promote: staging → main (2026-10-18-3) — b2e147338

[fedcourtsai-dev]

Drafted by the promotion train at 2026-10-18T18:35Z for promote/2026-10-18-3 at b2e147338 over main a2b9d414d. The branch was cut from staging and never moves, so the integration evidence and an approval of this head stay valid while staging carries on. The train regenerates the block between the markers while this PR is open; write anything else outside it.

Gate status (promote/2026-10-18-3 at b2e147338):

• freshness: not yet — freshness: no green 'ranged-reads' integration-test run at b2e1473;freshness: no green 'corpus-service' integration-test run at b2e1473;freshness: no green 'stub-cascade' integration-test run at b2e1473
• registry: clean

Train: dispatched the integration gate suite at b2e1473 (gh workflow run integration-test.yml --ref promote/2026-10-18-3 -f scenario=gate)

Next (maintainer): read the batch and approve this PR at b2e147338. The train then merges it with a merge commit once the integration gate run, the required checks and the registry gate hold at this head and no predict/evaluate/back-test round is in flight. Merging it yourself instead is fine. To stop it, request changes or close it: a closed candidate is not re-cut at the same staging tip, and the next one is cut once staging moves.

The batch

• fix(security): bind the production read-write role's jobs to a corpus-write environment #2522: fix(security): bind the production read-write role's jobs to a corpus-write environment
• fix(buttondown): include Buttondown's bounded reason when it refuses a request #2534: fix(buttondown): include Buttondown's bounded reason when it refuses a request
• feat(promotion-gate): say when a promotion owes the admin-read contexts stage, and when to run it #2536: feat(promotion-gate): say when a promotion owes the admin-read contexts stage, and when to run it
• docs(freeze-record): fill the 2026-10-18 promotion placeholders #2537: docs(freeze-record): fill the 2026-10-18 promotion placeholders
• feat(promotion-train): cut a candidate only on a dispatch #2540: feat(promotion-train): cut a candidate only on a dispatch
• Sync: chore: sync main into staging #2529

Effect checks

#2522: fix(security): bind the production read-write role's jobs to a corpus-write environment

Once promoted, and with step 1 done:

• A writer run's jobs show environment corpus-write. The run page shows a corpus-write deployment per writer job, and this lists fresh deployments dated after the promotion:

  gh api 'repos/ModelMirrorAI/fedcourtsai/deployments?environment=corpus-write&per_page=5' \
    --jq '.[] | [.created_at, .ref, .sha] | @tsv'
  

  The matching query for environment=prod no longer gains entries from run-pull pull/live windows.

• The window succeeds: its pointer commit lands on main.

• scripts/promotion-gate.sh contexts (maintainer's admin token, from main once promoted) passes, including the new "the corpus-write environment admits main alone and holds only the writers' names" line.

• After step 4, an executed check: a prod-bound job that tries the RW role is refused. Nothing in the repo can show this, so it is the maintainer's IAM reading of the RW trust (sub names only environment:corpus-write).

#2536: feat(promotion-gate): say when a promotion owes the admin-read contexts stage, and when to run it

• The next promotion PR's promotion-gate job log ends with a contexts: due — … or contexts: not due — … line, and the job's conclusion is unchanged by it.
• The train's generated block carries the contexts (admin read, run by hand) line exactly once.

To check:

gh run view <promotion-gate run> --log | grep 'contexts:'

---

Generated by Claude Code

#2540: feat(promotion-train): cut a candidate only on a dispatch

Once promoted, no tick cuts unless it is a dispatch.

1. After this batch merges and the sync lands, the next scheduled promotion-prep run's summary should read promotion train: wait — staging <sha> carries a batch over main, ready to cut; … gh workflow run promotion-prep.yml --ref main, and no new promote/ branch should appear:

   gh run list --workflow promotion-prep.yml --limit 3
   gh api repos/ModelMirrorAI/fedcourtsai/git/matching-refs/heads/promote/ --jq '.[].ref'
   

2. Then gh workflow run promotion-prep.yml --ref main should cut promote/<date> and open its draft PR (gh pr list --base main --search head:promote/).

---

Generated by Claude Code

No effect-check note found. Add one to the feature PR's description (the next refresh picks it up) or write it below the end marker, or say there why none applies:

• fix(buttondown): include Buttondown's bounded reason when it refuses a request #2534: fix(buttondown): include Buttondown's bounded reason when it refuses a request
• docs(freeze-record): fill the 2026-10-18 promotion placeholders #2537: docs(freeze-record): fill the 2026-10-18 promotion placeholders

After the merge

1. Tag promotion/<YYYY-MM-DD> on the merge commit (-2 for a same-day second batch).
2. Run the effect checks above and record what they printed.