From c89537c4654664a9e9fd0457bc51a9678f8cbec7 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Wed, 30 Sep 2026 16:13:06 -0500 Subject: [PATCH] docs(auth): record what PR #30's CI actually ran, not what its tick said Read the commit's /statuses rather than the check mark: gate / gate (pull_request) state=success desc='Successful in 1m41s' gate / conformance (pull_request) state=success desc='Has been skipped' The second is CLAUDE.md 2b's trap in the wild -- a SKIPPED Gitea job reports state=success, so that green tick certifies nothing. It agrees exactly with the local rc 3: the offline L0/L1 subset passed, L2/L3 never ran. Anyone reading the PR's check mark alone would conclude the opposite. Also re-measured branch protection instead of trusting the table in CLAUDE.md: GET /repos/.../branches/main -> protected=true, user_can_push=false. Co-Authored-By: Claude Opus 5 (1M context) --- decisions/2026-09-30-jackett-oauth2-proxy-session.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/decisions/2026-09-30-jackett-oauth2-proxy-session.md b/decisions/2026-09-30-jackett-oauth2-proxy-session.md index 0bf3dc8..d8c0259 100644 --- a/decisions/2026-09-30-jackett-oauth2-proxy-session.md +++ b/decisions/2026-09-30-jackett-oauth2-proxy-session.md @@ -200,6 +200,18 @@ than the file merely existing. not skipped โ€” mounting the sibling spec repo at `/home-network-k3s` (the path `ci/spec-immutability.sh` actually defaults to) in the ENGINE shim fixes that skip; the commonly circulated shim mounts it at its host path, where `SPEC_REPO` never finds it. +- **Gitea CI on this PR, read from the commit's `/statuses` rather than from a tick.** Two contexts + reported, and **only one of them ran**: + + gate / gate (pull_request) state=success desc='Successful in 1m41s' + gate / conformance (pull_request) state=success desc='Has been skipped' + + That second line is ยง2b's trap in the wild: a **skipped** Gitea job reports `state=success`. The + conformance job did not execute, so the green tick beside it certifies nothing. Read together with + the local rc 3 above, the two agree exactly โ€” the offline L0/L1 subset passed and L2/L3 never ran. + Anyone reading the PR's check mark alone would conclude otherwise. +- **`main` is protected**, re-measured this session rather than assumed: + `GET /repos/.../branches/main` โ†’ `protected=true`, `user_can_push=false`. ## What I did NOT verify