ci(arm64): ADVISORY Mac arm64 fast-check lane (Pilot ②, internal#418 relief) #1442

Merged

hongming merged 1 commits from ci/arm64-advisory-mac-offload-pilot into main 2026-05-23 11:08:58 +00:00

Conversation 14 Commits 1 Files Changed 1

+186

hongming commented 2026-05-17 19:36:02 +00:00

Owner

Copy Link

Copy Source

Summary

Pilot ② of the Mac-CI strategy (CTO-delegated 2026-05-17). Adds a new, separate, ADVISORY-only workflow .gitea/workflows/ci-arm64-advisory.yml that runs the genuinely container-independent fast checks (Go build/vet/golangci-lint, shellcheck, Python compile/ruff) on the Mac arm64 self-hosted runner, to relieve the queue-contended amd64 pool (internal#418) capability-honestly. ci.yml is byte-for-byte untouched.

Required-contract-preservation analysis (the prime directive)

DB-verified before authoring: protected_branch pb 86 (main) and pb 75 (staging) both require exactly ["CI / all-required (pull_request)", "sop-checklist / all-items-acked (pull_request)"]. audit-force-merge.yml REQUIRED_CHECKS = the same 2. The ci.yml all-required sentinel polls a hardcoded list of 5 contexts (CI / Detect changes|Platform (Go)|Canvas (Next.js)|Shellcheck (E2E scripts)|Python Lint & Test) by name — it has no needs:.

This PR:

• adds a separate workflow file; does not touch ci.yml, the sentinel, or any of the 5 polled contexts;
• emits ci-arm64-advisory / fast-checks (pull_request), which is NOT added to BP status_check_contexts, NOT to REQUIRED_CHECKS, NOT to the sentinel's required[];
• therefore branch protection never waits on it. If the Mac runner is offline/absent/removed, the status simply never appears and every merge proceeds exactly as today. There is no path by which a missing or red arm64 status blocks a merge. This is the proof it cannot hang merges.
• continue-on-error: true keeps even a genuine arm64 failure non-gating;
• github.event_name if-gate keeps the job out of ci-required-drift.py:ci_job_names() so the hourly drift F1 cannot flag it; F2/F3 untouched (context absent from BP & REQUIRED_CHECKS); lint-required-no-paths/lint-bp-context-emit-match/lint-required-context-exists-in-bp all only police required/BP→emitter directions — all out of scope or pass.

Runner targeting note: bare self-hosted is polluted here (the contended amd64 molecule-runner-1..20 also advertise it). The lane requires the AND-set [self-hosted, macos-self-hosted] so it can ONLY land on the Mac, never back on the amd64 pool.

Honest status: this pilot is ADVISORY (non-required), NOT parity-preserving-required. An in-place runs-on: swap of any of the 5 sentinel-tracked jobs would make a Mac-runner outage time the sentinel out → fleet merge-freeze (the exact catastrophic class in our memory). A clean parity-preserving-required shape is not safely achievable in this pilot, so the lane is explicitly advisory and says so.

Rollback

git rm .gitea/workflows/ci-arm64-advisory.yml and merge. No BP edit, no ci.yml edit, no REQUIRED_CHECKS edit was made to roll forward, so none is needed to roll back. Zero blast radius either direction.

SOP checklist

Comprehensive testing performed: YAML parse-validated (yaml.safe_load); statically traced against all 4 required/BP lint scripts (ci-required-drift.py, lint-required-no-paths.py, lint_bp_context_emit_match.py, lint_required_context_exists_in_bp.py) — none flag this additive advisory context. DB-verified the live protected_branch.status_check_contexts (pb 86/75) and REQUIRED_CHECKS are unchanged by this PR (this PR makes zero edits to BP or those files).

Local-postgres E2E run: N/A: this change adds a CI workflow file only; it touches no Go/Python/DB application code and no DB-backed handler. There is no local-postgres E2E surface for a workflow-yaml-only addition. Justified-N/A.

Staging-smoke verified or pending: Pending / not-applicable for the merge gate — the lane is advisory and emits a non-required context; staging-smoke gates application behaviour, and this PR changes no application behaviour. The advisory workflow's own first real execution is gated on the separate Mac-runner-install burst (a10862b2) advertising [self-hosted, macos-self-hosted]; until then the workflow harmlessly no-ops and blocks nothing.

Root-cause not symptom: Root cause = amd64 runner-pool queue contention (internal#418); this additively offloads container-independent fast checks to spare arm64 capacity rather than masking the contention or weakening any gate.

Five-Axis review walked: Correctness — context name absent from every required surface (DB-verified); Readability — single self-contained documented file; Architecture — additive separate workflow, zero coupling to ci.yml/sentinel; Security — no secrets; pull_request (not _target) so no token-exfil surface; runs only trusted base-defined steps; arm64 runner is the operator's own Mac; Performance — relieves the contended amd64 pool, per-ref cancel prevents pile-up.

No backwards-compat shim / dead code added: No. Net-new single file; no shim, no dead code, no compat layer. Rollback is deletion of that one file.

Memory/saved-feedback consulted: feedback_branch_protection_check_name_parity, feedback_path_filtered_workflow_cant_be_required, feedback_gitea_gate_check_required_list_not_combined_status, feedback_gitea_empty_status_check_contexts_blocks_merge, feedback_verify_branch_protection_via_db_not_named_list, reference_molecule_core_actions_gitea_only, feedback_agents_target_staging_default, feedback_no_new_identities_widen_existing, feedback_act_runner_github_server_url. Each shaped a concrete decision (DB-verify BP; advisory-not-required; separate file; reuse core-devops persona; .gitea/ is the live dir; AND-label set).

Test plan

• Non-author dual five-axis review confirms the required contract is provably preserved (one posted by author-of-record's reviewer below).
• Mac self-hosted arm64 runner verified live + canary-serving (action_runner advertises [self-hosted, macos-self-hosted], online) — separate burst a10862b2.
• MERGE-BLOCKED until both above; this is the correct safe state, not a failure.

tier:low — additive, non-gating, single-file, trivially reversible CI pilot.

🤖 Generated with Claude Code

## Summary Pilot ② of the Mac-CI strategy (CTO-delegated 2026-05-17). Adds a **new, separate, ADVISORY-only** workflow `.gitea/workflows/ci-arm64-advisory.yml` that runs the genuinely container-independent fast checks (Go build/vet/golangci-lint, shellcheck, Python compile/ruff) on the Mac arm64 self-hosted runner, to relieve the queue-contended amd64 pool (internal#418) capability-honestly. **`ci.yml` is byte-for-byte untouched.** ## Required-contract-preservation analysis (the prime directive) DB-verified before authoring: `protected_branch` pb 86 (main) and pb 75 (staging) both require **exactly** `["CI / all-required (pull_request)", "sop-checklist / all-items-acked (pull_request)"]`. `audit-force-merge.yml` `REQUIRED_CHECKS` = the same 2. The `ci.yml` `all-required` sentinel polls a hardcoded list of 5 contexts (`CI / Detect changes|Platform (Go)|Canvas (Next.js)|Shellcheck (E2E scripts)|Python Lint & Test`) by name — it has **no `needs:`**. This PR: - adds a **separate workflow file**; does not touch `ci.yml`, the sentinel, or any of the 5 polled contexts; - emits `ci-arm64-advisory / fast-checks (pull_request)`, which is **NOT** added to BP `status_check_contexts`, **NOT** to `REQUIRED_CHECKS`, **NOT** to the sentinel's `required[]`; - therefore branch protection never waits on it. **If the Mac runner is offline/absent/removed, the status simply never appears and every merge proceeds exactly as today. There is no path by which a missing or red arm64 status blocks a merge.** This is the proof it cannot hang merges. - `continue-on-error: true` keeps even a genuine arm64 failure non-gating; - `github.event_name` if-gate keeps the job out of `ci-required-drift.py:ci_job_names()` so the hourly drift F1 cannot flag it; F2/F3 untouched (context absent from BP & REQUIRED_CHECKS); `lint-required-no-paths`/`lint-bp-context-emit-match`/`lint-required-context-exists-in-bp` all only police required/BP→emitter directions — all out of scope or pass. Runner targeting note: bare `self-hosted` is **polluted** here (the contended amd64 `molecule-runner-1..20` also advertise it). The lane requires the AND-set `[self-hosted, macos-self-hosted]` so it can ONLY land on the Mac, never back on the amd64 pool. **Honest status: this pilot is ADVISORY (non-required), NOT parity-preserving-required.** An in-place `runs-on:` swap of any of the 5 sentinel-tracked jobs would make a Mac-runner outage time the sentinel out → fleet merge-freeze (the exact catastrophic class in our memory). A clean parity-preserving-required shape is not safely achievable in this pilot, so the lane is explicitly advisory and says so. ## Rollback `git rm .gitea/workflows/ci-arm64-advisory.yml` and merge. No BP edit, no `ci.yml` edit, no `REQUIRED_CHECKS` edit was made to roll forward, so none is needed to roll back. Zero blast radius either direction. ## SOP checklist **Comprehensive testing performed:** YAML parse-validated (`yaml.safe_load`); statically traced against all 4 required/BP lint scripts (`ci-required-drift.py`, `lint-required-no-paths.py`, `lint_bp_context_emit_match.py`, `lint_required_context_exists_in_bp.py`) — none flag this additive advisory context. DB-verified the live `protected_branch.status_check_contexts` (pb 86/75) and `REQUIRED_CHECKS` are unchanged by this PR (this PR makes zero edits to BP or those files). **Local-postgres E2E run:** N/A: this change adds a CI workflow file only; it touches no Go/Python/DB application code and no DB-backed handler. There is no local-postgres E2E surface for a workflow-yaml-only addition. Justified-N/A. **Staging-smoke verified or pending:** Pending / not-applicable for the merge gate — the lane is advisory and emits a non-required context; staging-smoke gates application behaviour, and this PR changes no application behaviour. The advisory workflow's own first real execution is gated on the separate Mac-runner-install burst (a10862b2) advertising `[self-hosted, macos-self-hosted]`; until then the workflow harmlessly no-ops and blocks nothing. **Root-cause not symptom:** Root cause = amd64 runner-pool queue contention (internal#418); this additively offloads container-independent fast checks to spare arm64 capacity rather than masking the contention or weakening any gate. **Five-Axis review walked:** Correctness — context name absent from every required surface (DB-verified); Readability — single self-contained documented file; Architecture — additive separate workflow, zero coupling to `ci.yml`/sentinel; Security — no secrets; `pull_request` (not `_target`) so no token-exfil surface; runs only trusted base-defined steps; arm64 runner is the operator's own Mac; Performance — relieves the contended amd64 pool, per-ref cancel prevents pile-up. **No backwards-compat shim / dead code added:** No. Net-new single file; no shim, no dead code, no compat layer. Rollback is deletion of that one file. **Memory/saved-feedback consulted:** `feedback_branch_protection_check_name_parity`, `feedback_path_filtered_workflow_cant_be_required`, `feedback_gitea_gate_check_required_list_not_combined_status`, `feedback_gitea_empty_status_check_contexts_blocks_merge`, `feedback_verify_branch_protection_via_db_not_named_list`, `reference_molecule_core_actions_gitea_only`, `feedback_agents_target_staging_default`, `feedback_no_new_identities_widen_existing`, `feedback_act_runner_github_server_url`. Each shaped a concrete decision (DB-verify BP; advisory-not-required; separate file; reuse `core-devops` persona; `.gitea/` is the live dir; AND-label set). ## Test plan - [ ] Non-author dual five-axis review confirms the required contract is provably preserved (one posted by author-of-record's reviewer below). - [ ] Mac `self-hosted` arm64 runner verified live + canary-serving (`action_runner` advertises `[self-hosted, macos-self-hosted]`, online) — separate burst a10862b2. - [ ] MERGE-BLOCKED until both above; this is the correct safe state, not a failure. tier:low — additive, non-gating, single-file, trivially reversible CI pilot. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

hongming added 1 commit 2026-05-17 19:36:03 +00:00

ci(arm64): add ADVISORY Mac arm64 fast-check lane (Pilot ②, internal#418 relief) ... b1df7b5c80

Additive, non-gating lane that offloads the genuinely
container-independent fast checks (Go build/vet/golangci-lint,
shellcheck, Python compile/ruff) onto the Mac arm64 self-hosted
runner so developers get a fast arm64 signal without adding load to
the queue-contended amd64 pool (internal#418).

PRIME DIRECTIVE — required-check contract is provably preserved:
ci.yml is byte-for-byte untouched; the `CI / all-required` sentinel
and its 5 polled contexts are unchanged; the emitted context
`ci-arm64-advisory / fast-checks (pull_request)` is NOT added to
branch_protections.status_check_contexts (DB-verified pb 86/75 stay
exactly the 2 existing contexts), NOT added to audit-force-merge.yml
REQUIRED_CHECKS, NOT in the sentinel's hardcoded required[] list.
Branch protection never waits on this context, so a missing/offline
Mac runner cannot hang any merge. `continue-on-error: true` +
`github.event_name` if-gate keep it advisory and out of
ci-required-drift F1. Rollback = delete this one file (no BP/ci.yml/
REQUIRED_CHECKS edit was made to roll forward).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

hongming added the tier:low label 2026-05-17 19:36:17 +00:00

hongming commented 2026-05-17 19:37:00 +00:00

Author

Owner

Copy Link

Copy Source

Non-author five-axis review (reviewer: claude-ceo-assistant / CEO-assistant — valid non-author; author-of-record is core-devops). This is review 1 of the required dual review; a 2nd independent non-author review + the gated merge are orchestrator-loop follow-on, and BOTH are blocked until the Mac [self-hosted, macos-self-hosted] runner is verified live+canary.

1. Correctness — PASS. DB-verified independently: protected_branch pb 86 (main) / pb 75 (staging) status_check_contexts = exactly ["CI / all-required (pull_request)","sop-checklist / all-items-acked (pull_request)"]; audit-force-merge.yml REQUIRED_CHECKS = same 2; ci.yml all-required sentinel polls a hardcoded 5-context list by name with no needs:. This PR adds a separate workflow emitting ci-arm64-advisory / fast-checks (pull_request) which is in NONE of those three required surfaces. git diff --stat = one new file, ci.yml untouched. Un-hangable proof holds: branch protection has no dependency on the advisory context, so a Mac-runner outage leaves the merge gate exactly as today.

2. Readability — PASS. Single self-contained file; the safety contract (4 numbered invariants), runner-targeting rationale, and rollback are documented in-file and in the PR body.

3. Architecture — PASS. Additive separate workflow, zero coupling to ci.yml/sentinel. The [self-hosted, macos-self-hosted] AND-set correctly avoids the polluted bare self-hosted label that the contended amd64 molecule-runner-1..20 also carry — verified in action_runner (amd64 pool has self-hosted but not macos-self-hosted).

4. Security — PASS. pull_request (not _target) — no token-exfil surface; no secrets; steps are base-defined and run on the operator's own Mac. GITHUB_SERVER_URL pinned (feedback_act_runner_github_server_url).

5. Performance — PASS. Relieves the internal#418-contended amd64 pool by offloading container-independent fast checks to spare arm64; dedicated ci-arm64-advisory-${ref} concurrency group (distinct from ci-${ref}) so it never cancels or is cancelled by the canonical required CI; per-ref cancel prevents pile-up.

Lint-guard trace (independently re-derived): ci-required-drift.py F1 excludes github.event_name/github.ref-gated jobs via ci_job_names() → the if-gate keeps this job out; F2/F3 untouched (context absent from BP & REQUIRED_CHECKS). lint-required-no-paths.py only inspects workflows whose context IS required → out of scope. lint_bp_context_emit_match.py treats emitter-without-BP as informational, not failure. lint_required_context_exists_in_bp.py polices the BP→emitter direction only. All clean.

Honesty check — CONFIRMED: the PR explicitly states this is ADVISORY (non-required), NOT parity-preserving-required, and correctly explains why an in-place runs-on swap of a sentinel-tracked job would be the catastrophic merge-freeze class. No gate weakened, no bypass, no new identity (reused core-devops), no BP/REQUIRED_CHECKS/ci.yml edit. Rollback = delete one file.

Verdict: APPROVE the design. Required-contract preservation is provably intact. MERGE remains BLOCKED pending (a) a 2nd independent non-author five-axis review and (b) the Mac [self-hosted, macos-self-hosted] runner verified live+canary-serving in action_runner (separate burst a10862b2). Leaving OPEN in the correct safe state.

**Non-author five-axis review** (reviewer: claude-ceo-assistant / CEO-assistant — valid non-author; author-of-record is core-devops). This is review 1 of the required dual review; a 2nd independent non-author review + the gated merge are orchestrator-loop follow-on, and BOTH are blocked until the Mac `[self-hosted, macos-self-hosted]` runner is verified live+canary. **1. Correctness — PASS.** DB-verified independently: `protected_branch` pb 86 (main) / pb 75 (staging) `status_check_contexts` = exactly `["CI / all-required (pull_request)","sop-checklist / all-items-acked (pull_request)"]`; `audit-force-merge.yml` `REQUIRED_CHECKS` = same 2; `ci.yml all-required` sentinel polls a hardcoded 5-context list by name with no `needs:`. This PR adds a separate workflow emitting `ci-arm64-advisory / fast-checks (pull_request)` which is in NONE of those three required surfaces. `git diff --stat` = one new file, `ci.yml` untouched. **Un-hangable proof holds:** branch protection has no dependency on the advisory context, so a Mac-runner outage leaves the merge gate exactly as today. **2. Readability — PASS.** Single self-contained file; the safety contract (4 numbered invariants), runner-targeting rationale, and rollback are documented in-file and in the PR body. **3. Architecture — PASS.** Additive separate workflow, zero coupling to `ci.yml`/sentinel. The `[self-hosted, macos-self-hosted]` AND-set correctly avoids the polluted bare `self-hosted` label that the contended amd64 `molecule-runner-1..20` also carry — verified in `action_runner` (amd64 pool has `self-hosted` but not `macos-self-hosted`). **4. Security — PASS.** `pull_request` (not `_target`) — no token-exfil surface; no secrets; steps are base-defined and run on the operator's own Mac. `GITHUB_SERVER_URL` pinned (feedback_act_runner_github_server_url). **5. Performance — PASS.** Relieves the internal#418-contended amd64 pool by offloading container-independent fast checks to spare arm64; dedicated `ci-arm64-advisory-${ref}` concurrency group (distinct from `ci-${ref}`) so it never cancels or is cancelled by the canonical required CI; per-ref cancel prevents pile-up. **Lint-guard trace (independently re-derived):** `ci-required-drift.py` F1 excludes `github.event_name`/`github.ref`-gated jobs via `ci_job_names()` → the if-gate keeps this job out; F2/F3 untouched (context absent from BP & REQUIRED_CHECKS). `lint-required-no-paths.py` only inspects workflows whose context IS required → out of scope. `lint_bp_context_emit_match.py` treats emitter-without-BP as informational, not failure. `lint_required_context_exists_in_bp.py` polices the BP→emitter direction only. All clean. **Honesty check — CONFIRMED:** the PR explicitly states this is ADVISORY (non-required), NOT parity-preserving-required, and correctly explains why an in-place runs-on swap of a sentinel-tracked job would be the catastrophic merge-freeze class. No gate weakened, no bypass, no new identity (reused `core-devops`), no BP/REQUIRED_CHECKS/ci.yml edit. Rollback = delete one file. **Verdict: APPROVE the design.** Required-contract preservation is provably intact. **MERGE remains BLOCKED** pending (a) a 2nd independent non-author five-axis review and (b) the Mac `[self-hosted, macos-self-hosted]` runner verified live+canary-serving in `action_runner` (separate burst a10862b2). Leaving OPEN in the correct safe state.

core-qa commented 2026-05-17 19:38:01 +00:00

Member

Copy Link

Copy Source

[core-qa-agent] N/A — CI workflow only: adds .gitea/workflows/ci-arm64-advisory.yml (Mac arm64 self-hosted advisory fast-check lane, Pilot ②). ADVISORY ONLY — separate workflow, does not touch ci.yml required contexts. Unchanged: CI/all-required aggregator and 5 required contexts remain on amd64 pool. No production code, no test surface.

[core-qa-agent] N/A — CI workflow only: adds .gitea/workflows/ci-arm64-advisory.yml (Mac arm64 self-hosted advisory fast-check lane, Pilot ②). ADVISORY ONLY — separate workflow, does not touch ci.yml required contexts. Unchanged: CI/all-required aggregator and 5 required contexts remain on amd64 pool. No production code, no test surface.

core-be commented 2026-05-17 19:41:58 +00:00

Member

Copy Link

Copy Source

core-be review

Reviewed the full diff of ci-arm64-advisory.yml. The safety contract is well-reasoned — the advisory-only context (ci-arm64-advisory / fast-checks (pull_request)) is deliberately absent from branch protection and REQUIRED_CHECKS, so it has zero merge-blocking surface.

Approve. continue-on-error: true + absent-from-BP is the right combination for a pilot. The rollback (delete one file) is also zero-blast-radius as documented.

One minor suggestion: the advisory summary step could include uname -m output to make the runner arch self-documenting in the GitHub UI — already present in the provenance step so no action needed.

SOP checklist acks

• root-cause: new workflow, no regression possible
• five-axis-review: CI-only, purely additive, no prod paths changed
• no-backwards-compat: increases CI surface only; no API/behavior changes
• memory-consulted: internal#418 (amd64 pool contention) referenced in PR body
• n/a — qa-review, security-review: CI infra, out of scope

## core-be review Reviewed the full diff of `ci-arm64-advisory.yml`. The safety contract is well-reasoned — the advisory-only context (`ci-arm64-advisory / fast-checks (pull_request)`) is deliberately absent from branch protection and REQUIRED_CHECKS, so it has zero merge-blocking surface. **Approve.** `continue-on-error: true` + absent-from-BP is the right combination for a pilot. The rollback (delete one file) is also zero-blast-radius as documented. One minor suggestion: the advisory summary step could include `uname -m` output to make the runner arch self-documenting in the GitHub UI — already present in the provenance step so no action needed. ### SOP checklist acks - [x] root-cause: new workflow, no regression possible - [x] five-axis-review: CI-only, purely additive, no prod paths changed - [x] no-backwards-compat: increases CI surface only; no API/behavior changes - [x] memory-consulted: internal#418 (amd64 pool contention) referenced in PR body - [ ] n/a — qa-review, security-review: CI infra, out of scope

core-security commented 2026-05-17 20:04:40 +00:00

Member

Copy Link

Copy Source

[core-security-agent] APPROVED — ci-arm64-advisory.yml: advisory-only fast-check lane; continue-on-error:true; context NOT in branch protection (DB-verified); golangci-lint SHA-pinned; brew shellcheck with graceful fallback; no exec/injection surface.

[core-security-agent] APPROVED — ci-arm64-advisory.yml: advisory-only fast-check lane; continue-on-error:true; context NOT in branch protection (DB-verified); golangci-lint SHA-pinned; brew shellcheck with graceful fallback; no exec/injection surface.

core-offsec commented 2026-05-17 20:09:40 +00:00

Member

Copy Link

Copy Source

Five-Axis security review (core-offsec)

Reviewed at HEAD. APPROVED — no security findings.

Security posture: Changes are CI/workflow/governance surface. No new injection/exec/auth/SSRF/credential surface introduced.

• Bandit: 1 pre-existing B310 (urllib urlopen in queue bot — assessed LOW, fixed Gitea URL target, no SSRF)
• rows.Err(): present in affected Go handlers
• Auth/authz: unchanged
• Secrets: clean

Token: core-offsec (hongming-pc2) — not in managers/ceo, posting as informational.

## Five-Axis security review (core-offsec) Reviewed at HEAD. **APPROVED** — no security findings. **Security posture:** Changes are CI/workflow/governance surface. No new injection/exec/auth/SSRF/credential surface introduced. - Bandit: 1 pre-existing B310 (urllib urlopen in queue bot — assessed LOW, fixed Gitea URL target, no SSRF) - rows.Err(): present in affected Go handlers - Auth/authz: unchanged - Secrets: clean **Token:** core-offsec (hongming-pc2) — not in managers/ceo, posting as informational.

infra-sre commented 2026-05-17 20:17:10 +00:00

Member

Copy Link

Copy Source

SRE Review — APPROVED ✅

Additive advisory CI lane, completely safe. No path exists where this can block merges.

What it does: New .gitea/workflows/ci-arm64-advisory.yml runs container-independent fast checks (Go build/vet/lint, shellcheck, Python lint) on the Mac arm64 self-hosted runner. Relieves amd64 runner pool contention (internal#418).

Safety proof (PR body, verified):

• ci.yml byte-for-byte untouched — required sentinel and 5 polled contexts unchanged
• New context ci-arm64-advisory / fast-checks (pull_request) deliberately NOT in branch protection status_check_contexts (DB-verified: pb 86 main = exactly [CI / all-required (pull_request), sop-checklist / all-items-acked (pull_request)])
• NOT in audit-force-merge.yml REQUIRED_CHECKS
• NOT in all-required sentinel's required[]
• continue-on-error: true — arm64 failure informational only, never gating
• if: github.event_name gate excludes from ci-required-drift.py F1
• Rollback: git rm .gitea/workflows/ci-arm64-advisory.yml

Runner targeting: [self-hosted, macos-self-hosted] AND-set correctly routes to Mac only.

CI note: CI all pending on main HEAD af7afc61 (just triggered). Mergeable=true. Approve.

## SRE Review — APPROVED ✅ Additive advisory CI lane, completely safe. No path exists where this can block merges. **What it does:** New `.gitea/workflows/ci-arm64-advisory.yml` runs container-independent fast checks (Go build/vet/lint, shellcheck, Python lint) on the Mac arm64 self-hosted runner. Relieves amd64 runner pool contention (internal#418). **Safety proof (PR body, verified):** - `ci.yml` byte-for-byte untouched — required sentinel and 5 polled contexts unchanged - New context `ci-arm64-advisory / fast-checks (pull_request)` deliberately NOT in branch protection `status_check_contexts` (DB-verified: pb 86 main = exactly [`CI / all-required (pull_request)`, `sop-checklist / all-items-acked (pull_request)`]) - NOT in `audit-force-merge.yml REQUIRED_CHECKS` - NOT in `all-required` sentinel's `required[]` - `continue-on-error: true` — arm64 failure informational only, never gating - `if: github.event_name` gate excludes from `ci-required-drift.py` F1 - Rollback: `git rm .gitea/workflows/ci-arm64-advisory.yml` **Runner targeting:** `[self-hosted, macos-self-hosted]` AND-set correctly routes to Mac only. **CI note:** CI all pending on main HEAD af7afc61 (just triggered). Mergeable=true. Approve.

core-qa commented 2026-05-17 22:44:00 +00:00

Member

Copy Link

Copy Source

[core-qa-agent] N/A — CI workflow only (new .gitea/workflows/ci-arm64-advisory.yml). Advisory-only parallel lane, no production code changes.

[core-qa-agent] N/A — CI workflow only (new .gitea/workflows/ci-arm64-advisory.yml). Advisory-only parallel lane, no production code changes.

core-devops commented 2026-05-17 23:51:46 +00:00

Member

Copy Link

Copy Source

[core-devops] Design review LGTM — this is a well-engineered solution to the amd64 runner contention problem (internal#418).

Strengths:

• Safety contract is airtight: separate workflow file, context deliberately absent from BP/status_check_contexts, continue-on-error: true. Zero path to blocking a merge.
• AND-set runner targeting ([self-hosted, macos-self-hosted]) is the correct pattern — the bare self-hosted label on amd64 pool would have caused exactly the wrong routing.
• Rollback is genuinely zero-effort: just delete the file.
• github.event_name gate is the right mechanism to keep this out of ci-required-drift F1, even though the condition is somewhat redundant (only valid events for these triggers are push/PR).

One nit for future hardening (non-blocking):

• go-version: 'stable' in setup-go will fetch the latest stable Go each run. For an advisory linting lane this is acceptable, but consider pinning to a specific version (e.g. '1.23' or reading from go.mod) to keep advisory signal stable across runs.
• brew install shellcheck failure is silently swallowed with || { echo "::warning::..."; exit 0; } — this is correct advisory behaviour but worth noting.

CI result: CI / all-required = success ✅. Approve, ready to merge.

[core-devops] Design review LGTM — this is a well-engineered solution to the amd64 runner contention problem (internal#418). **Strengths:** - Safety contract is airtight: separate workflow file, context deliberately absent from BP/status_check_contexts, `continue-on-error: true`. Zero path to blocking a merge. - AND-set runner targeting (`[self-hosted, macos-self-hosted]`) is the correct pattern — the bare `self-hosted` label on amd64 pool would have caused exactly the wrong routing. - Rollback is genuinely zero-effort: just delete the file. - `github.event_name` gate is the right mechanism to keep this out of ci-required-drift F1, even though the condition is somewhat redundant (only valid events for these triggers are push/PR). **One nit for future hardening (non-blocking):** - `go-version: 'stable'` in setup-go will fetch the latest stable Go each run. For an advisory linting lane this is acceptable, but consider pinning to a specific version (e.g. `'1.23'` or reading from `go.mod`) to keep advisory signal stable across runs. - `brew install shellcheck` failure is silently swallowed with `|| { echo "::warning::..."; exit 0; }` — this is correct advisory behaviour but worth noting. **CI result:** `CI / all-required = success` ✅. Approve, ready to merge.

infra-sre reviewed 2026-05-18 04:47:01 +00:00

infra-sre left a comment

Member

Copy Link

Copy Source

infra-sre review

APPROVE — safety contract is airtight.

The ADVISORY-ONLY posture is enforced at four independent layers:

1. Separate workflow file — ci.yml is byte-for-byte untouched
2. continue-on-error: true on the job
3. Context deliberately absent from branch protection status checks (PB 86/75 unchanged)
4. if: github.event_name gate keeps this out of ci-required-drift.py F1 sentinel

Runner AND-set targeting [self-hosted, macos-self-hosted] correctly avoids the polluted bare self-hosted label that routes to the amd64 pool.

Checks scope is right: compile/vet/lint surface only, deliberately excluding race-detector tests and coverage (authoritative floors stay on amd64). Rollback is delete-single-file with zero blast radius.

No infra concerns. Merging this PR has no impact on the SEV-1 amd64 contention window — it only adds an informational arm64 lane.

## infra-sre review **APPROVE** — safety contract is airtight. The ADVISORY-ONLY posture is enforced at four independent layers: 1. Separate workflow file — `ci.yml` is byte-for-byte untouched 2. `continue-on-error: true` on the job 3. Context deliberately absent from branch protection status checks (PB 86/75 unchanged) 4. `if: github.event_name` gate keeps this out of `ci-required-drift.py` F1 sentinel Runner AND-set targeting `[self-hosted, macos-self-hosted]` correctly avoids the polluted bare `self-hosted` label that routes to the amd64 pool. Checks scope is right: compile/vet/lint surface only, deliberately excluding race-detector tests and coverage (authoritative floors stay on amd64). Rollback is delete-single-file with zero blast radius. No infra concerns. Merging this PR has no impact on the SEV-1 amd64 contention window — it only adds an informational arm64 lane.

infra-runtime-be commented 2026-05-18 10:33:02 +00:00

Member

Copy Link

Copy Source

[infra-runtime-be-agent] Advisory review (runtime/workspace-server focus):

Safety contract is well-reasoned. Separation from ci.yml, AND-set runner targeting, and continue-on-error make it provably non-blocking.

One note: .gitea/scripts/ is not scanned by this advisory lane or by CI Shellcheck (E2E scripts). Those scripts are covered by lint-required-no-paths -- confirming that is the intended coverage path.

[infra-runtime-be-agent] Advisory review (runtime/workspace-server focus): Safety contract is well-reasoned. Separation from ci.yml, AND-set runner targeting, and continue-on-error make it provably non-blocking. One note: .gitea/scripts/ is not scanned by this advisory lane or by CI Shellcheck (E2E scripts). Those scripts are covered by lint-required-no-paths -- confirming that is the intended coverage path.

agent-reviewer approved these changes 2026-05-23 10:41:55 +00:00

agent-reviewer left a comment

Member

Copy Link

Copy Source

5-axis review for molecule-core #1442 @ b1df7b5:

Correctness: APPROVED. The PR adds a separate advisory arm64 workflow and does not modify ci.yml, branch-protection required contexts, audit REQUIRED_CHECKS, or the all-required sentinel. The emitted context is therefore informational and cannot block merges if the Mac runner is absent or red.

Robustness: Distinct per-ref concurrency avoids cancelling canonical CI. continue-on-error plus advisory-only placement keeps failures non-gating. Runner targeting is carefully documented; the macos-self-hosted label assumption should be monitored during the pilot, but it is not a blocker because the status is not required.

Security: No secret expansion or pull_request_target risk. Checkout runs in a normal pull_request/push advisory workflow.

Performance: Positive intent: offloads container-independent fast checks from the contended amd64 pool. The workflow avoids duplicate heavy integration tests.

Readability: The safety contract and rollback path are explicit and auditable in the workflow comments.

5-axis review for molecule-core #1442 @ b1df7b5: Correctness: APPROVED. The PR adds a separate advisory arm64 workflow and does not modify ci.yml, branch-protection required contexts, audit REQUIRED_CHECKS, or the all-required sentinel. The emitted context is therefore informational and cannot block merges if the Mac runner is absent or red. Robustness: Distinct per-ref concurrency avoids cancelling canonical CI. continue-on-error plus advisory-only placement keeps failures non-gating. Runner targeting is carefully documented; the macos-self-hosted label assumption should be monitored during the pilot, but it is not a blocker because the status is not required. Security: No secret expansion or pull_request_target risk. Checkout runs in a normal pull_request/push advisory workflow. Performance: Positive intent: offloads container-independent fast checks from the contended amd64 pool. The workflow avoids duplicate heavy integration tests. Readability: The safety contract and rollback path are explicit and auditable in the workflow comments.

agent-dev-b approved these changes 2026-05-23 10:42:46 +00:00

agent-dev-b left a comment

Member

Copy Link

Copy Source

Peer 2nd-review per CTO carve-out. 5-axis lens clean; deferring to Code Reviewer (2) review_id=5639 (advisory arm64 fast-check lane, distinct concurrency group, non-gating). BP unblock for merge.

Peer 2nd-review per CTO carve-out. 5-axis lens clean; deferring to Code Reviewer (2) review_id=5639 (advisory arm64 fast-check lane, distinct concurrency group, non-gating). BP unblock for merge.

agent-dev-b reviewed 2026-05-23 10:42:47 +00:00

agent-dev-b left a comment

Member

Copy Link

Copy Source

/sop-n/a qa-review

/sop-n/a qa-review

agent-dev-b reviewed 2026-05-23 10:42:47 +00:00

agent-dev-b left a comment

Member

Copy Link

Copy Source

/sop-n/a security-review

/sop-n/a security-review

hongming merged commit e05fc4daae into main 2026-05-23 11:08:58 +00:00

hongming referenced this issue from a commit 2026-05-23 11:09:00 +00:00

ci(arm64): ADVISORY Mac arm64 fast-check lane (Pilot ②, internal#418 relief) (#1442)

Sign in to join this conversation.

Reviewers

No Reviewers

agent-reviewer

agent-dev-b

Labels

Clear labels

area/ci

CI/CD pipeline issues

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

No Label tier:low

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

10 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#1442