Release Conductor: stop recurring develop failures on missing queue report and disabled apply mode (#906) (#909)

* Keep release conductor proposal-only without queue evidence (#906)

* Run release conductor tests in validate lint job (#906)

---------

Co-authored-by: GitHub Copilot <copilot@users.noreply.github.com>

Author: svelderrainruiz

.github/workflows/release-conductor.yml

@@ -89,10 +89,14 @@ jobs:
 
           $eventName = '${{ github.event_name }}'
           $apply = $false
+          $conductorEnabled = ($env:RELEASE_CONDUCTOR_ENABLED -eq '1')
           if ($eventName -eq 'workflow_dispatch') {
             $apply = ('${{ inputs.apply }}' -eq 'true')
           } elseif ($eventName -eq 'workflow_run') {
-            $apply = $true
+            $apply = $conductorEnabled
+            if (-not $apply) {
+              Write-Host 'Release conductor apply mode disabled; workflow_run will remain proposal-only.'
+            }
           }
 
           if ($apply) {
@@ -131,4 +135,4 @@ jobs:
           path: |
             tests/results/_agent/release/release-conductor-report.json
             tests/results/_agent/policy/policy-state-snapshot.json
-          if-no-files-found: error
+          if-no-files-found: error

.github/workflows/validate.yml

@@ -153,6 +153,11 @@ jobs:
       run: |
         pwsh -File tools/PrePush-Checks.ps1
 
+    - name: Release conductor contract tests
+      shell: bash
+      run: |
+        node tools/npm/run-script.mjs priority:release:conductor:test
+
     - name: Policy guard (branch protection)
       if: ${{ github.event.repository.fork == false }}
       shell: pwsh

docs/DEVELOPER_GUIDE.md

@@ -342,6 +342,9 @@ For Docker/Desktop VI history validation, run fast-loop lanes explicitly:
   For queue-aware release proposals, run `node tools/npm/run-script.mjs priority:release:conductor -- --dry-run`.
   Apply mode requires `RELEASE_CONDUCTOR_ENABLED=1`; if signing material is unavailable, the conductor remains
   proposal-only and emits evidence without mutating tags.
+  Hosted `schedule` and `workflow_run` conductor lanes stay proposal-only when apply mode is disabled, and dry-runs
+  record advisory-only queue-evidence / no-recent-success diagnostics instead of failing for missing queue artifacts or
+  idle dwell windows.
   Use `node tools/npm/run-script.mjs priority:remediation:slo` to compute remediation SLO governance metrics
   (MTTD, route latency, MTTR by priority, reopen rate, queue/trunk/release signals) and emit
   `tests/results/_agent/slo/remediation-slo-report.json` plus governor state

docs/schemas/release-conductor-report-v1.schema.json

@@ -212,10 +212,11 @@
     "decision": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["status", "blockerCount", "blockers"],
+      "required": ["status", "blockerCount", "blockers", "advisoryCount", "advisories"],
       "properties": {
         "status": { "type": "string", "enum": ["pass", "fail"] },
         "blockerCount": { "type": "integer", "minimum": 0 },
+        "advisoryCount": { "type": "integer", "minimum": 0 },
         "blockers": {
           "type": "array",
           "items": {
@@ -227,8 +228,20 @@
               "message": { "type": "string" }
             }
           }
+        },
+        "advisories": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["code", "message"],
+            "properties": {
+              "code": { "type": "string" },
+              "message": { "type": "string" }
+            }
+          }
         }
       }
     }
   }
-}
+}

package.json

@@ -62,6 +62,7 @@
     "priority:queue:supervisor": "node tools/priority/queue-supervisor.mjs",
     "priority:queue:readiness": "node tools/priority/queue-readiness.mjs",
     "priority:review:signal": "tsc -p tsconfig.json && node dist/tools/priority/copilot-review-signal.js",
+    "priority:release:conductor:test": "node --test tools/priority/__tests__/release-conductor.test.mjs tools/priority/__tests__/release-conductor-schema.test.mjs tools/priority/__tests__/release-conductor-workflow-contract.test.mjs",
     "priority:validation:attestation": "tsc -p tsconfig.json && node dist/tools/priority/validation-agent-attestation.js",
     "priority:validation:broker": "node tools/priority/validation-approval-broker.mjs",
     "priority:validation:helper": "node tools/priority/validation-approval-helper.mjs",

tools/priority/__tests__/release-conductor-workflow-contract.test.mjs

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+
+test('release conductor workflow keeps workflow_run proposal-only when apply mode is disabled', async () => {
+  const workflowPath = path.join(repoRoot, '.github', 'workflows', 'release-conductor.yml');
+  const workflow = await readFile(workflowPath, 'utf8');
+
+  assert.match(workflow, /RELEASE_CONDUCTOR_ENABLED:\s+\$\{\{\s*vars\.RELEASE_CONDUCTOR_ENABLED \|\| '0'\s*\}\}/);
+  assert.match(
+    workflow,
+    /elseif \(\$eventName -eq 'workflow_run'\) \{\s+\$apply = \$conductorEnabled\s+if \(-not \$apply\) \{\s+Write-Host 'Release conductor apply mode disabled; workflow_run will remain proposal-only\.'\s+\}\s+\}/ms
+  );
+});

tools/priority/__tests__/release-conductor.test.mjs

@@ -196,6 +196,158 @@ test('runReleaseConductor blocks apply when release conductor flag is disabled',
   assert.equal(commandCalls.some((entry) => entry.command === 'git' && entry.args[0] === 'tag'), false);
 });
 
+test('runReleaseConductor keeps dry-run proposal-only when queue evidence is missing and no recent success exists', async () => {
+  const readJsonOptionalFn = async (filePath) => {
+    const normalized = String(filePath);
+    if (normalized.includes('queue-supervisor-report.json')) {
+      return {
+        exists: false,
+        error: null,
+        path: filePath,
+        payload: null
+      };
+    }
+    return {
+      exists: true,
+      error: null,
+      path: filePath,
+      payload: {
+        schema: 'priority/policy-live-state@v1',
+        generatedAt: '2026-03-06T10:00:00Z',
+        state: {}
+      }
+    };
+  };
+
+  const runGhJsonFn = (args) => {
+    if (args[0] !== 'api') {
+      throw new Error(`unexpected gh args: ${args.join(' ')}`);
+    }
+    return {
+      workflow_runs: [
+        {
+          id: 1,
+          status: 'completed',
+          conclusion: 'success',
+          updated_at: '2026-03-06T09:00:00Z'
+        }
+      ]
+    };
+  };
+
+  const { report, exitCode } = await runReleaseConductor({
+    repoRoot: process.cwd(),
+    now: new Date('2026-03-06T12:00:00.000Z'),
+    args: {
+      apply: false,
+      dryRun: true,
+      reportPath: 'tests/results/_agent/release/release-conductor-report.json',
+      queueReportPath: 'tests/results/_agent/queue/queue-supervisor-report.json',
+      policySnapshotPath: 'tests/results/_agent/policy/policy-state-snapshot.json',
+      repo: 'owner/repo',
+      stream: 'comparevi-cli',
+      channel: 'stable',
+      version: '0.8.0',
+      dwellMinutes: 60,
+      quarantineStaleHours: 24,
+      help: false
+    },
+    environment: {
+      GITHUB_REPOSITORY: 'owner/repo',
+      RELEASE_CONDUCTOR_ENABLED: '0'
+    },
+    runGhJsonFn,
+    runCommandFn: () => ({ status: 0, stdout: '', stderr: '' }),
+    readJsonOptionalFn,
+    writeReportFn: async (reportPath) => reportPath
+  });
+
+  assert.equal(exitCode, 0);
+  assert.equal(report.decision.status, 'pass');
+  assert.equal(report.release.proposalOnly, true);
+  assert.equal(report.gates.greenDwell.status, 'fail');
+  assert.equal(report.gates.queueHealth.status, 'fail');
+  assert.equal(report.gates.quarantine.status, 'fail');
+  assert.equal(report.decision.blockerCount, 0);
+  assert.ok(report.decision.advisories.some((entry) => entry.code === 'green-dwell-no-recent-success'));
+  assert.ok(report.decision.advisories.some((entry) => entry.code === 'queue-report-unavailable-dry-run'));
+});
+
+test('runReleaseConductor still blocks dry-run when the dwell window contains workflow failures', async () => {
+  const readJsonOptionalFn = async (filePath) => {
+    const normalized = String(filePath);
+    if (normalized.includes('queue-supervisor-report.json')) {
+      return {
+        exists: true,
+        error: null,
+        path: filePath,
+        payload: {
+          paused: false,
+          throughputController: { mode: 'healthy' },
+          retryHistory: {}
+        }
+      };
+    }
+    return {
+      exists: true,
+      error: null,
+      path: filePath,
+      payload: {
+        schema: 'priority/policy-live-state@v1',
+        generatedAt: '2026-03-06T10:00:00Z',
+        state: {}
+      }
+    };
+  };
+
+  const runGhJsonFn = (args) => {
+    if (args[0] !== 'api') {
+      throw new Error(`unexpected gh args: ${args.join(' ')}`);
+    }
+    return {
+      workflow_runs: [
+        {
+          id: 1,
+          status: 'completed',
+          conclusion: 'failure',
+          updated_at: '2026-03-06T11:45:00Z'
+        }
+      ]
+    };
+  };
+
+  const { report, exitCode } = await runReleaseConductor({
+    repoRoot: process.cwd(),
+    now: new Date('2026-03-06T12:00:00.000Z'),
+    args: {
+      apply: false,
+      dryRun: true,
+      reportPath: 'tests/results/_agent/release/release-conductor-report.json',
+      queueReportPath: 'tests/results/_agent/queue/queue-supervisor-report.json',
+      policySnapshotPath: 'tests/results/_agent/policy/policy-state-snapshot.json',
+      repo: 'owner/repo',
+      stream: 'comparevi-cli',
+      channel: 'stable',
+      version: '0.8.0',
+      dwellMinutes: 60,
+      quarantineStaleHours: 24,
+      help: false
+    },
+    environment: {
+      GITHUB_REPOSITORY: 'owner/repo',
+      RELEASE_CONDUCTOR_ENABLED: '0'
+    },
+    runGhJsonFn,
+    runCommandFn: () => ({ status: 0, stdout: '', stderr: '' }),
+    readJsonOptionalFn,
+    writeReportFn: async (reportPath) => reportPath
+  });
+
+  assert.equal(exitCode, 1);
+  assert.equal(report.decision.status, 'fail');
+  assert.ok(report.decision.blockers.some((entry) => entry.code === 'green-dwell-failed'));
+});
+
 test('runReleaseConductor creates signed tag when apply is enabled and signing key is available', async () => {
   const readJsonOptionalFn = async (filePath) => {
     const normalized = String(filePath);
@@ -351,4 +503,4 @@ test('runReleaseConductor stays proposal-only when signing material is unavailab
   assert.equal(report.release.proposalOnly, true);
   assert.equal(report.release.tagCreated, false);
   assert.equal(commandCalls.some((entry) => entry.command === 'git' && entry.args[0] === 'tag'), false);
-});
+});

tools/priority/__tests__/validate-scope-routing-contract.test.mjs

@@ -37,3 +37,10 @@ test('validate heavy jobs consume scoped lane decisions without skipping require
   assert.match(workflow, /VALIDATE_SCOPE_RUN_VI_HISTORY:\s+\$\{\{\s*needs\.validate-scope-plan\.outputs\.run_vi_history\s*\}\}/);
   assert.match(workflow, /VALIDATE_SCOPE_VI_HISTORY_REASON:\s+\$\{\{\s*needs\.validate-scope-plan\.outputs\.vi_history_reason\s*\}\}/);
 });
+
+test('validate lint job runs release conductor contract coverage for issue branches', () => {
+  const workflow = readRepoFile('.github/workflows/validate.yml');
+
+  assert.match(workflow, /name:\s+Release conductor contract tests/);
+  assert.match(workflow, /node tools\/npm\/run-script\.mjs priority:release:conductor:test/);
+});