ci(brain): let the merge gate fail, and fail on a failed detect-build

[gHashTag]

Closes #883. Part of #851 (W15).

What changes

brain-ci.yml, two edits:

1. 🔒 Merge Gate: if: github.event_name == 'pull_request' becomes if: ${{ !cancelled() && github.event_name == 'pull_request' }}. Without a status function GitHub adds success(), so the gate ran only when everything upstream had passed, and its test "the report did not pass" could never be true. On 3 of 3 pull_request runs where the report failed, the gate was skipped.
2. 📋 Brain Health Report: before trusting needs.detect-build.outputs.present, require needs.detect-build.result == 'success'. A failed detect-build never writes present, and [ "" != "true" ] printed "Brain CI skipped — no root build.zig … Non-blocking" and exited 0. main has a root build.zig.

Measured (dispatch A/B, both arms with a forced exit 1 in detect-build)

arm	run	report	Merge Gate	run
control: main (exp/gate-defect-ab)	37240659458	success: if [ "" != "true" ] → "no root build.zig … Non-blocking"	skipped, 0 steps	failure
fix (exp/gate-fix-ab)	37240661475	failure: [ "failure" == "success" ] → "detect-build was failure"	failure: [ "failure" != "success" ] → "Merge gate blocked"	failure

On both throwaway branches, merge-gate's pull_request filter is dropped so a dispatch reaches it. The control keeps the implicit success(), and the fix arm keeps !cancelled(). Apart from that, each arm differs from its base by the forced step alone.

The control also corrected me. I had expected the whole brain CI to go green. It does not, because detect-build's own check stays red. The false part is the report alone: a green check that gives a wrong reason. The issue body records the correction.

Order and overlap

• Merges cleanly with ci(brain): skip the health report when the run itself was cancelled #882, ci(brain): stop calling tri stress --record, and let the weekly stress step fail #880, ci: give the 102 push workflows a dispatch-safe concurrency group #870, ci: run nine workflows once per PR commit, on every path their push run watched #876, ci: run the nine document gates on push to main only #867 and fix(gates): green doc-refs and orphan-artefacts on main after #510 #872 (git merge-tree, rc 0 each).
• After a cancel, ci(brain): skip the health report when the run itself was cancelled #882 keeps the report from running. Merge ci(brain): skip the health report when the run itself was cancelled #882 first, then this PR. This PR then keeps the gate from running too, so a cancelled run posts nothing and shows no red gate.

Not measured

• Whether detect-build has ever failed on a real run.
• This PR's own pull_request run, nothing forced: the report and the Merge Gate should both succeed. Pending.

🤖 Generated with Claude Code

[github-actions]

X Brain Health Check

Score: 100.0/100
Status: 🟢 HEALTHY
Threshold: 80/100

X Brain is above merge threshold

[github-actions]

🧪 Brain Stress Test Results

Score: not measured (no stress test prints a Score: line)
Status: 🟢 PASS
Threshold: 270/300

X Stress test passed

[gHashTag]

7fbeb9b renames the verdict bool and changes nothing else. detect_ok / != true becomes detect_failed / = true.

How it was found. I trial-merged the 18 open PRs that merge cleanly (speed mergeorder, using merge-tree and commit-tree only, no refs). Then I ran my workflow lint (speed wflint) on the merged tree. One of its rules is that every if must test a named bool in the form [ "$x" = true ]. Main has 175 findings. The merged tree had 176, and the extra one was this line in brain-ci.yml, which this PR added. The lint accepts only = true, so it flagged != true. The behaviour was already correct.

Check. I ran the old and new snippets under bash -e for each needs.detect-build.result value. Both give the same exit code for all five:

result	old	new	want
success	0	0	0
failure	1	1	1
cancelled	1	1	1
skipped	1	1	1
(empty)	1	1	1

After the fix the merged tree has 175 findings again, and comm -13 against main shows 0 new.

Not measured. I have not re-run the merge gate end to end on 7fbeb9b. This PR's checks are running now.

Refs #883, #851

🤖 Generated with Claude Code

[tri-claw]

Summary by t27-bees

The PR fixes two related CI logic bugs: the Merge Gate was implicitly guarded by success() so it only ran after a passing report (making its failure check unreachable), and the Brain Health Report treated a failed detect-build as "no root build.zig" instead of an error.

Worth a look

• .github/workflows/brain-ci.yml:517–527 – The new detect_failed block exits 1 when detect-build result is not success. If detect-build is cancelled (not failed), ${{ needs.detect-build.result }} equals "cancelled", so this will also fail the report. That may be intentional, but it differs from the prior "non-blocking" behavior for any non-success state.
• .github/workflows/brain-ci.yml:633 – The gate now runs when !cancelled() && github.event_name == 'pull_request'. If the workflow is cancelled mid-run, the gate is skipped (correct). However, if detect-build fails and the report fails (exit 1), the gate will run because the workflow isn't cancelled—this is the desired fix. Just confirm that needs: [brain-health-report] without an explicit result filter means the gate runs regardless of the report's conclusion (which is the point).
• .github/workflows/brain-ci.yml:521 – The summary message uses ${{ needs.detect-build.result }} directly in the string. If the result contains characters that break Markdown (unlikely for GitHub's fixed result strings), it could render oddly. Low risk.

---

_{Read: 1 files, +12 -1, the whole diff. Head 98da33e. Model: openai-compatible/nvidia/nemotron-3-ultra-550b-a55b. Commands: @t27-bees review | summary | help | pause | resume. Free for every repository.}