Agents: pin and verify shared workflow drift - #4749
Merged
Merged
Conversation
Contributor
WalkthroughThe PR adds pinned workflow drift manifests and CI checks, refactors seam initialization and validation, introduces dispatch/replay and readiness gates, adds audit utilities, and updates agent workflow contracts, documentation, and tests. ChangesAgent workflow governance
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related issues
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Member
Author
|
+ci-status |
Contributor
CI StatusHead SHA: Only the required gate is active unless hosted CI is requested. |
Member
Author
|
GitHub Actions semantic-change audit for final head
|
Member
Author
|
+ci-run-hosted |
Contributor
Hosted CI RequestedTriggered 9 workflow(s) for View progress in the Actions tab. |
github-actions
Bot
added
the
ready-for-hosted-ci
Greptile SummaryThis PR pins and verifies the shared agent-workflows pack. The main changes are:
Confidence Score: 5/5This looks safe to merge.
Important Files Changed
Reviews (1): Last reviewed commit: "Refresh the pinned workflow pack after r..." | Re-trigger Greptile |
![claude[bot]](https://avatars.github.com/in/1236702?s=60&v=4){kind=small}
Contributor
Review SummaryReviewed the diff (42 files, ~18k/-1.8k lines, all internal What it does: Pins the vendored copies of shared Assessment:
One finding posted inline: No P0/P1 issues found. |
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 12
🧹 Nitpick comments (1)
.agents/docs/installation-and-upgrades.md (1)
185-185: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider using a hyphen for the compound adjective.
Grammatically, "Full-Stack" serves as a compound adjective modifying the subsequent noun. Consider adding a hyphen for correctness.
📝 Proposed fixes
For line 185:
-## Full Stack Contributor Setup +## Full-Stack Contributor SetupFor line 259:
-### Full Stack Doctor +### Full-Stack DoctorAlso applies to: 259-259
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.agents/docs/installation-and-upgrades.md at line 185, Update the section headings “Full Stack Contributor Setup” at both occurrences to use the hyphenated compound adjective “Full-Stack Contributor Setup.”Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/bin/agent-workflow-seam-doctor:
- Around line 292-300: Update validate_trust_mapping! to validate trusted_bots
and trusted_metadata_bots values before calling normalized_trust_bot_login:
accept either a legacy string login or an array containing only nonempty
strings, and reject hashes, numbers, mixed arrays, and empty entries. Preserve
the existing normalization and overlap detection for valid inputs.
- Around line 1617-1619: Update the wrapper validation checks around the script
invariant logic and script_cd_to_root? so they inspect uncommented executable
lines rather than raw content. Ensure commented occurrences of set -euo
pipefail, repository-root resolution, or cd commands cannot satisfy the checks,
while preserving validation of the actual executable wrapper behavior.
- Around line 1043-1049: Update init_npm_command_info so executable paths whose
basename is npm, such as /usr/bin/npm, are accepted alongside the literal npm
command. Apply this check to the shifted command token while preserving
rejection of other executables and the existing argument parsing behavior.
- Around line 379-385: Strengthen env_split_string_operand_boundary handling in
complete_argument_forwarding_after? so nested shell -c payloads reserve a safe
$0 placeholder in addition to requiring outer "$@" forwarding; reject or parse
commands that do not satisfy both conditions. Update .agents/docs/adoption.md
lines 58-65 and .agents/docs/seam-design.md lines 147-153 to document both
required protections, while the executable change belongs in
.agents/bin/agent-workflow-seam-doctor lines 379-385.
In @.agents/docs/pr-batch-skills.md:
- Around line 209-211: Update the readiness invocation guidance in the PR batch
workflow to use the previously resolved PR_BATCH_SKILL_DIR when locating
pr-ci-readiness, rather than the hard-coded skills/pr-batch path. Preserve the
--requested-hosted-run argument and ensure the pinned/shared helper selected by
the resolution chain is the one invoked.
In @.agents/docs/seam-design.md:
- Around line 198-208: The Validation section must include the second pinned
drift check alongside agent-workflow-drift-manifest-test.rb. Add the actual
<pinned-source>/bin/check-agent-workflow-drift command, using the existing
pinned checkout reference, while preserving the current completeness test and
other validation steps.
In @.agents/skills/plan-pr-batch/scripts/check_goal_prompt_size.rb:
- Around line 854-865: Update the substitution checks in the mixed fallback flow
around mixed_route_fallback to compare each result with its immediate
pre-substitution value: retain the value returned by with_items before applying
WORKER_MODEL_EFFORT_ROUTES_PROMPT_LINE, then compare the route substitution
result against it; likewise compare the dispatch-policy substitution result
against the route-substituted value. Do not compare either result with the
one-item fallback_prompt.
In @.agents/skills/post-merge-audit/bin/closeout-evidence-replay:
- Around line 186-205: Update the not_applicable handling in the replay logic so
status: not_applicable remains a NOT_APPLICABLE disposition even when findings
are present, preventing valid findings from satisfying
--require-priority-dispositions. Add a required-mode regression test covering
not_applicable with a valid finding and verify it cannot produce SATISFIED.
In @.agents/skills/pr-batch/bin/dispatcher-capability-preflight:
- Around line 564-573: Update the selected_choice handling and corresponding
branches around persisted_decision_history and resolved_operator_decision so a
new dispatch-decision supersedes any prior refresh resolution. Ensure
history_resolution emits action dispatch-decision with the new approval and does
not classify the assignment as top-level fallback. Add coverage for
refresh-then-dispatch replay without operator_decision, including the related
branches near the other referenced locations.
In @.agents/skills/pr-batch/bin/pr-ci-readiness:
- Around line 295-335: Update assess to capture the PR head SHA before fetching
checks, pass and reuse that SHA for apply_requested_hosted_runs and
apply_viewer_review_inventory filtering, then re-read the head after all
evidence collection. If the head changed, set the verdict to UNKNOWN; always
include the observed head OID in the result so downstream merge logic binds
readiness to one stable head.
In @.agents/skills/pr-batch/bin/pr-security-preflight:
- Around line 163-174: Update repo_option_info to parse the gh repo view payload
with repo_info_from_payload before returning from the explicit GH_HOST path.
Require both the resolved nameWithOwner and canonical parsed host to match repo
and expected_github_host, aborting on either mismatch; add coverage for a
same-slug response from a different host.
In @.agents/skills/pr-batch/lib/git_probe_env.rb:
- Around line 66-77: Update timeout cleanup in the process-wait flow around
wait_for_process and terminate_process_group so reaping the child never blocks
past timeout_seconds. Use non-blocking waitpid behavior or a bounded reap loop,
including the ensure cleanup path, while preserving termination of the process
group.
---
Nitpick comments:
In @.agents/docs/installation-and-upgrades.md:
- Line 185: Update the section headings “Full Stack Contributor Setup” at both
occurrences to use the hyphenated compound adjective “Full-Stack Contributor
Setup.”
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 01c59553-0cde-4585-8887-e89a9541f210
📒 Files selected for processing (42)
.agents/.rubocop.yml.agents/agent-workflow-drift.yml.agents/bin/README.md.agents/bin/agent-workflow-drift-manifest-test.rb.agents/bin/agent-workflow-seam-doctor.agents/bin/agent-workflow-seam-doctor-test.rb.agents/bin/agent_workflow_drift_manifest_test_test.rb.agents/docs/adoption.md.agents/docs/coordination-backend.md.agents/docs/installation-and-upgrades.md.agents/docs/pr-batch-skills.md.agents/docs/seam-design.md.agents/docs/security-posture.md.agents/skills/address-review/bin/fetch-pr-review-data-test.rb.agents/skills/plan-pr-batch/scripts/check_goal_prompt_size.rb.agents/skills/post-merge-audit/bin/closeout-evidence-replay.agents/skills/post-merge-audit/bin/closeout-evidence-replay-test.rb.agents/skills/post-merge-audit/bin/pr-check-completion-timing.agents/skills/post-merge-audit/bin/pr-check-completion-timing-test.rb.agents/skills/pr-batch/bin/dispatcher-capability-preflight.agents/skills/pr-batch/bin/dispatcher-capability-preflight-test.rb.agents/skills/pr-batch/bin/pr-ci-readiness.agents/skills/pr-batch/bin/pr-ci-readiness-test.rb.agents/skills/pr-batch/bin/pr-security-preflight.agents/skills/pr-batch/bin/pr-security-preflight-test.rb.agents/skills/pr-batch/bin/stage-dependency-gate.agents/skills/pr-batch/bin/stage-dependency-gate-test.rb.agents/skills/pr-batch/lib/git_probe_env.rb.agents/skills/pr-batch/trusted-github-actors.yml.agents/skills/update-changelog/bin/changelog-merged-prs.agents/skills/update-changelog/bin/changelog-merged-prs-test.rb.agents/workflows/address-review.md.agents/workflows/adversarial-pr-review.md.agents/workflows/continuous-evaluation-loop.md.agents/workflows/post-merge-audit.md.agents/workflows/pr-processing.md.agents/workflows/tdd.md.github/workflows/ci-required.yml.github/workflows/hosted-ci-safety.test.cjs.prettierignoreAGENTS.mdinternal/contributor-info/agent-workflow-adoption.md
justin808
force-pushed
the
codex/23-wire-pinned-drift-check
branch
from
July 18, 2026 22:12
85d5439 to
ccc90ee
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/docs/installation-and-upgrades.md:
- Around line 516-519: Clarify the installation behavior in the skill Markdown
section: plugin-companion mode must not install the target’s skills directory,
because native plugins already provide skills and the installer adds only
companion assets. Align this statement with the plugin installation descriptions
in the earlier documented sections and preserve the host-neutral layout guidance
for modes that do install skills.
In @.agents/skills/pr-batch/bin/dispatcher-capability-preflight-test.rb:
- Around line 715-741: Update
test_replay_ignores_candidate_index_but_rebuilds_it_from_current_discovery_order
to assert that the replayed dispatch rebuilds stable-instance’s candidate index
to 1 after the new candidate is inserted, rather than comparing the entire
dispatch object to the first result. Keep the existing assertions for
launch-pending status and active assignments.
In @.agents/workflows/post-merge-audit.md:
- Around line 70-71: Resolve the comma parsing ambiguity across the marker
grammar, replay helper, mirrored skill, and regression fixtures. Prefer
reserving commas by rejecting them in record refs, then ensure OUTSTANDING
findings parsing and blocker identity/deduplication follow that rule
consistently; update the affected validation and fixture expectations without
changing unrelated ref normalization behavior.
In @.agents/workflows/tdd.md:
- Around line 12-14: Update the testing guidance in .agents/workflows/tdd.md so
narrow RED loops begin with the targeted commands defined in AGENTS.md: the
owning bundle for RSpec and pnpm for JavaScript tests. Revise the guidance
around the broad test command and the instruction at line 29 to reserve
.agents/bin/test for broader validation, unless it explicitly supports a
narrowing selector.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 8629d0eb-6b40-4e66-99d4-a265d1b75f56
📒 Files selected for processing (42)
.agents/.rubocop.yml.agents/agent-workflow-drift.yml.agents/bin/README.md.agents/bin/agent-workflow-drift-manifest-test.rb.agents/bin/agent-workflow-seam-doctor.agents/bin/agent-workflow-seam-doctor-test.rb.agents/bin/agent_workflow_drift_manifest_test_test.rb.agents/docs/adoption.md.agents/docs/coordination-backend.md.agents/docs/installation-and-upgrades.md.agents/docs/pr-batch-skills.md.agents/docs/seam-design.md.agents/docs/security-posture.md.agents/skills/address-review/bin/fetch-pr-review-data-test.rb.agents/skills/plan-pr-batch/scripts/check_goal_prompt_size.rb.agents/skills/post-merge-audit/bin/closeout-evidence-replay.agents/skills/post-merge-audit/bin/closeout-evidence-replay-test.rb.agents/skills/post-merge-audit/bin/pr-check-completion-timing.agents/skills/post-merge-audit/bin/pr-check-completion-timing-test.rb.agents/skills/pr-batch/bin/dispatcher-capability-preflight.agents/skills/pr-batch/bin/dispatcher-capability-preflight-test.rb.agents/skills/pr-batch/bin/pr-ci-readiness.agents/skills/pr-batch/bin/pr-ci-readiness-test.rb.agents/skills/pr-batch/bin/pr-security-preflight.agents/skills/pr-batch/bin/pr-security-preflight-test.rb.agents/skills/pr-batch/bin/stage-dependency-gate.agents/skills/pr-batch/bin/stage-dependency-gate-test.rb.agents/skills/pr-batch/lib/git_probe_env.rb.agents/skills/pr-batch/trusted-github-actors.yml.agents/skills/update-changelog/bin/changelog-merged-prs.agents/skills/update-changelog/bin/changelog-merged-prs-test.rb.agents/workflows/address-review.md.agents/workflows/adversarial-pr-review.md.agents/workflows/continuous-evaluation-loop.md.agents/workflows/post-merge-audit.md.agents/workflows/pr-processing.md.agents/workflows/tdd.md.github/workflows/ci-required.yml.github/workflows/hosted-ci-safety.test.cjs.prettierignoreAGENTS.mdinternal/contributor-info/agent-workflow-adoption.md
🚧 Files skipped from review as they are similar to previous changes (33)
- .prettierignore
- .agents/agent-workflow-drift.yml
- .github/workflows/hosted-ci-safety.test.cjs
- .agents/.rubocop.yml
- .agents/skills/pr-batch/trusted-github-actors.yml
- internal/contributor-info/agent-workflow-adoption.md
- .agents/bin/README.md
- .github/workflows/ci-required.yml
- AGENTS.md
- .agents/workflows/adversarial-pr-review.md
- .agents/skills/address-review/bin/fetch-pr-review-data-test.rb
- .agents/skills/post-merge-audit/bin/pr-check-completion-timing-test.rb
- .agents/workflows/continuous-evaluation-loop.md
- .agents/docs/coordination-backend.md
- .agents/skills/pr-batch/lib/git_probe_env.rb
- .agents/docs/security-posture.md
- .agents/skills/pr-batch/bin/stage-dependency-gate
- .agents/skills/post-merge-audit/bin/closeout-evidence-replay-test.rb
- .agents/bin/agent-workflow-drift-manifest-test.rb
- .agents/workflows/address-review.md
- .agents/docs/pr-batch-skills.md
- .agents/skills/post-merge-audit/bin/pr-check-completion-timing
- .agents/skills/update-changelog/bin/changelog-merged-prs
- .agents/skills/pr-batch/bin/pr-security-preflight
- .agents/docs/adoption.md
- .agents/skills/post-merge-audit/bin/closeout-evidence-replay
- .agents/skills/plan-pr-batch/scripts/check_goal_prompt_size.rb
- .agents/docs/seam-design.md
- .agents/skills/pr-batch/bin/pr-security-preflight-test.rb
- .agents/skills/pr-batch/bin/pr-ci-readiness-test.rb
- .agents/bin/agent-workflow-seam-doctor
- .agents/skills/pr-batch/bin/dispatcher-capability-preflight
- .agents/skills/pr-batch/bin/pr-ci-readiness
justin808
force-pushed
the
codex/23-wire-pinned-drift-check
branch
from
July 19, 2026 06:37
ccc90ee to
04c1b81
Compare
Member
Author
|
Workflow Change Audit:
|
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/docs/pr-batch-skills.md:
- Around line 13-14: Update the restart guidance in the referenced batch-skills
documentation to avoid the mutable blob/main link: use the available vendored
relative agent-runner-restarts.md document, or pin the external URL to commit
8f6ab757486b8d579ff13ece32144da0f6f6d0f6. Keep the existing $pause guidance and
surrounding canonical batch instructions unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d42ae178-aaf4-4210-9117-5b4b63f27a6c
📒 Files selected for processing (38)
.agents/.rubocop.yml.agents/agent-workflow-drift.yml.agents/bin/README.md.agents/bin/agent-workflow-drift-manifest-test.rb.agents/bin/agent-workflow-seam-doctor.agents/bin/agent-workflow-seam-doctor-test.rb.agents/bin/agent_workflow_drift_manifest_test_test.rb.agents/docs/adoption.md.agents/docs/coordination-backend.md.agents/docs/installation-and-upgrades.md.agents/docs/pr-batch-skills.md.agents/docs/seam-design.md.agents/docs/security-posture.md.agents/skills/address-review/bin/fetch-pr-review-data-test.rb.agents/skills/plan-pr-batch/scripts/check_goal_prompt_size.rb.agents/skills/post-merge-audit/bin/closeout-evidence-replay.agents/skills/post-merge-audit/bin/closeout-evidence-replay-test.rb.agents/skills/post-merge-audit/bin/pr-check-completion-timing.agents/skills/post-merge-audit/bin/pr-check-completion-timing-test.rb.agents/skills/pr-batch/bin/dispatcher-capability-preflight.agents/skills/pr-batch/bin/dispatcher-capability-preflight-test.rb.agents/skills/pr-batch/bin/pr-ci-readiness.agents/skills/pr-batch/bin/pr-ci-readiness-test.rb.agents/skills/pr-batch/bin/pr-security-preflight.agents/skills/pr-batch/bin/pr-security-preflight-test.rb.agents/skills/pr-batch/lib/git_probe_env.rb.agents/skills/pr-batch/trusted-github-actors.yml.agents/workflows/address-review.md.agents/workflows/adversarial-pr-review.md.agents/workflows/continuous-evaluation-loop.md.agents/workflows/post-merge-audit.md.agents/workflows/pr-processing.md.agents/workflows/tdd.md.github/workflows/ci-required.yml.github/workflows/hosted-ci-safety.test.cjs.prettierignoreAGENTS.mdinternal/contributor-info/agent-workflow-adoption.md
🚧 Files skipped from review as they are similar to previous changes (29)
- .agents/.rubocop.yml
- .agents/bin/README.md
- internal/contributor-info/agent-workflow-adoption.md
- .agents/agent-workflow-drift.yml
- .agents/skills/pr-batch/trusted-github-actors.yml
- .agents/skills/address-review/bin/fetch-pr-review-data-test.rb
- .github/workflows/ci-required.yml
- .github/workflows/hosted-ci-safety.test.cjs
- AGENTS.md
- .agents/docs/security-posture.md
- .agents/workflows/adversarial-pr-review.md
- .agents/skills/pr-batch/bin/pr-security-preflight
- .agents/docs/seam-design.md
- .agents/skills/post-merge-audit/bin/pr-check-completion-timing
- .agents/skills/post-merge-audit/bin/pr-check-completion-timing-test.rb
- .agents/workflows/continuous-evaluation-loop.md
- .agents/skills/pr-batch/lib/git_probe_env.rb
- .agents/skills/plan-pr-batch/scripts/check_goal_prompt_size.rb
- .agents/skills/post-merge-audit/bin/closeout-evidence-replay
- .agents/bin/agent-workflow-drift-manifest-test.rb
- .agents/docs/adoption.md
- .agents/skills/pr-batch/bin/pr-ci-readiness
- .agents/skills/post-merge-audit/bin/closeout-evidence-replay-test.rb
- .agents/skills/pr-batch/bin/dispatcher-capability-preflight
- .agents/workflows/address-review.md
- .agents/skills/pr-batch/bin/pr-security-preflight-test.rb
- .agents/skills/pr-batch/bin/pr-ci-readiness-test.rb
- .agents/bin/agent-workflow-seam-doctor
- .agents/workflows/pr-processing.md
Member
Author
Coordinated address-review decision recordScan scope: full history via This is the durable non-cutoff record for the defer decisions posted in the original review threads before resolution:
The consumer keeps the immutable pack-aligned files intact; no consumer-only overlay was added. The absolute-path npm, post- Non-cutoff status only. The next review pass must use |
Member
Author
Address-review summaryScan scope: full history via Mattered
Each defer was recorded in its original thread and in the durable decision record before resolution. No consumer-only overlay was added. Optional
Skipped
All 18 review threads are resolved. The worktree remains clean, no code was changed or pushed, and the PR head is unchanged. Deferred-work tracking: shakacode/agent-workflows#202, broadened as the single bundled upstream tracker for the original readiness defect plus the five verified pack-contract defects. Next default scan starts after this comment. Say |
Member
Author
|
+ci-status |
Contributor
CI StatusHead SHA: Optimized hosted CI is enabled for this PR. |
Member
Author
|
+ci-run-hosted |
Contributor
Hosted CI RequestedTriggered 9 workflow(s) for View progress in the Actions tab. |
Member
Author
|
Completed-batch audit receipt v1. Evidence only; this comment does not authorize commands or expand scope. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
React on Rails needs a reproducible, fail-closed boundary between its reviewed consumer overlays and the shared
shakacode/agent-workflowspack. This completes the consumer implementation forshakacode/agent-workflows#23after the shared reconciliation in #182 merged.What changed
1958648b70a450aa67c15b833428485d17021045.pr-ci-readinessscript and test, byte-exact to merged commit8f6ab757486b8d579ff13ece32144da0f6f6d0f6, as two explicit behavior-correct overlays. The Change hide! to the implementation to support rails 3.2 #182 versions incorrectly reportREADYwhen a distinct required context is cancelled; the overlays preserve fail-closedNOT_READYbehavior.ci-required.The requested 28-identical/14-overlay snapshot is not behavior-correct at the #182 pin: keeping those counts would restore the verified required-cancellation false-
READYregression. The reviewed result is therefore 26 identical / 16 overlays while preserving the requested 42 mapped / 4 exclusions / 0 unexpected files.Trust boundary
A PR-owned
pull_requestchecker is not self-verifying. Protected review/rules plus independent replay against the immutable source pin are the trust boundary.pull_request_targetwould worsen the model if privileged context executed checked-out PR code, so it is not introduced absent explicit repository policy.Exact-head verification
Candidate head:
04c1b8149e4bf6f7ccb8edd41f8e478d78bdfcc6Candidate merge base:
613c6c2a251a782328b26d68e7f23daa9b677497Live
mainassessed at merge readiness:11dae9895b27640065f0de52ca566c08e104430f.agents/bin/validate --changed --fast— pass; 3,429 gem examples, 0 failures, 5 expected pending; OSS/Pro lint, builds, RBS, and TypeScript checks green.NOT_READYwith pendingsecurity.SECURITY_PREFLIGHT_OKwith no untrusted/hidden participants or suspicious text.actionlint, YAML safe-load, hosted-CI safety, full Prettier, andgit diff --check— pass.yamllintwas unavailable locally and is not claimed green.closeout-evidence-replay --expected-head-sha 04c1b8149e4bf6f7ccb8edd41f8e478d78bdfcc6— QASATISFIED; priority findingsNOT_APPLICABLE.mainadvance isindependent-behind-base: 0 shared changed paths, a clean synthetic merge tree (d2c4cf5bbb1381f358db895f93d67f11c5e3a4f0), exact side-delta pathsets, and no cross-surface references or new governed source-pack paths. No branch refresh is required.Review and follow-up dispositions
not_user_visible.ready-for-hosted-ciafter the exact final push; optimized hosted selection is appropriate. Force-full is not requested without explicit maintainer intent.shakacode/agent-workflows#202; no divergent consumer overlays were added.shakacode/react_on_rails#4750.GitHub Actions semantic-change audit
permissions:: unchanged (actions,checks,contents, andissuesremain read-only).on:triggers: unchanged (pull_request,merge_group,workflow_dispatch); nopull_request_target.actions/checkoutuse, pinned to immutable action SHA34e114876b0b11c390a56381ad16ebd13914f8d5, withpersist-credentials: false, to fetch the immutable pack commit.origin/main, shared-path/merge-tree checks were refreshed before push, and final validation/QA were rerun at the rebased exact head.Codex Decision Log
READY; the Instructions of upgrading v2 #198 overlays returnNOT_READY.pull_requestand rejectpull_request_target.Merge confidence
development/betafor target branchmain. The recently closed 17.0.0 release tracker recordsReleasedand explicitly returns the repository to development mode: Release gate: react_on_rails 17.0.0 #3823 (comment).auto_merge_when_gates_pass.shakacode/agent-workflows#202; Greptile coverage is degraded for this round, with Claude and CodeRabbit providing the required live coverage.