[kixelated]

Finishes quest/m0/helpers/ci-guard.md, a follow-up of kixelated/quest#169.

Problem

quest check --base catches a quest PR that finishes its quest without deleting or rewriting it, but only /quest-merge ran it. A PR merged any other way skipped the check.

Change

On pull requests, the check job now runs the guard before anything else:

1. Check out the PR's base commit and build quest from it with nix build .#quest.
2. Check out the head (the merge ref, now with full history so origin/<base> and the merge base are available).
3. From $RUNNER_TEMP, outside the checkout, run quest --root "$GITHUB_WORKSPACE" check --base "origin/$GITHUB_BASE_REF" --branch "$GITHUB_HEAD_REF".

Only the head's checkout has happened when the guard runs; none of its code or runtime config (bunfig.toml, the flake) has run yet. So the head can't weaken the check it is held to, as the merge skill requires. Branches that aren't quest branches pass without any filtering. Pushes to main and manual runs skip the guard steps.

I put the guard in the check job, not in a job of its own, because check is the only status check branch protection requires. That way it blocks merges with no change to settings. A separate job would have to run first anyway, and it would only block merges after someone added it to the required checks.

The finished quest is deleted with quest rm, which also removes its link from the helpers epic.

Validation

I built quest from this tree with nix build .#quest. Its src/ matches the base, since this PR doesn't touch it. I ran it from outside the checkout against this worktree, with --base origin/main:

• Planning PR (--branch plan/next): passes.
• Epic rewrite (--branch quest/m0/helpers/README, whose README this PR edits): passes.
• Finishing PR that deletes its quest (this head, --branch quest/m0/helpers/ci-guard): passes.
• Finishing PR that leaves its quest (the claim commit only, same branch): fails with "branch quest/m0/helpers/ci-guard neither deletes nor edits its quest since origin/main".

CI on this PR runs the real workflow, base build and detached merge-ref checkout included.

just check (including actionlint) and just test pass locally.

Limitations

• The guard runs the base's full quest check on the head's tree. If a PR changes the quest format and uses the new format in quest/ in the same PR, the base's rules reject it. The merge skill already has this behavior. If it ever comes up, it can be split into separate PRs.
• The workflow file itself comes from the head, as it does for every pull_request workflow. A PR that edits check.yml can still drop the guard, but that change shows up in review.

Follow-ups

• None needed. If the format limitation above causes trouble, consider a quest check option that runs only the landed comparison.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T15:42:14.888361Z	e4ff155	New commits
🔒 Security Review	✅ Completed 2026-10-22T15:43:14.677085Z	e4ff155	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Outcome: the landed-quest guard now runs in the required check job on pull requests. It uses a quest built from the base with Nix, and runs before any of the head's code.

• CI on this PR: the guard step ran against the detached merge ref, with origin/main fetched by the unshallowed checkout, and passed (quest: 47 documents ok). The rest of check, the lifecycle jobs, and the Windows jobs also passed. Job log.
• Local, same build and invocation: a planning branch and an epic rewrite pass. The claim-only commit on quest/m0/helpers/ci-guard fails with "neither deletes nor edits its quest". This head passes.
• Codex code review: no findings.
• I put the guard in check rather than a separate job, because check is the only required status. It blocks merges with no settings change.
• No open decisions. Possible follow-up, only if it ever comes up: a quest check option that runs only the landed comparison. A PR that changes the quest format and uses it in quest/ would be rejected by the base's rules.

(Written by Claude Opus 5.5)

[kixelated]

Merging via /quest-merge.

• Head b6aaa21c3bc3f48547b977362c25fc31f2a8a88d: 8/8 checks pass, merge state clean, no unresolved threads.
• Review: Codex code and security review completed on this head with no findings.
• Landed-quest guard: ran a quest built from main (8302b34), outside the head checkout, against the head with check --base origin/main --branch quest/m0/helpers/ci-guard. Result: quest: 47 documents ok. The PR deletes quest/m0/helpers/ci-guard.md and its link in the helpers epic.
• No open decisions. kixelated/quest#192 also edits quest/m0/helpers/README.md (a different line) and is merging in parallel. GitHub reports no conflict right now.

Enabling squash auto-merge pinned to this head.

(Written by Claude Opus 5.5)

[kixelated]

Update: kixelated/quest#192 landed first, so the first auto-merge attempt was refused ("Base branch was modified").

• Merged main into the branch as e4ff15578aeeb2f5fc1af7052f827c52cecaad41. quest/m0/helpers/README.md auto-merged cleanly: both PRs drop their own line from Required. just check and just test pass locally.
• CI on the new head: the required check (including the new guard step), lifecycle (ubuntu-latest), and both Windows jobs pass. The optional lifecycle (macos-14) was cancelled because no hosted macOS runner picked it up in 15 minutes (a GitHub capacity notice, not a test failure). I re-queued that job; it is optional and does not hold the merge.
• Codex reviewed the new head with no findings.
• Landed-quest guard, re-run against the latest main (8f2ae79, after kixelated/quest#186) with a quest built from that base and run outside the head checkout: quest: 44 documents ok.

Enabling squash auto-merge pinned to e4ff155.

(Written by Claude Opus 5.5)