Keep a group member's siblings and refuse its merge until the group passed and every sibling is reviewed (issue 867, ADR 0382)

mesh-delivery's groups names each member's pull request, head, base and whether it is open (member_details), so the controller can read a member's siblings beside its check. The forge's holder keeps the siblings each verdict read, puts that verdict out of date when a sibling gets a new head, closes, or its base moves by anything but its own merge, and the merge tool merges such a member only when mesh/delivery-group passed at the heads read and each sibling head is approved. The statuses name the siblings, or say they could not be learned.

Co-Authored-By: Claude <noreply@anthropic.com>

modules/gitea/index.ts

@@ -45,6 +45,7 @@ import { CHECK_CONTEXT, REPO_CHECK_CONTEXT, commentFor, headsToAnnounce, statuse
   repoCheckFacts, reposToLook } from "./pulls.js";
 import { GateWriter, clonedAs, type BuildStarted } from "./gate.js";
 import { HOOK_PATH, HOOK_PORT, Pace, claimHead, ensureSystemHook, eventsTool, keptSecret, receiver, type ForgeEvent } from "./webhook.js";
+import { keepSiblings, noteVerdict, readSiblings, siblingsFile, siblingsOf, weighSiblings } from "./siblings.js";
 import { announcementOf, keepTook, lateVerdictComment, outOfDateWords, sameCommit, tookFile, weighTrunks } from "./trunk.js";
 
 // Without a way to a token — configured, or mintable with the admin account (token.ts) — there is
@@ -136,6 +137,7 @@ async function pollMerged(client: GiteaClient): Promise<void> {
           await emit("pull.closed", { owner: repo.owner, repo: repo.name, number: pull.number, title: pull.title,
             head: pull.head, head_sha: pull.head_sha, base: pull.base, html_url: pull.html_url });
           console.log(`[gitea] announced ${repo.full_name}#${pull.number} closed unmerged`);
+          await siblingMoves(client, repo.full_name, pull.number);
         }
         announced.add(closedKey);
         changed = true;
@@ -218,6 +220,8 @@ async function announceMerge(client: GiteaClient, repo: RepoOf, pull: PullOf): P
     // Said, because a trigger that fires silently is indistinguishable from one that did not
     // fire (novox/hq 04-ISSUES/131) — this line is how an operator knows the mesh was told.
     console.log(`[gitea] announced merge ${repo.full_name}#${pull.number} (${pull.merge_commit_sha.slice(0, 8)}) into ${pull.base}`);
+    // Its own merge of the head that was read is no sibling's move; any other is (ADR 0382 §5).
+    await siblingMoves(client, repo.full_name, pull.number);
   } catch (err) {
     announced.delete(pull.merge_commit_sha);
     throw err;
@@ -264,6 +268,8 @@ async function announceHead(client: GiteaClient, repo: RepoOf, pull: OpenOf): Pr
     throw err;
   }
   keepHeads();
+  // A sibling's new head puts out of date every verdict that read the sibling at another head (ADR 0382 §5).
+  await siblingMoves(client, repo.full_name, pull.number);
   // Said, so an operator knows the mesh was asked to check it.
   console.log(`[gitea] announced ${key} at ${sha.slice(0, 8)} to be checked before it merges`);
   // Pending until the verdict comes, so the pull request says a check is running rather than nothing — and
@@ -341,7 +347,22 @@ function keepTrunks(): void {
 
 /** Whether a trunk of one repository moved, weighed with this module's forge and its one writer (trunk.ts). */
 function trunksMoved(client: GiteaClient, owner: string, name: string): Promise<boolean> {
-  return weighTrunks(client, gates, trunks, owner, name);
+  return weighTrunks(client, gates, trunks, owner, name, () => siblingMoves(client, `${owner}/${name}`));
+}
+
+// **The siblings each open pull request's latest verdict names** (novox/hq ADR 0382 §5, siblings.ts), by member, kept beside
+// the other records. A sibling's new head, close unmerged, merge, or a move of its base puts the merge check of every
+// member whose verdict names it back to pending, with the reason; nothing is run for it.
+const siblingsRecord = siblingsFile(process.env.MESH_GITEA_STATE_DIR);
+const siblingNamed = readSiblings(siblingsRecord);
+
+/** A sibling moved, weighed (ADR 0382 §5): never fatal to what heard it. */
+async function siblingMoves(client: GiteaClient, repository: string, number?: number): Promise<void> {
+  try {
+    if (await weighSiblings(client, gates, siblingNamed, repository, number)) keepSiblings(siblingsRecord, siblingNamed);
+  } catch (err) {
+    console.error(`[gitea] whether a sibling of ${repository}${number ? "#" + number : ""} moved could not be weighed — ${err instanceof Error ? err.message : err}`);
+  }
 }
 
 // **The verdict, set where the pull request shows it.** Every verdict is the head commit's status; one
@@ -363,6 +384,17 @@ async function setVerdict(client: GiteaClient, event: { body: unknown }): Promis
     console.error("[gitea] a merge check's verdict named no repository, commit or verdict; ignored");
     return;
   }
+  // The siblings this verdict read are kept for the member (ADR 0382 §5); a verdict that read none removes the record.
+  const siblings = siblingsOf(c.siblings);
+  if (c.number && noteVerdict(siblingNamed, `${c.owner}/${c.repo}#${c.number}`.toLowerCase(), c.commit, siblings)) {
+    keepSiblings(siblingsRecord, siblingNamed);
+  }
+  // A sibling that moved while the check ran is weighed once this verdict has landed, in the head's own turn after it.
+  if (siblings.length) {
+    for (const repository of new Set(siblings.map((s) => s.repository))) {
+      void Promise.resolve().then(() => siblingMoves(client, repository));
+    }
+  }
   // Each status links to the pull request, where the delivery's view is kept (novox/hq ADR 0239).
   let target: string | undefined;
   let base: string | undefined;
@@ -445,6 +477,11 @@ async function buildStarted(event: { body: unknown }): Promise<void> {
 async function actOn(client: GiteaClient, event: ForgeEvent): Promise<void> {
   const b = event.body as { owner?: string; repo?: string; number?: number };
   if (!b.owner || !b.repo || !b.number) return;
+  if (event.name === "forge.pull-request.closed") {
+    // Closed unmerged is a sibling's move; a merge is weighed with its announcement below (ADR 0382 §5).
+    if (!(event.body as { merged?: boolean }).merged) await siblingMoves(client, `${b.owner}/${b.repo}`, b.number);
+    return;
+  }
   const head = ["forge.pull-request.opened", "forge.pull-request.synchronized", "forge.pull-request.reopened"].includes(event.name);
   const merged = event.name === "forge.pull-request.merged";
   if (!head && !merged) return;