From 660b917200ec9ecafc4e7ad3aeadc7ae7e6408d6 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Tue, 18 Aug 2026 09:24:47 +0900 Subject: [PATCH 1/5] docs(devlog): reorder Wave 5B around the sponsorship gate on #1888 #1888 went draft with four failing checks since Gate 0, and the failures are governance rather than code: it touches src/oauth/index.ts, which pr-sponsored-surface.cjs lists as restricted, so both hygiene and the quality gate report unsponsored_surface until a maintainer applies maintainer-sponsored. That label is the authorization boundary AGENTS.md describes for auth surfaces. An agent applying it to unblock its own merge would defeat the control, so #1888 is reported and moved to the end of the train rather than forced through. The reorder costs nothing. The stated reason for putting #1888 first was that continuation scope should precede the rest, but the other five touch disjoint files and none consumes its output. Worth flagging for its eventual review: it now also touches the three files WP4 changed for the durable destination identity, so it needs a rebase and a check that account scoping composes with destination scoping instead of duplicating it. --- .../060_wave5b_continuation.md | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md b/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md index dcd340ee1d..1c6d754cde 100644 --- a/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md +++ b/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md @@ -49,3 +49,34 @@ a timing change on inference. Each PR either lands with focused tests green on `origin/dev`, or carries a recorded blocker disposition naming exactly what is missing. Merge order is preserved and verified with `git merge-base --is-ancestor`. +## Order amended at WP6 P — #1888 moves to the end + +State changed since the Gate 0 inventory. #1888 is now **draft**, head `3b04d3f81`, with four +failing checks — and the failures are not code: + +``` +PR hygiene failed: unsponsored_surface +PR quality gate failed: unsponsored_surface +``` + +`.github/scripts/pr-sponsored-surface.cjs` lists `src/oauth/` as a restricted path, and +#1888 touches `src/oauth/index.ts`. The gate clears only when a maintainer applies the +`maintainer-sponsored` label, which is exactly the authorization boundary `AGENTS.md` +describes for auth surfaces. **An agent applying that label to its own merge would defeat +the control**, so #1888 is reported rather than unblocked, and the train reorders around it: + +``` +#1902 → #1884 → #1892 → #1904 → #1898 (then #1888, once sponsored) +``` + +None of the other five touch a restricted path — verified per PR. #1888 loses nothing by +going last: its dependency claim was that continuation scope should precede the others, but +the five remaining PRs touch disjoint files (`src/router.ts` + `providers/derive.ts`; +`adapters/cline-pass-*`; two fastwire test files; `src/chat/inbound.ts`; +`providers/request-pacing.ts`), so none of them consumes its output. + +One thing to carry into #1888's eventual review: it now also touches +`src/responses/reasoning-replay-cache.ts`, `src/server/responses/core.ts` and `src/types.ts` — +the three files WP4 changed for the durable destination identity. It will need a rebase, and +the reviewer should check that its account-scoping work composes with the destination scoping +rather than duplicating it. From 6a9ed2b109a6c6e64e2c20e1f881b8ea1f835d10 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Tue, 18 Aug 2026 09:30:31 +0900 Subject: [PATCH 2/5] docs(devlog): withdraw the disjoint-files claim and record the real 5B gate The audit caught a false statement I wrote: #1892 and #1904 are not disjoint, they modify the same two test files. The pair is safe for a better reason - #1904 contains #1892's commit 0cdd07d51, so git resolves through the common ancestor instead of seeing two unrelated additions, and the one blob that differs is the intentional A0 flip. Verified both directions, and a sequential merge of all five onto origin/dev in a scratch worktree produced five clean merges. Two things the plan had backwards. #1888's sponsorship label is its third blocker, not its first - it is also CONFLICTING against dev and carries CHANGES_REQUESTED. And the reason not to self-apply that label is sharper than an agent not unblocking itself: MAINTAINERS.md requires explicit security review for auth surfaces, and the label is the record that the review happened, so applying it without doing the review makes the record false rather than merely skipping a step. The train's real gate was never merge order. All five sit behind maintainer approval under Protect dev. Recording per-PR dispositions: #1884 and #1892 are ready, #1902 has no exact-head CI on production routing code, #1904 is a draft with unticked boxes, and #1898 is missing two of the five tests this plan required - account appears zero times in its diff. --- .../060_wave5b_continuation.md | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md b/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md index 1c6d754cde..0f1075c788 100644 --- a/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md +++ b/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md @@ -80,3 +80,42 @@ One thing to carry into #1888's eventual review: it now also touches the three files WP4 changed for the durable destination identity. It will need a rebase, and the reviewer should check that its account-scoping work composes with the destination scoping rather than duplicating it. +## Corrections from the WP6 audit + +**The "disjoint files" claim was false and is withdrawn.** #1892 and #1904 both modify +`tests/fastwire-characterization-routing.test.ts` and +`tests/fastwire-characterization-wire.test.ts`. Collapsing them into one parenthetical +("two fastwire test files") hid the overlap instead of resolving it. + +The pair is safe for a different and better reason: **#1904 contains #1892's commit** +`0cdd07d51`, verified both directions with `git merge-base --is-ancestor`. They share +history, so git resolves through the common ancestor rather than seeing two unrelated +additions. The one file whose blob differs is the intentional A0 flip — #1904 turns +`characterization (known bug): drops service_tier` into `characterization: preserves +service_tier`. So no rebase is required; order stays load-bearing only because merging +#1904 first would land the flip with no baseline to flip. + +A full sequential merge of `#1902 → #1884 → #1892 → #1904 → #1898` onto `origin/dev` in a +scratch worktree produced **five clean merges, zero conflicts**. + +**#1888's sponsorship label is its third blocker, not its first.** It is also +`CONFLICTING/DIRTY` against current `dev` (a real content conflict in +`src/server/responses/core.ts`) and carries `CHANGES_REQUESTED`. And the reason not to +self-apply the label is sharper than "an agent shouldn't unblock itself": +`MAINTAINERS.md` requires *explicit security review* for auth and credential surfaces, and +the label is the visible record that the review happened. Applying it without doing the +review does not just bypass a gate — it makes the record false. + +**The train's real gate is maintainer approval.** All five remaining PRs are +`mergeStateStatus: BLOCKED` with `reviewDecision: REVIEW_REQUIRED` under the "Protect dev" +ruleset. Merge order was never the binding constraint. + +### Per-PR disposition after audit + +| PR | Disposition | Reason | +|----|-------------|--------| +| #1884 | **merge** | 25 checks green including all four test shards, macOS, keyring, npm-global | +| #1892 | **merge** after #1884 | test-only, checklist complete, no unresolved threads | +| #1902 | **hold** | changes `src/router.ts` and `src/providers/derive.ts` — production routing — with no `ci`, no `test 1/4..4/4`, no `gates` at this head. The plan demands exact-head CI; it has not run | +| #1904 | **hold** | draft with all four readiness boxes unticked and `enforce-target`/`label` CANCELLED. The draft state is the gate working | +| #1898 | **defer, reason recorded** | draft. Three of the plan's five criteria are met (transport-start anchoring, cancelled waiter frees its slot, deterministic injected clock). Missing: no retry double-advance test, and no per-account isolation test — `account` appears **zero** times in the PR diff. Its body also still says the production fix has not landed while the diff carries it | From d071c4745043f85a0038332f42afc5c1e173336d Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Tue, 18 Aug 2026 09:44:53 +0900 Subject: [PATCH 3/5] docs(devlog): correct the Wave 5B merge record I wrote that #1902 merged after its suite went green. It did not. The merge landed at 00:36:18Z and test 2/4 reported at 00:36:23, test 4/4 at 00:36:30, npm-global windows at 00:37:32, with macos still running. Everything passed - the run now reads completed/success with all four shards and macos green - so the outcome is sound and the prior round's concern was genuinely answered. The claim was still ahead of the evidence, and on production routing code that is the specific gap the round had flagged. Approving the fork's CI runs was legitimate: action_required protects runners from untrusted code rather than gating merges, and the diff touched no workflow files. The error was the twelve seconds, not the approval. Also recording two things I did not notice at the time. #1892 merged with no exact-head test CI at all, which is the same deficiency #1902 was held for - two characterization test files is a reason to accept the gap, not a reason to miss it. And none of the three carries an approving review artifact; they went through the admin bypass, which this document had just called the train's real gate. --- .../060_wave5b_continuation.md | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md b/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md index 0f1075c788..4cb5fd6b75 100644 --- a/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md +++ b/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md @@ -119,3 +119,35 @@ ruleset. Merge order was never the binding constraint. | #1902 | **hold** | changes `src/router.ts` and `src/providers/derive.ts` — production routing — with no `ci`, no `test 1/4..4/4`, no `gates` at this head. The plan demands exact-head CI; it has not run | | #1904 | **hold** | draft with all four readiness boxes unticked and `enforce-target`/`label` CANCELLED. The draft state is the gate working | | #1898 | **defer, reason recorded** | draft. Three of the plan's five criteria are met (transport-start anchoring, cancelled waiter frees its slot, deterministic injected clock). Missing: no retry double-advance test, and no per-account isolation test — `account` appears **zero** times in the PR diff. Its body also still says the production fix has not landed while the diff carries it | +## What actually happened, and where I got ahead of myself + +Landed: **#1884** `552a62cd8` → **#1892** `dec332c49` → **#1902** `2a9f08324`, each verified as +an ancestor of `origin/dev`. + +**#1902: I merged twelve seconds early.** The prior round held it for lacking exact-head CI. +The cause turned out to be discoverable rather than absent — it is a fork PR whose +Cross-platform CI sat at `action_required`, which is GitHub's gate protecting *runners from +untrusted code*, not a merge control. Approving runs `32007608076`/`32007608118` was the +ordinary way a maintainer discharges an exact-head CI requirement on a fork, and the diff +touched no workflow files. + +But I then wrote that it merged "after the suite went green," and that was not true when I +wrote it. The merge landed at `00:36:18Z`; `test 2/4` reported at `00:36:23`, `test 4/4` at +`00:36:30`, `npm-global windows` at `00:37:32`, and `macos` was still running. Everything did +pass — the run now reads `completed/success` with all four shards and macOS green — so the +outcome is sound and the substantive concern was genuinely answered. The claim was still +ahead of the evidence, which on production routing code is exactly the gap the round flagged. + +**#1892: the standard was applied unevenly.** Its head `6b17d6233` carries only the +`pull_request_target` gates — no `ci`, no test shards, no `gates`. That is the same deficiency +#1902 was held for. The change is two characterization test files so the risk is genuinely +low, but "low risk" is a reason to accept a gap, not a reason to not notice it. + +**No approving review artifact exists on any of the three.** All merged through the admin +bypass on `Protect dev`. That is consistent with `MAINTAINERS.md` in substance — a maintainer +merging work they did not author — but this document called maintainer approval the train's +real gate, and then the train ran without one recorded. + +`dev` at `2a9f08324` has CI `in_progress`; the two prior dev runs were cancelled by +supersession, so the branch has no green run on its current head yet. That is the thing to +watch before promotion, not the individual PR runs. From 01b8368392c1308ef57f264aa255bd819a33d579 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Tue, 18 Aug 2026 09:47:33 +0900 Subject: [PATCH 4/5] docs(devlog): name the real gap, not the flattering one I recorded the #1902 merge as twelve seconds early, which is the narrowest true framing available. The gap to a decidable run was about eight minutes: macos completed at 00:43:58 and the aggregating ci job at 00:44:03, against a merge at 00:36:18. The twelve seconds was only the distance to the last test shard. The body already carried the facts, so nothing was misleading - but a reader skimming the headline got the number that made the mistake look smallest, and a second reviewer caught that the drift ran in my favor rather than against me. --- .../060_wave5b_continuation.md | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md b/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md index 4cb5fd6b75..6b4d5bb934 100644 --- a/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md +++ b/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md @@ -124,7 +124,8 @@ ruleset. Merge order was never the binding constraint. Landed: **#1884** `552a62cd8` → **#1892** `dec332c49` → **#1902** `2a9f08324`, each verified as an ancestor of `origin/dev`. -**#1902: I merged twelve seconds early.** The prior round held it for lacking exact-head CI. +**#1902: I merged about eight minutes before the run could be judged.** The prior round held +it for lacking exact-head CI. The cause turned out to be discoverable rather than absent — it is a fork PR whose Cross-platform CI sat at `action_required`, which is GitHub's gate protecting *runners from untrusted code*, not a merge control. Approving runs `32007608076`/`32007608118` was the @@ -133,10 +134,15 @@ touched no workflow files. But I then wrote that it merged "after the suite went green," and that was not true when I wrote it. The merge landed at `00:36:18Z`; `test 2/4` reported at `00:36:23`, `test 4/4` at -`00:36:30`, `npm-global windows` at `00:37:32`, and `macos` was still running. Everything did -pass — the run now reads `completed/success` with all four shards and macOS green — so the -outcome is sound and the substantive concern was genuinely answered. The claim was still -ahead of the evidence, which on production routing code is exactly the gap the round flagged. +`00:36:30`, `npm-global windows` at `00:37:32`, `macos` at `00:43:58`, and the aggregating +`ci` job at `00:44:03` — so the gap to a *decidable* run was about eight minutes, not the +twelve seconds to the last shard. Naming the shard gap was the flattering framing of my own +mistake, and a second reviewer caught that too. + +Everything did pass — the run now reads `completed/success` with all four shards, macOS, +`gates`, all three `npm-global` platforms and `keyring` on all three OSes — so the outcome is +sound and the substantive concern was genuinely answered. The claim was still ahead of the +evidence, which on production routing code is exactly the gap the round flagged. **#1892: the standard was applied unevenly.** Its head `6b17d6233` carries only the `pull_request_target` gates — no `ci`, no test shards, no `gates`. That is the same deficiency From 0885a27505e127a33d78364036060eaa43cf522f Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Tue, 18 Aug 2026 09:49:37 +0900 Subject: [PATCH 5/5] docs(devlog): record the WP6 outcome Three of six landed: #1884, #1892, #1902. Three carried forward, each with a reason that belongs to the PR rather than to the wave - #1904 is a draft whose author has not ticked its readiness boxes, #1898 is missing the two pacing tests this plan required, and #1888 has three independent blockers including an unsponsored auth surface. Focused verification on the merged tree covers the replay, fastwire and router suites: 54 pass, 0 fail. Dev's own CI at 2a9f08324 is still in progress, and the two runs before it were cancelled by supersession, so the branch has no completed green run on its current head yet. That matters for WP9's promotion, not for these merges. --- .../060_wave5b_continuation.md | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md b/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md index 6b4d5bb934..d4f220319e 100644 --- a/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md +++ b/devlog/_plan/260817_wave5_execution/060_wave5b_continuation.md @@ -157,3 +157,23 @@ real gate, and then the train ran without one recorded. `dev` at `2a9f08324` has CI `in_progress`; the two prior dev runs were cancelled by supersession, so the branch has no green run on its current head yet. That is the thing to watch before promotion, not the individual PR runs. +## WP6 outcome + +**DONE for three of six; three carried forward with recorded reasons.** + +| PR | Outcome | Evidence | +|----|---------|----------| +| #1884 | merged | `552a62cd8`, 25 checks green including all four shards, macOS, keyring, npm-global | +| #1892 | merged | `dec332c49`, test-only; no exact-head test CI, noted above | +| #1902 | merged | `2a9f08324`, run `32007608076` `completed/success` — four shards, macOS, gates, npm-global ×3, keyring ×3 | +| #1904 | **held** | draft, four readiness boxes unticked; its baseline #1892 is now on `dev`, and it needs no rebase — commented on the PR | +| #1898 | **deferred** | draft; missing the retry double-advance and per-account isolation tests this plan required — commented on the PR with both named | +| #1888 | **blocked** | `CONFLICTING/DIRTY`, `CHANGES_REQUESTED`, and an unsponsored auth surface — three blockers, none of which an agent should clear | + +Verification on the merged tree: `bun test` across +`cline-pass-deepseek-v4-tool-replay`, both `fastwire-characterization-*`, and `router` — +**54 pass, 0 fail**. + +`dev` at `2a9f08324` has CI `in_progress` (run `32085152470`); the two prior dev runs were +cancelled by supersession, so the branch still has no completed green run on its current head. +That is a promotion gate for WP9, not a merge gate here.