health digest 2026-09-14

Weekly read-only health digest for `Hmbown/CodeWhale`, window 2026-09-07 → 2026-09-14. No PRs opened/closed, nothing pushed, no branches deleted. No previous `health digest` issue exists to close.

## Recommended actions (ranked by impact)

1. **Approve the contribution gate for @BX166 (#6171).** 5 workflow runs (CI, OpenHarmony, Web Frontend, both review bots) are stuck at `action_required`; the author is not in `.github/APPROVED_CONTRIBUTORS`. Approve the runs and add `all:BX166` or comment `/lgtm`. @VincentCorleone (#6170) is also unlisted but currently has no blocked runs.
2. **Main CI was red for 56 of 103 `ci.yml` runs on `main` this week (54%).** Latest `main` runs are green (last failure `a286ded6`, `Version drift` job). The dominant failure was a cluster of 8+ tests failing together on the same commits (`open_or_init_with_cap_rejects_oversized_workspace` ×12 job failures on `main`, the deepseek-cn/doctor/runtime_api group ×7) — these are broken-commit failures, not flakes. Only 4 `(sha, job)` pairs actually flip-flopped (true flakes) — see §3.
3. **Land or close the two stale Hmbown PRs** (#5752 cloud-facts, 15 days no activity; #5861 brand whale, 11 days): both `CONFLICTING`, both failing `Test (windows-latest)`. Three other PRs are also `CONFLICTING/DIRTY` (#6161, #6134, #6055) — main churn is outrunning open work.
4. **Version drift:** `npm/deepseek-tui` is `0.8.49` vs workspace `0.9.13`; `web/package.json` is `0.1.0` (probably intentional, but the `Version drift` CI job failed 14 times this week). Dead-code budget is **exactly at budget (413/413)** — the next `#[allow(dead_code)]` fails CI.
5. **Docs drift:** 14 code slash commands undocumented (`/advisor /balance /exit /import-claude /lsp /pin /structcopy /system /transcript /verbose /voice /voicecontrol /voicesend /workbar`); 7 documented commands not in code (`/rc /dryrun /preview_request /plan /yolo /relaunch /relay`). Prune 25 stale bot branches (§2) once confirmed dead.

## 1. Stale PRs (no commit or comment since 2026-09-07)

| PR | Author | Age | Last activity | Failing checks | Unresolved threads | Mergeable |
|---:|---|---|---|---|---:|---|
| #5752 | @Hmbown | 15d | 2026-08-30 | Test (windows-latest) | 0 | CONFLICTING |
| #5861 | @Hmbown | 11d | 2026-09-03 | Test (windows-latest) | 2 | CONFLICTING |

Other open PRs (8, all active in window): #6171 BX166 — **gate blocked**, 5 `action_required` runs; #6170 VincentCorleone — green, 8 unresolved threads, unlisted contributor; #6161 Hmbown — CONFLICTING, 8 threads; #6134 Hmbown — CONFLICTING, Lint failing; #6105/#6104 dependabot — green, mergeable; #6096 aboimpinto — green, CLEAN, 0 threads (ready to land); #6055 h3c-hexin — CONFLICTING, Lint + Windows Test + npm smoke failing, 3 threads. `buildkite/codewhale-ci` appears in the rollup only on #5861 (state `None`).

Command

```sh
for n in 6171 6170 6161 6134 6105 6104 6096 6055 5861 5752; do gh pr view $n --json author,createdAt,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup,commits,comments; done
# reviewThreads via GraphQL: pullRequest(number:$n){reviewThreads(first:100){nodes{isResolved}}}
gh run list --branch --limit 5 --json status,conclusion,name
```

## 2. Stale branches (no commits since 2026-08-15, no open PR, `snapshot/*` skipped) — 25

| Prefix | Count | Last commit |
|---|---:|---|
| `copilot/*` (copilot-swe-agent[bot] / Hmbown) | 14 | 2026-08-03 |
| `codex/*` | 3 | 2026-07-31 – 08-01 |
| `bisect/win-*` | 3 | 2026-08-06 |
| `contrib/accepted-0.9.4`, `contrib/pr-5233` | 2 | 2026-08-03 |
| `cleanup/v095-manageability`, `web/copy-buttons-hanspacing`, `copilot/runtime-api-*` etc. | 3 | 2026-08-07 – 08-13 |

Full list + command

```sh
git fetch --prune && git for-each-ref --sort=committerdate --format='%(refname:short) %(committerdate:short) %(authorname)' refs/remotes/origin
```
```
origin/codex/v094-budget-5001 2026-07-31 Hmbown
origin/codex/v094-bench-turn-scoping 2026-08-01 Hmbown
origin/codex/wave-5055-effort-table 2026-08-01 Hmbown
origin/copilot/v094-make-responses-provider-profiled 2026-08-03 copilot-swe-agent[bot]
origin/copilot/rename-deepseekclient-legacy-internals 2026-08-03 copilot-swe-agent[bot]
origin/copilot/move-workflow-status-top-bar 2026-08-03 copilot-swe-agent[bot]
origin/copilot/v094-extract-responses-dialect-policy 2026-08-03 copilot-swe-agent[bot]
origin/copilot/fix-provider-switching-issue 2026-08-03 copilot-swe-agent[bot]
origin/copilot/fix-sub-agent-fleet-spawn-rejects 2026-08-03 copilot-swe-agent[bot]
origin/copilot/fix-fleet-config-silhouette 2026-08-03 copilot-swe-agent[bot]
origin/copilot/whaleflow-janitor-implementation 2026-08-03 copilot-swe-agent[bot]
origin/copilot/whaleflow-cached-main-overlay 2026-08-03 copilot-swe-agent[bot]
origin/copilot/zero-sandbox-mode-dev 2026-08-03 copilot-swe-agent[bot]
origin/copilot/add-skill-install-update-uninstall-trust-audit 2026-08-03 copilot-swe-agent[bot]
origin/copilot/runtime-api-add-bounded-mcp-config 2026-08-03 Hmbown
origin/copilot/add-memory-inspection-endpoint 2026-08-03 copilot-swe-agent[bot]
origin/copilot/runtime-api-expose-verifier-evidence 2026-08-03 Hmbown
origin/copilot/expose-persistent-goal-loop-state 2026-08-03 Hmbown
origin/contrib/accepted-0.9.4 2026-08-03 Hunter Bown
origin/contrib/pr-5233 2026-08-03 Hunter Bown
origin/bisect/win-after-5077 2026-08-06 CodeWhale Bot
origin/bisect/win-after-5240 2026-08-06 CodeWhale Bot
origin/bisect/win-debug 2026-08-06 CodeWhale Bot
origin/cleanup/v095-manageability 2026-08-07 CodeWhale Bot
origin/web/copy-buttons-hanspacing 2026-08-13 CodeWhale Bot
```

## 3. CI flake ranking (2026-09-07 → 09-14)

**GitHub Actions `ci.yml`:** 238 runs, 88 failed. `main`: 103 runs / 56 failed. `pull_request`: 122 / 27.

Failed jobs: Lint 53 · Test (windows-latest) 46 · Test (macos-latest) 40 · Test (ubuntu-latest) 15 · Version drift 14 · npm wrapper smoke (ubuntu) 4 · Integrations 3 · Documentation 2 · Safety gate 2 · npm wrapper smoke (windows) 1.

Top failing tests (count = failing-job occurrences across all runs):

| # | Test | Count | Example |
|---:|---|---:|---|
| 1 | `tools::subagent::tests::queued_turn_owned_child_parks_without_a_false_start_transition` | 36 | [run](https://github.com/Hmbown/Codewhale/actions/runs/34438666350) |
| 2 | `tools::subagent::tests::turn_end_parking_preserves_a_step_zero_resumable_checkpoint` | 36 | same |
| 3 | `runtime_api::tests::fleet_status_runtime_api_exposes_state_and_actions` | 32 | [run](https://github.com/Hmbown/Codewhale/actions/runs/34455961246) |
| 4–10 | deepseek-cn / doctor_endpoint / provider_switch / composed_frame cluster (7 tests, fail together) | 28 each | same |
| 11 | `snapshot::repo::tests::open_or_init_with_cap_rejects_oversized_workspace` | 28 (12 on main) | [run](https://github.com/Hmbown/Codewhale/actions/runs/34444153260) |
| 12 | `route::export::tests::golden_providers_export_matches_registry` | 24 | [run](https://github.com/Hmbown/Codewhale/actions/runs/34454972579) |
| 13 | `local_ollama::tests::probe_live_local_ollama_catalog_reads_api_tags` | 10 | [run](https://github.com/Hmbown/Codewhale/actions/runs/34778986475) |
| 14 | `core::engine::tests::first_turn_waits_for_explicit_mcp_schema_without_waiting_for_unrelated_server` | 10 | [run](https://github.com/Hmbown/Codewhale/actions/runs/34545532092) |
| 15 | `tui::keybindings::tests::keybindings_md_and_help_catalog_do_not_drift` | 6 | [run](https://github.com/Hmbown/Codewhale/actions/runs/34637149620) |

**Truly flaky** (`(sha, job)` failed then passed on the same commit): `700b6fc0` Test (ubuntu) · `b6b3df36` Test (macos) · `0fa9ee91` Test (ubuntu) + npm wrapper smoke (windows). Everything else above failed consistently on its commit → regression/broken-branch, not flake. `probe_live_local_ollama_catalog_reads_api_tags` (live network probe) is the most likely environment-dependent candidate.

**Buildkite `codewhale-ci`:** 78 builds — 63 passed, 15 failed. Failed steps: `:rust: workspace tests` 12 · `:apple: workspace tests` 10 · `:rust: fmt + clippy` 4. No commit both failed and passed (0 flakes). 6 of 15 failures on `fix/0913-release-recovery-20260907`, 3 on `integration/new-prs-20260907`. Example: https://buildkite.com/hunter-bown/codewhale-ci/builds/1929

Commands

```sh
gh run list --workflow ci.yml --created '>=2026-09-07' --limit 300 --json databaseId,headSha,headBranch,event,conclusion,createdAt,url
gh run view --json jobs
gh run view --log-failed | grep -E 'test .* \.\.\. FAILED'
curl -s -H "Authorization: Bearer $BUILDKITE_READ_TOKEN" "https://api.buildkite.com/v2/organizations/hunter-bown/pipelines/codewhale-ci/builds?created_from=2026-09-07T00:00:00Z&per_page=100"
```

## 4. Drift checks (fresh `--depth 1` clone of main)

| Check | Result |
|---|---|
| `python3 scripts/check-dead-code-budget.py` | `PASS: 413 attributes, exactly at budget.` (exit 0) — **zero headroom** |
| `Cargo.toml` workspace version | 0.9.13 |
| `CHANGELOG.md` top entry | 0.9.13 (2026-09-13) ✓ |
| `npm/codewhale`, `npm/runtime-sdk` | 0.9.13 ✓ |
| `npm/deepseek-tui` | **0.8.49** (lagging) |
| `web/package.json` | 0.1.0 (not release-tracked) |

Docs vs product — sources of truth: 88 `CommandInfo.name` entries under `crates/tui/src/commands/**` (registered via `groups::all_command_groups()`), help view `crates/tui/src/tui/views/help.rs`; settings taxonomy `ConfigCategory::ALL` (7 categories: Appearance, ModelsProviders, Work, ToolsMcp, Trust, Motion, Advanced) in `crates/tui/src/tui/views/mod.rs`; `/setup` `STEP_SPECS` (10 steps) in `crates/tui/src/tui/setup/mod.rs`. Scanned `docs/` and `web/` (excluding `node_modules`).

- **In code, not in docs (14):** `/advisor /balance /exit /import-claude /lsp /pin /structcopy /system /transcript /verbose /voice /voicecontrol /voicesend /workbar`
- **In docs, not in code (7):** `/rc /dryrun /preview_request /plan /yolo /relaunch /relay`
- Settings: category names are generic words (Work, Trust, Motion…) so a text scan cannot prove docs coverage; no doc page enumerating the 7 `ConfigCategory` entries or the 10 `/setup` steps was found — worth a dedicated `/settings` reference page.

## 5. Security posture

| Source | Open |
|---|---:|
| Dependabot alerts (`gh api repos/Hmbown/CodeWhale/dependabot/alerts?state=open`) | **0** |
| CodeQL / code-scanning alerts | **unavailable** — HTTP 403 "Resource not accessible by integration"; `GITHUB_CODEWHALE_SECURITY_PAT` is not provisioned |

## 6. Open issues — 92

| Label | Count |
|---|---:|
| enhancement | 38 |
| (unlabeled) | 35 |
| rust | 16 |
| tui / cleanup | 9 / 9 |
| documentation | 6 |
| bug | 5 |
| tools / reliability | 4 / 4 |
| agent-ready | 3 |
| ux / v0.9.12 / responses-api | 2 each |
| dependencies, subagents, question, external-memory, release-blocker, model-lab | 1 each |

Issues with no non-author **human** response and no update in >14 days (before 2026-08-31): **0**. Caveat: every issue gets an automated `codewhale-issue-intake` comment; excluding bots (`github-actions`, `*[bot]`) still yields 0 because all 92 were updated within 14 days (stale-bot/label churn), so this metric is not currently discriminating.

Command

```sh
gh issue list --state open --limit 1000 --json number,title,labels,createdAt,updatedAt,comments,author
```

Start by reviewing the ranked recommendations and the commands in the issue, especially the CI, branch, drift, and documentation checks; referenced entry points include ci.yml, scripts/check-dead-code-budget.py, crates/tui/src/commands/**, help.rs, and setup/mod.rs. This report has no single bounded change or acceptance criterion, so confirm which recommendation is being claimed before defining done.

Written by the indexing model from the issue text.