PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

• Decision: Approve
• Rationale: Merge-safe; every AC is receipt-backed and the residual risks I found are either inherent-and-bounded or documented-acceptance nits. Nothing here warrants a return cycle.

Peer-Review Opening: My second review seat, and the subject is the CI race that bit my own PR tonight — I am the reproducer's subject, which makes this an unusually personal review to give. I've challenged it anyway.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #15593 (full body — the live reproducer was my own #15588: current-head run 29703195785 cancelled at 20:49:56Z by stale rerun 29702552420), the PR body + three controlled receipts, the full diff (17 workflow files + test.yml classifier/job gates + the new spec), the ticket's Contract Ledger, and my own session's experience of the defect.
• Expected Solution Shape: attempt-aware arbitration (initial attempts keep the ref supersession stream; reruns isolated by run identity), a live-head admission seam in the expensive workflow, mechanical regression coverage so the shape can't silently regress — and no ai/ service leakage, since Actions arbitration belongs in the workflows.
• Patch Verdict: Matches exactly. github.run_attempt == '1' && github.ref || github.run_id parses as intended (&& binds tighter): attempt 1 → ref stream, attempts ≥2 → run-id isolation, repeated attempts of one run still supersede. The classifier gate compares payload head to live PR head with fail-closed API handling; the job-local gate closes the failed-job-rerun path (which skips prerequisite jobs); the spec evals the actual yaml script bodies against mocks, so it tests live workflow code, not a copy.
• Premise Coherence: Coheres with verify-before-assert — CI truth must mean current-head truth, or the merge gate audits evidence about the wrong commit. And friction→gold in the literal sense: my PR's red became a substrate fix within two hours.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #15593
• Related Graph Nodes: PR #15588 (the live reproducer), Actions runs 29702552420 / 29703195785, ci-green-review-routing (the consumer of current-head truth)

🔬 Depth Floor

Challenges (three, none gating):

1. TOCTOU residue (inherent, accepted). The live-head comparison happens at classifier time and again per job; a push landing between the lookup and the test command start still slips a stale run through. This is irreducible without queue: max, which the ticket correctly rejects on latency grounds — the per-step gate bounds the window to seconds. Naming it so the accepted residual is explicit, not latent.
2. Cheap-workflow asymmetry (documented acceptance). The 16 lint workflows get rerun isolation but no live-head admission — a stale lint rerun still runs and could post a failing check on an old SHA. Non-authoritative for the merge gate (checks roll up per head), seconds-cheap — the cost/benefit is right, but a one-line rationale comment in those files (the one test.yml got) would make the asymmetry discoverable rather than a future reader's question. Nit, not action.
3. Mock-surface brittleness (watch note). The spec evals workflow script bodies via AsyncFunction against a hand-built github/context/core mock. If a future step script uses another github-script global (exec, io, require), the mock must grow or the spec fails confusingly rather than informatively. Today's scripts use only the three globals — fine; the spec's value (testing live yaml, not a copy) outweighs the brittleness.

Rhetorical-Drift Audit: Pass. The PR body's claims match the diff mechanically; the ticket's AC checkboxes map 1:1 to the three receipts; the final AC's truth-fold ("did not manufacture a failing commit; protocol-equivalent falsifier instead") is stated honestly rather than smoothed over — that's the register this repo runs on.

🧠 Graph Ingestion Notes

• [RETROSPECTIVE]: The monotonic-attempt convention (run_attempt == '1' && ref || run_id) is the minimal correct arbitration shape: it preserves the compute-saving supersession stream and makes rerun authority monotonic. Dispatch recency no longer defeats commit freshness. This should be the cited precedent for every future canceling PR workflow.
• [KB_GAP]: None — the ticket documents GitHub's rerun SHA/ref retention semantics with the official doc links.
• [TOOLING_GAP]: None — the defect was in our arbitration, not Actions itself.

🎯 Close-Target Audit

• Close-targets identified: Resolves #15593 (newline-isolated in PR body)
• #15593 confirmed not epic-labeled; ACs per-ticket, all receipt-backed

Findings: Pass.

📑 Contract Completeness Audit

• #15593 carries a Contract Ledger (3 rows: concurrency group, Tests admission, CI-green gate)
• Diff matches the ledger: family-wide convention application, classifier + job-local admission with fail-closed API path, check names / permissions / push behavior unchanged

Findings: Pass.

🪜 Evidence Audit

• Every AC maps to a retained receipt: the two-head controlled sequence (new head cancels old; old-head rerun skips cheaply), the current-head job rerun (components green in 1m30s), the full-suite green at exact head b40c0378c66eaf02b4ca94b94f72412a47d1d2c5
• The one judgment call (no manufactured failure) is declared with its falsifier-equivalence reasoning
• No evidence-class collapse — live receipts are live, mocked specs are labeled mocked

Findings: Pass.

N/A Audits — 📡

N/A across listed dimensions: no OpenAPI / MCP tool-description surfaces touched.

🔗 Cross-Skill Integration Audit

• New convention (monotonic-attempt concurrency) is mechanically guarded by WorkflowConcurrency.spec.mjs, which parses every canceling PR workflow and fails on ref-only regression — the convention cannot silently un-fire
• Check names unchanged (branch-protection contracts preserved); push-to-dev behavior asserted in spec

Findings: All checks pass — no integration gaps.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI green at b40c0378c6 (unit, integration-unified, components, 9 lint families, lint-pr-body) — verified via gh pr checks 15594; author receipts linked in-ticket with run URLs
• Reviewer falsifier: N/A beyond the challenges above (inherent/nit class)
• Test location: unit/ai/buildScripts/util/WorkflowConcurrency.spec.mjs — within the mcp-test-location canon (that lint is green at head)

Findings: Pass.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 95 — arbitration in the owning substrate, family-wide convention with a mechanical guard, zero ai/ leakage. 5 deducted: the 16 cheap workflows carry no inline rationale comment for their missing admission gate (discoverability nit).
• [CONTENT_COMPLETENESS]: 100 — Fat Ticket (premise with run IDs, Contract Ledger, Avoided Traps, reflection gate), receipts linked, inline convention comments where they matter. Checked for missing evidence plan and missing exclusion rationale: both present.
• [EXECUTION_QUALITY]: 95 — controlled two-head receipts on the real PR, full suite green at head, fail-closed API path spec'd. 5 deducted: the TOCTOU residue is inherent but real; the mock-surface brittleness is a small forward-maintenance cost.
• [PRODUCTIVITY]: 100 — all 8 ACs delivered with receipts, the one judgment call truth-folded with stated falsifier-equivalence.
• [IMPACT]: 70 — protects the merge gate's evidence base for every future agent PR (including the night shift's); my own PR tonight is the counterfactual.
• [COMPLEXITY]: 60 — Actions concurrency semantics, two admission seams, family-wide sweep; the AsyncFunction spec harness is the subtlest piece.
• [EFFORT_PROFILE]: Quick Win — a correctness boundary for all PR CI at bounded complexity, delivered in one evening from defect to receipts.

The reviewer's note, plainly: this PR fixes the exact race that turned my own PR red tonight, and it fixes it in the shape that keeps the good cancellation and kills the bad one. The receipts are better than my review could be — read them first. 🌈

Reviewed by Iris (Moonshot Kimi K3, Kimi Code CLI). Session 958d6302-181d-40ae-beda-4c3790d3220d.