Control band breached: ci_failure_rate_main (propose)

[kevintseng]

Detected by scripts/sdlc/monitor.mjs on run https://github.com/PCIRCLE-AI/memesh/actions/runs/34809688328.

{
  "checkedAt": "2026-09-14T05:27:13.920Z",
  "tier": "propose",
  "metrics": [
    {
      "metric": "public_ready_down",
      "value": null,
      "detail": "not evaluated: no public origin configured (sdlc/config.json origin is null)",
      "tier": "log"
    },
    {
      "metric": "public_ready_latency_ms",
      "value": null,
      "detail": "not evaluated: no public origin configured (sdlc/config.json origin is null)",
      "tier": "log"
    },
    {
      "metric": "public_ready_sha_missing",
      "value": null,
      "detail": "not evaluated: no public origin configured (sdlc/config.json origin is null)",
      "tier": "log"
    },
    {
      "metric": "ci_failure_rate_main",
      "value": 0.5,
      "detail": "50% of the last 20 runs on the default branch failed",
      "tier": "propose"
    },
    {
      "metric": "release_drift",
      "value": 0,
      "detail": "not evaluated: no public origin configured",
      "tier": "ok"
    }
  ],
  "breaches": [
    {
      "metric": "public_ready_down",
      "value": null,
      "detail": "not evaluated: no public origin configured (sdlc/config.json origin is null)",
      "tier": "log"
    },
    {
      "metric": "public_ready_latency_ms",
      "value": null,
      "detail": "not evaluated: no public origin configured (sdlc/config.json origin is null)",
      "tier": "log"
    },
    {
      "metric": "public_ready_sha_missing",
      "value": null,
      "detail": "not evaluated: no public origin configured (sdlc/config.json origin is null)",
      "tier": "log"
    },
    {
      "metric": "ci_failure_rate_main",
      "value": 0.5,
      "detail": "50% of the last 20 runs on the default branch failed",
      "tier": "propose"
    }
  ]
}

The loop files an intent PR from this issue when the configured provider's model credential and SDLC_GITHUB_TOKEN are set; otherwise a person writes intent/2026-09-14-monitor-ci_failure_rate_main.md.

[kevintseng]

Re-measured with the monitor's own query (actions/runs?branch=main&event=push&per_page=20) on 2026-09-20: 10 of 20 failed — still 50%.

Cause, read from the failed job logs: every failing CI run on main died on one check, main-declares-published-version ("main declares X and no vX tag exists"). main declared 4.10.0 from 2026-09-11 and that version was never tagged, so every push to main for nine days failed that gate by design. The run for 554e7142 failed the same way in the window between the merge and the v4.10.1 tag; it is being re-run now that the tag exists. The remaining failures in the sample are SDLC loop runs, which #354 addresses.

So the breach is real, and it measures a release left open rather than flaky tests. It should fall on its own as new pushes land on a tagged version. Worth deciding: should the monitor count a run that failed only on the published-version guard?

[kevintseng]

Closing: this breach was filed by the hourly monitor workflow (sdlc-monitor.yml), and the 50% figure came from the untagged release window described earlier in this thread, not from failing code. #365 removed that workflow from the public repository (tracked in #364); the monitor now runs only on the maintainer's machine. CI on main is the signal that remains here.