From c83a3cd3e2ef78fbd3942f0ed0db796cbd4f8d3b Mon Sep 17 00:00:00 2001 From: mos-dt-0 Date: Sat, 1 Aug 2026 00:33:18 -0500 Subject: [PATCH] =?UTF-8?q?docs(remediation):=20bank=20D-32=20=E2=80=94=20?= =?UTF-8?q?the=20repaired=20gate=20shipped=20with=20a=20documented=20switc?= =?UTF-8?q?h=20to=20skip=20it?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit rev-974 blocked RM-03: pr-merge.sh still ships --skip-queue-guard at five sites including a worked example. It proved this rather than reading it — stubbed the guard to exit 99, ran a real fixture merge with the flag, and observed the guard never called, provider payload created, 'merged successfully', exit 0. Disqualifying because RM-03 repairs a mandatory gate that has never been able to fail; shipping that repair with a documented bypass means the gate merely requires one flag instead of zero, and every merge-side CANNOT_ASSERT/HOLD semantic is skipped. L0 bars equivalent skip switches, and the merge-gate role doc names this exact hazard about force_merge — adjacent to the field you came to edit, at the moment you are most motivated to reach for it. Generalizable: repairing a gate is incomplete while any supported path skips it. The failure changes from 'cannot block' to 'can be told not to' — the same outcome one keystroke later. Removing the bypass is part of the repair. Everything else passed independently, including the 160 KiB stdin transport where #1023 regressed. Co-Authored-By: Claude Opus 5 (1M context) --- docs/remediation/TASKS.md | 41 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index 80bf9153..1d78411b 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -221,6 +221,47 @@ reviewer, and no other seat holds mosaicstack write. Flagged to the coordinator busy lane. Not blocking today — RM-02's code blockers are independently disqualifying — but the next otherwise-clean PR meets this. +### D-32 — the repaired gate shipped with a documented switch to skip it + +`rev-974` blocked RM-03 (PR #1032) on a single finding, and it is the one that mattered: +**`pr-merge.sh` still ships `--skip-queue-guard`.** + +Verified independently at five sites in `packages/mosaic/framework/tools/git/pr-merge.sh` — usage line +`:3`, help text `:29` ("Skip CI queue guard wait before merge"), a worked **example** at `:38`, the flag +handler `:58`, and the conditional wrapping the entire `ci-queue-wait.sh` invocation at `:119`. + +**The reviewer did not report this from reading — it proved it.** It replaced the fixture queue guard +with an `exit 99` stub, ran a real fixture merge with `--skip-queue-guard`, and observed: **the guard was +never called, the provider payload was created, the wrapper printed "merged successfully", exit 0.** + +**Why this is disqualifying rather than a nitpick.** RM-03 repairs a mandatory merge gate that has never +once been able to fail (D-23). Shipping that repair while leaving a **documented, advertised, +worked-example** flag that skips the repaired gate means the gate still cannot be relied upon — **it +merely requires one flag instead of zero.** Every merge-side `CANNOT_ASSERT`/`HOLD` semantic the task +built is bypassed by it. L0 is explicit: _"Never use workarounds that bypass quality gates — `--no-verify` +and equivalent skip switches are off-limits."_ This is an equivalent skip switch, sitting in the merge path. + +The merge-gate role doc names this exact hazard about `force_merge`, and the description transfers +without modification: + +> _a `--no-verify` equivalent, **adjacent to the field you came to edit, at the exact moment you are most +> motivated to reach for it** — red gate, queued PR._ + +**The generalizable rule.** **Repairing a gate is incomplete while any supported path skips it.** A fix +that restores a gate's ability to fail, but leaves a switch that turns it off, has changed the failure +from _"the gate cannot block"_ to _"the gate can be told not to"_ — which under incident pressure is the +same outcome reached one keystroke later. Removing the bypass is **part of the repair**, not a follow-up. + +**Required:** remove `--skip-queue-guard` from merge-capable execution — flag, usage, help text and +example alike (**an undocumented-but-working bypass is worse than a documented one**) — plus a RED-first +regression proving a merge-capable invocation cannot reach a provider merge call with the guard unrun. +`--dry-run` may retain the skip since it does not merge, provided dry-run and merge-capable paths can +never both be true. + +**Everything else in RM-03 passed independent verification**, including the 160 KiB stdin transport where +#1023 regressed, the full classification matrix, the audited push-0/merge-75 tri-state, and the scope +disposition. A strong PR with one hole in it. + ### D-31 — a seat ran past 100% context with 28 uncommitted files and no commits `coder-mos1` reached **102.5% / 372k context** on RM-03 with **28 modified files uncommitted** and its