Skip to content

ADR-0004: Anti-Direct-Merge Prefetch & Dogfood Gating Pipeline

Status

Superseded by ADR-0012 — 2026-09-26 (previously Accepted).

Context

Direct commits to main without isolated sandbox verification bypass supply chain integrity, static analysis, and race condition tests. In multi-agent autonomous engineering environments, unverified merges can rapidly break CI pipelines and cascade across downstream forks.

Decision

We enforce a mandatory 4-stage anti-direct-merge gating pipeline (standardsctl gate):

  1. Stage 1 (Prefetch & Lockfiles): Verifies cryptographic hashes in go.sum, downloads dependencies with context timeouts, and ensures .standards.yaml and .standards.lock exist and are valid.
  2. Stage 2 (HISS Invariant Scan): Performs static AST inspection enforcing HISS-01 through HISS-16 invariants, including NASA JPL Rule 4 ($\le 60$ LOC per function) and strict zero-debt against .standards-baseline.json.
  3. Stage 3 (Race-Detector Tests): Executes go test -v -race across critical components in an isolated worktree.
  4. Stage 4 (Exit-0 Receipt & Merge): Emits a deterministic verification report. Direct pushes to main are blocked via GitHub rulesets; merge requires a verified gate run.

Consequences

  • Positive: Zero broken main builds; deterministic supply-chain prefetching prevents compromised or dangling dependencies.
  • Positive: Automated enforcement eliminates human review bottlenecks for mechanical invariants.
  • Negative: Pre-merge verification requires local computational overhead and execution time before merging.