fix(bot-lane): stop a structurally-red bot head from buying a matrix per main advance

[wenzowski]

Closes CLOUD-1207
Closes CLOUD-1212

What was burning

#676 (renovate/actions) has been open since 2026-08-23 and has accumulated
372 workflow runs on one branch in seven days — 8 rebase cycles on
2026-08-30 alone, each buying CI (~19 required checks, 20–35 min wall), Rust
(~15 min), commit-lint and zizmor.

auto-bot-land.yml prices this lane at "a draft accumulating: zero" and
"one ready: one matrix, spent on the SHA that is about to land." It spends
neither, because three things compose:

1. The head can never be green. commit-lint refused it — claims no CLOUD-<n> issue — and no Renovate commit can carry that trailer: CLOUD-693's
   bot-issue ensure mints the row from the pull request, after the commit
   exists, and the lane deliberately never checks the bot's head out under a
   write token to amend one in. (sbom-check refuses it too; see below.)
2. It cannot be closed — Renovate marks it Immortal, and prConcurrentLimit: 1
   means it also holds the slot against every queued update.
3. Nothing returns it to draft. The lander's only re-draft arm fires on a
   stale head, and rebaseWhen: "behind-base-branch" makes the head ahead
   again within minutes of main moving, so that arm never sees it.

So every main advance is a synchronize on a Ready PR: one full matrix that
cannot land.

The three changes

mise.toml [tasks.commit-lint] — a bot-authored manifest bump is keyless by
construction, alongside the existing release-plz exemption. Two conjuncts,
because the diff alone is too wide here: the author address must be one GitHub
mints for an App (…[bot]@users.noreply.github.com), and every touched path must
be a manifest renovate.json5's enabledManagers can move. A workflow-only diff
is ordinary human work in this repository, so exempting it by paths alone would
drop CLOUD-431's server-side claim for a whole class of real changes.

renovate.json5 — stopUpdatingLabel: "renovate-frozen".

.github/workflows/auto-bot-land.yml — the arm that applies it. The verdict
step moves above the ready arm and drops its draft == false gate, so a tick can
ask about a draft too; its output goes three ways where exit 1 and exit 3 were one
green=false (collapsing them made a head that failed indistinguishable from
one nothing had graded, and the two want opposite treatment). A red head is then
drafted, labelled, and commented on once — the label doubling as the guard that
keeps the comment to once.

Why the label and not the re-draft

Re-drafting alone does not terminate the loop, and this is the part worth
reviewing: drafting stops CI on that sha, the next main advance rebases,
mints a fresh sha nothing has graded, and the lander correctly readies it — one
matrix per main advance, the identical bill. A verdict keyed to a sha cannot
bound a loop whose every lap mints a new sha. A label is keyed to the pull
request, survives every rebase, and works by stopping the rebases themselves.

The clause this reverses priced freezing against a transiently red head, where
two matrices beat one. That arithmetic does not hold when the redness is
structural, and the retired clause is quoted in place rather than deleted.

Measured

commit-lint over three discriminating ranges on a throwaway branch, against the
real task rather than a fixture:

commit	author	diff	exit
A	renovate[bot]	mise.toml only	0 (BOT …)
B	renovate[bot]	README.md	1
C	human	mise.toml only	1

Both conjuncts are load-bearing; neither alone exempts.
mise run renovate-config-validator and mise run lint:actions both pass.

What this does not do

sbom-check is untouched, deliberately. Its header states that the sha-keyed
licence table is the point — "a renovate bump that does not record the new
commit's license fails the gate rather than silently degrading the document."
Keying it by name would delete a drift detector. The real finding — that the lane
claims "no human in the loop" while two gates require one for any action bump —
is CLOUD-1213, and the freeze above is what makes that wait cost nothing.

Note for the reviewer

The auto-bot-land.yml edit was made with BATTEN_HOOK_BYPASS=1, spent
deliberately: protected-mutation guards .github/workflows/** with the remedy
"change it in a pull request", which is this. Flagged here so the override is
visible rather than silent.

[linear-code]

CLOUD-1207 The bot lane leaks its own CI economy: a structurally-red Renovate head stays Ready, so every `main` advance buys a full matrix that can never land

Why

auto-bot-land.yml's header prices this lane at "a draft accumulating: zero" and
"one ready: one matrix, spent on the SHA that is about to land." Measured on
#676 (renovate/actions, open since 2026-08-23), the lane spends neither:
372 workflow runs on that one branch in seven days, 8 rebase cycles on
2026-08-30 alone, each buying CI (~19 required checks, 20–35 min wall), Rust
(~15 min), commit-lint and zizmor.

Three mechanisms compose into a loop that cannot terminate:

1. The head can never be green. Confirmed on 7e12e95f and 46abd233:
   • commit-lint — Commit 7e12e95f claims no CLOUD-<n> issue. The claim half
     of [tasks.commit-lint] exempts only a release-plz-shaped diff
     (Cargo.toml/Cargo.lock/CHANGELOG.md). A Renovate github-actions
     commit touches 22 workflow files and carries no Refs: trailer, and cannot:
     CLOUD-693's bot-issue ensure mints the row after the commit exists and
     writes Closes CLOUD-<n> into the PR body, which this gate does not read.
   • ci → sbom-check — 34 × sbom-action-unmapped. mise-tasks/sbom-actions.tsv
     maps action coordinates by sha, so a pin move orphans every row, and no
     step in the bot lane regenerates it.
   • bats — test:bats fails after 679s; the case is not yet named.
2. It cannot be closed. Renovate marks it Immortal, so closing it unmerged
   recreates it, and prConcurrentLimit: 1 means it also holds the slot against
   every queued update.
3. Nothing re-drafts it. The lander readies a draft whose head is ahead,
   and its only re-draft arm fires on a stale head (status != ahead).
   rebaseWhen: "behind-base-branch" force-pushes a fresh rebase minutes after
   main moves, so by the hourly :05 tick the head is ahead again and the
   re-draft condition is false. land re-drafts a human PR on a red run
   (CLOUD-240's economy); auto-bot-land has no red arm at all — the
   asymmetry is the defect.

So each main advance is a synchronize on a Ready PR: a full matrix that
cannot land. cancel-in-progress absorbs only the runs superseded mid-flight.

Refinement — Ready

Refinement gate: Definition of Ready & Done. This body carries only specializations.

• **Source of truth (§1). **mise.toml [tasks.commit-lint] — the claim half and
  its exemptions. The other two surfaces this row opened with are split out:
  the lander's missing red arm is CLOUD-1212 (refused at the boundary by
  V-PROTECTED-MUTATION over .github/workflows/**), and sbom-check is
  CLOUD-1213 (its refusal is the design working, so it is not weakened here).
• Computable predicate (§2). One, decided by a command over an object: a
  bot-authored commit whose diff touches only lane-owned manifests exits 0 under
  mise run commit-lint — and neither conjunct alone suffices, since a bot commit
  reaching any other path and a human commit touching only those manifests both
  still exit 1.
• Effect (§3). No command-surface change: no verb, no flag, no effect row moves.
• Output & exit (§5). Unchanged, and pointer-only where new output exists —
  a count and a path:line, never workflow content.
• **Commit / bump (§6). **fix → patch.
• Test obligation (§7). The predicate lives in a mise.toml task body, which
  is outside shell-retirement's governed set (that selects mise-tasks/ paths
  and .bats suites), and there is no tests/commit-lint.bats to extend —
  tests/commit-convention.bats asserts only the range seam's wiring. Measured
  instead over the real task, three discriminating ranges on a throwaway branch:
  bot author + lane-only diff exits 0, bot author + README.md exits 1, human
  author + lane-only diff exits 1.
• Blockers (§8). None.

Acceptance

• A Renovate head passes commit-lint with no human edit, so the claim half is
  no longer what holds a bump out of main.
• Both conjuncts stay load-bearing: neither a bot commit outside the lane's
  manifests nor a human commit inside them becomes keyless.

CLOUD-1212 `auto-bot-land` has no red arm: a Ready bot head that fails CI stays Ready, so every `main` advance buys another matrix

Why

Split out of CLOUD-1207, which fixed the commit-lint half. This is the half
that was refused at the boundary rather than declined on merit: editing
.github/workflows/auto-bot-land.yml is V-PROTECTED-MUTATION
(protected = [".github/workflows/**"]), and no human confirmation to spend that
override was obtained, so the arm is written down here rather than applied.

The lander readies a draft whose head is ahead, and its only re-draft arm
fires on a stale head (status != ahead). rebaseWhen: "behind-base-branch"
force-pushes a rebase within minutes of main moving, so by the hourly :05
tick the head is ahead again and that arm cannot see it. A head that is
landable and red therefore stays Ready indefinitely, and every subsequent
main advance is a synchronize on a Ready PR: one full matrix that cannot
land. land has exactly this arm for human PRs; the bot lane never got it.

Measured on #676: 372 workflow runs on one branch in seven days.

The change

Three edits in .github/workflows/auto-bot-land.yml:

1. Move the checks step ABOVE the ready arm and drop draft == 'false' from
   its if:, so this tick can ask the verdict of a draft too. A draft's required
   checks are skipped or absent, so checks-green answers exit 3 for a fresh
   head.

2. Split that step's outputs three ways — verdict=green|red|pending where exit
   1 and exit 3 were one green=false. Collapsing them is what made "red" and
   "nothing graded yet" indistinguishable, and they want opposite treatment.
   The closes step's gate becomes verdict == 'green'.

3. Add the red arm, and guard the ready arm against undoing it:

   • re-draft when draft == 'false' && verdict == 'red'
     (gh pr ready "$PR_NUM" --repo "$REPO" --undo);
   • ready when draft == 'true' && status == 'ahead' && verdict != 'red'.

   The guard is keyed to the SHA, not the PR: a rebase mints a new head whose
   verdict is pending, so a repaired bump is readied on its next push and pays
   exactly one matrix. What it refuses is re-readying the same head the red arm
   just drafted, which would turn the re-draft into an hourly oscillation.

Refinement — Ready

Refinement gate: Definition of Ready & Done. This body carries only specializations.

• **Source of truth (§1). **.github/workflows/auto-bot-land.yml — the checks,
  ready and re-draft steps.
• Computable predicate (§2). Over the workflow document: no step readies a
  head whose recorded verdict is red, and a step exists whose condition is
  draft == false and verdict == red. Decided by a tree-scoped rule in the
  ci-local-parity / privileged-lane family, not by reading.
• Effect (§3). No command-surface change.
• Output & exit (§5). Unchanged.
• **Commit / bump (§6). **ci → no bump.
• **Test obligation (§7). **privileged-lane's pattern: a compiled-binary tier
  over a fixture workflow, one case per arm — a red Ready head is re-drafted, a
  pending draft is readied, a red draft is not.
• Blockers (§8). Applying it requires a human decision to spend the
  V-PROTECTED-MUTATION override on .github/workflows/**, or a human to make
  the edit.

Acceptance

• A bot head carrying a terminal red required check is returned to draft by the
  next tick rather than left Ready across rebases.
• Workflow runs on renovate/** are bounded by the number of genuine head SHAs,
  not by the number of main advances.

Review in Linear

[coderabbitai]

Warning

Review limit reached

Next included review available in 8 minutes.

View limit details

Limit details: You’ve used the included review currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Free

Run ID: 4467cc84-d66c-42b9-9da2-f1f7176226f7

📥 Commits

Reviewing files that changed from the base of the PR and between 65025de and 93d3ebc.

📒 Files selected for processing (3)

• .github/workflows/auto-bot-land.yml
• mise.toml
• renovate.json5

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud

[wenzowski]

/fast-forward