Repository navigation
Description
Outcome
Reproduce the top-of-PR and scrolled-activity states R1/R2 in #319 with real PR information, safe Markdown, a truthful checks/stack sidebar and usable preview links. The page must remain useful when some information is missing, stale or inaccessible.
Parent: #319. Blocked by accepted artifacts: #321's account/revision-scoped read service and #322's workspace host; #320 supplies the reference/state contract. CR-5 can proceed in parallel. Produces overview/context selection for CR-6 and the action placement consumed by CR-7. This issue does not publish comments, request reviews or merge.
Context / entry points
Refresh current main, open PRs and AGENTS.md; audit baseline is cb33db5df00e235f68d36b5fac556dc30e0851f2. Use #320's exact source map and #322's accepted component interfaces. Reuse the existing safe Markdown implementation described in docs/status.md and #277, and existing menu/error components. Do not wait for all of #277 to close if its required renderer contract is already accepted.
Proposed files if no suitable equivalent exists: apps/desktop/src/renderer/components/code-review/PrOverview.tsx, PrActivity.tsx, PrSidebar.tsx, plus apps/desktop/e2e/code-review-overview.spec.ts. Keep shared read models in the #320 contract. These new paths are proposals.
Items to do
- Add failing tests for R1/R2: title/status/author/branch metadata, description, changes totals, activity timeline, reviewers, checks and preview information. Include empty, partial and unavailable variants rather than hard-coded happy-path rows.
- Render PR descriptions/comments with the existing safe Markdown path. Keep raw HTML inert; validate links and use the existing remote-image/privacy policy. PR text, SVG, filenames and bot comments must not execute scripts, acquire IPC access or silently load arbitrary remote resources.
- Build a paginated activity timeline with stable event IDs, explicit source/type and deterministic ordering. Distinguish commits, issue comments and submitted reviews; avoid double-counting a review appearing in multiple collections. Preserve the reader's position during refresh and expose remaining/failed pages.
- Match the compact right sidebar and expandable check rows. Show pending/failed/cancelled/neutral/skipped/unknown states and the revision/freshness of their evidence. Only describe a collection as empty when the read is complete; do not infer merge permission from the number of green checks.
- Render a numbered PR stack only from an accepted, documented relationship source. Distinguish explicit stack metadata from an inferred branch relationship; label inference and uncertainty. Do not infer dependencies from adjacent issue numbers or PR prose. Handle missing/inaccessible members, branching and cycles without inventing an order. No stack rebasing or mutation in this slice.
- Show deployment previews with provenance: a provider deployment/check result is different from a URL found in a comment. Mark comment-derived information accordingly. Validate external destinations and open them only on user action using the existing safe external-navigation path. Do not embed a privileged preview or add a new Vercel account integration solely to match the image.
- Place the activity comment composer and header edit/reviewer controls behind the capabilities/actions supplied later by CR-7. Keep the PR-question composer owned by CR-6. Specify explicit props/callbacks instead of duplicating draft stores or inventing successful submissions.
- Match the measured text width, whitespace, card density and floating-composer clearance. Preserve independent scrolling and focus on refresh. Include accessible check text, timeline headings and keyboard-operable expanders.
Acceptance criteria
- AC1: R1 and R2 are reached by selecting and scrolling the same PR; metadata and activity use the real read adapter or clearly identified deterministic fixtures.
- AC2: pagination/refresh produces no duplicate activity, lost scroll position or cross-PR response bleed. Partial data never becomes a misleading zero count.
- AC3: stale/unknown checks, inferred stack links and comment-derived deployment previews remain visibly distinct from authoritative current evidence.
- AC4: hostile Markdown/HTML, unsafe URL schemes and misleading preview links cannot execute content, access credentials or trigger navigation without user action.
- AC5: long titles, large descriptions and narrow windows remain readable; the composer does not cover the final activity item or keyboard focus.
- AC6: all visible write controls are either connected to a verified CR-7 capability or explicitly unavailable. This PR performs no GitHub mutations.
Validation / handoff
Add adapter/model tests for timeline deduplication and relationship ambiguity; exercise the actual Electron renderer with Playwright for R1/R2 and malicious-content fixtures. Run pnpm build && pnpm test and pnpm test:e2e. Record exact SHA, commands, reviewed screenshots, source/completeness labels and remaining authenticated/manual gates in docs/reviews/ and docs/status.md. Do not publish real private PR content in fixtures or evidence. Sources: #319, Electron security, GitHub REST practices.
Long-running goal prompt
Implement CR-4 for #319 in TypeSafeAI/modex after reading the live parent, #320/#321/#322 artifacts, current source and scoped AGENTS.md. Verify worktree ownership and current main. Reconstruct R1/R2 through the existing workspace using real read models and the existing safe Markdown renderer. Start with failing tests for timeline pagination, stale checks, ambiguous stack relationships and unsafe preview links. Keep every claim tied to its source/revision; missing data is not zero and inferred relationships are not authoritative. Reuse existing components, preserve scroll/focus and match approved geometry with synthetic content. Do not create another Markdown parser, draft store, Vercel integration or write service. Do not publish, review, merge or run foreign PR code. Implement small tested slices, visually inspect normal/narrow/error states, and checkpoint full SHA, files, exact test results, evidence and one next action. Finish with a signed reviewable PR and explicit limits; stop on missing authority or an unresolved producer contract, not on unrelated issue closure.
Follow-up / resume prompt
Resume CR-4 from current issue discussions, accepted producer artifacts and the actual owned-worktree diff. Rerun the overview/activity smoke test before trusting prior progress. Select one remaining acceptance item; inspect source provenance, pagination and revision state before changing presentation. Preserve other agents' workspace and draft/action ownership. Never replace unknown data with screenshot values or refresh goldens without review. Record what is verified by fixtures versus authenticated GitHub, remaining manual gates and the next action. Do not merge or publish anything.
Independent review prompt
Review R1/R2 with complete, partial, stale and hostile input. Check that stack ordering and deployment status have honest provenance, that checks do not imply merge permission, and that pagination preserves event identity and scroll position. Verify raw content stays inert and every unavailable write control says so. Compare actual rendered evidence to the approved references and report acceptance-specific findings.
Activity
BunsDev commentedon Oct 20, 2026
The CR-1 contract is on
mainas43d5b9c(#334). Bind to these files at that commit:apps/desktop/src/shared/code-review.ts(the contract)apps/desktop/test/fixtures/code-review.ts(synthetic fixtures)docs/design/code-review.md(source map, references, inventory, open decisions)For CR-4:
summarizeChecksgives the verdict. Pending is never passing, and only the newest run counts.PrOverview,PrActivityandPrStacktypes are in the contract.Coven-Harness: Claude Code / claude-opus-5-5
mariscate commentedon Oct 22, 2026
Refreshed goal prompts — 2026-10-22 (
mainat0e674e7)Where it stands: not started; this is next in Gate A, alongside #324. Everything it needs is on
main:overview,activity(cursor),checks(revision) andstackoperations inapps/desktop/src/shared/code-review.ts, served bysrc/main/engine/code-review/read-service.ts.summarizeChecks, thePrActivityunion (commit, opened, comment, review, event, deployment) andPrSummary.stackHint.FAULTS.renderer/code-review/PrPane.tsx.renderer/components/Markdown.tsx.Long-running goal prompt
Follow-up / resume prompt
Add the CR-8 acceptance matrix, Electron journeys and cross-slice reg…
BunsDev commentedon Oct 23, 2026
Refreshed goal prompts — 2026-10-23 (
mainat203a350)On
mainalready:renderer/code-review/PrPane.tsx.The overview itself has not landed.
In review: #393 (
cr4-overview, head52375d4, base68860a0; the implementation is in signed commit485391a).What #393 adds:
summarizeChecks;Evidence (
2026-10-23-cr4-overview.md):pnpm build && pnpm test: 2,020 passed, 16 skipped. One earlier rerun failed six terminal-cleanup cases; they pass on their own, and the cause is not identified.pnpm test:e2e: 400 desktop passed, 7 skipped.Still open:
CR-5's unpushed
cr5-remote-diffsbranch also changesPrPane.tsx,CodeReviewView.tsxandcode-review.css. Whichever lands second mergesmain.Long-running goal prompt
Follow-up / resume prompt
test(code-review): measure composer clearance beside the inline Ask s…