fix(fr-gate): pass items at or beyond the required stage

[aptracebloc]

Summary

The FR gate compared each item's kanban Status to the required stage with strict equality ([ "$STATUS" = "$REQUIRED" ]). An item already further down the pipeline than the gate requires was therefore falsely blocked — e.g. a card in Prod that reappears in a later staging promotion's commit range fails a Ready for staging gate even though it has already shipped past staging.

This replaces the equality check with a pipeline rank comparison: an item passes when its stage is at or beyond the required stage.

Change

• Added a rank() helper enumerating the canonical kanban stages (Backlog … FR on dev → Ready for staging → FR on staging → Ready for prod → Prod).
• Pass when rank(status) >= rank(required), or on exact match.
• Unknown statuses (including Cancelled) return an empty rank and fall through to the original strict-equality check — so they stay blocked, preserving prior behavior for anything outside the linear pipeline.
• Updated pass/fail messages and the header doc to "or later".

Why this is safe

• Items before the required stage still block (FR-on-staging vs Ready-for-prod → ❌), so the "FR must pass before promotion" rule is unchanged.
• Only items at or beyond the bar newly pass — which is the correct semantics.

Test

Verified the comparison locally against the stage matrix:

Item status	Required	Result
Prod	Ready for staging	✅ pass
Prod	Ready for prod	✅ pass
Ready for staging	Ready for staging	✅ pass (exact)
FR on staging	Ready for prod	❌ block
FR on dev	Ready for staging	❌ block
Cancelled	Ready for prod	❌ block (unknown rank → strict eq)

YAML validated with yaml.safe_load.

Blast radius

Reusable workflow consumed by every repo's fr-gate-caller at @main. Takes effect org-wide on merge. No input/interface changes — callers need no update.

Context

Surfaced by tracebloc/averaging-service#115 (staging→main), where the prior develop→staging promotion's CI card (#98) sat in Prod and falsely blocked the staging gate.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes merge-blocking CI semantics org-wide for all promotion PRs; under-stage items still fail, but mis-ordered ranks in rank() could incorrectly pass or block gates.

Overview
The reusable FR gate workflow no longer requires an exact kanban Status match. Promotion PRs were failing when a linked item’s card had already moved past the gate (e.g. Prod in a staging promotion range) because the check used strict equality.

A rank() helper maps linear pipeline stages from Backlog through Prod. An item passes when rank(status) >= rank(required); unknown statuses (e.g. Cancelled) still use the old exact-match path so they stay blocked. Pass/fail and header comments now say “or later”, with clearer logging when an item passes because it is beyond the required stage.

Blast radius: org-wide via reusable fr-gate callers; no workflow inputs changed.

^{Reviewed by Cursor Bugbot for commit cbf0550. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 16 / 8

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#115 — Release: staging → main (averaging correctness sweep → production) · author: @aptracebloc · no reviewer assigned
• backend#806 — feat(#805): store & distribute contributor tokenizer as a model artifact (Task 1 — backend) · author: @shujaatTracebloc · reviewer: @aptracebloc
• backend#807 — Release: staging → master (16.06.2026) · author: @aptracebloc · no reviewer assigned
• backend#808 — fix(#731): edge-resources missing-hardware guard keys off effective memory · author: @aptracebloc · reviewer: @saadqbal
• cli#78 — fix(dataset rm): delete staging files from a uid-65532 pod, not jobs-manager (#259) · author: @LukasWodka · no reviewer assigned
• cli#79 — chore(schema): re-sync vendored ingest.v1.json from data-ingestors master · author: @LukasWodka · no reviewer assigned
• client-runtime#108 — fix(authz): match ingest table prefixes at a segment boundary (close cross-tenant straddle) · author: @LukasWodka · no reviewer assigned
• client-runtime#114 — fix(jobs): cap training Job backoffLimit to stop crashloops starving the cluster · author: @saadqbal · no reviewer assigned
• data-ingestors#270 — docs(releasing): correct ingestor rollout — floating tag + imagePullPolicy=Always, not INGESTOR_IMAGE_DIGEST rewrite · author: @saadqbal · no reviewer assigned
• data-ingestors#275 — refactor(P5b): extract the cross-ingest table lock into TableLock · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)