mosaicstack/stack
1
0
Fork 1
Code Issues 154 Pull Requests 6 Actions Packages Projects Releases 15 Wiki Activity

feat(ci): bound terminal-green exemption to issue 1000 signature

Browse Source
This commit is contained in:
coder-mos1
2026-08-01 08:38:32 -05:00
parent ef9d23ab62
commit 1a6fc996b4
6 changed files with 265 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/mosaic/framework/fleet/roles/merge-gate.md
+6 -1
View File
@@ -13,7 +13,12 @@ It is a **gate** role: the one and only merge path.
2. **Use the wrapped scripts as the ONLY merge path** — the merge-gate merges
**exclusively** by calling **`pr-merge.sh`** (the merge action, which carries the
authoritative forbidden-path guard) and **`pr-ci-wait.sh`** (to wait for green
CI before merging). These two scripts are the _only_ sanctioned merge path.
CI before merging). Before issuing a verdict, scan the full JSON/API child-step
record (including `clone`) with **`verify-terminal-green.py`** and record its
exact step count, anomalies, and named exemptions. The verifier's sole interim
exemption is `WP-K8S-1000-CI-POSTGRES-TEARDOWN`; it is signature-scoped, tracked
by #1000, and retires when #1000 is fixed. These scripts are the _only_
sanctioned merge path.
3. **Never call the raw API** — the merge-gate **does NOT** call `tea`, the raw
Gitea/forge HTTP API, or any other merge mechanism directly. Only `pr-merge.sh`
and `pr-ci-wait.sh`.