fix(ci): make the diagnostics-only run-summary upload non-fatal

[claude]

Fixes #14469

What

.github/workflows/ci.yml — the Publish this shard's turbo run summary step (:602) now
carries continue-on-error: true, and its docblock gets a new paragraph explaining why, so
the next reader does not "tidy" it back.

Per the triage's ⭐ sentence:

✅ Queue the diagnostics half. Give the :602 step continue-on-error: true (or the
equivalent) so a 403 on a 313-byte summary upload cannot abort a shard ahead of its
attestation. ⭐ This cannot weaken #6082: the credential steps come after, still run,
and still must succeed — the gate's reading is unchanged. It removes one path by which a
fully green shard is evicted, and nothing else.

Why

Shard 2/6 was lost on a diagnostics-only upload (if: always() + if-no-files-found: ignore, i.e. not load-bearing) that was still, being unguarded, on the shard's pass/fail
path: a failed finalize on the artifact service (FinalizeArtifact 403 on this build, the
content already stored) aborted the job before the attestation pair ever ran, so the
fail-closed aggregator correctly read a missing credential and evicted a fully green shard
from the merge queue.

What is unchanged (verified)

• git diff --stat is exactly one file:

  .github/workflows/ci.yml | 15 +++++++++++++++
  1 file changed, 15 insertions(+)
  

• The attestation pair (Attest this shard ran and passed + Publish this shard's attestation, the job's last two steps, :717-724) — byte-for-byte unchanged, no if:,
  no continue-on-error, still the job's LAST TWO steps.
• scripts/check-shard-attestation.mjs — byte-for-byte unchanged (git diff origin/main -- scripts/check-shard-attestation.mjs is empty; it has zero references to
  continue-on-error and does not read this step).
• No retry was added anywhere (the attestation upload's 403 is reported non-retryable by
  the action, and the lint forbids a step appended below it — out of scope for this card
  per the triage's ⛔ fence).
• No step reordering.

Not in scope (per triage fences)

• ⛔ Not touching check-shard-attestation.mjs or the aggregator (test-gate /
  Verify test shard results) — fail-closed on a missing credential is the designed and
  correct reading.
• ⛔ Not "fixing" shard 5/6's failure (the attestation upload itself) — that is the half
  deliberately left alone here; [finding] Merge-queue build for PR #14433 evicted with every test green — actions/upload-artifact FinalizeArtifact returned a non-retryable 403 on two shards at the same second, and the fail-closed attestation gate read them as missing #14469 is not addressed for that shard, only for the
  diagnostics-upload eviction path.

Gates

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derives
27 commands for this path (.github/workflows/ci.yml) at merge-base f60ab90; all 27 run
against head abbf168 (working tree confirmed byte-identical to HEAD before running — git diff HEAD empty). --ran reconciliation: 27 derived, 27 run, 0 UNRUN (exit 0).

25 RAN-PASS, 2 NOT-MEASURED (both PREREQUISITE-NOT-MET, not red — evidence below):

node scripts/check-aggregator-roster.mjs            RAN-PASS
node scripts/check-ci-filter-parity.mjs              RAN-PASS
node scripts/check-cross-package-test-inputs.mjs     RAN-PASS
node scripts/check-position-name-fold-loaders.mjs    RAN-PASS
node scripts/check-required-contexts.mjs             RAN-PASS
node scripts/check-self-test-wired.mjs               RAN-PASS
node scripts/check-self-test-workflow-commands.mjs   RAN-PASS
node scripts/check-shard-attestation.mjs             RAN-PASS
node scripts/check-step-collectors.mjs               RAN-PASS
node scripts/check-test-completeness.mjs             NOT-MEASURED (no saved test log to grade — CI tees one; local run has none)
node scripts/check-whole-set-label-write.mjs         RAN-PASS
node scripts/docs-audit/check-drift-comment.mjs      RAN-PASS
node scripts/pm/ci-failure.mjs --self-test           RAN-PASS
pnpm check:agent-test-spelling                       RAN-PASS
pnpm check:console-injection                         RAN-PASS
pnpm check:console-sha                                RAN-PASS
pnpm check:declared-population-live                  RAN-PASS
pnpm check:dual-build-cjs-loads                      NOT-MEASURED (reads dist/ — full monorepo build out of scope for a workflow-only diff)
pnpm check:node-version                              RAN-PASS
pnpm check:pm-dispatch-gates                          RAN-PASS (1240 cases pass; run via os-verify-lock.sh, detached, ~14m11s held)
pnpm check:pnpm-acquisition                           RAN-PASS
pnpm check:pnpm-filter-targets                        RAN-PASS
pnpm check:required-contexts                          RAN-PASS
pnpm check:shard-attestation                          RAN-PASS
pnpm check:stall-guard-budget                         RAN-PASS
pnpm check:stall-guard-headroom                       RAN-PASS
pnpm check:workflow-status-functions                  RAN-PASS

skip-changeset: no package publishes — diff is .github/workflows/ci.yml only (label
requested on this PR).

Note: origin/main advanced 7 commits during this run (to 7085f90) but none touched
.github/workflows/ci.yml, scripts/check-shard-attestation.mjs, or the dispatch-gates
tooling — git log f60ab90ae..origin/main -- .github/workflows/ scripts/check-shard- attestation.mjs scripts/pm/dispatch-gates.mjs is empty, so this card's file surface and
derived gate set are unaffected; not rebased.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

---

Generated by Claude Code