Package invariants is red on every PR since 2026-09-12: the self-test that proves a mainline push gates everything is itself failing

[rubenvdlinde]

The Package invariants job runs every helper suite it discovers. One suite has failed on every pull_request run since 2026-09-12, and two PRs have been merged past it.

Which suite, and what it says. test_gate_mainline_push_audits_everything.sh, 5 failures:

FAIL — the runner exited 99 on a mainline push — it gated nothing (#183)
FAIL — no gate reported at all — a mainline push still gates nothing
FAIL — the run did not announce the full-tree fallback — a silent re-scope is how a scope change goes unnoticed
FAIL — the run never reached the coverage summary
FAIL — gate-25 reported 'nothing' — the fallback scope is not reaching tracked files

plus, above them, 0: integer expression expected, which is bash comparing an empty variable as a number. That is the likely root: some value the suite expects to be a count is arriving empty, the runner exits 99, and every downstream assertion fails on the absence.

Evidence that it is inherited, not introduced by the PR it currently blocks. Package invariants on recent pull_request runs, in order:

PR	state	Package invariants
#759	merged	success
#762	merged	failure
#763	merged	failure
#767	open	failure
#768	open	failure

It flipped between #759 and #762 and has stayed red on every PR since, including two that touch neither the gate runner nor this suite. The lockfile lane that opened #767 reported it reproduces at the base commit with that change absent.

Why this is not noise to be merged past indefinitely. Exit 99 in this fleet's contract means could not run, and 99 is not a pass. This suite exists to prove that a push to a mainline branch audits the full tree. While it is red, nothing verifies that a mainline push gates anything. An instrument that tests the instrument is down, and the two merges past it are the exact pattern the suite was written to catch.

A second suite in the same job, test_gate_orphaned_capability_fixtures.sh, reports "still failing as documented" with fixtures absent (3 assertions red and 2 green-because-empty; needs register-handler-resolution-{pass,fail}, orphaned-write-capability-{pass,fail}, orphaned-write-crossapp authored). That one is a known, documented gap and is not counted as the failing suite. Listed here so nobody conflates the two.

Not fixed here. Found while landing #768, which changes the E2E trigger and does not touch the gate runner. Merging #768 past this failure is consistent with how #762 and #763 were merged, but the failure itself needs an owner.

To reproduce the timing precisely: gh api repos/ConductionNL/.github/actions/runs?event=pull_request and read the Package invariants job on the runs for #759 and #762.