health digest 2026-09-28 #6702

Read-only digest, window 2026-09-21 12:20Z → 2026-09-28 12:20Z. Previous: #6385 (already closed by @Hmbown 09-23).

Recommended actions (ranked by impact)

1. main is red at HEAD 0bfe04e1. Test (windows-latest) fails on plugins::builtin::snapshot_tests::concurrent_first_startups_share_one_complete_embedded_snapshot (0 passed; 1 failed, log). Only one failure this week, so possibly flaky. The scheduled Marketplace connection :: catalog job also fails with Core active skill inventory changed; review and run npm run sync:skills (log). Week: main CI 72 success / 31 failure / 53 cancelled of 156 (last week 106/130 failed).
2. Approve the contribution gate for 5 open PRs that have never run CI. Every workflow run on feat(web): move the contribute page onto the dictionary spine (#5337) #6701, feat(web): move the docs vocabulary page onto the dictionary spine (#5337) #6683, feat(web): move session-media onto the docs shell dictionary (#5337) #6625, feat(routing): compatible Decisions transport with durable shadow receipts #6604 and fix(compaction): survive a provider request-body 413 while making room #6642 is action_required, so the required Lint, Test (windows-latest) and npm wrapper smoke checks never reported. All five show BLOCKED despite a green rollup. feat(providers): add Yolo-Auto compatible host #6408 also has CodeQL stuck at action_required.
3. Fix the flaky tests. 21 runs failed then passed on a same-commit rerun (19 CI, 2 Pet conformance). Worst: macOS PTY launch_card_pty::launch_recent_click_then_enter… (also broke main 94130d91), terminal_routes_serve_a_live_engine_session_over_http, the fleet::manager trio, the Version drift tmpdir race (rm: … Directory not empty), and the timing-based persistence-backlog budget (enqueue_elapsed_ns=25881412 exceeds 25000000). See §3.
4. Stop stale generated web artifacts from reaching PRs. Web Frontend :: Lint & Type Check failed 79 times (61 PR, 18 main, green on main since 09-27). Causes: stale facts.generated.ts, generated docs/INSTALL.md output, sync-latest-release/gt-catalog drift, not test logic. docs(i18n): complete the Tier-3 developer and internal docs for EPIC #5482 #6663, docs(i18n): complete the Tier-2 should-have docs for EPIC #5482 #6662, perf(tui): stop walking the whole item store to list or open a thread #6646 and chore(deps): bump rquickjs from 0.12.2 to 0.14.0 #6630 fail on this job right now. Running npm run prebuild in a pre-commit hook or a bot would remove most of these.
5. Triage the issue backlog. 167 open (+52; 119 opened, 67 closed), 88 unlabeled, 24 needs-triage, 11 external-author issues idle > 14 d (§6). Also drop the phantom /search command from docs/CONFIGURATION.md:3077.

1. Open PRs (none stale > 7 d)

12 open, none stale; #6393 (draft) crosses 7 d in ~9 h. 0 unresolved review threads on any.

Required (ruleset 15930115): Lint, Test (windows-latest), npm wrapper smoke (ubuntu-latest). buildkite/codewhale-ci reports on no open PR.

gh pr list -R Hmbown/CodeWhale --state open --limit 100 --json number,author,createdAt,updatedAt,isDraft,mergeable,mergeStateStatus,headRefOid,comments
gh api graphql  # per PR: commits(last:1){statusCheckRollup{contexts}} reviewThreads{isResolved}  -> 0 unresolved on all 12
gh api repos/Hmbown/CodeWhale/rules/branches/main  # required_status_checks: Lint, Test (windows-latest), npm wrapper smoke (ubuntu-latest)
gh api "repos/Hmbown/CodeWhale/actions/runs?head_sha=<sha>"  # per PR head
gh api --paginate "repos/Hmbown/CodeWhale/actions/runs?status=action_required"  # 95 total

2. Stale branches: 0

11 remote branches (last week listed 35 stale; all pruned). The oldest branch without an open PR is release/0.9.12-prep-20260830 (last commit 2026-08-30 20:58Z, 28.6 days; its PR #5744 is closed). No snapshot/* branches.

git fetch --prune; gh api repos/Hmbown/CodeWhale/branches --paginate; git log -1 --format='%cs %an' origin/<b>
2026-08-30 release/0.9.12-prep-20260830   2026-09-22 claude/chromewhale-codewhale-chrome-sz16nj
2026-09-22 claude/trusting-shannon-sgusdh 2026-09-23 docs/404-release-note-receipt
2026-09-25 feat/parity-small-wins         2026-09-25 feat/thread-provider-switch
2026-09-25 feat/workbar                   2026-09-25 fix/6508-head-tail-truncation
2026-09-26 dependabot/cargo/rquickjs-0.14.0  2026-09-26 dependabot/cargo/toml_edit-0.25.15spec-1.1.0
2026-09-28 main

3. CI flake ranking (7 d)

GitHub Actions had 6,503 runs in the window (fetched in 6-hour REST windows; no window hit the 1,000-run cap).

• CI on main: 156 runs (72 success, 31 failure, 53 cancelled).
• CI on PRs: 508 runs (196 success, 95 failure, 206 cancelled, 11 action_required).
• Web Frontend: 79 failures.
• Buildkite codewhale-ci: 0 builds in the window. The token works. The last build is fix(tui): unblock TUI on bare-separator @-mention completion (#1921) #1929 (failed, 2026-09-09).

Failed jobs by name:

Of the Test job failures, 18 were compile errors rather than test failures (13 of them on Windows).

Flaky tests: failed on attempt 1, then passed on a rerun of the same SHA.

PR closes an issue flipped fail→pass on the same SHA 18× (link check re-run after body edits; not a test).

Most frequent failing tests (79 distinct test names; each failed consistently on its commit, so these were broken commits, not flakes):

gh api --paginate "repos/Hmbown/CodeWhale/actions/runs?created=<6h window>&per_page=100"   # 28 windows, 6503 unique runs
gh api "repos/.../actions/runs/<id>/jobs?filter=latest"   # 215 failed CI/Web/OHOS/Pet runs -> failed jobs + steps
gh api "repos/.../actions/jobs/<id>/logs" | rg 'test (\S+) \.\.\. FAILED'   # 193 test-job logs
# flaky: 82 successful reruns (run_attempt>1); gh api runs/<id>/attempts/<n> -> 21 had a failed earlier attempt
curl -H "Authorization: Bearer $BUILDKITE_READ_TOKEN" ".../pipelines/codewhale-ci/builds?created_from=2026-09-21T12:20:00Z"  # -> []

4. Drift checks (fresh --depth 1 clone of main @ 0bfe04e1)

Docs vs product. The code registers 108 commands and 98 aliases (CommandInfo plus contract ContractInfo under crates/tui/src/commands/**). I compared them against backticked /cmd mentions in docs/ and web/.

• In code, not documented (23): /advisor /anchor /balance /branch /exit /feat015ctx /fork /home /import-claude /logout /lsp /new /overview /pin /remote-env /save /structcopy /system /transcript /tree /verbose /voicecontrol /voicesend. The session commands /branch /fork /new /save /tree /remote-env appear because the parser now also reads ContractInfo. /lane and /retry are now documented.
• Documented, not in code: /search in docs/CONFIGURATION.md:3077 (user-facing). The rest are in design or archive docs: /permission /loop /schedule /auto-mode-config /yolo (docs/design/*), and /plan /diagnostics (CHANGELOG_ARCHIVE.md).
• Fixed since last week: /rc and /relay are real commands again. /dryrun, /preview_request and /relaunch are gone from the docs.
• Settings: ConfigCategory::ALL still has 7 categories (Appearance, ModelsProviders, Work, ToolsMcp, Trust, Motion, Advanced) and /setup STEP_SPECS still has 10 steps. No docs page enumerates either list (unchanged).

git clone --depth 1 https://github.com/Hmbown/CodeWhale.git fresh && cd fresh
python3 scripts/check-dead-code-budget.py; bash scripts/release/check-versions.sh --range-audit-advisory
python3 # regex (CommandInfo|ContractInfo){ name, aliases } over crates/tui/src/commands (non-test), vs `/cmd` in docs/**, web/** (excl node_modules/.next)
rg -n 'const ALL: \[ConfigCategory|STEP_SPECS: \[' crates/tui/src/tui

5. Security posture

6. Open issues: 167 (+52 vs last week)

No human comment in more than 14 days: 27 (measured by the latest non-bot comment, or creation date if none).

• External authors (11): feat(desktop): first-class desktop app for project and agent workflows #4986 (JoeKerF), Design: unify route-specific tool projection before request dispatch #5633 and Design: scope MCP secret providers to the owning runtime #5637 (h3c-hexin), Mid-turn guidance: deliver a committed queued follow-up as a steer at the next checkpoint (peek tool rejected) #5625 (ronohara), Replace internal git CLI reads with gix (gitoxide) #5618 (LmeSzinc), Request: zero-sandbox / --no-sandbox mode for local dev #4955 (eugenicum), 输出内容中的文件，能不能支持点击后打开预览，这样不用再去目录中找 #2342 (caeserchen), FreeBSD support (npm binary / pkg) #1097 (Gabriel-Degret, FreeBSD), 未适配中文输入法 #2323 (cmdcorp6534), Continuous Self-Learning from Dialog (Automatic Skill Evolution) #5860 (Edouard-Legoupil), EPIC(docs): review, partially restructure, and fully localize documentation to Chinese #5482 (SparkofSpike, EPIC, 0 comments in 42 d).
• Oldest: Model Lab: turn local session traces into datasets, evals and fine-tuning jobs #1977 (127 d) and Add an indexed codebase_search tool (BM25 or embeddings) #4066 (83 d), both 0 comments. The other 14 are @Hmbown planning issues.

gh issue list -R Hmbown/CodeWhale --state open --limit 1000 --json number,labels,createdAt,comments,author   # 167
# idle = now - max(createdAt, non-github-actions comments) > 14d  -> 27
gh issue list --state closed --search "closed:>=2026-09-21" -> 67 ; --state all --search "created:>=2026-09-21" -> 119