feat(catalog): add the unsatisfiable-merge-gate error class (ERR-GATE-001..005) - #452
Conversation
…-001..005)
Five new error types, every one MEASURED across all 418 active estate repos on
2026-07-29 rather than inferred. They share one shape: the board reads green or
blocked for a reason no workflow edit can address, because the check never ran.
ERR-GATE-001 phantom-required-context
A required context no job emits. 236 required-context rows live in
RULESETS, which classic branch protection does not report -- so an audit
reading only classic protection sees almost none of the estate's
requirements. Variants: invented name (hypatia-scan), case mismatch
(codeql vs CodeQL), filename-as-context (.github/dependabot.yml).
ERR-GATE-002 required-context-never-runs-on-pull-request
The canonical case: Dependabot. GitHub's managed dependabot-updates runner
fires on a SCHEDULE against main -- 10 check-runs there, 0 on any PR head,
across 25 repos. Sampling main scores it HEALTHY. Likely root of the
estate's --admin merge drift.
ERR-GATE-003 dead-action-pin
69 repos, 135 refs to two DELETED action repos. An unresolvable uses: ref
yields NO check run rather than a red one. Remediation is REPOINT, not
vendor: vendoring creates one drifting copy per consumer, which this
estate's own handover names as its most recurring failure mode.
ERR-GATE-004 actions-policy-refuses-every-reusable
allowed_actions=selected + empty patterns_allowed -> startup_failure, zero
jobs. A SETTINGS fault: proof is governance.yml going 0 jobs -> 10 jobs
with no file change at all.
ERR-GATE-005 empty-jobs-map
20 repos' e2e.yml: jobs: present, every block commented out, hence invalid.
Each entry carries the API traps found while remediating it -- the surgical
DELETE sub-resource for contexts (a full PUT replaces the protection object and
drops required_signatures/enforce_admins), the HTTP 422 on emptying a ruleset's
required_status_checks, and that a startup_failure run cannot be re-run because
it has no jobs.
ERR-GATE-005 carries an explicit warning against the tempting fix: do not write
a job that passes without testing anything, because that converts a dead gate
into a fake one, which is worse -- it is read as evidence.
Verified: guile parses the catalog; 14 entries (9 existing + 5). schema-version
bumped to 2026-07-29.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ Approved 1 resolved / 1 findingsAdds the unsatisfiable merge gate error class with five new catalog entries, but malformed S-expression parentheses at line 310 break the outer list structure. ✅ 1 resolved✅ Bug: New ERR-GATE entries fall outside the error-catalog list
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
Five new error types, every one measured across all 418 active estate repos on 2026-07-29 rather than inferred. They share one shape: the board reads green or blocked for a reason no workflow edit can address, because the check never ran.
ERR-GATE-001phantom-required-contextERR-GATE-002never-runs-on-pull-requestmain, 0 on any PR head, 25 repos. Sampling main scores it healthyERR-GATE-003dead-action-pinERR-GATE-004actions-policy-refusalallowed_actions: selected+ emptypatterns_allowed→startup_failure, 0 jobs. Settings faultERR-GATE-005empty-jobs-mape2e.yml—jobs:present, every block commented outEach carries the API traps found while remediating it: the surgical
DELETEsub-resource (a fullPUT .../protectionreplaces the object and dropsrequired_signatures/enforce_admins), the HTTP 422 on emptying a ruleset'srequired_status_checks, and that astartup_failurerun cannot be re-run because it has no jobs.ERR-GATE-005explicitly warns against the tempting fix — writing a job that passes without testing anything converts a dead gate into a fake one, which is worse because it's read as evidence.Verified: guile parses the catalog; 14 entries (9 + 5).
🤖 Generated with Claude Code