Repository navigation
July 9 incident post-mortem: force-push auto-closed 23 PRs — recovery complete #261
Description
On 2026-07-09 at 00:59 UTC, a release-snapshot force-push replaced this repository's main history. GitHub reacted by auto-closing all 23 open community PRs within one second. That was our mistake, not yours — this post explains what happened, what we did about it, and what's different now.
What happened
Our release pipeline used to publish by force-pushing a freshly generated snapshot of main. The v0.3.0 cut did exactly what the (flawed) runbook said — and rewriting the base branch's history breaks every open PR's merge tracking. Once that happens, GitHub cannot reopen those PRs, even after main was restored to the identical pre-incident commit the same day.
The recovery — complete as of July 17
Every one of the 23 closed PRs is accounted for:
- 14 were resubmitted by their authors under new numbers (thank you all for the patience);
- 9 were recreated by us as
Recovered: …PRs (Recovered: fix(test): restore full test suite on Windows (#4 by @SahilRakhaiya05) #243–Recovered: fix(doctor): validate --output through the shared output-mode validator (#213 by @Yazan-O) #251) from the persistentrefs/pull/N/headrefs — original commits, original authorship, merge credit preserved.
As of today, 13 recovered/resubmitted PRs have been merged, several more are approved pending a rebase, and the rest carry detailed review feedback. Nothing was lost.
What's different now
- Force-pushing
mainis impossible: branch rulesets now block non-fast-forward pushes and deletions onmain, and releases are published append-only. - Release tags are ruleset-protected too.
- A CI issue that showed a false-red
gatecheck on every PR (anactions/github-scriptNode-24 breakage, unrelated to your PRs) was fixed on July 17 — your PR's next push or re-run will show it green.
If you contributed before July 9
If you had a PR closed by the incident and don't see a successor for it, comment here or reopen from your fork branch — we'll prioritize the review. Sorry again for the disruption, and thank you for building with us.
Activity
Davidson3556 commentedon Jul 24, 2026
/assign
testsprite-hob commentedon Jul 24, 2026
Assigned to @Davidson3556. Thanks for taking this on. (1 more slot available.)
Your open assigned issues (2/3):
Davidson3556 commentedon Jul 26, 2026
Thanks for the write-up. I wasn't affected: all my PRs merged before July 9, so nothing to recover on my end. Unassigning myself to free the slot.
Davidson3556 commentedon Jul 26, 2026
/unassign
testsprite-hob commentedon Jul 26, 2026
Unassigned @Davidson3556. Thanks for the update — freeing this up for someone else.
zeshi-du commentedon Aug 13, 2026
Closing this out, with the ledger actually reconciled rather than just asserted. When I wrote "recovery complete" above I was summarising, not counting — and a review this week found that the count didn't hold up. Here is where every auto-closed PR really ended up.
Recreated as
Recovered:PRs (#243–#251):Resubmitted by their own authors: #212 → #229, #179 → #225. Both are still open; #229 had gone 35 days with no response from us and CI that was never approved to run, which I've now fixed and replied to.
Landed by another route: #205's "preserve root output path" fix is present in
src/lib/bundle.tswith test coverage. #56's security-workflow work was done internally and shipped.Adopted in spirit, not in diff: #57 (Gemini agent-install target, @merlinsantiago982-cmd) was recreated as #247 and then closed in favour of #236 on review-scope grounds. The idea is on the roadmap because of that PR; the diff wasn't used. That deserved to be said out loud rather than inferred from a closed PR.
Never given a successor, and never told: #214 (@iamyhe, interactive prompt wizard for a missing
plan-frompath). Being straight about it: an interactive wizard cuts against the agent-first, scriptable direction inVISION.md— output is structured, stdout stays parseable, and prompting mid-command breaks that. So we're not going to build it. But you should have heard that in July from a person, not in August from a postmortem. @iamyhe, you also have #229 open; I've replied there.Structural fixes from the incident are all verified in place:
mainis ruleset-protected against force-push and deletion, release tags are ruleset-protected, and the false-red CI gate is fixed.Closing as a completed record rather than leaving it labelled in-progress. If your PR is on none of the lists above, comment here and I'll chase it.