Description
The guarded loop13 release review found that the existing CI aggregate rejects failed or cancelled required jobs but can treat skipped required leaves as success. This loop directly checked all required leaves at each accepted SHA. A later gate repair needs guarded workflow scope and does not follow from a green aggregate.
Acceptance Criteria
- #1 Aggregate is green only when every required leaf is explicitly successful; failed, cancelled, skipped and missing states cannot be accepted.
- #2 A resource-bounded negative control observes skipped required leaves failing the aggregate, with actionlint/zizmor and independent guarded review before landing.
Definition of Done
- #1 just test
- #2 just tf-validate
- #3 just check-identifiers and just no-em-dashes both return clean
Implementation Plan
Fail-first bounded aggregate negative control; require success for all required leaves; local validators, CodeRabbit and independent guarded review before landing.
Implementation Notes
loop14: one implementation attempt, guarded review and CodeRabbit completed0 findings; fail-first actual-workflow shell negative control observed13 failures, corrected candidate rejects18 negative cases. Exact integrated SHA9fb033bdfff72765188b5427469e786005292438 just check exit0 and required GitHub CI leaves explicitly successful. Two skipped suite tests are not passes.