merge: reconcile context telemetry with append-only persistence

Preserve effective input-token analytics from the context-budget branch while adopting mainline batched append-only message event persistence.

Generated-By: looper 0.11.8 (runner=fixer, agent=codex)

Author: Siri-Ray

.github/actions/setup-playwright/action.yml

@@ -99,6 +99,28 @@ runs:
         package_dir="${PACKAGE_JSON_PATH%/*}"
         pnpm -C "$package_dir" exec playwright install chromium
 
+    - name: Pin Blacksmith apt mirror to the canonical archive
+      if: ${{ steps.preinstalled-playwright.outputs.enabled != 'true' }}
+      shell: bash
+      env:
+        RUNNER_LABELS_JSON: ${{ inputs.runner-labels }}
+      run: |
+        # Blacksmith VMs resolve apt through a mirrorlist of third-party
+        # university mirrors. When one goes down, apt retries it for every
+        # index file before falling back, so the `apt-get update` inside
+        # `playwright install --with-deps` hangs until the job timeout.
+        # Browser OS deps are NOT fully preinstalled on the Blacksmith image
+        # (xvfb, fonts, libasound are missing), so apt must stay in the path;
+        # pin the canonical archive so it stays deterministic instead.
+        case "$RUNNER_LABELS_JSON" in
+          *'"blacksmith-'*) ;;
+          *) exit 0 ;;
+        esac
+        mirrorlist=/etc/apt/blacksmith-ubuntu-mirrors.txt
+        if [ -f "$mirrorlist" ]; then
+          printf 'http://archive.ubuntu.com/ubuntu\tpriority:1\n' | sudo tee "$mirrorlist"
+        fi
+
     - name: Install Playwright browsers
       if: ${{ steps.preinstalled-playwright.outputs.enabled != 'true' }}
       shell: bash

.github/scripts/landing-page-purge-edge-cache.ts

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+
+// Purge Cloudflare edge cache for the marketing host(s) by hostname.
+//
+// Used by `landing-page-production` after `pages deploy` so locale HTML
+// (`/`, `/zh/pricing/`, …) does not keep serving pre-deploy objects when
+// CF Pages' deploy invalidation is incomplete for the custom domain, and by
+// `landing-edge-cache-purge` for manual incident recovery / token checks.
+//
+// Inputs (all via env):
+//   CLOUDFLARE_API_TOKEN  (required) token with Zone → Cache Purge on the zone
+//   CLOUDFLARE_ZONE_ID    (optional) defaults to the open-design.ai zone id
+//   CLOUDFLARE_PURGE_HOSTS (optional) comma-separated hostnames, default
+//                          `open-design.ai`
+//
+// Scope: hosts purge is intentional — one host, all paths/locales, without
+// touching other hostnames on the same zone (e.g. download.open-design.ai).
+//
+// @see https://developers.cloudflare.com/api/resources/cache/methods/purge/
+// @see https://developers.cloudflare.com/cache/how-to/purge-cache/purge-by-hostname/
+
+type PurgeResponse = {
+  success?: boolean;
+  errors?: unknown;
+  result?: unknown;
+};
+
+const DEFAULT_ZONE_ID = "84ed4658186179c7eba52659b6ef48ad";
+
+const token = process.env.CLOUDFLARE_API_TOKEN?.trim();
+const zoneId = process.env.CLOUDFLARE_ZONE_ID?.trim() || DEFAULT_ZONE_ID;
+const hosts = (process.env.CLOUDFLARE_PURGE_HOSTS || "open-design.ai")
+  .split(",")
+  .map((host) => host.trim())
+  .filter(Boolean);
+
+if (!token) {
+  console.error("CLOUDFLARE_API_TOKEN is required");
+  process.exit(1);
+}
+if (hosts.length === 0) {
+  console.error("CLOUDFLARE_PURGE_HOSTS resolved to an empty host list");
+  process.exit(1);
+}
+
+const response = await fetch(
+  `https://api.cloudflare.com/client/v4/zones/${zoneId}/purge_cache`,
+  {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({ hosts }),
+  },
+);
+
+const payload = (await response
+  .json()
+  .catch(() => null)) as PurgeResponse | null;
+const ok = response.ok && payload?.success === true;
+
+console.log(
+  JSON.stringify(
+    {
+      httpStatus: response.status,
+      zoneId,
+      hosts,
+      success: ok,
+      errors: payload?.errors ?? null,
+      result: payload?.result ?? null,
+    },
+    null,
+    2,
+  ),
+);
+
+if (!ok) {
+  console.error(
+    `Cloudflare host purge failed. Ensure CLOUDFLARE_API_TOKEN has Zone.Cache Purge on ${hosts.join(", ")}.`,
+  );
+  process.exit(1);
+}

.github/scripts/rerun_infra_cancel.py

@@ -30,7 +30,7 @@
 import urllib.error
 import urllib.parse
 import urllib.request
-from typing import Any, Callable
+from typing import Any, Callable, Optional
 
 DEFAULT_MAX_ATTEMPT = 2
 ALLOWED_EVENTS = frozenset({"pull_request", "merge_group"})
@@ -63,7 +63,7 @@
 ANNOTATIONS_PER_PAGE = 100
 
 
-GhRequest = Callable[[str, str, dict[str, str] | None, str | None], Any]
+GhRequest = Callable[[str, str, Optional[dict[str, str]], Optional[str]], Any]
 
 
 class Skip(Exception):

.github/workflows/ci.yml

@@ -669,7 +669,7 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      # The needs-validation gate below produces a `handoff/comment` artifact when it ejects a
+      # The merge-blocking label gate below produces a `handoff/comment` artifact when it ejects a
       # queued PR, and that production goes through `.github/scripts/handoff.py` (the only
       # sanctioned source of handoff names and layout). Only the merge_group context can eject,
       # so pull_request runs skip the checkout entirely.
@@ -721,12 +721,12 @@ jobs:
             exit 1
           fi
 
-      - name: Block merge while the needs-validation label is present
-        id: needs_validation_gate
-        # Hard gate: a PR that still carries `needs-validation` must not merge. Enforced ONLY in
-        # the merge_group (merge-queue) context — never on pull_request. main requires the merge
-        # queue, so every merge passes through merge_group; a needs-validation entry fails this
-        # step there and is ejected from the queue, so it can never land.
+      - name: Block merge while a merge-blocking label is present
+        id: merge_blocking_label_gate
+        # Hard gate: a PR that still carries `needs-validation` or `needs-maintainer-check` must
+        # not merge. Enforced ONLY in the merge_group (merge-queue) context — never on
+        # pull_request. main requires the merge queue, so every merge passes through merge_group;
+        # a labeled entry fails this step there and is ejected from the queue, so it can never land.
         #
         # Why not also fail on pull_request: that turns the PR's own required `Validate workspace`
         # check red, and a deliberately-red required check is indistinguishable from a real CI
@@ -736,7 +736,8 @@ jobs:
         # forever). The merge_group run executes on the queue's transient ref, so this failure does
         # NOT appear in the PR head's status rollup; the PR stays green until the label is cleared.
         # Fails closed: any label-lookup error blocks rather than silently waving the merge through.
-        # Respects skip-validation implicitly (that override means needs-validation is never added).
+        # `skip-validation` continues to override only the `needs-validation` producer; it has no
+        # effect on the independent maintainer-check policy.
         env:
           GH_TOKEN: ${{ github.token }}
           EVENT_NAME: ${{ github.event_name }}
@@ -752,7 +753,7 @@ jobs:
         run: |
           set -euo pipefail
           if [ "$EVENT_NAME" != "merge_group" ]; then
-            echo "needs-validation is gated at merge time in the merge_group context; nothing to enforce on $EVENT_NAME (PR check stays green)."
+            echo "Merge-blocking labels are gated in the merge_group context; nothing to enforce on $EVENT_NAME (PR check stays green)."
           else
             # An ejection is invisible from the PR: this failure runs on the queue's transient
             # ref, the PR's own checks stay green, and `mergeQueueEntry` just goes null. Leave a
@@ -761,25 +762,41 @@ jobs:
             # completes. Best-effort: a handoff failure must never soften the block itself.
             emit_ejection_notice() {
               local pr="$1"
-              local pr_json pr_head pr_base handoff_id handoff_root handoff_dir marker
+              local blocking_label="$2"
+              local pr_json pr_head pr_base handoff_id handoff_root handoff_dir marker next_step
               pr_json="$(gh api "repos/$REPO/pulls/$pr")"
               pr_head="$(jq -r '.head.sha' <<< "$pr_json")"
               pr_base="$(jq -r '.base.sha' <<< "$pr_json")"
-              handoff_id="needs-validation-pr-$pr"
+              case "$blocking_label" in
+                needs-validation)
+                  handoff_id="needs-validation-pr-$pr"
+                  marker="<!-- merge-queue-needs-validation -->"
+                  # Markdown code spans are intentional literal text.
+                  # shellcheck disable=SC2016
+                  next_step='To land this PR: complete the QA pass the label is tracking, remove the `needs-validation` label, then add the PR back to the merge queue.'
+                  ;;
+                needs-maintainer-check)
+                  handoff_id="needs-maintainer-check-pr-$pr"
+                  marker="<!-- merge-queue-needs-maintainer-check -->"
+                  # Markdown code spans are intentional literal text.
+                  # shellcheck disable=SC2016
+                  next_step='To land this PR: have a maintainer complete the check, remove the `needs-maintainer-check` label, then add the PR back to the merge queue.'
+                  ;;
+                *)
+                  echo "Unsupported merge-blocking label: $blocking_label" >&2
+                  return 1
+                  ;;
+              esac
               handoff_root="$RUNNER_TEMP/handoff-comment-$handoff_id"
               handoff_dir="$(python3 .github/scripts/handoff.py dir comment "$handoff_id" --root "$handoff_root")"
               mkdir -p "$handoff_dir"
-              marker="<!-- merge-queue-needs-validation -->"
               # Markdown code spans are intentionally literal in these single-quoted strings.
               # shellcheck disable=SC2016
               {
                 printf '%s\n' "$marker"
-                # Markdown code spans are intentional literal text.
-                # shellcheck disable=SC2016
-                printf 'Ejected from the merge queue: this PR still carries the `needs-validation` label.\n\n'
+                printf 'Ejected from the merge queue: this PR still carries the `%s` label.\n\n' "$blocking_label"
                 printf 'The merge queue gate ([run %s](%s/%s/actions/runs/%s)) blocked the queued group because of the label. That failure runs on the queue'"'"'s transient ref, so it never appears in this PR'"'"'s own checks — they stay green, and this notice is the only visible trace on the PR.\n\n' "$RUN_ID" "$GITHUB_SERVER_URL" "$REPO" "$RUN_ID"
-                # shellcheck disable=SC2016
-                printf 'To land this PR: complete the QA pass the label is tracking, remove the `needs-validation` label, then add the PR back to the merge queue.\n'
+                printf '%s\n' "$next_step"
               } > "$handoff_dir/body.md"
               jq -n \
                 --arg kind "comment" \
@@ -843,31 +860,37 @@ jobs:
                 fi
                 covered=1
                 case " $checked " in *" $pr "*) ;; *) checked="$checked $pr";; esac
-                if printf '%s\n' "$labels" | grep -qx 'needs-validation'; then
-                  echo "::error::PR #$pr still has 'needs-validation' — blocking merge."
+                blocking_label=""
+                if printf '%s\n' "$labels" | grep -qx 'needs-maintainer-check'; then
+                  blocking_label="needs-maintainer-check"
+                elif printf '%s\n' "$labels" | grep -qx 'needs-validation'; then
+                  blocking_label="needs-validation"
+                fi
+                if [ -n "$blocking_label" ]; then
+                  echo "::error::PR #$pr still has '$blocking_label' — blocking merge."
                   # Fail-fast keeps this per-run notice on the FIRST labeled PR found; every
                   # labeled entry also fails its own queue run, so each still gets its own notice.
-                  emit_ejection_notice "$pr" || echo "::warning::could not produce the ejection-notice handoff for PR #$pr; the block itself still stands."
+                  emit_ejection_notice "$pr" "$blocking_label" || echo "::warning::could not produce the ejection-notice handoff for PR #$pr; the block itself still stands."
                   exit 1
                 fi
-                echo "PR #$pr: no needs-validation label."
+                echo "PR #$pr: no merge-blocking label."
               done
               if [ "$covered" -eq 0 ]; then
-                echo "::error::merge-group commit $sha resolved to no pull request (candidates: ${candidates:-none}) — cannot verify needs-validation; blocking merge (fail closed)."
+                echo "::error::merge-group commit $sha resolved to no pull request (candidates: ${candidates:-none}) — cannot verify merge-blocking labels; blocking merge (fail closed)."
                 exit 1
               fi
             done
-            echo "No 'needs-validation' label in the queued group ($checked ) — clear to merge."
+            echo "No merge-blocking label in the queued group ($checked ) — clear to merge."
           fi
 
       # `failure()` is required: the gate exits 1 on the very path that produces the handoff,
       # and the default `success()` condition would skip this upload exactly when it matters.
       - name: Upload merge-queue ejection notice handoff
-        if: ${{ failure() && steps.needs_validation_gate.outputs.comment_created == 'true' }}
+        if: ${{ failure() && steps.merge_blocking_label_gate.outputs.comment_created == 'true' }}
         uses: actions/upload-artifact@v4
         with:
-          name: ${{ steps.needs_validation_gate.outputs.comment_name }}
-          path: ${{ steps.needs_validation_gate.outputs.comment_path }}
+          name: ${{ steps.merge_blocking_label_gate.outputs.comment_name }}
+          path: ${{ steps.merge_blocking_label_gate.outputs.comment_path }}
 
   runtime_summary:
     name: Runtime summary

.github/workflows/contributor-maintainer-check.yml

@@ -0,0 +1,44 @@
+name: Contributor maintainer check
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize]
+
+permissions:
+  issues: write
+
+concurrency:
+  group: contributor-maintainer-check-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  route:
+    if: github.repository == 'nexu-io/open-design'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+
+    steps:
+      - name: Require maintainer check for configured contributors
+        uses: actions/github-script@v8
+        env:
+          NEEDS_MAINTAINER_CHECK_USER_IDS: ${{ secrets.NEEDS_MAINTAINER_CHECK_USER_IDS }}
+        with:
+          script: |
+            const rawIds = process.env.NEEDS_MAINTAINER_CHECK_USER_IDS?.trim();
+            const configuredIds = rawIds ? JSON.parse(rawIds) : [];
+            if (!Array.isArray(configuredIds) || !configuredIds.every((id) => Number.isSafeInteger(id) && id > 0)) {
+              core.setFailed('NEEDS_MAINTAINER_CHECK_USER_IDS must be a JSON array of positive integer GitHub user IDs.');
+              return;
+            }
+
+            const authorId = context.payload.pull_request?.user?.id;
+            if (!Number.isSafeInteger(authorId) || !configuredIds.includes(authorId)) {
+              return;
+            }
+
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              labels: ['needs-maintainer-check'],
+            });

.github/workflows/landing-edge-cache-purge.yml

@@ -0,0 +1,41 @@
+name: landing-edge-cache-purge
+
+# Manual / test entry to host-purge open-design.ai (or staging) without a full
+# production rebuild. Production deploy also purges after pages deploy; this
+# workflow is for incident recovery and permission checks.
+#
+# Requires secrets.CLOUDFLARE_API_TOKEN with Zone → Cache Purge on the target
+# zone. Optional: vars.CLOUDFLARE_ZONE_ID.
+
+on:
+  workflow_dispatch:
+    inputs:
+      hosts:
+        description: 'Comma-separated hostnames to purge (no scheme)'
+        required: true
+        default: 'open-design.ai'
+
+permissions:
+  contents: read
+
+jobs:
+  purge:
+    name: Purge Cloudflare edge cache by hostname
+    if: github.repository == 'nexu-io/open-design'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+
+      - name: Purge hosts
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ZONE_ID: ${{ vars.CLOUDFLARE_ZONE_ID }}
+          CLOUDFLARE_PURGE_HOSTS: ${{ inputs.hosts }}
+        run: node --experimental-strip-types .github/scripts/landing-page-purge-edge-cache.ts