Sweep Reds

Sweep reds: base first, then affected PRs

Read ../_shared/base-green.md and ../_shared/validation-gate.md. Success means verified required checks, not a disappearing incident or green wrapper.

Boundaries

• Never merge, close PRs or change release-freeze state through this skill.
• Never stash, alter the shared checkout, or touch another session's active worktree.
• Never weaken assertions, expand tolerances, suppress failures or raise a baseline to make a check green. A proven workflow defect requires an explicitly scoped gate-repair task; ordinary sweep authorization does not authorize CI mutation.
• Run live credentialed/paid tests, deployment or trust approvals only with the appropriate owner authorization. Missing access is HOLD, not PASS.

A. Base health

1. Resolve live main/release refs and freeze state read-only. Confirm the intended development branch; a frozen branch remains off limits.
2. Follow the shared exact-SHA evidence protocol. Closed/missing incidents mean UNKNOWN unless current applicable executions establish PASS. A quick observer receipt is partial; the last incident comment is only a diagnostic worklist.
3. Reproduce each signature on an isolated pinned base. Keep setup/install failures separate from assertions. Open one owned branch/worktree per independently reviewable repair, with RED-to-GREEN proof; avoid duplicating another session's PR.
4. Prepare/babysit the fix PR under the authorized scope, then hand it to the owner. Do not claim the base is repaired until the fix is integrated and the new exact base passes. The authorized observer, not this skill, manages its incident.

B. PR queue

Inventory requested open PRs and their current head/base/candidate identities. Classify required failure, advisory failure, pending, stale, cancelled and approval needed separately. Work one PR at a time, checking ownership before each mutation.

An inherited label requires the same measured signature on the exact base, not membership in an old incident list. For stale evidence, obtain a newly constructed candidate under the current base; a rerun still uses the original run identity. Updating a contributor branch or approving a fork run needs its own authority.

An advisory check is nonblocking only if the current policy says so. Its failure may be a real product defect; advisory is not an infrastructure diagnosis. A PR with advisory failures is admissible only after all required applicable gates pass on the current candidate and the remaining risks are reported.

For proven PR defects use the /babysit repair discipline: RED, minimal fix, focused/affected suites and complete candidate validation. Preserve contributor credit. If five iterations do not converge, report the evidence and owner decision needed, then continue eligible independent items; never relabel failure as green.

Report

Record base and PR SHAs, failure signatures/counts, causal confidence, commits, run/attempt/artifact evidence, full versus partial validation and holds. Keep advisory debt visible. Hand the owner the prepared PRs and unresolved decisions; this skill never authorizes their merge.