dependabot majors #640/#641 merged with red compile checks — required-check gap during hybrid-gate cutover

[forkwright]

Finding

PRs #640 (ulid 1.2→3.0) and #641 (rubato 3→4) merged onto main although their own pre-merge Check/Clippy/Test runs failed — both carried genuine compile breaks (fixed forward in #660). Main's push CI has been red or superseded since #639.

Evidence

• chore(deps): bump ulid from 1.2.1 to 3.0.0 #640 pre-merge run 29971760416: error[E0599]: no function or associated item named 'new' found for struct 'Ulid' in crates/paroche/src/routes/zone.rs:73 — merged anyway.
• chore(deps): bump rubato from 3.0.0 to 4.0.0 #641: error[E0107] (audioadapter 4.0 trait-lifetime removal) in crates/akouo-core/src/output/resample.rs — merged anyway.
• At merge time the required set had just been trimmed (hybrid-gate cutover) to gate / gate + cargo audit + cargo deny + osv-scanner + gitleaks + scan; Check/Clippy/Test were no longer required.
• For both PRs gate / gate must have reported success despite the tree not compiling — hypothesis: docs_only_exemption (or the trailer route) in the reusable hybrid-gate classified the dependabot diffs (Cargo.toml/Cargo.lock only) as exempt from the full build, so full-gate-build skipped and gate / gate passed vacuously.

Why this matters

A lockfile-only diff is exactly the class MOST in need of a compile check — dependency bumps break trees while touching no source. If the exemption treats manifest/lockfile changes as docs-only, every dependabot PR can merge red.

Desired correction

Verify the hypothesis against the #640/#641 gate / gate run logs (route taken, exemption decision). If confirmed: the docs-only classifier in the reusable hybrid-gate (forkwright/.github) must treat Cargo.toml/Cargo.lock (and any build-input file) as code, fleet-wide. Add a regression: a lockfile-only PR must take the full-gate-build route.

Done when: a Cargo.lock-only PR demonstrably runs full-gate-build, and the classifier change is landed in the reusable workflow consumed by all adopted repos.

[forkwright]

Hypothesis verified and mechanism narrowed: the docs-only classifier was innocent — run 29971760691 (#640) shows check-trailer reporting found=true via the trusted-automation waiver, which skipped full-gate-build (BUILD_RESULT: skipped), and a second author-keyed waiver in the gate evaluation exited 0 before reading the build result. Both waivers removed in forkwright/.github#20 (merged): automation PRs now take the standard ladder — attribution → trailer → docs-only → build success. All adopted repos consume the reusable workflow @main, so the fix is live fleet-wide. Live regression proof pending: #635 (lockfile + deny.toml diff, dependabot author) must now run full-gate-build on its next CI cycle — leaving this open until that's observed.

[forkwright]

Regression proof observed: rp PR #622 (release-please author, the exact class the old waiver exempted) ran full-gate-build under the fixed reusable workflow — run 29988339871 shows BUILD_RESULT: success with the gate evaluating the build result rather than waiving on author. The forkwright/.github#20 fix is live and verified fleet-wide. Historical damage was repaired forward in #660 (ulid/rubato fallout) and akroasis#288 (ulid + protoc).