fix(ci): add the external_id-scoped stranded-run sweep to the 4 fork reviewer lanes

[dwu96]

Fixes #3447

PR #3436 hardened three things inside the new first-principles lane only; the sibling reviewer lanes kept the un-hardened shape. Issue #3447 records the deferral. All three defects are now resolved: defect 3 landed via #3854 and defect 2 via #3855 (both mid-flight of this PR, adopted via rebase and dropped from this diff); this PR carries the remaining piece — defect 1's second half, stacking on the merged #3856.

What this ships (defect 1, second half)

#3856 landed the complete() finalize retry in the 4 fork lanes; this adds the rest of the reference implementation from fork-first-principles-review.yml:

• external_id="<lane>-pr-$PR" at check-run creation (design-pr-$PR, gpt-pr-$PR, opus-pr-$PR, ux-pr-$PR). None of the four lanes set one before (the issue's "reuse each lane's existing external_id" was not executable as written — verified against the checkout).
• complete() refactored to take the check-run id as $1 — byte-identical to the reference except the lane name in output[title] (per-lane $summary is assigned outside the helper).
• The stranded-run sweep: finalize lists still-incomplete check-runs of the lane's name on the head and completes only those with this PR's external_id — a run stranded by a previous workflow run (or by both PATCH attempts failing) can no longer wedge pr-readiness at checking, and a sibling PR sharing the head commit is never touched.
• Sweep conclusions (shaped by this PR's own review cycle — Design and GPT lane findings, both adopted): stranded runs complete with the CURRENT run's computed $conclusion/$title, not a hardcoded one. A hardcoded failure would permanently outvote a genuine green re-run under pr-readiness's fail-precedence; a hardcoded neutral would launder a genuine BLOCK whose own PATCH lost both attempts into a verdict pr-readiness no longer gates on. With no verdict, $conclusion already degrades to each lane's incomplete posture (failure for the fail-closed GPT/Opus lanes, neutral for the advisory Design/UX lanes). This deliberately diverges from the reference, which sweeps to hardcoded neutral and carries the same latent issue — tracked as fork-first-principles-review.yml sweep completes stranded runs as hardcoded neutral #5949 (the dispatching spec pinned the reference lanes as unmodifiable for this change).
• Sweep guarded by [ -n "${HEAD:-}" ] && [ -n "${PR:-}" ], so the workflow_run.head_sha fallback path (where steps.pr never ran) skips it instead of tripping set -u.

Tests

TestForkLaneStrandedRunSweeps in test/test_ai_review_workflows.py (red-before verified): external_id at creation, sweep presence, external_id scoping, ${PR:-} guard, and unscoped-sweep absence, per lane.

Verification

• YAML parse + bash -n of every run: block in all 4 touched workflows: clean.
• complete() diffed against the reference: only the lane name differs.
• Full backend suite (earlier heads): failure set byte-identical to an origin/main worktree baseline. Workflow test files: 212 passed on the final head. black gate (ratchet), isort, flake8: pass.

What could not be verified without a real fork PR: a PR modifying .github/workflows/ does not exercise the modified workflows on its own runs — CI green here is NOT evidence the runtime behavior works. The sweep's live behavior (listing and completing a genuinely stranded check-run) is verified statically and by the ported reference's production record only.

Relation to sibling PRs / out of scope

• fix(ci): retry the fork lanes' check-run finalize instead of stranding it #3856 (merged): defect 1's retry half; this PR stacks the deferred sweep on top.
• fix(ci): require the current-head marker before honouring an advisory verdict #3855 (merged mid-flight): defect 2 (marker verification) — adopted via rebase, my parallel implementation dropped in its favor.
• fix(ci): stop the UX scope gate misreading a wide diff as not-UI-relevant #3854 (merged mid-flight): defect 3 (here-string scope gates) — same.
• fork-first-principles-review.yml sweep completes stranded runs as hardcoded neutral #5949 (filed from this PR's review cycle): the reference lane's own hardcoded-neutral sweep.
• fork-pr-description.yml carries a similar bare PATCH … || true, but is not a reviewer lane — observed, deliberately not widened into this diff (it already sets its own external_id).

[dwu96]

Rebased onto main after #3854 merged mid-flight: defect 3 (UX scope-gate here-strings) is now main's — my workflow hunks and test class for it were dropped in favor of #3854's identical fix and stronger wide-diff tests. This PR now carries defects 1 (external_id + stranded-run sweep, 4 fork lanes) and 2 (current-head marker verification, 4 advisory lanes) only. Head: 7187874. All local gates re-run green (211 workflow tests, YAML+bash -n on all 6 lanes, black/isort/flake8).

[github-actions]

GPT 5.6 Review — ✅ no blocking findings

GPT 5.6 completed its review of 56ccaa6bdcade964859d9f2bd09215f3bfdd6473 and found no blocking issues.

This comment is updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] 56ccaa6

False positive or not applicable? A repository writer can comment:
/ai-review override gpt 56ccaa6bdcade964859d9f2bd09215f3bfdd6473: <one-sentence reason>

[github-actions]

First Principles Review (Fable 5) — ✅ PASS

Premise-level review of 56ccaa6bdcade964859d9f2bd09215f3bfdd6473 — why this exists and whether the shipped surface is the smallest honest version. Updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

I've verified everything I need. The harm is derived and nameable (pr-readiness.yml:474 counts any non-completed check-run as pending, so a doubly-failed PATCH wedges the PR forever); the sweep is the reference lane's own mechanism ported, the one divergence (computed verdict vs. hardcoded neutral) is declared and tracked, and the two other check-run-posting workflows are either windowless (fork-workflow-guard.yml posts status=completed one-shot) or declared out of scope with their own external_id (fork-pr-description.yml). One dead test-fixture column is the only subtraction. Final review:

First-Principles-Verdict: PASS

Ports the reference lane's stranded-run sweep to the four sibling lanes, closing a nameable wedge; every item is derived, declared, and cause-level.

What this change ships

Intent: stop a transiently-failed finalize from wedging pr-readiness at checking forever on the four fork reviewer lanes — a FIX (issue #3447, defect 1's second half).

1. Each lane's check-run is created tagged with its PR number (<lane>-pr-$PR) — justified (the sweep's only safe match key).
2. Finalize now completes any still-incomplete run this PR created — justified, cause-level: pr-readiness.yml:474 counts any non-completed run as pending, and the merged retry (fix(ci): retry the fork lanes' check-run finalize instead of stranding it #3856) cannot reach a run stranded by a previous workflow run; the sweep makes the wedge unreachable.
3. Stranded runs get the current run's computed verdict, not the reference's hardcoded neutral — declared divergence, deferred sibling tracked (fork-first-principles-review.yml sweep completes stranded runs as hardcoded neutral #5949, reference pinned unmodifiable).
4. complete() takes the check-run id as $1 — justified enabler; realigns with the reference.
5. Sweep skips when PR/HEAD unresolved (workflow_run fallback) — justified (set -u).
6. Tests pin external_id, sweep presence, and scoping per lane — justified.

Sibling count: I grepped method POST "repos/$REPO/check-runs" across .github/workflows/ — 14 sites in 7 files. The two non-lane files have no stranding window (fork-workflow-guard.yml posts status="completed" one-shot at all 3 sites) or are declared out of scope with their own external_id (fork-pr-description.yml:276). Zero undeclared unfixed siblings.

Subtractions

• Drop the unused check_name column from FORK_SWEEP_LANES (test/test_ai_review_workflows.py:1282) — no test body reads it (0 uses; grepped the three test bodies).

[FIRST-PRINCIPLES-REVIEWED] 56ccaa6

[github-actions]

Design Review (Fable 5) — ✅ PASS

Design-level review of 56ccaa6bdcade964859d9f2bd09215f3bfdd6473 — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

Design-Verdict: PASS

Faithful port of a production-proven sweep, correctly external_id-scoped against sibling-PR heads, with the verdict-preserving divergence from the reference well-argued and tracked (#5949).

Watch

• Runs stranded before this merge have no external_id, so the sweep can never match them — any PR currently wedged at checking stays wedged even after a re-run and needs a one-time manual PATCH. Worth noting in Three reviewer-lane defects fixed only in the new first-principles lane #3447 when closing it.

[DESIGN-REVIEWED] 56ccaa6

[dwu96]

Design Review CONCERNS — disposition (adopted, fixed in 740cd74):

The Watch item is correct and the suggestion was applied verbatim. In the fail-closed lanes the sweep now completes a stranded run with the current run's computed $conclusion/$title instead of a hardcoded failure: the stranded run's external_id already proves it belongs to this PR and head, the current run is the authoritative review of that exact diff, and pr-readiness's fail-precedence collapse would otherwise let the stamped failure permanently outvote a genuine green re-run. Fail-closed posture is unchanged — with no verdict, $conclusion is already failure/"review incomplete". Advisory lanes keep the reference's neutral sweep (neutral does not outvote under fail-precedence, and it stays byte-faithful to fork-first-principles-review.yml).

Verified: YAML + bash -n on both lanes, 211 workflow ratchet tests green, black/isort/flake8 pass.

[github-actions]

UX Review (Fable 5) — ⏭️ skipped

Revision 56ccaa6bdcade964859d9f2bd09215f3bfdd6473 touches no user-facing surface (no changes under website/ or committed screenshots), so the UX review was skipped. Advisory — does not block merge.

[github-actions]

Opus 4.8 Review — ✅ no blocking findings

Reviewed 56ccaa6bdcade964859d9f2bd09215f3bfdd6473 — this comment is updated in place on each push.

Review details

No findings.

[OPUS-REVIEWED] 56ccaa6

Verdict parsed from the review's SHA-scoped output markers for commit 56ccaa6bdcade964859d9f2bd09215f3bfdd6473.

False positive or not applicable? A repository writer can comment:
/ai-review override fable 56ccaa6bdcade964859d9f2bd09215f3bfdd6473: <one-sentence reason>

[dwu96]

GPT BLOCK-MERGE on 740cd74 — disposition (stale-base contamination, rebased):

The blocking finding targets src/kiro_crew/dashboard/part_stream.py, which this PR does not touch — the diff is 6 workflow files + 1 test file (git diff origin/main...HEAD --name-only). That file was last modified by the already-merged #5704 (video attachments), and the UX lane's same-round comment likewise described #5704's composer surfaces. The lanes reviewed a diff contaminated with ~10 commits that merged to main after this branch's old merge-base: the finding belongs to merged main, not to this PR. A re-run of the lane reproduced it identically, confirming determinism rather than model noise.

Rebased onto current main (740cd74 → f515d9f, patch unchanged) to refresh the merge-base; fresh lanes will review the true diff. 211 workflow ratchet tests green post-rebase.

[dwu96]

GPT BLOCK on f515d9f — disposition (adopted, fixed in 13a2dd4):

Legitimate finding, and symmetric to the Design lane's earlier one: in the two advisory lanes the sweep completed a stranded run as hardcoded neutral, so a genuine BLOCK whose own PATCH lost both attempts would be swept into a verdict pr-readiness no longer gates on. Fixed by passing the current run's computed $conclusion/$title, as suggested — all four fork lanes now share one sweep shape (with no verdict, $conclusion degrades to each lane's incomplete posture: neutral for advisory, failure for fail-closed).

Noted: the reference fork-first-principles-review.yml sweeps to neutral and carries this same latent issue; modifying the reference is explicitly out of this PR's scope (#3447), so it is flagged in the PR body as an observed sibling instead of widening the diff.

Verified: YAML + bash -n on both lanes, 211 workflow ratchet tests green.

[dwu96]

First Principles CONCERNS — per-concern dispositions:

1. Reference lane's own sweep still hardcodes neutral (fork-first-principles-review.yml:679) — agreed on the substance: the reference now lags its four ported siblings, and the fix is one line. Not folded into this PR because the dispatching spec for Three reviewer-lane defects fixed only in the new first-principles lane #3447 explicitly pins both first-principles lanes as the unmodifiable reference ("Do not modify … they are the reference"), and silently widening a reviewed diff past its spec is the wrong side of that trade this late in the cycle. Filed as fork-first-principles-review.yml sweep completes stranded runs as hardcoded neutral #5949 with the exact fix shape and ratchet-extension noted, so it is tracked rather than deferred into folklore.

2. PR fix(ci): require the current-head marker before honouring an advisory verdict #3855 is a second in-flight spelling of defect 2 — declared in the PR body since open. Whichever lands second rebases and drops its copy; this PR's marker-verification shape is byte-consistent with the reference lanes' existing greps, so if fix(ci): require the current-head marker before honouring an advisory verdict #3855 lands first the residual delta here shrinks to the shape difference only.

No code change on this PR from either item; both are tracked (#5949, and the #3855 note in the PR body's "Relation to open PRs").

[dwu96]

Rebased onto main after #3855 merged (defect 2, marker verification): my parallel defect-2 hunks and test class were dropped in favor of main's landed shape — the auto-merge had produced doubled marker guards in 3 lanes and a conflicting duplicate test class name, both resolved to main's version (verified: exactly one marker guard per lane, verdict-step byte-identical to main in the design lanes). This PR now carries only defect 1's second half (external_id + stranded-run sweep, 4 fork lanes), stacking on #3856. All three #3447 defects are now covered: #3854 (defect 3), #3855 (defect 2), this PR (defect 1 residual). Head: 56ccaa6, single commit, 212 workflow tests green, YAML+bash -n clean, black/isort/flake8 pass.

[bolichen97]

Tier 1 auto-approve: fix (5 files). Criteria: no conflict, no requested changes, security path denylist clean, design-doc gate clean, SAST annotations clean, security checklist all-NO, AI reviewers green. Category: fix — a transient 5xx while completing a fork AI-review check-run stranded it in_progress, wedging the PR at readiness: checking; the finalize sweep is scoped by external_id (PR number) so it only ever completes this PR's own stranded run and never a sibling sharing the commit.