[garrytan]

{
  "schema_version": 1,
  "pr": 3515,
  "head": "c7f6daa7a497c57ca75fa2e23a22a8a4728caa90",
  "version": "1.91.277.0",
  "base": "main",
  "gate": {
    "remote free gate (Ubicloud, whole free tier, tree db28ddaf67c4)": {
      "pass": 19401,
      "fail": 0,
      "skip": 0
    },
    "CI at 64684de (Free Tests run 40518449716, Windows Free Tests run 40518449728 and the other workflows)": {
      "pass": 48,
      "fail": 0,
      "skip": 11
    },
    "focused bun test (13 files)": {
      "pass": 302,
      "fail": 0,
      "skip": 0
    },
    "test:quick (4 shards, local 4-core; 5 fails are 2 environment-only files and 1 load flake green on rerun)": {
      "pass": 21173,
      "fail": 5,
      "skip": 0
    }
  },
  "session_kind": "unattended",
  "pregate": "requires-remote cleared @db28ddaf67c4 (1 checks, current for 64684de144e5)",
  "requires_remote": [
    "free-tests.yml/cso-macos-launcher: https://github.com/garrytan/gstack/actions/runs/40518449716",
    "free-tests.yml/macos-named-regressions: https://github.com/garrytan/gstack/actions/runs/40518449716",
    "free-tests.yml/cso-windows-launcher: https://github.com/garrytan/gstack/actions/runs/40518449716",
    "windows-free-tests.yml/windows-free-shard: https://github.com/garrytan/gstack/actions/runs/40518449728",
    "pregate.json/remote_gate: remote-gate tree=db28ddaf67c4 tests=19401"
  ],
  "issues": {
    "fixes": [],
    "refs": [
      3485,
      3499,
      3504
    ],
    "flakes": []
  },
  "docs": {
    "status": "updated",
    "scope": "docs/, README.md, CONTRIBUTING.md, AGENTS.md, CLAUDE.md (first audit at f1635d0 updated 4 files; read-only re-audit at 8c12f8d found every doc current)"
  },
  "review_loop": {
    "passes": 6,
    "blocking_found": 0,
    "deferred": 0,
    "noted": 3,
    "fixed": 8,
    "scope": "frozen"
  },
  "carry": {
    "from": "64684de144e5c5b8934408514b44434559487b18",
    "reason": "base merge + release metadata",
    "product_patch_id": "c30253c25c3056f6934d4bbf4a03c48955cef45d",
    "changed_paths": [
      "metadata:CHANGELOG.md",
      "metadata:VERSION",
      "metadata:agents-digest/gstack-AGENTS.md",
      "product:bin/gstack-pr-wait",
      "product:bin/gstack-ship-receipt",
      "product:docs/TESTING_INTERNALS.md",
      "product:docs/pregate.md",
      "product:docs/ship-policy.md",
      "product:docs/standalone-binaries.md",
      "product:docs/troubleshooting.md",
      "product:lib/pr-wait-github.ts",
      "product:lib/pr-wait.ts",
      "product:lib/restamp.ts",
      "product:lib/ship-queue-train-ready.ts",
      "product:lib/ship-queue-train.ts",
      "product:lib/ship-receipt-prose.ts",
      "product:lib/ship-receipt.ts",
      "product:lib/tree-receipt.ts",
      "metadata:package.json",
      "product:scripts/eval-readiness.ts",
      "product:scripts/train-gate.ts",
      "test:test/eval-readiness.test.ts",
      "test:test/gstack-restamp-queue.test.ts",
      "test:test/gstack-ship-receipt-docs.test.ts",
      "test:test/pr-wait.test.ts",
      "test:test/ship-queue-train-ops.test.ts",
      "test:test/ship-queue-train.test.ts",
      "test:test/ship-receipt-prose.test.ts",
      "test:test/train-gate.test.ts",
      "test:test/tree-receipt-stamp-sensitive.test.ts"
    ],
    "merge_commits": 1,
    "range_diff": "1:  e08612e = 1:  e08612e Eval selection exemptions, review-floor rulings and the GSTA-121 follow-ups\n2:  1f77181 = 2:  1f77181 fix: pre-landing review fixes\n3:  f1635d0 = 3:  f1635d0 fix: pre-landing review fixes (pass 2)\n4:  ecf3ad7 = 4:  ecf3ad7 fix: adversarial review fixes\n5:  f7eeda8 = 5:  f7eeda8 fix: pre-landing review fixes (pass 4)\n6:  8c12f8d = 6:  8c12f8d fix: pre-landing review fixes (pass 5)",
    "covers": [
      "pre-landing review",
      "adversarial review",
      "gate integrity",
      "documentation audit"
    ],
    "reruns": [
      "CI at head (gstack-ship-queue ready requires it); test and helper code changed since the reviewed head runs there unreviewed"
    ]
  }
}

What changed

A licence line, a notice entry or a crew template planned the whole paid gate (113 cases, 24 judges); now they plan none, and an ETHOS.md edit plans the three cases and one judge that read it (#3499).

Before/after as text: the PR eval selection, one changed file at a time

--- Before · origin/main@a1934a1498ec
+++ After · this branch
 $ bun run scripts/eval-select.ts  (PR profile, one changed file at a time)
-NOTICE.md                          mode full-fallback  e2e cases 113  judges 24  unknown dependency -> whole gate
-LICENSE                            mode full-fallback  e2e cases 113  judges 24  unknown dependency -> whole gate
-licenses/MIT-pstack.txt            mode full-fallback  e2e cases 113  judges 24  unknown dependency -> whole gate
-captain/templates/merge-ask.md     mode full-fallback  e2e cases 113  judges 24  unknown dependency -> whole gate
-ETHOS.md                           mode full-fallback  e2e cases 113  judges 24  unknown dependency -> whole gate
+NOTICE.md                          mode pr             e2e cases   0  judges  0
+LICENSE                            mode pr             e2e cases   0  judges  0
+licenses/MIT-pstack.txt            mode pr             e2e cases   0  judges  0
+captain/templates/merge-ask.md     mode pr             e2e cases   0  judges  0
+ETHOS.md                           mode pr             e2e cases   3  judges  1

The remote free gate packed the live .git with tar and lost the race against a reviewer's git; the snapshot now goes through git's own transport.

Before/after as text: ubi-runner pack under concurrent git

--- Before · origin/main@a1934a1498ec
+++ After · this branch
-PREGATE_REMOTE_INFRA: tar: .git: file changed as we read it
-tar exit 1 (3 of 3 packs under concurrent git)
+ubi-runner pack: refs fetched into a fresh repository, index and staged blobs carried
+pack exit 0 (3 of 3 packs under 20 s of index.lock, worktree and ref churn)
+unpacked: same HEAD, origin/main, remote URL, status and gstack-wtree as the source

Why

"A licence line or a changelog entry costs a full gate screen (about $30 planned for a docs PR) without any paid case reading the changed bytes" (#3499, filed from #3493's ship), and "the same classes of finding reached the owners again on every ship after being judged below the floor once" (#3504, #3485). A notice, licence or crew-template edit now plans no paid case, an ETHOS.md edit plans the four checks that read it, and a finding in one of the six ruled classes is a note from pass 1 on, with the floor itself unchanged. GSTA-121's three gaps close with it. The merge-ask template and docs/skills.md carry the Blast radius item the PR body already had, an approval record can cite screen 40477638211 GREEN without the scanner reading the run id as a phone number, and a review subagent's git diff can no longer fail the remote gate's tar.

Blast radius

Four surfaces beyond the files named are touched. First, every PR's paid selection (narrower only for NOTICE.md, LICENSE, licenses/**, captain/templates/** and ETHOS.md; every other unmapped file still restores the full gate, pinned in test/paid-free-boundary.test.ts), every scanner that reads pii.phone.e164 (an 11-digit span right after a run word is a run id in gstack-approvals, gstack-decision-trail, the pregate secrets check and gstack-post alike; a national number written without its + after failed or run is the accepted residual of the ruling that a run id is not a phone number), the generated review SKILL.md on five hosts (byte-for-byte at its pins; the size guard and the parity suite are green), and every ubi-runner pack consumer (the snapshot carries the index's blobs that HEAD lacks, replays remote.* and branch.*, skips gitlinks, and leaves no temp repository on failure; submodule repositories and a split index enabled without core.splitIndex are the known gaps, both older than this change). Evidence rung: the remote free gate ran the whole free tier on the final tree through the new pack (19,401 tests, 0 failed), and CI at the pin is green (48 passed, 0 failed, 11 skipped).

Approvals

Date	Asked	Exact words	Outcome	Covers	Still pending
2026-10-27	Rule 19: merge origin/main into #3515 once so CI schedules on the pin (CHANGELOG, touchfiles-data, paid-free-boundary conflicts)	“Rule 19 grant for #3515: merge origin/main at 6ff98c6 (v1.91.277.0, as of this message) once, as a merge commit with your prepared resolution. No rebase. The grant is spent on that one push” (GStack Minder (GSTA-36))	approved	one merge commit of origin/main@6ff98c66 into eval-select-review-floor-followups (64684de); spent	none

Source: gstack-approvals record for eval-select-review-floor-followups (display only; not an approval citation).

Summary

• Eval selection (eval selection: NOTICE.md/CHANGELOG.md/licenses should never widen the PR gate; register ETHOS.md's consumers (plus two prompt notes from #3493) #3499): RELEASE_METADATA_FILES (NOTICE.md, LICENSE, licenses/**) and captain/templates/** in FREE_ONLY_PR_FILES in scripts/test-pr-profile.ts; ETHOS.md registered under the /office-hours and /plan-ceo-review cases and judge in test/helpers/touchfiles-data.ts; SECURITY.md replaces it as the unregistered example in test/pr-dependencies.test.ts, test/paid-pr-profile.test.ts, test/exercised-map.test.ts; scripts/harness-version.json re-pinned non-behaviorally. The two prompt notes in eval selection: NOTICE.md/CHANGELOG.md/licenses should never widen the PR gate; register ETHOS.md's consumers (plus two prompt notes from #3493) #3499 (plan-tune and eval-plan wording) are not in this PR.
• Review floor (Deferred items from the /ship review of #3487 (docs-caps fail-open and symlinks, docs not in the receipt schema, --check-prose unwired, REVIEW_SCOPE_KEY_VERSION move) #3504, Deferred findings from the /ship review of #3484 (train ops) #3485): docs/review-policy.md#rulings-below-the-floor (six classes); the On record ground in scripts/resolvers/review-army.ts, rendered into review/sections/review-army.md and ship/sections/review-army.md with the other grounds tightened so the pins hold. The floor text is unchanged.
• Windows curation (Deferred findings from the /ship review of #3484 (train ops) #3485): test/pregate-remote-stamp-only.test.ts is KNOWN_WINDOWS_INCOMPATIBLE in scripts/lib/windows-curation.ts; the how-to in docs/TESTING_INTERNALS.md.
• Blast radius (GSTA-121): captain/templates/merge-ask.md, docs/skills.md ("The PR body"), docs/captain.md, capy/skill/gstack/captain.md, bin/gstack-pr-shots (caption), ship/sections/capy-pr.md and .tmpl (heading).
• Run-id exemption (GSTA-121): CI_RUN_WORD_BEFORE and isCiRunIdentifier in lib/redact-patterns.ts; lib/gstack-post.ts imports the shared regex; docs/troubleshooting.md and docs/pregate.md.
• Pack snapshot (GSTA-121): scripts/ubicloud/ubi-runner.sh cmd_pack.
• Import graph (GSTA-121): relative string literals are edges in lib/pregate/import-graph.ts, so test/ship-publication-gates.test.ts is selected when the pr-body template changes.
• Tests: test/paid-free-boundary.test.ts, test/redact-context-exemptions.test.ts, test/approval-record.test.ts, test/pregate-allowlist.test.ts, test/gstack-post.test.ts, test/ubicloud-runner.test.ts, test/pregate-import-graph-paths.test.ts. Release notes: CHANGELOG.md Unreleased entry.

Tests

• Remote free gate (Ubicloud, whole free tier, tree db28ddaf67c4 at the pin, through the new pack): 19,401 tests, 0 failed, $0.15; the pre-merge tree 31401568d0c2 ran it too (19,214, 0 failed, $0.08).
• CI at 64684de: 48 passed, 0 failed, 11 skipped (Free Tests run 40518449716, Windows Free Tests run 40518449728); the three platform pregate lanes are cleared with those runs.
• Merge of origin/main@6ff98c66 (v1.91.277.0) under GStack Minder's rule 19 grant: CHANGELOG.md (both entries kept), test/helpers/touchfiles-data.ts (GSTA-96's entries kept, ETHOS.md added to the plan-ceo-review entries main left without it) and test/paid-free-boundary.test.ts (LICENSE and NOTICE.md are no longer full-fallback examples) resolved; selection tests, redaction, pack, parity and size-guard suites green on the merged tree.
• Focused: 302 tests across 13 files pass; bun run typecheck clean; typecheck:test 819 known, none new; gen:skill-docs fresh; parity suite and SKILL.md size guard green; gstack-prose-lint CHANGELOG.md --unreleased --gate ok.
• bun run test:quick on this 4-core Capy machine: 21,173 pass, 5 fail in files this PR does not touch: test/gstack-retro-metrics.test.ts (2, this machine forces the git author through /etc/capy/git-identity.conf), test/cso-witness.test.ts (2, "Build CSO first: bun run build:cso"), test/gstack-gbrain-mcp-verify.test.ts (1, green on its one rerun alone; rule 16). All five pass on the remote gate.

Pre-Landing Review

Six passes under frozen scope, 0 blocking. Pass 1 (full diff): six specialists and the core checklist NO FINDINGS; Red Team 5 INFORMATIONAL (4 fixed, 1 noted). Pass 2 (fix range): state machines found the pass-1 EXIT trap read a local after unwinding and its test was vacuous; both fixed. Pass 3: clean. Pass 4 (after the adversarial fixes): 4 INFORMATIONAL (gitlink abort, valueless-key test, CHANGELOG wording, blob-list size), all fixed. Pass 5 and 6: clean, converged at the cycle cap.
Gate edits: none detected (4 listed, 2 read; patterns: RH-1,RH-3,RH-4,RH-12,RH-13,RH-14,RH-15,RH-16; unlisted idioms: none).
Outside review: Codex not installed on this machine; outside coverage unavailable. Native adversarial (Claude): four passes; the first found two floor-level defects the specialists missed (a stale scripts/harness-version.json pin that fails test/harness-version.test.ts, and staged blobs missing from the pack snapshot so a VM gstack-wtree could not read a staged file), both fixed; the fourth pass at the final tree: no FIXABLE, two INVESTIGATE notes below.

Review notes

Below the blocking floor (advisory, informational, test-gap or wording items); recorded here and not fixed in this PR.

• INFORMATIONAL test/helpers/touchfiles-data.ts:162 ETHOS.md is registered only under the two prompts that quote it; the tier>=3 preamble names it as a read-on-demand pointer that no paid case asserts on (noted in the touchfiles header).
• INFORMATIONAL lib/redact-patterns.ts:348 a national number written without + right after a run word (failed 14155551234) reads as a run id: the accepted residual of the ruling that a run id is not a phone number, in the scanner and in gstack-post alike (gstack-post has read it that way since GSTA-121).
• INVESTIGATE scripts/ubicloud/ubi-runner.sh cmd_pack: ls-tree -r HEAD reads the live HEAD a few milliseconds after the refs fetch (a commit landing in that window would subtract blobs the snapshot lacks; fails loud on the VM, not a regression); resolve-undo blobs of a resolved conflict are not packed; a split index enabled by git update-index --split-index without core.splitIndex is not detected (pre-existing).

Exploratory QA

CLI surface, Full mode, 5 probes (~/.capy/work/GSTA-127/qa/functional/evidence.json): gstack-approvals add records words citing screen 40477638211 GREEN (exit 0, mirror written) and still refuses words carrying an E.164 number (exit 3, APPROVAL_RECORD_SECRET); gstack-redact flags a bare the id is <run id> and not screen 40477638211 GREEN on the same input; ubi-runner.sh pack under six concurrent git writers unpacks with the same HEAD, origin/main, remote URL and 31 status lines as the source (probe 4 superseded: wrong argument shape).

Design Review

No frontend files changed — design review skipped.

Eval Results

Selection on this diff: profile pr (dependents); the global touchfiles (scripts/test-pr-profile.ts, test/helpers/touchfiles-data.ts, lib/gstack-post.ts, lib/pregate/import-graph.ts, scripts/harness-version.json, scripts/lib/windows-curation.ts, bin/gstack-pr-shots) select every dependent gate case, so the PR screen is the pr-summary job on this PR; captain/templates/merge-ask.md was this PR's own unknown dependency before it was registered. No local paid run.

Greptile Review

Greptile: not run (no PR existed during the review); runs on the PR now that it exists.

Scope Drift

Scope Check: DRIFT DETECTED (in kind). Intent: the Captain brief (#3499 selection exemption and ETHOS.md registration, #3504/#3485 rulings with the floor unchanged, #3485's Windows one-liner, GSTA-121's Blast radius docs, run-id false positive, pregate-remote tar race and file selection). Delivered: all of it, plus captain/templates/** in FREE_ONLY_PR_FILES (found by this PR's own selection, #3499's class) and the pack hardening the reviews asked for. Not delivered: #3499's two prompt notes (plan-tune and eval-plan wording; prompt edits with their own paid cases).

Plan Completion

Plan completion audit: not run (no plan is bound to this branch and no docs/designs/ file matches). Fix: add "Plan: " to the PR body, or run /autoplan.

Issues

Refs #3499
Refs #3504
Refs #3485

TODOS

No TODO items completed in this PR.

Documentation

Status: updated (first audit at f1635d0), then current (read-only re-audit at 8c12f8d).

Scope: a1934a1498ec..8c12f8d (6 commits, 32 files; the later merge of origin/main@6ff98c66 touched no doc beyond CHANGELOG.md), covering the test-pr-profile lists, the redact run-id exemption, the ubi-runner pack snapshot, the review-policy rulings, the PR body docs, the merge-ask Blast radius section and the Windows curation entry. The banned-terms check returned none.

Documentation health:

• docs/TESTING_INTERNALS.md: updated (the exempt-file list names captain/templates/** and RELEASE_METADATA_FILES; the Windows curation how-to)
• docs/captain.md: updated (the merge ask includes blast radius)
• docs/troubleshooting.md: updated (the scanner-level run-id exemption and its residual)
• docs/pregate.md: current (the allowlist note)
• docs/review-policy.md, docs/skills.md, docs/capy-install.md, capy/skill/gstack/captain.md: current
• CHANGELOG.md: the Unreleased entry, written by this ship

Coverage debt: the ubi-runner.sh pack snapshot details (staged, intent-to-add and unmerged blobs travel, gitlinks skip, init --template= with gc.auto=0, valueless config keys replay as true) live only in the script header; RELEASE_METADATA_FILES has one reference line. Diagram drift: none found.

Test plan

• gstack-pregate --stage tests --remote --spend-cap 2 --timeout 2700 --allow-repo-commands: PREGATE_REMOTE tree=db28ddaf67c4 tests=19401 failed=0 spent=0.15 (and tree=31401568d0c2 tests=19214 failed=0 spent=0.08 before the merge of main)
• bun test on the 13 focused files: 302 pass, 0 fail
• bun run typecheck, bun run typecheck:test, bun run gen:skill-docs --dry-run, bun test test/parity-suite.test.ts test/skill-md-size-guard.test.ts: clean, none new, fresh, 4 pass
• bun run test:quick: 21,173 pass; 5 environment-only or load-flake fails named above

🤖 Generated with Claude Code

[trunk-io]

😎 This pull request was merged.