught it.
AND THE THIRD EDIT, which no finding asked for. The `prod` divergent cell drops
the three `quality / *` contexts "BECAUSE the producer is absent". Flipping the
caller row makes that sentence false, so it is corrected here rather than left
behind a fixed field. The cell itself stays `[]` -- that IS the measured state,
`rfcs/main` requires ZERO contexts -- so only the justification had rotted, which
is exactly the failure backend#2449 added the citation guard for, one field over.
Left as a named open question rather than decided quietly: now that the caller
exists and reports those contexts on every `rfcs` PR, `main` COULD require them.
That is a protection change, not an inventory correction.
Verified: `caller-drift-selftest.py` 197 pass / 0 fail, and a live audit against
the whole org now reports "No drift. Every repo read, every entry matched."
Closes #2498
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(2498): stop asserting a citation count that has now rotted twice
Bugbot, and saadqbal reviewing .github#332.
The `code_quality_caller_missing` anchor said "Down to THREE citations
(claude-skills, release-train, rfcs)". Flipping `rfcs` to `required` leaves TWO
-- claude-skills and release-train -- so the count and the named list are false
the moment this PR merges.
THE FIX IS TO DELETE THE TALLY, NOT TO DECREMENT IT. That sentence has now been
wrong twice in the same way: it previously said THREE and named
claude-skills/docs/release-train while FOUR entries pointed at the anchor, and it
says THREE and names `rfcs` after this PR removes it. Its own last line already
told the reader to trust `grep -n` over the sentence -- and the list outlived the
advice. Nothing checks a prose count: `reason-citations.py` verifies that an
issue cited in a reason is still OPEN, not that a tally is still right.
So the roster is derived, and the grep that derives it is written down. The
remediation history stays, because that is measurement rather than a tally --
model-zoo/start-training (backend#1420), docs, and now rfcs (backend#2498), each
having gone stale the same way.
A PR whose thesis is "stale prose rots silently" should not ship new stale prose
in the file it is fixing, which is saadqbal's point and it is a fair one.
AND THE OPEN QUESTION IS NOW A TICKET (backend#2501), not a comment. Naming it in
this file is the same mechanism that just failed; a cited issue is at least
checkable by `reason-citations.py`. The comment now points at it.
Verified: caller-drift-selftest 197/0, reason-citations clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(2498): anchor the derivation, which over-counted exactly what it replaced
saadqbal and Bugbot on .github#332, and the defect is the one this hunk was
written to remove.
The anchor now tells a reader to derive the roster with
grep -n "exempt: *code_quality_caller_missing" repo-inventory.yml
and run verbatim that returns FOUR lines: two real aliases (claude-skills,
release-train) and two COMMENTS that mention the anchor by name. So the
prescribed derivation over-counts by exactly the two entries just removed from
the sentence, and a reader following it lands back on "three or four" -- which is
where this sentence started.
Anchored to value position at line start, it returns 2:
grep -nE '^\s*exempt: \*code_quality_caller_missing\s*$' repo-inventory.yml
The class is worth naming, because saadqbal counts this as the fifth instance
today of a check or instruction that greps source text and cannot tell code from
commentary (client#808, e2e-test-agent#233 twice, tracebloc-engine#732, this).
A derivation is only better than a tally if it derives the right set.
Verified on this head: unanchored 4, anchored 2. Selftest 197/0, reason-citations
clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(2498): enter design-system-v2, the repo that appeared mid-review
The `audit` failure on this PR was never about this PR's diff.
`tracebloc/design-system-v2` was created 2026-08-25 11:35, WHILE this was in
review, and `caller-drift` went red on
design-system-v2: active in tracebloc but absent from repo-inventory.yml
That is backend#2498's second half in one sentence: the audit reads the LIVE
FLEET rather than the diff, so `.github` can only merge at an instant when every
repo in the org is conformant -- and the org does not hold still.
IT COULD NOT BE ENTERED WHEN IT FIRST APPEARED, which is why this took two
attempts and one revert. While the repo was empty the guard refused to audit it
at all ("An empty repo is a legitimate state, but it is not one this guard can
audit"), so adding an entry only moved the finding from `absent from
repo-inventory.yml` to `repo has no branches`. Neither is fixable from this file.
The entry became possible only once the repo got its first branch -- the right
order, since the inventory records measured reality and there was nothing to
measure.
Measured on `develop`, its DEFAULT and only branch: private, unprotected, no
`staging` and no `main`, ten org callers present (version-bump-gate,
advance-deploy-env, code-quality, customer-priority-bump, fr-gate, stale-backlog,
fr-pass-comment, kanban-closure-router, set-pr-status, plus the add-to-kanban
copy), the three unrolled-out ones absent, and both quality files present.
Verified: live org audit now reports "No drift. Every repo read, every entry
matched." Selftest 197/0, reason-citations clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@LukasWodka

Copy link
Copy Markdown
ContributorAuthor

bugbot run

@tracebloc-release-traintracebloc-release-trainBot added the gate-nudge Toggled by the release train to (re-)fire the fr-gate label Aug 25, 2026
Comment threadrepo-inventory.yml
@tracebloc-release-traintracebloc-release-trainBot removed the gate-nudge Toggled by the release train to (re-)fire the fr-gate label Aug 25, 2026
@LukasWodka

Copy link
Copy Markdown
ContributorAuthor

Promoted with 1 open Medium/Low Bugbot finding(s), per the severity policy in release-train's README (High stops the line; Medium/Low are recorded and ship, at both hops):

New repo structural cells disagree

This is a second look at once-reviewed code -- it passed per-feature review on the source branch, and has NOT had functional review yet (that happens on staging). Fix forward on develop if any is real.

What the train did with each:

LukasWodkaand others added 2 commits August 25, 2026 17:24
…y so (backend#2284) (#333)
claude-skills#36 merged at 13:46, putting the first bugbot-gate caller
anywhere in the org onto claude-skills/develop. That makes its exempt row
stale (caller-drift.py:2309) and falsifies the anchor in the same move.
The anchor claimed "bugbot-gate has ZERO callers anywhere in the org".
True when written on 2026-08-23, false from 13:46 today -- the reason
rotted at the moment the thing it described changed, which is the shape
backend#2449 exists for.
Its replacement derivation is anchored (backend#2507): the bare identifier
also matches the paragraph describing it, so an unanchored grep would
count its own documentation.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
…quired (#335)
* fix(inventory): claude-skills' code-quality caller, and the reason it falsifies
REBASED ONTO develop AND NARROWED. This branch originally also flipped
`claude-skills`' `bugbot-gate.yml` row and re-measured the
`bugbot_gate_rollout_pending` anchor. .github#333 (backend#2284) landed both while
this was open, and did the anchor better -- it names `claude-skills#36` as the
first caller. Those edits are dropped rather than merged: two PRs asserting the
same fact in different words is how the next reader learns to distrust both.
What is left is the half #333 did not cover, confirmed by running the audit
against current develop:
1 drift finding(s):
- claude-skills: code-quality.yml is marked `exempt` but a caller exists
So:
1. Flip that row to `required`. `code-quality-caller.yml` is present in
`tracebloc/claude-skills/.github/workflows`.
2. Fix the reason the flip falsifies. `claude-skills` prod `required_checks` said
the three `quality / *` contexts are dropped "BECAUSE the producer is absent",
citing the very exemption being removed. The measured reason is narrower:
`claude-skills/main` carries no required status checks at all (classic
protection, empty `contexts`, measured 2026-08-25), because it is non-train
infra whose `main` is a working branch. `required_checks: []` was and stays
correct; only its cause was wrong.
`release-train` carries the SAME wording and keeps it -- verified it has no
code-quality caller, so its producer really is absent. One comment became
false; the other did not.
`caller-drift.py` against the live org: 1 finding before, "No drift. Every repo
read, every entry matched." after.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(inventory): the anchor's own counts, falsified by this PR's flip
Bugbot Medium on .github#335, and correct. Removing the `claude-skills` alias
made the `code_quality_caller_missing` anchor's own prose false:
said: FOUR lines -- two real aliases and two comments
measured: THREE lines -- ONE real alias (release-train) and two comments
Both numbers re-measured and stated, plus the remediation history extended with
`claude-skills` (2026-08-25, .github#335, caller added by claude-skills#36) --
the thread flagged that omission too.
The anchor stays rather than being deleted: `release-train`'s citation is
genuine, verified again here (no code-quality caller in its workflows).
WHY THIS KEEPS RECURRING, since this is the third time in one PR that a flip
falsified a sentence. A count written into prose is falsified by the NEXT flip,
every time -- this anchor's text already carried that scar ("A reader following
it lands back on 'three or four', which is where this sentence started") and
acquired a fresh one anyway. The note now says so explicitly, so the next
person flipping a row knows the count is theirs to re-measure.
Not proposing a mechanism here. But a guard that parses the anchor's stated
counts and compares them to the two greps would end the class, and it is the
same shape as the citation guard .github#329 already landed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(inventory): claude-skills has no fr-gate caller, and cannot use one
UNRELATED PRE-EXISTING DRIFT, surfaced mid-review and fixed here because it is
what keeps `audit` (and therefore the required `gate`) red on this PR. Nothing in
this branch touched the fr-gate row -- `git diff origin/develop..HEAD` does not
mention it -- the audit simply started reporting:
claude-skills: MISSING required caller for fr-gate.yml on develop.
Measured: `fr-gate-caller.yml` is absent from `tracebloc/claude-skills`, while the
inventory carried `fr-gate.yml: required`. So the row asserts a caller that is not
there.
FLIPPED TO EXEMPT RATHER THAN RESTORING THE CALLER, and the reason is in the file
already: this entry's own `rulesets.promotion_merge_commit_only` exemption states
that claude-skills has "no staging branch and no promotion PRs". The fr-gate only
reports on a PR targeting staging/main/master AS A PROMOTION, so there is nothing
here for it to gate -- structurally the same case as release-train's fr-gate
exemption. Requiring a context nothing produces is the client#665 defect this file
warns about two entries above.
The remedy runs both ways and the reason says so: if the caller was removed by
mistake, restore it and flip this back. The audit reports either direction.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@LukasWodka

Copy link
Copy Markdown
ContributorAuthor

bugbot run

@tracebloc-release-traintracebloc-release-trainBot added the gate-nudge Toggled by the release train to (re-)fire the fr-gate label Aug 25, 2026

@cursorcursorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 7202700. Configure here.

Comment threadrepo-inventory.yml
Comment threadrepo-inventory.yml
@tracebloc-release-traintracebloc-release-trainBot removed the gate-nudge Toggled by the release train to (re-)fire the fr-gate label Aug 25, 2026
@LukasWodka

Copy link
Copy Markdown
ContributorAuthor

Promoted with 2 open Medium/Low Bugbot finding(s), per the severity policy in release-train's README (High stops the line; Medium/Low are recorded and ship, at both hops):

Discovery-framed fr-gate exemption; Citation guard misses tracked issue

This is a second look at once-reviewed code -- it passed per-feature review on the source branch, and has NOT had functional review yet (that happens on staging). Fix forward on develop if any is real.

What the train did with each:

@tracebloc-release-train
tracebloc-release-trainBot merged commit 416da9b into stagingAug 25, 2026
23 of 24 checks passed
@tracebloc-release-train
tracebloc-release-trainBot deleted the release-train/to-staging branch August 25, 2026 16:30
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@LukasWodka