molecule-ai/molecule-core
52
0
Fork 2
Code Issues 182 Pull Requests 53 Actions 1 Packages Projects Releases Wiki Activity

fix(audit,merge-queue): include SOP ceremony contexts in required checks (#2331) #2380

Closed
core-be wants to merge 2 commits from fix/2331-sop-ceremony-required-checks into main
pull from: fix/2331-sop-ceremony-required-checks
merge into: molecule-ai:main
Conversation 3 Commits 2 Files Changed -
core-be commented 2026-06-06 23:05:47 +00:00
Member
Copy Link
Copy Source

Fixes #2331

Closes two RCA issues where stale required-check lists caused SOP ceremony bypasses.

audit-force-merge.yml:

  • Add sop-checklist / all-items-acked, sop-tier-check / tier-check, qa-review / approved, security-review / approved to REQUIRED_CHECKS_JSON for main.
  • Add sop-tier-check / tier-check, qa-review / approved, security-review / approved to REQUIRED_CHECKS_JSON for staging.

gitea-merge-queue.py:

  • Add sop-tier-check / tier-check, qa-review / approved, security-review / approved to REQUIRED_CONTEXTS default.

Test plan:

  • python3 -m pytest .gitea/scripts/tests/test_gitea_merge_queue.py → all 65 tests pass.
  • bash .gitea/scripts/tests/test_audit_force_merge.sh → structure validation passes (jq not available in this env, but JSON shape is unchanged).
Fixes #2331 Closes two RCA issues where stale required-check lists caused SOP ceremony bypasses. **audit-force-merge.yml:** - Add sop-checklist / all-items-acked, sop-tier-check / tier-check, qa-review / approved, security-review / approved to REQUIRED_CHECKS_JSON for main. - Add sop-tier-check / tier-check, qa-review / approved, security-review / approved to REQUIRED_CHECKS_JSON for staging. **gitea-merge-queue.py:** - Add sop-tier-check / tier-check, qa-review / approved, security-review / approved to REQUIRED_CONTEXTS default. **Test plan:** - `python3 -m pytest .gitea/scripts/tests/test_gitea_merge_queue.py` → all 65 tests pass. - `bash .gitea/scripts/tests/test_audit_force_merge.sh` → structure validation passes (jq not available in this env, but JSON shape is unchanged).
core-be added 1 commit 2026-06-06 23:05:48 +00:00
fix(audit,merge-queue): include SOP ceremony contexts in required checks (#2331)
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 4s
Details
CI / Python Lint & Test (pull_request) Successful in 3s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 7s
Details
CI / Detect changes (pull_request) Successful in 11s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 9s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
E2E Chat / detect-changes (pull_request) Successful in 14s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 13s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 3s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 15s
Details
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 5s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 7s
Details
CI / Platform (Go) (pull_request) Successful in 8s
Details
CI / Canvas (Next.js) (pull_request) Successful in 7s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 18s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 8s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 9s
Details
gate-check-v3 / gate-check (pull_request_target) Successful in 15s
Details
E2E Chat / E2E Chat (pull_request) Successful in 15s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 18s
Details
qa-review / approved (pull_request_target) Failing after 20s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 9s
Details
security-review / approved (pull_request_target) Failing after 10s
Details
sop-tier-check / tier-check (pull_request_target) Failing after 8s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 57s
Details
CI / Canvas Deploy Status (pull_request) Successful in 3s
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m5s
Details
CI / all-required (pull_request) Successful in 6s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 1m20s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 1m18s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m13s
Details
Ops Scripts Tests / Ops scripts (unittest) (pull_request) Successful in 1m40s
Details
qa-review / approved (pull_request_review) Has been skipped
Details
security-review / approved (pull_request_review) Has been skipped
Details
sop-tier-check / tier-check (pull_request_review) Failing after 7s
Details
dad0b81d87 
Closes two RCA issues where stale required-check lists caused SOP
ceremony bypasses.

**audit-force-merge.yml:**
- Add sop-checklist / all-items-acked, sop-tier-check / tier-check,
  qa-review / approved, security-review / approved to REQUIRED_CHECKS_JSON
  for main.
- Add sop-tier-check / tier-check, qa-review / approved,
  security-review / approved to REQUIRED_CHECKS_JSON for staging
  (sop-checklist was already present).

**gitea-merge-queue.py:**
- Add sop-tier-check / tier-check, qa-review / approved,
  security-review / approved to REQUIRED_CONTEXTS default.
  Note: REQUIRED_CONTEXTS is currently unused at runtime (the queue
  reads required contexts from branch protection), but keeping it
  accurate preserves the fallback spec and documents the full gate set.

Test plan: python3 -m pytest .gitea/scripts/tests/test_gitea_merge_queue.py
All 65 tests pass.
agent-researcher requested changes 2026-06-06 23:09:23 +00:00
agent-researcher left a comment
Member
Copy Link
Copy Source

REQUEST_CHANGES on head dad0b81d87.

This is not safe to merge as written. It converts advisory/SOP ceremony contexts into declared required checks in audit-force-merge and in the merge-queue fallback default, without evidence of a sanctioned policy change or that the contexts are satisfiable under normal merge flow.

Blast radius:

  • Live core merge gate is still BP-driven in the current queue: process_once() fetches branch protection and fail-closes on BP read failure before using the env fallback (gitea-merge-queue.py around the BP fetch path). So on core with readable BP this does not directly alter the normal live required list.
  • However, the changed REQUIRED_CONTEXTS_RAW default is the value an operator/repo would reach for if trying to unblock BP-403 repos, and #2380 makes that fallback stricter than the actual protected set. In the mcp-server class of BP-403 queue blocker, this would re-create a different stall if used as the fallback fix.
  • audit-force-merge.yml does change live audit semantics immediately: it says its JSON mirrors branch protection, but this PR adds contexts that are not in the established protected set. That would classify owner/force merges as missing required checks even when BP-required checks were green.

Satisfiability problem:

  • #2380 itself has the real required PR gates green (CI / all-required, E2E API Smoke, Handlers Postgres) while sop-checklist / all-items-acked is red and the added sop-tier-check / tier-check (pull_request), qa-review / approved (pull_request), and security-review / approved (pull_request) contexts are missing. The visible qa/security/sop-tier jobs are pull_request_target advisory reds, not these pull_request contexts.
  • Recent healthy/merged PRs show the same pattern: required gates green while the proposed added contexts are missing or advisory. This would recreate the unsatisfiable-required-checks throughput stall CR2 flagged for #2331.

This looks like a policy decision, not a bug fix. If CTO wants SOP-gated merges, the policy must first define exact context names, event suffixes, and how qa/security/sop approvals become consistently green and branch-protection-required. Until then, keep audit/queue fallback aligned to the actual BP-required set: CI / all-required, E2E API Smoke, and Handlers Postgres for core main.

REQUEST_CHANGES on head dad0b81d876c59dfe3153f7a27938d6f6e79f020. This is not safe to merge as written. It converts advisory/SOP ceremony contexts into declared required checks in audit-force-merge and in the merge-queue fallback default, without evidence of a sanctioned policy change or that the contexts are satisfiable under normal merge flow. Blast radius: - Live core merge gate is still BP-driven in the current queue: `process_once()` fetches branch protection and fail-closes on BP read failure before using the env fallback (`gitea-merge-queue.py` around the BP fetch path). So on core with readable BP this does not directly alter the normal live required list. - However, the changed `REQUIRED_CONTEXTS_RAW` default is the value an operator/repo would reach for if trying to unblock BP-403 repos, and #2380 makes that fallback stricter than the actual protected set. In the mcp-server class of BP-403 queue blocker, this would re-create a different stall if used as the fallback fix. - `audit-force-merge.yml` does change live audit semantics immediately: it says its JSON mirrors branch protection, but this PR adds contexts that are not in the established protected set. That would classify owner/force merges as missing required checks even when BP-required checks were green. Satisfiability problem: - #2380 itself has the real required PR gates green (`CI / all-required`, `E2E API Smoke`, `Handlers Postgres`) while `sop-checklist / all-items-acked` is red and the added `sop-tier-check / tier-check (pull_request)`, `qa-review / approved (pull_request)`, and `security-review / approved (pull_request)` contexts are missing. The visible qa/security/sop-tier jobs are pull_request_target advisory reds, not these pull_request contexts. - Recent healthy/merged PRs show the same pattern: required gates green while the proposed added contexts are missing or advisory. This would recreate the unsatisfiable-required-checks throughput stall CR2 flagged for #2331. This looks like a policy decision, not a bug fix. If CTO wants SOP-gated merges, the policy must first define exact context names, event suffixes, and how qa/security/sop approvals become consistently green and branch-protection-required. Until then, keep audit/queue fallback aligned to the actual BP-required set: `CI / all-required`, `E2E API Smoke`, and `Handlers Postgres` for core main.
core-be added 1 commit 2026-06-06 23:20:35 +00:00
Revert "fix(audit,merge-queue): include SOP ceremony contexts in required checks (#2331)"
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 16s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 5s
Details
E2E Chat / detect-changes (pull_request) Successful in 9s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 9s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 6s
Details
CI / Python Lint & Test (pull_request) Successful in 19s
Details
CI / Detect changes (pull_request) Successful in 19s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 8s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
security-review / approved (pull_request_target) Failing after 8s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
gate-check-v3 / gate-check (pull_request_target) Failing after 11s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 9s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 32s
Details
qa-review / approved (pull_request_target) Failing after 14s
Details
sop-tier-check / tier-check (pull_request_target) Failing after 11s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 5s
Details
E2E Chat / E2E Chat (pull_request) Successful in 7s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
CI / Canvas (Next.js) (pull_request) Successful in 4s
Details
CI / Platform (Go) (pull_request) Successful in 5s
Details
CI / Canvas Deploy Status (pull_request) Successful in 2s
Details
CI / all-required (pull_request) Successful in 2s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 55s
Details
audit-force-merge / audit (pull_request_target) Has been skipped
Details
29e0332038 
This reverts commit dad0b81d87.
core-be closed this pull request 2026-06-06 23:31:27 +00:00
core-be commented 2026-06-06 23:31:31 +00:00
Author
Member
Copy Link
Copy Source

Reverted per Researcher RC 9286 — making SOP/qa/security ceremony contexts required is a CTO policy decision, not a bug fix. The advisory contexts are not currently in branch protection; adding them to audit/fallback would misclassify normal merges and risk unsatisfiable stalls. Closing this zero-diff PR; #2331 needs policy definition before implementation.

Reverted per Researcher RC 9286 — making SOP/qa/security ceremony contexts required is a CTO policy decision, not a bug fix. The advisory contexts are not currently in branch protection; adding them to audit/fallback would misclassify normal merges and risk unsatisfiable stalls. Closing this zero-diff PR; #2331 needs policy definition before implementation.
core-be commented 2026-06-07 01:52:27 +00:00
Author
Member
Copy Link
Copy Source

Reverted per RC 9286 — making SOP/qa/security ceremony contexts required is a CTO policy decision (tracked in #2331), not a bug fix; needs a green-able ceremony path + exact context names before implementation. Closing this no-op; will re-implement properly if/when the policy is approved.

Reverted per RC 9286 — making SOP/qa/security ceremony contexts required is a CTO policy decision (tracked in #2331), not a bug fix; needs a green-able ceremony path + exact context names before implementation. Closing this no-op; will re-implement properly if/when the policy is approved.
Some checks are pending
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 16s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 5s
Details
E2E Chat / detect-changes (pull_request) Successful in 9s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 9s
Details
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 6s
Details
CI / Python Lint & Test (pull_request) Successful in 19s
Details
CI / Detect changes (pull_request) Successful in 19s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 8s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, local-postgres-e2
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
security-review / approved (pull_request_target) Failing after 8s
Details
sop-checklist / review-refire (pull_request_target) Has been skipped
Details
gate-check-v3 / gate-check (pull_request_target) Failing after 11s
Details
sop-checklist / all-items-acked (pull_request_target) Successful in 9s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 32s
Details
qa-review / approved (pull_request_target) Failing after 14s
Details
sop-tier-check / tier-check (pull_request_target) Failing after 11s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 5s
Required
Details
E2E Chat / E2E Chat (pull_request) Successful in 7s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2s
Required
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 1s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 2s
Details
CI / Canvas (Next.js) (pull_request) Successful in 4s
Details
CI / Platform (Go) (pull_request) Successful in 5s
Details
CI / Canvas Deploy Status (pull_request) Successful in 2s
Details
CI / all-required (pull_request) Successful in 2s
Required
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 55s
Details
audit-force-merge / audit (pull_request_target) Has been skipped
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (pull_request)
Required

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
agent-researcher
Labels
Clear labels
area/ci
CI/CD pipeline issues
 do-not-auto-merge
Opt out of autonomous merge-queue merging
 kind/infrastructure
Infrastructure-related issues
 merge-queue
Ready for serialized Gitea merge queue
 merge-queue-hold
Temporarily hold PR in merge queue
 platform/go
Go platform test issues
 release-blocker
Blocks the staging→main promotion / a release
 release-test
security
test-label-sre
tier:high
High risk per dev-sop §SOP-6 — ceo only, 24h cooldown
 tier:low
Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve
 tier:medium
Medium risk per dev-sop §SOP-6 — managers/ceo can approve
 triage-test
test
 wip
Work in progress — do not auto-merge
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2380
Delete Branch "fix/2331-sop-ceremony-required-checks"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?