mvillmow · Sep 13, 2026 · Aug 31, 2026
@@ -12,13 +12,13 @@ security scanning of the Keystone HMAS (Hierarchical Multi-Agent System) codebas
 - **`extras.yml`** emits the separately required `coverage` context and advisory
   benchmark/NATS checks.
 - **`release-please.yml`** manages releases after pushes to `main`.
-- **`merge-queue-smoke.yml`** is the ONLY workflow that runs for
-  `merge_group/checks_requested`. It runs a single fast `merge-queue-smoke`
-  job (< 5 minutes, one runner slot) of real validation steps. Full CI
-  validates every commit at pull-request time and is left untouched.
 
-Existing push, pull-request, manual, and scheduled behavior is unchanged; only
-the merge-queue surface moved to the dedicated smoke workflow.
+The live baseline also requires `_required.yml`'s `install` job; the complete
+context list is recorded in the quality-gates guide below.
+
+The required and extras workflows execute their real jobs for both pull-request
+and `merge_group/checks_requested` commits. Event-and-SHA-scoped concurrency
+keeps those independent validation runs from cancelling one another.
 
 ## Workflow Details
 
@@ -205,15 +205,19 @@ All workflows run on:
 
 ### Merge Queue
 
-Only `merge-queue-smoke.yml` runs for `merge_group/checks_requested`. GitHub
-creates that event against the speculative group ref; the `merge-queue-smoke`
-job re-validates fast repository invariants there, while the exhaustive suites
-run at pull-request time (each queued commit already passed them on its PR).
-
-Queue activation is a separate post-merge administration step (every ruleset's
-required contexts must first be replaced with `merge-queue-smoke`). See
+`_required.yml` and `extras.yml` both run for `merge_group/checks_requested`.
+GitHub creates that event against the speculative group ref, and every live
+required context is re-emitted by the same real producers that validate pull
+requests.
+
+Queue activation and any required-context cutover remain separate post-merge
+administration steps. The active queue currently uses `HEADGREEN`; this
+producer change does not mutate it.
+[Keystone #671](https://github.com/HomericIntelligence/Keystone/issues/671)
+owns the live emit-before-require cutover, full ruleset read-back, and rollback
+evidence. See
 [CI/CD Quality Gates](../../docs/CICD_QUALITY_GATES.md#merge-queue-activation)
-for the preserved required-context baseline and approved queue policy.
+for the observed live state and ownership boundary.
 
 ### Push Events
 

@@ -12,10 +12,13 @@ on:
   pull_request:
     branches: [main, develop]
 
+  merge_group:
+    types: [checks_requested]
+
   workflow_dispatch:
 
 concurrency:
-  group: required-${{ github.ref }}
+  group: required-${{ github.event_name }}-${{ github.sha }}
   cancel-in-progress: true
 
 permissions:

@@ -1,25 +1,20 @@
 name: Extras (non-blocking)
 
-# Benchmarks, NATS integration, and coverage — informational only, not required for merge.
-# These jobs produce build artifacts and Codecov reports but do not block PRs.
+# Benchmarks and NATS integration are informational. Coverage emits a live
+# required context, so the complete workflow runs for pull requests and
+# synthetic merge-group commits.
 
 on:
   push:
     branches: [main, develop, "claude/**"]
   pull_request:
     branches: [main, develop]
-  # The `coverage` context is required by the live main ruleset, so this
-  # workflow must keep triggering on merge_group to emit it until the
-  # ruleset is flipped to require only merge-queue-smoke (tracked
-  # separately; needs org-admin credentials to execute). Every job below
-  # skips merge-queue builds (`if: github.event_name != 'merge_group'`): the
-  # skipped conclusion satisfies the required context, while under ALLGREEN
-  # grouping an actually-run sub-threshold `coverage` reading (it exits 1
-  # below its 75% target) would eject otherwise-green PRs from the queue.
+  merge_group:
+    types: [checks_requested]
   workflow_dispatch:
 
 concurrency:
-  group: extras-${{ github.ref }}
+  group: extras-${{ github.event_name }}-${{ github.sha }}
   cancel-in-progress: true
 
 permissions:
@@ -28,7 +23,6 @@ permissions:
 jobs:
   benchmarks:
     name: benchmarks
-    if: github.event_name != 'merge_group'
     runs-on: ubuntu-24.04
     # Raised from 20 to 30: the install-build-deps step (apt-get update + conan
     # install) intermittently exceeds 20 minutes on GitHub-hosted runners during
@@ -98,7 +92,6 @@ jobs:
 
   nats-integration:
     name: NATS integration tests
-    if: github.event_name != 'merge_group'
     runs-on: ubuntu-24.04
     # 20 (was 15): leave headroom for a cold dev-image rebuild — any
     # Containerfile/conanfile.py change misses the exact-match image cache in
@@ -179,7 +172,6 @@ jobs:
 
   coverage:
     name: coverage
-    if: github.event_name != 'merge_group'
     runs-on: ubuntu-24.04
     timeout-minutes: 25
 

@@ -298,7 +298,8 @@ The `quality-summary` job runs after all quality gates complete:
 The live `main` rulesets require these existing GitHub Actions contexts. Merge
 queue rollout must preserve all of them:
 
-- `lint`, `unit-tests`, `integration-tests`, `test`, `build`, and `package`
+- `lint`, `unit-tests`, `integration-tests`, `test`, `build`, `install`, and
+  `package`
 - `security/dependency-scan` and `security/secrets-scan`
 - `schema-validation` and `deps/version-sync`
 - `coverage` and `release`
@@ -310,47 +311,21 @@ rules.
 
 ## Merge Queue Activation
 
-The workflows are prepared for a staged merge-queue rollout by handling
-`merge_group/checks_requested`. This repository has no canonical, repo-owned
-ruleset configuration file, so an administrator must perform activation only
-after this readiness change merges and the repository smoke check is ready.
-
-Add one `merge_queue` rule to the existing active `homeric-main-baseline`
-ruleset while preserving every existing condition, bypass actor, rule, required
-context, and enforcement field. The rule must use this exact payload:
-
-```json
-{
-  "type": "merge_queue",
-  "parameters": {
-    "check_response_timeout_minutes": 60,
-    "grouping_strategy": "ALLGREEN",
-    "max_entries_to_build": 10,
-    "max_entries_to_merge": 5,
-    "merge_method": "SQUASH",
-    "min_entries_to_merge": 1,
-    "min_entries_to_merge_wait_minutes": 5
-  }
-}
-```
-
-Activation is a full-replacement ruleset write and therefore requires this
-operator sequence:
-
-1. Fetch and retain the complete live ruleset as the rollback snapshot.
-2. Verify the snapshot includes all required contexts listed above and every
-   current non-queue rule.
-3. Append only the queue rule, update the ruleset, and read it back.
-4. Compare the read-back with the snapshot, allowing only the new queue rule.
-   If any unrelated field changed, immediately restore the snapshot.
-5. Enqueue one representative pull request and record the
-   `merge_group/checks_requested` workflow run, all required check conclusions,
-   and the queued squash merge result on
-   [Keystone #610](https://github.com/HomericIntelligence/Keystone/issues/610).
-
-This activation belongs to the post-merge rollout tracked by
-[Odysseus #386](https://github.com/HomericIntelligence/Odysseus/issues/386); it
-must not be performed from the implementation PR.
+The active `homeric-main-baseline` ruleset already has a merge queue. Its
+observed live queue state is `HEADGREEN` with 10 entries building concurrently,
+groups of 1–5 entries, a five-minute group wait, a 60-minute check timeout, and
+squash merge. These values describe current state; they are not an executable
+desired-state template, and this producer change does not mutate them.
+
+The required and extras workflows handle `merge_group/checks_requested` so a
+representative synthetic commit can emit the same real contexts as its pull
+request. Live context replacement and the final queue-policy transition are
+owned exclusively by
+[Keystone #671](https://github.com/HomericIntelligence/Keystone/issues/671).
+That operational issue requires snapshot, emit-before-require probes, complete
+GET-derived updates, read-back comparison, and rollback evidence before the
+queue moves to its final 180-minute aggregate-gate baseline. No ruleset write
+or queue activation belongs in this implementation PR.
 
 ## Local Validation
 

@@ -52,6 +52,14 @@ check-extraction:
 check-merge-queue-readiness:
   ./scripts/check-merge-queue-readiness.sh
 
+# Fail-closed GitHub Actions schema validation for both workflow extensions.
+check-workflow-schema:
+  ./scripts/check-workflow-schema.sh
+
+# Prove that semantic workflow-schema failures are rejected.
+test-workflow-schema-validation:
+  ./scripts/test-workflow-schema-validation.sh
+
 format:
   uv run make format
 

@@ -42,6 +42,8 @@ dev = [
     "pytest>=8.0",
     "ruff>=0.9",
     "pip-audit>=2.7",
+    # Fail-closed validation for every committed GitHub Actions workflow.
+    "check-jsonschema>=0.38.0,<1",
 ]
 
 # Tooling-only manifest: there is no importable `keystone` Python package to