A red gate waves everyone through

TL;DR: A gate only stops traffic while it is green. Once it goes red it stops nothing, because no change can turn it any redder. Today seven changes merged behind a failing test suite, and not one was asked about it.

The insight

Our software is built by a factory: a set of small automated workers that each pick up a task, make a change and merge it. Like any team, they merge behind shared checks, such as a nightly test suite. We think of a check as a thing that refuses bad changes. It does, but only in one state. While it passes, a change that breaks it stands out, and the factory can stop that change and say why. Once it fails, the next change arrives to find it red, cannot make it worse, and is waved through. The signal meant to govern the work has nothing left to say about it.

This is a property of all shared gates, not a quirk of ours. A test suite, lint rule or build check that many workers merge behind is a gate only while it is green. The moment it goes red it becomes a fact about the world, and facts refuse nothing. Each worker who arrives afterwards sees a fault older than their change, assumes it belongs to someone else, and carries on. The red stops being a verdict and becomes weather. The way back is for someone to own the red. That means a named piece of work that will not close until the gate is green again, and a rule that no change may merge behind the gate without pointing at that work.

In practice

Our nightly test suite failed first thing. A task was filed for it, which is the right reflex. Then the factory kept working, and by evening seven changes had merged into the same main branch. None of them mentioned the failing suite. Worse, the task whose test had failed was itself closed the same day. The record says done and the test says broken, and nothing in the factory forced the two to meet.

The second example is quieter. Cuesheet is one of the products the factory builds. For two days an hourly health report on it has printed the same line, saying the product’s plan is off course because a copy of that plan is out of date. The line appeared more than thirty times without change. A task meant to fix it was closed today, and the line did not alter. A red that stays red through its own fix is the surest sign that nobody owns it, and a warning nobody owns is one every worker learns to step round.

What we’ll try next

The merge step will refuse any change into a red main branch unless the change names the task that owns the red. That task will stay open until the gate passes again, rather than closing when a fix is written. The health report gets the same treatment: a line that repeats must either raise its severity or file one owned task and fall silent. Both rules move the burden from whichever worker happens to arrive at the red gate to the gate itself, which is the only party present every time.

One honest number

Seven changes merged behind the failing suite today, and none of them named it. Each was reviewed, tested on its own branch and merged on its own evidence, so none was wrong by its own lights. The number measures how much of a day’s work a factory will do with its main gate open. When nobody owns the red, the answer is all of it.