fix: count runs from disabled selected workflows

[yihanzhu]

Disabled selected workflows were omitted from the run count, so the runaway brake could pass even at its threshold. Add --all to the existing per-workflow query and exercise the real helper with enabled and disabled workflow runs. Selection, thresholds and error handling stay unchanged.

The regression fails against the original helper with runs=3. On the final committed head, the complete affected suite passes, including 19 runs passing and 20 runs refusing with the existing diagnostic. ShellCheck 0.11.0, Bash syntax and whitespace checks pass. Automatic quick CI and independent review remain required; this is not a full-suite result.

Accepted artifacts: work/disabled-workflow-run-counting/{intent,spec,plan}.md; plan accepted in #403. Only the helper and its existing test change. Output remains inactive and repository-only; no installation or activation occurred.

review_size: standard

Closes #132.

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	811c4cc
Status:	✅  Deploy successful!
Preview URL:	https://d2762d5e.fabrica-6yx.pages.dev
Branch Preview URL:	https://ystack-impl-disabled-workflo.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Independent G3 review — PR #404, round 0

Reviewer: /root/package_rebinding_intent_author, independent of implementation author /root/disabled_workflow_impl_sol. Requested reviewer model/effort: gpt-6-astra / high; author requested gpt-5.6-sol / medium. Actual runtime identities are not independently exposed.

Repository: yihanzhu/ystack
PR: #404
Branch: ystack/impl/disabled-workflow-run-counting
Gate: artifact-high / high

Reviewed-head: 811c4cc
Reviewed-base: 3abc1d3
Plan-blob: 831be531bd96c1f0e123820357a6c55b3d88a26e
Spec-blob: c70ccd50c18858f8165da66d5dce64707d1cbbe1
Intent-blob: d9bd79f672384b5b97d43ab96e9165038fb5d3c3
Intake-title-sha256: 8d8797714fd0b602d816d0e6fb9ad3499faa3b10e797104f4486dfbec12629d5
Intake-body-sha256: 628e11bfe6ede8a92d47bef7a7953cbe7b67610d90dfa87c235a23b057012809

Evidence and identity.

I read the complete diff, both complete changed files, accepted artifact chain, current review rules and CI-minimum decision. I independently inspected the retained pre-fix and final proof logs, statuses, first-code tuple and publication records. All 13 entries in the evidence checksum inventory matched their files. The saved commit diff includes a commit header and summary; its patch bytes exactly match the reviewed Git diff.

Before/after API reads preserved the exact head, base and intake hashes above. PR #404 remained open with only round-0; claimed, needs-human and merge-ready were absent. Intake #132 remained open with only roadmap-step-4; ready, claimed and needs-human were absent. Final remote head/main matched the reviewed tuple. The worktree remained clean.

Bugs pass — no Important findings.

The sole production change adds --all to the existing per-workflow query. The workflow filter, creation cutoff, fetch limit, JSON result handling, accumulation and threshold comparison remain unchanged. The global sanity query is untouched.

The fixture models the missing behavior: a configured disabled workflow returns the existing missing-workflow response without --all, and its configured count with the option. Existing enabled workflows and fixture modes remain intact.

The new cases invoke the actual helper and assert:

• Enabled 3 plus disabled 16 produces exactly runs=19 and exit 0.
• Enabled 3 plus disabled 17 produces exactly runs=20, exit 1 and the existing threshold diagnostic.

These assertions inspect behavior rather than merely matching the command. They run sequentially in the complete affected suite. The test diff adds assertions without removing or weakening existing ones.

Security pass — no Important findings.

The change preserves the runaway brake’s policy and refusal boundaries. Numeric-count validation, global listing failures, unexpected per-workflow errors and existing missing-workflow treatment are unchanged. Window, defaults, exclusions, fetch-limit scaling and environment aliases/precedence remain intact.

No workflow, credential, permission, executable-selection, probe-publication or run-attempt code changes. The new fixture is private to the existing test suite. No new dependency, framework, exceptional implementation path, live provider operation, installation or activation is introduced.

Compliance pass — no Important findings.

Exactly the two accepted implementation paths change, with 29 additions and one deletion. The implementation is one single-parent commit above the accepted plan-base. All three accepted artifact blobs remain byte-identical, and both hash links remain valid.

Plan PR #403 merged at 2026-09-22T07:13:31Z, producing the reviewed base. Build claim codex-disabled-workflow-build-48eaace6-f4cc-4b76-a696-32a653a342df, comment 5772603773, was recorded at 07:15:13Z. The retained first-code tuple binds local head and fetched main to that plan-base. The implementation commit is dated 07:19:50Z. The observed sequence therefore preserves plan acceptance before code.

The claim names the exact artifacts, risk, branch and two allowed paths. Completion comment 5772697007 binds the resulting PR/head/base and records claim release. Current labels agree with the review-stage state.

The PR uses Closes #132, records standard review size and describes the result and verification accurately. No full-matrix milestone is added by this isolated repair.

Proof inspected.

The pre-fix run used original helper blob 806f23e6612c2db01b2dd61701c8f20d146425f8 and augmented test blob 9a792ceeac9372687234965d8dbfd529273ddfa9. It exited 1 with:

FAIL: disabled workflow runs must be counted (got: runs=3)

That test blob matches the final committed test. The retained final run at the reviewed head completed the entire affected suite with exit 0. Final committed-head ShellCheck 0.11.0, Bash syntax and whitespace statuses also report exit 0.

Verified raw-log SHA-256s:

• Pre-fix regression: caedad4bb49a93173b3ec46fcf7783257b3d5be95c0a6622c9b00fde45b2e24f
• Final affected suite: ea5ffcd533a0164b3bd7aabcbe72ccccf6d1c5646ddc68b5a70cc83d284c640b
• Final ShellCheck: f169320201dc79f01728697022d3ad8c118671976273441d56034700633621ab

I did not rerun tests or execute the helper.

CI and conclusion.

Run 35699351606 reports success at the reviewed head: checks succeeded, the full-matrix test job was skipped, and required aggregate ci job 106653765564 succeeded. This is quick CI plus the separately inspected affected-suite proof, not a full-suite result.

No Important findings or nits. The exact implementation satisfies the accepted scope and proof. The manager remains responsible for final unchanged-identity and protection checks before any protected merge.

This reviewer made no file, ref, worktree, comment, label or other state changes and executed no tests or targets.

VERDICT: PASS