You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(ci): admit the tracked capability closure regression - #1879
The authoritative merge-group run for #1795 failed its tracked-payload guard:
Tracked inert payload bytes are forbidden:
nix/buck2-products/capability-closure.test.sh
The guard admits Nix source and an exact metadata/test allowlist, but the newly tracked capability regression fixture was missing from that allowlist. Failing job.
Goal
Admit this specific source test while continuing to refuse actual product payloads and unregistered shell scripts.
Decisions
Add only capability-closure.test.sh to the existing exact allowlist in the generator and regenerate the workflow. The regression executes the generated guard in a temporary Git repository, accepting that filename and rejecting product.tar.gz and unrelated.sh. Required-check policy is unchanged.
Independent review: GO, no findings, at aa2cc1886856ab0cc5b65478593d004d7de2a514.
Workflow regeneration completed with devenv tasks run genie:run (exit 0).
Canonical gate-slot --class gate -- devenv tasks run check:quick passed at that same head: 2026-10-16T02:32:25Z command-exited exit=0, EXIT=0. Receipt records identical start/end head, cleanStart=true, cleanEnd=true, exact=true, outcome completed.
Complexity
No new production abstraction or dependency.
Concerns
pr-a-inert-buck remains outside required merge contexts; changing its enforcement is intentionally outside this correction.
Friction & bottlenecks
The broader workflow-helper suite reported 93 passing tests and one unrelated subprocess failure in its raster-failure fixture (result.status was null). The focused payload-policy regression passed.
Owner GO at exact head aa2cc18. Independent exact-head GO; focused generated-guard regression accepts capability-closure.test.sh and rejects unrelated.sh/product.tar.gz; exact clean-head check:quick EXIT0. Hosted CI38841066185 and preview38841066077 completed success; final rollup9success22skipped0failed0pending; unresolvedthreads=[]. Broader existing helper suite had one unrelated raster subprocess failure, disclosed in description. Required-context policy unchanged; merge-group inert check still must prove this fix in hosted path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
area:ciCI workflows, runners, and pipeline configuration · Set: manualorigin:agentFiled or primarily produced by an AI agent · Set: AI agent or manualtype:bugSomething broken or a regression · Set: manual
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The authoritative merge-group run for #1795 failed its tracked-payload guard:
The guard admits Nix source and an exact metadata/test allowlist, but the newly tracked capability regression fixture was missing from that allowlist. Failing job.
Goal
Admit this specific source test while continuing to refuse actual product payloads and unregistered shell scripts.
Decisions
Add only
capability-closure.test.shto the existing exact allowlist in the generator and regenerate the workflow. The regression executes the generated guard in a temporary Git repository, accepting that filename and rejectingproduct.tar.gzandunrelated.sh. Required-check policy is unchanged.Verification
Focused regression:
vitest run --root packages/@overeng/genie --config vitest.config.ts src/runtime/github-workflow/ci-workflow-helpers.unit.test.ts -t "tracked inert payload admission"— 1 passed, 93 skipped, exit 0.Independent review: GO, no findings, at
aa2cc1886856ab0cc5b65478593d004d7de2a514.Workflow regeneration completed with
devenv tasks run genie:run(exit 0).Canonical
gate-slot --class gate -- devenv tasks run check:quickpassed at that same head:2026-10-16T02:32:25Z command-exited exit=0,EXIT=0. Receipt records identical start/end head,cleanStart=true,cleanEnd=true,exact=true, outcomecompleted.Complexity
No new production abstraction or dependency.
Concerns
pr-a-inert-buckremains outside required merge contexts; changing its enforcement is intentionally outside this correction.Friction & bottlenecks
The broader workflow-helper suite reported 93 passing tests and one unrelated subprocess failure in its raster-failure fixture (
result.statuswas null). The focused payload-policy regression passed.Follow-ups
None added by this narrowly scoped fix.
References
Refs #1795.