pdurlej/platform

Fork 0

feat(w6d): add canary-backed automerge lane #488

Closed

codex wants to merge 1 commit from codex/w6d-canary-backed-lane into main

codex commented

2026-05-25 13:56:15 +02:00

Collaborator

Canary status: missing — rely on required Forgejo checks before merge

Canary Context Pack

Product story

W6d already works for boring docs/status PRs. The next useful expansion is not broader trust in model comments, but a second lane where selected policy/spec files can be considered only after a real 3+3 decision packet approves the exact PR head SHA.

What changed

Added a canary_3x3 policy lane to automerge_readiness.py.
Allowed only prompts/ and decisions/ into that lane.
Required matching decision_packet.json with default_action=approve_merge, all_tech_ok=true, all_product_ok=true, no dissents, no soft_fail_note, and matching commit SHA.
Kept runtime, workflow, control-plane, modules, schema, scripts, tests, secrets, auth, and exposure outside W6d.
Documented the two-lane policy in the W6d cycle note.

Why it changed

The operator asked whether W6d can use the existing 3+3 approach to broaden the lane. This change adds the deterministic policy support without treating skipped canary statuses or PR body text as proof.

Files touched

control-plane/platformctl/ci/automerge_readiness.py
control-plane/platformctl/tests/test_automerge_readiness.py
state/cycle/W6d-autonomous-merge-pilot.md

Relevant context

W6d autonomous merge pilot and Iskra Matrix approval lane.
Existing 3+3 decision_packet shape from platformctl.tools.run_review / consolidate_review.

Runtime evidence

No runtime mutation. Local verification only:

PYTHONPATH=control-plane pytest control-plane/platformctl/tests/test_automerge_readiness.py -> 18 passed
python3 -m compileall -q control-plane/platformctl/ci/automerge_readiness.py
git diff --check

Known constraints

This PR adds checker support. A trusted workflow still needs a real decision-packet source before canary_3x3 should be used for live automerge. It deliberately does not accept canary status alone, because canary can be green while skipped/not configured.

Explicit out-of-scope

No workflow dispatch wiring for retrieving canary decision artifacts.
No auditlm integration.
No runtime/module/schema/workflow/control-plane automerge eligibility.

Requested decision

Merge if checks pass. After merge, follow with a small workflow PR that wires the trusted decision-packet source, then a prompt/decision smoke PR.

Merge blockers

Any path expansion beyond prompts/ and decisions/.
Accepting comments/status text instead of a matching decision_packet.json.
Any runtime or secret behavior change.

Spec sources read

control-plane/platformctl/ci/automerge_readiness.py — W6d checker implementation.
control-plane/platformctl/tests/test_automerge_readiness.py — readiness policy tests.
state/cycle/W6d-autonomous-merge-pilot.md — operator-facing W6d lane policy.
.forgejo/workflows/canary-required.yml — checked why canary status alone is not sufficient proof.
control-plane/platformctl/tools/consolidate_review.py — decision packet shape and approve_merge semantics.

Canary status: missing — rely on required Forgejo checks before merge ## Canary Context Pack ### Product story W6d already works for boring docs/status PRs. The next useful expansion is not broader trust in model comments, but a second lane where selected policy/spec files can be considered only after a real 3+3 decision packet approves the exact PR head SHA. ### What changed - Added a `canary_3x3` policy lane to `automerge_readiness.py`. - Allowed only `prompts/` and `decisions/` into that lane. - Required matching `decision_packet.json` with `default_action=approve_merge`, `all_tech_ok=true`, `all_product_ok=true`, no dissents, no `soft_fail_note`, and matching commit SHA. - Kept runtime, workflow, control-plane, modules, schema, scripts, tests, secrets, auth, and exposure outside W6d. - Documented the two-lane policy in the W6d cycle note. ### Why it changed The operator asked whether W6d can use the existing 3+3 approach to broaden the lane. This change adds the deterministic policy support without treating skipped canary statuses or PR body text as proof. ### Files touched - `control-plane/platformctl/ci/automerge_readiness.py` - `control-plane/platformctl/tests/test_automerge_readiness.py` - `state/cycle/W6d-autonomous-merge-pilot.md` ### Relevant context - W6d autonomous merge pilot and Iskra Matrix approval lane. - Existing 3+3 `decision_packet` shape from `platformctl.tools.run_review` / `consolidate_review`. ### Runtime evidence No runtime mutation. Local verification only: - `PYTHONPATH=control-plane pytest control-plane/platformctl/tests/test_automerge_readiness.py` -> 18 passed - `python3 -m compileall -q control-plane/platformctl/ci/automerge_readiness.py` - `git diff --check` ### Known constraints This PR adds checker support. A trusted workflow still needs a real decision-packet source before `canary_3x3` should be used for live automerge. It deliberately does not accept canary status alone, because canary can be green while skipped/not configured. ### Explicit out-of-scope - No workflow dispatch wiring for retrieving canary decision artifacts. - No `auditlm` integration. - No runtime/module/schema/workflow/control-plane automerge eligibility. ### Requested decision Merge if checks pass. After merge, follow with a small workflow PR that wires the trusted decision-packet source, then a prompt/decision smoke PR. ### Merge blockers - Any path expansion beyond `prompts/` and `decisions/`. - Accepting comments/status text instead of a matching `decision_packet.json`. - Any runtime or secret behavior change. ## Spec sources read - `control-plane/platformctl/ci/automerge_readiness.py` — W6d checker implementation. - `control-plane/platformctl/tests/test_automerge_readiness.py` — readiness policy tests. - `state/cycle/W6d-autonomous-merge-pilot.md` — operator-facing W6d lane policy. - `.forgejo/workflows/canary-required.yml` — checked why canary status alone is not sufficient proof. - `control-plane/platformctl/tools/consolidate_review.py` — decision packet shape and `approve_merge` semantics.

codex added 1 commit

2026-05-25 13:56:15 +02:00

feat(w6d): add canary-backed automerge lane

base-is-main / guard (pull_request) Successful in 2s

Details

python-ci / Python 3.12 (pull_request) Successful in 43s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 21s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 20s

Details

python-ci / Python 3.11 (pull_request) Successful in 42s

Details

python-ci / Python 3.13 (pull_request) Successful in 43s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

canary-required / canary (pull_request) Successful in 14s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 24s

Details

6e8a5416c1

codex commented

2026-05-26 08:42:37 +02:00

Author

Collaborator

Closing as superseded after operator-approved Oracle review.

Reason: this PR is locally cautious, but architecturally stale after the Patchwarden decision. Policy-driven review/automerge expansion should live in pdurlej/patchwarden; pdurlej/platform should stay a thin client that consumes Patchwarden verdict/status artifacts, asks Iskra, and performs trusted dispatch/merge execution.

The useful requirement from this PR is preserved for Patchwarden: exact-head-SHA review/decision artifacts need trusted provenance before they can widen any merge lane. Platform W6d remains boring docs/status/roadmap only for now.

Closing as superseded after operator-approved Oracle review. Reason: this PR is locally cautious, but architecturally stale after the Patchwarden decision. Policy-driven review/automerge expansion should live in `pdurlej/patchwarden`; `pdurlej/platform` should stay a thin client that consumes Patchwarden verdict/status artifacts, asks Iskra, and performs trusted dispatch/merge execution. The useful requirement from this PR is preserved for Patchwarden: exact-head-SHA review/decision artifacts need trusted provenance before they can widen any merge lane. Platform W6d remains boring docs/status/roadmap only for now.

codex closed this pull request

2026-05-26 08:42:37 +02:00

codex referenced this pull request

2026-05-26 08:45:24 +02:00

docs(w6d): record Patchwarden policy boundary #500