feat(agent,daemon): unified agent tuning, fork reconciliation, and multi-provider SCM - #6
Open
KooshaPari wants to merge 121 commits into
Open
feat(agent,daemon): unified agent tuning, fork reconciliation, and multi-provider SCM#6KooshaPari wants to merge 121 commits into
KooshaPari wants to merge 121 commits into
Conversation
…uid#626) * feat(daemon): bound run event subscriptions without losing state A bounded subscriber queue cannot guarantee delivery of every payload without either blocking the executor or growing without limit, so the old drop-newest policy silently discarded lifecycle transitions and left consumers rendering state the daemon had already left behind. Stop trying to conserve payloads and conserve effects instead. Every state event is reconstructable from get_run, so the stream only has to carry the fact that state changed: - internal/ipc/events.go owns the taxonomy (activity is droppable, state is not, control is broker-generated, unknown fails safe to state), so the daemon's overflow policy and each consumer's reconciliation policy cannot drift apart. - internal/daemon/eventmailbox.go owns overflow: a per-subscriber ring bounded at 64 events and 1 MiB, non-blocking publish, activity as the only evictable class, and everything else folded into one sticky coalescing stream_gap that drains ahead of queued payload. A reserved slot fails at the second simultaneous transition; a coalescing scalar absorbs any number. The queue is a ring under a mutex because a producer-side channel receive races the reader for the same slot. - Every state event and every get_run snapshot carries a monotonic StateRev, sampled before the database read. Consumers apply a delta only when it is newer, so deltas queued before a snapshot cannot regress state after it. - Every subscription opens gapped, so attach and reconnect always reconcile first. AXI needed one function: it already treats payloads as wakeup hints and reads authority from get_run. The TUI gains the revision guard, authoritative snapshot application, coalesced gap-triggered reconciliation, and bounded resubscribe on stream loss, replacing a path that froze the live view on any dropped connection. The fix-review working-tree diff moves off the stream to get_step_diff. It was the only unbounded payload, and one frame past the 1 MiB transport line limit ends the subscription and hides every later event, including the run's terminal frame. * no-mistakes(review): Fix event-stream reconciliation and approval-state persistence * no-mistakes(review): Close residual reconciliation and approval-state gaps * no-mistakes(review): Add manual retry for review evidence failures * no-mistakes(review): Preserve concurrent review retries and disclose recovery * no-mistakes(review): Gate responses and retire stale diff requests * no-mistakes(document): Document bounded event-stream recovery behavior * no-mistakes: apply CI fixes
…guid#628) * fix(ci): require trusted no_ci evidence for empty checks Stop treating an unproven empty forge check list as checks-passed. Ready now requires observed all-green checks, or trusted default-branch no_ci: true with zero registered checks. Feature branches cannot self-declare; delayed registration, pending, and failing checks stay not-ready even on declared no-CI repos. AXI help names the declaration when that path applies. * no-mistakes(review): Persist CI provenance and fail closed on unresolved checks * no-mistakes(review): Restore cimonitor-owned CI readiness event flow * no-mistakes(review): Guarantee CI readiness events through saturated subscriber buffers * no-mistakes(review): Integrated PR 626 mailbox and removed blind eviction * no-mistakes(review): Classify diff reads and reset stale TUI gate state * no-mistakes(review): Compare authoritative snapshots against prior gate findings * no-mistakes(review): Retry stale TUI snapshots through single-flight reconciliation * no-mistakes(document): Document no-CI readiness semantics * no-mistakes: apply agent fixes * no-mistakes: apply CI fixes
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…nguid#631) * fix(branchsync): release ownership after a pre-push abort with an unchanged head A run cancelled through the supported abort before the pipeline changed the submitted head (for example when delivery switches to a direct PR mid-validation) was invisible to branch-sync run selection: axi status and the home view omitted the branch_sync object entirely, and axi sync --check refused with wrong-branch ambiguity, leaving the worker no supported answer about branch ownership. Cancellation releases ownership. A terminal never-pushed run whose head_sha still equals submitted_head_sha now stays selectable and classifies as the new user_owned branch-sync state: public structured status identifies the run and reports the exact branch, local head, submitted and current pipeline heads, and relation as user-owned and immediately usable, with no next_action. Check and sync treat it as a non-blocking no-op, --recover on a released branch is an idempotent no-op that mutates no file, ref, or database row, a repeated abort is an idempotent no-op returning the same final ownership truth, and nothing blocks a separately authorized direct push or PR. Only a terminal run with unpublished pipeline commits (moved head) keeps the guarded adopt-versus-keep-local custody recovery, unchanged, including every refusal cell. An active run on an unmoved head now reports plain pipeline custody (continue_active_run) instead of the misleading legacy_unbound, abort attaches the final structured ownership state after waiting for the terminal transition, and pipeline-owned classifications now expose the local-vs-run head relation whenever it is computable locally. * no-mistakes(review): Preserve cancelled pipeline commits before releasing custody * no-mistakes(review): Make terminal custody release evidence atomic and fail-safe * no-mistakes(review): Stamp verified head in CLI abort fixture * no-mistakes(review): Verify heads on every successful terminal path * no-mistakes(document): Document released branch custody semantics * no-mistakes: apply CI fixes * fix(cli): report abort success only after confirmed terminal quiescence Both abort surfaces could claim a completed cancellation before the run actually reached a terminal state: the branch-scoped abort ignored the result of its bounded terminal wait and printed aborted: true regardless, and the explicit --run cancellation never waited at all. A delayed terminalization or a failed status read could therefore present final ownership guidance for a run that was still active. waitForTerminalRun now reports positive confirmation with the last observed run state and a precise reason when confirmation was not reached. Both abort surfaces report aborted: true, the terminal run_status, and any ownership guidance only after that positive confirmation; otherwise they exit nonzero, state explicitly that cancellation was requested but terminal quiescence is unconfirmed, include the last structured run state when one is available, and present no released or recoverable ownership claim. The no-op paths for an already-quiescent branch or id are unchanged, and repeated abort stays idempotent. Public CLI regressions drive both surfaces against a scripted daemon that delays terminalization past the bounded wait, fails the status read, and confirms the terminal path still reports completion. * no-mistakes(review): Bound abort status reads by quiescence deadline * no-mistakes(document): Document confirmed abort before restart * fix(cli): resolve durable terminal truth for explicit-run abort A cancel_run result of no-active-run was treated as a successful no-op by itself, so axi abort --run for a known already-terminal run returned no terminal truth, a daemon-state inconsistency where the run record is still nonterminal was reported as success, and the daemon-unavailable early path claimed no active run for any id without evidence. The no-active result is now resolved against the exact run's durable state. With the daemon up, one bounded cancellation-aware get_run read decides: an already-terminal run returns an idempotent success carrying its terminal run_status with no fabricated new cancellation, the daemon's explicit run-not-found lookup is the only proof that preserves the documented unknown-id no-op, and a still-nonterminal or unreadable run returns the nonzero terminal-unconfirmed contract. With the daemon down, nothing can be cancelled and abort never starts one: the durable run record alone decides the same three outcomes, and a recorded nonterminal run reports that cancellation could not be requested rather than claiming it was. Public CLI regressions cover idempotent terminal-truth resolution, the inconsistent no-active-but-running case, unknown-id preservation on both paths, unreadable-record refusals, and the daemon-unavailable treatment. Branch-scoped abort, bounded reads, verified-head evidence, guarded recovery, and all refusal cells are unchanged. * no-mistakes(review): Require exact run identity for abort terminal proof * no-mistakes(document): Document durable abort terminal resolution
…kunchenguid#595) Re-run provider-cancelled, timed-out, or stale CI checks once before escalating, so the gate does not spend a fix-agent round on infrastructure noise. Default off (rerun budget 0), trusted-only opt-in, durable per-run reservation before the provider call, and cancelled/unknown checks never read green.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix(pipeline): review turns never resume the session that prescribed their fixes A rereview certifies fix-round code that implements the previous review turn's findings. Resuming the durable reviewer session seated the prescriber as certifier, so the rereview verified that its own prescription was implemented instead of independently judging the pipeline-authored code: one fix round shipped a correctness defect plus the test blessing it, and the resumed session passed both with zero findings. Review turns (initial and every rereview) now run session-free; only the fixer keeps a durable session, since it certifies nothing. Cross-round review context travels solely in the explicit sanitized round history, and the rereview prompt reframes fix-round changes as pipeline-authored code under the same adversarial standard as the author's changes: prior findings, fix summaries, and same-round tests are claims, not evidence. SessionRoleReviewer remains only so crash recovery accepts legacy persisted rows, which are never resumed. * no-mistakes(review): Allow recovery past legacy reviewer sessions * no-mistakes(document): Correct stale review-session documentation
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…#637) * fix(pipeline): decide terminal cancelled CI checks instead of polling them A provider-cancelled check is terminal: the forge has already published its conclusion for that check and will not publish another one on its own. kunchenguid#628 started counting every non pass/fail/skip bucket as "pending" so an unknown or empty check state could never read green, and in doing so routed that terminal cancellation into the wait-for-more-results branch it can never leave. kunchenguid#595 built the right gate for it, but only reaches it once the run has spent a rerun on the check, and the rerun budget is 0 by default - so on a default-configured repository the CI monitor polls an already-final rollup until its whole ci_timeout elapses. Observed on firstmate PR 1495 (v1.44.2, the first release carrying kunchenguid#628): eight jobs green, one job killed by its own timeout-minutes, which GitHub reports as CANCELLED. The monitor logged "CI checks running, waiting for results..." and kept polling that unchanging rollup until the run was aborted by hand. Before kunchenguid#628 the same shape read as checks-passed - wrong, but it ended. A cancelled check with no rerun outstanding now reaches the same ask-user gate as one that came back cancelled after its rerun, and each finding says which of the two it is. Checks that can still finish on their own still keep the monitor waiting, and an unrecognized bucket is deliberately left on the wait-then-timeout path: unknown is not evidence of terminal. * test(e2e): stop timing the init-rollback guard against machine speed TestInitRollsBackWhenDaemonStartFails measures a whole CLI subprocess - spawn, git work, opening the database, and the rollback - and failed the run whenever that took a second. What it is guarding is that init honored the injected 200ms daemon start timeout rather than falling back to the 45s production budget, and a second of slack does not distinguish those; it only distinguishes a loaded machine. It flaked at 1.21s inside the parallel e2e suite while passing in isolation. Widen the bound to 10s and say what it is for. A run that actually fell back to the production budget still fails it by a wide margin. * no-mistakes(document): Clarify cancelled-check approval and rerun behavior
* fix(update): authenticate GitHub release fetch with env token no-mistakes update fetched releases anonymously and failed with a 403 once the shared IP's anonymous GitHub rate limit was exhausted. Read GITHUB_TOKEN then GH_TOKEN from the environment and send it as the Authorization: Bearer header on release-list and asset-download requests, falling back to anonymous when no token is set. * no-mistakes(document): document updater GitHub token authentication * no-mistakes: apply CI fixes
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* perf(ci): keep the Windows test job well inside its timeout The windows-latest test job repeatedly overran timeout-minutes and was cancelled (twice on PR kunchenguid#636). It is not a hang: no test exceeds ~32s, the per-binary `go test -timeout=15m` never fired, and every package that completed reported a normal duration. The job is process-spawn bound. Git-backed packages cost roughly 10x their Linux time on the Windows runner (internal/git 5.7s -> 53s, internal/branchsync 31s -> 415s) because Defender scans every git.exe spawn and every file the temp repos create, and internal/branchsync ran all 52 tests serially, making it the job's 7-minute wall floor. Observed windows job runtimes over 20 recent runs: 10.7-25.3m against a 25m cap, median ~14m. Excludes the ephemeral build and test trees this job creates from Defender scanning, and takes internal/branchsync off the serial critical path with t.Parallel. Locally the package drops from 49.5s to 19.5s with -race clean over repeated runs; no coverage is skipped or weakened. * no-mistakes(review): Harden Windows workflow contract tests * no-mistakes(document): Windows CI documentation already accurate * no-mistakes: apply CI fixes
…#647) * fix(ci): retire a rerun record once the provider answers it A CI check the provider cancelled earns a deterministic rerun, and the step records that rerun in `checkRerunBudget.rollup` so a later poll can tell a rollup that has not refreshed yet from a rerun that came back cancelled again. Nothing ever retired that record, so it outlived the rerun it described. `cancelledAfterRerun` treats every name still in the rollup as a rerun awaiting publication, so any later poll where that name is absent from the check list is attributed to a rerun that was already answered. The bounded rollup grace then runs out and the check latches as "cancelled again after its rerun" for the rest of the run. From then on the CI step reports an issue on every poll: readiness is cleared, the run either parks on a cancellation the provider already replaced or keeps cycling in the fixing state, and a head whose every reported check is green can never reach checks-passed. The trigger is a cancelled job plus a rerun that succeeds on that head; the masking condition is the leftover rerun record; the symptom is a run stuck fixing until the CI idle timeout. Confirmed against a control with the identical check sequence and no cancellation, which stays ready throughout. `retireResolvedReruns` drops the record on the first poll that publishes a conclusive bucket for that check name, and persists the change so a recovered run does not resurrect it. Retirement needs positive evidence: pending, cancelled, and unrecognized buckets stay tracked, so the transitional-gap protection still covers a rerun the provider has not published, and a same-named check still outstanding blocks retirement. It removes only this run's claim that a rerun is outstanding, never a check's own bucket, so no cancelled, failing, or pending check can be promoted to green by it, and the spent budget is left intact so a later cancellation cannot earn more reruns than `ci.rerun_transient` allows. * no-mistakes(review): Harden rerun retirement against cancelled and same-name checks * no-mistakes(review): Persist provider identities for safe rerun retirement * no-mistakes(review): Persist rerun retirement before committing live state * no-mistakes(review): Scope rerun retirement to advancing pipeline heads * no-mistakes(review): Restore safe same-head rerun retirement * no-mistakes(document): Document resolved CI rerun transitions
…nguid#649) * fix(branchsync): auto-recover custody for a rebase-superset preserved head A cancelled validation whose default branch advanced leaves the preserved pipeline head as a rebase of the operator's branch: the same logical commits under different SHAs. Recovery's decision matrix tested only equality and ancestry, so that shape fell through to the diverged refusal and escalated a custody return where nothing could be lost. A clean diverged worktree is now adopted when preservedContainsLocalWork proves the preserved head carries every local change, by either sufficient proof: each local commit replayed patch-identically (git rev-list --cherry-mark, which survives the fix rounds that supersede operator lines), or the preserved head already holding the local branch's exact content (merge-tree, anchored on the merge-base rather than runs.base_sha, which is the previous gate head). Adoption anchors the pre-recovery local head at refs/no-mistakes/recover-local/<run> before resetting. The unlanded-work protection is unchanged and deliberately fail-closed: unique local commits, a conflict-resolved replay, a squash that also rewrote operator lines, and a dirty worktree all still escalate, because only escalation can tell a deliberate pipeline fix apart from a dropped change. Reproduced end to end through the real binary in TestAxiCustodyRecoveryAfterRebaseJourney, with both directions pinned in internal/branchsync/recover_test.go. * no-mistakes(review): Harden custody recovery against duplicate patches and anchor races * no-mistakes(review): Correct recovery guidance and failed-reset reporting * no-mistakes(review): Qualify conflict-resolved custody recovery guidance * no-mistakes(review): Reject ambiguous recovery patches and close reset race * fix(branchsync): narrow custody adoption to a provable containment check Reshapes the rebase custody recovery to the narrowest contract that still fixes the reported bug, after three review rounds showed the previous containment proof was not one. Containment is now proven only by an executable three-way merge whose result is exactly the preserved head's tree. The patch-identity arm is gone: patch IDs discard hunk locations and whitespace, so they cannot tell a genuine replay from a same-shaped edit to another identical block, and a containment claim built on them is not a proof. An ordinary rebase that carries the operator's content forward intact recovers automatically; a rebase whose fix rounds also rewrote the operator's own lines now escalates, because nothing available to recovery separates a deliberate pipeline fix from a dropped change. No-data-loss outranks convenience. The branch move no longer observes branch, HEAD, and cleanliness and then runs an unconditional reset --hard. That is check-then-act, and anything landing in the gap is destroyed no matter how often it is re-observed. The two Git operations now carry the guard themselves: an atomic update-ref compare-and-swap against the observed head, so a concurrent commit refuses with nothing touched, and read-tree -m -u, which aborts rather than overwriting a modified or untracked file and is rolled back by the same compare-and-swap in reverse. Also reverts the internal/git/git.go patch-identity helper, which was scope drift outside the custody-return decision. Regression coverage: rebased auto-recover, unique local work escalates, rewritten operator lines escalate, squash-equivalent adopts, squash-drop escalates, concurrent commit refuses without losing the commit, concurrent worktree edit aborts the move and rolls the branch back, dirty refuses, keep-local unchanged. TestAxiCustodyRecoveryAfterRebaseJourney drives the whole thing through the real binary and fails before this change. * no-mistakes(review): Harden cancelled custody adoption recovery * no-mistakes(document): Document custody recovery reach limit * no-mistakes(document): Clarify diverged custody recovery guidance
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix(pipeline): restore Risk Assessment, Testing, and rich Pipeline PR sections PR kunchenguid#605 silently dropped the deterministic Risk Assessment and Testing sections (passed as literal empty strings) and swapped the rich per-step Pipeline detail for a compact, evidence-free status summary, all while leaving their composer functions unit-tested but production-dead. Rewire buildPRContent to thread riskLine, testingMD, and BuildPipelineSummary's rich per-step detail back into every PR body path, while keeping kunchenguid#605's actually-intended change: the agent-authored What Changed narrative stays scoped to the final branch diff rather than commit history. * no-mistakes(review): Restore tested commands in rich pipeline details * no-mistakes(document): Document restored deterministic PR body evidence
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…nguid#670) * feat(pipeline): attest PR step statuses * no-mistakes(review): Preserve pipeline attestations across PR body truncation * no-mistakes(review): Bind pipeline attestations to recorded head SHA * no-mistakes(document): Document pipeline step attestation contract
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* feat(evidence): publish test evidence to an orphan branch Test evidence used to be committed into the pushed branch when test.evidence.store_in_repo was enabled, so every merged PR carried its screenshots and logs into the default branch's history forever. Evidence is now always collected outside the worktree and published to a dedicated orphan branch in the same repository, with the PR body linking the artifacts by evidence commit. Same access control, binaries welcome, no external host, and nothing lands in the PR branch or main. - internal/evidence owns the mechanism: git plumbing against a scratch index, so HEAD, the index, and the worktree are untouched and a detached or shallow clone works; the parent is the freshly fetched remote tip, so the push is a plain fast-forward and never a force. - Fail-closed: an unreadable remote, a refused push, or a branch of that name without the .no-mistakes-evidence marker publishes nothing, and the PR body keeps local-path references instead of dead links. - test.evidence.branch configures the name (default no-mistakes/evidence), is validated as a git branch name at config parse time, and is trusted-only because it names a ref the daemon pushes to. * no-mistakes(review): Harden evidence ownership and artifact links * no-mistakes(document): Document GitHub orphan evidence publication limits * no-mistakes: apply CI fixes
…process group (kunchenguid#685) * fix(daemon): reap pipeline children that escape their process group A process group only contains descendants that stayed in it. Anything that calls setsid(2) or setpgid(2) - agent CLIs sandboxing their tool runners, any daemonizing worker script - leaves the group, so the teardown no-mistakes runs on cancellation and on every exit path cannot reach it. Once its parent exits it reparents to init and no lineage-based mechanism can name it again: it keeps burning CPU and holds a deleted worktree open through its cwd, indefinitely. internal/procreap is the identity-based backstop. It matches a process by the run worktree its working directory resolves under - the one identity that survives lineage loss - and deliberately never by argv, which a legitimate `git worktree remove` also carries. It never signals pid<=1, itself, or its ancestors, spares any worktree whose run is still pending or running, and escalates SIGTERM to SIGKILL only after a grace period. A process working outside ~/.no-mistakes/worktrees is out of reach by construction, so unrelated long-lived workers cannot be hit. Two call sites: run cleanup sweeps that one run's worktree with no age floor before the directory is removed, and daemon startup sweeps every inactive worktree older than ten minutes, cleaning up after a predecessor that died without tearing anything down. Windows needs neither - job objects contain the whole tree - so its platform layer reports an empty process table. shellenv's group teardown now asks before killing: survivors get SIGTERM and are SIGKILLed only if still alive after the grace period, so a test runner or worker script can flush output and clean up after itself. The cancellation path escalates out of band because cmd.Cancel runs on the goroutine that owns cmd.Wait. * no-mistakes(document): docs already accurate for process reaper change
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* feat(db): record build identity on runs * no-mistakes(document): record build identity on runs is already documented accurately
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* feat: add local review eval toolkit * no-mistakes(review): Fix eval isolation, fidelity, and reporting * no-mistakes(review): Count every queued candidate finding * no-mistakes(review): Pin replay configuration and correct confidence intervals * no-mistakes(review): Correct eval token baselines and interval labeling * no-mistakes(review): Keep eval opt-in and correct capture reporting * no-mistakes(review): Correct eval capture retry documentation * no-mistakes(review): Preserve eval provenance and confidence accuracy * no-mistakes(review): Preserve exact replay provenance and isolation * no-mistakes(review): Isolate eval provenance, ownership, and baseline metrics * no-mistakes(document): Document eval toolkit contracts * no-mistakes: apply CI fixes
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…guid#711) * feat(eval): collect review cases automatically without copying history The eval corpus never filled. Two independent gaps caused it: replay provenance was gated behind an environment variable nobody had set, and nothing ever called Capture outside the CLI, so `eval sets` reported zero cases no matter how many reviews the machine performed. Provenance is now a first-class `eval.capture_provenance` key, default on. An environment variable was the wrong home for it: the daemon's launchd unit is re-rendered on install and update and preserves only proxy variables, so collection would have stopped silently after an update. Provenance is recorded with the review round or never, so a default-off setting means every run before someone discovers it is permanently unusable. Collection itself is `eval.auto_capture`, also default on: a finished run's decided review passes become cases with no command. It runs last in the run goroutine, after the pipeline has already reported its outcome, and swallows its own panic, bounds its own time, and logs rather than propagates - the run it observes can never be affected by it. Auto-collecting the previous case format was unaffordable: each case carried a self-contained bundle of the repository's whole history, ~8 MB per review pass. Cases of one repository now share a Git object pool, so the first case stores the history once and each later case adds only the objects its own commits introduced - measured at ~8 KB. `eval.max_cases` keeps the corpus a rolling window, dropping the oldest first and never a case whose replays a report already cites. The rejection message named the round's age, which sent readers hunting for a version problem; it now names the setting that actually governs it. * no-mistakes(review): Serialize eval capture and make pruning cleanup retryable * no-mistakes(review): Protect replay cohorts and reconcile pending captures * no-mistakes(review): Release replay reservations and remove empty pools * no-mistakes(document): Document automatic eval corpus collection * no-mistakes(document): Correct eval CLI corpus help * no-mistakes: apply CI fixes
…/git/git.go by extracting --no-tags and --no-write-fetch-head into named constants gitFetchNoTags and gitFetchNoWriteHead, applied across all 4 usages in fetch-related functions. All tests pass and lint is clean
❌ The current Mergify configuration is invalidDetails
|
KooshaPari
changed the title
❌ The current Mergify configuration is invalidDetails
|
KooshaPari
changed the title
…/config/config.go. In the `reservedAgentArgs` map for `AgentPi`, the flags `"--resume"` and `"--session-id"` were added as verbatim string literals, but these same strings were already extracted as named constants `flagResume` and `flagSessionID` (defined at line 1345) and used consistently for `AgentClaude` and `AgentGrok`. Replaced the duplicate literals in `AgentPi` with the existing constants, eliminating the duplication flagged by SonarCloud's duplicate-literal rule. Build and tests pass
KooshaPari
changed the title
❌ The current Mergify configuration is invalidDetails
|
KooshaPari
changed the title
❌ The current Mergify configuration is invalidDetails
|
❌ The current Mergify configuration is invalidDetails
|
KooshaPari
changed the title
Owner
Author
|
Final reconciliation evidence at Resolved review findings:
Local verification:
Hosted verification on this exact head:
Guarded Human decision remains required: accept or separately remediate the baseline-wide Sonar policy debt, review this fork-local integration PR, and merge only if satisfied. |
❌ The current Mergify configuration is invalidDetails
|
❌ The current Mergify configuration is invalidDetails
|
❌ The current Mergify configuration is invalidDetails
|
|
Owner
Author
Final exact-head qualificationQualified commit: Local evidence
Hosted evidenceAll exact-head checks are terminal green or intentionally skipped:
Provenance noteThe local no-mistakes AXI review/provider path was exercised but unavailable (provider quota/config/CLI incompatibility and a stalled delegated run). No review state was forged and no protected-branch bypass was used. Equivalent strict local verification, independent exact-head review, and all hosted gates now pass. Pushes targeted only the KooshaPari fork branch and were non-force. Human approval remains the final gate. |
Owner
Author
Human merge-method preflightLive
Consequently a normal two-parent merge commit is policy-incompatible even though it gives the cleanest stacked ancestry. Squash would collapse the qualified 121-commit series. The least-lossy permitted method is therefore Rebase and merge, performed only after explicit human approval. Important provenance consequences:
No merge method has been invoked and no approval is inferred by this preflight. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intent
Finish fork-local no-mistakes PR #6 by retaining the semantic review fixes and removing the newly added source-content-only test that violates repository test policy, relying on existing behavioral agent-construction coverage. Update only KooshaPari/no-mistakes PR #6; do not touch upstream, force-push, rewrite history, merge, auto-approve, add binaries, or broaden scope. Preserve every earlier commit and leave final approval to the human.
What Changed
New
agentcfgpackage (internal/agentcfg): A harness-neutral normalization layer for agent model and reasoning-effort selection. It maps a unifiedProfile(model name + effort level) into the native flag/shell-message form expected by each supported harness (claude, copilot, codex, grok, pi, opencode, acpx). This replaces ad-hocagent_args_overrideusage and eliminates the eval path's divergent copy of the model rule.Fork reconciliation infrastructure: Introduced
forgecontext(internal/forgecontext) for provider profile resolution,worktrees(internal/worktrees) for run worktree placement policy,runenv/overlay(internal/runenv/overlay.go) for subprocess environment injection,safepath(internal/safepath) for home-directory redaction in PR content, andcustody/refsfor run-head recovery anchoring. Theaxi statuscommand gained branch-scoped run resolution, and the executor gained durable step-state with mid-run restart support.Forgejo and Gitea SCM providers: Full implementations added under
internal/scm/forgejo/andinternal/scm/gitea/with provider-specific API quirks documented and handled (Gitea'smergeablefield bug, Forgejo's job-level conclusion reporting, tea CLI flag surface traps).Shared PR attestation action (
.github/actions/require-no-mistakes/): A reusable composite action that verifies a PR body carries a parseable pipeline-step attestation bound to the PR head SHA, withreview/test/documentall completed. This replaces per-repository copies across the fleet. CI workflows were consolidated into a single.github/workflows/ci.ymlwith.circleci/,trunk-check.yml,scorecard.yml,infisical.yml, and.mergify.ymlremoved.Cross-run review decision propagation: The round history prompt section now surfaces human decisions from earlier runs on the same branch and from other steps in the current run, preventing a finding declined in one context from being silently re-applied by a later step or run. Findings with a recorded
user_declinedselection are flagged as advisory-only; auto-fix left-unselected findings are explicitly flagged as not-yet-decided.Risk Assessment
✅ Low: Both commits are clean: the fork reconciliation fixes correctly unify agent construction paths, propagate errors fail-closed, and add defensive validation; the source-content-only test was properly removed per policy with behavioral coverage already in place.
Testing
Confirmed that c8f4a97 removes only the source-content-only test, that behavioral agent-construction tests provide real coverage, and that all semantic fork-reconciliation fixes from 6673317 remain intact. Build and all relevant tests pass.
Pipeline
Updates from git push no-mistakes
✅ **intent** - passed
✅ No issues found.
✅ **Rebase** - passed
✅ No issues found.
✅ **Review** - passed
✅ No issues found.
✅ **Test** - passed
✅ No issues found.
go test -v -run TestNewPipelineAgent|TestNewWithOptions ./internal/daemon/... ./internal/agent/... (17 behavioral agent-construction tests)go test ./internal/forgecontext/... ./internal/worktrees/... (fork reconciliation coverage)go test -v -run TestRun|TestRecover|TestPipelineAgent|TestManager ./internal/daemon/... (recovery and run management tests)go build -o ./bin/no-mistakes ./cmd/no-mistakes (build verification)✅ **Document** - passed
✅ No issues found.
✅ **Lint** - passed
✅ No issues found.
✅ **Push** - passed
✅ No issues found.