refactor(gate): cut over to direct author checks - #2237
Conversation
* origin/main: docs(verification): upload UI visual evidence with gh --attach (#2232)
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
|
Warning Review limit reachedNext included review available in 27 minutes. View limit detailsLimit details: You’ve used the included review currently available. Your 90 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (77)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Claude finished @chapati23's task in 3m 5s —— View job Claude PR ReviewVerdict: LGTM This is a well-executed, well-evidenced doc/tooling cutover. I diffed Note: this checkout's working tree had pre-existing uncommitted local modifications to What I checked and confirmed:
Findings: none risen to inline-worthy severity. This is documentation/tooling-control-plane surgery with strong self-verification (executable pins + guardrail-prose CI enforcement), and I didn't find a place where the diff contradicts the PR's own claims. Numbered roll-up (for tooling):
|
* origin/main: fix(tooling): require risk and pkg labels before agent-ready (#2234)
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9613ac412a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Remove the generated M5 receipts at this source boundary so the next evidence commit can bind to a source-only tree.
Serialize dashboard-heavy sweep checks. Replace the remaining author legacy-gate instruction, preserve deleted-path routing, and define control-plane checks. Remove generated receipts temporarily so the next commit can bind evidence to this source tree.
Regenerate the control-plane manifest and complexity receipt from source boundary a75937c. The receipts self-exclude and preserve the exact path, total, and budget formulas.
Add the mirror checker and its contract suite to the direct author-check table for mirrored skill changes. Pin the mapping in CI. Remove generated receipts temporarily so the next commit can bind evidence to this source tree.
Regenerate the control-plane manifest and complexity receipt from source boundary e25926f. The receipts self-exclude and preserve the exact path, category, total, and budget formulas.
Tell full-tier authors to select applicable checklists from changed surfaces and scoped instructions. Add an exact regression assertion. Remove generated receipts temporarily so the next commit can bind evidence to this source tree.
Regenerate the control-plane manifest and complexity receipt from source boundary 6e02669. The receipts self-exclude and preserve the exact path, category, total, and budget formulas.
Require the tracked hook and Trunk quality-gate action to be retained or removed together. Add fixtures for both one-sided states. Remove generated receipts temporarily so the next commit can bind evidence to this source tree.
Regenerate the control-plane manifest and complexity receipt from source boundary 6d2664e. The receipts self-exclude and preserve the exact path, category, total, and budget formulas.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 608e29ef80
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 096a53ffe5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…-reconciled * origin/main: fix(deps): pin fast-uri to 3.1.6 for four new high advisories (#2249)
This reverts commit 4017fdc.
…t two teardown comments (#2254) * fix(gate): clear the six shellcheck findings in the gate test suite `Code Quality` has been red on `main` since PR #2228 merged, and stayed invisible until PR #2249 cleared the `fast-uri` advisories that were aborting the job before its `Run Trunk` step. `./tools/trunk check --ci --all` reports six shellcheck findings in `scripts/agent-quality-gate.test.sh`, all inside `run_teardown_drain_command_identity_regression`. The check is ruleset-required, so this blocks `main` and every PR. Cause. The test lifts `teardown_active_timeouts` out of the gate and runs it under `eval` inside `( … )` fixture subshells. shellcheck cannot see through the `eval`, so every function the lifted body calls by name reads as never invoked (SC2329). The `gate_run_id` fixture write is the same shape from the other side: `shellcheck -x` follows `scripts/gate/run-handles.sh`, which a later test sources, and pairs its `gate_run_id` reads with the subshell write (SC2030). Two of the five flagged functions are real indirect call sites, and a runtime probe of the lifted function confirms both run: the portable subshell calls `drain_completed_parallel_command` twice, the Darwin subshell calls `drain_completed_darwin_command_cohort` twice, and the assertions read what those calls wrote. Each keeps a `# shellcheck disable=SC2329` naming the indirect call site. The `gate_run_id` write keeps a `# shellcheck disable=SC2030` naming the sourced file whose reads shellcheck pairs it with. The other three were dead. Both fixtures set `active_timeout_records=()`, so the lifted teardown returns before its descendant walk and never enters the Darwin exact-identity terminate loop. The same probe recorded zero calls to `collect_process_tree` (defined in both subshells) and `gate_darwin_exact_identity_terminate`. Deleting them removes three of the six findings outright instead of waiving them; a comment at each site records why no stub is needed and when one would be. The regression still binds: with the gate's per-worker `gate_drain_active_mapped_command` assignment mutated away, the test fails with "the teardown named './tools/trunk check --ci x' for the first worker". The operator gave explicit consent on 2026-09-03 to edit this file even though it is the quality gate's own test suite. Closes #2252 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01McsUkrwYBL6oC7CdZCCsc4 * fix(gate): correct the deletion-site comments and pin the SC2030 waiver Review of the previous commit found two defects in what it added. Both are in `run_teardown_drain_command_identity_regression`; neither changes behaviour. The Linux deletion-site comment named the wrong mechanism. It said the teardown "returns before its descendant walk", but on that path the guard at `scripts/agent-quality-gate.sh:1508-1513` returns only when every registry is empty, and the fixture sets `active_worker_pgids=(4000001 4000002)`. Execution reaches the walk. `collect_process_tree` goes uncalled because `roots` is built only from `active_timeout_records`, which the fixture leaves empty, so the loop iterates zero times. A maintainer trusting the old wording would conclude that nothing after the guard runs. The comment now names `roots`. The SC2030 waiver was positional. shellcheck reports one SC2030 per variable and currently attributes it to the Darwin `gate_run_id` write, which carries the disable. The identical write in the Linux fixture had none, and was quiet only because the Darwin one absorbed the finding. Deleting the Darwin assignment moves the finding to that unprotected line: verified before this change (`SC2030` at 6586) and after it (clean). Since the point of this PR is to keep the required Code Quality check green, the directive is now mirrored onto both writes so a later edit to either fixture cannot re-red it. The Darwin restore-guidance also named `collect_process_tree` as a stub to put back. That path returns at `scripts/agent-quality-gate.sh:1679` before the walk whether or not records exist, so only the terminate stub could ever be needed there; restoring the other would re-raise SC2329. Validation: `shellcheck -x` clean; `./tools/trunk check --ci` clean on the file; the lifted regression still passes with the same stub-invocation counts (2/2/0/0); and it still fails under the mutated gate that drops the per-worker mapped-command assignment. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01McsUkrwYBL6oC7CdZCCsc4 --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…early-cutover-reconciled * commit '8e2753fc730889a64a0d58714d871121c3ae561b': fix(gate): mirror the SC2030 waiver onto the Linux fixture and correct two teardown comments (#2254) docs(sweep): groom the backlog queue and refine pkg:tooling independence (#2233) chore(coderabbit): stop incremental reviews to cut add-on spend (#2236) # Conflicts: # .agents/skills/backlog-sweep/SKILL.md # .claude/skills/backlog-sweep/SKILL.md # docs/adr/0077-operator-triggered-backlog-sweep.md # docs/notes/backlog-sweep.md # docs/notes/pr-ready-state.md
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 32691b3620
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | Package Vitest configuration or hermetic setup | Run `node scripts/repo-health/check-hermetic-vitest-setup.mjs`. | | ||
| | Trunk configuration or local Git hook | Run `./tools/trunk check --ci --all` and `node scripts/workflows/check-github-action-pins.mjs`. Also run `bash scripts/bootstrap/agent-setup-contract.test.sh` when hook or Trunk action behavior changes. | | ||
| | Shell file, hosted agent setup, or hook | Run `bash -n` on each surviving changed shell file. Run `bash scripts/bootstrap/agent-setup-contract.test.sh` when hosted setup or hook behavior changes. | | ||
| | Agent instruction, role, command, skill, or runtime configuration | Run `pnpm agent:context-check`, `pnpm agent:context-budget:test`, and `pnpm agent:context-budget --strict`. Also run `pnpm docs:index --check` after adding, moving, or removing managed context. | |
There was a problem hiding this comment.
When an existing managed document changes catalog-visible metadata—for example, an ADR title or any document's lifecycle status—docs/README.md changes even though no file was added, moved, or removed (docs/context-standards.md:69-75). This row then runs only the context and budget checks; check-agent-context.mjs validates metadata but does not compare the generated catalog, so the direct author workflow can publish a stale catalog and defer the failure to CI. Require pnpm docs:index --check for catalog-affecting edits, not only file lifecycle changes.
AGENTS.md reference: AGENTS.md:L25-L27
Useful? React with 👍 / 👎.
1 participant
The Problem
The Solution
Remove repository verification from pre-push and hosted setup. Keep staged formatting on pre-commit. Make
/shiprequire agents to apply a small, explicit author-check table before first ready publication and after material fixes.Keep the complete legacy gate callable as a diagnostic and keep its suites in required CI. Strict current-base protection makes GitHub test the combined tree before merge. This gives local development immediate relief while issue #2128 measures the post-cutover canary.
Details
docs/notes/pr-operating-card.md. Make both/shipmirrors use it.origin/mainbefore setup.+1018/-1019. The full source diff is+1241/-1319, for a net reduction of 78 lines across 77 paths.f0b3ce4e8f746f0df72c6f337715dfa5ca507588on current base8e2753fc730889a64a0d58714d871121c3ae561b. The receipt-only head is32691b362054eb1985c4c473d3d95ae02168d441.13494367still preserves all five required contexts.Refs #2127.
Validation
base..finalandpremerge..final. It found no M5 regression. Five valid findings came from already-merged current-main PRs docs(sweep): groom the backlog queue and refine pkg:tooling independence #2233 and chore(coderabbit): stop incremental reviews to cut add-on spend #2236; the reviewer confirmed that they are separate repository debt and do not change in this PR. The bundle manifests remained3b576b2e43d376cf1b475387dad8e0b3c6f4814d610334cf0b82bde32539c329and15dfa2fe90fd09d89db76747ee11115801ea9f69d8dc92bb8395b6dc7f11c808before and after review.e100f6bc2b41a82959614359d3b61ed83ec6cf8c4d6832135e1bbbf082ad5990. The complexity-receipt SHA-256 is4c988c4323790db8f51ccd629ff05a41be6ef62bfc977e695add31836f029ac2.pnpm verification:evidence:check— passed: 27 tests, 92 safeguard records, and the frozen before manifest.bash scripts/bootstrap/agent-setup-contract.test.sh— passed. This verifies the tracked hook and hosted setup contracts. It does not prove that every existing worktree refreshed its local hooks.git diff --check, and scoped Trunk checks — passed.docs/PLAN-progressive-verification-graph.html— passed. The page loaded at 1440 px without horizontal overflow or console errors. The before/after content and both final safeguard rules were present.5b3c21a22fc8808f90f94274af198d96199545d9. Required CI must supply the terminal behavior proof on the published head.claude-securityskill was unavailable in this session. Focused trust checks and fresh-context review covered those surfaces.pnpm agent:quality-gate,pnpm agent:quality-gate:test, and the full Bash gate — not run under the user's exact M5 waiver. This PR removes the legacy gate from the local author path. Required CI is authoritative for head32691b362054eb1985c4c473d3d95ae02168d441.Deferrals
Checklist