From 86bbb33eb62a487b56f05aada2d741d382eade42 Mon Sep 17 00:00:00 2001 From: Tomer Weller Date: Tue, 25 Aug 2026 00:05:50 +0000 Subject: [PATCH 1/2] =?UTF-8?q?Regression=20test=20for=20#3820=20=E2=80=94?= =?UTF-8?q?=20fails=20on=20current=20main?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a structural TAP self-test asserting monitor-tick check (11) gates the `urgent` label on a failing `Verify Execution (Mainnet)` workflow, strikes the stale "blocks deploy and meets the urgent criteria" rationale, and drops the unconditional `gh issue create --label urgent`. Fails on main today because the stale sentence is present and check (11) applies urgent unconditionally. Refs #3820 Co-authored-by: Claude Code --- scripts/test-monitor-skill-snippets.sh | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/scripts/test-monitor-skill-snippets.sh b/scripts/test-monitor-skill-snippets.sh index 9f23dd18..342e07e3 100755 --- a/scripts/test-monitor-skill-snippets.sh +++ b/scripts/test-monitor-skill-snippets.sh @@ -55,7 +55,7 @@ cleanup() { trap cleanup EXIT # ── TAP state ──────────────────────────────────────────────────────────────── -TAP_PLAN=478 +TAP_PLAN=479 TAP_CURRENT=0 TAP_FAILURES=0 @@ -11288,6 +11288,30 @@ Cargo.toml" tap_not_ok "structural: Test 6 boundary check is deterministic and guarded (#3766)" \ "Test 6 must mock 7199 (not the exact 7200 boundary) and guard its check_session_wiped call via exit_code6" fi + + # ── Structural self-test: check (11) urgent-label gate is conditional (#3820) ── + # Post-#3351 the deploy gate consumes ONLY `Verify Execution (Mainnet)`, so a + # main-branch CI failure is `urgent` ONLY when that exact workflow is red. + # Guard against the pre-#3820 regressions: + # (a) the stale "blocks deploy and meets the urgent criteria" rationale must + # be gone (§10 removed the CI-blocks-deploy premise it rested on); + # (b) the section must gate the urgent label on `Verify Execution (Mainnet)`; + # (c) step 5's `gh issue create` must NOT carry an unconditional + # `--label urgent` — the label is appended only via an `ONLY IF` gate. + # Scope to the extracted `## CI check workflow` section so unrelated matches + # elsewhere in SKILL.md (e.g. §10) can't mask a regression. + local ci_section + ci_section=$(extract_md_section "$tick_md" '^## CI check workflow') + if [[ -n "$ci_section" ]] \ + && ! grep -q 'blocks deploy and meets the urgent criteria' <<<"$ci_section" \ + && grep -q 'Verify Execution (Mainnet)' <<<"$ci_section" \ + && ! grep -q 'gh issue create --label urgent' <<<"$ci_section" \ + && grep -q 'ONLY IF' <<<"$ci_section"; then + tap_ok "structural: check (11) gates urgent on Verify Execution (Mainnet), stale blocks-deploy rationale struck (#3820)" + else + tap_not_ok "structural: check (11) gates urgent on Verify Execution (Mainnet), stale blocks-deploy rationale struck (#3820)" \ + "check (11) must strike 'blocks deploy and meets the urgent criteria', gate urgent on 'Verify Execution (Mainnet)', and drop the unconditional 'gh issue create --label urgent' in favor of an 'ONLY IF' gate" + fi } check_skill_structure run_tests From 596f3844d767bbe7c0eac4b5e12a679adf74166d Mon Sep 17 00:00:00 2001 From: Tomer Weller Date: Tue, 25 Aug 2026 00:07:49 +0000 Subject: [PATCH 2/2] Gate check (11) urgent label on Verify Execution (Mainnet) failure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Post-#3351, §10 step 4 removed the "CI failure blocks deploy" gate: the deploy signal now targets the latest green Verify Execution (Mainnet), so a red run of that workflow is the only CI conclusion that defers deploy (and independently signals a hash/parity mismatch). Check (11) steps 4/5 still applied `urgent` unconditionally to any main-branch CI failure, resting on the now-false "blocks deploy" rationale — mislabeling benign failures (Quickstart, CI, Gitlinks, …) as urgent and driving alarm fatigue. Gate the urgent label on the failing workflow being Verify Execution (Mainnet) in both the existing-issue (step 4) and new-issue (step 5) paths, strike the stale rationale sentence, and add a one-line clarification to the canonical label policy tying the CI criterion to that workflow. Refs #3820 Co-authored-by: Claude Code --- .claude/skills/monitor-tick/SKILL.md | 12 ++++++++---- scripts/lib/monitor-label-policy.md | 2 +- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.claude/skills/monitor-tick/SKILL.md b/.claude/skills/monitor-tick/SKILL.md index d846a5f6..6a6ce6e2 100644 --- a/.claude/skills/monitor-tick/SKILL.md +++ b/.claude/skills/monitor-tick/SKILL.md @@ -2213,12 +2213,16 @@ Only act on failures from the last 2 hours (compare `createdAt` with 4. Check for an existing open issue: `gh issue list --search "" --state open`. If one matches, `gh issue comment ` with the new evidence (sha, log - snippet, timestamp) and ensure it has the `urgent` label - (`gh issue edit --add-label urgent`) — failing CI on origin/main - blocks deploy and meets the urgent criteria. + snippet, timestamp). Add the `urgent` label + (`gh issue edit --add-label urgent`) **ONLY IF** the failing workflow is + `Verify Execution (Mainnet)` — post-#3351 that is the sole workflow the + deploy gate consumes (§10 step 4), and its failure is a hash/parity mismatch + that independently meets the urgent criteria. Every other main-branch + workflow (`CI`, `Quickstart`, `Gitlinks`, `History Publish`, `Push on main`) + no longer gates deploy, so comment/file it **unlabeled**. **Board-route:** if NOT on project board, add to Backlog: `bash .github/skills/shared/scripts/move-issue-status.sh "$N" backlog` -5. Otherwise, file a new issue: `gh issue create --label urgent --title ": " --body "..."` with investigation findings. +5. Otherwise, file a new issue: `gh issue create --title ": " --body "..."` with investigation findings — append `--label urgent` **ONLY IF** the failing workflow is `Verify Execution (Mainnet)` (same predicate as step 4); every other main-branch workflow files **unlabeled**. **Board-route:** `bash .github/skills/shared/scripts/move-issue-status.sh "$N" backlog` 6. Do NOT commit a fix. Report: `CI ISSUE FILED — failed on , filed/commented #`. diff --git a/scripts/lib/monitor-label-policy.md b/scripts/lib/monitor-label-policy.md index e2a43486..53943d4c 100644 --- a/scripts/lib/monitor-label-policy.md +++ b/scripts/lib/monitor-label-policy.md @@ -10,7 +10,7 @@ | Label | Criteria | Examples | |-------|----------|----------| -| `urgent` | Blocks validator operation or consensus participation | Hash mismatch (any kind), wedged node (frozen event loop, watchdog auto-abort), failing CI on origin/main blocking deploy, panic or crash from production code, SYNC FAILURE past active deadline, OOM-driven restart, deploy regression | +| `urgent` | Blocks validator operation or consensus participation | Hash mismatch (any kind), wedged node (frozen event loop, watchdog auto-abort), failing CI on origin/main blocking deploy (post-#3351 that means a failing `Verify Execution (Mainnet)` run — the only workflow the deploy gate consumes; other workflow failures no longer gate deploy and file **unlabeled**), panic or crash from production code, SYNC FAILURE past active deadline, OOM-driven restart, deploy regression | | `alarm-regression` | Alarm that was meaningfully active (≥5% of ticks) in the replay baseline has gone completely silent (0% firing) in the current replay window | An alarm tracking recovery-stalled ticks that stops firing after a code change, an alarm for high open_fds that disappears after a refactor | | *(no label)* | Non-urgent: does not block operation | Calibration, threshold tuning, NONC alerts, cosmetic noise, follow-up improvements, metric drift without visible effect | | `not-ready` | Needs operator decision before any code change | Tier-3 self-reflection issues, design decisions pending, ambiguous requirements needing human input |