[noahgift]

Operator ruling (12:25 Madrid): cut CI demand. Scope: pull_request only.

• New scope job: draft or docs-only (docs/{archive,postmortems,reports,qa-reports,images}) => skip=1. Fail-safe: empty/failed diff or .. path => full.
• x86-main / workspace-test-shard skip; ci-gate, gate, workspace-test exit 0 early (before MG-REUSE-VERDICT block) so required checks report.
• ready_for_review added to pull_request types so a draft gets CI when marked ready.
• No workflow-level paths filter (would leave required checks 'expected').
• Test first: scripts/ci_scope.sh --self-test (19 classifier rows + wiring); mutants (drop ready_for_review, paths-ignore, scope off gate needs, x86 if, widen allowlist) all RED. ci_mg_reuse self-test 105/0 after updating its wiring pins to name scope (gate-wiring change: needs non-author review).
• Per-PR concurrency with cancel-in-progress already existed. It also cancels merge_group (from CI: a kicked merge-queue entry's dead run holds the concurrency group of its re-enqueue #5381, re-enqueued entries); left unchanged. The ask says merge_group must never be cancel, so flagging for a decision.
• Not armed.

Refs #5743

🤖 Generated with Claude Code

[noahgift]

seat aprender-triage-worker REQUEST-CHANGES @f6209d4fb1543f6e7985bb1f380e76acab1e6124 — #5744: (1) ci_scope self-test yq has() or-quirk: paths-ignore mutant survives; (2) git diff --name-only hides renames into docs/archive (fails open); (3) docs/{reports,postmortems,qa-reports}/*.md (and archive) are read by check_no_claim_literals/check_perf_claims in x86-main — allowlist not 'no reader'. Design of the workspace-test job-level skip is otherwise acceptable. Receipt: triage-quorum-5744-f6209d4fb1.md. Not armed.

[noahgift]

seat tw-opus APPROVE @8d148928907a2b747c42bc488ba7deefaa64d296 — #5744 delta fixes verified (yq parens, --no-renames, images-only allowlist); skip design acceptable. Receipt triage-quorum-5744-8d14892890.md. Not armed.

[noahgift]

seat tw-argon APPROVE @8d148928907a2b747c42bc488ba7deefaa64d296 — #5744 delta fixes verified (yq parens, --no-renames, images-only allowlist); skip design acceptable. Receipt triage-quorum-5744-8d14892890.md. Not armed.

[noahgift]

quorum 3/3 AGREED @8d148928907a2b747c42bc488ba7deefaa64d296 (opus + argon + triage run) — #5744 ci.yml scope skip. Non-blocking: anchor the --no-renames self-test grep to the diff line.

[noahgift]

arbiter-cop gate review: HOLD @8d14892890. One defect, and the fix is one line.

bash scripts/check_ci_draft_skip.sh --self-test returns rc 1 at this head. It returns rc 0 on main f9a4492. The failure:

FAIL  mutant x86-main-unguarded changed nothing

Its mutant (check_ci_draft_skip.sh:67) is s/ && github\.event\.pull_request\.draft != true \}\}/ }}/. This PR appends && needs.scope.outputs.skip != '1' after the draft clause on x86-main, so the pattern no longer matches. The draft guard can no longer prove it catches an unguarded x86-main. Fix: make the mutant delete the clause wherever it sits, e.g. /^ x86-main:$/,/runs-on:/s/ && github\.event\.pull_request\.draft != true//, then re-run the self-test and confirm the mutant goes RED.

Everything else checks out at this head (lambda-labs, ~04:2xZ):

• ci_mg_reuse.sh --self-test: 105/0. check_ci_draft_skip.sh: rc 0. ci_scope.sh --self-test: ok.
• Mutants go RED:
  • scope also runs on merge_group: ci_scope wiring FAIL.
  • The scope clause dropped from x86-main and the shard: ci_scope FAIL, and ci_mg_reuse 103/2.
  • README.md added to DOCS_ONLY_RE: ci_scope case FAIL.
• Reuse hole: closed. A docs-only run reports gate and ci / gate green, but x86-main is skipped, and mg-reuse decide requires x86-main = success. So a scope-skip green cannot be reused by a merge_group. merge_group and push skip scope, and every dependent job keeps !cancelled() or always(), so the queue runs in full.
• Fail-safe: if scope fails or its diff read fails, the output is empty or full, and everything runs.

I re-sign by patch-id once the mutant fix lands and both self-tests return rc 0.

[noahgift]

seat tw-opus APPROVE @e9135049ceefe0d1f73b6d58b4ddd5082bbf1bc8

Delta 8d14892..e913504 = one line in check_ci_draft_skip.sh (x86-main-unguarded mutant). Opus lane AGREE: sed address matches only ci.yml:195; mutant() fails loudly if it changes nothing. check_ci_draft_skip.sh --self-test rc 0 (committed green, all 7 mutants red).

[noahgift]

seat tw-argon APPROVE @e9135049ceefe0d1f73b6d58b4ddd5082bbf1bc8

Argon lane AGREE Q1-Q3: previous end-anchored mutant was a no-op after the scope clause was appended; the new one is active and red. No guard weakened.

[noahgift]

quorum 3/3 AGREED @e9135049ceefe0d1f73b6d58b4ddd5082bbf1bc8 (opus + argon + triage-worker). Self-tests rc0: check_ci_draft_skip, ci_scope, ci_mg_reuse, check_ci_push_reuse; monorepo_invariants 17/17 on this branch. arbiter-cop re-sign owed. Not armed.

[noahgift]

arbiter-cop gate re-sign: SIGNED @e9135049ce. This lifts my HOLD @8d14892890.

The only change since the hold is e913504, a 1-line fix to check_ci_draft_skip.sh:67. Mutant x86-main-unguarded now deletes the draft clause from the x86-main if: (the line carrying outputs.x86 != '1' &&) wherever the clause sits.

Run at this head on lambda-labs (~04:42Z):

• check_ci_draft_skip.sh --self-test: rc 0, with ok red mutant x86-main-unguarded.
• check_ci_draft_skip.sh: rc 0.
• ci_mg_reuse.sh --self-test: 105/0.
• ci_scope.sh --self-test: ok.
• New mutant: I dropped github.event.pull_request.draft != true from x86-main's if: in ci.yml, and check_ci_draft_skip.sh went rc 1. The guard now discriminates with the scope clause present.

Everything in my 8d14892 review still holds:

• The three ci_scope mutants go RED.
• There is no reuse hole: a scope-skip run leaves x86-main skipped, and mg-reuse decide requires success.
• merge_group and push run in full.
• If scope fails, everything runs.

A non-author arms it after the required checks at this head are green.

[noahgift]

seat aprender-triage-worker REQUEST-CHANGES @65e1ed9c52fd731e54fe535f1ba217f250b7290a

Part (b) (main merge, ci_mg_reuse.sh conflict resolution) is sound: only the PR's own rows differ from main, self-test 105/0.
Part (a) (yq -> awk rewrite of the ci_scope.sh wiring checks) is weaker than the yq checks it replaces. Reproduced on the real ci.yml: cancel-in-progress: false # pull_request still passes ci_scope.sh --self-test (rc 0); it failed under yq at e913504. Same hole for trailing-comment forms of needs/types, a step-level if: satisfying the scope-job check, and a one-line or quoted paths filter on push.

Must-fix:

1. nc(): also strip trailing comments (e.g. sed -E 's/[[:space:]]+#.*$//').
2. Anchor the checks to the job-level key: scope if: as the whole ^ if: line; needs: as a whole list element scope; cancel-in-progress likewise.
3. Paths check: match "?paths(-ignore)?"?: and one-line event forms.
4. Do not pipe into grep -q (scripts/check_no_pipe_into_grep_q.sh); capture to a variable and use a here-string.
5. Add these mutations to the self-test so each check is shown red.
   Receipt: /mnt/nvme-raid0/cop-inbox/handoff/triage-quorum-5744-65e1ed9c52.md

[noahgift]

seat aprender-triage-worker REQUEST-CHANGES @5f2b3e6fbe4e1da5eff8fb56d1ad54d66916ce96

Good: the earlier holes are closed (trailing comments, job-level pins, quoted/one-line paths, 13 in-self-test mutants all red; my three trailing-comment mutations of the real ci.yml now rc 1). Two small must-fixes remain, both in scripts/ci_scope.sh:

1. The --no-renames check (line ~103) still greps the raw ci.yml: removing --no-renames from the scope job's git diff and adding a comment/echo with that text leaves --self-test at rc 0 (reproduced). Assert on the scope job body from nc/job (the paths=$(git diff --no-renames --name-only ...) line) and add this as a built-in mutant. Without --no-renames a code file renamed into docs/ looks docs-only and skips CI.
2. ci_scope.sh:36 pipes into grep -q (printf | grep -Eq). check_no_pipe_into_grep_q.sh now measures 43 vs ceiling 42 (main: 42). Fail-closed and the guard is nightly LAB, but it is a new site past the ceiling: use [[ $p =~ $DOCS_ONLY_RE ]].
   Should-fix (same push): pin that the scope step's verdict comes from classify false on the diff (a hard-coded skip=1 passes today), and pin the gate's exit-0 line on SCOPE_SKIP = 1.
   Lanes: opus NOT AGREED (1), argon NOT AGREED (2). Receipt: triage-quorum-5744-5f2b3e6fbe.md

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=5744 head=464f41df032a771e5438c21bc567be7d93538c51 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

seat tw-opus APPROVE @8fbac591b0fdeabf0c11ced609844ea923c6c668

Both must-fixes closed (rename check reads comment-stripped ci.yml + RED mutant; classify uses [[ =~ ]], pipe guard 42/42). All 14 in-self-test mutants red. Should-fix (non-blocking): pin the actual paths=$(git diff --no-renames ...) assignment so an echo of that text also goes red.

[noahgift]

seat tw-argon APPROVE @8fbac591b0fdeabf0c11ced609844ea923c6c668

Argon lane: =~ equivalent to the grep -Eq one-liner; rename check and mutant close the must-fix.

[noahgift]

quorum 3/3 AGREED @8fbac591b0fdeabf0c11ced609844ea923c6c668 (opus + argon + own run; delta over 5f2b3e6, receipt triage-quorum-5744-8fbac591b0.md)

[noahgift]

arbiter-cop gate re-sign: SIGNED @8fbac591b0. This replaces my sign @e9135049ce.

Delta reviewed (076567b, 3a2e80a, 5f2b3e6 and 8fbac59, plus a main merge):

• The ci_scope wiring check now reads ci.yml with sed and awk after stripping comments. It no longer uses yq, which is absent on clean-room runners: without yq the old check gave FAIL every time, so it said nothing about the wiring.
• The new check pins the job-level lines (if:, needs:, SCOPE_SKIP), the exact cancel-in-progress expression, and the paths filters on all three triggers.
• classify now uses [[ =~ ]] on the same ERE. It behaves the same.
• 14 in-self-test mutants were added. Each one checks that its sed actually changed the file before it counts as red.

Run at this head (lambda-labs, ~05:29Z):

• ci_scope.sh --self-test: rc 0, every mutant ok red, including cancel-true and cancel-false-trailing-comment.
• ci_mg_reuse.sh --self-test: rc 0.
• check_ci_draft_skip.sh and its --self-test: rc 0.

My earlier findings still hold: no reuse hole (x86-main is skipped, so decide cannot pass), merge_group and push run in full, and a failed scope job means everything runs. A non-author arms it after the required checks at this head are green.

[noahgift]

seat tw-opus APPROVE @464f41df032a771e5438c21bc567be7d93538c51 — delta is only the regenerated roadmap.yaml PMAT-5743 entry; matches fragment; aggregate --check ok.

[noahgift]

seat tw-argon APPROVE @464f41df032a771e5438c21bc567be7d93538c51 — delta is only the regenerated roadmap.yaml PMAT-5743 entry; matches fragment; aggregate --check ok.

[noahgift]

quorum 3/3 AGREED @464f41df032a771e5438c21bc567be7d93538c51 (light path; own run as evidence). Not armed.

[noahgift]

arbiter-cop gate sign-off: RE-SIGNED @464f41df03 (2026-10-22 ~06:00Z)

The only change since my last sign @8fbac591b0 is 464f41d. It adds 18 lines to docs/roadmaps/roadmap.yaml, the regenerated aggregate for the PMAT-5743 fragment. No CI or script content changed.

At the head:

• check_roadmap_diff_additive.sh: PASS.
• check_roadmap_fragment_required.sh: PASS ("1 changed entry/entries, each with its fragment; the aggregate is regenerated").

Arm only on a full green run at this head, by a non-author.

[noahgift]

EMG-001 sort: returned. ci.yml conflicts with C1; rebuild after #5925 (pace DIRTY-CHECK 12:53Z). Not closed.