ci: harden trusted PR review evidence (#1896)
This commit is contained in:
Carlos Florêncio
@@ -1,5 +1,5 @@
|
||||
---
|
||||
description: Provide a frontier-model second opinion on unusually risky Kandev architecture and planning; the primary planner owns normal specs and plans.
|
||||
description: User-requested independent frontier second opinion; planner owns normal architecture, specs, and plans.
|
||||
mode: subagent
|
||||
temperature: 0.1
|
||||
permission:
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
description: Review changed Kandev code for correctness, security, architecture, scope, complexity, and missing tests after implementation or before PRs.
|
||||
description: Frontier-review Kandev changes with architecture, cross-cutting, high-risk, or stale/incomplete external-review risk.
|
||||
mode: subagent
|
||||
temperature: 0.1
|
||||
permission:
|
||||
|
||||
@@ -29,11 +29,32 @@ Include head SHA, GitHub mergeability/merge-state status, and the local unmerged
|
||||
index count from `git ls-files -u`. Use one-shot checks or bounded commands.
|
||||
Report only observed values and return one compact report block.
|
||||
|
||||
The planner may provide `selected_reviewer=<GitHub login>`. For selection,
|
||||
read raw `scripts/pr-state --trusted-reviewer "$selected_reviewer" <PR>`: only known/complete records with matching
|
||||
checks/opening/closing heads, `checks_snapshot_complete=true`, and
|
||||
`commit_id == evidence_head_sha` qualify; H1 checks with H2 reviews must retry
|
||||
or fall back. Timestamps never establish head coverage. Only `eligibility=eligible` (approved with no blocker or explicit
|
||||
`<!-- kandev-review: clean -->`) qualifies; selected `${OPENCODE_REVIEW_APP_SLUG}[bot]` must
|
||||
also have emitted `trusted_producer=true` from `scripts/pr-state --trusted-reviewer "$selected_reviewer" <PR>` on the exact-head record; only the dedicated OpenCode App requires this provenance, while other selected reviewers retain generic exact-head qualification. Generic
|
||||
marker reviews do not qualify. Ambiguous/dismissed/pending/unknown
|
||||
reviews do not. Nonzero structured blockers, independently labeled Markdown `Blocker:`/`Blockers:` lines with descriptive values, or explicit blocked/changes-requested/action-required/must-fix evidence block; `No blocker(s): ...`, `Blocker(s): 0`, and `| Blocker | 0 |` do not. Once CI is complete, exit on qualified selected evidence or an
|
||||
observed blocker (active change request, any
|
||||
`blocked_exact_current_head_review_count > 0`, `eligibility=blocked`, or
|
||||
actionable unresolved thread) without waiting for unrelated bots. Without a
|
||||
selected reviewer, use the normal configured-reviewer terminal condition.
|
||||
|
||||
Follow the exact output contract in `.agents/agents/pr-poller.md`: delimit the
|
||||
only output with `=== pr-poller report ===` and `=== end ===`, and include
|
||||
`pr`/`branch`, `head_sha`, `mergeable`, `merge_state_status`,
|
||||
`local_unmerged_entries`, `ci_failed`, `ci_passed`, `ci_pending`, every bot row,
|
||||
`unresolved_review_threads`, `issue_comments_from_bots`, `claude_summary`, and
|
||||
`recommendation`. Use `unknown` when collection fails.
|
||||
`local_unmerged_entries`, `ci_failed`, `ci_passed`, `ci_pending`, every configured-reviewer row,
|
||||
`checks_evidence`, `unresolved_review_threads`, `actionable_issue_comments_from_bots`, `claude_summary`, and
|
||||
`review_evidence`, and `recommendation`. Emit `review_evidence:` as
|
||||
`reviewer=<login|none> qualification=<qualified|blocked|unqualified|unknown>
|
||||
reviewed_head_sha=<SHA|unknown> review_state=<state|none|unknown>
|
||||
eligibility=<eligible|blocked|ineligible|unknown>
|
||||
verdict=<approved|clean|blocker|dismissed|unknown|none>
|
||||
trusted_producer=<true|false|unknown>
|
||||
active_changes_requested=<N|unknown>
|
||||
blocked_exact_current_head_reviews=<N|unknown>`. Use `unknown` when collection fails.
|
||||
|
||||
Do not spawn subagents.
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
description: Verify integrated Kandev work after implementation by tracing wiring, testing happy paths, breaking edge cases, and checking coverage/readiness.
|
||||
description: Independently verify Kandev changes with integration, public-contract, persistence, concurrency, recovery, cross-component, or missing faithful behavior evidence.
|
||||
mode: subagent
|
||||
temperature: 0.1
|
||||
permission:
|
||||
|
||||
@@ -13,4 +13,4 @@ Review recently changed files and simplify while preserving behavior. Remove one
|
||||
|
||||
Verify after meaningful simplifications. If behavior changes, revert that simplification. Report modified files, what changed, and verification.
|
||||
|
||||
Do not spawn subagents. Report required full verification to the planner.
|
||||
Do not spawn subagents. Report required change-aware verification to the planner.
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
description: Run Kandev format, typecheck, tests, and lint before commit, then report failures without fixing source or test logic.
|
||||
description: Verify committed changes before push, reusing proven hook coverage and using full mode only for broad or ambiguous impact.
|
||||
mode: subagent
|
||||
temperature: 0.1
|
||||
permission:
|
||||
@@ -9,16 +9,20 @@ permission:
|
||||
"*": ask
|
||||
---
|
||||
|
||||
Run the monorepo verification pipeline and report issues found.
|
||||
Follow `.agents/agents/verify.md`, its impact matrix, and hook-evidence
|
||||
reference. Run after commit and before push. Default to changed scope; validate
|
||||
any supplied receipt, run only uncovered commands, and report PR/scope bases,
|
||||
receipt eligibility, omissions, changed paths, commands, limits, and
|
||||
`changed-scope PASS` versus `full PASS`. Never infer hook success, and never
|
||||
rerun an eligible hook-covered command for reassurance.
|
||||
|
||||
Install `apps` dependencies when missing. Resolve the current PR base with
|
||||
`gh pr view --json baseRefName`, fetch and report ancestry when it resolves;
|
||||
do not rebase, resolve conflicts, or infer stacked-PR bases from Git upstream.
|
||||
|
||||
Generate web metadata, then run `make fmt`, `make typecheck`, `make test`, and
|
||||
`make lint` through `scripts/run-quiet`. Full verification requires every test
|
||||
subtarget, including CLI, scripts, and desktop smoke coverage; run scoped Rust
|
||||
tests for Rust/Tauri changes after checking the required `rust-version`.
|
||||
Run only uncovered matrix-selected commands. Full mode is for explicit,
|
||||
ambiguous, broad, release/toolchain, or no-PR-CI delivery; ignore hook
|
||||
omissions and cover every relevant subtarget.
|
||||
|
||||
Do not fix source or test logic. Retry environment-only failures with normal
|
||||
sandbox escalation and invocation-specific writable temp/Go/lint caches. For
|
||||
@@ -27,7 +31,7 @@ an implementer. Finish with a compact pass/fail report.
|
||||
|
||||
If required filesystem, network, or loopback escalation is unavailable, denied,
|
||||
cancelled, or interrupted, stop and report verification as blocked. Explain
|
||||
that mandatory verification is preventing commit and PR creation. Include a
|
||||
that mandatory verification is preventing push and PR delivery. Include a
|
||||
required user action telling the user to enable the runtime's full access mode,
|
||||
then retry verification. Do not offer to proceed unverified or imply that the
|
||||
agent or repository host cannot create PRs. Recommend full access only after
|
||||
|
||||
Reference in New Issue
Block a user