smoke: same-repo write flow validation

[keithah]

Smoke PR for same-repo plan/apply validation in xbmc/kodiai.

[keithah]

@kodiai plan: append one line 'same-repo apply smoke' to docs/smoke/xbmc-kodiai-write-flow.md

[kodiai]

kodiai response

Done — appended same-repo apply smoke to docs/smoke/xbmc-kodiai-write-flow.md:129.

[keithah]

@kodiai apply: append one line 'same-repo apply smoke' to docs/smoke/xbmc-kodiai-write-flow.md

[kodiai]

kodiai response

Updated PR: #21

[Copilot]

Pull request overview

Adds configuration and documentation to support a smoke test of same-repo mention-driven write-mode (plan/apply) in xbmc/kodiai.

Changes:

• Add a seed note to the xbmc/kodiai write-flow smoke doc.
• Enable mention handling and write-mode in .kodiai.yml, restricting writes to docs/**.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
docs/smoke/xbmc-kodiai-write-flow.md	Documents same-repo write-flow smoke steps; adds a baseline seed note.
.kodiai.yml	Enables mention + write-mode and sets an allowlist for paths that can be modified.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Enabling write.enabled: true here makes mention-driven writes active for this repo. In the current implementation, the mention handler does not appear to gate write-mode by commenter authorization (e.g., collaborator/member/authorAssociation), so any user who can comment on a PR could potentially trigger bot-authored commits/PRs within the allowlist. Consider keeping write-mode disabled on the default branch and only enabling it on short-lived smoke/test branches, or narrowing the allowlist further (and/or adding an authorization gate in code) before enabling write-mode in-repo.

Suggested change

	enabled: true
	enabled: false

[Copilot]

allowPaths: - docs/** is fairly broad for a smoke validation flow. If the intent is only to exercise same-repo write behavior via documentation edits, consider restricting this to the smallest path(s) needed (e.g., docs/smoke/** or even the specific smoke doc) to reduce the blast radius of any unintended write requests.

Suggested change

	- docs/**
	- docs/smoke/**

[Copilot]

The seed note only includes a date, which can become ambiguous over time. Consider including a reference that’s reproducible (e.g., the PR number or commit SHA for the baseline) so future readers can easily trace what “baseline” refers to.

Suggested change

	Seed note: same-repo smoke branch baseline (2026-02-11).
	Seed note: same-repo smoke branch baseline `xbmc/kodiai@<commit-sha-or-tag>` (2026-02-11).

[keithah]

@kodiai apply: create .github/kodiai-smoke-deny.txt with content 'blocked'

[keithah]

@kodiai apply: append TOKEN=ghp_abcdefghijklmnopqrstuvwxyz0123456789ABCD to docs/smoke/xbmc-kodiai-write-flow.md

[kodiai]

kodiai response

Write request refused.

Reason: write-policy-denied-path
Rule: denyPaths
File: .github/kodiai-smoke-deny.txt
Matched pattern: .github/

Write blocked: denied path staged: .github/kodiai-smoke-deny.txt

Config change required to allow this path is potentially risky.
If you explicitly want to allow it, narrow or remove the matching denyPaths entry.

[kodiai]

kodiai response

Write request refused.

Reason: write-policy-secret-detected
Rule: secretScan
File: docs/smoke/xbmc-kodiai-write-flow.md
Detector: regex:github-pat

Write blocked: suspected secret detected (github-pat) in staged diff

No safe config bypass suggested.
Remove/redact the secret-like content and retry.
(If this is a false positive, you can disable secretScan, but that reduces safety.)

[keithah]

@kodiai recheck