-
Notifications
You must be signed in to change notification settings - Fork 0
Review 5635
#5635 ci: promote accepted visuals from main by cixzhang (bucket: the maintainer)
139291a447361636a066fa5c3e6888d4248b1cbb — every claim below was verified at this exact head. Its sole parent is approved #5631 head 29dafeba0e6cef644c36bd9e99725baa09259dfe, whose approved parent is #5629 head 88195bb8e6765f7fd10fd5abf7521e09d157bc42.
LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4
LANE: full WHY: this changes the privileged post-merge trigger, adds main-commit-to-PR discovery and a dynamic promotion matrix, moves status ownership to main, and dispatches release evidence; identity, queueing, failure, retry, and stack behavior require the full security and concurrency radius.
WHY 1: A pull-request close event can run from PR-shaped context after merge instead of beginning from the protected main commit that actually shipped. WHY 2: Promotion can then bind reviewed pixels or failures to the wrong source identity and leave maintainers without a trustworthy post-merge result. WHY 3: Visual acceptance is release evidence only when the reviewed PR head, the merged main commit, the accepted CI run, and the published baseline all refer to the same change.
USER-FACING PROBLEM: A maintainer merging an accepted visual change needs the exact protected-main commit to reproduce and publish those pixels, with a status and release-gate run that identify the same merge. PROBLEM SEVERITY: broken task — a missed or misbound promotion can leave the release baseline stale or make the wrong commit appear ready. NEW FEATURE CASE: not a product feature — this is maintainer-facing reliability work on the approved publication subsystem from #5629 and #5631. EARLY STOP: clear — the approved parent stack and prior recovery failures establish the need.
VERDICT: clear
A protected-main push identifies which merged pull requests produced each new main commit, then resolves each PR head and immutable acceptance record. Accepted candidates run one at a time through the existing shared publisher, recapture the exact main result, and publish success, deferral, or failure on that main commit. A successful publication dispatches a release-gate run carrying its source identity.
SOLUTION (3 decisions · 363 added / 240 removed production/config lines of 811 total changed lines)
- Replace normal PR-close promotion with protected-main push discovery while retaining one-PR manual recovery.
- Carry
{pr, headSha, mergeSha, mainSha, acceptance}through a serial matrix and revalidate immediately before the shared publisher mutates the baseline. - Project per-PR outcomes onto the exact main commit and add source metadata to the release-gate report.
BURDEN: high — two event paths, an inline GitHub API resolver, a dynamic matrix, privileged status/workflow dispatch, one additive report schema, and shared-queue publication with retry and cleanup. BURDEN MATCH: proportionate for the cross-workflow identity problem, but its central automatic candidate selector lacks an executable regression boundary and the direct helper contract test is red.
VERDICT: BLOCKS — the new main-push identity route is not protected by a passing executable contract.
OWNER: the promotion workflow owns post-merge source resolution and status; the approved shared publisher owns every mutation this path makes to gh-pages.
TIER 1: the approved #5629/#5631 queue, immutable acceptance record, CI-attempt resolver, and baseline publisher.
TIER 2: none.
SEAMS: squash/rebase merges, multi-commit main pushes, manual recovery, active CI retries, concurrent promotion runs, idempotent repeat dispatch, cleanup races, release-gate publication, and terminal queue cleanup.
BEHAVIOR UNIT: inline workflow script plus promotion-identity.mjs utility — downstream identity validation is unit-tested, but automatic main-commit candidate selection remains embedded in YAML and unexecuted.
COMPLEXITY BUDGET: one candidate resolver, one immutable promotion item schema, one publisher owner, two trusted event paths, and one status context per promoted PR.
ACTUAL BURDEN: 5 changed files; 363 added / 240 removed production/config lines; 124 added / 84 removed test lines; 2 workflows; 1 extended identity helper; 1 additive release-report projection; 94 relevant focused tests, with 1 direct contract failure.
BURDEN TREND: approved parent 29dafeba → current 139291a4: the publication owner and durable acceptance/queue schemas remain flat; one main-promotion resolver, matrix projection, and release-source projection are added for the new trigger.
RESET TRIGGER: not triggered — this is the first review of this PR and the runtime model still has one acceptance source and one publication owner; the block is the missing testable boundary for its new resolver.
| domain fact | one authoritative writable source | generated / immutable projections | other writable copies |
|---|---|---|---|
| merged PR/head/main identity | GitHub PR and commit APIs, validated by resolvePullRequestIdentity
|
immutable matrix item and status target | none |
| accepted evidence identity | immutable acceptance record plus current.json pointer |
record_rel carried into the matrix and revalidated |
none |
| baseline publication order | shared publisher tickets and holder | inherited legacy compatibility projection from the approved parent | none added here |
| release provenance | successful promotion dispatch inputs | additive source object in release-gate.json
|
no public-repository consumer currently treats it as authority |
| seam | driven result |
|---|---|
| live squash-merge lookup | three landed main commits each resolve to the PR whose merge_commit_sha exactly matches — pass |
| wrong main identity | helper rejects a PR whose merge SHA differs from the supplied main SHA — pass |
| immutable acceptance / latest CI | focused tests reject stale pointers, wrong heads/runs, tampered pixels, and superseded CI — pass |
| cleanup race / retry | local bare-remote workflow test survives preview cleanup winning the first push race — pass |
| repeat recovery | repeated promotion records one baseline decision — pass |
| shared publication | all changed promotion/report mutations call the shared publisher; no changed workflow contains a direct git push — pass |
| automatic candidate selection | invert the exact merge_commit_sha filter so the real merged PR is skipped; 29/29 workflow tests remain green — BLOCKS |
| direct identity contract | unchanged promotion-identity.test.mjs expects no mainSha; exact head returns it and fails 1 of 48 tests — BLOCKS |
VERDICT: BLOCKS — the automatic source-discovery owner can silently stop emitting promotions while every workflow-level test stays green.
At this exact implementation, live GitHub data for three squash-merged main commits matches the intended PR/main identity, and accepted publication remains serialized, retried, idempotent, and terminally cleaned by the approved publisher. But a future one-character regression in the new candidate filter can make a maintainer merge an accepted visual PR and receive no baseline update, no main status, and no release-gate dispatch while the focused workflow suite stays green. NEW FEATURE IMPACT: not a product feature — maintainers gain main-bound release evidence only if this new discovery boundary remains protected.
VERDICT: BLOCKS — the defining automatic path is currently regression-silent.
No package or consumer API changes.
| change | public? | class | doc’d? | verdict | |
|---|---|---|---|---|---|
~ |
promotion item adds mainSha beside PR/head/merge identity |
no — repository workflow contract | existing recovery identity | workflow/test call sites | direct contract test red |
+ |
release dispatch inputs source, source_pr, source_main_sha
|
no — repository workflow contract | release provenance | workflow descriptions | clear |
+ |
additive source object in release-gate.json
|
public build artifact, not package API | release report metadata | producer only | clear; current release preflight ignores it |
OSSIFICATION: these schemas are repository automation contracts rather than installed surface. Existing release-gate fields and parent acceptance/publisher schemas remain unchanged; the new source object is additive.
VERDICT: note — schema compatibility is preserved, but the changed helper return contract has an unchanged failing direct test.
No CSS, tokens, theme targets, rendered elements, or style contracts change.
VERDICT: clear
BEHAVIOR: normal promotion intentionally moves from merged-PR close to protected-main push; one-PR manual recovery remains, accepted records are revalidated after queueing, and success/failure moves from the contributor head to the exact main commit. API: no installed-consumer API change; internal workflow/report additions are additive. VISUAL: no rendered UI, story, CSS, or DOM path changes. THEME: no theme change.
VERDICT: clear — the intended event/status behavior changes are explicit and compatible with the approved parent schemas.
EFFECTS: zero React Effects. RENDER: no application render path changes. LISTENERS/OBSERVERS: none. LAYOUT: none. BUNDLE: no dependency or package change. CI cost: each protected-main push performs one associated-PR lookup per unique pushed SHA; accepted candidates run serially with a 90-minute per-job bound and the publisher’s bounded wait/retry loops.
VERDICT: clear — CI work scales with pushed commits and accepted candidates; application runtime is unchanged.
VISUAL CHECK: not applicable WHY: all five changed paths are workflow YAML, a Node identity helper, or Node tests; no UI, CSS, markup, story, or rendered component path changes.
VERDICT: clear
REMEDY SEARCH: not triggered — no proven visual defect
No rendered element, interaction, role, accessible string, locale formatting, or direction-sensitive path changes.
VERDICT: clear
| slot | verdict |
|---|---|
| PROBLEM | clear |
| SOLUTION | BLOCKS — the new source-identity path lacks a passing executable contract |
| ARCHITECTURE | BLOCKS — automatic candidate selection is inline and mutation-silent |
| IMPACT | BLOCKS — the whole post-merge path can disappear under green workflow tests |
| API | note — additive internal schema; direct helper test is stale/red |
| THEMING | clear |
| BREAKING | clear |
| PERFORMANCE | clear |
| VISUAL | clear — not applicable |
| A11Y & I18N | clear — not applicable |
GOAL: partly met — current code resolves three live squash merges correctly and 93/94 relevant focused tests pass, but the one direct helper test fails and the automatic exact-match selector survives an inverted filter with 29/29 workflow tests green.
DISPOSITION: executable coverage for automatic candidate discovery → blocks now; stale direct helper expectation → blocks now; Prettier failures in two changed files → blocks now; absent substantive exact-head Actions CI → post-parent-landing landing gate, separate from the code verdict.
ADVICE: bounded outcome criteria — the checked-in suite must execute main-push candidate discovery and fail when exact-match filtering, squash/rebase identity, or multi-commit selection is broken; the direct helper contract and formatting must be green.
AUTHOR CAN PROCEED: yes — add that executable boundary, update the expected mainSha contract, format the two files, and rerun the same focused checks.
WORST OUTCOME: “A maintainer merges an accepted visual PR and receives no baseline update, no main status, and no release-gate dispatch while focused tests stay green.” → request changes.
JUDGEMENT NEEDED: none — this is deterministic workflow verification, not an API or design decision.
request changes (self-authored semantic COMMENT; no merge or auto-merge)
- Main-push candidate discovery is not executed by the focused suite.
→ a future filter regression can silently skip every post-merge publication while tests stay green ·
.github/workflows/visual-acceptance-promote.yml:119
Semantic verdict: request changes
Thanks — moving promotion onto protected main and keeping publication behind the shared owner looks right.
The new main-commit candidate resolver has no executable test boundary. I inverted its exact merge_commit_sha filter so the merged PR is silently skipped; all 29 workflow tests still passed, meaning accepted pixels, main status, and the release-gate dispatch can all disappear under green focused tests. The direct identity test is also red because mainSha changed its return contract, and Prettier is red in two changed files.
Could we exercise squash/rebase and multi-commit push selection through the real resolver, update the direct contract test, and format the changed files?
[Reviewed by Robohands]
None — the finding spans inline main-push discovery and its absent executable boundary.
- The exact implementation’s GitHub API lookup returned exact PR/merge pairs for three recent main squash commits.
- Publisher, workflow-concurrency, and promotion-workflow suites pass 46/46; the independent direct identity suite is 47/48 because its expected return shape omits
mainSha. - Four inherited preview/vibe workflows still contain direct
gh-pagespushes, but none is changed or called by this PR; every mutation in this delta routes through the approved shared publisher.
TIME total 16m
- setup/rules: 5m — loop 1.9.1, official audit 1.14.4, parent review rounds, feedback, exact stack, and untrusted-code preflight
- worktree/install: 1m — dedicated detached exact-head worktree; lockfile-matched install with lifecycle scripts disabled
- build/server: 0m — not applicable
- browser/a11y: 0m — non-rendering change
- focused tests/checks: 4m — 94 relevant tests, actionlint, syntax, Prettier, diff-check, and
check:repo - code/history/probes: 4m — source identity, live merge lookups, shared publisher, retry/idempotency/cleanup, permissions, direct-writer census, and one mutation
- critique/wiki/delivery: 2m — presentation, critic pass, exact-head recheck, COMMENT, record/index update, and readback
- CI wait: 0m — no substantive Actions workflow exists for this stacked exact head
- waste: 1m — one formatter-diff attempt ran outside the repository config and was discarded
- A live post-merge promotion was not dispatched because it would mutate shared
gh-pagesand run the release gate. - Substantive exact-head GitHub Actions CI has not run on this stacked draft.
At exact head 139291a447361636a066fa5c3e6888d4248b1cbb, Meta CLA, Vercel Preview Comments, and Vercel are green. Delivery triggered Review signal run 33168074223; both jobs skipped, so no substantive Actions workflow ran. Code review requests changes independently. After the finding is fixed, #5629 and #5631 must land before substantive exact-head Actions CI can run; that CI must pass before landing. No merge or auto-merge was requested.
- Exact suites: publisher/workflow tests 46/46 pass; direct identity tests 47/48 pass, with the failure at
promotion-identity.test.mjs:90becausemainShais newly returned. - Mutation: changing
pull.merge_commit_sha !== mainShato===leaves 29/29 workflow tests green while suppressing the real merged candidate. - Formatting: repository-configured Prettier fails on
promotion-identity.mjsandvisual-promotion-workflow.test.mjs; its exact rewrite is 47 diff lines. - Other checks: actionlint passes both changed workflows; all 3 changed Node files pass
node --check;git diff --checkandpnpm check:repopass. - Publication/security: automatic and manual paths use trusted main code, validate PR/head/main/acceptance/CI identity, serialize candidates with
max-parallel: 1, revalidate after enqueue, and publish only through the shared queue. Permissions are scoped to read-only resolution and actions/contents/status writes in the promotion job. No changed path adds a directgh-pageswriter or shell-expands untrusted PR data. - Exact CI: one skipped Review signal run with both jobs skipped; 2 green check runs and 1 green Vercel commit status only.
Posted as drafted after one critic pass.
GitHub review: https://github.com/facebook/astryx/pull/5635#pullrequestreview-5050734762
#5636 is not code-review-safe to start while this parent has a red direct test and an unprotected automatic candidate resolver. It was not inspected, started, or touched.
#5635 ci: promote accepted visuals from main by cixzhang (bucket: the maintainer)
df65ecdd4b44e9565c3a7108d081e6facdfc09f7 — every claim below was verified at this exact head. Its sole parent is approved #5631 head 29dafeba0e6cef644c36bd9e99725baa09259dfe, whose sole parent is approved #5629 head 88195bb8e6765f7fd10fd5abf7521e09d157bc42.
LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4
LANE: full WHY: this is a delta re-review of the defining main-candidate boundary in a privileged post-merge workflow, with explicit mutation, ancestry, status, publisher, formatting, parent, and CI obligations.
WHY 1: A protected-main push must select only the merged pull request whose server-resolved merge commit equals each trusted main commit. WHY 2: A wrong or missing filter can skip accepted pixels, promote the wrong identity, or make the entire post-merge path disappear while ordinary workflow tests remain green. WHY 3: Visual acceptance is release evidence only when the reviewed PR head, merged main commit, immutable acceptance, published baseline, status, and release-gate dispatch identify the same change.
USER-FACING PROBLEM: A maintainer merging an accepted visual change needs the exact protected-main commit to select the exact merged PR and either promote that acceptance or fail closed. PROBLEM SEVERITY: broken task — a silent candidate-selection regression can suppress baseline publication and its release evidence. NEW FEATURE CASE: not a product feature — this is maintainer-facing reliability work on the approved publication subsystem from #5629 and #5631. EARLY STOP: clear — the approved parent stack and prior exact-head mutation establish the need.
VERDICT: clear
The main-push candidate logic is moved out of inline workflow code into one dependency-injected identity resolver. Its tests mix pushed main commits, associated PR summaries, full PR identities, PR heads, exact merge commits, stale identities, and manual reachability, so candidate choice and refusal behavior execute directly. The workflow supplies GitHub API readers while the acceptance, publisher, status, and release paths remain unchanged.
SOLUTION (1 delta decision · 155 added / 77 removed production/config lines of 286 added / 86 removed total)
- Extract main-push/manual candidate resolution into the identity behavior unit and add direct mixed-identity regression cases.
BURDEN: medium — one exported asynchronous resolver with injected GitHub readers, six direct candidate cases, and no new durable state, workflow, permission, or publication owner. BURDEN MATCH: proportionate — the extraction makes the previously untestable defining filter executable without changing downstream mutation or status semantics.
The prior review asked for direct mixed push/PR/main candidate coverage, a current return-contract update, and clean formatting. This head provides all three; both required filter mutants are non-green.
VERDICT: clear
OWNER: resolveMainPromotionCandidates owns automatic and manual candidate selection; the workflow owns GitHub API wiring; the approved shared publisher still owns every gh-pages mutation.
TIER 1: GitHub commit/PR identity, resolvePullRequestIdentity, immutable acceptance validation, and the approved #5629/#5631 publisher.
TIER 2: none.
SEAMS: squash/rebase identity, multi-commit pushes, duplicate after, no associated PR, stale/unrelated association, multiple exact candidates, manual recovery, and unreachable merge.
BEHAVIOR UNIT: pure async utility — GitHub readers are injected and all candidate outcomes execute directly in promotion-identity.test.mjs.
COMPLEXITY BUDGET: one candidate resolver, one immutable promotion-item identity, one publisher owner, two trusted event paths, and no additional status or queue model.
ACTUAL BURDEN: 5 delta files; 155 added / 77 removed production/config lines; 131 added / 9 removed test lines; 1 extracted resolver; 6 candidate cases; 100 focused tests total.
BURDEN TREND: prior reviewed 139291a4 → current df65ecdd: runtime ownership contracts flat; candidate logic moves from inline workflow code into the existing identity module and direct test coverage grows.
RESET TRIGGER: not triggered — the fix creates a test boundary rather than another identity source, owner, representation, or guard.
| domain fact | one authoritative writable source | generated / immutable projections | other writable copies |
|---|---|---|---|
| pushed main identity | trusted push payload commit ids plus after
|
deduplicated candidate scan | none |
| merged PR/head/main identity | GitHub PR response validated by resolvePullRequestIdentity
|
immutable promotion matrix item | none |
| accepted evidence identity | immutable acceptance record plus current pointer |
record_rel carried into the matrix and revalidated |
none |
| baseline publication order | approved shared publisher queue/holder | inherited legacy compatibility projection | none added here |
| seam | driven result |
|---|---|
| mixed multi-commit push | exact PRs 42 and 43 are selected for their matching main commits; stale/unrelated PRs 40 and 41 are excluded — pass |
| no associated PR | returns no candidates and performs no promotion — pass |
| multiple exact PRs | rejects with multiple-main-candidates — pass |
| stale/unreachable manual merge | rejects because the merge is not reachable from main — pass |
| unrelated main commit with stale associated PR | returns no candidates — pass |
| inverted exact-match filter | candidate suite becomes 3 failed / 3 passed — killed |
| omitted exact-match filter | candidate suite becomes 2 failed / 4 passed — killed |
| restored exact head | candidate suite returns to 6/6; full focused suite is 100/100 — pass |
| publisher behavior | both publisher entrypoint/module blobs are byte-identical to prior head; 17/17 publisher tests pass — unchanged |
| main-status/finalization behavior | workflow suffix from immutable acceptance through status finalization and promotionStatusProjection are byte-identical to prior head — unchanged |
VERDICT: clear
The prior regression-silent boundary is now executable. A maintainer’s mixed main push selects only exact merge identities, while no, stale, unrelated, multiple, and unreachable cases remain non-mutating or rejected as appropriate. Inverting or deleting the exact filter makes the checked-in suite fail before publication. NEW FEATURE IMPACT: not a product feature — maintainers retain main-bound promotion with a regression boundary around its defining source selection.
VERDICT: clear
No package or consumer API changes.
| change | public? | class | doc’d? | verdict | |
|---|---|---|---|---|---|
+ |
exported resolveMainPromotionCandidates({...readers})
|
no — repository workflow module | existing promotion identity | direct tests and workflow caller | clear |
~ |
resolvePullRequestIdentity() expected result includes mainSha
|
no — repository workflow contract | existing promotion identity | direct expectation updated | clear |
OSSIFICATION: installed consumers cannot depend on these repository automation helpers. Candidate identity still derives from GitHub and feeds the existing immutable matrix schema.
VERDICT: clear
No CSS, token, theme target, rendered element, or style contract changes.
VERDICT: clear
BEHAVIOR: candidate resolution moves behind a direct utility boundary without changing its exact-match, deduplication, manual recovery, acceptance, publisher, status, or release semantics. API: no installed-consumer API change; one repository-internal helper is exported for the workflow and tests. VISUAL: no UI, CSS, DOM, story, or rendered path changes. THEME: no theme change.
VERDICT: clear
EFFECTS: zero React Effects. RENDER: no application render path changes. LISTENERS/OBSERVERS: none. LAYOUT: none. BUNDLE: no dependency or package change. CI cost: candidate unit coverage adds six in-process tests; the production GitHub request pattern is unchanged from the prior reviewed head.
VERDICT: clear
VISUAL CHECK: not applicable WHY: all five delta paths are workflow YAML, a Node identity helper, or Node tests; no UI, CSS, markup, story, or rendered component path changes.
VERDICT: clear
REMEDY SEARCH: not triggered — no proven visual defect
No rendered element, interaction, role, accessible string, locale formatting, or direction-sensitive behavior changes.
VERDICT: clear
| slot | verdict |
|---|---|
| PROBLEM | clear |
| SOLUTION | clear — the prior executable-boundary, contract, and formatting asks are satisfied |
| ARCHITECTURE | clear — one identity owner with direct mixed-candidate tests |
| IMPACT | clear |
| API | clear — repository-internal extraction only |
| THEMING | clear |
| BREAKING | clear |
| PERFORMANCE | clear |
| VISUAL | clear — not applicable |
| A11Y & I18N | clear — not applicable |
GOAL: met — clean focused tests pass 100/100; candidate cases pass 6/6; inverted and omitted exact-match filters fail 3 and 2 candidate tests respectively; Prettier and every requested repository check are green.
DISPOSITION: prior unexecuted candidate resolver → resolved; stale direct mainSha expectation → resolved; two Prettier failures → resolved; substantive exact-head Actions CI → post-parent landing gate, separate from code approval.
ADVICE: omitted — no code or evidence change remains from this review.
AUTHOR CAN PROCEED: yes — code review is clear; landing waits for #5629, then #5631, then substantive exact-head CI.
WORST OUTCOME: none found at the reviewed head → approve.
JUDGEMENT NEEDED: none — the required identity, mutation, formatting, parent, and unchanged-semantics evidence is complete.
approve (self-authored semantic COMMENT; no merge or auto-merge)
Semantic verdict: approve
At df65ecdd, prior candidate discovery is covered: mixed ancestry passes; inverted and omitted filters fail; 100 focused tests and formatting are green. Landing waits for #5629 → #5631 and exact-head CI.
[Reviewed by Robohands]
None.
- The direct candidate fixture includes two exact main/PR pairs, two stale mismatches, one unrelated main commit, a duplicate
after, and separate no/multiple/unreachable cases. - Current
mainhas not changed any PR-touched file since the prior review. - Parent heads remain exactly
88195bb8→29dafeba→df65ecdd; no successor PR was inspected or started.
TIME total 11m
- setup/rules: 3m — loop 1.9.1, official audit 1.14.4, prior round, approved parent records, exact stack, and preflight
- worktree/install: 1m — dedicated detached exact-head worktree and lockfile-matched dependency clone/reconcile
- build/server: 0m — not applicable
- browser/a11y: 0m — non-rendering change
- focused tests/checks: 2m — 100 focused tests, 6 candidate cases, actionlint, four syntax checks, Prettier, diff-check, and
check:repo - code/history/mutations: 2m — prior-head delta, main movement, exact ancestry, two filter mutants, and publisher/status identity
- critique/wiki/delivery: 3m — presentation, critic pass, exact-head recheck, COMMENT, record/index update, and readback
- CI wait: 0m — no substantive Actions workflow exists for this stacked exact head
- waste: 1m — two local harness command corrections; no product evidence was rerun
- A live post-merge promotion was not dispatched because it would mutate shared
gh-pagesand run the release gate. - Substantive exact-head GitHub Actions CI cannot run on this stacked draft until its parents land.
At exact head df65ecdd4b44e9565c3a7108d081e6facdfc09f7, Meta CLA, Vercel Preview Comments, and Vercel are green. GitHub reports zero Actions workflow runs for this head, so the code verdict is approve while landing remains separately gated on #5629 → #5631 → substantive exact-head CI. No merge or auto-merge was requested.
- Clean exact-head suite: 4 files / 100 tests passed in 57.60s; candidate-discovery subset 6/6 before and after mutation restoration.
- Candidate coverage: exact mixed push candidates selected; no association yields no mutation; stale/unrelated associations are excluded; multiple exact candidates and unreachable manual recovery reject.
- Inverted filter mutant: 3 failed / 3 passed — exact selection, unrelated/stale exclusion, and multiple-candidate refusal each fail.
- Omitted filter mutant: 2 failed / 4 passed — exact mixed selection and unrelated/stale exclusion each fail.
- Unchanged semantics: both publisher blobs, the workflow from immutable acceptance through status finalization, and
promotionStatusProjectionare byte-identical to the prior reviewed head; publisher/status tests remain green. - Repository checks: actionlint passes both changed workflows; all four changed Node files pass
node --check; Prettier passes all six changed files;git diff --checkandpnpm check:repopass. - Exact ancestry: #5635
df65ecdd→ approved #563129dafeba→ approved #562988195bb8.
Posted as drafted after one critic pass.
GitHub review: https://github.com/facebook/astryx/pull/5635#pullrequestreview-5050863099
#5636 is code-review-safe to start from this parent verdict, but not landing-safe until the parent order and exact-head CI gates clear. It was not inspected, started, or touched.