One CI step beside the self-ref pin, and test/vendored.test.sh covering
both directions: the manifest -> tree scan (missing, symlink, directory,
empty, ../ escape, absolute, untracked) and the closed-world root rule
(neither list, vendored, exempted, prose is not an input, no recursion
below the root), plus the real tree unmodified and the RELEASES.md
regression both ways.
The one-off `grep -Fx RELEASES.md` row at test/docs-sync.test.sh is
deleted (#251 D4): two spellings of "the manifest is right" is the drift
the manifest exists to prevent. Its intent is now a guard case, which the
next doctrine file inherits for free.
Refs #251
docs/VENDORED.txt is already machine-authoritative on the consumer side —
actions/docs-sync reads it as the sole declaration and enforces
"manifest union .ceremony/, nothing else". Nothing enforced the other end:
a doctrine file landing at ceremony every root with nobody adding it to
the manifest is a SILENT miss, because docs-sync only asserts
byte-identity for the files the manifest names.
Two directions, two mechanisms (#251 D2): manifest -> tree is a scan
(regular, non-empty, tracked, no symlink, no directory, no .. escape);
tree -> manifest is a closed-world rule over root *.md with a short
in-script exemption list, because nothing in the tree answers "which
files are vendorable".
Refs #251
Five fragments assembled into '## 0.5.0 — 2026-08-03' (#205#216#221#224#226); VERSION to bare 0.5.0; the three CEREMONY_SELF_REF carriers
stamped "0.5.0" in this one commit; the panel-rows unreleased marker in
docs/CONSUMERS.md cleared to name 0.5.0; drills/0.5.0.md records the
doors-unchanged ruling with the measurements as they are at 0ac3a6f.
Refs #233.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Consume the two displacement-fix fragments into the 0.4.1 section, stamp
VERSION and every CEREMONY_SELF_REF carrier, and record the doors-unchanged
drill ruling with the candidate-head evidence table.
Refs #212
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
crew#250 verified two facts the design prose now carries: a queue-
displaced run is not independently rerunnable (gh run rerun / --failed /
--job all refuse), so a victim PR had no manual escape hatch; and the
displacing burst is deterministic — one review_requested event per
panelist per request — so displacement is the steady state of a working
fleet, scaling with panel size, not a traffic spike.
CONSUMERS.md now walks the adoption as one atomic four-edit PR with crew
as the worked example: the pin bump in every ceremony uses: reference,
the new labels-sweep.yml caller, the cron RELOCATED (bold warning: a
copied-not-moved schedule double-fires sweeps into the one shared group
and reads as the bug getting worse after the fix), and actions: write
replacing the labels caller's actions: read.
Refs #209
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The sweep rode the same workflow run as the PR event that woke it, so
every displacement in the shared labels-reconcile queue recorded a
CANCELLED reconcile check on some PR — fake red CI that held review
requests. The reconcile + issueflow jobs move, unchanged, to a new
reusable labels-sweep.yml behind their own caller; labels.yml gains a
trigger job that dispatches the consumer's sweep caller with the plain
GITHUB_TOKEN (workflow_dispatch is a documented no-retrigger exemption)
on every event that used to run reconcile. A displaced sweep now cancels
on the Actions tab, attached to no PR; PR checks show scope + trigger.
Because every trigger-driven wake arrives as workflow_dispatch, the event
name alone no longer separates the operator's manual bootstrap from an
event-woken sweep: the sweep caller's bootstrap dispatch input does — the
trigger passes no, a bare manual dispatch defaults to yes. The sweep
reusable also takes pr_workflow_name, exported as SELF_WORKFLOW for the
#208 reconciler (harmless to earlier ones; zero file overlap with #208).
The trigger is deliberately loud: a pin bumped without the sweep caller,
its bootstrap input, or actions: write on the labels caller goes red at
the trigger job instead of silently never sweeping again — documented in
docs/CONSUMERS.md with the split stubs and the atomic-adoption note.
Refs #209
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The trigger comments, CONSUMERS stub, changelog, and reusable labels.yml
comment said "events carry every real state change in seconds; the cron
only backstops a forgotten handoff." That is backwards: no subscribed
event wakes this sweep for a review verdict landing (no pull_request_review
trigger), blocker:ci-red set/cleared, blocker:conflict when another PR
merges, or the time-based stale/48h-reclaim. The hourly cron is the sole
discovery path for those four classes, not a forgotten-handoff net —
so the comments now name them and warn against deleting the cron (AC5).
codex-2 / kimi-2 (both blocking, round 2 @0a812c4b).
Round fixes on #200.
codex-1 (blocking): the issues narrowing dropped `edited`/`reopened`, but both
carry a queue-state change an event uniquely carries — `edited` a body rewrite
of the `Blocked by #N` declaration the sweep parses
(issueflow-reconcile.sh:179), `reopened` a closed issue re-entering the queue.
Dropping them tripped #199's must-fail. Narrow to
`[opened, closed, edited, reopened]`, dropping only the churn/validation
actions labeled/unlabeled/assigned/unassigned. Trigger tests now pin
edited/reopened present and the four dropped; labels.test.sh exact-list updated.
kimi (blocking): the "supersedes unreleased #144" prose was false — #144's
edited/reopened shipped in 0.3.0. Dissolved: we now keep them. CONSUMERS prose
rewritten to the real version history (0.2.0 #32 / 0.3.0 #144 / #199 narrows),
and the #137 review-request line corrected from "unreleased" to shipped-in-0.3.0.
kimi (non-blocking): reusable labels.yml comment no longer cites */15.
codex-2 (AC1 after-measurement / closing) escalated to triage on #199 — held,
not guessed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The advisory */15 cron fired a full-board sweep four times an hour at
GitHub's 1-minute billing floor; events carry real state changes in
seconds, so the cron only backstops a forgotten handoff. Relax it to
hourly and narrow the issues: trigger to [opened, closed] — the two
actions with promptness-critical reconcile behavior — dropping the
labeled/unlabeled churn source. Per-trigger why-comments added.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The reconciler's rule was right and blind: the caller never listened on
review_requested/review_request_removed, so the one event that falsifies
(or restores) blocker:unrequested could not clear it, and a quiet repo
wore the red flag until the advisory cron (#137's timeline: 93 seconds,
cleared only by an unrelated PR's push).
- self-labels.yml + the CONSUMERS.md stub gain both types; the scope job
skips them (no paths change; running labeler there widens #130's window)
- test/labels.test.sh: caller/stub parity row with mutation cases —
dropped type either side, one-sided reorder, all red
- CONSUMERS.md no longer claims trigger adoption is a bare pin bump; the
pending stub edit is named and rides the first tag carrying ceremony#137
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The mapping header still described actions/labeler@v5 + sync-labels —
the exact mechanism this PR removed; it now describes labels-scope's
base-ref read and additive POST, keeping the #128 incident. The
scope:labels row gains actions/labels-scope/** and its test, and two
fixtures derive against the real mapping so the coverage is tested, not
just present. The reconcile job comment names labels-scope instead of
labeler (grok nit 3).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bare X.Y.Z at the head where the base says otherwise, no release label,
not a draft: the sweep emits one :⚠️: per pass naming both
versions. A warning only — release is declared intent and the reconciler
never guesses intent (LABELS.md). Version read via the API, both
backends, jq not node; unreadable reads nag nobody. Plus the yq test
contract in CI and fixture tests for the guard matrix.
Part of #130.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
actions/labeler@v5 writes the whole label set (setLabels PUT) even under
sync-labels: false, so a label applied between its read and its write is
silently removed — ceremony#128 lost `release` that way. v6/v7 write the
same way. Replace the step with actions/labels-scope: same labeler.yml
mapping (changed-files/any-glob-to-any-file subset, refused loudly
otherwise), changed paths via the API, and an additive POST as the only
write.
Part of #130.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
release-exercise.yml's fixture arms with changelog.d/ and stamps through
the real assembler (#112 D12). The assembled suite's trio row expected
changelog-armed green on the dropped-entry tree — true when #116 was
written, false since #115's fragment mode landed after it (main is red at
736733e on exactly this row); the row now asserts the interaction as it
stands, and the hand-edited tree carries the only-red claim.
CONTRIBUTING's flow item, BUILDER.md's entry rule, and the PR template
checklist all point at changelog.d/<issue>.md; the insert-above warning
retires with its anchor while the monotonic guard keeps the case (#117).
Stamp 2 is one assembler-produced edit; changelog-armed's rule is stated
mode-first (fragment, then legacy, #112 D7/D8/D9); changelog-assembled
gets its operator section (#116); monotonic records D10; the two rewritten
error strings and the retired re-arm recovery follow (#117).
The flip's mechanical half (#117): the 26 entries under '## Unreleased'
move verbatim to changelog.d/<issue>.md, the heading is deleted, the
directory gains its marker README (#112 D1) and this PR's own fragment
(112.md), CHANGELOG.md's preamble describes fragments, and labeler.yml
maps changelog.d/** into scope:release-flow.
VERSION at 0.1.0-dev, the armed CHANGELOG.md, drills/README.md (what a
drill means here), the self-callers (self-release.yml, self-labels.yml —
local uses:, the one form consumers must never copy), .github/labeler.yml
for the scope job, and the three self-guards in CI. labels.yml gains the
self-consumption bypass (release.yml's twin) so the label bootstrap can run
before any release tag exists; action-exercise's armed/drill-recorded
scratch steps move to self-guards per their own eviction note.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The fixture consumer is the workspace root (a uses: step cannot cd);
ceremony rides a subdirectory checkout serving as both the local action
ref and the --source override. CONSUMERS.md gains the wiring, bootstrap,
and pin-bump procedure (#12's section, amended in the same cycle).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Port box's drill-recorded.sh (the origin of the three copies) as a
composite action on the #5 pattern: version read through lib/version.sh,
one file per version under drills/, whitespace-only records refused.
Keyed on the tree's version — -dev trees pass with a notice that says
why nothing was asserted; bare trees must show drills/<version>.md with
at least one non-whitespace character.
Closes#7
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The action-exercise job commits a scratch base, marks it as an in-job
fixture branch, commits an insert-above edit, and runs the composite
action against that history — proving the wiring AND a genuine
merge-base comparison, not just an action.yml parse. Base ref passed
explicitly: the shallow PR checkout has no origin/main to resolve.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round 1's shared blocking catch: release-exercise's call job proves the
parse but executes no steps (both doors are push-gated, by design), and
fixture-chain drives the scripts, not the workflow. The new step-replay
job executes the merge door's early sequence for real — both checkout
shapes including path: .ceremony-src, both branches of the bypass via a
matrix standing in for the repository test, the CEREMONY_DIR wiring, and
facts → decide → notes through genuine $GITHUB_OUTPUT plumbing — against
a fixture tree with a stubbed gh. Wired into PR CI as standing evidence;
PR-only, because a push-to-main workflow_call would hand release.yml the
merge door's exact gate. release.yml's honest-gap paragraph narrows to
what stays untested until #11: the doors themselves.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Closes#9. .github/workflows/release.yml (workflow_call) replaces box's,
rig's and cast's release.yml: the merge door (facts -> decide -> notes ->
tag+publish+bump, every decision in a tested lib script) and the tag door
(the manual fallback and backfill, no bump). Plus lib/facts.sh (the merge
door's impure half, contract-tested against fixture repos with a stubbed
gh), the self-ref pin guard (.github/scripts/self-ref-check.sh + CI step +
tests), the release-exercise scratch caller (dry wiring), the end-to-end
script-chain rehearsal, and the caller + artifact-hook contracts in
docs/CONSUMERS.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Port box's changelog-armed.sh as the first composite action, establishing
the pattern #6 and #7 copy: action.yml passes inputs as env vars, the
co-located script stays directly runnable, and the shared libs are sourced
relative to the action so they travel with it at the consumer's pinned ref.
Port deltas per issue #5: the version goes through version_read (#3) so the
guard works for package-json trees, and the bare-version emptiness check
consults changelog_section (#4) — the guard and the publisher cannot
disagree about what a section is. Messages and the header essay keep the
box#108 / rig#66 / rig#44 / cast#108 history; this is the guard rig and
cast regain at adoption.
CI gains an action-exercise job driving uses: ./actions/changelog-armed
against a scratch armed tree — the composite wiring proven, not just the
script.
Closes#5
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
