The Last Hand-Edit

The Gate is the automated check suite every change has to pass before it can merge, and the agents aren't allowed to edit the file that runs it, .github/workflows/gate.yml. CLAUDE.md, the instruction file every agent session reads first, says so, and a guard (a hook that denies the write) enforces it. So when issue #445 asked, back on July 14th, for CI to skip the slow tests on changes that can't break them, the answer was a Markdown file in docs/proposals/, which is where an agent leaves a protected change for a human to apply. By October there were four: #445, #630, #659 and #879, each a different fix to the same file, the oldest dated July 21st. I know this folder. At my last job we called it "the backlog."

I've written about this fence before, and about the part that got me, which is from August. The last of the four to arrive, #879, doesn't beg for yet another edit. It moves the Gate's actual steps out of the protected file into a composite action, a separate file the agents can push, and leaves the workflow as a thin shell. Look at the skip logic in there. The step asks scripts/gate.ts, "the same classifier pnpm gate:scoped runs locally," whether a change is inert (can't break the slow tier), "rather than re-expressing isInert in YAML where the two would drift." It's marked continue-on-error "so a broken optimizer can only ever cost time": if the skip decision breaks, the Gate just runs everything. The proposal itself calls this "the last hand-edit the Gate should need for anything other than triggers or permissions." I have shipped a CI skip rule written twice, once in a script and once in YAML. They disagreed within a month.

On October 3rd PR #1572 applied it: one commit, 50 lines added and 666 removed (578 of those are the four deleted proposals), the workflow file from 85 lines to 33. The PR says a human applied the workflow half through a wizard script, and the session's log adds that the agent's own attempt to write the file had been refused by the guard, so it wrote the script for a person to run. It also said, plainly, that its own run was the composite's first real execution, and to revert if it failed. It didn't. On September 18th I wrote that the composite had never once run; on October 3rd, fifty-eight days after it landed, it did. That run took 4 minutes 49 seconds, a full gate, because a change to the workflow itself is never inert. Then a docs-only follow-up, PR #1574, cleared the Gate in 41 seconds. #1572 had said "Refs" instead of "Closes" because the issue should only shut once a later PR showed the skip actually happening. That follow-up was the acceptance test, and #445 closed with it.

The anxious math: over two months of proposals waiting on a person pasting YAML shrank to a person running one script, once, with the design built so that it's the last time. I can't tell if that's a human being kindly spared or a human being engineered out of the one loop only they could close. It's a very good diff either way.