Guardrails for the 2026-08-17 catalog incident, plus the harness-mismatch fix.
index-artifact.yml loses its commented-out push trigger and the note telling a future reader to restore it. Triggers are schedule + workflow_dispatch only, and the file now states the general rule: a job that mutates state which cannot be rebuilt in ten minutes is triggered deliberately.
AGENTS.md is a symlink to CLAUDE.md, asserted by make skill-check — a copy would pass every other check in this repo while drifting.
skill-check now scans CLAUDE.md too. It named 27 make targets and nothing verified one of them; coverage goes 19 -> 46.
CLAUDE.md## Git Workflow states the branching rules this PR is the first instance of.
This PR is also the end-to-end test of the new branch protection on main.
Guardrails for the 2026-08-17 catalog incident, plus the harness-mismatch fix.
- `index-artifact.yml` loses its commented-out `push` trigger and the note telling a future reader to restore it. Triggers are `schedule` + `workflow_dispatch` only, and the file now states the general rule: a job that mutates state which cannot be rebuilt in ten minutes is triggered deliberately.
- `AGENTS.md` is a symlink to `CLAUDE.md`, asserted by `make skill-check` — a copy would pass every other check in this repo while drifting.
- `skill-check` now scans `CLAUDE.md` too. It named 27 make targets and nothing verified one of them; coverage goes 19 -> 46.
- `CLAUDE.md` `## Git Workflow` states the branching rules this PR is the first instance of.
This PR is also the end-to-end test of the new branch protection on `main`.
Two guardrails for the 2026-08-17 incident, and one is not about CI.
index-artifact.yml's `push` trigger was commented out that day with a
note to restore it once the rebuild completed. Restoring it is the bug.
A refresh is individually cheap, which is what made the trigger look
free; what it actually did was put an unattended job that mutates the
only copy of a ~205 GB catalog on the same trigger as an ordinary code
change, on a runner with capacity 1. The rule the file now states is the
general one -- a job that mutates state which cannot be rebuilt in ten
minutes is triggered deliberately -- so the next such job has somewhere
to look. The cron and workflow_dispatch lose nothing: indexbuild resumes
from its checkpoint either way.
Note what no branching or PR gate would have caught here. That change
was green on its branch, green on the merge and green on main; the fault
existed only against the persistent /cache database, which no fixture
reproduces. Code is gated by CI, irreplaceable state by refusing to
touch it and by docs/index-cache.md's restore.
The other half is the mismatch that started this: two harnesses reading
two files. AGENTS.md is a symlink to CLAUDE.md and skill-check asserts
the symlink rather than comparing contents, because a copy would satisfy
every other check in this repo while silently drifting -- which is the
failure being prevented. The same check now scans CLAUDE.md for make
targets, which it never did: 27 targets named in the file agents trust
most, none of them verified. Coverage goes 19 -> 46.
Scanning prose meant the line-start rule needed a fence. "Two green
branches do not / make a green merge" wrapped onto a line beginning
`make a` and duly failed on a target called `a`. Inside a fence it is
code; outside one it is a sentence that broke there, and a check that
fails on reflow gets disabled rather than fixed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AfVYUVExXsx1nSWrXN8mAh
A branch push and its pull request are the same commit. With
`branches: ['**']` alongside `pull_request:`, opening a PR booked four
runs -- check and e2e for the branch, then both again for
refs/pull/N/head -- and this host has capacity 1, shared with an index
build that can hold it for three hours. PR #1's own checks queued two
runs deep behind exactly that.
`pull_request` covers feature branches. `main` stays because a
post-merge run is the record of the trunk's health, and now that main
refuses direct pushes it happens exactly once per merge.
The trade is that a branch pushed with no PR open gets no CI. That
matches the workflow this repo just committed to, and the signal returns
on the same commit the moment a PR exists.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AfVYUVExXsx1nSWrXN8mAh
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Guardrails for the 2026-08-17 catalog incident, plus the harness-mismatch fix.
index-artifact.ymlloses its commented-outpushtrigger and the note telling a future reader to restore it. Triggers areschedule+workflow_dispatchonly, and the file now states the general rule: a job that mutates state which cannot be rebuilt in ten minutes is triggered deliberately.AGENTS.mdis a symlink toCLAUDE.md, asserted bymake skill-check— a copy would pass every other check in this repo while drifting.skill-checknow scansCLAUDE.mdtoo. It named 27 make targets and nothing verified one of them; coverage goes 19 -> 46.CLAUDE.md## Git Workflowstates the branching rules this PR is the first instance of.This PR is also the end-to-end test of the new branch protection on
main.LGTM