[systemfsoftware-maker]

Summary

#155 dropped three verifications from CI; this restores them. The merge queue can see the check it requires again (actionlint + version surfaces), CI again fails when the Nix-built binary reports a version other than package.json's, and the platform workflow again fails on an unknown mode instead of passing having built nothing. .mergify.yml is unchanged.

Which case it was

The version-surfaces verification was dropped, not just renamed. Commit 5958ac8 (#155, "fix: check .nix files; stop testing configuration") changed the checks job in one edit:

• name: actionlint + version surfaces became name: actionlint.
• The step Version surfaces agree (release.jsonc, checked by the locked release toolchain) (version-management sync check) was deleted.

.mergify.yml, added earlier in 9e44128 (#141), still requires check-success = actionlint + version surfaces, so no PR could satisfy it. git log -S'actionlint + version surfaces' shows 5958ac8 as the only commit that removed the string from the workflow, and nothing on master runs version-management sync check any more. The step first came from 44e1c87 (#138), which retired the repository-local version gate in favour of this toolchain check.

The first commit restores the job name and the step as they were before #155. On master the check passes (sync-versions: ok — 0.3.6 across the manifest and every surface), so restoring it does not turn existing PRs red.

Other checks #155 dropped

• Built binary version (nix job, "Smoke the built binary version"): compares comment-checker --version from the Nix build with claude-code-comment-checker <package.json version>. It was the binary-identity check 44e1c87 kept when it retired run-binary-smoke.ts. Restored with the same command; the rationale for smoking the unwrapped binary (the bwrap wrapper needs --unshare-net, which Actions containers do not permit) moved from a YAML comment into the step name, because this repository's comment checker flags it as redundant.
• Unknown mode (platform.yml, "Reject unknown mode"): without it a typo in a caller's mode skips every inputs.mode == ... step and the job goes green having built and staged nothing. fix: check .nix files; stop testing configuration #155's description lists this among the deletions as checking only configuration. It guards a caller-supplied input, so it is restored as it was.

Left deleted

The hook_commands.rs changes in #155 stay as they are:

• repo_settings_hook_runs_the_readme_hook_command asserted that two config files hold the same string. It restates the configuration and exercises no behavior.
• exactly_one (now first) counted the hook entries in config files. Same reason.
• real_direnv_exits_1_without_running_the_command_when_envrc_is_blocked_or_command_is_missing runs only the direnv binary and never the hook script or the checker, so it tests a third party's behavior and fails or passes with no change to this repository. Its direnv install step in rust-gate.yml is tooling for that test alone, so it stays deleted too.

Unapplied review findings

• P3 — .mergify.yml:14 — merge_conditions do not include actionlint + version surfaces. Intended: the commit and surface checks are judged on the PR, the gate on the queue draft, as in systemfsoftware/systemfsoftware.

Residual risk: nothing checks that the check names in .mergify.yml match the workflow's job names, so another rename would strand the queue the same way.

The Mergify rule that stops approvals from queueing PRs on master is fixed at its source in the organization's .github repository, in its own PR.

Testing

• nix shell --inputs-from . pnpm-release-management#release-tools -c version-management sync check exits 0.
• The restored smoke command, run locally: Nix-built binary reports claude-code-comment-checker 0.3.6, equal to the expected value.
• The restored mode case statement, run locally under bash: rehearsal exits 0, bogus exits 1 with the message.
• actionlint (locked nixpkgs) exits 0.
• cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test --all-targets pass locally. Mutation was not run: no classifier change.
• Pending on CI: the actionlint + version surfaces, nix flake check and packaging / rehearsal jobs on this PR's head.
• Code review: focused path with one local adversarial reviewer (run 20261111-015121-2650e7a1, status complete, depth focused) on the first commit. The later commits restore deleted lines verbatim and were not separately reviewed.

---

[kiro-systemf]

Independent review at d46d8ae: Ready to merge. Each verification #155 removed is restored as it was and can fail; the one P3 on the three left-deleted hook_commands.rs tests is not a missing verification.

[systemfsoftware-bot]

@Mergifyio queue

[mergify]

✅ Merged into master as a77129c at 04:40 UTC

5 min in the queue, 3 min of it CI.

So far

• ✅ Entered the queue Wed 11 Nov, 04:36 · rule default · triggered by @systemfsoftware-bot with the @mergifyio queue command
• ✅ Passed · draft merge queue: merged #165: fix(ci): restore the version and mode checks #155 dropped #167
• ✅ Merged 04:40 · a77129c · squash

3 merge conditions met

• check-success = gate / gate
• check-success = nix flake check
• github-review-approved · required by GitHub repository ruleset rule main

_{Times in UTC · dashboard · how the merge queue works}