gHashTag · Oct 18, 2026 · Oct 19, 2026
@@ -6,19 +6,13 @@ on:
     paths:
       - 'docs/WHITEPAPER/**'
   pull_request:
-    # No `branches:` filter on pull_request, deliberately. A branch filter makes
-    # this gate silent on any PR whose base is not listed -- a stacked PR then
-    # shows a green check list that a master-based PR would not get. Enforced by
-    # scripts/ci/check_pr_branch_filters.py. The `push` filter below, where one
-    # exists, is left alone: restricting post-merge runs is a cost decision.
     paths:
       - 'docs/WHITEPAPER/**'
-  # Without this the missing reading cannot be taken on purpose: a gate with
-  # a `paths:` filter that nothing has matched in months is unmeasured, not
-  # passing, and there was no way to fire it at the default branch and find
-  # out. `tri gates unmeasured` reports the gap; this is what closes it.
   workflow_dispatch:
 
+concurrency:
+  group: build-paper-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   build-paper:
     runs-on: ubuntu-latest

@@ -19,11 +19,6 @@ name: Catalog Count Invariant (CI-01)
 
 on:
   pull_request:
-    # No `branches:` filter on pull_request, deliberately. A branch filter makes
-    # this gate silent on any PR whose base is not listed -- a stacked PR then
-    # shows a green check list that a master-based PR would not get. Enforced by
-    # scripts/ci/check_pr_branch_filters.py. The `push` filter below, where one
-    # exists, is left alone: restricting post-merge runs is a cost decision.
     paths:
       - "specs/numeric/formats_catalog.t27"
       - "tools/gen_formats_catalog.py"
@@ -42,6 +37,9 @@ on:
       - ".github/workflows/catalog-count-gate.yml"
   workflow_dispatch:
 
+concurrency:
+  group: catalog-count-gate-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 jobs:
   count-invariant:
     runs-on: ubuntu-latest

@@ -31,6 +31,9 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: conformance-integrity-gate-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   integrity-gate:
     runs-on: ubuntu-latest

@@ -16,11 +16,6 @@ on:
       # no-op and no run would notice, because nothing under coq/ changed.
       - 'bootstrap/src/phi_f64_literals.rs'
   pull_request:
-    # No `branches:` filter on pull_request, deliberately. A branch filter makes
-    # this gate silent on any PR whose base is not listed -- a stacked PR then
-    # shows a green check list that a master-based PR would not get. Enforced by
-    # scripts/ci/check_pr_branch_filters.py. The `push` filter below, where one
-    # exists, is left alone: restricting post-merge runs is a cost decision.
     paths:
       - 'coq/**'
       - 'proofs/**'
@@ -29,12 +24,11 @@ on:
       - 'tools/coq_outside_build_baseline.txt'
       - '.github/workflows/coq-kernel.yml'
       - 'bootstrap/src/phi_f64_literals.rs'
-  # Without this the missing reading cannot be taken on purpose: a gate with
-  # a `paths:` filter that nothing has matched in months is unmeasured, not
-  # passing, and there was no way to fire it at the default branch and find
-  # out. `tri gates unmeasured` reports the gap; this is what closes it.
   workflow_dispatch:
 
+concurrency:
+  group: coq-kernel-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   build:
     runs-on: ubuntu-latest

@@ -14,6 +14,9 @@ on:
       - '.github/workflows/coq-proofs.yml'
   workflow_dispatch:
 
+concurrency:
+  group: coq-proofs-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   compile-proofs:
     runs-on: ubuntu-latest

@@ -13,9 +13,9 @@ name: Duplicate Body Ratchet
 
 on:
   pull_request:
-    # No `branches:` filter, deliberately: a filter makes this gate silent on a
-    # stacked pull request, which then shows a green check list a master-based
-    # one would not get (scripts/ci/check_pr_branch_filters.py enforces this).
+    # No `branches:` filter (scripts/ci/check_pr_branch_filters.py): a stacked PR must
+    # not see a different check list.
+    paths: ["specs/**", "tools/dupe_scan.py", "tools/duplicate_bodies_baseline.txt", ".github/workflows/dupe-ratchet.yml"]
   push:
     branches: [master]
   workflow_dispatch:

@@ -40,6 +40,9 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: gf-wide-conformance-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   gf-wide:
     runs-on: ubuntu-latest

@@ -22,6 +22,9 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: gf16-conformance-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   gf16-oracle:
     runs-on: ubuntu-latest

@@ -27,6 +27,9 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: pack-index-consistency-gate-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   pack-index-consistency:
     runs-on: ubuntu-latest

@@ -22,16 +22,15 @@ on:
       - 'bootstrap/src/compiler.rs'
       - 'bootstrap/stage0/FROZEN_HASH'
       - 'repro/numerics/nmse_manifest.json'
-  # Without this the missing reading cannot be taken on purpose: a gate with
-  # a `paths:` filter that nothing has matched in months is unmeasured, not
-  # passing, and there was no way to fire it at the default branch and find
-  # out. `tri gates unmeasured` reports the gap; this is what closes it.
   workflow_dispatch:
 
 # Least-privilege: this advisory job only needs to read the checked-out tree.
 permissions:
   contents: read
 
+concurrency:
+  group: seal-staleness-warn-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 jobs:
   warn-if-seal-stale:
     runs-on: ubuntu-latest