[objectstack-fleet]

Requested by Steedos · project thread

Fixes #31517

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：合并队列（merge_group）里，Test Core、Test UI、Dogfood 三个测试矩阵改成「一个分片红了，其余分片立即停止」。PR、push、定时运行不变，仍然每个分片都跑完。
• 为什么改：以前队列里一个分片已经红了，还要等最慢的分片（Test Core 最慢片中位约 19 分钟）跑完聚合检查才报红，排在后面的条目也跟着干等。按裁决 6730013883（A）执行。
• 风险与回滚：只用矩阵自带的 fail-fast，没有取消整次运行，真红仍然是红（聚合检查读到 failure）。代价是队列运行只显示第一个红分片，完整红单仍在作者的 PR 运行里。回滚：把三处表达式改回 false。
• 先看：.github/workflows/ci.yml 里 test 任务的 strategy 段（表达式和说明）；scripts/check-shard-attestation.mjs 新增的 [Decision] Merge queue: stop the remaining test shards once one shard is red (merge_group only), which narrows ruling 6139629628 A1 inside the queue #31517 自测电池；ci.yml 里 dogfood 与 test-ui 的 strategy 段。
• 两分钟验证：node scripts/check-shard-attestation.mjs --self-test，预期最后一行是 ✓ check-shard-attestation --self-test: 350 assertions …，并且 grep -n 'fail-fast:' .github/workflows/ci.yml 恰好三行，都是 ${{ github.event_name == 'merge_group' }}。
• 需要你做的：审阅并亲手合并（.github/workflows/** 属 Tier H）。

What changes

• .github/workflows/ci.yml: strategy.fail-fast: ${{ github.event_name == 'merge_group' }} on test (Test Core), test-ui (Test UI) and dogfood (Dogfood Regression Gate), as ruled (ruling record 6730013883, letter A). The expression is false on pull_request, push, schedule and workflow_dispatch, so those runs keep every shard running to its end. It is the matrix's own fail-fast; there is no run-level cancel and no concurrency change.
• The A1 wording ([Decision] 门禁过严拖慢发版:一轮 CI 暴露全部红、成本型棘轮加容差带、门禁瘦身审计 #23177 ruling B, item A1, comment 6139629628): the test strategy comment says why the queue is the exception (its job is a fast mergeable-or-not answer, and the PR run of the same diff already showed every red); the Test Core step's A1 note now says A1 holds inside a shard on every event and the queue is the exception across shards; the dogfood, test-ui, Dogfood Regression Gate and Test UI aggregate comments say how each reads the fail-fast shape.
• scripts/check-shard-attestation.mjs: a new self-test battery, #31517 merge-queue fail-fast: one shard red, the rest cancelled by the strategy (8 cases, roster floor 25 → 26), and a header paragraph. No verdict logic changes. The cases: a red shard beside attested and fail-fast-cancelled siblings is red by the declared negative and by the count; a red shard with zero attestations is red (failure is never the zero-attestation CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668 pass); a failure matrix asks no cancel cause; the measured fail-fast cancel annotation classifies as other, never a supersession; if a matrix ever read cancelled after a sibling attested, that cause still reds it; a planned (ci: Test UI always starts 16 shard runners and Test Core 8, even when the affected set is one package, and an empty shard still pays checkout + install + closure build before learning it has nothing to run #26084) roster cut short is red; the Dogfood Regression Gate reads a red dogfood shard with a cancelled sibling as red.
• scripts/ci-shard-matrix.mjs: its self-test fixture job spelled fail-fast: false; it now spells the new expression, so the reader is exercised over the line ci.yml carries. The other three scripts the card named (check-shard-attestation.mjs, check-aggregator-roster.mjs, partition-test-shards.mjs) pin no fail-fast anchor: git grep -n fail-fast -- scripts at f2abd47 hits ci-shard-matrix.mjs:220 only, plus unrelated step-level fail-fast prose in scripts/ci/lane-verdict.mjs and scripts/pm/ci-failure.mjs.

Tests

Self-tests and live checks of the touched and card-named scripts (6903a73, and again at the final head 0a383d6, all exit 0)

• node scripts/check-shard-attestation.mjs --self-test: exit 0, ✓ check-shard-attestation --self-test: 350 assertions …
• node scripts/check-shard-attestation.mjs (static guard over ci.yml): exit 0, ✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
• node scripts/ci-shard-matrix.mjs --self-test: exit 0, 27 cases pass across 5 batteries (live: test=8, dogfood=3, test-ui=16)
• node scripts/check-aggregator-roster.mjs --self-test: exit 0 (63 assertions); live: exit 0
• node scripts/partition-test-shards.mjs --self-test: exit 0
• node scripts/ci/scheduled-full-run.mjs --self-test: exit 0

The new cases can fail: two mutations, red, then restored (committed head, in-place edit, `git checkout HEAD --` restore, blob hash checked)

• classifyCancelAnnotations also reading The strategy configuration was canceled as a supersession: self-test exit 1, failing exactly #31517: a shard cancelled by its matrix's fail-fast is never read as a supersession and #31517: were the matrix ever to read cancelled after a sibling attested, the fail-fast cause still reds it….
• judge() routing a failure leg into the cancelled branch: self-test exit 1, failing exactly #31517: the first shard red before any sibling attested, all cancelled ⇒ red….
• Both restores: git hash-object equal to the HEAD blob and git diff HEAD empty.

Acceptance notes

• The aggregates read the fail-fast shape correctly. Measured on run 30271824408 (the CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668 experiment, a fail-fast matrix): shard 1 concluded failure, shard 2 concluded cancelled, and the observer read the matrix result as failure. The cancelled shard's check run 89995981782 carries the annotation The strategy configuration was canceled because "matrix._1" failed (read from the check-run annotations endpoint). So Test Core and the Dogfood Regression Gate read failure (a declared negative, plus the missing credentials), and Test UI reads anything but success (or a filter-explained skip) as red.
• A fail-fast queue run is never borrowed by a push (ci: let a covered push run borrow the merge queue's verdict #31611, df91a35). queueRunVerdict in scripts/ci/scheduled-full-run.mjs covers a commit only when its queue run concluded success; a run whose aggregate is red concludes failure. testUiFullGreen counts only Test UI (k/16) jobs that concluded success, so a cancelled shard makes ui_full_green false and the push runs Test UI. Both are pinned by that script's existing self-test (a failure queue run, and 15 of 16 green shards). Nothing in that file changes.
• What a red queue run shows now. Only the shards that finished before the first red one, plus that one. The author's pull_request run of the same diff still shows every red shard (ruling 6139629628 A1, unchanged there).
• Reading after landing (owed by the devx seat, on [Decision] Merge queue: stop the remaining test shards once one shard is red (merge_group only), which narrows ruling 6139629628 A1 inside the queue #31517): for 7 days of merge_group runs of ci.yml, the queue time from the first red Test Core (k/8), Test UI (k/16) or Dogfood Regression Gate (k/3) shard to the matching aggregate concluding red, compared with the same reading over the 7 days before landing.
• Noted, not filed (pre-existing, unchanged here): a matrix where every shard is killed by its own timeout before any shard attests reads cancelled with zero attestations, and that is CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668's pass with no cause read (ruled not extended on [Decision] The required Test Core and Dogfood Regression Gate go red on superseded runs (139 in 51 h, 0 real catches): keep #16157's ruled reading, or decide by the cancel cause the platform records? #22653). Fail-fast does not widen it: a timeout fires at 60 or 30 minutes, long after the fast shards attest, and a shard that goes red first makes the matrix read failure.

Verification

Derived gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (63 commands)

Run at the final head 0a383d6 (origin/main 90cea47 merged): 63 derived, 63 run, every one exit 0. --ran verdict: ✓ dispatch-gates --ran: 63 derived famil(ies) accounted for — 63 run, 0 NOT-MEASURED.

The first run, at 6903a73 before the merge, read the same 63-command list; there check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure and check:sourcemap-no-sources-content exited 3 (no built dist yet). check:type-check-debt built the workspace in that run, so on the final head they read a dist built at 6903a73; packages/objectql is the only package whose source the merge moved, and this diff touches no package.

node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/check-declaration-mirrors.mjs :: exit 0
node scripts/check-declaration-mirrors.mjs --self-test :: exit 0
node scripts/check-dts-emitted.mjs --self-test :: exit 0
node scripts/check-self-test-wired.mjs :: exit 0
node scripts/check-self-test-wired.mjs --self-test :: exit 0
node scripts/check-self-test-workflow-commands.mjs :: exit 0
node scripts/check-self-test-workflow-commands.mjs --self-test :: exit 0
node scripts/check-step-collectors.mjs :: exit 0
node scripts/check-step-collectors.mjs --self-test :: exit 0
node scripts/check-whole-set-label-write.mjs :: exit 0
node scripts/check-whole-set-label-write.mjs --self-test :: exit 0
node scripts/ci/assert-turbo-remote-cache.mjs --self-test :: exit 0
node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0
node scripts/ci/prune-turbo-cache.mjs --self-test :: exit 0
node scripts/ci/scheduled-full-run.mjs --self-test :: exit 0
node scripts/docs-audit/check-drift-comment.mjs :: exit 0
node scripts/pm/bare-root-worklist.mjs --self-test :: exit 0
node scripts/pm/ci-failure.mjs --self-test :: exit 0
pnpm check:agent-test-spelling :: exit 0
pnpm check:aggregator-roster :: exit 0
pnpm check:bash32-floor :: exit 0
pnpm check:ci-filter-parity :: exit 0
pnpm check:cli-command-ids :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:declared-population-live :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:dts-closure :: exit 0
pnpm check:dual-build-cjs-loads :: exit 0
pnpm check:entry-guard :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:lean-entry-closure :: exit 0
pnpm check:node-version :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:parse-guard :: exit 0
pnpm check:pm-close-cards :: exit 0
pnpm check:pm-expected-skips :: exit 0
pnpm check:pm-fleet-write-dispatch :: exit 0
pnpm check:pm-fleet-write-execute :: exit 0
pnpm check:pm-fleet-write-validate :: exit 0
pnpm check:pm-governed-merges :: exit 0
pnpm check:pm-issue-transfer :: exit 0
pnpm check:pm-post-stamped :: exit 0
pnpm check:pm-record-recognisers :: exit 0
pnpm check:pnpm-acquisition :: exit 0
pnpm check:pnpm-filter-targets :: exit 0
pnpm check:pnpm-flag-spellings :: exit 0
pnpm check:ratchet-remedy-authority :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:required-contexts :: exit 0
pnpm check:scripts-symbol-anchors :: exit 0
pnpm check:shard-attestation :: exit 0
pnpm check:sourcemap-no-sources-content :: exit 0
pnpm check:stall-guard-budget :: exit 0
pnpm check:stall-guard-headroom :: exit 0
pnpm check:type-check-coverage :: exit 0
pnpm check:type-check-debt :: exit 0
pnpm check:watch-hint-literal :: exit 0
pnpm check:workflow-status-functions :: exit 0
pnpm check:workflow-step-name-quoting :: exit 0
pnpm check:pm-dispatch-gates :: exit 0

Also at 0a383d6: cd ui && pnpm exec vitest run on the three ui/scripts/__tests__ files that import scripts/ci-shard-matrix.mjs (select-affected-tests-wiring, select-affected-tests, test-file-timings): 3 files, 95 tests passed.

Tier H: .github/workflows/ci.yml is a governed surface, so the maintainer merges this by hand. skip-changeset: the diff touches only a workflow and root scripts/, which no package publishes.

---

Generated by Claude Code

[objectstack-fleet]

domain:devx#2 · zhuangjianguo · session_01QsR2jTo666XXx9e1Gm21C6

Contract-review-claim: session_01QsR2jTo666XXx9e1Gm21C6 · head 0a383d6 · 2026-11-09T02:58Z

Rules face (.github/workflows/ci.yml), by an isolated Fable reviewer of this seat. The record follows.

[objectstack-fleet]

domain:devx#2 · zhuangjianguo · session_01QsR2jTo666XXx9e1Gm21C6

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0a383d677bd8bd31bdb92f4778c644ced0bce6f9
Local-runs: none
Scope: .github/workflows/ci.yml + scripts/check-shard-attestation.mjs, scripts/ci-shard-matrix.mjs

Inputs: card #31517 (body; comments 6730013883 ruling A, 6730062998 claim, 6730882208 dev report), PR #31753 (body, 3-file list, net diff origin/main 90cea47…0a383d67), and the 66 check-runs on the head (all success or an expected skipped; Test Core, Test UI, Dogfood Regression Gate, Lint · CI, release & engine gates, Lint · scoped · tooling self-tests, Check Changeset, Governed Surface Queue Guard green). Face: rules (.github/workflows/ci.yml is a governed path). Code read, not reviewed: scripts/ci/scheduled-full-run.mjs (queueRunVerdict L1479, testUiFullGreen L1534, decidingQueueRun L1466), the queue-verdict, borrowed-verdict, test-gate, dogfood-gate and test-ui-gate jobs on the head, and judge() / shardsNeedingCancelCause() / classifyCancelAnnotations() in check-shard-attestation.

① Derived judgments

• strategy.fail-fast: false becomes ${{ github.event_name == 'merge_group' }} on test (L1061), dogfood (L2746) and test-ui (L4186), nothing else in strategy: moves — right, the ruling's exact spelling (6730013883, letter A). Expressions are legal on this key (the platform reads "set to true or its expression evaluates to true"), and the head's pull_request run started every matrix job, so the file parses.
• The expression is false on pull_request, push, schedule and workflow_dispatch: those runs keep every shard reporting — right. None of the three jobs carries a job-level continue-on-error (grep of indent-4 continue-on-error on the head: none), so on merge_group a red shard really does fire the strategy's cancel; the step-level continue-on-error: true entries in test are the report-only summary/timing uploads, not the test step.
• No run-level cancel, no concurrency: change, no other workflow touched; codeql.yml, scaffold-e2e.yml, test-nightly-tiers.yml, ui-coverage-nightly.yml keep fail-fast: false — right, outside the ruling.
• Accept-set effect in the queue: a red shard's failure dominates the matrix leg's needs result (card premise 1, run 30271824408), so Test Core reds by the declared-negative line of judge() (L695) and by the count (the cancelled shards publish no credential), Dogfood Regression Gate the same, and Test UI by its *) branch (L4476) — right. ⚠ The head's check-runs are a pull_request run, so the merge_group arm is attested by the card's own premise and the cited run, not by a check-run on this head; that is the shape the ruling accepted.
• A fail-fast queue run is never borrowed by a push — right, read in the live tree: queueRunVerdict refuses any queue run whose conclusion !== 'success' (L1483) and decidingQueueRun takes the NEWEST run on the sha (L1473), so an older green cannot outvote; testUiFullGreen needs all sixteen Test UI (k/16) jobs at success (L1538); borrowed-verdict runs only on covered == 'true'; and a sha whose queue run went red never lands, so it is never a pushed commit. The three aggregates skip only on a covered push (always() && needs.queue-verdict.outputs.covered != 'true'). A cancelled shard cannot read as covered.
• scripts/check-shard-attestation.mjs: no verdict logic changes (diff is a header paragraph, one roster entry, the floor, and the battery) — right. Roster 25 → 26 keys counted on origin/main and on the head; SELF_TEST_BATTERY_FLOOR 25 → 26 matches; the battery pins 8 and the block holds exactly 8 assert( calls; counts are floors, so the bump is honest and not inflated.
• scripts/ci-shard-matrix.mjs fixture now spells the new expression between strategy: and matrix: — right and faithful to the three live jobs' shape. The reader locates matrix: by regex and reads its indented children, so it never inspects the fail-fast line: the change is cosmetic, and the the live ci.yml battery already reads the real line (liveShardTotal on test, dogfood, test-ui). The \${{ escape in the template literal yields the literal ${{ … }} text.
• The card's three named scripts (check-shard-attestation.mjs, check-aggregator-roster.mjs, partition-test-shards.mjs) pin no fail-fast anchor — right: git grep fail-fast origin/main -- scripts hits ci-shard-matrix.mjs:220 only, plus step-level prose in scripts/ci/lane-verdict.mjs and scripts/pm/ci-failure.mjs that is about lane steps, not matrices.
• A1 comment amendment (test strategy L1045–1059; the Test Core step's A1 note L1596–1600; dogfood, test-ui, the two aggregates): the queue is named as the exception across shards, A1 kept inside a shard on every event — right, matches the ruling's "After the ruling" paragraph.

② Semver level

No package source, no packages/**, no published surface: a workflow and two root scripts/ files. skip-changeset is correct and Check Changeset is green on the head. Clause-②: no on the PR body (no (narrowing) arm) — right: nothing declared is withdrawn; the narrowing is of ruling A1 inside the queue, which the card ruled, not of a published spec. Metadata-protocol: none — right.

③ Boundary flags

• Dev report open_questions: [] — none to answer.
• Dev report deviations: none — agreed; the diff is the ruled change and its fixtures, nothing beyond ci.yml strategy lines, comments and the two scripts.
• Dev report out_of_scope_findings (and the PR body's "Noted, not filed"): a matrix whose every shard is killed by its own timeout before any attests reads cancelled with zero attestations and passes by CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668 (ruled not extended on [Decision] The required Test Core and Dogfood Regression Gate go red on superseded runs (139 in 51 h, 0 real catches): keep #16157's ruled reading, or decide by the cancel cause the platform records? #22653); "fail-fast does not widen it". Answered: the pre-existing gap is correctly described. The "does not widen" claim is qualified by finding N3 below — a contingent, narrow widening under runner starvation that depends on whether the platform's fail-fast fires on a sibling the job wall cancelled. Not escalated: the pass is CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668's, the mechanism is the one the ruling binds, and the stall guard (L965, L1537) turns a hung test step into a failure well before the wall. Folded into the 7-day reading the card already owes.
• owed_after_landing: the devx seat's 7-day queue-time reading on [Decision] Merge queue: stop the remaining test shards once one shard is red (merge_group only), which narrows ruling 6139629628 A1 inside the queue #31517 — stands; add the count of merge_group runs whose Test Core/Dogfood Regression Gate passed on a cancelled matrix with zero attestations (expected 0).

④ Design judgment

.github/workflows/ci.yml (hits) against ruling 6730013883 and the code it cites:

• The ruled mechanism holds. A merge_group red shard cancels its siblings by the strategy, never by a run cancel; failure dominates the matrix result, and all three aggregates read failure red with no path to green (shardsNeedingCancelCause asks nothing unless result === 'cancelled', L420; a failure leg always pushes the declared-negative error, L695). Attempt to break: (a) cancelled-before-attesting siblings — missing credentials plus the declared negative, red; (b) sibling attested then cancelled — counted as attested, still red by the negative; (c) planned roster (ci: Test UI always starts 16 shard runners and Test Core 8, even when the affected set is one package, and an empty shard still pays checkout + install + closure build before learning it has nothing to run #26084) cut short — red (battery case 7); (d) dogfood with dogfood-verify skipped on the queue — the dogfood leg's failure reds the gate; (e) Test UI — *) branch, red. No green route found.
• PR/push/schedule/dispatch: fail-fast false, every shard runs to its end; A1 holds where the author reads it. The test job's if: and the attestation step's if: needs.queue-verdict.outputs.covered != 'true' are untouched.
• Borrowing: see ①; a fail-fast queue run concludes failure and queueRunVerdict refuses it; ui_full_green needs sixteen success conclusions. Nothing in scheduled-full-run.mjs changes, and its existing self-test pins a failure queue run (L3408) and a 15-of-16 Test UI matrix reading ui_full_green=false (L3697–3703).
• Findings on the hits file:
  • N1 · nit (dogfood-gate comment, L3112–3116): the amended sentence attributes the red to the cause read ("which the cause read classifies as no supersession: a partially attested matrix it cut short reads red"). On the fail-fast shape the leg reads failure and no cause is read at all — the PR's own battery case 4 pins exactly that; the cause read is reached only on the counterfactual cancelled path (battery case 6). The verdict is right, the sentence names the wrong reason. Prose in the hits file: a fix moves the head, so it is an accepted deviation to tidy on the next ci.yml touch, or the follow-up card.
  • N2 · nit (style): two amended comment lines run far past the file's wrap — L3116 (the dogfood-gate line ending "…which", about 130 columns) and L4182 ("…reads red there. A fail-fast queue run is red, so a push never", about 105 columns). No gate reads comment width. Accepted deviation.
  • N3 · nit, follow-up (design, contingent): a job killed by its own timeout-minutes concludes cancelled (CANCEL_CAUSE_TIMEOUT, measured). If the platform's fail-fast treats that as the "fails" its wording names, a queue shard hung past its 60-minute (test) or 30-minute (dogfood, test-ui) wall BEFORE any sibling attested — i.e. the siblings still queued under runner starvation — would cancel those siblings into a zero-attestation cancelled matrix, which is CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668's pass; on main today those siblings would run and attest, and the timed-out shard's cause would red the gate ([Decision] The required Test Core and Dogfood Regression Gate go red on superseded runs (139 in 51 h, 0 real catches): keep #16157's ruled reading, or decide by the cancel cause the platform records? #22653). The window is narrow (the stall guard on the test step fires well before the wall and exits non-zero, which is failure, the dominated shape) and the pass it reaches is the one ruled not extended on [Decision] The required Test Core and Dogfood Regression Gate go red on superseded runs (139 in 51 h, 0 real catches): keep #16157's ruled reading, or decide by the cancel cause the platform records? #22653, so it is not a defect of this diff. Named here so the 7-day reading counts it (③).
  • Observation, no grade: the battery's FAIL_FAST_ANNOTATIONS text (The strategy configuration was canceled because "matrix._1" failed) is the dev's transcription from check run 89995981782, which this record did not re-read. The pin does not depend on it: classifyCancelAnnotations returns other for every message that does not start with the timeout or supersession prefix (L450–456), so any wording GitHub writes for a fail-fast cancel reds the counterfactual path.

scripts/check-shard-attestation.mjs (implementing): the header paragraph (L83–89) agrees with the contract sentence by sentence — the queue's test and dogfood matrices are fail-fast (this script covers no Test UI credentials, so naming two is accurate to its scope), failure dominates, the cancelled shards are missing from the count, the fail-fast annotation reads other. The battery pins the case from both sides: failure with partial and with zero attestations is red (cases 1–3, the zero-attestation one being the load-bearing contrast to #3668), no cause read on failure (case 4), the annotation is not a supersession (case 5), the counterfactual cancelled path still reds and quotes the record (case 6), planned roster (case 7), dogfood (case 8). The dev's two mutation probes (classifier reading the fail-fast text as a supersession; judge() routing failure into the cancelled branch) are the right ones and name cases 5/6 and 3 respectively. Floor bump honest (①). No finding.

scripts/ci-shard-matrix.mjs (implementing): the fixture now mirrors the live jobs' strategy: shape; the reader is indifferent to the line, the live battery covers the real file, and no refusal case depends on fail-fast. No finding.

Nits only; no must-fix, no should-fix. The round ends here.

Implemented-by: claude/project-thread-c9oqlr
Reviewed-by: session_cse_01QsR2jTo666XXx9e1Gm21C6

VERDICT: PASS

[objectstack-fleet]

domain:devx#2 · zhuangjianguo · session_01QsR2jTo666XXx9e1Gm21C6

维护者速读

• 改了什么:根 ci.yml 的 test、dogfood、test-ui 三个矩阵,fail-fast 由 false 改为 ${{ github.event_name == 'merge_group' }}。只有合并队列里第一个红分片会取消同矩阵的其余分片;PR、push、定时、手动运行照旧每个分片跑完。另改相关注释,check-shard-attestation 自测加 8 条用例(下限 25→26),ci-shard-matrix 夹具同步。
• 为什么改:[Decision] Merge queue: stop the remaining test shards once one shard is red (merge_group only), which narrows ruling 6139629628 A1 inside the queue #31517 裁定 A。队列里一个分片已红,整次队列运行必红,其余分片继续跑只占 runner、拖后面排队的 PR。用的是矩阵自身的 fail-fast,不取消整次运行。
• 风险与回滚:fail-fast 的队列运行结论是 failure,三个汇总门禁都读红,不会被后续 push 借成绿(queueRunVerdict 只认 success)。回滚 = revert 本 PR。
• 先看:.github/workflows/ci.yml 三处 fail-fast: 行及 test job 的 strategy 注释。
• 两分钟验证:本 PR 的 CI 全绿(50 成功、14 跳过)。队列一侧的行为要等第一次队列红分片才看得到。
• 需要你做的:亲手合并本 PR(受管 .github/workflows/**,Tier H)。契约复核 PASS 在案:评论 6731165523,Head-sha: 0a383d677bd8bd31bdb92f4778c644ced0bce6f9。
• 席位意见:建议合。合并后本席做 7 天队列耗时读数。

席位核对 · ACCEPT · 2026-11-09T02:59Z · head 0a383d677bd8bd31bdb92f4778c644ced0bce6f9

Seat domain:devx#2 reviewed the diff of its own dispatch (ruling 6730013883 on #31517, claim 6730062998, card thread session_01QsR2jSkaG5iii6WC7w4qSX, report 6730882208). Checked against GitHub, not against the report.

1. Shape: net diff against main: 3 files, +90 / -7. ci.yml: the three fail-fast: lines and their comments. check-shard-attestation.mjs: a header paragraph, one roster entry, floor 25 → 26 and an 8-case battery, with no verdict logic changed. ci-shard-matrix.mjs: the fixture's strategy line. Every file is inside the claim. Body: Fixes #31517, skip-changeset, Clause-②: no.
2. Premise: read on main. Ruling A is the matrix's own fail-fast on merge_group only, never a run cancel. The diff is exactly that, with no concurrency: change and no job-level continue-on-error on the three jobs. Read in the live tree, queueRunVerdict refuses any queue run that did not conclude success, and testUiFullGreen needs sixteen success shards. So a fail-fast queue run is never borrowed.
3. Gates / check-runs: this head has 64 completed runs: 50 success, 14 skipped, 0 red. check-expected-skips --pr 31753 from main: OK, 14 skipped, every one in main's roster, exit 0. mergeable_state: clean. Dev: 63 derived families, 63 exit 0. The head's runs are a pull_request run, so the merge_group arm rests on the card's premise run 30271824408, as the ruling accepted.
4. Contract review: claim 6731160441, record 6731165523 on this head by this seat's isolated Fable reviewer: PASS, nits only, so the round ends.
5. Accepted deviations: the record's three nits. N1: the dogfood-gate comment names the cause read as the reason for the red, but on the fail-fast shape the leg reads failure and no cause is read. N2: two comment lines run past the wrap. Both are prose in the governed file, and fixing them would move the reviewed head. They ride the next ci.yml touch. N3: under runner starvation, a shard killed by its own wall could cancel unstarted siblings into the zero-attestation cancelled pass that CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668 allows. That gap is pre-existing and narrow (the stall guard fires first), and the 7-day reading counts it.
6. Landing: check-governed-merges classes this governed, Tier H (.github/workflows/**), 97 changed lines. The maintainer merges by hand. After the merge this seat writes the landing note, and the 7-day queue reading on [Decision] Merge queue: stop the remaining test shards once one shard is red (merge_group only), which narrows ruling 6139629628 A1 inside the queue #31517 is owed: queue wall and runner minutes on red queue runs, plus the count of merge_group runs whose aggregate passed on a cancelled zero-attestation matrix (expected 0).