[don-petry]

Problem

[Fleet Monitor] combsmith/.github-private — .github/workflows/sync-scope-guard.yml

From the issue: | Metric | Value | |---|---| | Failure Rate | 25% (2 / 8 runs) | | Status | DEGRADED | | p50 Duration | 25s | | p95 Duration | 1380s | | Successful Runs | 4 | | Cancelled Runs | 2 |

Risk

Low — changes automation shell logic under scripts/, covered by shellcheck (--severity=warning) and the bats suite.

Test plan

Tests added/updated: tests/fleet_report.bats. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the bats suite runs in CI.

Rollback

Revert this PR. No non-revertible side effects (no tags, migrations, or external state).

Monitoring

This PR's Lint (shellcheck) and bats checks show pass/fail; watch subsequent dev-lead / pr-review runs for behavioral regressions.

Closes #2373

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #2378
No changes were committed, but the PR still can't be marked done: required check SonarCloud is still pending. The retry cron will re-attempt automatically. Next attempt after: 2026-10-21T02:02:22Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but I can't mark it done yet: required check SonarCloud is still pending. I'll re-check automatically.
Next attempt after: 2026-10-21T02:02:22Z

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-21T02:32:45Z.

[don-petry]

QA Lead — test-risk advisory

Risk tier: LOW. This changes one line in the monitoring allowlist. It cannot change what ships or what the guard enforces. Both failed runs were the guard correctly rejecting PR #2366 for having no path manifest, not a broken check.

What I'd shore up (highest leverage first):

• Don't lose the signal. Exempting the gate also hides the real problem: the sync generator in combsmith/.github produced a PR with no manifest (chore: sync 3 org-standard workflow stub(s) from combsmith/.github #2366, still open and labelled needs-human-review). Please make sure that producer defect is tracked on its own, so this exemption doesn't quietly hide it.
• Pin the default list as a whole. The new test is a copy of the per-gate test, which is fine. A single test that checks the full default FLEET_GATE_WORKFLOWS (all three names) would catch someone dropping an entry while editing the list. Today each gate's test only fails on its own name.
• Add a near-miss check. Gates are matched on the exact file name. One test that a similar name (e.g. sync-scope-guard-v2.yml) is still tracked would stop the exemption from widening by accident later.
• The p95 of 1380s isn't a slow test. The failed jobs took about 5–11s; the 1380s is the run's wall-clock time, not the job's. No speed-up work is needed here, though the monitor may want to measure job duration instead.

Escalate? no

Advisory only — I comment, I do not change code. Ground: BMAD Test Architecture
(bmad-tea v1.19.0). Opt out on this item with the qa-lead:hands-off label.

[don-petry]

Acknowledged: Codex's review run failed to complete (no findings were produced, only a status table). No action needed.

[don-petry]

Acknowledged: Codex usage-limit notice. It carries no finding, so no action is needed.

[don-petry]

Acknowledged: CodeRabbit reports no actionable comments. Its Merge Risk is Minimal and the pre-merge checks passed. It has no retained concerns, nitpicks or outside-diff items, so no action is needed.

[don-petry]

Acknowledged: SonarCloud Quality Gate passed. No action needed.

[don-petry]

Dev-Lead — fix-reviews (no-changes)

Agent reasoning

Addressed 0 threads: there were no open review threads, so I made no code changes and no commits. I didn't run the test suite.
**Phase 0 (PR state):**
- CI: no check has a failing conclusion. `bats`, `dev-lead / dispatch` and `review / review` are still in progress.
- Reviews: CodeRabbit's single review is `APPROVED`. No review has `CHANGES_REQUESTED`.
**Phase 1b (PR issue comments):** I posted one `informational` disposition on each of these four comments, with no finding to act on:
- **Codex review summary:** the review run failed and produced no findings.
- **Codex usage-limit notice:** the notice carries no finding.
- **CodeRabbit summary:** it says "No actionable comments", Merge Risk is Minimal, and the pre-merge checks passed.
- **SonarCloud:** the Quality Gate passed.
I skipped the comments from our own automation (the dev-lead status notes, the persona QA advisory and the pr-review rate-limit note).
Files changed: none.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: c83c5df74a3e10286ddd51843e4e374575813373
Review mode: triage-approved (single reviewer)

Summary

Adds sync-scope-guard.yml to the Fleet Monitor gate-workflow exemption list (FLEET_GATE_WORKFLOWS in scripts/fleet_report.sh), adds a matching bats test, and updates the AGENTS.md exception note. This is a one-line change to the monitoring allowlist. It does not change what the guard enforces. Confirms the triage assessment: LOW risk.

Linked issue analysis

#2373 is a Fleet Monitor DEGRADED tracker for sync-scope-guard.yml (25% failure rate, 2 of 8 runs). That workflow is a required gate that fails closed on out-of-scope sync PRs (#1700). Like test-deletion-guard.yml and holdout-guard.yml (#941), its failure conclusions are intentional enforcement, so the tracker is a false positive. Adding it to the gate list is the fix AGENTS.md prescribes ("Add new gate workflows of this class to that list"). Closes #2373 is appropriate for a tracker issue.

Findings

• No blocking findings.
• filter_high_failure matches gates by exact basename, and its ERROR-row path still surfaces read failures for gates. The exemption therefore stays narrow.
• The new bats test mirrors the existing per-gate tests and uses the issue's real metrics row.
• Non-blocking, from the QA Lead advisory: (a) the producer defect that caused the real failures, a sync PR with no manifest (#2366), should be tracked separately so this exemption doesn't hide it. (b) A whole-list test of the FLEET_GATE_WORKFLOWS default and a near-miss name test would harden the allowlist.
• No unresolved review threads. CodeRabbit approved, and the SonarCloud quality gate passed.
• MCP secret scan: run_secret_scanning was not available in this run. The diff contains no secrets or credentials, and gitleaks passed.

CI status

All required checks green: Lint, shellcheck/ShellCheck, bats, unit-tests, CodeQL, SonarCloud, gitleaks, actionlint, AgentShield, and the validate-* suite. Two earlier sync-scope-guard and guard runs show CANCELLED. Each workflow sets concurrency: cancel-in-progress, so a newer run superseded them, and the superseding runs on the same SHA passed. Remaining entries are SKIPPED (not applicable).

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 5.5 [opus 4.8, opus 4.7]). Reply if you need a human review.

[donpetry-bot]

pr-review approved on PARTIAL advisory evidence: 2/5 required advisory bots reported before the gate's head-age-timeout fallback proceeded. Recorded for the miss-rate metric (#1596).

[don-petry]

No description provided.