Invariant 1 is relative to a predicate the repository can render vacuous in one fully validated landing.
One PR replaces the body of .github/workflows/jsmnmq.yml with a no-op. It is validated by the OLD workflow, lands legitimately, and becomes the dispatch source for every candidate after it. From then on every value of main carries "complete required validation" in the event log while nothing has been tested.
Bar A's independent detector reconstructs its verdict from that log, so it will agree forever. This converts Bar A from a safety measurement into a measurement of the repository's code review, and it is invisible in every metric the project commits to.
CONFIGURATION §1.2 floors which targets and adapters may be named, and §6 forbids an empty target set — but nothing floors the workflow's body.
The fix already exists in the docs as an alternative. CONFIGURATION §3.1 offers "landed policy OR an immutable approved workflow SHA". Making that mandatory is close to a one-word change.
Options
Verify by experiment: write the minimal PR that no-ops the workflow and confirm every downstream check still reports green.
Related: this is why W1's detector should arguably be a gate (a second required status context pinned to a second App ID) rather than an observer — but see the availability tradeoff, since an empty bypass list makes control-plane downtime into trunk downtime and disables the revert lane precisely during the outage that needs it.
See docs/INVESTIGATION.md §6 Q4, §3 assumption 4.
Invariant 1 is relative to a predicate the repository can render vacuous in one fully validated landing.
One PR replaces the body of
.github/workflows/jsmnmq.ymlwith a no-op. It is validated by the OLD workflow, lands legitimately, and becomes the dispatch source for every candidate after it. From then on every value ofmaincarries "complete required validation" in the event log while nothing has been tested.Bar A's independent detector reconstructs its verdict from that log, so it will agree forever. This converts Bar A from a safety measurement into a measurement of the repository's code review, and it is invisible in every metric the project commits to.
CONFIGURATION §1.2 floors which targets and adapters may be named, and §6 forbids an empty target set — but nothing floors the workflow's body.
The fix already exists in the docs as an alternative. CONFIGURATION §3.1 offers "landed policy OR an immutable approved workflow SHA". Making that mandatory is close to a one-word change.
Options
Verify by experiment: write the minimal PR that no-ops the workflow and confirm every downstream check still reports green.
Related: this is why W1's detector should arguably be a gate (a second required status context pinned to a second App ID) rather than an observer — but see the availability tradeoff, since an empty bypass list makes control-plane downtime into trunk downtime and disables the revert lane precisely during the outage that needs it.
See
docs/INVESTIGATION.md§6 Q4, §3 assumption 4.