release-train: staging -> main

[LukasWodka]

Automated promotion by the release train (RFC-0008 D14). Head is the train-managed release-train/to-main branch (a mirror of staging), so it never collides with a human PR. Merged only when the fr-gate is green.

---

Note

Medium Risk
Large CI surface area touching org project writes, promotion gates, and secret-backed App tokens; mis-scoped tokens or board/column mismatches can strand or mis-route kanban cards fleet-wide, though workflows are designed to fail loudly.

Overview
Adds the tracebloc release-train / engineering-kanban automation and quality gates as inline GitHub Actions in this repo, because public repos cannot uses: reusable workflows from private tracebloc/org-config. Each new workflow is a generated, self-contained copy (regenerate via org-config’s render-self-contained.py); callers’ triggers and literals are folded in so required check names like advance / advance stay unchanged.

Kanban & process: add-to-kanban.yml (issues/PRs → org project #2) with repo-scoped App tokens and explicit issues/pull-requests read plus project write. advance-deploy-env.yml updates Deploy env + Status on pushes to integration branches, derives PRs from the commits API (not commit subjects), uses shared branch_status_map.py from org-config, and fails closed on bad Status resolution or failed project lookups; drops the obsolete Staging (human review) rank shim. kanban-closure-router.yml routes merged/closed items (issues completed → Done, not deploy columns). customer-priority-bump.yml handles from:customer → priority label and work-type:bug → Ready. fr-pass-comment.yml implements /fr-pass with visible 👍/👎 outcomes and red runs on real refusals. fr-gate.yml blocks staging/main promotions unless kanban items meet the required stage (shared fr-gate-walk.sh).

Quality: code-quality.yml (pipefail/YAML run blocks, gitleaks, house-rules, dead-weight, action-pins). bugbot-gate.yml turns Cursor Bugbot into a derived pass/fail gate (polls for review completion).

Also adds a minimal .cursor/BUGBOT.md placeholder for per-repo Bugbot guidance (conformance expects the file to exist).

^{Reviewed by Cursor Bugbot for commit 157d299. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 157d299. Configure here.}

[cursor]

Errors treated as absent cards

High Severity

The item lookup only treats a non-zero gh api graphql exit as a failed read. An HTTP 200 with errors[] exits 0, so a rate limit or partial payload is handled as “not on the project” and the step skips. The project’s Item-closed automation can then write Cancelled and archive shipped work.

Additional Locations (1)

• .github/workflows/advance-deploy-env.yml#L439-L456

 

^{Reviewed by Cursor Bugbot for commit 157d299. Configure here.}

[LukasWodka]

REFUSED. This promotion was blocked by 1 HIGH severity finding(s): Errors treated as absent cards, per the severity policy in release-train's README (High stops the line; an unreadable severity blocks too, because unknown is not low; Medium/Low are recorded and ship, at both hops).

Blocking threads stay UNRESOLVED by design, so this promotion remains blocked until they are fixed on develop. This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion.

What the train did with each:

• Errors treated as absent cards (high) - filed as https://github.com/tracebloc/backend/issues/3703, thread left UNRESOLVED so it keeps blocking.

[LukasWodka]

REFUSED. This promotion was blocked by 1 HIGH severity finding(s): Errors treated as absent cards, per the severity policy in release-train's README (High stops the line; an unreadable severity blocks too, because unknown is not low; Medium/Low are recorded and ship, at both hops).

Blocking threads stay UNRESOLVED by design, so this promotion remains blocked until they are fixed on develop. This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion.

What the train did with each:

• Errors treated as absent cards (high) - filed as https://github.com/tracebloc/backend/issues/3703, thread left UNRESOLVED so it keeps blocking.
• FR pass reports false success - filed as https://github.com/tracebloc/backend/issues/3704, thread resolved by the train.

[LukasWodka]

REFUSED. This promotion was blocked by 1 HIGH severity finding(s): Errors treated as absent cards, per the severity policy in release-train's README (High stops the line; an unreadable severity blocks too, because unknown is not low; Medium/Low are recorded and ship, at both hops).

Blocking threads stay UNRESOLVED by design, so this promotion remains blocked until they are fixed on develop. This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion.

What the train did with each:

• Errors treated as absent cards (high) - filed as https://github.com/tracebloc/backend/issues/3703, thread left UNRESOLVED so it keeps blocking.

[LukasWodka]

REFUSED. This promotion was blocked by 1 HIGH severity finding(s): Errors treated as absent cards, per the severity policy in release-train's README (High stops the line; an unreadable severity blocks too, because unknown is not low; Medium/Low are recorded and ship, at both hops).

Blocking threads stay UNRESOLVED by design, so this promotion remains blocked until they are fixed on develop. This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion.

What the train did with each:

• Errors treated as absent cards (high) - filed as https://github.com/tracebloc/backend/issues/3703, thread left UNRESOLVED so it keeps blocking.

[LukasWodka]

REFUSED. This promotion was blocked by 1 HIGH severity finding(s): Errors treated as absent cards, per the severity policy in release-train's README (High stops the line; an unreadable severity blocks too, because unknown is not low; Medium/Low are recorded and ship, at both hops).

Blocking threads stay UNRESOLVED by design, so this promotion remains blocked until they are fixed on develop. This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion.

What the train did with each:

• Errors treated as absent cards (high) - filed as https://github.com/tracebloc/backend/issues/3703, thread left UNRESOLVED so it keeps blocking.

[LukasWodka]

REFUSED. This promotion was blocked by 1 HIGH severity finding(s): Errors treated as absent cards, per the severity policy in release-train's README (High stops the line; an unreadable severity blocks too, because unknown is not low; Medium/Low are recorded and ship, at both hops).

Blocking threads stay UNRESOLVED by design, so this promotion remains blocked until they are fixed on develop. This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion.

What the train did with each:

• Errors treated as absent cards (high) - filed as https://github.com/tracebloc/backend/issues/3703, thread left UNRESOLVED so it keeps blocking.

[LukasWodka]

REFUSED. This promotion was blocked by 1 HIGH severity finding(s): Errors treated as absent cards, per the severity policy in release-train's README (High stops the line; an unreadable severity blocks too, because unknown is not low; Medium/Low are recorded and ship, at both hops).

Blocking threads stay UNRESOLVED by design, so this promotion remains blocked until they are fixed on develop. This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion.

What the train did with each:

• Errors treated as absent cards (high) - filed as https://github.com/tracebloc/backend/issues/3703, thread left UNRESOLVED so it keeps blocking.

[LukasWodka]

REFUSED. This promotion was blocked by 1 HIGH severity finding(s): Errors treated as absent cards, per the severity policy in release-train's README (High stops the line; an unreadable severity blocks too, because unknown is not low; Medium/Low are recorded and ship, at both hops).

Blocking threads stay UNRESOLVED by design, so this promotion remains blocked until they are fixed on develop. This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion.

What the train did with each:

• Errors treated as absent cards (high) - filed as https://github.com/tracebloc/backend/issues/3703, thread left UNRESOLVED so it keeps blocking.