ci(devx): label-gated opt-in pre-merge pack smoke

[claude]

Fixes #14214

Adds the missing trigger for the packed-install smoke: while a PR carries needs:pack-smoke, CI runs the existing pack smoke against that PR's merge preview, before the merge, as a check run the author already reads.

Derived from the maintainer-approved ruling on #14000 (2026-09-01, director batch #23, 「同意」; the follow-up recommendation 「label 门控 opt-in」 was the one approved).

Premise re-check (done first, on fresh origin/main)

The card's premise holds. Verified at base 035951faf:

• git grep -n 'labeled' -- .github/workflows/ returns no labeled trigger anywhere — every hit is prose, or pr-automation.yml explicitly excluding labeled/unlabeled from its jobs. There was no pre-merge pack-smoke trigger of any kind to collide with.
• Positive control (the leg the card describes) is present and reads exactly as described: publish-smoke.yml triggers on: workflow_run: workflows: [Release], resolves the open changeset-release/main PR, and reports publish-smoke / packed-tarballs as a commit status on the release branch head. That is a release surface, not a PR surface — which is the whole gap.
• Base already carries fix(devx): re-pin the publish smoke to the declared first-run contract #14255 (035951fa), so the driver reused here is the re-pinned one.

Driver-contract verification (read off the driver, not invented)

Verified in scripts/publish-smoke.sh rather than assumed:

Contract	Reading
Invocation	bash scripts/publish-smoke.sh — identical to publish-smoke.yml's pack-smoke step
Mode	SMOKE_MODE defaults to pack, so no env is needed
Prereq	the script fails fast unless packages/cli/dist and the create-objectstack bin exist, i.e. pnpm install + pnpm run build must precede it
Target tree	it packs from REPO_ROOT, resolved from the script's own location — whatever tree is checked out

The merge preview is a valid target and needs no plumbing. The one risk worth checking was whether pack mode assumes a release-branch layout the preview lacks; it does not. The release-branch coupling in publish-smoke.yml lives entirely in its resolve job (finding the release PR and a report-sha to post a status to), never in the driver. On pull_request the default actions/checkout ref is already refs/pull/N/merge, and the check run lands on the PR itself — so this workflow needs no resolve job, no resolve-guard, and no statuses: write. It runs with contents: read only. No driver changes were required, and none were made.

Scope boundaries, honoured

• ⛔ Pack-smoke assertion content is untouched. scripts/publish-smoke.sh has zero changes in this PR — re-pinning the assertions was The release candidate has failed its fresh-install smoke for ~18h — POST /auth/sign-up/email returns 403 SELF_REGISTRATION_CLOSED (and the check-run is NOT about main) #14000's deliverable and landed in fix(devx): re-pin the publish smoke to the declared first-run contract #14255. This card is only about when the smoke runs.
• Publish Smoke's run-list conclusion conflates the weekly registry canary with pack-smoke — a Monday canary green reads as "the RC smoke passed" and cost three seats a six-day duration misread #14190 (canary/pack-smoke run-level conflation) is adjacent and not touched.

Design decisions worth review

• Guard has two limbs. The PR must currently carry the label, and on a labeled event the label just added must be ours. Without the second limb every unrelated label the size labeler adds (size/l, ci/cd) to an already-labelled PR would start another 45-minute smoke of an unchanged tree.
• concurrency is at JOB level, deliberately. At workflow level the group is taken by every run the workflow starts — including runs whose job then skips — so an unrelated labeled event would cancel a smoke that was still running and then skip, leaving the PR with no verdict. That is the The release candidate has failed its fresh-install smoke for ~18h — POST /auth/sign-up/email returns 403 SELF_REGISTRATION_CLOSED (and the check-run is NOT about main) #14000 silence shape (a missing answer reading as a green one) rebuilt inside its own fix. A skipped job never enters a job-level group.
• types: restates the three defaults alongside labeled, because naming types: replaces rather than extends the default set (check-required-contexts asserts no paths: on the pull_request trigger but nothing about types: — a dropped default activity type is the same permanent-pending failure, unguarded #8304).
• No merge_group: trigger, and that is not an oversight. A merge_group event carries no pull_request context, so neither guard limb can be evaluated there; and the ruling puts this cost pre-merge and opt-in, not in the queue. The job is correspondingly not a required context — it is advisory by design, and a PR that never opts in never produces it.

The label

needs:pack-smoke did not exist. It was created on this repo (colour 006b75, description 94 chars), and — more importantly — declared in scripts/pm/ensure-pm-labels.sh, the repo's only declared home for a label object. An undeclared label is the grey / empty-description drift that file's header describes: auto-created by its first application and unrepairable by any rerun. Declaring it also puts its description under check:pm-label-desc-cap.

The added comment states plainly that this is the first row in that file that is not part of the PM state machine — it is written by the PR author about their own diff, names a property of the change rather than a position on the board, and no sweep in scripts/pm/ reads it.

⛔ It is never auto-applied: no .github/labeler.yml rule, by design. Path-derived application would be a different design from the one ruled, and would put the ~45-minute cost back into the default inner loop the ruling kept it out of.

Documentation line

One line in CONTRIBUTING.md's "Before Submitting" checklist — where a PR author actually meets it — carrying the ruling's criterion verbatim in substance: the PR changes the auth/audience defaults or the accept/reject behaviour of the unauthenticated surface.

Residual risk, stated rather than hidden

Self-declaration only covers the author who recognises their change as breaking. An author who does not realise they widened the unauthenticated surface still gets no pre-merge pack coverage; the release-time leg remains the backstop for that case. Closing that would need a detection rule — a different card and a different ruling. This is written into the workflow header too, so the next reader does not mistake the opt-in shape for full coverage.

Checks

Gate families derived mechanically from the real changeset — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no hand-written path list) — which named 31 families; harvested with --commands and all 31 run.

• 30 of 31 green.
• 1 NOT MEASURED, not a red: scripts/check-test-completeness.mjs exits 3 with no test log to read, and says so itself: "the local reading for this gate is NOT MEASURED … ⛔ It is not a red, and there is nothing here to fix." CI tees it a real log and passes the path, so that branch is unreachable there.

Re-run union on the final commit 820a49923 (12 families, all green), quoting each gate's own verdict line:

check-workflow-status-functions: OK (scanned 30 workflow file(s), 53 job(s), 26 job-level if: expression(s);
  10 read needs.*.outputs.*, all naming a status function).
check:pm-label-desc-cap: 22 label descriptions in scripts/pm/ensure-pm-labels.sh, all <=100 characters
  (longest: 100, repo:objectui).
check-required-contexts: 6 required context name(s) pinned across 2 workflow(s).
check-stall-guard-budget: OK (30 workflow file(s), 53 job(s), 572 step(s), 7 guard-wrapped step(s);
  every effective cap clears its job budget by at least one stall window).
check-nul-bytes: OK (scanned 7794 text file(s); no raw ASCII control bytes).
check:declared-population-live - 156 of 200 famil(ies) declare a path population, and every one reaches this tree.
check-bash32-floor: 26 tracked shell file(s) ... name no bash 4+ construct outside a comment.

Plus pnpm check:ratchet-remedy-authority (green: 183 scripts swept) and pnpm check:pm-dispatch-gates (green: 1140 self-test cases), both requested for the scripts/** touch.

The new workflow was also parsed with the repo's own yaml library to confirm on: did not fall into the YAML-1.1 true trap and that the guard expression survives folding intact.

Releases nothing (.github/, scripts/pm/, CONTRIBUTING.md), so skip-changeset is applied per the Check Changeset step's own route 2.

Demonstration run

needs:pack-smoke is applied to this draft PR so the new job fires on it — the trigger demonstrating itself. The run is cited in a follow-up comment once it has a URL. Note the smoke exercises the merge preview of this PR, whose diff is CI wiring only, so a green here demonstrates the trigger, not any auth/audience behaviour.

⛔ Draft on purpose — not to be marked ready by an agent.

---

Generated by Claude Code

[claude]

Demonstration run — all three arms observed live on this PR

The trigger demonstrating itself. Three pull_request runs of Pack Smoke (opt-in) landed on this PR, and between them they exercise every arm of the guard — measured, not asserted:

Run	Event	Job outcome	What it demonstrates
33539960970	opened, no label yet	skipped	⛔ boundary #2 of the ruling: an unlabelled PR pays zero new cost
33540022686	labeled — skip-changeset	skipped	the guard's SECOND limb: an unrelated label add does not start a 45-minute smoke of an unchanged tree
33540022809	labeled — needs:pack-smoke	in_progress	the trigger fires on the opt-in label, against the merge preview

The middle row is the one that would otherwise be easy to get wrong and impossible to notice: without that limb, every size/* and ci/cd label the automation adds to an already-labelled PR would each start another full smoke.

Note the smoke here exercises the merge preview of this PR, whose diff is CI wiring only — so its eventual colour demonstrates the trigger, not any auth/audience behaviour. Per the dispatch contract the report is filed at draft-PR time rather than waiting for the ~45-minute run to converge; the run above is cited at in_progress.

---

Generated by Claude Code