docs(w6): record CI required-check guardrails #451

Merged

pdurlej merged 1 commit from codex/w6a-ci-required-checks into main

2026-05-24 22:20:05 +02:00

codex commented

2026-05-24 21:34:32 +02:00

Collaborator

Canary status: missing — rely on required Forgejo checks before merge

Canary Context Pack

Product story

W6 needs reliable CI/branch-protection evidence before stronger AI review or future semi-autonomous merge policy. This report records what is actually enforced today and what is only advisory PR evidence.

What changed

Added state/reports/w6a-ci-required-checks-2026-05-24.md with read-only evidence from workflow files, CI docs, check_branch_protection.py, and Forgejo PR status APIs.

Why it changed

Fork A's W6a job is to make the current CI guardrail state explicit so the integrator can sequence W6a/W6b/W6c without guessing.

Files touched

state/reports/w6a-ci-required-checks-2026-05-24.md

Relevant context

W6a / Milestone 06 CI guardrails
#243 branch protection owner action
#49 old ADR-0002 CI enforcement checklist
#449 PR-body reviewer context just landed before this fork started

Runtime evidence

No runtime mutation. Read-only Forgejo API evidence only.

Known constraints

codex cannot read admin branch-protection endpoints (403), but check_branch_protection.py can read the branch payload and confirmed main protection readiness for base-is-main / guard.

Explicit out-of-scope

No branch-protection mutation.
No required-check changes.
No runtime/RS2000 mutation.
No state/STATUS_NOW.md edit.

Requested decision

Merge as W6a evidence if checks are green.

Merge blockers

Report contradicts live branch-protection readiness.
Workflow lint fails.

Spec sources read

.forgejo/ci-policy.yaml
.forgejo/workflows/base-is-main.yml
.forgejo/workflows/workflow-lint.yml
.forgejo/workflows/patchwarden-pr-sanity.yml
.forgejo/workflows/canary-required.yml
.forgejo/workflows/platformctl-plan.yml
docs/ci/README.md
docs/ci/runner-contract.md
docs/forgejo-agent-operations.md
runbooks/forgejo-actions-runner.md
control-plane/platformctl/ci/check_branch_protection.py
Forgejo API read-only: PR #449 status, branch readiness, issues #49/#85/#243

Test plan

python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --markdown /tmp/w6a-workflow-lint.md --json /tmp/w6a-workflow-lint.json → passed with 0 findings
git diff --check → clean

Refs #49
Refs #243

Canary status: missing — rely on required Forgejo checks before merge ## Canary Context Pack ### Product story W6 needs reliable CI/branch-protection evidence before stronger AI review or future semi-autonomous merge policy. This report records what is actually enforced today and what is only advisory PR evidence. ### What changed Added `state/reports/w6a-ci-required-checks-2026-05-24.md` with read-only evidence from workflow files, CI docs, `check_branch_protection.py`, and Forgejo PR status APIs. ### Why it changed Fork A's W6a job is to make the current CI guardrail state explicit so the integrator can sequence W6a/W6b/W6c without guessing. ### Files touched - `state/reports/w6a-ci-required-checks-2026-05-24.md` ### Relevant context - W6a / Milestone 06 CI guardrails - #243 branch protection owner action - #49 old ADR-0002 CI enforcement checklist - #449 PR-body reviewer context just landed before this fork started ### Runtime evidence No runtime mutation. Read-only Forgejo API evidence only. ### Known constraints `codex` cannot read admin branch-protection endpoints (`403`), but `check_branch_protection.py` can read the branch payload and confirmed `main` protection readiness for `base-is-main / guard`. ### Explicit out-of-scope - No branch-protection mutation. - No required-check changes. - No runtime/RS2000 mutation. - No `state/STATUS_NOW.md` edit. ### Requested decision Merge as W6a evidence if checks are green. ### Merge blockers - Report contradicts live branch-protection readiness. - Workflow lint fails. ## Spec sources read - `.forgejo/ci-policy.yaml` - `.forgejo/workflows/base-is-main.yml` - `.forgejo/workflows/workflow-lint.yml` - `.forgejo/workflows/patchwarden-pr-sanity.yml` - `.forgejo/workflows/canary-required.yml` - `.forgejo/workflows/platformctl-plan.yml` - `docs/ci/README.md` - `docs/ci/runner-contract.md` - `docs/forgejo-agent-operations.md` - `runbooks/forgejo-actions-runner.md` - `control-plane/platformctl/ci/check_branch_protection.py` - Forgejo API read-only: PR #449 status, branch readiness, issues #49/#85/#243 ## Test plan - `python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --markdown /tmp/w6a-workflow-lint.md --json /tmp/w6a-workflow-lint.json` → passed with 0 findings - `git diff --check` → clean Refs #49 Refs #243

codex added 1 commit

2026-05-24 21:34:32 +02:00

docs(w6): record CI required-check guardrails

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 23s