[kadel]

Allow Claude Code 2.1+’s claude.exe binary to reach Vertex STS.

Configure Review to use the repository-owned RHDH image and policy, and update the code/fix and e2e-triage policies with the same allowlist.

This fixes the policy_denied failure confirmed in the OpenShell logs for run 33504512709.

This fix follows the Fullsend policy configuration introduced in redhat-developer/rhdh-agentic#124.

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure (validation failed after 2 iteration(s)) · Started 1:25 PM UTC · Completed 1:27 PM UTC

Commit: d493020 · View workflow run →

Runtime: claude · Model: claude-opus-4-8

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 1:37 PM UTC · Completed 2:00 PM UTC

Commit: d493020 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $6.14

[fullsend-ai-retro]

Retro: PR fullsend-ai/fullsend#13 — fix(fullsend): allow Claude Code Vertex authentication

What happened

PR fullsend-ai/fullsend#13 on this newly-created repo (Aug 18, 2026) fixed a policy_denied failure that had been blocking all review agent runs since the repo was set up. Claude Code 2.1+ ships as a bun-compiled binary named claude.exe, but the upstream network policies from fullsend-ai/agents (pinned at 4bbe4f5) only allowlisted **/claude — causing the sandbox to block claude.exe from reaching Vertex AI STS for authentication.

The review agent dispatched on PR fullsend-ai/fullsend#13 itself also hit policy_denied (chicken-and-egg: the fix wasn't in the base branch yet). The agent consumed zero tokens across 2 iterations, produced no output, and reported "validation failed after 2 iteration(s)." The PR was correctly merged by kadel ~10 minutes later. A follow-up PR fullsend-ai/fullsend#14 (merged 7 minutes after) switched the model pin from Opus 4.8 (unavailable on Vertex) to Opus 4.6.

No review agent has ever completed successfully on this repo. All 4+ review dispatches failed due to policy or model issues before the fixes in PRs fullsend-ai/fullsend#13 and fullsend-ai/fullsend#14 landed.

Evidence for existing issues

• Harness should fail fast on authentication errors instead of retrying fullsend-ai/fullsend#2058 ("Harness should fail fast on authentication errors instead of retrying"): This retro provides direct evidence. The harness ran 2 full iterations despite policy_denied being deterministic — the same sandbox, same policy, same binary, guaranteed to fail again. Zero tokens consumed, ~92 seconds of sandbox create/delete wasted per attempt.
• Status comment should classify infrastructure failures and suggest retry fullsend-ai/fullsend#5382 ("Status comment should classify infrastructure failures and suggest retry"): The status comment said only "validation failed after 2 iteration(s)" with no indication that the root cause was a sandbox policy blocking claude.exe. A human had to dig through run logs to diagnose the issue.
• fullsend-ai/fullsend#6795 ("Review agent outage: opus alias resolves to policy-denied claude-opus-5 on Vertex AI"): PR Add testing-agents problem document fullsend-ai/fullsend#14's model fix (Opus 4.8 → 4.6) is related but distinct — the model wasn't available on the Vertex project, separate from the binary policy issue.

Proposals skipped (target repo not allowed)

File manually or update create_issues.allow_targets in config.yaml:

• **Add /claude.exe to upstream network policy binary allowlists (fullsend-ai/agents)