fix(gate): make the review-swarm scripts executable - #172
Merged
Conversation
`review-swarm.yml` executes two of these directly — `swarm-prepare.sh` at
line 53 and `swarm-post.sh` at line 99 — but all three are committed mode
100644, so the job dies with:
swarm-prepare.sh: Permission denied
Process completed with exit code 126
126 is "found but not executable", not a missing file or a credential fault.
Because the scripts come from the immutable gate on `main`, this fails the
`review` check on EVERY flows PR, not just the one you are looking at.
`swarm-verdict.sh` is copied into the PR head rather than executed here, but
it is a gate script of the same kind and is given the bit for consistency.
Found while verifying that adding the missing `RELAY_WORKSPACE_KEY` secret to
this repo fixed the preflight: `Validate cloud authentication` now passes and
the job fails one step later, here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Ld4S9gUGzTjhVhbtX9cTd
Session-Id: fe8515ad-c2bc-4f9a-9b39-88b2ba12f73e
kjgbot
pushed a commit
that referenced
this pull request
Sep 5, 2026
Local 3-lens preswarm review, maintainability lens, on the rebased head. It returned REVIEW_FAILED with three blockers; all three are real. 1. The branch was reverting the swarm scripts' executable bit. It was cut before #172 landed, so `git diff main..HEAD` showed 100755 -> 100644 on all three gate scripts -- the silent-merge shape where a clean merge undoes someone else's fix. Rebased onto main; the .github diff is now zero lines. 2. The release guard was an unindented IIFE. ~40 lines sat at the same indent as the outer body, so the boundary that decides whether work is covered by the release was invisible. Extracted to `spawn_claimed_run`, whose doc says plainly that `register` is last on purpose and that work added after the call is outside the guarantee. 3. A comment still asserted the registry repairs any claim whose run was never registered. That stopped being true in the previous commit: repair is now conditional on the boot, and the same-boot case is handled by `release_claim`. Rewritten to say which recovery applies when. Also from the same review: replaced the `duplicate column name` message match with a `PRAGMA table_info` probe (SQLite's wording is not a contract), renamed the retry constants to `WAL_SWITCH_RETRY_*` so they do not read as a general policy, moved the test module's imports back to the top, folded the three boot-id constructions into `new_boot_id()`, and dropped the unused path from the extracted return. Not taken, and said out loud in the code instead: a Drop guard for the panic window between claim and register. The gap is real -- a panic strands the event for the life of the boot -- but a Drop that opens a database and cannot report failure is its own mechanism, and bundling it under an exactly-once fix would ship it unreviewed. Tracked separately. Kernel: 148 passed, 0 failed, no warnings. Racing test 30/30 after the refactor. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FtQSAcGDta5VH9xiZFT4sR Session-Id: c228933d-4f94-4d83-9a9a-daf3c83b94f1
This was referenced Sep 5, 2026
kjgbot
pushed a commit
that referenced
this pull request
Sep 5, 2026
Local 3-lens preswarm review, maintainability lens, on the rebased head. It returned REVIEW_FAILED with three blockers; all three are real. 1. The branch was reverting the swarm scripts' executable bit. It was cut before #172 landed, so `git diff main..HEAD` showed 100755 -> 100644 on all three gate scripts -- the silent-merge shape where a clean merge undoes someone else's fix. Rebased onto main; the .github diff is now zero lines. 2. The release guard was an unindented IIFE. ~40 lines sat at the same indent as the outer body, so the boundary that decides whether work is covered by the release was invisible. Extracted to `spawn_claimed_run`, whose doc says plainly that `register` is last on purpose and that work added after the call is outside the guarantee. 3. A comment still asserted the registry repairs any claim whose run was never registered. That stopped being true in the previous commit: repair is now conditional on the boot, and the same-boot case is handled by `release_claim`. Rewritten to say which recovery applies when. Also from the same review: replaced the `duplicate column name` message match with a `PRAGMA table_info` probe (SQLite's wording is not a contract), renamed the retry constants to `WAL_SWITCH_RETRY_*` so they do not read as a general policy, moved the test module's imports back to the top, folded the three boot-id constructions into `new_boot_id()`, and dropped the unused path from the extracted return. Not taken, and said out loud in the code instead: a Drop guard for the panic window between claim and register. The gap is real -- a panic strands the event for the life of the boot -- but a Drop that opens a database and cannot report failure is its own mechanism, and bundling it under an exactly-once fix would ship it unreviewed. Tracked separately. Kernel: 148 passed, 0 failed, no warnings. Racing test 30/30 after the refactor. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FtQSAcGDta5VH9xiZFT4sR Session-Id: c228933d-4f94-4d83-9a9a-daf3c83b94f1 Session-Id: c228933d-4f94-4d83-9a9a-daf3c83b94f1
kjgbot
pushed a commit
that referenced
this pull request
Sep 5, 2026
The previous NEXT.md asked for the cloud review-swarm to be BUILT. It was
built -- `review-swarm.yml` and its three scripts are on main and the
workflow reaches step 6 of 9. A work package describing finished work
burns whoever picks it up, and this repo has recorded that cost before.
Retargeted at what is actually broken:
Step 6 `Launch cloud swarm`:
agent-relay: command not found
##[error]Process completed with exit code 127.
The workflow calls `agent-relay cloud run` and `agent-relay cloud status`
and no step installs the CLI.
**Claim narrowed after review.** A first draft said this failed on "every
run since the gate was written". That is false and self-contradictory:
run 33959293210 died at step 5 with exit 126 (the missing exec bit) and
step 6 was SKIPPED -- a fact the same brief acknowledged two paragraphs
earlier. The supported statement is: every run that REACHED step 6 after
#172 failed with 127.
**The brief now poses the design question instead of hiding it.** On
`pull_request`, GitHub takes `.github/workflows/review-swarm.yml` from
the PR, so an install step written naively into that file is editable by
the author of the PR being judged -- re-opening the exact hole the gate's
`sparse-checkout ... ref: main` closes for its scripts. My first draft
would have had the fixer cheerfully undo the invariant the previous
package established. It now asks where the install should live and
requires an answer in the PR.
The npm lead is also demoted from assertion to something to verify: if
the package is private or differently named, an asserted recipe is a dead
end with no fallback.
**The Lead cannot do this work.** Decision #6 and the charter's second
rail put the gates that judge it outside its write scope, which is why
this is a brief and why the gate has stayed visibly broken rather than
being quietly patched.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FtQSAcGDta5VH9xiZFT4sR
Session-Id: c228933d-4f94-4d83-9a9a-daf3c83b94f1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
reviewcheck fails on every flows PR, and it is one bitreview-swarm.ymlexecutes two of these scripts directly —swarm-prepare.sh(line 53) andswarm-post.sh(line 99) — but all three are committed mode 100644:126 is "found but not executable" — not a missing file, not a credential fault. Since the scripts come from the immutable gate on
main, this failsreviewon every PR in this repo.swarm-verdict.shiscp'd into the PR head rather than executed by this workflow; it gets the bit too for consistency as a gate script of the same kind.How it surfaced, and the evidence it is now the real blocker
AgentWorkforce/flowshad zero Actions secrets, so thereviewjob was failing its preflight on a missingRELAY_WORKSPACE_KEY. That secret has now been added at repository scope (repository, not environment — the job declares noenvironment:, so an environment copy would be invisible and fail identically).Re-running the review job on #168 as attempt 2 moved the failure exactly one step:
So the secret fix is confirmed working, and this is what stands behind it.
Note on merging
The flows auto-merge gate keys on a
🎯 review-swarm: PASSEDmarker — which this PR's own change is required to produce. That is a chicken-and-egg, so this one needs a human merge rather than the usual gate.Not fixed here
#168also failslinux-x64-artifact(~30m), which is unrelated to this and to the secret.🤖 Generated with Claude Code
https://claude.ai/code/session_017Ld4S9gUGzTjhVhbtX9cTd