diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index 80bf9153..1d78411b 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -221,6 +221,47 @@ reviewer, and no other seat holds mosaicstack write. Flagged to the coordinator busy lane. Not blocking today — RM-02's code blockers are independently disqualifying — but the next otherwise-clean PR meets this. +### D-32 — the repaired gate shipped with a documented switch to skip it + +`rev-974` blocked RM-03 (PR #1032) on a single finding, and it is the one that mattered: +**`pr-merge.sh` still ships `--skip-queue-guard`.** + +Verified independently at five sites in `packages/mosaic/framework/tools/git/pr-merge.sh` — usage line +`:3`, help text `:29` ("Skip CI queue guard wait before merge"), a worked **example** at `:38`, the flag +handler `:58`, and the conditional wrapping the entire `ci-queue-wait.sh` invocation at `:119`. + +**The reviewer did not report this from reading — it proved it.** It replaced the fixture queue guard +with an `exit 99` stub, ran a real fixture merge with `--skip-queue-guard`, and observed: **the guard was +never called, the provider payload was created, the wrapper printed "merged successfully", exit 0.** + +**Why this is disqualifying rather than a nitpick.** RM-03 repairs a mandatory merge gate that has never +once been able to fail (D-23). Shipping that repair while leaving a **documented, advertised, +worked-example** flag that skips the repaired gate means the gate still cannot be relied upon — **it +merely requires one flag instead of zero.** Every merge-side `CANNOT_ASSERT`/`HOLD` semantic the task +built is bypassed by it. L0 is explicit: _"Never use workarounds that bypass quality gates — `--no-verify` +and equivalent skip switches are off-limits."_ This is an equivalent skip switch, sitting in the merge path. + +The merge-gate role doc names this exact hazard about `force_merge`, and the description transfers +without modification: + +> _a `--no-verify` equivalent, **adjacent to the field you came to edit, at the exact moment you are most +> motivated to reach for it** — red gate, queued PR._ + +**The generalizable rule.** **Repairing a gate is incomplete while any supported path skips it.** A fix +that restores a gate's ability to fail, but leaves a switch that turns it off, has changed the failure +from _"the gate cannot block"_ to _"the gate can be told not to"_ — which under incident pressure is the +same outcome reached one keystroke later. Removing the bypass is **part of the repair**, not a follow-up. + +**Required:** remove `--skip-queue-guard` from merge-capable execution — flag, usage, help text and +example alike (**an undocumented-but-working bypass is worse than a documented one**) — plus a RED-first +regression proving a merge-capable invocation cannot reach a provider merge call with the guard unrun. +`--dry-run` may retain the skip since it does not merge, provided dry-run and merge-capable paths can +never both be true. + +**Everything else in RM-03 passed independent verification**, including the 160 KiB stdin transport where +#1023 regressed, the full classification matrix, the audited push-0/merge-75 tri-state, and the scope +disposition. A strong PR with one hole in it. + ### D-31 — a seat ran past 100% context with 28 uncommitted files and no commits `coder-mos1` reached **102.5% / 372k context** on RM-03 with **28 modified files uncommitted** and its