Repository navigation
The bypass-roster refusal is the arm that fires every time, so say so where signing happens - #10322
Merged
Merged
Conversation
… where signing happens The mechanism was already annotated: a whole-ruleset PUT plus an unreadable bypass roster means applying desired could delete an unknown number of grants, so it refuses rather than writing blind. What was missing is the CONSEQUENCE, and the two read very differently. `bypass_actors` is omitted by GitHub both when the roster is empty AND when the reading credential may not see it, and the credential available to this repository is the second case. So `BypassRosterUnavailable` is not a defensive branch guarding an unlikely world -- it is returned by every live read taken so far, converge is unconditionally held today, and it is held before any question about the merge_queue rule is reached. A reader who takes it for a rare arm reads a held converge as transient and retries; retrying changes nothing, because the observation is a property of the credential rather than of the moment. The remedy is an authorized bypass-roster read and nothing else. The same consequence is stated in `desired_merge_queue`'s `awaiting` text, and that placement is the point rather than a duplicate: flipping to `MergeQueueSignedOff` requires DELETING that field, so whoever signs must read it to remove it. Signing does not by itself make converge actuate, and the person signing is exactly the person who would otherwise assume it does. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RPZR4RfT74eH25bQQZzFKL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first commit after #10204, as scheduled. Annotation only — no type, no predicate, no behaviour changes;
git diff --statis one file, +12/-1.What was missing
bypass_roster_projection_refusalalready carried its mechanism: converge sends a whole-ruleset PUT, an unreadable bypass roster means applying desired could delete an unknown number of grants, and the observation cannot say whether that is none or several — so it refuses rather than writing blind, because treating unavailable as empty would be the empty-observation narrow deciding a destructive write.What it did not carry is the consequence, and the two read very differently to someone deciding what to do next.
GitHub omits
bypass_actorsboth when the roster is empty and when the reading credential may not see it. The credential available to this repository is the second case, soBypassRosterUnavailableis not a defensive branch guarding an unlikely world — it is what every live read taken so far has returned. Converge is therefore unconditionally held today, and held before any question about the merge_queue rule is reached, since the bypass gate is checked first.The failure that follows from reading it as a rare arm is specific: a held converge looks transient, so the reader retries it. Retrying changes nothing, because the observation is a property of the credential and not of the moment. The remedy is an authorized bypass-roster read — a credential whose ruleset GET returns
bypass_actors— and nothing else discharges it: not a retry, not a wait, and not signing the sign-off row.Why it is stated twice
The second site is
desired_merge_queue'sawaitingtext, and that placement is the point rather than a duplicate of the first.Flipping the desire to
MergeQueueSignedOffrequires deleting that field — it does not exist on the signed arm. So whoever signs has to read the text in order to remove it. The person signing is exactly the person who would otherwise assume that signing makes converge actuate, and it does not: the bypass gate still holds it, for a reason that has nothing to do with the ruling they just made. Stating it only at the refusal would put it where the signer never looks.Scope
No live repository setting is read or written by this change, and none was written by #10204 either. This is prose in typed carriers on two existing symbols.
🤖 Generated with Claude Code
https://claude.ai/code/session_01RPZR4RfT74eH25bQQZzFKL