chore(ci): qualify ordinary main PRs and separate milestone publication #628

Activity

1. ss-o

   added a parent issue on Oct 8, 2026

   • chore(governance): migrate Zi to protected main integration .github#771
2. ss-o

   added this to Z-shell Deliveryon Oct 8, 2026
3. github-project-automation

   moved this to Triage in Z-shell Deliveryon Oct 8, 2026
4. ss-o

   added

   type:maintenanceNon-feature maintenance, cleanup, or org work.Non-feature maintenance, cleanup, or org work.

   area:ciContinuous integration or GitHub Actions work.Continuous integration or GitHub Actions work.

   area:ziZi core behavior, APIs, or documentation.Zi core behavior, APIs, or documentation.

   status:triageAwaiting initial review or classification.Awaiting initial review or classification.

   on Oct 8, 2026
5. ss-o commented on Oct 8, 2026

   

   ss-o

   on Oct 8, 2026

   MemberAuthor

   More actions

   The staged implementation is locally verified. Stable qualification now runs on every main PR and push, including ZD compatibility and clean startup/real-object lifecycle checks. The existing Promotion gate context is retained for a protected staged rollout. Automatic promotion publication is removed; release planning is read-only and signed milestone publication requires the exact current main SHA, latest successful push qualification, a valid signature and a matching semantic plan. Deterministic notes are recomputed after excluding the newly pushed tag.

   Validation: all 43 focused test files passed on Linux with Zsh 5.9.2 in isolated runtime state. The new aggregate regression rejects failed, cancelled and skipped results for every constituent. Milestone regressions reject newer failed runs, PR-only evidence and mismatched semantic tags. Native syntax/compilation, targeted Trunk checks, actionlint and diff whitespace checks passed. Linux/macOS matrix execution, fork PR enforcement and live settings are not yet verified.

   Next: publish the organization-policy and staged Zi PRs for review, deliver under current next/promotion rules, observe exact-head hosted qualification on a real main PR, then apply the reviewed protection cutover and downstream changes. Preserve PR #627 and its owner. Historical issue reconciliation must precede removal of its closure automation, and retained-history/reference checks must precede separately authorized next retirement. No branch or live ruleset was deleted or weakened.
6. ss-o

   added a commit that references this issue on Oct 9, 2026

   ci(release): stage main qualification and signed milestones (#629)

   ...

   4a91dbb
7. ss-o commented on Oct 9, 2026

   

   ss-o

   on Oct 9, 2026

   Last edited by ss-o

   MemberAuthor

   More actions

   Agent handoff

   Status: Complete

   Repository: z-shell/zi, z-shell/.github and z-shell/wiki

   Branch/PR: Delivered Zi #629, #630, #632, #631, organization #773, #778 and wiki #942. Private workspace tracking and local prompt references are delivered.

   Tracker/Issue: Parent #771, policy #772 and Zi #628.

   Completion criteria

   • Policy: Accepted ADR-0039 amends ADR-0019 and supersedes ADR-0028. Final organization delivery b9a3eafbcd7caaf50e6ebf5c99ee981822bf16ac activates the protected-main contribution and separate signed-milestone contract, regenerates canonical guidance and synchronizes template pins. Policy issue #772 closed natively and its Project 28 item is Done.
   • Qualification and enforcement: Signed Zi main 22b6da908579e6e8143a0abe02e6da14e7b4d5b8 has eleven strict required contexts, signatures, resolved threads and retained deletion/non-fast-forward protections, with no bypass actors. Full qualification passed all 21 jobs, including all six Linux/macOS Zsh 5.8.1/5.9/5.9.2 legs, eight ZD jobs including compatibility, full Trunk, CodeQL, clean startup and real-object lifecycle checks. Separate push workflows also passed. Actual aggregate regressions reject failed, skipped and cancelled constituents. Fork qualification was verified before removing the old source guard requirement; historical guard failures are retired-check evidence, not a passing check or a bypass.
   • Milestones: Read-only exact-SHA release planning and signed annotated-tag publication replace promotion authorization. Signature, exact current main, latest successful push qualification and semantic-plan verification are enforced; regressions reject stale, failed, PR-only and mismatched evidence. Ordinary merges do not publish a release. Existing tag creation/update/deletion protection and the existing administrator role are retained. No tag or release was created.
   • References and delivery: Contribution guidance, templates, Renovate and workflows target main. Wiki's signed delivery bcd13edf13c64558f22145337a0d1d55cdb403c8 passed its full main build/publication; GitHub Pages and Cloudflare Pages production deployments both succeeded on that SHA. Private workspace branch declarations, three delivered pins, generated instructions and local prompt references are synchronized. The initialized children are clean and match their pins.
   • Consumers, history and issues: Fresh startup and existing-clone main self-update, failed-fetch preservation and successful retry passed on final Zi main. Local runtime probes used Linux Zsh 5.9.2; the hosted matrix is separate platform evidence. Promotion retained historical ancestry and canonical tags. Historical closure reconciliation and its read-only replay found no outstanding unqualified closing clause. Former next PR chore(github): sync the organization membership form links #627 is merged; there are no open Zi PRs.
   • Authorized retirement: Remote next at 4a91dbb1b401df7c52a125f0ee1cbb53e1f700ae had zero unique commits against delivered main. After downstream synchronization, the maintainer separately approved remote-only retirement. The exact-tip deletion succeeded and obsolete next-only ruleset 20885504 was deleted. Main/tag rules are unchanged by content comparison; canonical tags, local refs and worktrees match their saved receipts. The different local next tip and all topic work are preserved. Main history and the saved next tip retain recovery evidence; recreating a persistent integration branch remains separately scoped.

   Review and verification limits

   Each normal protected merge has its applicable exact-head review of record. Wiki's explicit ADR-0035 election and additional separate-session review are recorded with the review wrapper's limitations; that scrutiny is not a second human or proof of independence.

   The private workspace change passed 120 Python tests, 42 bootstrap cases, Ruff 0.16.7, ShellCheck and generation checks. Its hosted validation failed before running any jobs and is unavailable validation, not a pass. Unrelated zd/zsh-lint pin drift and other checkouts' runtime currency findings remain recorded outside this migration's scope. Auxiliary local wiki snapshot rebuilding refused its dependency-layout guard; the actual main build and production deployments provide delivery evidence. Completion advisor transport was unavailable because parent runtime identification failed; no advisor approval is claimed.

   No release, unrelated source repair or local branch/worktree cleanup is part of this completion.
8. ss-o

   added 5 commits that reference this issue on Oct 9, 2026

   chore: promote protected-main qualification (#630)

   ...

   6840325

   ci: isolate stable qualification caller concurrency (#632)

   ...

   07743c2

   chore: cut over Zi integration to protected main (#631)

   ...

   22b6da9

   docs: activate Zi protected-main policy (#778)

   ...

   b9a3eaf

   docs: align Zi contribution and package guidance (#942)

   ...

   bcd13ed
9. ss-o

   closed this as completedon Oct 9, 2026