fix: restore three PRs that #66's merge silently reverted, and take openspec 1.10

ullrich commented

2026-08-24 12:47:01 +00:00

Owner

What happened

#66 ("Update testing tooling to v1.62.1") reverted three already-merged PRs. It was squashed onto a stale base, so its commit carried that branch's entire tree rather than just the ci.yml change it was for. Merging it undid everything that had landed in between:

PR	File	Reverted to
#63	`docker/brouter/Dockerfile`	temurin 25 → 11
#80	`route-features/activity-feed/spec.md`	pre-fix (scenarios dropped again)
#80	`wahoo-production-cutover/wahoo-route-push/spec.md`	pre-fix
#38	`pnpm-lock.yaml`	`@fission-ai/openspec` 1.9.0 → 1.6.0
#38	`.agents/skills/`, `.claude/commands/opsx/`	regenerated docs, undone

Only .forgejo/workflows/ci.yml was meant to change.

It wasn't only git. cd-brouter redeployed afterwards, so production BRouter has been running openjdk 11.0.31 — not the 25.0.3 that #63 verified. Java 25 was live for about three hours before being silently rolled back.

Nothing failed. Every CI run was green, because each PR was tested against its base at push time, not at merge time — precisely the hazard CLAUDE.md documents. The revert simply looked like a dependency PR doing dependency things.

What this restores

All three, plus openspec goes to 1.10.0 rather than #86's 1.9.0, which is already stale. package.json's floor moves ^1.6.0 → ^1.10.0 so it stops understating the requirement, and the generated skill/command docs are rebuilt with openspec update --force. 1.10 adds a sync workflow, hence the new openspec-sync-specs skill and opsx/sync command.

Deliberately not included

The rest of #86's development-group bumps. They're within existing caret ranges and belong to Renovate, which regenerates the lockfile against current main — hand-merging its 586-line lockfile is the exact manoeuvre that caused this incident. Two of them, vitest and @vitest/browser-playwright, must also move in lockstep with the ci.yml Playwright image tag, so they need the grouping rather than an opportunistic bump here.

#86 should be left for Renovate to rebase (rebaseWhen: "conflicted"), after which it will contain only the remaining bumps.

Testing

openspec 1.10 validation: 81 passed, 0 failed. Confirmed the restored fix is load-bearing — without it, 1.10 fails the same two changes 1.9 did, so 1.10 kept that rule.
typecheck 14/14, lint 14/14, test 12/12.
Diffed every resolved package version against main to prove nothing regressed: 23 upgrades, and the one flagged "downgrade" (emoji-regex 10.6.0 → 8.0.0) is a duplicate copy dropping out — main carried both 8.0.0 and 10.6.0, the latter pulled by string-width@7.2.0 in the old inquirer chain that 1.10 no longer needs. Not a direct dependency anywhere.

That last check is the one whose absence let this through, and it's worth making routine: after rebasing or squashing any lockfile-touching branch, diff resolved versions against the target and assert no package moves backwards. A green CI run will not tell you.

After merging

cd-brouter will trigger on the docker/brouter/Dockerfile change and put Java 25 back. Worth confirming it actually routes afterwards — docker exec trails-brouter java -version plus a route request — since that's how the rollback went unnoticed the first time.

## What happened **#66 ("Update testing tooling to v1.62.1") reverted three already-merged PRs.** It was squashed onto a stale base, so its commit carried that branch's *entire tree* rather than just the `ci.yml` change it was for. Merging it undid everything that had landed in between: | PR | File | Reverted to | |---|---|---| | **#63** | `docker/brouter/Dockerfile` | temurin **25 → 11** | | **#80** | `route-features/activity-feed/spec.md` | pre-fix (scenarios dropped again) | | **#80** | `wahoo-production-cutover/wahoo-route-push/spec.md` | pre-fix | | **#38** | `pnpm-lock.yaml` | `@fission-ai/openspec` **1.9.0 → 1.6.0** | | **#38** | `.agents/skills/*`, `.claude/commands/opsx/*` | regenerated docs, undone | Only `.forgejo/workflows/ci.yml` was meant to change. **It wasn't only git.** `cd-brouter` redeployed afterwards, so production BRouter has been running `openjdk 11.0.31` — not the `25.0.3` that #63 verified. Java 25 was live for about three hours before being silently rolled back. Nothing failed. Every CI run was green, because each PR was tested against its base at push time, not at merge time — precisely the hazard `CLAUDE.md` documents. The revert simply looked like a dependency PR doing dependency things. ## What this restores All three, plus openspec goes to **1.10.0** rather than #86's 1.9.0, which is already stale. `package.json`'s floor moves `^1.6.0 → ^1.10.0` so it stops understating the requirement, and the generated skill/command docs are rebuilt with `openspec update --force`. 1.10 adds a `sync` workflow, hence the new `openspec-sync-specs` skill and `opsx/sync` command. ## Deliberately not included The rest of #86's development-group bumps. They're within existing caret ranges and belong to Renovate, which regenerates the lockfile against *current* main — hand-merging its 586-line lockfile is the exact manoeuvre that caused this incident. Two of them, `vitest` and `@vitest/browser-playwright`, must also move in lockstep with the `ci.yml` Playwright image tag, so they need the grouping rather than an opportunistic bump here. #86 should be left for Renovate to rebase (`rebaseWhen: "conflicted"`), after which it will contain only the remaining bumps. ## Testing - **openspec 1.10 validation: 81 passed, 0 failed.** Confirmed the restored fix is load-bearing — without it, 1.10 fails the same two changes 1.9 did, so 1.10 kept that rule. - typecheck 14/14, lint 14/14, test 12/12. - **Diffed every resolved package version against main** to prove nothing regressed: 23 upgrades, and the one flagged "downgrade" (`emoji-regex 10.6.0 → 8.0.0`) is a duplicate copy dropping out — main carried both 8.0.0 and 10.6.0, the latter pulled by `string-width@7.2.0` in the old inquirer chain that 1.10 no longer needs. Not a direct dependency anywhere. That last check is the one whose absence let this through, and it's worth making routine: **after rebasing or squashing any lockfile-touching branch, diff resolved versions against the target and assert no package moves backwards.** A green CI run will not tell you. ## After merging `cd-brouter` will trigger on the `docker/brouter/Dockerfile` change and put Java 25 back. Worth confirming it actually routes afterwards — `docker exec trails-brouter java -version` plus a route request — since that's how the rollback went unnoticed the first time.

ullrich added 1 commit

2026-08-24 12:47:01 +00:00

fix: restore three PRs that #66 's merge silently reverted, and take openspec 1.10

CD Staging / Build & Push Docker Images (pull_request) Has been skipped

Details

CD Staging / Build & Push Docker Images-1 (pull_request) Has been skipped

Details

CD Staging / Deploy Staging (pull_request) Has been skipped

Details

CD Staging / Deploy PR Preview (pull_request) Has been skipped

Details

CI / Security Scan (pull_request) Successful in 44s

Details

CI / Dockerfile Package Check (pull_request) Successful in 17s

Details

CI / Visual Tests (pull_request) Successful in 1m52s

Details

CI / Journal Image Smoke Test (pull_request) Successful in 17m22s

Details

CI / Checks (pull_request) Successful in 3m21s

Details

CI / E2E Tests (pull_request) Successful in 6m38s

Details

Cancel superseded CI / Cancel in-flight CI (pull_request) Successful in 15s

Details

CD Staging / Tear Down PR Preview (pull_request) Successful in 27s

Details

efa0a7a0b8

#66 ("Update testing tooling to v1.62.1") was squashed onto a stale base, so its
commit carried that branch's whole tree rather than just its intended ci.yml
change. Merging it reverted everything that had landed in between. Only
.forgejo/workflows/ci.yml was meant to change; these were collateral:

  #63  docker/brouter/Dockerfile          temurin 25 -> 11
  #80  route-features/activity-feed       the MODIFIED-block scenario fix
  #80  wahoo-production-cutover/…         the MODIFIED-block scenario fix
  #38  pnpm-lock.yaml                     @fission-ai/openspec 1.9.0 -> 1.6.0
  #38  .agents/skills/*, .claude/commands/opsx/*   regenerated docs, undone

Not just in git: cd-brouter redeployed afterwards, so production BRouter has been
running `openjdk 11.0.31` rather than the 25.0.3 that #63 verified. The Java 25
change was live for roughly three hours.

This restores all three and goes to openspec 1.10.0 (latest; 1.9.0 as proposed in
#86 is already stale). package.json's floor moves ^1.6.0 -> ^1.10.0 so it stops
understating the requirement, and the generated skill/command docs are rebuilt
with `openspec update --force` — 1.10 adds a `sync` workflow, hence the new
openspec-sync-specs skill and opsx/sync command.

Deliberately NOT included: the rest of #86's development-group bumps. Those are
within existing caret ranges and belong to Renovate, which regenerates the
lockfile from current main; hand-merging its 586-line lockfile is the manoeuvre
that caused this incident. Two of them — vitest and @vitest/browser-playwright —
must also move in lockstep with the ci.yml Playwright image tag, so they need
Renovate's grouping rather than an opportunistic bump here.

Verified openspec 1.10 accepts the restored specs (81 passed, 0 failed — the same
two changes fail without the fix, so 1.10 kept 1.9's rule). typecheck 14/14,
lint 14/14, test 12/12. Also diffed every resolved version against main to prove
nothing regressed: 23 upgrades, and the single flagged "downgrade"
(emoji-regex 10.6.0 -> 8.0.0) is a duplicate copy dropping out — main carried both
8.0.0 and 10.6.0, the latter pulled by string-width@7.2.0 in the old inquirer
chain that 1.10 no longer needs. That comparison is the check whose absence let
this incident through.