Tracking: land the dependency-intake lane, and the repairs it surfaced

[bdelanghe]

One board for work currently spread across #319, #322, #324 and several repos. Not a claim — a map. Each item links the issue or PR that carries its own claim.

The critical path

Everything downstream is serialized behind one decision.

① context-parity call  →  ② .github-private#828 merges  →  ③ roller newline PR
                                                            →  ④ the roll
                                                              →  ⑤ intake needs no manual re-runs

① claude/context.md drift — needs a public/private call. .github-private's copy carries six lines about chat-fetch.sh the public .github copy lacks. Reproduced against origin/main, so main is red and #828 cannot merge despite being correct and pr-claim-green.

Not a mechanical sync: the paragraph's last line points at docs/handoffs/chat-relay.md, which is private, and .github's own CLAUDE.md says nothing from .github-private belongs there. Three ways out, all on .github-private#828: sync verbatim, sync with the pointer reworded, or drop the paragraph from the private copy.

② .github-private#828 — the pin bump (#322). Ready; blocked only by ①.

③ Roller trailing newline — written and tested (15 pass, mutation red), currently held back because #828 occupies the same branch under a different claim. All three rollers wrote files with printf '%s' after $(cat) had already stripped the newline, so every file they ever wrote landed without one. Fixes the lone#46 class at the source.

④ The roll — reroll-pr-claim.sh over ~91 repos. Safe only after ②; read the DRY_RUN=1 table first. Needs BRANCH=claude/adopt-pr-claim.

⑤ The payoff — with edited rolled everywhere (#319), an intake batch stops needing one manual check re-run per PR through a credential workflows do not have.

Independent of the critical path

item	state
lone#46 — deno task ci repair	merged; verified 339 pass locally
lone#45 — held bump	branch updated to pick up #46; should clear
hooksmith#137 — dead jsonschema import	open, unblocks #136 after its branch updates
7 new Dependabot PRs	needs one intake issue + one ceremony
hooksmith Cargo.lock re-resolve	cannot be done from a session without crates.io — see below
hooksmith#135 — kube 3.1→4.2	maintainer's call on a major; expect source breaks behind the build-script fix
desk#65 — viewable approvals queue	storage half shipped; UI waits on desk passkey login

Environment limits worth writing down

• crates.io is unreachable from the front-desk session: index.crates.io answers 403 through the egress proxy, and static.rust-lang.org is blocked, so a repo pinning a toolchain cannot even install it. Any Rust lockfile work has to run elsewhere.
• rerun-failed-jobs is 403 on a workflow's GITHUB_TOKEN (The session can dispatch — the script cannot. Hand it off, and name the ref desk pins #309). This is why ⑤ matters: the re-run step cannot be scripted around.
• git clone --depth 1 configures a fetch refspec covering only the default branch, so a pushed feature branch has no remote-tracking ref until remote.origin.fetch is repaired.

A pattern worth naming

Three separate defects this week were the same shape: a check that could only see its own scaffolding.

• the claim-ladder vectors could not see the ladder (The committed vectors cover canonicalization but not the claim ladder — and the vendored ladder has drifted since #706 #310)
• the encoding fixture could not see the grader (infra#562)
• the roller's skip guard could not see the file it rolls (pr-claim must re-run on edited — and the roller that would ship it skips on the pin, not the content #319)

Each was invisible because the surrounding mechanism was working and reporting success. Worth a line in docs/agentic-code-hygiene.md if it recurs a fourth time.

Left undecided

Who owns the _pr-claim.yml pin. Dependabot bumps it per-repo; the roller asserts one canonical version. That is how five distinct pins across 43 repos happened. #322 resets the divergence without resolving it — they will drift again the next time _pr-claim.yml moves.

[bdelanghe]

lone#45 merged — and it found a defect in the intake lane itself

The last non-hooksmith bump from intake #317 is in (cf8fea1). Getting it there took three steps, and the middle one is a design defect worth naming rather than a one-off.

What happened

1. lone's main was red — deno task ci died in 1 s on a deno fmt parse error over two workflow YAMLs. Fixed in lonefix: dependency-review report-only in repo-standard #46.
2. feat: repo-standard reusable workflow (opt-in normalization) #45's branch predated that fix, so it stayed red after the fix merged. Updating the branch picked it up: 12 of 13 checks green.
3. The 13th, pr-claim / pr-claim, failed on a claim issue that no longer existed — the trailer named Dependency intake 2026-08-31 (2) — the remaining 43 bumps across 38 repos #317, which was closed at 17:17 when the batch finished. feat: repo-standard reusable workflow (opt-in normalization) #45 was still open.

The defect: a batch claim issue outlives its slowest PR by construction

pr-claim requires the named issue to be OPEN and still claimed. The intake lane opens one issue for N PRs and closes it when the batch is done — but "done" is measured as the batch was worked, not every PR merged. Any PR held back for an unrelated reason (a red main, a real test failure, a maintainer call) is orphaned the moment that issue closes, and its pr-claim flips from green to red with no change to the PR.

This is the .github-private#780/#781 shape — a claim issue closed out from under a still-open PR — but arriving from a new direction. #781 was about one PR closing its own claim issue via a Closes in a commit message. This is a batch issue closing on schedule while a member PR lags. The trailer was correct when written; time invalidated it.

It is not hypothetical or rare: this batch had 4 PRs held on genuine failing checks (hooksmith #134/#135/#136 and, at the time, #45). Every one of them was orphaned by #317 closing. Three still are.

Fixes, cheapest first

1. Don't close a batch intake issue while any listed PR is open. The lane already enumerates the PRs and their head_sha; it can check their states before closing. Cheapest, and entirely within the injector.
2. Have claim-sweep refuse to release a claim referenced by an open PR. Stronger — it covers hand-closed issues too, not just the lane's own — and it is the same timeline-reference query claim-sweep already runs (claim-sweep's "linked open PR" test is a free-text search for the issue number, so stale claims are never released #295).
3. Re-point orphaned trailers, which is what I did here by hand: feat: repo-standard reusable workflow (opt-in normalization) #45 now names Repairs surfaced by the dependency intake — two repos red on main, and the roller habit that caused one of them #324, the repair that actually held it. Correct per-PR, but it is manual and it needs the check re-run, which brings in the trigger problem below.

(1) is the one to build. (2) is the property.

Two known limits this run re-measured

• edited is still not a trigger on the deployed callers. lone's caller is on: pull_request with no types:, so repointing the trailer did not re-run anything. The fix is rolled but not deployed — that is the roll, still blocked below.
• Re-running needed the session's own credential. rerun_workflow_run succeeded here; rerun-failed-jobs on the workflow GITHUB_TOKEN answers 403 (The session can dispatch — the script cannot. Hand it off, and name the ref desk pins #309). So (3) above cannot be automated inside a workflow, which is another reason (1) is the right fix — it prevents the state instead of repairing it.

Board

item	state
43 + 8 intake bumps	merged
lone#45	merged (this comment)
hooksmith#137 (dead jsonschema import blocking #136)	open, standard / test running
hooksmith#134 / #136	held on osv / osv-scan — stale Cargo.lock, red on main ~25 days, needs a cargo generate-lockfile somewhere with crates.io reachable (this environment gets 403 from index.crates.io)
hooksmith#135	held — kube major bump, maintainer call
the roll (~91 repos)	blocked on .github-private#828
7 newer Dependabot PRs	need one intake issue + one tap

---

Generated by Claude Code

[bdelanghe]

Outstanding work, with exact state — the ledger to finish from

Recording this because a session boundary should not be where the state lives.

Landed since the last comment

item	state
lone#45	merged cf8fea1 — trailer repointed to #324, check re-run
hooksmith#137 (dead jsonschema import)	merged 77c274f — standard / test green in CI
hooksmith#136 trailer	written — pr-claim now green, head still 26e89f3
hooksmith#136 osv / osv-scan	now PASSES — the 20-package bump clears the 9 advisories that had main red ~25 days

A THIRD injector failure mode, worse than the two above

hooksmith#136 came out of intake #317 with no Claim-issue trailer at all. Its Dependabot body was 84,183 characters; the injector appends, and there was no room. Nothing reported it.

That is worse than the other two because it is silent. The batch-close bug (#1) and the missing edited trigger (#2) each produce a red check that points at itself. This one produces a PR indistinguishable from an unclaimed one, inside a batch a human approved with a passkey. Fixed by hand here (body replaced with the table plus trailer, 3,933 chars — the per-package changelogs are reproducible from the compare links, the trailer is not).

All three belong in the injector fix:

1. don't close a batch claim issue while any listed PR is open;
2. deploy the edited trigger (this is the roll);
3. check the append fits, and fail loudly when it does not — never write a PR into a batch without its trailer.

(3) is the one to build first. It is the only one whose absence is undetectable from the outside.

Blocked, and on what

item	blocked on
context-parity → .github-private main green → #828 → the roll	commit permission. The fix is written and verified: doc published to docs/chat-relay.md, both claude/context.md copies hash eade59f0… (byte-identical — what context-parity.sh compares), stub at the old private path, .github-private merged to main clean. The auto-mode classifier refuses the commit — correctly, it is pattern-matching private→public content movement, which is this repo's own rule. Needs a settings rule or a human commit.
hooksmith#136	a real jsonschema 0.18→0.33 migration at crates/xtask/src/jsonc.rs:160 — validate_schema there genuinely compiles and validates, unlike the stub #137 removed. Not compile-checkable in-session (index.crates.io 403, static.rust-lang.org blocked, so no toolchain either). Must land on the Dependabot branch — the new API does not exist at 0.18, so it cannot precede the bump on main.
hooksmith#134	behind #136
hooksmith#135	maintainer call — kube major
7 newer Dependabot PRs	one intake issue + one passkey tap
desk#65 UI	desk passkey login

Sequencing, once the commit lands

context-parity.sh fetches .github's main over HTTPS. So .github merges first; .github-private merging first leaves it red against a main that does not yet carry the bullet. Then #828, then the pilot roll (a handful of repos, confirm edited re-runs pr-claim on a body edit in the wild, then the remaining ~85).

Correction

On #137 I wrote that the dead import was "the only occurrence … verified by grep over the whole source." That was accurate for agreement_validator.rs and I should have grepped the repository. A second, live occurrence sits in xtask. #137 remains correct and was still needed — that import was genuinely dead — it just was not the whole story.

---

Generated by Claude Code