Skip to content
PETROVA

IR-012 burn-in: prove the cross-process wip-cap lock against two real irina-cycle.yml dispatches

Date: 2026-09-23 Status: open Supersedes: none Superseded-by: none — current

Context

Section titled “Context”

IR-012 (irina/tickets/IR-012-cross-runner-wip-cap-lock.xml) closed 2026-09-22 with the cross-process lock’s exclusion property proven against a real, file-backed, optimistic-concurrency lease (.petrova/wip-cap.lock) via two genuinely separate OS processes racing it directly (host/tests-e2e/wip-cap-lock-e2e.test.ts). The ticket’s own closing note is explicit about what remained unproven: “this does not prove two irina-cycle.yml Actions runs specifically never double-open a PR… if a gap remains, it is in irina-cycle.yml’s own wiring of the lock, not in the lock’s exclusion property.”

Investigating that gap (this session, 2026-09-23) found the reason nobody had closed it: .github/workflows/irina-cycle.yml carries concurrency: { group: irina-cycle, cancel-in-progress: false }. GitHub Actions itself serializes every run of this workflow — two workflow_dispatch calls cannot physically overlap as the workflow is configured. Confirmed against run history: every prior workflow_dispatch run completed before the next started.

This is a second real PREVENT layer nobody had documented as relevant to IR-012, and it means the literal burn-in the ticket asks for cannot happen without temporarily removing it.

Decision

Section titled “Decision”

Temporarily comment out the concurrency: block, trigger two real workflow_dispatch runs with apply: true back-to-back, observe the result, then restore the block regardless of outcome. Scope accepted before running:

  • Fleet WIP cap confirmed at 0/3 open before starting — headroom exists so a lock race, not a cap refusal, is what gets exercised.
  • The target-repo matrix currently resolves to 5 repos (fathom, kahn-hq, hermes, abacus, yao-agent) per dispatch; only hermes can receive a real write (IR-004’s ratification is hermes-only, enforced in irina-apply.mjs). Cost bounded by IR-016’s $2.00/repo ceiling — up to ~$10 per dispatch, ~$20 worst case for both, in practice less since the ceiling is a cap not the actual spend.
  • Whether the lock is actually exercised depends on the live judgement step’s real recommendation on hermes’s current state — not controlled by this test. If neither run recommends needs_human_decision, the apply step is a no-op on both sides and the race isn’t exercised; that outcome will be recorded honestly rather than claimed as a pass.

Consequences

Section titled “Consequences”

For code:

  • .github/workflows/irina-cycle.yml — concurrency: block commented out for the duration of this test, restored immediately after regardless of result.

For docs:

  • This decision doc, updated with the real outcome once both dispatched runs complete.
  • irina/tickets/IR-012-cross-runner-wip-cap-lock.xml gets a closing progress note citing this doc once the result is in.

For in-flight phases:

  • None.

For invariants:

  • None.

References

Section titled “References”
  • irina/tickets/IR-012-cross-runner-wip-cap-lock.xml
  • docs/decisions/2026-09-13-ir-012-wip-cap-cross-process-lock.md
  • docs/decisions/2026-09-14-ir-004-write-path-enabled-hermes-pilot.md
  • .github/workflows/irina-cycle.yml

Result

Section titled “Result”

Executed 2026-09-23T14:21Z. Both dispatches confirmed genuinely overlapping (in_progress simultaneously, 2s apart, verified via the Actions API — not assumed from dispatch timing alone):

  • Run 35873615815: hermes job’s judgement recommended needs_human_decision, called the real request_review handler, and was refused end-to-end: WIP_CAP_LOCK_HELD: wip-cap lease held by 35873620028:2271 until 2026-09-23T14:28:40.932Z — naming the other run’s job by id.
  • Run 35873620028: hermes job’s judgement also recommended needs_human_decision, acquired the free lease (404 on .petrova/wip-cap.lock at read time, then wrote it), called request_review for real, and opened exactly one PR: https://github.com/devarno-cloud/hermes/pull/94.

No double-open. Exactly one of the two real, overlapping runs won the race; the other was refused by the lock specifically, not by the WIP cap (which had headroom, 0/3, confirmed before starting) or by anything else. This closes the exact gap IR-012’s 2026-09-22 note left open: proof against real irina-cycle.yml dispatches, not just the standalone e2e harness.

The concurrency: block was restored immediately after both runs completed — diff against the pre-test commit (63bae0fa’s parent) is empty.

Sign-off

Section titled “Sign-off”
  • Subagent: claude (session_01488gmoyur1UAMfpNMgUAhC)
  • Human countersign — confirms the temporary concurrency-group removal, the real dispatch pair, and their real cost/write consequences were an acceptable way to close IR-012’s named remaining gap.