MotirBuilding in public
MOTIR · moooon
onMotir
You’re viewing a public project. Anyone can view it — no account needed. Sign in to submit, upvote, or comment on requests.View-only — you can’t edit work items
MOTIR-3850

(motir-core) `sandbox-staleness` has failed EVERY scheduled run for 17 days — the tripwire is right: `packages/cli` is 30 commits past `cli-v0.3.0` and the published sandbox image is what users pull

To Do
Description

Type · chore (release operations) · Parent · MOTIR-1464, the discovery epic (no blocked_by / blocks edge into any not-done card of the finding work, so the edge test says NO) · Discovered in · the run of MOTIR-3768, 2026-08-28 · Repo · motir-core

The finding — the LANE is not broken, its VERDICT is true

MOTIR-3768 had to read every workflow's observed durations off the platform. sandbox-staleness.yml has no healthy run on record: every scheduled run sampled (33200717813 2026-08-28, 33099519758 2026-08-27, 32941479794 2026-08-26, and 32820267686 / 32701752907 / 32624525720 back to 2026-08-23) failed, each in about 30 seconds, at the same step.

The failure is the assertion itself, not an infrastructure fault:

##[error]the published image is 30 commits behind and the oldest has been unreleased for
16 days (limit 3) — everyone pulling ghcr.io/moooon-b-v/motir-sandbox is getting 0.3.0,
not what main documents. Cut a release: bump packages/cli/package.json, merge, then tag
the merge commit

Verified against shipped reality

  • Newest release tag: cli-v0.3.0, tagged 2026-08-11T21:46:28+02:00 (git ls-remote --tags origin 'refs/tags/cli-v*', git log -1 --format=%cI cli-v0.3.0) — 17 days ago.
  • packages/cli/package.json on origin/main still declares 0.3.0, so the declared version equals the newest tag and the drift is entirely in commits, not in a version bump nobody tagged.
  • git log --oneline cli-v0.3.0..origin/main -- packages/cli | wc -l → 30. That is exactly the number the tripwire reports, and packages/cli is assert-current.mjs's DEFAULT_WATCH_PATHS.
  • The limit is DEFAULT_MAX_DRIFT_DAYS = 3 (packages/cli/sandbox/smoke/assert-current.mjs:73).

So the tripwire is measuring the thing it was built to measure (MOTIR-2131 landed it for exactly this shape) and reporting a true condition. The defect is the unshipped release, not the check.

Why it is filed rather than left to the daily red

The last card that would have closed this — MOTIR-2613, Cut cli-v0.2.1 — is cancelled, and no open card names a release. A scheduled lane that has been red for 17 days is also a lane whose next genuine failure is indistinguishable from its current one, which is the same class of harm MOTIR-3569 and MOTIR-3768 are about: a signal that is always red carries no information.

Fix direction

A release cut, not a code change — executor: human because it ends in a tag push and a GHCR/npm publish nobody should fake:

  1. Read the 30 commits (git log cli-v0.3.0..origin/main -- packages/cli) and pick the semver bump they justify.
  2. Bump packages/cli/package.json, merge that to main.
  3. Tag the merge commit cli-v<version> and push the tag — this fires release-cli.yml and release-sandbox.yml.
  4. Verify as a consumer, per the artifact-obtainable check: npm pack @motir/cli@<version> and an anonymous docker pull ghcr.io/moooon-b-v/motir-sandbox:claude-<version>, and quote the digests.
  5. Record the published digests in packages/cli/sandbox/README.md (the shape MOTIR-1883 / MOTIR-2133 used).
  6. Confirm sandbox-staleness goes green on its next scheduled run — that is the only signal that the condition actually cleared.

The alternative reading, named so the fixer is not railroaded: if 30 commits of packages/cli churn is judged not to warrant a release, the honest fix is to raise --max-age-days on the schedule with a stated reason — never to leave the lane red. A tripwire nobody intends to act on should be re-tuned, not ignored.

Acceptance criteria

  1. A cli-v<version> tag exists on origin whose commit is on main and postdates cli-v0.3.0.
  2. npm pack @motir/cli@<version> succeeds anonymously, and docker pull ghcr.io/moooon-b-v/motir-sandbox:claude-<version> succeeds with no credential; both digests are quoted on this card.
  3. packages/cli/sandbox/README.md § Published images carries the new digests.
  4. The next scheduled sandbox-staleness run is green — quoted by run id.
  5. ORDERING — criteria 1–3 read on a tag and a registry, criterion 4 reads on a scheduled run that fires after the tag. Nothing here reads on MOTIR-3768's branch.

Context refs

  • .github/workflows/sandbox-staleness.yml — the lane; packages/cli/sandbox/smoke/assert-current.mjs:56,73,86 — TAG_PREFIX, DEFAULT_MAX_DRIFT_DAYS, DEFAULT_WATCH_PATHS.
  • MOTIR-2131 — the card that built this tripwire, after the same defect went unnoticed for eleven commits.
  • MOTIR-2613 — the cancelled Cut cli-v0.2.1 card; MOTIR-2132 / MOTIR-2133 are the worked shape of a release + digest record.
  • Run 33200717813 (job 98949200516) — the quoted failure.

Resolution: open.