[gHashTag]

Closes #1778. Refs Trinity-S-AI-DNA/t27#12766/#12767 (the paired cron card, same hour — the registry honesty rule).

1. The main red watch

.github/workflows/main-red-watch.yml (new foreign file, owner-approved-foreign quoted below): the thin host for the rules in specs/crons/trinity-main-red-watch.t27 (Trinity-S-AI-DNA/t27#12767). Daily 05:47 UTC: a workflow whose newest main run concluded failure, or whose newest pull_request run has been failure for over 24h, opens one issue naming it; a clean day logs one line and touches nobody. Born from docs-check sitting red on every docs-touching PR for two days (2026-10-24..26) behind a paths filter.

2. The validator reads the spec

pr-blog-report.yml reads MIN_RESULT/MIN_OUTLINE/MAX_FIELD from specs/report/work_report.t27 (#1775) with the same sed pattern the workflow already uses for POST_DIR, and fails loudly if the constants are missing. scripts/pr_blog_report.py takes them from the WR_* env; the literals it falls back to are the spec's own values, so a run without the env behaves identically. One home for the numbers that cost two CI bounces on 2026-10-26.

3. Card chrome tokens

The courses card values now live once as :root tokens in index.css (--card-border/-radius/-pad/-gap/-catalog-gap/-title-size/-desc-color/-foot-color); Course.css's .course-card* rules and the blog card block read them, with the tokens' own values as fallbacks so either sheet alone keeps the look.

Foreign-code note

main-red-watch.yml is a NEW foreign file; the other touched files (pr-blog-report.yml, pr_blog_report.py, index.css, Course.css) are existing hand-written foreign files. This PR carries owner-approved-foreign.

Owner approval: given 2026-10-27 in the owner's OpenCode session, in Russian, verbatim: "да все три и сделай сам автономно и в конце три варианта ускорения по правилу парето и писать все на .t27" — the instruction to land all three acceleration items autonomously, with the rules written in .t27 (which they are: the card and the spec).

{
  "version": 1,
  "head_sha": "d92377ef715a2a778a4587927b059cea9199f553",
  "summary": "Three acceleration items in one pull request: the main red watch workflow (thin host, rules in the t27 cron card), the work-report validator reading its bounds from the t27 spec through the workflow's env, and the mirrored courses/blog card values becoming one set of root tokens.",
  "changes": [
    ".github/workflows/main-red-watch.yml (new): daily 05:47 UTC watch; newest-main-failure and stale-over-24h pull_request failure each open one issue naming the workflow and its run; a clean day prints one line. Rules and birth story live in specs/crons/trinity-main-red-watch.t27 (gHashTag/t27#12767).",
    ".github/workflows/pr-blog-report.yml: a step reads MIN_RESULT/MIN_OUTLINE/MAX_FIELD from specs/report/work_report.t27 with the POST_DIR sed pattern, fails if any is missing, and exports them as WR_* env before the validate step.",
    "scripts/pr_blog_report.py: MIN_RESULT/MIN_OUTLINE/MAX_FIELD module constants from the WR_* env with the spec's own literals as fallback; the text() defaults and the result/outline call sites use them.",
    "apps/website/src/index.css + apps/website/src/pages/Course.css: card chrome tokens in :root; .course-card* and the blog card block read them with literal fallbacks."
  ],
  "tests": [
    {
      "command": "python3 -m py_compile scripts/pr_blog_report.py",
      "result": "the validator compiles with the env-driven constants",
      "status": "passed",
      "evidence": "Run on this tree, 2026-10-27, before the commit."
    },
    {
      "command": "python3 -c \"import yaml; yaml.safe_load(...both workflows...)\"",
      "result": "both workflow files parse as valid YAML",
      "status": "passed",
      "evidence": "Run on this tree, 2026-10-27, before the commit."
    },
    {
      "command": "the bounds-reading step dry-run against the spec",
      "result": "the three sed patterns extract 12, 80 and 4000 from specs/report/work_report.t27, the exact values the validator held inline",
      "status": "passed",
      "evidence": "The patterns are byte-identical in shape to the POST_DIR precedent that already runs in this workflow on every PR."
    },
    {
      "command": "lefthook pre-commit on the commit",
      "result": "explorer bilingual contract, queen bilingual contract (497/497 keys) and english-only all pass",
      "status": "passed",
      "evidence": "Hook output on commit d92377ef7, 2026-10-27."
    }
  ],
  "limitations": [
    "The red watch's first scheduled run is 05:47 UTC tomorrow; until then the workflow is dispatch-only and unexercised by the schedule.",
    "The watch walks every workflow with two API calls each (about 80 for this repository); a repository with hundreds of workflows would want pagination hygiene revisited.",
    "The tokens unify the mirrored values, not the rules that use them; a future card style still edits two files, but now only once per value."
  ],
  "tags": [
    "Ci",
    "Crons",
    "Css"
  ],
  "blog": {
    "title": "The watch, the spec and the tokens: three small laws",
    "summary": "A gate that sat red for two days behind a paths filter, a validator whose bounds lived only where they bit, and a card style mirrored by hand in three places: three small single-home laws landed in one pull request.",
    "outline": [
      "What two days of docs-check silence measured about gates that live off main, and why the watch reads every workflow's newest run on both main and the pull_request lane.",
      "How the validator learned its numbers from the spec through the same sed pattern the workflow already used, and why the fallback literals are the spec's own values.",
      "What a set of root tokens changes for the next restyle of the courses and blog cards, and what it deliberately does not try to unify."
    ]
  }
}

[github-actions]

X Brain Health Check

Score: 100.0/100
Status: 🟢 HEALTHY
Threshold: 80/100

X Brain is above merge threshold

[tri-claw]

Summary by t27-bees

Checked by the t27 compiler

_{t27c parse, parse-complete and typecheck on each changed .t27 file at d92377e. Nothing was generated, built or run. A pass means the file is well formed, not that it is right.}

• specs/report/work_report.t27: parses and typechecks.

Read by the model

This PR bundles three independent changes: a new daily "red watch" workflow that surfaces silently-failing CI, the report validator reading its bounds from the spec instead of hardcoding them, and unifying card styling via CSS custom properties.

Worth a look

• .github/workflows/main-red-watch.yml (lines 33–50): The gh api loop makes two API calls per workflow (up to 100 workflows = 200 calls) with --paginate. A rate-limit hit or slow network could exceed the 15-minute job timeout or silently skip workflows because each call has || true. No pagination handling for the runs endpoints (only per_page=1), so a workflow with no runs on main/PR returns empty and is skipped — correct, but worth knowing.

• .github/workflows/pr-blog-report.yml (lines 61–73): The sed patterns expect exact formatting (^pub const MIN_RESULT : u32 = \([0-9][0-9]*\);$). Any whitespace change, comment on the same line, or type tweak in work_report.t27 will make extraction fail and the workflow abort with "bounds missing from spec". The spec currently matches, but this is a brittle single point of failure.

• scripts/pr_blog_report.py (line 36): int(os.environ.get("WR_MIN_RESULT", "12")) will raise ValueError and crash the validator if the env var is set to a non-integer (e.g., empty string, "12\n"). The workflow step only checks non-emptiness, not integer validity.

• apps/website/src/index.css + apps/website/src/pages/Course.css: Fallback values are duplicated in both files (e.g., var(--card-border, #333) in index.css and the same in Course.css). If a token is updated in :root but the fallback in the other sheet isn't, the two card styles diverge when only one sheet loads.

• specs/report/work_report.t27 (new file): The spec defines the constants but the workflow's sed extraction and the Python fallback literals are separate copies of the same numbers. No mechanism ensures they stay in sync if the spec changes — the workflow will fail loudly, but the Python fallback will silently retain the old value until the workflow is fixed.

---

_{Read: 6 files, +160 -22, the whole diff. Head d92377e. Model: openai-compatible/nvidia/nemotron-3-ultra-550b-a55b. Commands: @t27-bees review | summary | help | pause | resume. Free for every repository.}

[github-actions]

🧪 Brain Stress Test Results

Tests: 261/261 passed, 0 leaked
Status: 🟢 PASS
Gate: every test in zig build test-brain-stress passes and none leaks