From 3e05eda333ec2eb042bbdfacfdaef501cb884027 Mon Sep 17 00:00:00 2001 From: mintaka Date: Sun, 6 Sep 2026 02:25:19 -0400 Subject: [PATCH 1/8] fix(tools): point orion-ref-gate's failure hint at an in-repo doc (RIG-3344) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gate's violation message told the author to "see skill://private-repo-boundary", which does not exist. Worse, it could not: compass ships its own skill set under `config/skills/` (8 skills), and no boundary skill is among them — so the hint was unresolvable in the repo that emits it, handed to an author at the exact moment a fail-closed gate blocks their PR. Point it instead at `docs/concepts/self-host-and-managed.md`, which is in this repo, is already the canonical statement of the ban ("Never name or point at the private repo"), and is the doc the gate's own header cites as the rule it enforces. Also inline the actionable part of the guidance — say "the managed service", or describe the core capability directly — so the message stands alone without a lookup. The test pinned the dead URI, so it moves to asserting the two load-bearing substrings. Verified with a positive control: breaking the cited path takes the suite red (1 fail), restoring it green (23 pass), so the assertion defends the contract rather than merely running. Spec-impact: none. Refs RIG-3344 Co-authored-by: Matt Wilkinson --- tools/orion-ref-gate/index.test.ts | 3 ++- tools/orion-ref-gate/index.ts | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/tools/orion-ref-gate/index.test.ts b/tools/orion-ref-gate/index.test.ts index e04bc84e1..1588469c9 100644 --- a/tools/orion-ref-gate/index.test.ts +++ b/tools/orion-ref-gate/index.test.ts @@ -159,7 +159,8 @@ describe("runOnce", () => { expect(code).toBe(1); const e = errs.join("\n"); expect(e).toContain("docs/x.md:7"); - expect(e).toContain("skill://private-repo-boundary"); + expect(e).toContain("the managed service"); + expect(e).toContain("docs/concepts/self-host-and-managed.md"); }); test("returns 2 on a scan error (fail closed)", async () => { diff --git a/tools/orion-ref-gate/index.ts b/tools/orion-ref-gate/index.ts index 2d7d93505..fdb398098 100644 --- a/tools/orion-ref-gate/index.ts +++ b/tools/orion-ref-gate/index.ts @@ -154,7 +154,9 @@ export async function runOnce(deps: Deps): Promise { deps.err(` ${v.file}:${v.line}: ${v.text.trim()}`); deps.err( "A public repo must not name, cite, or quote the private internal monorepo. " + - "Refer to it by architectural role instead (see skill://private-repo-boundary).", + 'Refer to it by architectural role instead — say "the managed service", or ' + + "describe the core capability directly so it need not be named. " + + "See docs/concepts/self-host-and-managed.md.", ); return 1; } From fea7789ea98cdb9a56c7e0d6a97cd399c992df24 Mon Sep 17 00:00:00 2001 From: mintaka Date: Sun, 6 Sep 2026 02:48:09 -0400 Subject: [PATCH 2/8] test(tools): assert orion-ref-gate's cited remediation doc exists (RIG-3344) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review found the hint fix was vulnerable to the defect it repaired: the cited doc path was a bare string literal the test only asserted was *present* in the output, never that the file existed. Deleting `docs/concepts/self-host-and-managed.md` outright left the suite 23-green, so a docs reorg would silently kill the pointer again with every gate passing. Nothing else covers it — markdownlint globs `**/*.md` and cannot read a TS string literal, and the gate's own check only greps for the token. Extracts the path as an exported `REMEDIATION_DOC` const, interpolates it into the failure hint, and asserts the file exists. The path is resolved from `import.meta.url` rather than the cwd, so the assertion holds under any invocation. The test now references the same symbol as the message instead of re-typing the string. Control: repointing the const at a nonexistent path fails exactly the new test (23 pass / 1 fail); restoring returns 24/0. Re-ran the reviewer's own probe in an isolated `git archive` tree — deleting the cited doc with the gate source untouched now goes red where it was previously green. biome, typecheck, and `orion-ref-gate:check` all clean. Spec-impact: none. Refs RIG-3344 --- tools/orion-ref-gate/index.test.ts | 11 ++++++++++- tools/orion-ref-gate/index.ts | 11 ++++++++++- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/tools/orion-ref-gate/index.test.ts b/tools/orion-ref-gate/index.test.ts index 1588469c9..f96f9ca24 100644 --- a/tools/orion-ref-gate/index.test.ts +++ b/tools/orion-ref-gate/index.test.ts @@ -12,6 +12,7 @@ import { findViolations, isCarveOut, lineHasToken, + REMEDIATION_DOC, runOnce, } from "./index.ts"; @@ -160,7 +161,15 @@ describe("runOnce", () => { const e = errs.join("\n"); expect(e).toContain("docs/x.md:7"); expect(e).toContain("the managed service"); - expect(e).toContain("docs/concepts/self-host-and-managed.md"); + expect(e).toContain(REMEDIATION_DOC); + }); + + test("the doc cited in the failure hint exists", async () => { + // Resolved from this file, not the cwd, so the assertion holds under any + // invocation. Without it the hint can silently die in a docs move — + // the defect this pointer was repaired for. + const abs = new URL(`../../${REMEDIATION_DOC}`, import.meta.url); + expect(await Bun.file(abs).exists()).toBe(true); }); test("returns 2 on a scan error (fail closed)", async () => { diff --git a/tools/orion-ref-gate/index.ts b/tools/orion-ref-gate/index.ts index fdb398098..f39afe402 100644 --- a/tools/orion-ref-gate/index.ts +++ b/tools/orion-ref-gate/index.ts @@ -77,6 +77,15 @@ export const CARVEOUT_PATHS: readonly string[] = ["bun.lock"]; */ export const ALLOWLIST: Readonly> = {}; +/** + * The in-repo doc stating the boundary rule, cited in the failure hint. Named + * here so the test can assert the file actually exists: a bare string would + * let a docs move silently kill the pointer again — the exact defect this + * hint was repaired for. Wording tracks its "Never name or point at the + * private repo" bullet; update both together. + */ +export const REMEDIATION_DOC = "docs/concepts/self-host-and-managed.md"; + /** One scanned line carrying the token. */ export interface Reference { readonly file: string; @@ -156,7 +165,7 @@ export async function runOnce(deps: Deps): Promise { "A public repo must not name, cite, or quote the private internal monorepo. " + 'Refer to it by architectural role instead — say "the managed service", or ' + "describe the core capability directly so it need not be named. " + - "See docs/concepts/self-host-and-managed.md.", + `See ${REMEDIATION_DOC}.`, ); return 1; } From b5c72c031cd64293b6e2a2ac24267a50658e264a Mon Sep 17 00:00:00 2001 From: mintaka Date: Sun, 6 Sep 2026 03:11:56 -0400 Subject: [PATCH 3/8] fix(tools): declare orion-ref-gate's cited doc as a test input (RIG-3344) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review round 2 found the existence assertion added in the previous commit was invisible to the runner that executes it. The new test's real input set includes `docs/concepts/self-host-and-managed.md`, but the `test` task declared only its TypeScript and lockfile, so moon's content hash could not see the doc and replayed a cached green after it was deleted. Verified end to end in a `git worktree` at the prior head: warm the cache, delete the doc leaving the gate source byte-identical, re-run — moon reported `24 pass / 0 fail` while a direct `bun test` in that same tree reported `23 pass / 1 fail`. The guard added to stop a silent docs move was itself silently skippable, which is the same failure shape relocated one layer out from the assertion to the task graph. Declares the cited doc as an input of the `test` task, scoped to the one file rather than `/docs/**` so unrelated docs edits do not re-run the suite. The sibling `design-ledger-gate` sets the precedent, declaring `/docs/designs/**/*.md` on the task whose subject is the live docs tree. The path now appears in two places, so the `REMEDIATION_DOC` comment names the moon input and says to move both. Counterfactual: with the input declared the task hash tracks the doc — warm run `5a90424d`, cached on re-run, and deleting the doc moves it to `cb969d99`, re-runs, and fails `23 pass / 1 fail`, propagating to `orion-ref-gate:ci`. Restoring the doc returns 24/0. Suite, biome, typecheck, and the gate itself all clean. Spec-impact: none. Refs RIG-3344 --- tools/orion-ref-gate/index.ts | 4 +++- tools/orion-ref-gate/moon.yml | 14 +++++++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/tools/orion-ref-gate/index.ts b/tools/orion-ref-gate/index.ts index f39afe402..aec4467fa 100644 --- a/tools/orion-ref-gate/index.ts +++ b/tools/orion-ref-gate/index.ts @@ -82,7 +82,9 @@ export const ALLOWLIST: Readonly> = {}; * here so the test can assert the file actually exists: a bare string would * let a docs move silently kill the pointer again — the exact defect this * hint was repaired for. Wording tracks its "Never name or point at the - * private repo" bullet; update both together. + * private repo" bullet; update both together. This path also appears in + * `moon.yml` as an input of the `test` task — the declaration is what makes + * the cache re-run that assertion when the doc changes, so move both. */ export const REMEDIATION_DOC = "docs/concepts/self-host-and-managed.md"; diff --git a/tools/orion-ref-gate/moon.yml b/tools/orion-ref-gate/moon.yml index be557f572..66e5ee76a 100644 --- a/tools/orion-ref-gate/moon.yml +++ b/tools/orion-ref-gate/moon.yml @@ -19,7 +19,19 @@ tasks: deps: ['install'] inputs: ['*.ts', 'tsconfig.json', '/tsconfig.base.json', 'package.json', '/bun.lock'] test: - inputs: ['*.ts', 'tsconfig.json', '/tsconfig.base.json', 'package.json', '/bun.lock'] + # `/docs/concepts/self-host-and-managed.md` is a real input: a test asserts + # the doc cited in the failure hint still exists, so the cache key must + # track it. Without it moon replays a green after the doc is deleted — + # the same silent-pointer-death this gate's hint was repaired for. Scoped + # to the one cited file, not `/docs/**`, so unrelated docs edits don't + # re-run the suite. Keep in sync with `REMEDIATION_DOC` in index.ts. + inputs: + - '*.ts' + - 'tsconfig.json' + - '/tsconfig.base.json' + - 'package.json' + - '/bun.lock' + - '/docs/concepts/self-host-and-managed.md' check: # The boundary gate: scan the whole tracked tree (via git grep) for any # reference to the private monorepo. Run from the workspace root so the From 1da8f2a36bc51ee72e6d7f4e39b2e4aa9577d103 Mon Sep 17 00:00:00 2001 From: mintaka Date: Sun, 6 Sep 2026 03:32:29 -0400 Subject: [PATCH 4/8] docs(tools): scope orion-ref-gate's cache-input claim to the cache (RIG-3344) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review round 3 asked whether the previous two findings had a third layer, and they do. The declared test input governs moon's cache, which is what the previous commit proved — but it is not what selects the task in CI. On a pull_request, `tools/ci-matrix` computes its closure with `moon query projects --affected`, which walks the project graph and never consults a cross-tree task input; `.github/workflows/ci.yml` already documents that discriminator for another project. Measured with controls at this head: touching the cited doc yields the closure `['flake-gate','root']` with this project ABSENT, while touching the gate's own source yields `['flake-gate','orion-ref-gate','root']`. Driving the real `generate()` with the measured closure gives a bun leg of `['root:ci']` alone, so the gate is not selected. The task-level query does track the doc (`['check','test']`, against `['check']` for an unrelated doc), so the input is correct and simply never consulted on that event. No code change: the input is right and closing the selection gap would be a CI-architecture change affecting every cross-tree-input gate, which is not this PR's scope. What was wrong was the comments' claim of completeness, so both now scope the guarantee to the cache and name the push/nightly full sweep as the backstop — verified to select this project on both events. Spec-impact: none. Refs RIG-3344 --- tools/orion-ref-gate/index.ts | 6 ++++-- tools/orion-ref-gate/moon.yml | 7 +++++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/tools/orion-ref-gate/index.ts b/tools/orion-ref-gate/index.ts index aec4467fa..fc00fdefd 100644 --- a/tools/orion-ref-gate/index.ts +++ b/tools/orion-ref-gate/index.ts @@ -83,8 +83,10 @@ export const ALLOWLIST: Readonly> = {}; * let a docs move silently kill the pointer again — the exact defect this * hint was repaired for. Wording tracks its "Never name or point at the * private repo" bullet; update both together. This path also appears in - * `moon.yml` as an input of the `test` task — the declaration is what makes - * the cache re-run that assertion when the doc changes, so move both. + * `moon.yml` as an input of the `test` task — that declaration is what makes + * moon's cache re-run the assertion when the doc changes, so move both. Note + * a pull_request selects targets by project, so a docs-only change relies on + * the main/nightly full sweep. */ export const REMEDIATION_DOC = "docs/concepts/self-host-and-managed.md"; diff --git a/tools/orion-ref-gate/moon.yml b/tools/orion-ref-gate/moon.yml index 66e5ee76a..833944ed5 100644 --- a/tools/orion-ref-gate/moon.yml +++ b/tools/orion-ref-gate/moon.yml @@ -25,6 +25,13 @@ tasks: # the same silent-pointer-death this gate's hint was repaired for. Scoped # to the one cited file, not `/docs/**`, so unrelated docs edits don't # re-run the suite. Keep in sync with `REMEDIATION_DOC` in index.ts. + # + # This governs moon's CACHE, not CI's task selection: on a pull_request, + # tools/ci-matrix selects targets via `moon query projects --affected`, + # which walks the project graph and never consults a cross-tree input (see + # the discriminator note in .github/workflows/ci.yml). So a docs-only PR + # that moves or deletes this file does not select this project, and the + # backstop is ci.yml's unconditional push + nightly full sweep. inputs: - '*.ts' - 'tsconfig.json' From 9ef537449bca610eb1ecefaf0ea48f693988249e Mon Sep 17 00:00:00 2001 From: mintaka Date: Sun, 6 Sep 2026 04:03:06 -0400 Subject: [PATCH 5/8] docs(tools): state orion-ref-gate's real unselected radius on a docs-only PR (RIG-3344) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review round 4 found the previous commit's caveat understated its own blast radius. It scoped the unselected case to a PR that moves or deletes the cited doc, which reads as "worst case the pointer goes stale". The gap is wider: a docs-only PR does not select this project at all, and the `check` scan's own `/**/*` input is cross-tree the same way, so a docs-only PR that ADDS a private-repo reference is not gated on that PR either. Verified by planting a real reference in an unrelated doc: the affected closure came back without this project, the generator selected only `root:ci`, and yet running the scan on that same tree fails loudly with the leak verdict. So the gate's primary function is unselected on precisely the change shape most likely to introduce a leak, and the comment whose whole job is honesty about the uncovered surface was understating it. Widens both comments to state that, names `dependsOn: ['root']` as the one-line option and the over-trigger reason it is declined — the same tradeoff `sql-migration-gate` documents — and points at RIG-3381 for the general answer. Also corrects this file's header, which still described CI as a single `moon run :ci` job; that has not been true since the concern matrix landed, and it now sits directly above an accurate description. The other files carrying that line are left alone. No behaviour change: stripping comments from both files leaves the previous head's bytes identical, the doc remains a resolved input of the test task, and the suite, biome, and the gate are clean. Spec-impact: none. Refs RIG-3344 --- tools/orion-ref-gate/index.ts | 5 +++-- tools/orion-ref-gate/moon.yml | 25 +++++++++++++++++-------- 2 files changed, 20 insertions(+), 10 deletions(-) diff --git a/tools/orion-ref-gate/index.ts b/tools/orion-ref-gate/index.ts index fc00fdefd..fa10e3c16 100644 --- a/tools/orion-ref-gate/index.ts +++ b/tools/orion-ref-gate/index.ts @@ -85,8 +85,9 @@ export const ALLOWLIST: Readonly> = {}; * private repo" bullet; update both together. This path also appears in * `moon.yml` as an input of the `test` task — that declaration is what makes * moon's cache re-run the assertion when the doc changes, so move both. Note - * a pull_request selects targets by project, so a docs-only change relies on - * the main/nightly full sweep. + * a pull_request selects targets by project, so a docs-only PR does not select + * this gate at all — including its leak scan — and relies on the main/nightly + * full sweep (see moon.yml). */ export const REMEDIATION_DOC = "docs/concepts/self-host-and-managed.md"; diff --git a/tools/orion-ref-gate/moon.yml b/tools/orion-ref-gate/moon.yml index 833944ed5..292e492d6 100644 --- a/tools/orion-ref-gate/moon.yml +++ b/tools/orion-ref-gate/moon.yml @@ -7,8 +7,9 @@ # lint/format are whole-repo tasks on the root project (/moon.yml), so this # leaf has no own bun.lock and never runs its own install. # -# Compass CI is a single moon-driven `CI` job (.github/workflows/ci.yml runs -# `moon run :ci`), so the `ci` aggregate below is swept automatically. +# Compass CI runs a per-concern matrix, not one job: tools/ci-matrix computes +# the targets and .github/workflows/ci.yml runs `moon run `, so this +# project's `ci` aggregate is swept only when the matrix selects it. layer: 'tool' language: 'typescript' tags: ['bun', 'ci-group.bun'] @@ -26,12 +27,20 @@ tasks: # to the one cited file, not `/docs/**`, so unrelated docs edits don't # re-run the suite. Keep in sync with `REMEDIATION_DOC` in index.ts. # - # This governs moon's CACHE, not CI's task selection: on a pull_request, - # tools/ci-matrix selects targets via `moon query projects --affected`, - # which walks the project graph and never consults a cross-tree input (see - # the discriminator note in .github/workflows/ci.yml). So a docs-only PR - # that moves or deletes this file does not select this project, and the - # backstop is ci.yml's unconditional push + nightly full sweep. + # That declaration governs moon's CACHE, not CI's task selection: on a + # pull_request, tools/ci-matrix selects targets via `moon query projects + # --affected`, which walks the project graph and never consults a + # cross-tree input (see the discriminator note in + # .github/workflows/ci.yml). KNOWN GAP, wider than this input: a docs-only + # PR does not select this project AT ALL. The `check` scan's own `/**/*` + # input is cross-tree the same way, so a docs-only PR that ADDS a + # private-repo reference is not gated on that PR either — only the doc + # pointer's staleness is the mild case. The backstop is ci.yml's + # unconditional push + nightly full sweep, which does run the scan to a + # real verdict. `dependsOn: ['root']` would pull this project into a + # docs-only closure, but over-triggers the gate on every repo-root file + # change (moon edges are project-level, not file-level) — the same + # tradeoff sql-migration-gate documents declining. Tracked as RIG-3381. inputs: - '*.ts' - 'tsconfig.json' From eee961360a4ecbfe4103f6591efe6acdb8a9a4d7 Mon Sep 17 00:00:00 2001 From: mintaka Date: Sun, 6 Sep 2026 04:34:40 -0400 Subject: [PATCH 6/8] docs(tools): the unselected radius is any foreign tree, not just docs (RIG-3344) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review round 5 found the previous commit's caveat still had a wrong noun. It said a "docs-only" PR fails to select this project, which tells a reader a code PR is gated. It is not: the `check` scan's `/**/*` input is cross-tree for every path, so ANY PR that does not touch this project's own tree fails to select it. Measured by planting a real private-repo reference in Go code: the closure came back with six projects and this one absent, the generator selected no target for it, and the scan on that same tree exited 1 naming the offending line. The positive control discriminates — touching this project's own source does select it. Also records why `dependsOn: ['root']` is not taken, which is stronger than the over-trigger cost alone: it would pull this project in for most trees but not for dot-paths such as `.github/**`, which produce an empty closure and are nonetheless scanned — verified by planting a reference in a workflow file. Taking it would read as closing a gap it leaves open, which is the failure this PR has spent its rounds repairing. No behaviour change: stripping comments from both files leaves the previous head's bytes identical. Suite, biome, and the gate are clean. Spec-impact: none. Refs RIG-3344 --- tools/orion-ref-gate/index.ts | 6 +++--- tools/orion-ref-gate/moon.yml | 22 ++++++++++++---------- 2 files changed, 15 insertions(+), 13 deletions(-) diff --git a/tools/orion-ref-gate/index.ts b/tools/orion-ref-gate/index.ts index fa10e3c16..2bcc2811a 100644 --- a/tools/orion-ref-gate/index.ts +++ b/tools/orion-ref-gate/index.ts @@ -85,9 +85,9 @@ export const ALLOWLIST: Readonly> = {}; * private repo" bullet; update both together. This path also appears in * `moon.yml` as an input of the `test` task — that declaration is what makes * moon's cache re-run the assertion when the doc changes, so move both. Note - * a pull_request selects targets by project, so a docs-only PR does not select - * this gate at all — including its leak scan — and relies on the main/nightly - * full sweep (see moon.yml). + * a pull_request selects targets by project, so any PR not touching this + * project's own tree does not select this gate at all — including its leak + * scan — and relies on the main/nightly full sweep (see moon.yml). */ export const REMEDIATION_DOC = "docs/concepts/self-host-and-managed.md"; diff --git a/tools/orion-ref-gate/moon.yml b/tools/orion-ref-gate/moon.yml index 292e492d6..6467e31ac 100644 --- a/tools/orion-ref-gate/moon.yml +++ b/tools/orion-ref-gate/moon.yml @@ -31,16 +31,18 @@ tasks: # pull_request, tools/ci-matrix selects targets via `moon query projects # --affected`, which walks the project graph and never consults a # cross-tree input (see the discriminator note in - # .github/workflows/ci.yml). KNOWN GAP, wider than this input: a docs-only - # PR does not select this project AT ALL. The `check` scan's own `/**/*` - # input is cross-tree the same way, so a docs-only PR that ADDS a - # private-repo reference is not gated on that PR either — only the doc - # pointer's staleness is the mild case. The backstop is ci.yml's - # unconditional push + nightly full sweep, which does run the scan to a - # real verdict. `dependsOn: ['root']` would pull this project into a - # docs-only closure, but over-triggers the gate on every repo-root file - # change (moon edges are project-level, not file-level) — the same - # tradeoff sql-migration-gate documents declining. Tracked as RIG-3381. + # .github/workflows/ci.yml). KNOWN GAP, and it is not docs-specific: ANY + # PR that does not touch this project's own tree fails to select it, since + # the `check` scan's `/**/*` input is cross-tree the same way. A Go-only + # or docs-only PR that ADDS a private-repo reference is therefore not + # gated on that PR; the doc pointer going stale is the mild case. The + # backstop is ci.yml's unconditional push + nightly full sweep, which does + # run the scan to a real verdict. `dependsOn: ['root']` is NOT taken: it + # would pull this project in for most trees, but not for dot-paths like + # `.github/**` (which produce an empty closure yet ARE scanned), so it + # would read as closing a gap it leaves open — and it over-triggers on + # every repo-root change, the tradeoff sql-migration-gate documents + # declining. Tracked as RIG-3381. inputs: - '*.ts' - 'tsconfig.json' From d997aeef8f88ea63f166fe71ca39d45b259ad359 Mon Sep 17 00:00:00 2001 From: mintaka Date: Sun, 6 Sep 2026 04:54:23 -0400 Subject: [PATCH 7/8] docs(tools): give the declined dependsOn a true reason (RIG-3344) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review round 6 caught a regression the previous commit introduced. While correcting the radius noun, it also rewrote the `dependsOn: ['root']` rationale from a true reason to a false one, and false twice over: it claimed dot-paths such as `.github/**` produce an empty closure, and that the option therefore would not cover them. Neither holds. The root project's source is `.`, so every path marks it affected and `['flake-gate','root']` is the universal floor — no path produces an empty closure. An A/B in a patched worktree confirms the consequence: with the dependency declared, the gate is selected for every dot-path tried, including workflow files, `.gitignore`, `.envrc`, and `.moon/workspace.yml`; without it, for none of them. So the option does close the PR-time gap. The decline stands on the reason it always had — it over-triggers the gate on every repo-root file change, since moon edges are project-level rather than file-level, which is the tradeoff sql-migration-gate documents declining. The clause now says that and nothing more, and states the mechanism it does rest on. The radius correction the previous commit was for is unaffected and was verified precise: every path inside this project's tree selects it, no path outside does, and there are no inbound graph edges to change that. Spec-impact: none. Refs RIG-3344 --- tools/orion-ref-gate/moon.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tools/orion-ref-gate/moon.yml b/tools/orion-ref-gate/moon.yml index 6467e31ac..f53f8f3b1 100644 --- a/tools/orion-ref-gate/moon.yml +++ b/tools/orion-ref-gate/moon.yml @@ -37,11 +37,11 @@ tasks: # or docs-only PR that ADDS a private-repo reference is therefore not # gated on that PR; the doc pointer going stale is the mild case. The # backstop is ci.yml's unconditional push + nightly full sweep, which does - # run the scan to a real verdict. `dependsOn: ['root']` is NOT taken: it - # would pull this project in for most trees, but not for dot-paths like - # `.github/**` (which produce an empty closure yet ARE scanned), so it - # would read as closing a gap it leaves open — and it over-triggers on - # every repo-root change, the tradeoff sql-migration-gate documents + # run the scan to a real verdict. `dependsOn: ['root']` would close the + # PR-time gap — root's source is `.`, so every path marks it affected and + # `--downstream direct` would pull this project in — but it over-triggers + # the gate on every repo-root file change (moon edges are project-level, + # not file-level), the same tradeoff sql-migration-gate documents # declining. Tracked as RIG-3381. inputs: - '*.ts' From ae82395c4fb27452d92162bd5dc4c9d278a1ceb7 Mon Sep 17 00:00:00 2001 From: mintaka Date: Sun, 6 Sep 2026 05:26:59 -0400 Subject: [PATCH 8/8] docs(tools): state the declined edge's real cost, not the inherited one (RIG-3344) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review round 7 found the previous commit's fix contradicted the clause beside it. Establishing that root's source is `.` — so every path marks it affected — entails that the edge would run the gate on every PR, but the retained cost phrase still said "every repo-root file change". Both cannot hold. Measured which: with the dependency declared, the gate is selected for paths under go/, apps/, packages/, proto/, docs/, and .github/ — none of which touch a repo-root file. Repo-root-level files are a few dozen of several thousand tracked, so the phrase understated the cost by roughly an order of magnitude. It was accurate where it came from — sql-migration-gate's gap really is two root-level configs — and became false when placed after a clause establishing root's source is the whole repo. States the real cost instead, and keeps the sibling precedent while noting its gap is the narrower one. The decline still stands on that cost: the edge would run a 148ms scan on every PR for a leg that already runs, which is a tradeoff worth naming accurately rather than a reason to take or refuse the line without measuring it. Spec-impact: none. Refs RIG-3344 --- tools/orion-ref-gate/moon.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/tools/orion-ref-gate/moon.yml b/tools/orion-ref-gate/moon.yml index f53f8f3b1..5f998e7da 100644 --- a/tools/orion-ref-gate/moon.yml +++ b/tools/orion-ref-gate/moon.yml @@ -39,10 +39,11 @@ tasks: # backstop is ci.yml's unconditional push + nightly full sweep, which does # run the scan to a real verdict. `dependsOn: ['root']` would close the # PR-time gap — root's source is `.`, so every path marks it affected and - # `--downstream direct` would pull this project in — but it over-triggers - # the gate on every repo-root file change (moon edges are project-level, - # not file-level), the same tradeoff sql-migration-gate documents - # declining. Tracked as RIG-3381. + # `--downstream direct` would pull this project in — but for the same + # reason it would run the gate on EVERY PR, since moon edges are + # project-level rather than file-level. sql-migration-gate declines the + # same edge, though its gap is narrower (two root-level configs). + # Tracked as RIG-3381. inputs: - '*.ts' - 'tsconfig.json'