ci: reduce obsolete and known-red PR work and explain failures

[songoow]

Goal And Delivered Outcome

Known-red PRs continue occupying six long Python queues, while delayed runs created after a PR closes can escape obsolete-run cleanup. Aggregate failures also require manually finding upstream evidence, and Dashboard browser shards repeat unit coverage whose merger consumes only shard 1.

This proposal separates trusted CI Maintenance from qualification, retires delayed exact-closed-head runs, admits ordinary PRs to long Python queues only after checks succeeds, removes two duplicate Dashboard unit-coverage invocations, and adds current-attempt failed-job/step links to the existing merge-gate summary.

Author Declaration

• Written by: model_agent, OpenAI Codex.
• Specification: docs/development/ci-impact-selection.md and docs/development/testing-and-quality.md; integrated base 3a30359712940bf4df9ea719dd8d34b21d089ed6; S12 developer experience and validation cost.
• Latest source: 9f5d469bff3274c6d56c69eaf5cccf39d35b6b67; integrated suite at f4fd2951, followed by focused cleanup regression on the final patch.

Scope And Continuation

The existing Python gate remains the sole qualification owner. All six partitions, three Dashboard browser shards, coverage floors and required-success rules remain. Skipping long tests after failed prerequisites still fails pytest and merge-gate. The read-only TypeScript summary cannot waive failures.

Scheduling changes: all long Python shards wait for checks; ordinary PRs require success, while main, scheduled, manual and merge-queue runs retain complete Python diagnostics after failed checks when classification/bundle succeeded and the workflow is not cancelled. This saves work on known-red PRs under contention but increases serial latency for healthy idle runs. Manual runs retain full diagnostics for a failing PR branch. Global six-lane capacity and test/worker counts are unchanged.

Cleanup retains repository, branch, head/lifecycle and sibling-PR guards. When Actions omits a fork run's PR association, synchronize cleanup accepts only the webhook's exact before head after verifying after and event source identity against the current PR; other unassociated heads remain protected. Only exact-closed-head residue may cross the old close-time cutoff. Cleanup still needs a runner and can miss a run created after its snapshot. Its trusted trigger deploys from the default branch after merge; PR CI does not prove deployment.

Integrated #6501 from main without duplicating its cancellation policy. Its new cancellation expression exposed a Sonar boundary-fixture parser mismatch; the fixture now handles that expression while preserving negative guards. No product runtime or public UI changes relative to main.

Future-facing pass: reuse the existing aggregate and Python verdict owner, retain the shared coverage merger, and keep evidence rendering separate from decisions. No new scheduler or shared status protocol.

Validation

Kind	Result	Evidence / limitation
unit / regression_parity	passed	Node 24: pytest -q tests/test_python_ci_workflow.py tests/test_ci_resource_policy.py tests/test_sonarcloud_workflow.py scripts/ci/; 704 tests and 302 subtests on the integrated patch at f4fd2951
unit	passed	node --test scripts/ci/qualification_summary.test.ts scripts/ci/merge-dashboard-coverage.test.mjs; 8 tests
negative / admission	passed	Current workflow expression covers PR prerequisite failures, non-PR diagnostics, cancelled workflows, failed classification and exempt lanes; original gates reject skipped/missing partitions
negative / cleanup	passed	152 tests and 289 subtests for final cleanup/resource/Sonar boundaries; old logic fails the new cases. Delayed exact closed heads and verified synchronize before/after pairs retire; foreign, contradictory and changed/shared sources remain protected
static	passed	Changed Python Ruff, whitespace/public-boundary scans; strict TS checks of the unchanged renderer/test passed before main integration
hosted	incomplete	First-head run at 3ba9d3c6 passed Dashboard shards/coverage, TS shards/coverage, Windows, packaged browser and Stage2c lanes; full Python remained pending. This is not final-head qualification. Latest-head CI has started its queue and must pass separately.

Real Dashboard unit lcov was generated locally and by the first hosted head. The first hosted unit step took about 2 seconds, so deduplication is a small saving, not evidence of an overall speedup. A queue snapshot found four earlier PR runs with failed checks and six outstanding Python shards each. The current complete-run latency improvement remains unproven.

Frontend / Visual Evidence

UI impact: none. GitHub receives a text-only diagnostic summary.

Type of Change / LoopX Area

• Bug fix / CI maintenance
• Documentation and durable validation
• Build, packaging, installer, or CI

Boundary Checklist

• No credentials, private state, raw traces, internal links or local machine paths.
• Required failures remain blocking; skipped work is not passing evidence.
• Behavior change, healthy-run latency tradeoff and hosted gaps disclosed.
• Every PR-branch commit includes DCO sign-off.
• No merge or organization-plan change requested by this proposal.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @songoow.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; declaration_source=runtime_reported; reasoning_effort=xhigh.

动机

贡献者更新或关闭 PR 后，已经过期的测试仍可能占用执行资源；另一些 PR 在便宜的基础检查已经失败时，仍排队启动六组 Python 测试。维护者打开失败页面，也常先看到汇总失败，难以找到实际失败的步骤。这次改动让这三条路径各自有明确处理：过期任务由独立维护工作流清理，PR 的昂贵分组等基础检查通过再启动，失败页面附带当前运行次数对应的具体步骤。首个有用结果是减少明显无效的排队并改善排障入口；本次源码审查不声称已降低托管队列时间或费用。托管采用、持续运行和预算收益仍由既有 CI 效率验收保留，当前质量回执另有独立 hold。

改动思路

清理属于可信默认分支上的 GitHub 维护传输，判定资格继续由既有 Python gate 拥有；新增 TypeScript 只展示证据，不另建通过规则。当前 PR 边界是工作流排队顺序、受限旧运行清理和只读失败摘要，不改变六分组验收与豁免标准。仅增加摘要不能回收资源；只取消旧运行又不能阻止已知失败 PR 继续排队。因此这组改动围绕同一贡献者反馈循环，并保留各机制自己的失败边界。

有一个明确取舍：健康、空闲的 PR 需要先跑 checks，再启动 Python 分组，单次延迟可能增加。已接受的 docs/development/ci-impact-selection.md 以完整验收和不清理当前/同分支其它 PR 为边界，维护者现有 CI 效率方向支持减少无效执行；这里没有用作者的节约预期当作实测收益。非 PR 事件仍可在 checks 失败后获取完整测试诊断，取消事件仍停止后续执行，等待是 checks 的有限执行依赖。

具体改动

精确 head 9f5d469bff3274c6d56c69eaf5cccf39d35b6b67，immutable base 3a30359712940bf4df9ea719dd8d34b21d089ed6，完整十一文件 +613/-126，包含最后的 Sonar 工作流测试。先读 base 的 docs/development/ci-impact-selection.md 全文，再核对工作流、原 gate 和 coverage 合并消费者；scripts/ci/review_gate.py 与 base 逐字节相同。规范的 Six complete Python shards、Resource cadence and supersession、Qualification 三个章节中的完整六分组资格、文档/展示豁免和可信取消权限边界仍保留。

关键代码讲解

• cancel-obsolete-pr：从 Python Tests 移到独立的 pull_request_target 工作流，唯一脚本不 checkout PR。仍验证 PR 生命周期、最新 head、来源仓库/分支及同分支其它 open PR，普通取消和强制取消前都检查；延迟创建的关闭 head 可越过关闭时间截点，旧 head 不可。同步事件仅用与当前 after 匹配的 webhook before 作为无 PR 关联运行的补证，任意无关联 head 不会获准。
• test-shard：显式依赖 checks，条件包含 !cancelled()，避免 GitHub 隐式 success 条件误伤非 PR 的失败后诊断。只有 PR 增加 checks-success 前置，六分组、每组两 worker 和完整 coverage 合并要求保留。dashboard 的三个浏览器仍跑，unit coverage 只在第一分组生成一次；缺任一所需 coverage 仍拒绝。
• renderQualificationSummary：按 run/attempt 精确过滤，只把已知失败和未完成状态展示出来。聚合 job 名单只是展示分组，不定义豁免；空或不可用证据不能变成通过。步骤和 metadata 转为有界转义文本，链接来自已验证运行身份。它不修改 gate verdict。
• merge-gate：原 verify 步骤没有 continue-on-error；后置报告才是 always、限时一分钟、允许自身失败。只读 actions 权限获取当前 attempt，十秒超时或 API 不可用时明确保留原 verdict，不打印原始 provider 错误。两份文档同步披露来源分支生效边界、诊断回退与健康运行延迟取舍。

对主干的风险

主要风险是误取消当前/其它 PR 的运行、把 skipped 或旧 attempt 当作当前通过，以及为了节约执行而遗漏验收。独立运行实际 YAML 中的清理脚本，stub 仅替换 GitHub REST 传输：当前 head、fork、同分支其它 PR、reopen、取消前和 force 前状态变化、409、拒绝和取消后仍未终态等均保留检查。使用相同私有 harness 对 immutable base/head 执行两个新场景：关闭后延迟创建的 exact head，以及缺 PR 关联但 webhook before/after 完整的旧 head，base 均不取消，head 均只取消目标；矛盾 after 两侧都不取消。没有执行远程取消。

本次实际 704 Python tests、302 subtests 通过（31.45 秒），包括 200 个事件/状态组合、原 gate/分类/豁免规则、实际摘要 adapter+renderer、完整 dashboard coverage 消费者；另 8 个 Node tests 通过。配置内 mypy 19 文件、正确根项目 control-plane TSC、focused Ruff、DCO 和 diff hygiene 通过。开发语义 advisory 先于完整 semantic 检查；4 direct +19 selected/executed checks 全通过，0 check failure、0 manual hold。总 canary 仍 exit 1 / quality_receipt_missing：本地当前范围没有合格质量回执，未创建或伪造该资格。因此“源码审查通过”和“总预合并资格通过”分开保留。最初私有 TSC 命令选错项目目录，仅输出编译器帮助；改用仓库配置命令才得到本次通过证据。

托管 Actions 是否已经采用新的维护工作流、实际队列/费用效果和空闲延迟均未验证，也没有查询、等待或触发 CI。新增可信工作流要进入默认分支后才能依其事件规则使用；本地脚本 fixture 不能证明线上部署。权限仍仅维护 job 的 actions-write 与读取 PR，报告仅只读，不给予发布、合并或仓库内容写入权限。

我的整体评价

APPROVE，justified_increment。long_horizon improved：当前源码能有界回收两个已验证过期场景，且不会用缺失/跳过证据放宽下一次资格。user_experience accepted_tradeoff：排障定位更直接，已知失败 PR 不再启动昂贵分组，健康 PR 的串行等待成本明确披露；如托管实测不合适，可在原工作流依赖边界回滚，不能放松 gate。剩余托管采用、持续运行和预算收益由既有 CI 效率验收保留，当前质量回执仍需资格 owner 处理。

未来演进检查已关注资格判定与证据展示的相邻边界：清理从被取消的验收流中拆出，summary 复用原 verdict，既有 coverage merger 不新增平行规则。没有必要为两个 provider 脚本增加通用框架。清理属于可信默认分支上的 GitHub 维护传输，判定资格继续由既有 Python gate 拥有；新增 TypeScript 只展示证据，不另建通过规则。当前 PR 边界是工作流排队顺序、受限旧运行清理和只读失败摘要，不改变六分组验收与豁免标准。该结论只针对上述 exact head，不授予 merge/bypass，也不宣称已获得托管资格。

English verdict: APPROVE. The exact head preserves qualification rules while isolating trusted obsolete-run cleanup, avoiding known-red PR shard work and displaying attempt-bound diagnostics. Independent validation passed 704 Python tests, 302 subtests and 8 Node tests; base/head script controls distinguish both new cleanup cases without broadening foreign/current-head scope. All executed checks passed, but the overall premerge gate remains held by a missing local quality receipt. Hosted adoption, queue/cost benefit and idle latency remain unqualified.