#513 Gate The Approval Check On The Claude Label

[b-at-neu]

Closes #513

Summary

approval-check.yml required the approved pipeline label on every PR into dev, which no Dependabot PR and no manual human PR can ever satisfy — PR #296 has been unmergeable since 14 August for exactly this reason. Author-based detection isn't available (pipeline PRs are opened under an operator's gh token, so agent and human PRs share authors), so the claude label is the only usable signal.

The gate now applies only to PRs carrying claude, via a job-level if:. Everything else gets a skipped check run, which GitHub counts as a satisfied required check, so it merges on its own merits. The trigger is deliberately untouched — a workflow that never runs creates no check run, leaving the required check pending forever, which is the worse failure.

This inverts the failure mode from fail-closed to fail-open, accepted deliberately in the ticket: the gate's job is to stop mid-pipeline PRs merging early, not to enforce review universally. Because CI can't tell an unlabelled pipeline PR from a human one, the mitigations are upstream — impl-agent now passes --label "claude" at PR-creation time, and the cockpit gained an ungated-PR sweep so a dropped label surfaces instead of silently disabling the gate.

Changes

• .github/workflows/approval-check.yml — if: contains(github.event.pull_request.labels.*.name, 'claude') on run-approval-check; rewritten header comment; new missing-approved error copy. on: (branches: [dev], all five types) and the job ID are unchanged — that ID is the registered required check.
• .claude/agents/impl-agent.md — --label "claude" in the step-6 gh pr create block, plus a line on why it is load-bearing.
• .claude/docs/PIPELINE.md — claude row in the PR-labels table; a CI merge gate paragraph in Permission rationale; a recovery-runbook row for a pipeline PR showing Skipped.
• .claude/skills/pipeline/SKILL.md — ungated-PR sweep query in the tick block, its report line, a gate #N command, and the sweep folded into tick step 4 and status.
• CLAUDE.md — claude label added to the PR bullet in Commits, Branches, PRs.

Testing plan

This PR is its own primary test fixture: it carries claude, and pull_request workflows run from the merge ref, so the new condition is live here.

• run-approval-check runs and fails on the missing approved label, showing the new error copy ("remove the 'claude' label and this check will skip").
• Remove claude from this PR → the next event's run-approval-check reports Skipped, and GitHub's merge box no longer lists it as failing.
• Re-add claude → the gate runs and fails again (proves labeled re-evaluation in both directions).
• The check-run name in the merge box is still run-approval-check, with no "Expected — waiting for status" entry.
• Add approved with claude present → the job passes with the "merge gate satisfied" line.
• Add a blocking label (e.g. reviewing) alongside claude + approved → the job still fails, on the blocking label.
• After merge into dev: comment @dependabot rebase on Bump prettier from 3.8.4 to 3.9.6 #505 (and Bump @prisma/adapter-pg from 7.8.0 to 7.9.1 #506, Bump tailwindcss from 4.3.2 to 4.3.3 #508, Bump prettier-plugin-tailwindcss from 0.8.0 to 0.8.1 #509) so their merge refs pick up the new workflow, then confirm run-approval-check reports Skipped and each PR is mergeable. (Bump prettier from 3.8.4 to 3.9.3 #296 from the ticket is already closed; Bump prettier from 3.8.4 to 3.9.6 #505 is its live successor, prettier 3.8.4 → 3.9.6.)
• A dev → main release PR is unaffected: branches: [dev] means the workflow never runs there, and no pipeline label is involved.
• In a cockpit session, status reports a pipeline-labeled PR that lacks claude on the ungated line; with claude present it is not reported.

Automated checks

• npm run prettier:check — pass
• npm run eslint:check — pass
• npm run tsc:check — pass
• npm run test:unit — 133 passed (5 files). The db project was skipped: no Postgres / DATABASE_URL in this worktree. This change touches no source, schema, or query code.

Notes

• No schema or migration changes; no source changes. Docs + one CI condition.
• The ungated-PR sweep's --jq was verified live against the repo and correctly surfaced PR #391 Strengthen ESLint, TypeScript, And CI Configuration #517 (labeled needs revision, no claude) — the filter works, so an empty result is meaningful.
• claude is an existing repo-wide label shared between issues and PRs; nothing new to create.
• Dependabot PRs opened before this lands keep running the old workflow from their own merge ref until rebased. @dependabot rebase is the fix, not a further workflow change. All four currently-open Dependabot PRs (Bump prettier from 3.8.4 to 3.9.6 #505, Bump @prisma/adapter-pg from 7.8.0 to 7.9.1 #506, Bump tailwindcss from 4.3.2 to 4.3.3 #508, Bump prettier-plugin-tailwindcss from 0.8.0 to 0.8.1 #509) show run-approval-check FAILURE today — that is the bug this closes.
• Per Implement .claude Config Tickets From an Operator Session #503 this ticket edits .claude/, so it was implemented from an operator session rather than dispatched to impl-agent.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aplio	Ready	Preview	Aug 19, 2026 10:28pm

[b-at-neu]

Code Review — Cycle 1 · needs revision

1 open — 1 🟡 Low (see inline)

[b-at-neu]

Revision — Cycle 1

fixed R1-L1 · skipped none · 0cf9275

Header is now 2 new lines; the 3-line main/dev ruleset warning is preserved verbatim as the ticket's acceptance criteria require, leaving the file's header at its original 5 lines.

[b-at-neu]

Code Review — Cycle 2 · approved

0 open — R1-L1 resolved cleanly (header comment trimmed to 2 lines), no regressions introduced