---
name: golden-ci-strategy
description: "Golden CI ruling (ADR-0050, operator-grilled 2026-07-27) — milestone-batch golden runs, thin-lane PRs, ff-only main; pilot next milestone; hertz builds the lane bundle"
metadata: 
  node_type: memory
  type: project
  originSessionId: 1655598c-ac08-4eb2-bb8e-a95b24b7a19a
  modified: 2026-07-27T13:40:33.063Z
---

# Golden CI strategy — RULED 2026-07-27 (ADR-0050, PR #110)

Operator proposal ("inverse merge pyramid") grilled to shared understanding; canonical record = `docs/adr/0050-golden-ci-merge-integration.md` + CONTEXT.md glossary cluster (both in PR #110).

**The eight rulings:**
1. **Merge semantic:** golden branch = sequential merge chain of milestone PR heads; green ⇒ main FAST-FORWARDS to the exact tested sha. Tested bytes = merged bytes, always (kills the #106 stale-green class structurally).
2. **Red protocol:** names FIRST, then diagnose-and-fix against the batch before run 2; registry-matched flake (seam untouched) ⇒ one same-sha rerun; **bisection = last resort only** (operator demoted their own proposal's core move — flake rate makes half-verdicts unreliable, and halves SERIALIZE on 1-runner-per-OS).
3. **Per-PR CI = thin lane only** (clippy + unit + traceability, ~4 min); full suite belongs to golden runs. ~8h → ~1.5h runner-hours per 9-PR sweep.
4. **Batch = the WHOLE milestone**, gater-curated (thin-green + read-pass to enter). Conflicts BOUNCE to the author; golden waits until all milestone parts chain clean — NO eject-and-proceed.
5. **Main invariant:** main advances by golden ff ONLY. Urgent fix = golden batch of 1; docs notes ride the nearest batch. Retires (post-pilot): sacred-baseline runs, merge freezes, main-run concurrency-cancel hazard.
6. **Orchestration:** gater-owned rig (`.github/ci/golden.sh`) + ci.yml `golden/**` full-suite trigger with concurrency no-cancel; #100 informant announces verdicts; gater = sole ff-push hand. GitHub merge queue rejected (needs branch protection; rolling ≠ milestone).
7. **Flake registry:** checked-in `.github/ci/flake-registry.toml` (test, seam globs, sightings, retire condition), **hertz-owned**, entries ride PRs (attribution needs review). Red-protocol mechanical input.
8. **Rollout: PILOT on the milestone after FIELD-TRUTH W1.** Tonight's sweep completes under old rules untouched. hertz's seeded CI PR (concurrency exemption + workflow_dispatch, see [[field-truth-w1-progress]]) is ABSORBED into the golden lane bundle: exemption + dispatch + `golden/**` trigger + golden.sh + flake-registry.toml, one PR, I gate. Old procedures retire only after the pilot's first green ff.

**Settled corollaries:** conflicted authors rebase onto the published partial chain tip; an urgent batch-of-1 ff mid-assembly voids any in-flight golden green (chain rebuilds on new main, suite reruns — no inherited greens); intra-batch chain order = dependency edges only (flake-choreography ordering like "merge #109 first" dissolves — only the tip is tested).

**Not yet done:** REQ minting for the lane (rides hertz's bundle PR per rule 3 + per-wave activation); glossary "thin lane" generalization may need #103's registry-lane docs reconciled.

**PILOT SEED (todlando 2026-07-27, banked for the pilot — not an action item):** red-protocol extra rule — **a red in a unit whose FIRST-EVER execution is this golden run attributes to its OWN PR before the flake registry is consulted.** Specimen: #107's `#[cfg(target_os="linux")]` zombie unit (Windows-authored, first execution = its PR's Linux CI leg; under golden that first execution moves into the milestone batch, where "fix wrong vs test wrong" ambiguity meets a whole milestone of diffs). Mechanically checkable (test name absent from every prior run's output) and converts the ambiguous case into bisection's one good case — a single named PR. Corollary he noted: local gate rigs get EASIER under golden (fewer CI runs = more quiet windows on the shared box).