No GitHub Actions run for this repository has ever executed mvn verify, the public-household fixture, the Playwright suites, the Docker build or the Trivy scan. gh run list --limit 100 shows 9 cancelled, 1 failed, 4 waiting and 0 successful runs. The one failure (run 36876709062) stopped at the FOUNDATION_PACKAGES_TOKEN gate in .github/workflows/ci.yml:55-60 (exit 1 BLOCKED). The four waiting runs are parked on the foundation-packages environment, which requires reviewers (gh api repos/KofTwentyTwo/carl/environments). PR #1 was merged on 2026-10-01 with statusCheckRollup still WAITING.
Evidence
.github/workflows/ci.yml jobs application and required-verification; token gate at lines 55-60.
.github/workflows/release.yml triggers on a develop branch that does not exist on the remote (git ls-remote shows only main); docs/CI-CD.md:95 acknowledges this.
docs/TODO.md:50 and docs/SESSION-STATE.md record the blocked run; docs/ACCEPTANCE.md says hosted qualification is BLOCKED.
Impact
Every "PASS" in the acceptance record rests on local runs on one machine. main carries code that no hosted gate has verified. Branch protection is not preventing unverified merges.
Suggested resolution
Provision FOUNDATION_PACKAGES_TOKEN (package read on the foundation) in the foundation-packages environment, or publish the foundation parent somewhere the Carl workflow can resolve without a reviewer-gated environment.
Require the required-verification check for merges to main.
Either create develop or point release.yml at main.
Related: #5 covers the future CI/CD design; this issue is about the existing GitHub workflow never having run.
Priority rationale
P0: the repository's merge gate is not functioning.
Filed from the 2026-10-01 real-versus-fake audit of Carl (branch feature/cicd-liquibase-gitops, HEAD 5414d7a, main 1b334d1). Four read-only reviews covered domain and services, QQQ metadata and data model, tests/CI/evidence, and docs/integrations. A local offline build of a Carl copy against the installed foundation 0.5.0-SNAPSHOT is in progress; its result will be added as a comment. Existing issues #3, #4 and #5 (real Monarch accounts, Authentik with real data, CI/CD with Liquibase and ArgoCD) are referenced rather than duplicated.
## Summary
No GitHub Actions run for this repository has ever executed `mvn verify`, the public-household fixture, the Playwright suites, the Docker build or the Trivy scan. `gh run list --limit 100` shows 9 cancelled, 1 failed, 4 waiting and **0 successful** runs. The one failure (run 36876709062) stopped at the `FOUNDATION_PACKAGES_TOKEN` gate in `.github/workflows/ci.yml:55-60` (`exit 1 BLOCKED`). The four waiting runs are parked on the `foundation-packages` environment, which requires reviewers (`gh api repos/KofTwentyTwo/carl/environments`). PR #1 was merged on 2026-10-01 with `statusCheckRollup` still `WAITING`.
## Evidence
- `.github/workflows/ci.yml` jobs `application` and `required-verification`; token gate at lines 55-60.
- `.github/workflows/release.yml` triggers on a `develop` branch that does not exist on the remote (`git ls-remote` shows only `main`); `docs/CI-CD.md:95` acknowledges this.
- `docs/TODO.md:50` and `docs/SESSION-STATE.md` record the blocked run; `docs/ACCEPTANCE.md` says hosted qualification is BLOCKED.
## Impact
Every "PASS" in the acceptance record rests on local runs on one machine. `main` carries code that no hosted gate has verified. Branch protection is not preventing unverified merges.
## Suggested resolution
1. Provision `FOUNDATION_PACKAGES_TOKEN` (package read on the foundation) in the `foundation-packages` environment, or publish the foundation parent somewhere the Carl workflow can resolve without a reviewer-gated environment.
2. Require the `required-verification` check for merges to `main`.
3. Either create `develop` or point `release.yml` at `main`.
Related: #5 covers the future CI/CD design; this issue is about the existing GitHub workflow never having run.
## Priority rationale
P0: the repository's merge gate is not functioning.
---
Filed from the 2026-10-01 real-versus-fake audit of Carl (branch `feature/cicd-liquibase-gitops`, HEAD `5414d7a`, main `1b334d1`). Four read-only reviews covered domain and services, QQQ metadata and data model, tests/CI/evidence, and docs/integrations. A local offline build of a Carl copy against the installed foundation 0.5.0-SNAPSHOT is in progress; its result will be added as a comment. Existing issues #3, #4 and #5 (real Monarch accounts, Authentik with real data, CI/CD with Liquibase and ArgoCD) are referenced rather than duplicated.
Local build result promised in the audit footer: a copy of this branch (HEAD 5414d7a plus the uncommitted V60 work) built against the foundation 0.5.0-SNAPSHOT installed from source, mvn verify with Docker, 2026-10-01.
JaCoCo bundle check: passed (floors 80% line / 60% branch)
One earlier attempt hung inside a PostgreSQL connection handshake on a stalled Docker-mapped port and was killed after 281 passing tests; the rerun passed cleanly. That hang is tracked upstream as KofTwentyTwo/kof22-agent-foundation#54.
So the suite is real and green locally. This issue stands: none of it has ever run on GitHub Actions.
Local build result promised in the audit footer: a copy of this branch (HEAD `5414d7a` plus the uncommitted V60 work) built against the foundation `0.5.0-SNAPSHOT` installed from source, `mvn verify` with Docker, 2026-10-01.
- Tests run: 428, Failures: 0, Errors: 0, Skipped: 0
- JaCoCo bundle check: passed (floors 80% line / 60% branch)
- One earlier attempt hung inside a PostgreSQL connection handshake on a stalled Docker-mapped port and was killed after 281 passing tests; the rerun passed cleanly. That hang is tracked upstream as KofTwentyTwo/kof22-agent-foundation#54.
So the suite is real and green locally. This issue stands: none of it has ever run on GitHub Actions.
This repo is archived. You cannot comment on issues.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
No GitHub Actions run for this repository has ever executed
mvn verify, the public-household fixture, the Playwright suites, the Docker build or the Trivy scan.gh run list --limit 100shows 9 cancelled, 1 failed, 4 waiting and 0 successful runs. The one failure (run 36876709062) stopped at theFOUNDATION_PACKAGES_TOKENgate in.github/workflows/ci.yml:55-60(exit 1 BLOCKED). The four waiting runs are parked on thefoundation-packagesenvironment, which requires reviewers (gh api repos/KofTwentyTwo/carl/environments). PR #1 was merged on 2026-10-01 withstatusCheckRollupstillWAITING.Evidence
.github/workflows/ci.ymljobsapplicationandrequired-verification; token gate at lines 55-60..github/workflows/release.ymltriggers on adevelopbranch that does not exist on the remote (git ls-remoteshows onlymain);docs/CI-CD.md:95acknowledges this.docs/TODO.md:50anddocs/SESSION-STATE.mdrecord the blocked run;docs/ACCEPTANCE.mdsays hosted qualification is BLOCKED.Impact
Every "PASS" in the acceptance record rests on local runs on one machine.
maincarries code that no hosted gate has verified. Branch protection is not preventing unverified merges.Suggested resolution
FOUNDATION_PACKAGES_TOKEN(package read on the foundation) in thefoundation-packagesenvironment, or publish the foundation parent somewhere the Carl workflow can resolve without a reviewer-gated environment.required-verificationcheck for merges tomain.developor pointrelease.ymlatmain.Related: #5 covers the future CI/CD design; this issue is about the existing GitHub workflow never having run.
Priority rationale
P0: the repository's merge gate is not functioning.
Filed from the 2026-10-01 real-versus-fake audit of Carl (branch
feature/cicd-liquibase-gitops, HEAD5414d7a, main1b334d1). Four read-only reviews covered domain and services, QQQ metadata and data model, tests/CI/evidence, and docs/integrations. A local offline build of a Carl copy against the installed foundation 0.5.0-SNAPSHOT is in progress; its result will be added as a comment. Existing issues #3, #4 and #5 (real Monarch accounts, Authentik with real data, CI/CD with Liquibase and ArgoCD) are referenced rather than duplicated.Local build result promised in the audit footer: a copy of this branch (HEAD
5414d7aplus the uncommitted V60 work) built against the foundation0.5.0-SNAPSHOTinstalled from source,mvn verifywith Docker, 2026-10-01.So the suite is real and green locally. This issue stands: none of it has ever run on GitHub Actions.