[#850] Finish #857 tail: 6 convergence PRs blocked on CI-infra noise (cancelled dev-lead checks + repo-specific fails)

[don-petry]

Tracks the tail of #857 fleet convergence. The automation is delivered and validated end-to-end; the remaining consumer PRs carry verified-correct content (correct @<agent>/v<M>-stable pins + S7635 + S7637 markers) but are blocked from pr-review auto-approval by CI-infrastructure noise — not by any review concern. Decision (2026-07-22): accept current state, close #857 on its core pin-delivery, finish the tail here.

Open convergence PRs (correct content, blocked on CI noise)

• google-app-scripts#479, broodly#440, markets#369, ContentTwin#383, .github#866, .github-private#1351

Deployed-state gaps pending those merges

• Bare @dev-lead/stable still on broodly, markets, ContentTwin (their PRs re-pin to v1-stable + add the marker).
• google-app-scripts dev-lead/auto-rebase/dependabot: correct v-form pins but missing the S7635 marker (pins converged pre-feat: implement issue #877 — [#850] make standards-deploy driver treat a missing S7635 marker as drift (propagate #876 markers to already-pinned consumers) #878; needs a marker re-sweep once GAS#479 clears).

Root blocker (why the pr-review agent won't approve)

The PR Review Agent (.github-private, REVIEW_ENGINE=claude) skips any PR whose CI is failing — including non-required checks (decision:skip, reason:ci-failing). The failing checks here are infra noise, not real:

1. Cancelled dev-lead / dispatch + dev-lead / ci-relay checks (concurrency churn) on don-petry-authored standards-sync PRs → the agent reads CANCELLED as failing. Systemic — the main blocker. dev-lead should not leave blocking cancelled checks on non-dev-lead PRs (or the agent's CI gate should ignore superseded/cancelled non-required contexts, mirroring the ready-check tolerance).
2. google-app-scripts autofix fails on workflow-file PRs (App token lacks workflows permission).
3. ContentTwin Test failing (non-required) — investigate.
4. .github-private bats + template-drift — template-drift = repo-template byte-drift (files differ from templates though pins are correct); bats needs a look.

Definition of done

• The 6 PRs merge (via pr-review once CI noise is cleared) → broodly/markets/ContentTwin on dev-lead/v1-stable + marker.
• google-app-scripts dev-lead/auto-rebase/dependabot carry the S7635 marker.
• Compliance audit: 0 wrong-channel-pin findings fleet-wide.

Related follow-ups

#872 (pr-auto-review sweep hardening), #879 (in-place S7635 injection, systemic — plus its test-9 harness fix), #883 (comment tier-token cosmetic).

[don-petry]

Dev-Lead Implementation Plan

Issue: #884 — [#850] Finish #857 tail: 6 convergence PRs blocked on CI-infra noise

Verified live state (all 6 PRs, checked this run)

PR	Mergeable	Real remaining blocker
.github#866	✅	All checks green. Only needs-human-review label + review dispatch — not CI noise.
broodly#440	✅	All checks green. Needs review dispatch.
markets#369	✅	Only CANCELLED dev-lead/dispatch+ci-relay (already tolerated by the gate) + needs-human-review.
ContentTwin#383	✅	Real non-required Test FAILURE.
google-app-scripts#479	✅	Real non-required autofix FAILURE (App token lacks workflows perm).
.github-private#1351	✅	Clean; needs review dispatch.

Root-cause split

• Cancelled dev-lead/* checks (blocker Addressing PR comments #1): already tolerated in code today — ready-check.sh (pr-auto-review ready-check counts non-required/cancelled checks → false 'not passing', blocks auto-dispatch #680) gates on required contexts only and ignores non-required cancelled advisories; the review engine's compute_ci_status (feat(add-to-project): classify + track all issues + retire Discussion drafts #608) treats CANCELLED as non-blocking. .github's own gate is correct and covered by ready-check.bats / ready.bats.
• Real non-required FAILUREs (ContentTwin Test, GAS autofix): these still block the PR Review Agent because its gate compute_ci_status is not required-aware — it blocks on any non-own failing check, unlike ready-check.sh which ignores non-required contexts. The issue's requested systemic fix ("ignore non-required contexts, mirroring the ready-check tolerance") therefore lands in petry-projects/.github-private/scripts/lib/ci-status.sh, not in this .github repo.

Scope of this .github run

This repo's canonical CI gate (ready-check.sh) already implements the required-only tolerance the convergence relies on. The systemic engine change and the per-PR operational fixes live in other repos (.github-private, ContentTwin, google-app-scripts) and are out of this repo's committable source. In-scope, non-fabricated deliverable here: lock the exact #884 fleet-convergence fact-pattern into the canonical bats suite so the tolerance cannot silently regress, and hand off the operational + .github-private items with precise remediation notes.

Implementation Checklist

• Add a dedicated [#850] Finish #857 tail: 6 convergence PRs blocked on CI-infra noise (cancelled dev-lead checks + repo-specific fails) #884 regression test to test/workflows/pr-auto-review/ready.bats (required-green + both dev-lead/dispatch+dev-lead/ci-relay CANCELLED + a non-required failing advisory → dispatched).

Tests to Write

• ready.bats: "[#850] Finish #857 tail: 6 convergence PRs blocked on CI-infra noise (cancelled dev-lead checks + repo-specific fails) #884 fleet-convergence repro: required green + cancelled dev-lead pair + non-required failing advisory → dispatched"

Test Command

node_modules/.bin/bats --print-output-on-failure test/workflows/pr-auto-review/ and bash .dev-lead/scripts/dev-lead-lint.sh

Handoff (out of this repo's code scope)

1. Systemic (.github-private): make compute_ci_status required-aware — ignore non-required failing/cancelled contexts, mirroring ready-check.sh pr-auto-review ready-check counts non-required/cancelled checks → false 'not passing', blocks auto-dispatch #680. Unblocks ContentTwin#383 + GAS#479 + markets#369.
2. Operational: re-dispatch pr-review for the now-green PRs (.github#866, broodly#440, .github-private#1351); fix GAS autofix (workflows-scoped token); investigate ContentTwin Test; then S7635 marker re-sweep on GAS dev-lead/auto-rebase/dependabot; final compliance audit for wrong-channel pins.

[don-petry]

Dev-Lead: Implementation Complete

Summary

Issue #884 is a coordination tail of the #857 fleet convergence. I verified the live blocker for each of the 6 PRs and confirmed that the systemic CI-gate tolerance the issue asks for already exists in this repo's canonical gate (ready-check.sh, #680) and is fully tested. The one net-new, in-scope, non-fabricated change here is a regression test that locks the exact #884 fact pattern into the canonical bats suite so the tolerance the convergence depends on cannot silently regress.

Plan Execution

• Verified live state of all 6 convergence PRs (state, mergeability, per-check rollup)
• Root-caused the blocker split (cancelled dev-lead checks vs. real non-required failures)
• Added [#850] Finish #857 tail: 6 convergence PRs blocked on CI-infra noise (cancelled dev-lead checks + repo-specific fails) #884 regression test to ready.bats
• Full pr-auto-review bats suite green (66 tests)
• Required lint (.dev-lead/scripts/dev-lead-lint.sh) green

Test Results

ok 61 candidates: non-numeric MAX emits nothing (defensive)
ok 62 candidates: empty PR list emits nothing
ok 63 candidates: empty stdin emits nothing
ok 64 candidates: non-array API error body emits nothing
ok 65 candidates: an object missing isDraft is treated as non-draft
ok 66 candidates: all drafts → nothing

Files Changed

• test/workflows/pr-auto-review/ready.bats: +1 regression test pinning the [#850] Finish #857 tail: 6 convergence PRs blocked on CI-infra noise (cancelled dev-lead checks + repo-specific fails) #884 repro — required contexts green + both dev-lead / dispatch and dev-lead / ci-relay CANCELLED + a non-required Test FAILURE ⇒ dispatched. Passes against the existing required-only gate (no behavior change).

Why no gate code changed in .github

• .github's dispatch gate (ready-check.sh, pr-auto-review ready-check counts non-required/cancelled checks → false 'not passing', blocks auto-dispatch #680) already gates on required contexts only and ignores non-required cancelled/failing advisories — verified by ready-check.bats + ready.bats.
• The remaining live blocker for ContentTwin#383 (Test) and google-app-scripts#479 (autofix) is that the PR Review Agent's gate compute_ci_status is not required-aware — it blocks on any non-own failing check. The issue's requested systemic fix ("ignore non-required contexts, mirroring the ready-check tolerance") therefore lands in petry-projects/.github-private/scripts/lib/ci-status.sh, which is out of this repo's committable source.

TDD note

Per the Phase-2 exception: the tolerance under test is pre-existing correct behavior (#680), so this is a regression/characterization lock, not red→green TDD. The test passes on first run by design.

Handoff — remaining DoD (operational / other repos)

1. Systemic (.github-private): make compute_ci_status required-aware to mirror ready-check.sh pr-auto-review ready-check counts non-required/cancelled checks → false 'not passing', blocks auto-dispatch #680 → unblocks ContentTwin#383, GAS#479, markets#369.
2. Re-dispatch pr-review for the now-fully-green PRs: .github#866, broodly#440, .github-private#1351 (note .github#866 + markets#369 also carry needs-human-review).
3. GAS#479 autofix: needs a workflows-scoped token on workflow-file PRs.
4. ContentTwin#383 Test: investigate the repo-specific failure.
5. After merges: S7635 marker re-sweep on GAS dev-lead/auto-rebase/dependabot, then compliance audit for 0 wrong-channel-pin findings.

[don-petry]

Tail landed — all 6 convergence PRs merged, fleet max-quality

All tail PRs merged with verified-correct content (v-stable pins + S7635 + S7637 markers):

• markets#369, ContentTwin#383, .github-private#1351, google-app-scripts#479 — admin-merged (user-authorized) after the pr-review agent flagged these sanctioned verbatim stub-syncs as needs-human (risk=MEDIUM, empty findings) inconsistently (broodly got LOW-risk + auto-approved; identical PRs got MEDIUM). Required checks were green on all; only non-required infra checks (autofix/Test/bats/template-drift) failed.
• broodly#440, TalkTerm#405 — merged earlier via the engine.
• .github#866 — closed (empty/superseded; .github dependency-audit is self-hosted).

GAS's remaining marker gap closed: GAS#481 merged (dev-lead/v1-stable + auto-rebase/v2-stable + dependabot-automerge/v2-stable, all with the S7635 marker).

Fleet is now uniformly max-quality (correct v-form pins + S7635 markers) EXCEPT repo-template, whose baseline re-seed reverts the convergence to bare — tracked in #886 (the last wrong-channel-pin). The fleet-wide pr-auto-review dry-run 'drift' is benign (re-pins to the identical v1-stable — a compliance-check re-deploy quirk, not a wrong pin).

Residual follow-ups: #886 (repo-template re-seed), #480 (GAS autofix App-perm), #872/#879/#883 (robustness/cosmetic). Closing the tail; #886 carries the one remaining pin fix.