coilyco-flight-deck/infrastructure

Fork 0

Converge required PR status contexts for PR-gated Forgejo repos #532

New issue

Closed

opened 2026-07-10 09:58:38 +00:00 by coilyco-ops · 3 comments

coilyco-ops commented

2026-07-10 09:58:38 +00:00

Member

Problem

coilyco-flight-deck/agentic-os#421 added a live pull-request CI workflow that now reports ci / gate (pull_request)=success on PR agentic-os#423, but older PR-gated repos are still not consistently unblocked because Forgejo branch protection does not declare required status contexts.

Current evidence from the director surface on 2026-07-10:

warded director merge --repo coilyco-flight-deck/agentic-os --dry-run --limit 100
skipping coilyco-flight-deck/agentic-os#426: base branch does not declare any required status contexts
skipping coilyco-flight-deck/agentic-os#420: base branch does not declare any required status contexts

Forgejo branch API for agentic-os and ward main reports:

{"protected": true, "enable_status_check": false, "status_check_contexts": null}

The existing infrastructure branch-protection converge intentionally only denies force-push and branch deletion while keeping direct fast-forward pushes working. That was correct for direct-main repos, but agentic-os, ward, and cli-guard are now declared as pull-requests-and-merge in the coilyco ward config bundle, so the merge lane needs a converged required-context policy for those repos.

Related work:

agentic-os#421 / PR #423 - adds the ci / gate workflow for agentic-os.
ward#994 - director currently reads the Forgejo status row's empty state field instead of the populated status field.
infrastructure/scripts/forgejo-branch-protection.py - current owner of branch-protection convergence.

Acceptance criteria

The branch-protection converge can declare required status contexts for PR-gated repos without changing direct-main repos.
coilyco-flight-deck/agentic-os main requires ci / gate once its workflow PR lands.
coilyco-flight-deck/ward main keeps or requires its live test / test PR context through the same tracked converge path.
coilyco-flight-deck/cli-guard is either configured with its correct live PR context or explicitly documented as waiting on a workflow prerequisite.
The dry-run output makes status-context changes visible before execute=1.
Documentation explains how the no-force-push branch protection policy composes with PR-gated required status contexts.

## Problem `coilyco-flight-deck/agentic-os#421` added a live pull-request CI workflow that now reports `ci / gate (pull_request)=success` on PR `agentic-os#423`, but older PR-gated repos are still not consistently unblocked because Forgejo branch protection does not declare required status contexts. Current evidence from the director surface on 2026-07-10: ```text warded director merge --repo coilyco-flight-deck/agentic-os --dry-run --limit 100 skipping coilyco-flight-deck/agentic-os#426: base branch does not declare any required status contexts skipping coilyco-flight-deck/agentic-os#420: base branch does not declare any required status contexts ``` Forgejo branch API for `agentic-os` and `ward` `main` reports: ```json {"protected": true, "enable_status_check": false, "status_check_contexts": null} ``` The existing infrastructure branch-protection converge intentionally only denies force-push and branch deletion while keeping direct fast-forward pushes working. That was correct for direct-main repos, but `agentic-os`, `ward`, and `cli-guard` are now declared as `pull-requests-and-merge` in the coilyco ward config bundle, so the merge lane needs a converged required-context policy for those repos. Related work: * `agentic-os#421` / PR `#423` - adds the `ci / gate` workflow for agentic-os. * `ward#994` - director currently reads the Forgejo status row's empty `state` field instead of the populated `status` field. * `infrastructure/scripts/forgejo-branch-protection.py` - current owner of branch-protection convergence. ## Acceptance criteria * The branch-protection converge can declare required status contexts for PR-gated repos without changing direct-main repos. * `coilyco-flight-deck/agentic-os` `main` requires `ci / gate` once its workflow PR lands. * `coilyco-flight-deck/ward` `main` keeps or requires its live `test / test` PR context through the same tracked converge path. * `coilyco-flight-deck/cli-guard` is either configured with its correct live PR context or explicitly documented as waiting on a workflow prerequisite. * The dry-run output makes status-context changes visible before `execute=1`. * Documentation explains how the no-force-push branch protection policy composes with PR-gated required status contexts.

coilyco-ops added the

headless

labels

2026-07-10 09:58:38 +00:00

coilyco-ops commented

2026-07-10 09:58:47 +00:00

Author

Member

WARD-DISPATCH: deferred ⏸

deferred details

This forwarded dispatch was deferred after the issue was already reserved.

Attempted harness: codex
Attempted run: ward agent engineer coilyco-flight-deck/infrastructure#532 --harness codex --ward-version v0.573.0 --details Fix infrastructure#532. Extend the Forgejo branch-protection converge so PR-gated repos can declare required status contexts without changing direct-main repos. Use the existing branch-protection script/runbook, make dry-run output show status-context changes, cover agentic-os ci / gate and ward test / test, document cli-guard if it needs a prerequisite, add tests/docs, and close infrastructure#532 when landed.
Container: engineer-codex-infrastructure-532
Container created: no running engineer was observed.
Host log: /Users/kai/.ward/agent-logs/dispatch/20260710T095844Z-director-codex-zv99-coilyco-flight-deck-infrastructure-532.log
Capacity: ward agent engineer --harness codex: global engineer limit is reached: 12 running (limit 12); wait for a run to finish or run ward agent reap for stale engineers

Retry: the issue stays queued and the director will try again when a slot opens.

— Codex, via ward agent

WARD-DISPATCH: deferred ⏸ <details><summary>deferred details</summary> This forwarded dispatch was deferred after the issue was already reserved. Attempted harness: `codex` Attempted run: `ward agent engineer coilyco-flight-deck/infrastructure#532 --harness codex --ward-version v0.573.0 --details Fix infrastructure#532. Extend the Forgejo branch-protection converge so PR-gated repos can declare required status contexts without changing direct-main repos. Use the existing branch-protection script/runbook, make dry-run output show status-context changes, cover agentic-os ci / gate and ward test / test, document cli-guard if it needs a prerequisite, add tests/docs, and close infrastructure#532 when landed.` Container: `engineer-codex-infrastructure-532` Container created: no running engineer was observed. Host log: `/Users/kai/.ward/agent-logs/dispatch/20260710T095844Z-director-codex-zv99-coilyco-flight-deck-infrastructure-532.log` Capacity: `ward agent engineer --harness codex: global engineer limit is reached: 12 running (limit 12); wait for a run to finish or run `ward agent reap` for stale engineers` Retry: the issue stays queued and the director will try again when a slot opens. </details>  — Codex, via `ward agent`

coilyco-ops commented

2026-07-10 10:39:26 +00:00

Author

Member

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-infrastructure-532 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-10T10:39:25Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/infrastructure#532 · branch issue-532 · harness codex · workflow direct-main
Run: engineer-codex-infrastructure-532 · ward v0.580.0 · dispatched 2026-07-10T10:39:25Z
Comment thread: 1 included in the pre-flight read, 0 stripped (ward's own automated comments).
- included: @coilyco-ops (2026-07-10T09:58:47Z)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0).

— Codex, via ward agent

WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-infrastructure-532` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-10T10:39:25Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/infrastructure#532` · branch `issue-532` · harness `codex` · workflow `direct-main` - **Run:** `engineer-codex-infrastructure-532` · ward `v0.580.0` · dispatched `2026-07-10T10:39:25Z` - **Comment thread:** 1 included in the pre-flight read, 0 stripped (ward's own automated comments). - included: @coilyco-ops (2026-07-10T09:58:47Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a commit

2026-07-10 10:49:10 +00:00

feat(forgejo): converge PR-gated branch protection contexts

coilyco-ops closed this issue

2026-07-10 10:49:10 +00:00

coilyco-ops commented

2026-07-10 10:50:02 +00:00

Author

Member

WARD-OUTCOME: done

details

workflow: direct-main; review summary: skipped (review gate skipped by ~/.ward/config.yaml default)
retrospective: the change was mostly plumbing, with a small policy split for PR-gated repos.
confidence: high.
surprises: the repo-wide pre-commit gate needed UV cache overrides in this container.
follow-ups: none.

WARD-OUTCOME: done <details><summary>details</summary> workflow: direct-main; review summary: skipped (review gate skipped by ~/.ward/config.yaml default) retrospective: the change was mostly plumbing, with a small policy split for PR-gated repos. confidence: high. surprises: the repo-wide pre-commit gate needed UV cache overrides in this container. follow-ups: none. </details>