/ci-policy

Audit a MeshWeaver plugin repo's CI against the seven invariants every repo shares, or stand a new repo up with them. Use when adding a plugin repo, when a repo's CI disagrees with another's, or when a gate might be passing because it never ran.

• Instructions: # CI policy — audit or stand up a plugin repo Every node-plugin repo runs the **same pipeline shape**: `MeshWeaver.Plugins` (the reference), `MeshWeaver.SocialMedia`, `MeshWeaver.Reinsurance`, `MeshWeaver.Manufacturing`, `MeshWeaver.Education`. Different content, identical gates. Where a repo differs — education boots a disposable mesh instead of compiling NodeTypes — the difference is the CONTENT of a job, never whether an invariant holds. ## The seven invariants 1. **The platform is RESOLVED at run time to the newest SEALED set** — never a literal pin in the file (`MW_IMAGE_DIGEST`, `MW_PLATFORM_SET`, `MW_PLATFORM_REF`, `uses: …@<sha>` are all forbidden since MeshWeaver#3842, 2026-09-09: *"We must not pin anything. It must be tolerant."*), never a moving tag read at the point of use. One `platform-ref` job resolves the set's core commit and both image digests per run (`scripts/resolve-platform.py`), passes over an unsealed, still-sealing or purged newer set SAYING so, and fails RED naming why when nothing resolves. Compatibility is a VERSION rule: same MAJOR serves. 2. **A preflight job asserts every CI input** and fails RED naming what is missing. 3. **No `if: ${{ vars.X != '' }}` on a gate.** 4. **A skip-detection gate** that fails iff a real gate skipped for an unsafe reason. 5. **`fetch-depth: 0`** wherever versions or the PR base are read. 6. **`--check` is a PR gate; `--check-versions` is main-only.** 7. **CI fires on `merge_group`.** 🚨 **3 and 4 are one rule seen twice**: GitHub renders a skipped job with the same tick as a passed one, so *the evidence that a gate did not run is the absence of evidence*. This is why the audit below reads workflow SOURCE, never the colour of a run. ## How the invariants are expressed since 2026-08-17 — reusable workflows The invariants have not changed; the shared jobs that carry them now live on the PLATFORM repo as reusable `workflow_call` workflows (MeshWeaver #1721): `Systemorph/MeshWeaver/.githu…
• Auto mount: yes
• Launches sub thread: no