The token/exec split gives slices-comment NO checkout by design, and gh's
pr-comment subcommand resolves the repo FROM git — it died with 'not a git
repository' on PR #2746's first run (the update-existing PATCH path was
already explicit-repo REST and worked). Create now posts through
gh api repos/.../issues/N/comments, and the wiring test pins that no
git-context-requiring comment call can creep back into the job.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Token/exec separation restored: slices-report (runs PR-authored code:
bun install + the reconcile runner) drops to contents:read; the PR
comment moves to a NEW slices-comment job holding the write token with
ZERO repo code — no checkout, no bun, only downloaded artifacts + jq/gh.
$GITHUB_ENV/BASH_ENV persistence is job-scoped, so the split is the
boundary. The matrix-era report job had this property; the consolidation
had regressed it. Pinned by the wiring test.
- Reconcile exit captured via PIPESTATUS[0] in BOTH lanes: GitHub's default
run-step shell has no pipefail, so `$?` after `| tee` was tee's exit —
the fail-closed gate was silently fail-open. Wiring test pins it.
- PR comment: final-attempt accounting restored the dropped COST
accumulation (the dial read $0 forever), flaky passes render as the
warning they are (never as failures), and a malformed tests[] artifact
skips that file instead of aborting the whole comment under bash -e.
- Remaining mutable action tags pinned (free-tests upload-artifact,
ci-image checkout/docker trio — the image publisher holds packages:write
and feeds the secret-bearing lanes). restore-deps fallback installs
--frozen-lockfile; register-gstack-skills validates skill names before
its rm -rf.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Every PR paid twice: the hand-enumerated matrix (18 test files, 22.6 min,
~$21 API measured on run 33263204465) ran serialized AHEAD of the strictly
superior sliced lane via 'needs: evals' — 35.5 min wall and ~2x paid spend
for the same diff. 14 of 17 rows carried no tier:, so periodic Opus
benchmarks leaked into every PR (the e2e-plan row alone: 12/12 tests,
21.7 min, $7.28 — the wall-clock bound of ALL of CI).
Parity receipt (static, pre-deletion): the sliced lane's gate census (49
files, derived from the runner itself) strictly contains all 18 matrix test
files, plus 31 files the matrix never ran. Pure deletion — one revert
restores it. The PR comment moved into slices-report (same '## E2E Evals'
upsert marker, now sourced from slice artifacts + carrying the fail-closed
reconciliation verdict). plan-slices loses the needs edge; the dead
workflow-level EVALS_TIER env goes with it.
test/evals-workflow-matrix.test.ts (and its KNOWN_MATRIX_GAPS /
KNOWN_TIER_UNSET burn-down ratchets — retired: the sliced census makes
'every gate file runs' true by construction) is rewritten as
test/evals-workflow-wiring.test.ts: matrix stays deleted, planner/executor/
report tier + slice-count agreement, both surviving lanes on the shared
register-skills composite with its fail-fast verification loop, PR comment
survival. Expected: PR eval wall 35.5 -> ~13 min, per-PR paid spend ~halved.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
