[Decision] Merge queue: should the three Dogfood Regression Gate shards run on merge_group, so a dogfood red stops a PR before main instead of after?

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Ruled: 6663883327 · letter B · 2026-11-05T16:47Z

Filing gate: a decision card the maintainer asked for in the triage session (「开决策卡合并队列要不要跑 dogfood 分片」, 2026-11-05). ⛔ Not a claim. Grade p1: every dogfood red it would catch is a main red (p0) today.

维护者速读

问题：合并队列（merge_group）只跑快档，三个 Dogfood Regression Gate 分片只在 main 的 push、4 小时全量和手动全量里跑。所以一个会打红 dogfood 的 PR 能顺利合进 main，合进去之后才红。
代价：10-22 以来 dogfood 引起的 main 红 p0 有 9 张：dogfood: main's Dogfood Regression Gate (1/3) and (3/3) are red since #26361 — the authz census still pins rest-route-ledger.ts at 80 rows and rest-server.ts this.routeManager.register at 62; #26361 made them 81 and 63 #26400、dogfood: packaged-action-disabled-dispatch-live picks an unordered showcase_task?$top=1; when that seed task is already done, acceptance[0] fails and acceptance[5] cascades (main push red 21:56Z and 22:08Z) #26952、main red (Dogfood Regression Gate 1/3) since 21c4bdd8 (#27667): two dogfood pins still expect a code-less hook refusal after HOOK_ABORTED landed #27806、main red (Dogfood Regression Gate 3/3) since 3e0fd7a8 (#27964): the api-action door dogfood pin still expects sys_metadata_activation in the disabled-action sentence that #27842 rewrote #28082、main red: Dogfood Regression Gate — GET /packages/:id/customizations is ledgered but not mounted (#28595), so the route 404s at runtime #28622、main red: Dogfood Regression Gate fails on main since #29365 (dfbe34d8) — flow-runas and declarative-endpoint-anonymous-guest dogfood files #29426、main red: Dogfood Regression Gate (2/3) fails signup-organization-census.dogfood.test.ts since PR #29975 (a7293f74) — the test reads the verification-mail row the sign-up now writes after its response #29991、main red: Dogfood Regression Gate (2/3) fails update-by-id-refusal-order after PR #30165 #30198、main red: Dogfood Regression Gate (2/3) fails permission-set-clone-door after PR #30222 (member_default grants sys_comment) #30255。今天一天就有两张，main red: Dogfood Regression Gate (2/3) fails update-by-id-refusal-order after PR #30165 #30198 和 main red: Dogfood Regression Gate (2/3) fails permission-set-clone-door after PR #30222 (member_default grants sys_comment) #30255/4-hourly full run: red on main (CI) #30274。每张都要一轮定位、修复或回滚，红着的时候所有在飞 PR 都跟着受影响。
要你选：A 保持现状，B 合并队列也跑这三个分片，C 只在改动触及 dogfood 范围时跑。我倾向 B。

Facts (read at `main` `df4c06e6`)

.github/workflows/ci.yml, "THE TWO SPEEDS (skills(ci): two-speed CI — fast set on PR and merge-queue runs, full battery hourly on main and before a release, main-red stops the lane, four required contexts plus the guard, timing gates report-only, test budgets not deletions #22998)": a pull_request or merge_group run carries the fast set (Build Core, Test Core affected-only, Build Docs). main's push, the 4-hourly schedule and workflow_dispatch carry the full battery. That is the fast set plus temporal-conformance, dogfood (three shards), dogfood-verify and ui-published-artifacts.
The dogfood job's if: denies both per-PR events: github.event_name != 'pull_request' && github.event_name != 'merge_group'. The required Dogfood Regression Gate context comes from dogfood-gate (if: always()). With both legs skipped it counts zero attestations and concludes success, so the queue sees it green without running it.
A shard is ~5 min on a 4-vCPU runner, timeout-minutes: 30, and the three run in parallel.
Today, merge-queue entries take ~12–30 min from start to finish, and the Actions queue holds ~55 queued runs.

Options

A. Keep it as is (skills(ci): two-speed CI — fast set on PR and merge-queue runs, full battery hourly on main and before a release, main-red stops the lane, four required contexts plus the guard, timing gates report-only, test budgets not deletions #22998). The queue stays fast, and a dogfood red keeps landing on main and being caught by the next push or full run. That is the current p0-and-revert cycle.
B. Run the three dogfood shards on merge_group too. Drop merge_group from the dogfood job's deny list only; pull_request keeps the fast set. A dogfood red then ejects the PR from the queue instead of reaching main. Cost: +3 runner jobs per queue entry, about +100 jobs per 4 hours at today's rate, on an Actions pool that is already congested. Wall time should grow little, because the shards run in parallel with Test Core. That is to be measured after the change, not assumed. dogfood-verify, temporal-conformance and ui-published-artifacts stay off the queue unless you say otherwise.
C. Run them on merge_group only when the diff can reach them. This adds an affected-only filter for dogfood to the filter job. It costs less than B per entry, but it is new dev work, and a wrong filter silently skips the gate, which is the failure direction skills(ci): two-speed CI — fast set on PR and merge-queue runs, full battery hourly on main and before a release, main-red stops the lane, four required contexts plus the guard, timing gates report-only, test budgets not deletions #22998 warns against.

Triage lean: B

It moves an existing gate one step earlier rather than adding a new gate (the standing rule 「新增门禁默认否」 is about new gates). Nine main reds in two weeks cost more than three parallel ~5-min jobs per entry. If runner load becomes the bottleneck, C can follow as its own card.

After the ruling

B or C goes to domain:devx as a card: the ci.yml change, the THE TWO SPEEDS comment and check:shard-attestation read together, and a measured before and after of queue wall time.
A closes this card with the ruling recorded.

Refs: #22998, #30274, #30198, #30255

Ruling: batch 2026-11-05/1 item 4 · #30461 · letter B · maintainer 「29029 29425 29918 30461 29466 同意」 2026-11-05T16:47:09Z

thread · os-elon-musk · session_016WV4cxaQxzxGCx9xsyjVWu · written 2026-11-05T17:05Z

The maintainer answered batch 1 of the 总监决裁 presentation in the project thread (five cards, one recommendation each) with 「29029 29425 29918 30461 29466 同意」, read as the recommended letter on every card. Presentation: /mnt/project-files/director-batch/2026-11-05-batch-1.md (project files). ⛔ Not a claim.

What the ruling binds

B: the three dogfood shards run on merge_group. Only merge_group leaves the dogfood job's deny list. pull_request keeps the fast set (skills(ci): two-speed CI — fast set on PR and merge-queue runs, full battery hourly on main and before a release, main-red stops the lane, four required contexts plus the guard, timing gates report-only, test budgets not deletions #22998). A dogfood red then ejects the PR from the queue instead of reaching main.
dogfood-verify, temporal-conformance and ui-published-artifacts stay off the queue.
This moves an existing gate earlier. It adds no gate. Not C: an affected-only dogfood filter that is wrong skips the gate silently. If queue wall time becomes the bottleneck, C may follow as its own card.

Workload of the letter

domain:devx, one PR. The change is the if: of the dogfood job in .github/workflows/ci.yml (today line 2395 at b17dbcf2), plus the THE TWO SPEEDS comment and the check:shard-attestation reading, read together. .github/workflows/** is governed (Tier H). Precedent: #25867 added merge_group for the ui outputs. The PR and this card record merge-queue wall time over 24 hours before and after the change.

Execution

The domain:devx seat files or claims the card; label strokes are the lane seat's.

Generated by Claude Code

domain:devx#2 · marchtian · session_017ihL2ebbZkr2QAEG1x7UC8

Written 2026-11-05T17:01Z.

Ruling-ref: 6663883327

Out of the decision box on ruling B, into pm:queue for domain:devx. ⛔ Not a claim: the devx seat is at its ceiling (2/2), so the next free slot claims it. Work as ruled: the if: of the dogfood job in .github/workflows/ci.yml lets merge_group through (only that event leaves the deny list), with the THE TWO SPEEDS comment and the check:shard-attestation reading updated together; pull_request keeps the fast set. Tier H, precedent #25867. The PR and this card record merge-queue wall time over 24 hours before and after.

domain:devx#2 · marchtian · session_017ihL2ebbZkr2QAEG1x7UC8

Claim: PM loop round 1
Session: session_017ihL2ebbZkr2QAEG1x7UC8
Account: marchtian
Branch: claude/issue-30461-dogfood-merge-group
Worktree: objectstack-issue-30461
Domain: domain:devx
Seat: domain:devx#2
Ruling-ref: 6663883327
File surface: .github/workflows/ci.yml — the if: of the dogfood job (line 2395 at origin/main 6701c08a44) lets merge_group through while pull_request stays denied, plus THE TWO SPEEDS comment (line 116) and every comment that restates the dogfood deny list; the check:shard-attestation reading and any repo gate whose roster names which jobs run on merge_group (required contexts, expected skips, CI filter parity), changed only as far as this one move requires. ⛔ dogfood-verify, temporal-conformance and ui-published-artifacts stay off the queue; no affected-only dogfood filter (letter C is not ruled).
Container & model: M, mode:subagent, model: default tier, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — CI workflow (Tier H, governed); hand-off to os-zhuang + hotlong after ACCEPT + contract review PASS
Thread-read: 6664079672
Premise: holds (the dogfood job's if: at 6701c08a44 still denies both pull_request and merge_group; precedent #25867 added merge_group for the ui outputs).
Serial constraints cleared: no open PR found that changes the dogfood job's if:; a later conflict on ci.yml is resolved by a merge of origin/main.
Measurement owed: merge-queue wall time over the 24 hours before (recorded in the PR) and the 24 hours after landing (recorded on this card before it closes).

domain:devx#2 · marchtian · session_017ihL2ebbZkr2QAEG1x7UC8
os-dev-report

{
 "change": {
  "pr": 30639,
  "head": "4bb48774cf",
  "branch": "claude/issue-30461-dogfood-merge-group",
  "draft": true,
  "labels": [
   "skip-changeset"
  ],
  "assignees": [],
  "reviewers": [],
  "ruling": "6663883327 letter B",
  "ci_yml_dogfood_if": "!cancelled() && needs.filter.outputs.core != 'false' && github.event_name != 'pull_request'",
  "unchanged_if": [
   "dogfood-verify",
   "temporal-conformance",
   "ui-published-artifacts"
  ],
  "needs_on_merge_group": "filter only; filter runs on every event and outputs core='true' on merge_group; nothing else widened",
  "gates_touched": {
   "scripts/pm/dispatch-gates.mjs": "jobIfReading refused a lone pull_request exclusion, which would drop the dogfood path population; it now strips it (exact spelling, last conjunct) and returns notOnPullRequest; the row clause names the merge-queue build as the first run",
   "scripts/pm/check-expected-skips.mjs": "pr-event reason says full battery only only when both events are excluded; the shards read as skipped on PR heads and answered by the merge-queue build",
   "scripts/check-required-contexts.mjs": "tombstone prose only; the registry is unchanged",
   "scripts/check-shard-attestation.mjs": "read, unchanged: reads no event; a full matrix beside a skipped CLI leg already judges green"
  },
  "prose": [
   "ci.yml THE TWO SPEEDS",
   "ci.yml core output, dogfood, dogfood-gate comments",
   "release.yml full-battery",
   "upgrade-harness-optin.yml",
   "scripts/ci/scheduled-full-run.mjs HALF 3",
   "AGENTS.md Two speeds line",
   "docs/agents/multi-agent-discipline.md"
  ],
  "seat_decision_open": "Dogfood Regression Gate is outside the required set since #22998, so a queue red does not eject the entry; re-requiring it (ruleset + REQUIRED_CONTEXTS row) is not ruled and was not made; no gate forced it"
 },
 "gates": {
  "head": "4bb48774cf",
  "derived": 80,
  "run": 80,
  "exit_0": 80,
  "not_measured": 0,
  "unrun": 0,
  "ran_verdict": "dispatch-gates --ran: 80 derived famil(ies) accounted for, 80 run, 0 NOT-MEASURED (a DERIVED zero)",
  "pre_merge_head": "57fd195a35",
  "exit_3_then_built_then_0": [
   "check:doc-formula-expressions",
   "check:dts-closure",
   "check:dual-build-cjs-loads",
   "check:lean-entry-closure"
  ],
  "red_then_fixed": {
   "check:pm-skill-ratchet": "AGENTS.md L514 123B over the 120B budget; rewrapped in c029b25517, exit 0"
  },
  "own_suites": {
   "node scripts/pm/dispatch-gates.mjs --self-test": "2240 cases pass (fast 1951 + slow 289)",
   "pnpm check:pm-expected-skips": "209 cases pass"
  },
  "build": "pnpm build under os-verify-lock, VERDICT command-exit 0, after the merge",
  "ci_check_runs": "in_progress at report time",
  "dogfood_battery": "n/a: no ! in the title and no (narrowing) arm"
 },
 "files_changed": [
  ".github/workflows/ci.yml",
  ".github/workflows/release.yml",
  ".github/workflows/upgrade-harness-optin.yml",
  "AGENTS.md",
  "docs/agents/multi-agent-discipline.md",
  "scripts/check-required-contexts.mjs",
  "scripts/ci/scheduled-full-run.mjs",
  "scripts/pm/check-expected-skips.mjs",
  "scripts/pm/dispatch-gates.mjs",
  "scripts/pm/dispatch-gates.self-test.mjs"
 ],
 "queue_wall_time_before": {
  "window_start": "declared under the fence",
  "read_at": "declared under the fence",
  "base": "origin/main 6701c08a44",
  "query": "gh api -X GET repos/objectstack-ai/objectstack/actions/workflows/ci.yml/runs?event=merge_group&created=%3E%3DWINDOW_START&per_page=100&page=1..4; duration = updated_at - run_started_at",
  "listed": 306,
  "in_progress": 3,
  "completed_all": {
   "n": 303,
   "median_min": 20.5,
   "p90_min": 26.0,
   "max_min": 32.8
  },
  "success": {
   "n": 285,
   "median_min": 20.4,
   "p90_min": 25.8
  },
  "failure": {
   "n": 18,
   "median_min": 21.9,
   "p90_min": 26.7
  },
  "critical_path_60_newest_success": {
   "Test Core_closes": 38,
   "Test UI_closes": 11,
   "Lint UI_closes": 10,
   "Test Core_close_median_min": 20.8,
   "Test Core_close_p90_min": 25.9
  },
  "dogfood_shards_push_main_same_window": {
   "runs_read": 128,
   "read_502": 2,
   "shard": {
    "n": 282,
    "median_min": 11.4,
    "p90_min": 12.3,
    "max_min": 14.2
   },
   "Dogfood Verify CLI": {
    "n": 99,
    "median_min": 5.5,
    "p90_min": 8.3
   }
  },
  "after": "the seat's, 24 h after landing"
 },
 "deviations": [
  "AGENTS.md and docs/agents/multi-agent-discipline.md edited outside the claim's file surface: both restate the PR/queue battery split this PR changes",
  "PR body ends with the order's footer line, not AGENTS.md's session-URL footer form; the session id is in the body prose",
  "dogfood shard timings: 2 of 130 completed push runs' jobs reads answered HTTP 502 and are not in the sample"
 ],
 "mcp_calls": 0,
 "api_writes": {
  "count": 2,
  "endpoints": [
   "POST /repos/objectstack-ai/objectstack/dispatches (relay pr_create, PR 30639)",
   "POST /repos/objectstack-ai/objectstack/dispatches (relay comment, this report)"
  ],
  "git_push": 3
 },
 "filed_issues": []
}

Queue window start 2026-11-04T18:41Z, read 2026-11-05T18:41Z; this report written 2026-11-05T19:47Z.

domain:devx#2 · marchtian · session_017ihL2ebbZkr2QAEG1x7UC8

Ruling: #30461 follow-up · required set · letter A, in two steps · maintainer 「同意」 · 2026-11-05T21:26Z

Recorded by the lane seat. The maintainer answered 「同意」 at 2026-11-05T21:25Z to the recommendation in the project's analysis thread on whether Dogfood Regression Gate rejoins main's required set. Full analysis: /mnt/project-files/issue-30461/decision-analysis.md (project files). ⛔ Not a claim; the card stays claimed by domain:devx#2.

Why a follow-up was needed

Ruling 6663883327 (letter B) says a dogfood red ejects the entry from the queue. The merge queue only enforces the ruleset's required checks, and Dogfood Regression Gate has been outside that set since #22998. The live ruleset read on 2026-11-05T19:45Z lists ten contexts without it. So PR #30639 alone makes a dogfood red visible on the queue build but does not eject the entry.

What the ruling binds (A, in two steps; precedent #26460 for `Test UI`)

PR ci(dogfood): the three Dogfood Regression Gate shards run on merge_group #30639 lands as ruled under letter B. ⛔ No ruleset change in it.
The 24-hour after-landing reading this card already owes gains these items:
- the number of queue-build entries that ran dogfood, and whether the shards ran;
- each dogfood red, classed as (a) that entry's own regression, (b) a flake, or (c) inherited from an entry ahead of it;
- confirmation that on merge_group, Dogfood Regression Gate counts 3 credentials and judges Dogfood Verify CLI as skipped.
Threshold: at most one (b) and no environmental failure, and a queue median wall-time increase of at most 2 minutes. Then the lane reports to the maintainer, who adds Dogfood Regression Gate to main's ruleset. The lane lands the matching REQUIRED_CONTEXTS row the same day, as an XS follow-up PR that merges first, before the ruleset edit. If (b) is above one, the flaky test is fixed before the context is required.
Fuse: if, once required, flakes eject three or more entries in one day that are not the same real regression, the lane may revert ci(dogfood): the three Dogfood Regression Gate shards run on merge_group #30639. That brings the gate back to zero expected credentials and success, and unfreezes the queue without touching the ruleset. The lane fixes the flake at the same time.

The card therefore stays open after #30639 merges, until the step-3 report and the REQUIRED_CONTEXTS row land, or step 3 stops at a flake fix.

domain:devx#2 · marchtian · session_017ihL2ebbZkr2QAEG1x7UC8

Landed (step 1 of ruling 6669982756) · PR #30639 merged as 788715ef5c at 2026-11-05T22:38Z, enqueued by os-zhuang · recorded 2026-11-05T22:39Z.

The live proof is already in: this PR's own queue build (run 42120488623) ran Dogfood Regression Gate (1/3), (2/3) and (3/3), all success in 9–12 minutes. Dogfood Verify CLI skipped, and the Dogfood Regression Gate aggregate concluded success over the three credentials. The ruleset is unchanged, as ruled.

The card stays open and stays with domain:devx#2. It moves to pm:on-hold until the 24-hour reading, and the seat's slot is released in the meantime.

Restart-when: 24 hours after 2026-11-05T22:38Z (the #30639 merge), the seat reads the merge_group runs per ruling 6669982756 step 2 (entries, shards run, each dogfood red classed a/b/c, the gate's credential count, queue median vs the 20.5 min before-reading) and posts the step-3 verdict here

Navigation Menu

Repository navigation

[Decision] Merge queue: should the three Dogfood Regression Gate shards run on merge_group, so a dogfood red stops a PR before main instead of after? #30461

维护者速读

Facts (read at `main` `df4c06e6`)

Options

Triage lean: B

After the ruling

What the ruling binds

Workload of the letter

Execution

Why a follow-up was needed

What the ruling binds (A, in two steps; precedent #26460 for `Test UI`)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Decision] Merge queue: should the three Dogfood Regression Gate shards run on merge_group, so a dogfood red stops a PR before main instead of after? #30461

Description

维护者速读

Facts (read at main df4c06e6)

Options

Triage lean: B

After the ruling

Activity

objectstack-fleet commented on Nov 5, 2026

What the ruling binds

Workload of the letter

Execution

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

Why a follow-up was needed

What the ruling binds (A, in two steps; precedent #26460 for Test UI)

objectstack-fleet commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Facts (read at `main` `df4c06e6`)

What the ruling binds (A, in two steps; precedent #26460 for `Test UI`)