Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›DevOps›DevOps Foundation·35 in this wave

Approve: DevOps FoundationTo do · blocker NEEDS MATTHEW: staging STRIPE_WEBHOOK_SIGNING_SECRETBlocked · blocker main is RED — 8 unit tests failing on origin/main, so pnpm verify cannot gate any PRDone · blocker The production account's data is 42 days stale — Analytics renders empty at any default windowBlocked · blocker MATTHEW: add db_url to the 1Password Supabase item — two RLS audits have never been runnableDone · blocker Wire apps/api test suite into CIDone Wire Playwright specs into CIDone Wire verify:swift-parity into CIDone Enable branch protection on mainBlocked Verify the staging environment is actually liveDone Web deploy workflow (manual trigger only)To do API deploy workflow (manual trigger only)To do Add post-deploy smoke test to the deploy workflowsTo do Write the rollback procedureTo do Add Sentry to iOSTo do Add Sentry to AndroidTo do Configure uptime monitoringTo do Set the three missing staging secrets on tactile-api-stagingDone Playwright is failing on main and producing no report — every run that gets a runner failsTo do Playwright job must free port 3000 BEFORE its first suite — a watchdog-killed job leaks its server and fails every later runDone Add CHANGELOG.mdTo do Automate release tagging on mainTo do Fix stale Vercel references in the observability runbookDone Add apps/api typecheck to CIDone Clean the SAST baselineTo do Flip SAST to blockingTo do Edge function deploy workflow (manual trigger only)To do Supabase migration check in CITo do Write the release procedureTo do Configure Supabase log drainTo do Centralize Cloudflare Workers logsTo do Replace console.* with structured logging in apps/apiTo do Two runners share one ~/.gradle — scope it per runner without losing the warm cacheTo do MATTHEW: CI capacity — one Mac, two runners, and a full Xcode build now runs on every pushTo do Auto-cancel queued CI runs whose head branch was deletedTo do

Wave

DevOps Foundation

Unblocked now — nothing waits on the surfaces. Wiring existing tests into CI, deploy automation, base observability.

TacTile › Launch TacTile › DevOps › DevOps Foundation

10/35 done25 open3 open blockers

Selected taskclear

Auto-cancel queued CI runs whose head branch was deleted

To doOwner · ait_93265e38

GitHub does not cancel queued workflow runs when their head branch is deleted. On a two-runner self-hosted setup every merge wave therefore leaves runs that gate nothing sitting ahead of runs that do. Measured 2026-08-16: 10 of 16 queued runs were for merged-and-pruned branches.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Auto-cancel queued CI runs whose head branch was deleted** · to do

GitHub does not cancel queued workflow runs when their head branch is deleted. On a two-runner self-hosted setup every merge wave therefore leaves runs that gate nothing sitting ahead of runs that do. Measured 2026-08-16: 10 of 16 queued runs were for merged-and-pruned branches.

Where it sits: TacTile › Launch TacTile › DevOps › DevOps Foundation

## The brief on file

PROBLEM, MEASURED 2026-08-16 during round-25 cleanup.

GitHub does NOT cancel queued workflow runs when the head branch is deleted. Squash-
merging a PR and pruning its branch leaves every already-queued run for that branch
sitting in the queue forever, holding slots.

The measurement: after merging round 25, the queue was 16 runs deep and **10 of them
were for branches that no longer existed** — every one a MERGED PR (#480, #481, #483,
#489, #490, #491, #492, #493). Cancelling them by hand took the queue 16 -> 6.

WHY IT HURTS HERE SPECIFICALLY. Two self-hosted runners on one Mac. A job that gets
stuck behind ten dead runs waits over an hour: run 31959550523 (`ios` on
r25-ios-embeds) was CREATED 16:45:23 and its job was not assigned a runner until
17:59:12 — 74 minutes queued, then it executed normally. That delay is what made three
round-25 PRs sit unmergeable for an hour, and it is a pure own-goal: nothing was
broken, the queue was just full of work that could never merge anything.

Note the diagnostic trap this creates, already recorded in memory: a run cancelled
this way reports as `fail` in `gh pr checks` with an EMPTY `runner_name` and an empty
`steps` array — indistinguishable, in that one command, from a real failure.

WHAT TO BUILD. A scheduled workflow (or a step on the existing nightly) that:
  1. lists queued + in_progress runs via
     `gh api "repos/:owner/:repo/actions/runs?status=queued"`,
  2. for each, tests whether `head_branch` still exists on origin
     (`git ls-remote --heads origin <branch>`), skipping `main`,
  3. POSTs `/actions/runs/<id>/cancel` for the ones whose branch is GONE,
  4. PRINTS every cancellation with the branch name and the PR it belonged to.

DESIGN CONSTRAINTS, learned from this repo's other checks:
  · Never cancel a run whose branch still exists — a live branch mid-review is exactly
    the run someone is waiting on. Test branch existence, not PR state: a PR can be
    merged while its branch is deliberately kept.
  · `main` must be excluded explicitly, not by accident of the branch test.
  · FLOOR IT. If the queued-run enumeration returns zero, that is far more likely to be
    a broken API call or a bad jq path than a genuinely empty queue — fail loudly
    rather than exiting 0 having cancelled nothing. Same reasoning as
    verify:shell-parse's four anti-vacuity floors.
  · Print what was cancelled. A cleanup job that only prints OK is how
    verify:agent-card-collection was found naming a comment as its consumption site.

RELATED: t_361002e9 (CI capacity — the underlying constraint; this task reduces waste
but does not add capacity), t_e7bfca45 (two runners sharing one ~/.gradle).

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

DevOps Foundation

Auto-cancel queued CI runs whose head branch was deleted