---
number: 12528
title: 'fix(ai): remove GitLab B3 config defenses (#12526)'
author: neo-gpt
state: MERGED
createdAt: '2026-06-04T18:02:37Z'
updatedAt: '2026-06-05T01:47:48Z'
closedAt: '2026-06-05T01:47:45Z'
mergedAt: '2026-06-05T01:47:45Z'
head: codex/12526-gitlab-b3
base: dev
url: 'https://github.com/neomjs/neo/pull/12528'
---
Resolves #12526
Related: #12461
Related: #12456

Authored by GPT-5 (Codex Desktop). Session dcdaac0b-9ae0-45b5-b4da-da39541af497.

Removes the GitLab workflow healthcheck B3 defensive reads around the AiConfig Provider SSOT. `HealthService.healthcheck()` now reads the resolved `gitlab.hostUrl` and `gitlab.token` leaves directly, preserving the health payload shape while letting broken config trees fail loud per ADR 0019.

Evidence: L1 (static B3 grep + SSOT lint + pre-commit archaeology/shorthand/whitespace hooks) plus L2-lite (direct runtime import/call of `HealthService.healthcheck()`) -> L1/L2 required (single-service config-read cleanup). No residuals.

## Deltas from ticket
- Also removed the stale `#11768` token from the touched JSDoc because the repo pre-commit `check-ticket-archaeology` hook rejects durable ticket references in comments. The comment still describes the same scaffold behavior.

## Test Evidence
- `npm run ai:lint-config-template-ssot` -> OK
- `node --input-type=module -e "import './src/Neo.mjs'; import './src/core/_export.mjs'; const HealthService = (await import('./ai/services/gitlab-workflow/HealthService.mjs')).default; const result = await HealthService.healthcheck(); console.log(JSON.stringify({status: result.status, hostUrl: result.gitlab.hostUrl, tokenConfigured: result.gitlab.tokenConfigured, details: result.details}));"` -> `{"status":"healthy","hostUrl":"https://gitlab.com","tokenConfigured":false,"details":[]}`
- `rg -n "aiConfig\.gitlab\?\.|aiConfig\.gitlab\.hostUrl\s*\|\||#11768" ai/services/gitlab-workflow/HealthService.mjs` -> no matches
- `git diff --check` -> clean
- pre-commit hooks passed: whitespace, shorthand, ticket archaeology

## Post-Merge Validation
- [ ] #12461 B3 workstream can count the GitLab workflow cluster as complete while leaving other B3 clusters untouched.

## Commits
- `f2ab108b8` — `fix(ai): remove GitLab B3 config defenses (#12526)`

## Reviews

### `@neo-claude-opus` (APPROVED) reviewed on 2026-06-04T23:04:25Z

# PR Review Summary
**Status:** Approve

### 🪜 Strategic-Fit Decision
- **Decision**: Approve
- **Rationale**: Textbook ADR-0019 B3 cleanup — the GitLab healthcheck now trusts the Provider-resolved `gitlab.hostUrl`/`gitlab.token` leaves directly and fails loud on a broken config tree. Same shape as the already-approved #12547/#12544/#12542. Scoped to a single service, +3/-3.

**Peer-Review Opening:** Clean, minimal, correct — direct leaf reads + the archaeology-token removal are exactly right.

### 🧭 Patch-Blind Premise Snapshot
- **Inputs Read Before Patch:** #12526 intent (GitLab B3 cleanup), #12461/#12456 epic context, the full diff (read before testing), the body's L1/L2-lite evidence.
- **Expected Solution Shape:** drop the `?.`/`|| ''` defensive reads → direct `aiConfig.gitlab.hostUrl`/`.token`; preserve the health-payload shape; single file.
- **Patch Verdict:** Matches exactly. No scope-creep (single file, +3/-3).

### 🕸️ Context & Graph Linking
- **Target Epic / Issue ID:** Resolves #12526
- **Related Graph Nodes:** #12461 (B3 workstream), #12456 (SSOT epic)

### 🔬 Depth Floor
- **Challenge / Verified-Safe**: The `aiConfig.gitlab?.hostUrl || ''` → `aiConfig.gitlab.hostUrl` change removes the empty-string fallback. Verified safe — the empty/missing-hostUrl graceful path is **preserved**: `if (!hostUrl)` still catches an empty leaf-default and reports `unhealthy` (no throw on empty-string). Only a genuinely-undefined `gitlab` block would throw, which is the intended ADR-0019 fail-loud on config-tree corruption (the Provider guarantees `gitlab` resolves). Zero-tolerance import check: **no `Neo`/`_export` import** in this non-entrypoint service file — clean.

### 🧠 Graph Ingestion Notes
- **`[RETROSPECTIVE]`**: Per-leaf B3 cleanups (this, #12547/#12544/#12542) are a clean, low-risk PR class — direct Provider-leaf reads + archaeology-token hygiene; fast to review + merge.

### N/A Audits — 📑 🎯 📡 🔗 🪜
N/A across listed dimensions: internal config-read cleanup; no public-contract / close-target-epic / OpenAPI / cross-skill surfaces; L1/L2-lite evidence is appropriate (no new ACs needing L2/L3).

### 🧪 Test-Execution & Location Audit
- [x] Checked out the PR head in the test shell (`git fetch origin codex/12526-gitlab-b3 && git checkout FETCH_HEAD`; verified `#11768` gone → shell carries the PR head, not my branch).
- [x] **Reproduced the body's runtime verification on the PR head:** `HealthService.healthcheck()` → `{"status":"healthy","hostUrl":"https://gitlab.com","tokenConfigured":false,"details":[]}`. `aiConfig.gitlab.hostUrl` resolves to the leaf-default (no throw) — confirms the cleanup's core risk (does the leaf resolve?) is sound.

**Findings:** Verification reproduced green on the PR head (not a false-green — confirmed the shell carried the PR's code first). The cleanup is correct.

### 📋 Required Actions
None — ready to merge.

### 📊 Evaluation Metrics
*   **`[ARCH_ALIGNMENT]`**: 95 - Exact ADR-0019 B3 shape (direct Provider-leaf reads, fail-loud on tree corruption).
*   **`[CONTENT_COMPLETENESS]`**: 95 - Scoped, complete; archaeology hygiene handled; evidence reproduced.
*   **`[EXECUTION_QUALITY]`**: 95 - Minimal +3/-3, correct, no scope-creep, no Neo-import leak.
*   **`[PRODUCTIVITY]`**: 88 - Small focused PR; closes one B3 cluster leaf.
*   **`[IMPACT]`**: 78 - Removes silent config-drift in the GitLab healthcheck; modest surface.
*   **`[COMPLEXITY]`**: 30 - Trivial 3-line leaf-read cleanup.
*   **`[EFFORT_PROFILE]`**: Maintenance - SSOT defensive-read cleanup, single service.

Clean B3 leaf — approved, ready to merge. 🖖

---

