ci(nightly): reject stale source stacks by incognitojam · Pull Request #95 · yngatech/t3code

incognitojam · 2026-08-12T10:47:31Z

A manually dispatched source_ref could be cut from stale main and silently drop newer fork patches when the verified candidate was promoted.

This adds a prepare-time git cherry guard that compares the supplied stack with the captured main snapshot before rebasing or verification. Missing patches fail loudly with their commit subjects. Maintainers can explicitly acknowledge intentionally reshaped conflict-resolution patches with allow_missing_main_patches; scheduled runs are unchanged. The operations runbook now documents the workflow.

Focused Git-history coverage includes equivalent patches, newer upstream bases, upstream-absorbed patches, empty candidates, stale stacks, the explicit override, and fail-closed handling when git cherry errors.

Verification:

vp test run scripts/check-source-stack.test.ts
vp fmt --check scripts/check-source-stack.test.ts docs/operations/fork-nightly.md .github/workflows/fork-nightly.yml
vp lint scripts/check-source-stack.test.ts
bash -n .github/scripts/check-source-stack.sh
shellcheck .github/scripts/check-source-stack.sh
actionlint -ignore 'label ".*" is unknown' .github/workflows/fork-nightly.yml
git diff --check

Fixes #94

Written by an agent (T3 Code, gpt-5.6-sol).

A manually dispatched `source_ref` could be cut from stale `main` and silently drop newer fork patches when the verified candidate was promoted. This adds a prepare-time `git cherry` guard that compares the supplied stack with the captured `main` snapshot before rebasing or verification. Missing patches fail loudly with their commit subjects. Maintainers can explicitly acknowledge intentionally reshaped conflict-resolution patches with `allow_missing_main_patches`; scheduled runs are unchanged. The operations runbook now documents the workflow. Focused Git-history coverage includes equivalent patches, newer upstream bases, upstream-absorbed patches, empty candidates, stale stacks, the explicit override, and fail-closed handling when `git cherry` errors. Verification: - `vp test run scripts/check-source-stack.test.ts` - `vp fmt --check scripts/check-source-stack.test.ts docs/operations/fork-nightly.md .github/workflows/fork-nightly.yml` - `vp lint scripts/check-source-stack.test.ts` - `bash -n .github/scripts/check-source-stack.sh` - `shellcheck .github/scripts/check-source-stack.sh` - `actionlint -ignore 'label ".*" is unknown' .github/workflows/fork-nightly.yml` - `git diff --check` Fixes #94 --- Written by an agent (T3 Code, gpt-5.6-sol).

Every conflict-resolved `source_ref` reshapes the patches it touched, so the stale-stack guard from #95 flags them and `allow_missing_main_patches` has to be set on essentially every dispatch — and that boolean waives the *entire* missing list, including a patch that merged to `main` after the review. The blanket override defeats the guard in exactly the window it was built for (#94). This replaces the boolean with `waived_main_patches`: the reviewed commits themselves, space or comma separated. Waived patches are listed in the log and skipped; any other missing patch still fails the dispatch, so a PR that lands on `main` between review and re-dispatch is caught instead of silently waived. A literal `true` is rejected with a pointer to the new input, a waiver entry that does not resolve fails loudly, and waivers that turn out to be unnecessary are noted without failing. The runbook documents the new flow. Verification: - `vp test run scripts/check-source-stack.test.ts` (12 passed) - `vp lint scripts/check-source-stack.test.ts` - `vp fmt --check scripts/check-source-stack.test.ts docs/operations/fork-nightly.md .github/workflows/fork-nightly.yml` - `bash -n .github/scripts/check-source-stack.sh` - `shellcheck .github/scripts/check-source-stack.sh` - `actionlint -ignore 'label ".*" is unknown' .github/workflows/fork-nightly.yml` --- Written by an agent (T3 Code, claude-fable-5).

A manually dispatched `source_ref` could be cut from stale `main` and silently drop newer fork patches when the verified candidate was promoted. This adds a prepare-time `git cherry` guard that compares the supplied stack with the captured `main` snapshot before rebasing or verification. Missing patches fail loudly with their commit subjects. Maintainers can explicitly acknowledge intentionally reshaped conflict-resolution patches with `allow_missing_main_patches`; scheduled runs are unchanged. The operations runbook now documents the workflow. Focused Git-history coverage includes equivalent patches, newer upstream bases, upstream-absorbed patches, empty candidates, stale stacks, the explicit override, and fail-closed handling when `git cherry` errors. Verification: - `vp test run scripts/check-source-stack.test.ts` - `vp fmt --check scripts/check-source-stack.test.ts docs/operations/fork-nightly.md .github/workflows/fork-nightly.yml` - `vp lint scripts/check-source-stack.test.ts` - `bash -n .github/scripts/check-source-stack.sh` - `shellcheck .github/scripts/check-source-stack.sh` - `actionlint -ignore 'label ".*" is unknown' .github/workflows/fork-nightly.yml` - `git diff --check` Fixes #94 --- Written by an agent (T3 Code, gpt-5.6-sol).

Every conflict-resolved `source_ref` reshapes the patches it touched, so the stale-stack guard from #95 flags them and `allow_missing_main_patches` has to be set on essentially every dispatch — and that boolean waives the *entire* missing list, including a patch that merged to `main` after the review. The blanket override defeats the guard in exactly the window it was built for (#94). This replaces the boolean with `waived_main_patches`: the reviewed commits themselves, space or comma separated. Waived patches are listed in the log and skipped; any other missing patch still fails the dispatch, so a PR that lands on `main` between review and re-dispatch is caught instead of silently waived. A literal `true` is rejected with a pointer to the new input, a waiver entry that does not resolve fails loudly, and waivers that turn out to be unnecessary are noted without failing. The runbook documents the new flow. Verification: - `vp test run scripts/check-source-stack.test.ts` (12 passed) - `vp lint scripts/check-source-stack.test.ts` - `vp fmt --check scripts/check-source-stack.test.ts docs/operations/fork-nightly.md .github/workflows/fork-nightly.yml` - `bash -n .github/scripts/check-source-stack.sh` - `shellcheck .github/scripts/check-source-stack.sh` - `actionlint -ignore 'label ".*" is unknown' .github/workflows/fork-nightly.yml` --- Written by an agent (T3 Code, claude-fable-5).

A manually dispatched `source_ref` could be cut from stale `main` and silently drop newer fork patches when the verified candidate was promoted. This adds a prepare-time `git cherry` guard that compares the supplied stack with the captured `main` snapshot before rebasing or verification. Missing patches fail loudly with their commit subjects. Maintainers can explicitly acknowledge intentionally reshaped conflict-resolution patches with `allow_missing_main_patches`; scheduled runs are unchanged. The operations runbook now documents the workflow. Focused Git-history coverage includes equivalent patches, newer upstream bases, upstream-absorbed patches, empty candidates, stale stacks, the explicit override, and fail-closed handling when `git cherry` errors. Verification: - `vp test run scripts/check-source-stack.test.ts` - `vp fmt --check scripts/check-source-stack.test.ts docs/operations/fork-nightly.md .github/workflows/fork-nightly.yml` - `vp lint scripts/check-source-stack.test.ts` - `bash -n .github/scripts/check-source-stack.sh` - `shellcheck .github/scripts/check-source-stack.sh` - `actionlint -ignore 'label ".*" is unknown' .github/workflows/fork-nightly.yml` - `git diff --check` Fixes #94 --- Written by an agent (T3 Code, gpt-5.6-sol).

Every conflict-resolved `source_ref` reshapes the patches it touched, so the stale-stack guard from #95 flags them and `allow_missing_main_patches` has to be set on essentially every dispatch — and that boolean waives the *entire* missing list, including a patch that merged to `main` after the review. The blanket override defeats the guard in exactly the window it was built for (#94). This replaces the boolean with `waived_main_patches`: the reviewed commits themselves, space or comma separated. Waived patches are listed in the log and skipped; any other missing patch still fails the dispatch, so a PR that lands on `main` between review and re-dispatch is caught instead of silently waived. A literal `true` is rejected with a pointer to the new input, a waiver entry that does not resolve fails loudly, and waivers that turn out to be unnecessary are noted without failing. The runbook documents the new flow. Verification: - `vp test run scripts/check-source-stack.test.ts` (12 passed) - `vp lint scripts/check-source-stack.test.ts` - `vp fmt --check scripts/check-source-stack.test.ts docs/operations/fork-nightly.md .github/workflows/fork-nightly.yml` - `bash -n .github/scripts/check-source-stack.sh` - `shellcheck .github/scripts/check-source-stack.sh` - `actionlint -ignore 'label ".*" is unknown' .github/workflows/fork-nightly.yml` --- Written by an agent (T3 Code, claude-fable-5).

> [!NOTE] > `#123`, `GH-123` and `owner/repo#123` in a pull request body are now links, the way they are on > GitHub. What each number turns out to be decides where it opens: a pull request in a project on > this machine opens as a tab beside the one being read, an issue opens in a browser, and a number > the host has nothing under is underlined in red and still opens. GitHub's autolinked references are its own extension rather than GFM, so remark left them as they were: every `pingdotgg#6039` an agent or a reviewer wrote in a description, a comment or a review stayed plain text, and following one meant retyping it into a browser. Reading them is the easy half. Knowing what one *is* takes asking the host, and a body can name a dozen — so they are asked about together, in one GraphQL document, aliased by repository and by number. `issueOrPullRequest` answers which of the two each number turned out to be, which is what decides where it opens; a cache keeps a panel of many bodies from spawning a process per body for numbers a neighbour just resolved. The link is addressed at `/issues/{n}` before any of that comes back, because the host redirects that to `/pull/{n}` for a pull request — so it is already right in a browser, and resolving only ever improves it. A reference clicked before its answer arrives follows it as written. Everything else follows from one rule: **only an answer marks a link as broken.** A request that failed on the way — rate limited, logged out, offline — leaves every reference exactly as it was, and a null is read as nothing-there only where the host filed `NOT_FOUND` against it, since `FORBIDDEN` is SAML or an IP allowlist standing between the reader and something they can very likely open themselves. A host having a bad minute must not repaint a body full of good references as mistakes. Inert unless a surface passes the repository to read numbers against, so `#2` in a conversation — where it is far more likely to be a step than an issue — stays the plain text it reads as. ## Before / after The description of #126, which cites the stale-stack guard from `#95` and the window it was built for (`#94`). | Before | After | | --- | --- | | <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/before.png" alt="Reference numbers rendered as plain grey text" width="460"> | <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/after.png" alt="The same numbers rendered as links" width="460"> | `#95` resolves to a pull request and opens as a tab here; `#94` resolves to an issue and opens in a browser, since there is no issue surface to open it in. A reference the host has nothing under keeps its link colour and takes the mark an unknown word takes. No pull request in this repository happens to cite a number the repository lacks, so the state below was forced on a resolved reference to photograph it: <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/missing.png" alt="A reference underlined with a red wavy line" width="460"> ## Reading the commits Three layers, each of which stands alone: the plugin that reads references and renders nothing differently on its own, the request that answers them and is called by nobody, then the wiring that turns both on. ## Verification - `vp test run` for the touched suites: `sourceControl` (147), `GitManager`, and the web `markdown-github-references`, `chat` and `pullRequest` suites (469). - Targeted `tsgo --noEmit` for `apps/web`, `apps/server` and `packages/contracts`, at each of the three commits rather than only at the tip. - The matching rules are GitHub's own, each checked against its renderer before being written down: `foo#123` and `#123abc` are not references, `(#123)`, `#123.`, `#123-abc` and `/#123` are, `#0` is not, and code spans and link labels are left alone. - Read live against this repository in `test-t3-app`: references linkified in a real description, `#95` re-addressed itself to `/pull/95` and opened here, `#94` stayed addressed for the browser. That pass is also what found two faults nothing else did — a memoized renderer holding the first render's answers, and a mark cancelled by `.chat-markdown a { text-decoration: none }`. --- Written by an agent (T3 Code, claude-opus-5).

A manually dispatched `source_ref` could be cut from stale `main` and silently drop newer fork patches when the verified candidate was promoted. This adds a prepare-time `git cherry` guard that compares the supplied stack with the captured `main` snapshot before rebasing or verification. Missing patches fail loudly with their commit subjects. Maintainers can explicitly acknowledge intentionally reshaped conflict-resolution patches with `allow_missing_main_patches`; scheduled runs are unchanged. The operations runbook now documents the workflow. Focused Git-history coverage includes equivalent patches, newer upstream bases, upstream-absorbed patches, empty candidates, stale stacks, the explicit override, and fail-closed handling when `git cherry` errors. Verification: - `vp test run scripts/check-source-stack.test.ts` - `vp fmt --check scripts/check-source-stack.test.ts docs/operations/fork-nightly.md .github/workflows/fork-nightly.yml` - `vp lint scripts/check-source-stack.test.ts` - `bash -n .github/scripts/check-source-stack.sh` - `shellcheck .github/scripts/check-source-stack.sh` - `actionlint -ignore 'label ".*" is unknown' .github/workflows/fork-nightly.yml` - `git diff --check` Fixes #94 --- Written by an agent (T3 Code, gpt-5.6-sol).

Every conflict-resolved `source_ref` reshapes the patches it touched, so the stale-stack guard from #95 flags them and `allow_missing_main_patches` has to be set on essentially every dispatch — and that boolean waives the *entire* missing list, including a patch that merged to `main` after the review. The blanket override defeats the guard in exactly the window it was built for (#94). This replaces the boolean with `waived_main_patches`: the reviewed commits themselves, space or comma separated. Waived patches are listed in the log and skipped; any other missing patch still fails the dispatch, so a PR that lands on `main` between review and re-dispatch is caught instead of silently waived. A literal `true` is rejected with a pointer to the new input, a waiver entry that does not resolve fails loudly, and waivers that turn out to be unnecessary are noted without failing. The runbook documents the new flow. Verification: - `vp test run scripts/check-source-stack.test.ts` (12 passed) - `vp lint scripts/check-source-stack.test.ts` - `vp fmt --check scripts/check-source-stack.test.ts docs/operations/fork-nightly.md .github/workflows/fork-nightly.yml` - `bash -n .github/scripts/check-source-stack.sh` - `shellcheck .github/scripts/check-source-stack.sh` - `actionlint -ignore 'label ".*" is unknown' .github/workflows/fork-nightly.yml` --- Written by an agent (T3 Code, claude-fable-5).

> [!NOTE] > `#123`, `GH-123` and `owner/repo#123` in a pull request body are now links, the way they are on > GitHub. What each number turns out to be decides where it opens: a pull request in a project on > this machine opens as a tab beside the one being read, an issue opens in a browser, and a number > the host has nothing under is underlined in red and still opens. GitHub's autolinked references are its own extension rather than GFM, so remark left them as they were: every `pingdotgg#6039` an agent or a reviewer wrote in a description, a comment or a review stayed plain text, and following one meant retyping it into a browser. Reading them is the easy half. Knowing what one *is* takes asking the host, and a body can name a dozen — so they are asked about together, in one GraphQL document, aliased by repository and by number. `issueOrPullRequest` answers which of the two each number turned out to be, which is what decides where it opens; a cache keeps a panel of many bodies from spawning a process per body for numbers a neighbour just resolved. The link is addressed at `/issues/{n}` before any of that comes back, because the host redirects that to `/pull/{n}` for a pull request — so it is already right in a browser, and resolving only ever improves it. A reference clicked before its answer arrives follows it as written. Everything else follows from one rule: **only an answer marks a link as broken.** A request that failed on the way — rate limited, logged out, offline — leaves every reference exactly as it was, and a null is read as nothing-there only where the host filed `NOT_FOUND` against it, since `FORBIDDEN` is SAML or an IP allowlist standing between the reader and something they can very likely open themselves. A host having a bad minute must not repaint a body full of good references as mistakes. Inert unless a surface passes the repository to read numbers against, so `#2` in a conversation — where it is far more likely to be a step than an issue — stays the plain text it reads as. The description of #126, which cites the stale-stack guard from `#95` and the window it was built for (`#94`). | Before | After | | --- | --- | | <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/before.png" alt="Reference numbers rendered as plain grey text" width="460"> | <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/after.png" alt="The same numbers rendered as links" width="460"> | `#95` resolves to a pull request and opens as a tab here; `#94` resolves to an issue and opens in a browser, since there is no issue surface to open it in. A reference the host has nothing under keeps its link colour and takes the mark an unknown word takes. No pull request in this repository happens to cite a number the repository lacks, so the state below was forced on a resolved reference to photograph it: <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/missing.png" alt="A reference underlined with a red wavy line" width="460"> Three layers, each of which stands alone: the plugin that reads references and renders nothing differently on its own, the request that answers them and is called by nobody, then the wiring that turns both on. - `vp test run` for the touched suites: `sourceControl` (147), `GitManager`, and the web `markdown-github-references`, `chat` and `pullRequest` suites (469). - Targeted `tsgo --noEmit` for `apps/web`, `apps/server` and `packages/contracts`, at each of the three commits rather than only at the tip. - The matching rules are GitHub's own, each checked against its renderer before being written down: `foo#123` and `#123abc` are not references, `(#123)`, `#123.`, `#123-abc` and `/#123` are, `#0` is not, and code spans and link labels are left alone. - Read live against this repository in `test-t3-app`: references linkified in a real description, `#95` re-addressed itself to `/pull/95` and opened here, `#94` stayed addressed for the browser. That pass is also what found two faults nothing else did — a memoized renderer holding the first render's answers, and a mark cancelled by `.chat-markdown a { text-decoration: none }`. --- Written by an agent (T3 Code, claude-opus-5).

github-actions Bot added vouch:trusted PR author is trusted by repo permissions or the VOUCHED list. size:M labels Aug 12, 2026

yngatech-nightly Bot force-pushed the main branch from 73dd518 to 2a4685b Compare August 12, 2026 10:50

incognitojam force-pushed the t3code/guard-stale-source-stack branch from 0df5843 to 60ce889 Compare August 12, 2026 11:45

ci(nightly): reject stale source stacks

6cec787

incognitojam force-pushed the t3code/guard-stale-source-stack branch from 60ce889 to 6cec787 Compare August 12, 2026 12:04

incognitojam merged commit 9d444db into main Aug 12, 2026
12 checks passed

incognitojam deleted the t3code/guard-stale-source-stack branch August 12, 2026 14:34

incognitojam mentioned this pull request Aug 14, 2026

ci(nightly): waive missing main patches per commit #126

Merged

Navigation Menu

Uh oh!

ci(nightly): reject stale source stacks - #95

ci(nightly): reject stale source stacks#95
incognitojam merged 1 commit into
mainfrom
t3code/guard-stale-source-stack

incognitojam commented Aug 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

incognitojam commented Aug 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant