Gate check (11) urgent label on Verify Execution (Mainnet) failure

.claude/skills/monitor-tick/SKILL.md

@@ -2213,12 +2213,16 @@ Only act on failures from the last 2 hours (compare `createdAt` with
 4. Check for an existing open issue:
    `gh issue list --search "<workflow name + signature>" --state open`.
    If one matches, `gh issue comment <N>` with the new evidence (sha, log
-   snippet, timestamp) and ensure it has the `urgent` label
-   (`gh issue edit <N> --add-label urgent`) — failing CI on origin/main
-   blocks deploy and meets the urgent criteria.
+   snippet, timestamp). Add the `urgent` label
+   (`gh issue edit <N> --add-label urgent`) **ONLY IF** the failing workflow is
+   `Verify Execution (Mainnet)` — post-#3351 that is the sole workflow the
+   deploy gate consumes (§10 step 4), and its failure is a hash/parity mismatch
+   that independently meets the urgent criteria. Every other main-branch
+   workflow (`CI`, `Quickstart`, `Gitlinks`, `History Publish`, `Push on main`)
+   no longer gates deploy, so comment/file it **unlabeled**.
    **Board-route:** if NOT on project board, add to Backlog:
    `bash .github/skills/shared/scripts/move-issue-status.sh "$N" backlog`
-5. Otherwise, file a new issue: `gh issue create --label urgent --title "<workflow>: <short signature>" --body "..."` with investigation findings.
+5. Otherwise, file a new issue: `gh issue create --title "<workflow>: <short signature>" --body "..."` with investigation findings — append `--label urgent` **ONLY IF** the failing workflow is `Verify Execution (Mainnet)` (same predicate as step 4); every other main-branch workflow files **unlabeled**.
    **Board-route:** `bash .github/skills/shared/scripts/move-issue-status.sh "$N" backlog`
 6. Do NOT commit a fix. Report: `CI ISSUE FILED — <workflow> failed on <sha>, filed/commented #<N>`.
 

scripts/lib/monitor-label-policy.md

@@ -10,7 +10,7 @@
 
 | Label | Criteria | Examples |
 |-------|----------|----------|
-| `urgent` | Blocks validator operation or consensus participation | Hash mismatch (any kind), wedged node (frozen event loop, watchdog auto-abort), failing CI on origin/main blocking deploy, panic or crash from production code, SYNC FAILURE past active deadline, OOM-driven restart, deploy regression |
+| `urgent` | Blocks validator operation or consensus participation | Hash mismatch (any kind), wedged node (frozen event loop, watchdog auto-abort), failing CI on origin/main blocking deploy (post-#3351 that means a failing `Verify Execution (Mainnet)` run — the only workflow the deploy gate consumes; other workflow failures no longer gate deploy and file **unlabeled**), panic or crash from production code, SYNC FAILURE past active deadline, OOM-driven restart, deploy regression |
 | `alarm-regression` | Alarm that was meaningfully active (≥5% of ticks) in the replay baseline has gone completely silent (0% firing) in the current replay window | An alarm tracking recovery-stalled ticks that stops firing after a code change, an alarm for high open_fds that disappears after a refactor |
 | *(no label)* | Non-urgent: does not block operation | Calibration, threshold tuning, NONC alerts, cosmetic noise, follow-up improvements, metric drift without visible effect |
 | `not-ready` | Needs operator decision before any code change | Tier-3 self-reflection issues, design decisions pending, ambiguous requirements needing human input |

scripts/test-monitor-skill-snippets.sh

@@ -55,7 +55,7 @@ cleanup() {
 trap cleanup EXIT
 
 # ── TAP state ────────────────────────────────────────────────────────────────
-TAP_PLAN=478
+TAP_PLAN=479
 TAP_CURRENT=0
 TAP_FAILURES=0
 
@@ -11288,6 +11288,30 @@ Cargo.toml"
     tap_not_ok "structural: Test 6 boundary check is deterministic and guarded (#3766)" \
       "Test 6 must mock 7199 (not the exact 7200 boundary) and guard its check_session_wiped call via exit_code6"
   fi
+
+  # ── Structural self-test: check (11) urgent-label gate is conditional (#3820) ──
+  # Post-#3351 the deploy gate consumes ONLY `Verify Execution (Mainnet)`, so a
+  # main-branch CI failure is `urgent` ONLY when that exact workflow is red.
+  # Guard against the pre-#3820 regressions:
+  #   (a) the stale "blocks deploy and meets the urgent criteria" rationale must
+  #       be gone (§10 removed the CI-blocks-deploy premise it rested on);
+  #   (b) the section must gate the urgent label on `Verify Execution (Mainnet)`;
+  #   (c) step 5's `gh issue create` must NOT carry an unconditional
+  #       `--label urgent` — the label is appended only via an `ONLY IF` gate.
+  # Scope to the extracted `## CI check workflow` section so unrelated matches
+  # elsewhere in SKILL.md (e.g. §10) can't mask a regression.
+  local ci_section
+  ci_section=$(extract_md_section "$tick_md" '^## CI check workflow')
+  if [[ -n "$ci_section" ]] \
+     && ! grep -q 'blocks deploy and meets the urgent criteria' <<<"$ci_section" \
+     && grep -q 'Verify Execution (Mainnet)' <<<"$ci_section" \
+     && ! grep -q 'gh issue create --label urgent' <<<"$ci_section" \
+     && grep -q 'ONLY IF' <<<"$ci_section"; then
+    tap_ok "structural: check (11) gates urgent on Verify Execution (Mainnet), stale blocks-deploy rationale struck (#3820)"
+  else
+    tap_not_ok "structural: check (11) gates urgent on Verify Execution (Mainnet), stale blocks-deploy rationale struck (#3820)" \
+      "check (11) must strike 'blocks deploy and meets the urgent criteria', gate urgent on 'Verify Execution (Mainnet)', and drop the unconditional 'gh issue create --label urgent' in favor of an 'ONLY IF' gate"
+  fi
 }
 check_skill_structure
 run_tests