Skip to content

Commit 90a34e2

Browse files
ci(ui-merge): retire the two-repo pin gates — Spec Shape Gate, Console Pin Gate, prerelease-pin-watch (#25827)
Part of #25697 (item 6, PR B). PR A (#25710) carried items 1 to 5 and is merged; the card stays open for the epic PM, who hands this PR to the cutover. Blocked-by: #25752 (cutover PR first) Part of objectstack#25677 Clause-②: no Metadata-protocol: none ## What this retires Once `ui/` lives in this repository, the gates that proved the objectui pin from the outside have nothing left to prove. This PR deletes them: - `.github/workflows/spec-shape-gate.yml` (**Spec Shape Gate**), with `scripts/ci/spec-shape-gate.mjs` and `scripts/ci/spec-shape-retirements.json`. - The `console-pin` job (**Console Pin Gate**) in `ci.yml`, and the `console` list and output of its `filter` job. - `.github/workflows/prerelease-pin-watch.yml` (**Stable release watch**). - The `Spec Shape Gate` row of `RELEASE_GATE_WORKFLOWS` in `scripts/ci/scheduled-full-run.mjs`. The release gate now reads `CI` and `Lint & Type Check`. `release.yml` and `cut-rc.yml` have no read of their own (measured); both reach the roster only through `scheduled-full-run.mjs --release-gate`. What replaces them is already on `main` from PR A: `Type Check UI` and `Build & E2E UI` compile and build the Console from `ui/` in the PR that changes one of the seven packages objectui installs (`ui_consumers` filter). The console scripts (`build-console.sh`, `check-console-sha.mjs`, `check-console-injection.mjs`, `console-spec-probes.mjs`, `assert-console-spec-injection.mjs`) stay, as the order says. 4a #25745 deletes them with the pin. ## Hit-class table Census: `git grep -n -E 'spec-shape-gate|Spec Shape Gate|spec-shape-retirements|prerelease-pin-watch|Console Pin Gate|console-pin'` at the base `52f3f518e1` gives 169 hits in 33 files. Also posted on the card: #25697 (comment) | Class | Files (hits) | Treatment | |---|---|---| | The retired gates themselves | `spec-shape-gate.yml` (15), `scripts/ci/spec-shape-gate.mjs` (21), `scripts/ci/spec-shape-retirements.json` (1), `prerelease-pin-watch.yml` (6) | deleted | | `ci.yml` job and filter | `ci.yml` (7) | `console-pin` job, `console` filter list and output deleted; the comments that pointed at them re-worded | | Release-gate roster | `scripts/ci/scheduled-full-run.mjs` (19) | roster row dropped; the self-tests that encoded a three-row roster are rewritten to the two-row roster with the same assertion shape (none deleted or skipped); two dated diagnosis fixtures kept verbatim | | Gates that encode the deleted job or script | `check-ci-filter-parity.mjs` (5), `check-expected-skips.mjs` (5), `dispatch-gates.self-test.mjs` (20), `dispatch-gates.mjs` (7) | filter-parity `console` subject retired with its battery (floor 10 to 9); the `Console Pin Gate` expected-skip row removed and its recorded runs re-spelled to the live roster; the live-tree job-filter cases re-pointed at `Build Core`; synthetic specimens kept; tense fixes | | Orphan the deletion forces | `scripts/check-prerelease-pin-watch.mjs` (15), `package.json` (2) | deleted, with the `check:spec-shape-gate` and `check:prerelease-pins` aliases (deviation 1) | | Instruction prose naming a deleted gate as live | `AGENTS.md` (2), `docs/releases-maintenance.md` (2) | prose fixes, listed below | | Comments naming a retired gate as live | `cut-rc.yml:358`, `docs-deploy.yml`, `lint.yml` (2), `release-coverage-patrol.yml`, `release.yml:1510`, `check-release-section-coverage.mjs` (2), `check-self-test-workflow-commands.mjs`, `check-vendor-version-stamps.mjs` (2), `check-required-contexts.mjs` | past tense, or a one-paragraph addendum to the existing tombstone | | Left for 4a #25745, which deletes or rewrites them | `release.yml:1874` and `:1917`, `cut-rc.yml:383`, `packages/console/README.md:54`, `check-console-injection.mjs` (6) | untouched here, so the two PRs do not conflict on them | | Dated history and fixtures | `docs/audits/*` (5), `scripts/docs-audit/README.md`, `scripts/fixtures/merge-queue-triage/*.json` (2), the `fleet-write/validate.mjs` fixture, `packages/spec/liveness/dashboard.json:146`, `pnpm-workspace.yaml:184`, the #9533 tombstone in `check-required-contexts.mjs` | kept as written | ## Tier H prose touched - `AGENTS.md` line 533: drops `Console Pin Gate` from the list of full-battery jobs. - `AGENTS.md` lines 1103 to 1104: the sibling-removal rule named the full battery's `Console Pin Gate` as what reds a breaking removal on `main`. It now names `Type Check UI`, which compiles the Console under `ui/` in the PR that makes the removal. Line count unchanged (1117, the ratchet ceiling). - `docs/releases-maintenance.md`: the "What still checks the pin" paragraph is now "What used to check the pin", and the release-gate roster reads `CI`, `Lint & Type Check`. No ADR is touched. ## Required contexts that vanish **None.** Read at the time of this PR: the `main` ruleset requires `TypeScript Type Check`, `Test Core`, `Build Core`, `Lint & Repo Gates`, `Governed Surface Queue Guard`, and classic branch protection requires `TypeScript Type Check`, `Build Core`, `Test Core`, `Dogfood Regression Gate`. Neither `Spec Shape Gate` nor `Console Pin Gate` is in either list, so the sitting needs no ruleset change for this PR. `node scripts/check-required-contexts.mjs --verify-required-set` exits 0: the registry and the live set agree in both directions. ## Landing with 4a #25745 This PR and 4a are two halves of one change and land as a batch, 4a first: - **On `main` alone this PR is red in one place.** The order keeps `check-console-injection.mjs` and `console-spec-probes.mjs` until 4a and deletes `Console Pin Gate`, their only PR-time runner. Two live-tree cases of the dispatch-gates fast tier then red: the silent load-break pair `check:console-injection` from `console-spec-probes.mjs`, and the `pull_request`-only narrowing of the scheduled-only zero. That step belongs to `Lint & Repo Gates`. With 4a merged first, the same tier passes 1917 of 1917 (verification record below). Neither case was weakened. - **Two files overlap.** `package.json` (both PRs delete the `check:prerelease-pins` alias) and one comment in `scripts/pm/dispatch-gates.self-test.mjs` near line 1006. Take the `main` side (4a) in both; checked on the local merge below. ## Deviations from the order 1. `scripts/check-prerelease-pin-watch.mjs` and its `check:prerelease-pins` alias are deleted here as well. Once the workflow is gone the script has no CI caller and `check-self-test-wired` reds the orphan. 4a deletes the same file, so the two deletions agree. 2. `prerelease-pin-watch.yml` does not watch the objectui pin. It watched better-auth prerelease overrides in `pnpm-workspace.yaml`, and its watch list was already empty. It is deleted as ordered. 3. Beyond the order's file list, these gates had to follow the deletion so they stay true: `check-ci-filter-parity.mjs`, `check-expected-skips.mjs`, `dispatch-gates.self-test.mjs`. Each keeps its assertion shape; nothing is skipped or loosened. ## Verification record Head `1776dbd798a4ebde5abc974e5b8d01c6db3fd3ef`, base `52f3f518e1`. - **Derived gate sweep** (`node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack`): 86 derived, 82 run. 81 exit 0. `pnpm check:pm-dispatch-gates` exits 1 (the two cases above, 2 of 1917). 4 exit 3, prerequisite not met, because they need every workspace dist built: `check:dts-closure`, `check:dual-build-cjs-loads`, `check:lean-entry-closure`, `check:sourcemap-no-sources-content`. `Build Core` runs them on this PR. `dispatch-gates.mjs --ran`: 86 accounted, 0 unrun. - **Named by the order:** `node scripts/ci/scheduled-full-run.mjs --self-test` 0, `pnpm check:shard-attestation` 0, `pnpm --filter @objectstack/spec check:liveness` 0, `check-required-contexts.mjs --verify-required-set` 0. - **Merged tree** (`main` `abebc4e14d` + 4a `4ac569dc00` + this PR, local, conflicts resolved to the `main` side): `pnpm check:pm-dispatch-gates` exit 0 (fast tier 1917 of 1917). The same 86-command sweep on the merged tree: 80 exit 0, 6 exit 3 (prerequisite not met: the throwaway worktree has no package dists or package-level installs, so `check:doc-formula-expressions` and `check:type-check-debt` join the four above; both exit 0 on this branch), no finding. ```text exit command (this branch, head 1776dbd) 0 node scripts/check-aggregator-roster.mjs 0 node scripts/check-aggregator-roster.mjs --self-test 0 node scripts/check-ci-filter-parity.mjs 0 node scripts/check-ci-filter-parity.mjs --self-test 0 node scripts/check-closing-keyword-parity.mjs 0 node scripts/check-closing-keyword-parity.mjs --self-test 0 node scripts/check-comment-mask-corpus.mjs 0 node scripts/check-declaration-mirrors.mjs 0 node scripts/check-declaration-mirrors.mjs --self-test 0 node scripts/check-dts-emitted.mjs --self-test 0 node scripts/check-merged-branch-reaper-outcome.mjs 0 node scripts/check-merged-branch-reaper-outcome.mjs --self-test 0 node scripts/check-position-name-fold-loaders.mjs 0 node scripts/check-position-name-fold-loaders.mjs --self-test 0 node scripts/check-release-section-coverage.mjs 0 node scripts/check-release-section-coverage.mjs --self-test 0 node scripts/check-release-section-coverage.mjs --strict 0 node scripts/check-scripts-symbol-anchors.mjs 0 node scripts/check-scripts-symbol-anchors.mjs --self-test 0 node scripts/check-self-test-wired.mjs 0 node scripts/check-self-test-wired.mjs --self-test 0 node scripts/check-self-test-workflow-commands.mjs 0 node scripts/check-self-test-workflow-commands.mjs --self-test 0 node scripts/check-step-collectors.mjs 0 node scripts/check-step-collectors.mjs --self-test 0 node scripts/check-whole-set-label-write.mjs 0 node scripts/check-whole-set-label-write.mjs --self-test 0 node scripts/ci/assert-turbo-remote-cache.mjs --self-test 0 node scripts/ci/prune-turbo-cache.mjs --self-test 0 node scripts/ci/scheduled-full-run.mjs --self-test 0 node scripts/docs-audit/check-drift-comment.mjs 0 node scripts/pm/bare-root-worklist.mjs --self-test 0 node scripts/pm/ci-failure.mjs --self-test 0 node scripts/release-dist-tags.mjs --self-test 0 node scripts/release-verify-npm.mjs --self-test 0 node scripts/render-release-coverage-anchor.mjs --self-test 0 pnpm --filter @objectstack/lint run check:doc-formula-expressions 0 pnpm check:agent-test-spelling 0 pnpm check:bash32-floor 0 pnpm check:cli-command-ids 0 pnpm check:cross-package-test-inputs 0 pnpm check:declared-population-live 0 pnpm check:doc-authoring 0 pnpm check:docs-audit-scope 0 pnpm check:driver-memory-census 0 pnpm check:entry-guard 0 pnpm check:gitlink-declared 0 pnpm check:manifest-repository-directory 0 pnpm check:merge-driver 0 pnpm check:node-version 0 pnpm check:nul-bytes 0 pnpm check:parse-guard 0 pnpm check:pm-close-cards 0 pnpm check:pm-expected-skips 0 pnpm check:pm-fleet-write-dispatch 0 pnpm check:pm-fleet-write-execute 0 pnpm check:pm-fleet-write-validate 0 pnpm check:pm-governed-merges 0 pnpm check:pm-governed-prose 0 pnpm check:pm-issue-transfer 0 pnpm check:pm-post-stamped 0 pnpm check:pm-record-recognisers 0 pnpm check:pm-skill-id-lint 0 pnpm check:pm-skill-ratchet 0 pnpm check:pnpm-acquisition 0 pnpm check:pnpm-filter-targets 0 pnpm check:pnpm-flag-spellings 0 pnpm check:ratchet-remedy-authority 0 pnpm check:refd-timer-probe 0 pnpm check:required-contexts 0 pnpm check:select-gate-families 0 pnpm check:shard-attestation 0 pnpm check:stall-guard-budget 0 pnpm check:stall-guard-headroom 0 pnpm check:turbo-task-graph 0 pnpm check:type-check-coverage 0 pnpm check:type-check-debt 0 pnpm check:vendor-version-stamps 0 pnpm check:watch-hint-literal 0 pnpm check:workflow-status-functions 0 pnpm check:workflow-step-name-quoting 1 pnpm check:pm-dispatch-gates 3 pnpm check:dts-closure 3 pnpm check:dual-build-cjs-loads 3 pnpm check:lean-entry-closure 3 pnpm check:sourcemap-no-sources-content ``` ## 维护者速读(草稿) **改了什么**:删掉三个只为「跨仓库钉版本」存在的门禁:Spec Shape Gate(每小时拉 objectui main 编译一遍)、Console Pin Gate(按 `.objectui-sha` 克隆 objectui 构建控制台)、prerelease-pin-watch(盯 better-auth 预发布版本,清单早已为空)。发布前的全量电池名单从三个工作流减为 `CI` 与 `Lint & Type Check`。AGENTS.md 两处、发布维护文档一处把它们改为过去时。 **为什么改**:objectui 合入 `ui/` 之后,控制台在同一个 PR 里由 `Type Check UI`、`Build & E2E UI` 编译构建,规格一改就当场验证,不再需要隔一小时去克隆另一个仓库。留着旧门禁只会对着已不存在的钉版本报错。 **风险与代价(含回滚)**:不影响必需检查(这三个都不在必需集合里)。必须在 4a #25745 之后合入:单独合入时 `Lint & Repo Gates` 会因控制台脚本失去 PR 期运行者而红两条,4a 删除这些脚本后即消失。回滚就是还原此 PR,三个工作流与脚本原样恢复。 **席位意见**: **你要做的**:切换当天在 4a 之后合入本 PR(Tier H,需你批准)。规则集无需改动。 --- _Generated by [Claude Code](https://claude.ai/code/session_01H835wAyqCCeF7jiYq7XSxi)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
1 parent 2a61f08 commit 90a34e2

22 files changed

Lines changed: 143 additions & 2878 deletions

‎.github/workflows/ci.yml‎

Lines changed: 7 additions & 285 deletions
Large diffs are not rendered by default.

‎.github/workflows/cut-rc.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@ jobs:
255255
restore-keys: |
256256
${{ runner.os }}-pnpm-store-v3-
257257
258-
# Restore-only, like ci.yml's Console Pin Gate: this workflow runs a handful
258+
# Restore-only, as ci.yml's retired Console Pin Gate was: this workflow runs a handful
259259
# of times a month so its own namespace is almost always cold, and the
260260
# build-core fallbacks seeded from main are the ones that actually hit.
261261
# Saving is lint.yml's job.

‎.github/workflows/docs-deploy.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,9 @@ on:
5757
# snapshot owns :07 of 02, 08, 14 and 20. Of the six six-hour sets, only
5858
# 0/6/12/18 and 1/7/13/19 have hours with nothing scheduled after :00; the
5959
# first is taken because its :00 neighbours are short (release.yml's
60-
# version-pr refresh, prerelease-pin-watch at 06:00, the hourly ci/lint
61-
# runs), while 07:00 starts the showcase smoke. The MINUTE is off the top of
62-
# the hour for the reason every patrol here gives: scheduled runs queue
63-
# behind everyone else's :00 cron.
60+
# version-pr refresh, the hourly ci/lint runs), while 07:00 starts the
61+
# showcase smoke. The MINUTE is off the top of the hour for the reason every
62+
# patrol here gives: scheduled runs queue behind everyone else's :00 cron.
6463
#
6564
# This job spends almost nothing of the per-repository GITHUB_TOKEN budget
6665
# (the checkout, and no API reads), so unlike the board readers it is not

‎.github/workflows/lint.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3261,7 +3261,7 @@ jobs:
32613261
# from git: 17.1.0 ran 5h44m (36 PRs landed), 16.1.0 ran 25 days (2712 PRs).
32623262
# Hard-failing would have red 2748 PRs for a debt none of them created. So
32633263
# findings are a `::warning::` + step summary with the job GREEN — the
3264-
# loud-but-non-blocking shape prerelease-pin-watch.yml uses — and the policy
3264+
# loud-but-non-blocking shape the retired prerelease-pin-watch.yml used — and the policy
32653265
# follows half-state-patrol.yml's rule verbatim: findings never fail
32663266
# anything, the job DOES fail when the sweep could not run. A broken
32673267
# instrument is fatal here in every mode. `--strict` promotes findings to
@@ -4727,7 +4727,7 @@ jobs:
47274727
# the legacy `##[...]` form is parsed ANYWHERE in a printed line (the
47284728
# measured token sat at column 18 and was still consumed), while the
47294729
# `::...::` form is parsed only at LINE START (two mid-sentence ones print
4730-
# on every PR from `check-prerelease-pin-watch` and mint nothing). So the
4730+
# on every PR from the since-retired `check-prerelease-pin-watch` and minted nothing). So the
47314731
# first detector is unanchored and the second is anchored — flagging inert
47324732
# prose would be a false positive the next author would be right to delete.
47334733
#

‎.github/workflows/prerelease-pin-watch.yml‎

Lines changed: 0 additions & 130 deletions
This file was deleted.

‎.github/workflows/release-coverage-patrol.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ name: Release-Coverage Patrol
6363
# grepping prose, while the JOB stays green whenever findings exist. A `--strict`
6464
# run stays red for as long as the prose is unwritten — 25 days, in the 16.1.0
6565
# case — and a chronically red scheduled job is how people learn to skim red,
66-
# which `prerelease-pin-watch.yml`'s header warns about directly. Findings land
66+
# which the retired `prerelease-pin-watch.yml`'s header warned about directly. Findings land
6767
# in the anchor issue; they never colour this job.
6868
#
6969
# ## What lands where

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1506,8 +1506,8 @@ jobs:
15061506
# ══════════════════════════════════════════════════════════════════════════
15071507
full-battery:
15081508
name: Full battery green at the version commit
1509-
# A PR or queue build carries ci.yml's FAST SET since #22998; the dogfood,
1510-
# temporal and console-pin legs run only on main's push, hourly and
1509+
# A PR or queue build carries ci.yml's FAST SET since #22998; the dogfood
1510+
# and temporal legs run only on main's push, hourly and
15111511
# dispatch runs. So "tested before a release" is read HERE, as a gate: the
15121512
# newest completed `schedule` or `push` runs of `CI` and `Lint & Type
15131513
# Check` whose head is the version commit or a first-parent ancestor of it

0 commit comments

Comments
 (0)