A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:01:48Z by majordomus 0.29.0. Nothing on this page is read again. See it live
CI/CD & Releases
From a green check to a published release.
What was released, what the tree declares and what its commits imply next, where it is deployed, and every gate the CI model can run.
- Released0.29.0distribution.releases /latest/version
- Declared0.29.0release.version /declared
- Next0.29.1release.version /next
- Gates81gates.model /count
Releases
What was published, newest first.
Declared 0.29.0 · the commits since the last release imply a patch release
- v0.29.0stable · 4a4573690f · its record
- v0.28.0stable · 441c965549 · its record
- v0.27.0stable · c1a430dcfe · its record
- v0.26.0stable · ff38297096 · its record
- v0.25.0stable · ac203c34df · its record
- v0.24.1stable · 92f11cda7c · its record
- v0.23.0stable · e506c041a4 · its record
- v0.22.0stable · 61d4417675 · its record
- v0.21.0stable · 722228ef3c · its record
- v0.20.0stable · c8f0e4c501 · its record
- v0.19.1stable · fe0b58b67b · its record
- v0.19.0stable · 3d92c25c12 · its record
- v0.18.0stable · 6800dcb519 · its record
- v0.17.0stable · 4090b2b8ae · its record
- v0.16.0stable · f70c522d73 · its record
- v0.15.0stable · 76a7a2340a · its record
- v0.14.0stable · 815b96b5a1 · its record
- v0.13.2stable · 9a31fed5e5 · its record
- v0.13.1stable · 2a4fe055b8 · its record
- v0.13.0stable · f075170530 · its record
- v0.12.0stable · a137c3fe14 · its record
- v0.11.0stable · 1271a2ecd9 · its record
- v0.10.0stable · 910835dd07 · its record
- v0.9.0stable · 823ca04683 · its record
- v0.8.0stable · 8d37d011ef · its record
- v0.7.0stable · ab776e5c27 · its record
- v0.6.0stable · d98a264b5f · its record
- v0.5.0stable · 3a032c1e03 · its record
- v0.3.1stable · 45f921efb5 · its record
distribution.releases0 msAPI/api/v1/distribution/releasesCLImajordomus distribution releasesMCPmajordomus_releasestechnical view
release.version1263 msAPI/api/v1/release/versionMCPmajordomus_release_versiontechnical view
Deployments
Where the product is declared to run.
| Deployment | Application | State |
|---|---|---|
| majordomusThe Majordomus layer, served from its container image.ai/repo/deployments/majordomus.yaml | majordomus | declared |
deploy.list0 msAPI/api/v1/deploymentsMCPmajordomus_deploymentstechnical view
CI model
Every gate the model declares, the job it runs in and when it is selected.
| Gate | Job | Runs | What it holds | Implies |
|---|---|---|---|---|
| shell-lint | structure | every plan | bash -n over every script, shellcheck over the tool, the scripts and the cases | none |
| prompt-privacy | structure | every plan | no published or generated file is a prompt record, a rendering, or a copy of one; every site generator names the local half so it can exclude it | none |
| ui-check | structure | every plan | the static half of UI conformance — every scrolling box this repository writes is reachable from the keyboard | none |
| pipefail-check | structure | every plan | a script that pipes under `set -e` may not report its pipeline's failure as its last command's success; a ratchet over the scripts that still can | none |
| argv-limit-check | structure | every plan | a whole file's JSON may not travel to jq on the command line — Linux refuses a single argument over 131072 bytes and macOS never will, so the shape is checked rather than the size | none |
| doc-command-check | structure | every plan | a command the documents tell a reader to run is executed by a use-case scenario or a command-line example, or marked with the reason it cannot run here; a ratchet over the prose that still promises without proof | none |
| liveness-check | structure | every plan | a wait with no bound, a process spawned and never reaped, a command that pages to a terminal; a ratchet over the shell that still carries them | none |
| development-semantics | structure | every plan | a mutating development command is backed by a capability of the canonical runtime and a Cockpit tree reaches into no layer path; the debt ratchets down and may not grow | none |
| provider-evidence | structure | every plan | every declared provider's session and prompt capability is declared with the citation it was verified from, and every one of them is reported | none |
| core-check | structure | every plan | doctor, watch, the context documents, the continuity commands, plan validate, the offline GitHub projection, every reference a document makes, the derived site data | none |
| evidence-check | structure | every plan | every claim that declares a guarantee, against the run actually recorded for it; a ratchet over the claims no recorded execution yet supports | none |
| site-basepath | structure | when its paths change | the documentation source states no origin-absolute link, so one build serves both the published site and the executable's /docs mount | none |
| adr-collision | structure | when its paths change | every decision valid and its references resolving, and no identity this branch adds is already carried by a different decision on another ref | none |
| knowledge-nodes | structure | every plan | every canonical object is one node with one identity; an identity two source classes claim is refused by name, and the refusal fails the plan | none |
| collision-check | structure | every plan | no path this pull request adds is added independently, with different content, by another unmerged branch; related work and same-bytes copies are listed, and a checkout that cannot see the other branches says so instead of passing | none |
| case-numbers | structure | every plan | no file under test/cases/ shares its identity with another, beyond the collisions recorded on the baseline | none |
| shell-suite | suite | when its paths change | every behavioural case, in a disposable repository each, four at a time | none |
| rust-integration | rust | when its paths change | the executable built, the registry validated, every committed projection current, the benchmark coverage complete | none |
| command-graph | rust | when its paths change | the command graph builds without an error, and no workflow file carries a hand-written bridge to either program | none |
| rust-check | rust | when its paths change | fmt, clippy with warnings denied, the suites and doc examples, rustdoc, the benchmarks building, the registry checks, the benchmark runner through every transport | rust-integrationrust-quality |
| command-furnished | structure | every plan | every public command carries its reference section, its fixture, its demo and its behavioural and negative cases, reported in one pass rather than one refusal per derivation | none |
| rust-command | structure | when its paths change | every composed command module asserts, in the file that declares it, that it is what it claims | none |
| handbook-check | structure | every plan | every edition of the handbook builds from this tree; a chapter whose declared anchor left the repository's graph, a chapter that cites nothing, a caption with no figure behind it and derived data that changed shape each fail | none |
| english-only | structure | every plan | every authored file is spelled in English; a letter that occurs in Czech, Slovak or Polish and never in English, or a whole other script, fails — proper nouns and files that use a foreign string as test data are declared with their reason beside the check | none |
| prismatic-independence | structure | every plan | no submodule, gitlink, dependency manifest, script, hook, workflow or configuration file names a Prismatic project; the project's own name and the bare brand word are not references, and documents are out of scope | none |
| finding-reproduce | structure | every plan | every finding a command reports names the command that reproduces it; a reporting call with too few arguments, or one this gate cannot parse, is a finding of its own | none |
| skills-proof | structure | when its paths change | every active skill is named by a test and invoked by a workflow, prompt, profile, provider template, recipe or CI workflow; no test or invocation names a skill that does not exist | none |
| skill-naming | structure | when its paths change | every active skill is named where a test demands the whole list — the majordomus-skill header of apps/majordomus-cli/tests/skills.rs and the first marker line of test/cases/391_skills_are_proven_capabilities.sh — and neither names a skill that does not exist | none |
| audit-plan | structure | when its paths change | every row of docs/COCKPIT_IDE_AUDIT.md's gap matrix whose status is planned names an issue id, and every id it names is an issue of the plan; rows in the other statuses are evidence claims and are not read | none |
| release-record-listing | structure | when its paths change | every case that names the release record or reads what is offered from it is run by the release-record-cases gate, and every case that gate names exists | none |
| pack-plan | structure | when its paths change | the chatgpt pack plans clean — every file within a shard's token budget, the shards within the file count, no source naming the checkout, never a binary, worktree, link or build artifact | none |
| rule-proof | structure | when its paths change | every blocking rule names what proves it and every proof is in the tree; a blocking rule that names none is new debt, a named case that was renamed or deleted fails outright, and the verdict names the population it is not about (claims are the claim-proof gate) | none |
| commit-policy | structure | when its paths change | every commit this branch adds satisfies the repository's commit policy, and the history's recorded debt does not grow | none |
| lease-reader | structure | every plan | the shared server's lease is parsed by the one typed reader the executable owns; a second parser anywhere but documentation and the tests is refused | none |
| claim-proof | structure | every plan | every claim marked guaranteed names a runnable test that names the claim back, so the link reads from both ends; the verdict states its denominator and names the population it is not about, and with the debt at zero any exception fails | none |
| economics-claims | structure | every plan | no quantity about tokens, context or cost is typed into hand-written prose, and every claim bound to an economics metric is guaranteed only while its evidence is current and meets the binding | none |
| mcp-tool-run | structure | every plan | every MCP tool the registry projects is sent a tools/call by a case or an integration test of this repository; the verdict states its denominator and the populations it is not about, and the uninvoked set may not grow | none |
| rust-quality | structure | when its paths change | the crate's own exported surface — documentation beyond the signature, an executable example on everything that carries behaviour, a module boundary something exercises — and every command of the command line accounted for against the capability registry | none |
| generation-converges | structure | when its paths change | generating twice changes nothing the second time — no artifact is written from a value the same run also writes | none |
| rust-coverage | coverage | when its paths change | coverage of the crate against scripts/rust-coverage-threshold and of the session/continuity domain against scripts/session-coverage-threshold, both measured with test code out of the denominator | none |
| coverage-differential | coverage | when its paths change | every executable line, function and region a change adds or touches under the crate is covered by a test, measured against the branch's merge-base with the trunk over the same export and test-exclusion as the crate gate; new debt is refused, legacy debt on untouched lines is not this gate's business (project.new-code-is-covered) | none |
| rust-bench | bench | on demand | the benchmark check against the committed baseline of its platform (macOS, the one platform with a baseline under .ai/repo/benchmarks/rust/) | none |
| projection-closure | rust | when its paths change | the command line, the one interface declared twice, agrees with the registry — no capability claims a command clap does not answer, and no new command is hand-written rather than derived | none |
| web-topology | rust | when its paths change | the repository's web surfaces resolve into one topology with no collision, no nested claim and no directory outside the generated root | none |
| intent-check | rust | when its paths change | every intent names a milestone and a criterion, and every milestone, evidence reference and governance entry it names resolves; every serves link names a criterion of an intent that realises the issue's milestone, every issue under such a milestone serves a criterion, and a criterion of an intent with work has an issue serving it; the gap and critique hold together, and no serving issue started without a critique or with a blocking finding open; a milestone no intent serves, and weaker coverage, are reported as warnings | none |
| intent-realization | rust | when its paths change | no intent whose counted milestones are all DONE has a criterion whose latest recorded run is failing or no longer current evidence at the checkout; criteria never evidenced and work serving no intent are warnings; the work realising each intent, its providers and handovers, and each link's provenance are reported | none |
| cockpit-assets | site | when its paths change | every committed stylesheet of the browser surfaces (the Cockpit's and the UI's) matches the source it is compiled from | none |
| cockpit-projection | structure | every plan | no Cockpit page reads the index directly; every fact a page shows is what a capability answered through Context::execute (ADR 0012) | none |
| ui-integrity | structure | every plan | what an interface shows is derived and unknown is never drawn as healthy — no direct registry, product or Why read in a Cockpit page outside the navigation's allow-list, no health check ok by literal, no healthy | none |
| design | structure | when its paths change | no source carries a design decision of its own — every colour, size, status word, brand copy and theme key comes from share/design/tokens.yaml through its projections | none |
| worktree-topology | structure | when its paths change | the branch-to-worktree rule has one constant in the crate, the pre-commit hook asks the guard and the policy declares it, every document and template names the same container, and the behavioural case passes through the built executable | none |
| backlog-hygiene | structure | every plan | every self-accumulating quantity keeps its measuring command, the reaper matches by predicate rather than by name, every derived site tree is declared merge=derived, and nothing advertises the forge merge button | none |
| mesh-check | structure | when its paths change | the mesh stays one subsystem — UDP sockets, link transports, link handlers and the journal only under src/mesh/ (and its capability module), one MeshRegistry constructed only there, a Cockpit mesh page that asks the mesh capabilities, and the mesh-declaration kind, its schema and both rules moving together (project.mesh-is-observation-not-authority, project.mesh-cooperation-is-authenticated) | none |
| mesh-lab | mesh-lab | when its paths change | separate Linux nodes on a real bridge discover each other by multicast, link, share claims and handovers, converge, and recover from a partition and a crash, and scripts/ci/mesh-lab-evidence then judges the record the lab wrote — a complete acceptance or nothing (project.mesh-cooperation-is-authenticated, claim mesh-network-acceptance) | none |
| crate-boundary | structure | when its paths change | the Rust crate declares only dependencies that were argued for, and links no async runtime, HTTP client, TLS stack or CDP client (ADR 0032) | none |
| order-check | structure | when its paths change | a collection has one order — no case-folded comparator outside order.rs, no sort key that renders markup, no locale-collated comparison, and the ordering debt does not grow | none |
| entry-converges | structure | when its paths change | entry by a shell starts nothing and builds nothing, the start event ensures the server where the policy says it does, the briefing has one author and the lease one typed reader, and a server nobody owns has a bounded life | none |
| shell-inventory | structure | when its paths change | every shell unit under bin/, lib/, scripts/, share/, .githooks/ and .claude/hooks/ is declared in .ai/repo/automation/inventory.jsonl with an exemption that says why it is shell and when it stops being, and no record names a unit the tree no longer has | none |
| step-bound | structure | every plan | every timed step of a workflow declares a bound, and every bound is smaller than the bound of the job that runs it, so a step that runs out of time fails with a message instead of being killed by its job and reported as a cancellation | none |
| github-projection | structure | when its paths change | the GitHub projection still agrees with the canonical model — no record behind, edited, in conflict or unmanaged, and the backlog of unprojected records no larger than its baseline | none |
| providers-data | structure | when its paths change | every provider is declared once beside its template, every projected bootstrap is under the derived merge driver, the generated provider table is current, and no document lists providers by hand instead of pointing at it | none |
| cockpit-probe | cockpit | when its paths change | every Cockpit route the server serves answered, and the pages and interactions measured in a real browser; the route set is the one the UI audit uses | none |
| site-build | site | when its paths change | the derived data current, the site built once, every static check over the output | none |
| site-probe | site | when its paths change | every route at three widths in a real browser, the menu, the dropdown, the theme toggle, the diagrams | none |
| rustdoc | rust | when its paths change | the crate's published rustdoc tree is this commit's and complete — every exported item has its page at its derived route, no page is an orphan, the crate index and its assets are present, every internal link resolves, and no machine path or secret is published | none |
| interaction-probe | interactions | when its paths change | every interactive control on every page is claimed by one behaviour spec and does what it says in a browser — menus, dropdowns, theme, copy buttons, tabs, filters, the diagnosis, the contract, the changelog, the graphs and every keyboard scroll region | none |
| ui-audit | ui | when its paths change | every warm screen of the UI within the latency budget the benchmark policy declares, measured over a real socket; then every discovered page of every surface the executable serves — built directories and the routes it renders itself — at every width the theme implies, in a browser, against the responsive, semantic, component and WCAG invariants; the report is rendered at /tests/ui | none |
| version-surface | rust | when its paths change | the declared version is at least what the public contract requires since the last release — capabilities, routes, MCP tools, commands and both schemas of each, compared as contracts rather than as text — and every breaking movement is named | none |
| pages-live | pages | when its paths change | the site GitHub Pages serves was built from a commit on master, no publication has been owed longer than the deploy window, the live site is serving what gh-pages published, the UI it holds at the UI's mount was read at that same commit and every page its record lists answers, GitHub's own build of that branch did not error, and the homepage, /releases/latest.json and the newest GitHub release name one release once the release window has passed | none |
| installer-live | install | on demand | the install command the project advertises, fetched and run from the published site, installing the published release on this runner | none |
| macos | macos | on demand | the behavioural suite under the stock macOS shell and userland, and the crate's suites on macOS | none |
| campaigns-provenance | structure | when its paths change | every file under campaigns/ is the bytes the manifest recorded, every file present is declared, and every pack has a row in the index that names it | none |
| diagram-check | structure | when its paths change | no architectural relationship in a published document (docs, the site's pages and templates, the decisions, the rules, the handbook, the markdown majordomus ui renders) is typed in box art — every one is a mermaid block, with literal terminal output, file listings, quoted file content and the verbatim campaign packs exempt by declaration | none |
| nav-check | structure | when its paths change | the site's navigation is declared once in site/data/nav.toml — no href is written twice, the primary navigation stays small, every template that renders navigation reads nav.groups and types no route the declaration does not carry, and the call to action resolves | none |
| entity-check | structure | when its paths change | every object of the layer is addressable — no two identities of a kind reduce to one route — and site/data/publication.toml declares, for every kind the index holds and for no kind it does not, whether the site publishes it as entity pages, as an editorial section, or not at all and why | none |
| release-check | structure | when its paths change | the version is authored in one place with one writer — the crate's writer and the release script name the same manifest, the shell tool prints what it declares, the lock records it, no changelog is kept by hand, the tree is not behind what was published, and every published tag has a release record so that a release the pipeline failed to record cannot pass for a finished one | none |
| version-authored-once | structure | every plan | the version is authored in one place — share/version.txt, the projection the shell tool reads, states what the crate manifest declares, no version is written by hand in bin/, lib/, scripts/ or share/ outside a generated artifact, and no hand-written prose names a version label (a major and a minor with no patch) outside the declared history (project.prose-states-no-version) | none |
| source-pin-check | structure | every plan | no template under site/templates adds a source link that names master instead of the commit the page was built from — a ratchet over the blob/master and tree/master occurrences, per file, against .ai/repo/source-pin-baseline.txt | none |
| merge-policy | structure | when its paths change | the merge policy's generated block of .gitattributes is what the generators write — every path it marks merge=derived is one a generator owns, and every generated path is marked | none |
| release-record-cases | rust | when its paths change | the cases about the committed release record and what is offered from it — the distribution model, the release pipeline and projection, the record's schema, the version the site shows, the install gate, the stable channel the MCP tools resolve — pass against this tree | none |
| plan-record-cases | rust | when its paths change | the cases about the plan's records and what reads them — the project model, the plan command and its transitions, the DAG and roadmap, the GitHub projection, the intents bound to issues, the completion gates — pass against this tree | none |
gates.model19 msAPI/api/v1/gatesMCPmajordomus_gatestechnical view
Build timings
How long each check takes on the open pull requests, measured from when each run started to when it completed.
- Runs measured1255integration.timings /timings/measured_runs
- Not measured172integration.timings /timings/unmeasured_runs
- Observed2026-10-18T00:00:23Zintegration.timings /timings/observed_at
| Check | Median | 90th percentile | Longest | Runs |
|---|---|---|---|---|
| suite-shard (1) | 24 min 09 s | 1 h 04 min | 1 h 20 min | 51 · 44 failed |
| suite-shard (4) | 22 min 54 s | 36 min 04 s | 1 h 20 min | 51 · 39 failed |
| suite-shard (3) | 21 min 57 s | 1 h 14 min | 3 h 37 min | 51 · 46 failed |
| rust (1) | 20 min 23 s | 32 min 55 s | 58 min 16 s | 51 · 30 failed |
| suite-shard (2) | 18 min 10 s | 45 min 42 s | 3 h 37 min | 51 · 40 failed |
| coverage | 18 min 05 s | 48 min 03 s | 3 h 37 min | 57 · 40 failed |
| rust (3) | 17 min 58 s | 54 min 01 s | 1 h 20 min | 51 · 41 failed |
| rust (2) | 16 min 08 s | 29 min 05 s | 1 h 06 min | 51 · 26 failed |
| interactions | 15 min 21 s | 45 min 24 s | 58 min 22 s | 63 · 50 failed |
| ui | 11 min 36 s | 58 min 16 s | 3 h 37 min | 62 · 53 failed |
| structure | 11 min 33 s | 26 min 34 s | 3 h 37 min | 62 · 45 failed |
| image | 11 min 06 s | 12 min 55 s | 12 min 55 s | 9 · 2 failed |
| cockpit | 9 min 37 s | 19 min 09 s | 1 h 00 min | 61 · 34 failed |
| site | 9 min 05 s | 46 min 17 s | 1 h 20 min | 62 · 49 failed |
| evidence | 4 min 33 s | 7 min 07 s | 7 min 41 s | 59 · 38 failed |
| mesh-lab | 3 min 14 s | 32 min 55 s | 3 h 37 min | 58 · 28 failed |
| plan | 14 s | 28 s | 24 min 01 s | 69 · 18 failed |
| suite | 14 s | 18 s | 28 s | 63 · 59 failed |
| ci | 13 s | 18 s | 4 min 41 s | 65 · 62 failed |
| bench | 0 s | 0 s | 0 s | 42 · 11 failed |
| install | 0 s | 0 s | 0 s | 44 · 13 failed |
| macos | 0 s | 0 s | 0 s | 43 · 11 failed |
| pages | 0 s | 3 min 04 s | 1 h 20 min | 54 · 21 failed |
| rust | 0 s | 0 s | 0 s | 12 · 12 failed |
| suite-shard | 0 s | 0 s | 0 s | 13 · 13 failed |
Longest waits
| Pull request | Wall time | Slowest check |
|---|---|---|
| #919 | 3 h 37 min | structure · 3 h 37 min |
| #1294 | 3 h 06 min | structure · 1 h 20 min |
| #1305 | 3 h 01 min | suite-shard (1) · 1 h 04 min |
| #1304 | 2 h 59 min | suite-shard (1) · 51 min 37 s |
| #1081 | 2 h 39 min | suite-shard (3) · 1 h 15 min |
| #1289 | 2 h 39 min | suite-shard (1) · 1 h 06 min |
| #1301 | 2 h 29 min | suite-shard (3) · 1 h 05 min |
| #1167 | 2 h 10 min | suite-shard (3) · 1 h 16 min |
| #1170 | 1 h 45 min | suite-shard (1) · 58 min 16 s |
| #1118 | 1 h 45 min | suite-shard (3) · 1 h 14 min |
integration.timings29 msAPI/api/v1/pull-requests/timingsMCPmajordomus_ci_timingstechnical view