fix: fail closed on Robot SF gate evidence - #7343
Conversation
…e-authority-repair-20260817
…e-authority-repair-20260817
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
the
review-bot-auto
🔍 PR Contract Check SummaryOverall Status: 🟢 PASSED
ℹ️ Info
This check is mechanized. Please resolve any blockers to pass CI. |
Maintainer Decision RequiredCurrent Status:
Action Required by Maintainer:
|
ll7
added
the
decision-required
Decision packetQuestion. Merge this fail-closed source-head Merge Queue Gate now, or hold it until the Direction of the change (not an authority expansion). Every hunk narrows merge authority:
What is author-reserved. Two things, neither performed by this PR:
Recommendation. Hold as draft until #1645 is ready, then land #1645 → #7343 → ruleset change. Automatic consequence of each ruling.
Reopen condition. A confirmed merge that bypasses the gate after activation, or evidence that the Evidence. Head |
|
Self-review disposition (2026-08-18; not an approval): reviewed the exact draft head The diff is coherent as a fail-closed source-PR/merge-group gate repair and adds regression coverage, but it is an authority-expansion change: it changes workflow enforcement for pull-request/review events and explicitly requires a separate |
…-repair-20260817' into codex/issue-1624-merge-authority-repair-20260817
|
#7343: hold-for-coordinated-orchestrator-1645-landing Choose the coordinated landing. Keep this PR draft until The change is directionally fail-closed, but landing this half alone would make the new gate appear as a red required check to existing PR-rollup tooling before the consumer-side exclusion and exact-head authority path are ready. That operational cost is avoidable, and #1645 is still draft. Automatic consequence: remove Policy decision was evaluated at head |
ll7
removed
the
decision-required
|
Updated exact head: This now also closes the independent Validation from the current merged-base worktree: 269 focused tests passed, Ruff passed, py_compile passed, and |
…e-authority-repair-20260817
PR reconciliation — canonical source-head gate, ordered control-plane rolloutThis PR remains the source-head workflow owner. It must be reviewed together with the orchestrator companion and direct-dispatch path, not as an isolated workflow edit. Required order:
Do not enable the required branch-protection context before the complete authority path is present. Historical merges remain forensic only. |
ll7
left a comment
ll7
left a comment
There was a problem hiding this comment.
Exact-current-main review — blocked
- PR: #7343 (
fix: fail closed on Robot SF gate evidence) - Published PR head:
5b1308eb9d4015232200d99d5f7cd37d4e27e1de - Current
origin/main:69bf08968dfc528221518a6bde29ef4a2e889754 - Linked worktree:
/home/luttkule/git/robot_sf_ll7.worktrees/pr-7343-current-main-20260821
Refresh result
The branch cannot be rebased cleanly onto the current main. The merge-tree conflict set is:
scripts/dev/merge_queue_gate.pyscripts/dev/pr_loop_policy.pyscripts/dev/stacked_prs.pytests/dev/test_merge_queue_gate.pytests/dev/test_stacked_prs.py
The PR is a draft and its body identifies an external cross-repository authority/ruleset follow-up. Its old-base implementation therefore has no current-base implementation proof and is not eligible for merge admission.
Disposition
- No code was changed or pushed in the review worktree.
- Do not infer acceptance from the old exact-head checks.
- Rebase/repair the conflict set, rerun focused gate/stacked-PR tests and final readiness, reconcile the body, and obtain the required cross-repo/ruleset decision before reconsidering.
base-policy: current-base-refresh-required @ 69bf08968dfc528221518a6bde29ef4a2e889754
gate-verdict: blocked @ 5b1308eb9d4015232200d99d5f7cd37d4e27e1de
merge-ready: no @ 5b1308eb9d4015232200d99d5f7cd37d4e27e1de
|
review-claim: verify-7343 @ 5b1308e until 2026-08-23T03:30:00Z Exact-head review only; no merge. Claim acquired after live head/base and recent activity readback. |
ll7
left a comment
ll7
left a comment
There was a problem hiding this comment.
Exact-head review — blocked on stale/conflicting base
- PR: #7343 (
fix: fail closed on Robot SF gate evidence) - Reviewed head:
5b1308eb9d4015232200d99d5f7cd37d4e27e1de - PR base:
85577f5dca7d2eeab175c7e37ea782f3a897d842 - Current
origin/main:0f9d0a9928bba055458df2b3b3a405f2ef845f60 - Dedicated worktree:
/home/luttkule/git/robot_sf_ll7.worktrees/pr-7343-review-20260823 - Disposition: blocked; no approval and no merge
Findings
P1 — current-base proof is unavailable. GitHub reports the draft PR as mergeable=false,
mergeable_state=dirty, and its base is stale. git merge-tree origin/main HEAD reports content
conflicts in docs/dev_guide.md, scripts/dev/merge_queue_gate.py,
scripts/dev/pr_loop_policy.py, scripts/dev/snapshot_pr_queue.py, scripts/dev/stacked_prs.py,
tests/dev/test_merge_queue_gate.py, and tests/dev/test_stacked_prs.py. Current main already
contains later exact-head provenance, trusted-carrier, and stacked-merge safeguards; the PR's
861-line delta removes or rewrites some of those contracts while adding source-PR fail-closed
workflow enforcement. This remains unique value (current main is still advisory for source PRs),
but reconciling it is a design-level refresh, not a bounded conflict repair. Do not merge this
old-base head.
P1 — exact-head metadata admission is not established. The body was reconciled through the
REST helper at exact head, producing digest
16fa53d3e6de448d2b21d16efc9c52e67eda02aeccba99161d1c55538ff377b9, but the body has no
pr-metadata: reconciled @ <digest> carrier. The PR's listed final-readiness command could not
run in this worktree because duckdb, pyarrow, and pandas are unavailable. A refreshed branch
must add/verify current-base metadata and rerun the final readiness path before admission.
Exact-head validation
pytest tests/dev/test_merge_queue_gate.py tests/dev/test_pr_loop_policy.py tests/dev/test_snapshot_pr_queue.py tests/dev/test_stacked_prs.py -q— 269 passed.uvx --from ruff==0.16.2 ruff check <changed Python files>— passed.uvx --from ruff==0.16.2 ruff format --check <changed Python files>— 7 files already formatted.git diff --check origin/main...HEAD— passed.check_docs_evidence_integrity.py --base-ref origin/main --full— 1992 Markdown files passed.check_docs_proof_consistency.py --base origin/main --json—[].PR_READY_MODE=final BASE_REF=origin/main scripts/dev/pr_ready_check.sh— unavailable because optional analytics dependencies (duckdb,pyarrow,pandas) are missing; not treated as success.
The hosted check snapshot has 30 successes plus one skipped check, with merge-queue-gate
failed on the draft/stale/missing-evidence state. That failure is consistent with the PR's own
fail-closed contract and is not evidence of a repaired current-base implementation.
The cross-repository companion ll7/codex-orchestrator#1645 remains open and the PR's required
ruleset activation is maintainer follow-up. Refresh this branch onto current main, reconcile the
current #7471 provenance guard and #7417 stacked path, rerun the focused/current-base proof, and
obtain the coordinated authority/ruleset decision before reconsideration.
pr-metadata: reconciled @ 16fa53d3e6de448d2b21d16efc9c52e67eda02aeccba99161d1c55538ff377b9
gate-verdict: blocked @ 5b1308e
merge-ready: no @ 5b1308e
|
review-claim: released @ 5b1308e Exact-head review published as COMMENTED; no code push and no merge. Reopen after a current-main refresh and coordinated companion review. |
|
review-claim: verify-7343 @ 5b1308e until 2026-08-23T18:31:31Z Corrective short claim recorded after identifying the original marker's expired timestamp. No further PR mutation is planned. |
|
review-claim: released @ 5b1308e Exact-head review published as COMMENTED; no code push and no merge. Reopen after a current-main refresh and coordinated companion review. |
…to v2 Part A: scripts/dev/audit_pr_contract_versions.py classifies open PRs as v2_valid/v2_invalid/v1_compatibility/body_missing via the canonical pr_contract_v2 parser, with deterministic JSON, offline fixtures, and a fail-closed --check mode. v1-compatible PRs are reported, not failed, during the compatibility period. Part B: live-migrated draft PR #7343 to a valid pr-contract:v2 block (change_class: tooling, relates 7665+7892, deferred main-protection ruleset change recorded without authorizing it) after exact-head and changed-path revalidation; the complete human body is preserved. Part C: docs/context/evidence/issue_7892_pr_contract_v2_live_migration/ records the inventory counts, pre/post body digests, parser and follow-up analyzer results, and the no-CI-event-on-edit observation. Closes #7892. Relates #7665.
…to v2 (#7894) <!-- pr-contract:v2 change_class: tooling linked_issues: closes: - 7892 relates: - 7665 deferred_work: status: none issues: [] reason: "" evidence: applicability: na tier: null result: na domain_approval: required: false status: not_required domains: [] note: "NA - control-plane workflow/tooling change; no simulation, benchmark, metric, model, safety, or publication claim." performance: claimed: false --> ## Summary Deliver issue #7892's pr-contract.v2 live-migration slice in three parts: - **Part A** — `scripts/dev/audit_pr_contract_versions.py`: read-only inventory of open PR contract versions using the canonical `pr_contract_v2` parser. Classifies each PR as `v2_valid` / `v2_invalid` / `v1_compatibility` / `body_missing`, supports deterministic JSON output, offline JSON fixtures, and a fail-closed `--check` mode (malformed v2 markers fail; v1-compatible PRs are reported, not failed, during the compatibility period). - **Part B** — live-migrated draft PR #7343 to a valid `pr-contract:v2` block after exact-head (`5b1308eb9...`) and changed-path revalidation. The complete human body is preserved; the declared block is `change_class: tooling`, `relates: [7665, 7892]`, with the deferred main-protection ruleset change recorded but not authorized. - **Part C** — `docs/context/evidence/issue_7892_pr_contract_v2_live_migration/README.md`: live observation receipt with inventory counts before/after, pre/post body digests, local parser and follow-up analyzer results, and the explicit no-CI-event-on-`edited` observation. ## Why / user value Open PRs keep shipping without a machine-readable contract, and the v1 Markdown parser is the only classification path. This slice adds a deterministic inventory so the migration to `pr-contract.v2` can be tracked per PR, proves the live migration path on one representative tooling PR, and records the exact validation/CI behavior — all without weakening any hard gate or removing v1 support. ## What changed - `scripts/dev/audit_pr_contract_versions.py` (new, 170 lines) - `tests/dev/test_audit_pr_contract_versions.py` (new, 230 lines, 14 tests) - `docs/context/evidence/issue_7892_pr_contract_v2_live_migration/README.md` (receipt) ## Validation / proof - `uv run pytest tests/dev/test_audit_pr_contract_versions.py -q` → 14 passed - `uv run pytest tests/dev/test_check_pr_followups.py tests/test_ci_script_contract.py -q` → regression, 232 passed combined - `uv run ruff check scripts/dev/audit_pr_contract_versions.py scripts/dev/pr_contract_v2.py scripts/dev/check_pr_followups.py tests/dev/test_audit_pr_contract_versions.py` → clean - `uv run ruff format --check scripts/dev/audit_pr_contract_versions.py tests/dev/test_audit_pr_contract_versions.py` → clean - `git diff --check` → clean - Live inventory: 8 open PRs before migration (all `v1_compatibility`); 7 `v1_compatibility` + 1 `v2_valid` (#7343) after - Proposed and live #7343 bodies both parse `ok` via `parse_pr_contract_v2` and pass `analyze_body` (follow-up analyzer) ## Risks and rollback - The one external write is the #7343 body edit (prepend-only, human body preserved; documented digests allow restoration). No merge, approval, v1 removal, branch-protection, or ruleset change is made. - The inventory tool requires `gh` read access or a fixture; failures are explicit. ## Follow-up / residual scope - v1 parser removal and any `main-protection` ruleset change remain separately authorized (see #7665 and the #7343 deferred-work declaration).
|
review-claim: goal-cycle-20260827-pr7343 @ 5b1308e until 2026-08-27T15:30:00Z Exact-head review lease for the current draft disposition only. No branch push or merge unless the live head changes and the coordinated companion gate is satisfied. |
ll7
left a comment
ll7
left a comment
There was a problem hiding this comment.
Exact-head review — blocked on coordinated rollout
- PR: #7343 (
fix: fail closed on Robot SF gate evidence) - Reviewed head:
5b1308eb9d4015232200d99d5f7cd37d4e27e1de - Current
origin/main:a8a5405253f7fe77454241aa6557e4b3ffadb892 - PR base:
85577f5dca7d2eeab175c7e37ea782f3a897d842
Validation
git diff --check origin/main...HEAD— passed.uv run pytest tests/dev/test_merge_queue_gate.py tests/dev/test_pr_loop_policy.py tests/dev/test_stacked_prs.py -q— 215 passed.
Disposition
The exact-head code and targeted tests are coherent, but this draft is not merge-ready. GitHub reports the base as stale against current origin/main, the merge state as conflicting/dirty, and merge-queue-gate as failed. The PR contract and existing maintainer decision comments also hold this source-side change for the coordinated external companion rollout.
I am leaving this as a blocking comment only: no code change, branch push, approval, or merge is justified until the companion decision is satisfied and the branch is refreshed and revalidated at a new exact head.
|
review-claim: released @ 5b1308e Exact-head blocked review published as COMMENTED (review 5042247544). No code push, approval, or merge. Reopen after the coordinated companion rollout and a fresh current-main rebase/revalidation. |
Coordinated-rollout blocker refresh — 2026-08-28Two Robot SF prerequisites named in the earlier handoff are now complete: #7486 and #7417 merged. Current The controlling cross-repository dependency remains unresolved: Disposition remains draft and dependency-blocked. The next valid implementation step is a coordinated owner refresh after the orchestrator companion is ready, followed by current-main conflict reconciliation and exact-head control-plane validation. No |
1 participant
Summary
Issue
Cross-repo companion to ll7/codex-orchestrator#1624. This is control-plane maintenance only; it changes no Robot SF simulation or benchmark claim.
Validation
tests/dev/test_merge_queue_gate.pytests/dev/test_pr_loop_policy.pytests/dev/test_snapshot_pr_queue.pyPR_READY_MODE=final BASE_REF=origin/main scripts/dev/pr_ready_check.shFollow-up
After this code is merged and the required check is observed on
main, the maintainer must apply the reviewedmain-protectionruleset change requiringmerge-queue-gate. Historical merges are forensic evidence only and are not backfilled.