Make validate prove complete local-branch readiness before push or PR

Open
  • Is something wrong?
#1,069 1 comment 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@alexhraber is already working on this.

Since Jul 27, 2026.

  • #1552 by @alexhraber — closed without merging

Assessment

This issue has not been assessed yet.

Description

ci hermes proof validation

Summary

Block the completion verdict until all required CI checks for the current PR head SHA are green. Publication is allowed (it starts the CI cycle); completion is gated.

Invariant

A governed PR is only complete when its current remote head SHA has all required checks passing. Every push invalidates prior remote proof.

Observed failure

PR #1051: head SHA 473120a (then ddffaced) had check "Governance Artifacts (all four)" failing. No mechanism blocked completion.

Scope

Remote completion gate. Not publication (which must succeed to trigger CI).

Non-goals

  • Publication mechanics (#1064)
  • Evidence ingestion (#1070)
  • Local validation (#1073 preflight)

Proposed contract

Command (illustrative): decapod workspace complete --pr <number>

State machine

workspace_ready
  -> publish (allowed, creates new remote head)
  -> remote_checks_pending
      -> remote_checks_green -> complete (allowed)
      -> remote_checks_failed -> remediate -> republish
      -> remote_checks_unavailable -> blocked (missing auth)

Check resolution

  1. Resolve PR -> target branch, remote, current head SHA
  2. Query GitHub Checks API for that SHA
  3. Classify each check:
    • required (default: all non-skipped in workflow)
    • optional (explicitly listed)
    • pending/running -> gate waits
    • success -> satisfied
    • failure/cancelled/timed_out -> block
    • neutral/skipped -> satisfied (unless explicitly required)
    • unavailable (missing auth) -> blocked

Blocking response

Cannot complete PR #1051 (head: ddffacedb838)
Required checks failing:
  - Governance Artifacts (all four): failure (run 30226189538)
Pending checks: none
Unavailable:
  - Propodus Live Contract Proof: unavailable (no credentials)
Run `gh pr checks 1051` for details.
Override: decapod workspace complete --pr 1051 --waive <check-name> (records waived state)

Override/waiver

  • --waive <check> records waived state in trajectory
  • Never produces false green verdict
  • Waived completion is distinctly tagged

Output (JSON):

{
  "pr": 1051,
  "head_sha": "ddffacedb838",
  "required_checks": ["Governance Artifacts (all four)", "Lint (clippy)", "Tests (core)"],
  "status": "blocked",
  "failing": ["Governance Artifacts (all four)"],
  "pending": [],
  "waived": [],
  "unavailable": ["Propodus Live Contract Proof"],
  "completed": false
}

Acceptance criteria

  • Resolves exact PR head SHA before checking
  • Distinguishes pending, success, failure, cancelled, neutral, skipped, unavailable
  • Blocks completion on any required failure
  • Allows publication (starts CI cycle)
  • Invalidates prior remote proof after every push
  • Missing GitHub auth -> unavailable, not passed
  • Waiver records distinct waived state, never false green

Regression tests

  1. PR with all green -> complete allowed
  2. PR with one required failure -> complete blocked, shows failing check
  3. PR with pending checks -> complete blocked, waits or reports pending
  4. PR with unavailable check (no auth) -> complete blocked, shows unavailable
  5. Push to PR -> prior proof invalidated, re-check required
  6. Waiver -> completion allowed but tagged waived

Relationships

  • Consumes #1070 remote evidence
  • Requires #1064 publication to create remote head
  • Sequence: #1071 -> #1066 -> #1064 -> #1059/#1065 -> #1072 -> #1070 -> #1069
Dominant language
Rust
Stars
233
Forks
23
Avg merge
2h 16m
Merged PRs (30d)
163

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from DecapodLabs/decapod

All issues in DecapodLabs/decapod

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.