feat(ci): add p0-gate workflow and runbook baseline - #172
Merged
Conversation
Complete the repository-controlled portion of the active p0-conformance-gate change. Key changes: - add integration anchors for step-driven closed-loop execution and runtime-backed SQLite event-log replay/hash-chain verification - add scripts/ci/p0_gate.py as the single deterministic CI/local command entrypoint for SECURITY_REGRESSION, STEP_EXEC_REGRESSION, and AUDIT_CHAIN_REGRESSION - add unit coverage for p0-gate summary formatting and failed-node extraction - wire a new p0-gate job into .github/workflows/ci-gate.yml - add docs/guides/P0_Gate_Runbook.md covering local execution, category triage, release archive requirements, and flaky-handling rules - update branch-protection, Team Agent playbook, docs navigation, OpenSpec tasks/spec evidence, and feature evidence Rationale: The change originally lacked explicit integration anchors for the full P0 category bundle and had no single CI command or operational guidance for the gate. This commit freezes the repository-side behavior and documentation so the only remaining open task is the external repo-admin branch protection step that marks p0-gate as a required check on main. Verification: - ../../.venv/bin/python -m pytest -q tests/integration/test_security_policy_gate_flow.py tests/integration/test_p0_conformance_gate.py tests/unit/test_dare_agent_step_driven_mode.py - ../../.venv/bin/python -m pytest -q tests/unit/test_dare_agent_security_policy_gate.py tests/unit/test_dare_agent_security_boundary.py tests/unit/test_five_layer_agent.py - ../../.venv/bin/python -m pytest -q tests/unit/test_p0_gate_ci.py - ../../.venv/bin/python scripts/ci/p0_gate.py - openspec validate p0-conformance-gate --type change --strict --json --no-interactive - ./scripts/ci/check_governance_evidence_truth.sh
Update the active p0-conformance-gate feature aggregation doc with the implementation PR link and current review status. Key changes: - add PR #172 under review and merge gate links - replace the stale 'not opened yet' status with the live implementation PR state Rationale: The feature aggregation doc is the evidence source of truth for the active change. Once the implementation PR exists, the review/merge gate section must point to it so governance and reviewer workflows stay auditable. Verification: - ./scripts/ci/check_governance_evidence_truth.sh
Collaborator
Author
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c31e6c8cce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Address the PR #172 review item about missing node ids when pytest fails with ERROR summary lines. Key changes: - extend scripts/ci/p0_gate.py failure extraction so both FAILED and ERROR summary rows produce deterministic node ids - add unit coverage for ERROR-line extraction in tests/unit/test_p0_gate_ci.py - refresh the active p0-conformance-gate feature evidence to record the review fix and updated unit test count Rationale: The previous implementation only captured assertion-style FAILED lines. Collection/import/runtime failures would therefore degrade CI triage to '<no failing test ids captured>', which weakens the summary contract for blocker-grade gate handling. Verification: - ../../.venv/bin/python -m pytest -q tests/unit/test_p0_gate_ci.py - ../../.venv/bin/python scripts/ci/p0_gate.py - ./scripts/ci/check_governance_evidence_truth.sh
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 27bf193f47
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| from dataclasses import dataclass | ||
| from pathlib import Path | ||
|
|
||
| FAILED_TEST_RE = re.compile(r"^(?:FAILED|ERROR)\s+([^\s]+)") |
There was a problem hiding this comment.
extract_failed_tests currently treats any line that starts with ERROR as a failing node id, so failure output that includes captured error logs (for example ERROR root:test_file.py:4 ...) is parsed as if root:test_file.py:4 were a test id. This produces incorrect triage entries in the p0-gate summary whenever a failing test logs at ERROR level, which undermines the deterministic failure-pointer contract even though the gate pass/fail status is correct.
Useful? React with 👍 / 👎.
mindfn
added a commit
that referenced
this pull request
Mar 6, 2026
Fix the newly failing governance intent gate and the latest review comment on checkpoint defaults. Changes: - rewrite dare_framework/checkpoint/defaults.py to remove imports from deleted checkpoint._internal modules - provide in-module legacy-compatible checkpoint symbols so the defaults facade remains importable - add regression test tests/unit/test_checkpoint_defaults.py to lock importable default exports - add missing Intent PR link to docs/features/p0-conformance-gate.md so governance-intent-gate can validate merged intent metadata for active governed docs Verification: - ../../.venv/bin/python -m pytest -q tests/unit/test_checkpoint_defaults.py (passed) - GOVERNANCE_INTENT_GATE_DIFF_RANGE='origin/main...HEAD' GOVERNANCE_INTENT_GATE_PR_STATE_FIXTURE='#126=merged,#172=merged' ./scripts/ci/check_governance_intent_gate.sh (passed) - ./scripts/ci/check_governance_traceability.sh (passed) - ./scripts/ci/check_governance_evidence_truth.sh (passed) - openspec validate p0-conformance-gate --type change --strict --json --no-interactive (valid)
mindfn
added a commit
that referenced
this pull request
Mar 6, 2026
…ation Address the latest PR #188 review comment on SessionContextContributor config loss. Root cause: - SessionContextContributor.serialize() called asdict(session_context) and then attempted asdict(serialized['config']) again. - For dataclass-backed contexts, the first asdict() already converted config to dict, so the second call raised and forced config to None. Changes: - only run asdict() for config when config is non-null and not already a dict - keep existing dict config payload untouched - extend tests/unit/test_checkpoint_defaults.py with a regression test that verifies config survives serialization Verification: - ../../.venv/bin/python -m pytest -q tests/unit/test_checkpoint_defaults.py (2 passed) - GOVERNANCE_INTENT_GATE_DIFF_RANGE='origin/main...HEAD' GOVERNANCE_INTENT_GATE_PR_STATE_FIXTURE='#126=merged,#172=merged' ./scripts/ci/check_governance_intent_gate.sh (passed) - ./scripts/ci/check_governance_traceability.sh (passed) - ./scripts/ci/check_governance_evidence_truth.sh (passed)
mindfn
added a commit
that referenced
this pull request
Mar 6, 2026
Address the latest review comment on selector-overlap coverage in scripts/ci/check_test_failure_ownership.py. Root cause: - overlap detection only tokenized selectors by - directory selectors like were treated as unrelated to descendant node selectors such as - this allowed cross-category ownership overlap to bypass validation Changes: - normalize selectors into path parts + pytest node parts - treat file_or_dir path prefix matches as overlapping when the prefix side has no node suffix - keep existing node-level overlap and parametrized node normalization behavior - add regression test for directory selector overlap in tests/unit/test_check_test_failure_ownership.py Verification: - ../../.venv/bin/python -m pytest -q tests/unit/test_check_test_failure_ownership.py (5 passed) - ../../.venv/bin/python scripts/ci/check_test_failure_ownership.py (passed) - ../../.venv/bin/python scripts/ci/p0_gate.py (PASS) - GOVERNANCE_INTENT_GATE_DIFF_RANGE='origin/main...HEAD' GOVERNANCE_INTENT_GATE_PR_STATE_FIXTURE='#126=merged,#172=merged' ./scripts/ci/check_governance_intent_gate.sh (passed) - ./scripts/ci/check_governance_traceability.sh (passed) - ./scripts/ci/check_governance_evidence_truth.sh (passed)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR advances the active
p0-conformance-gatechange to the repository-controlled finish line.Included here:
scripts/ci/p0_gate.pyas the single gate entrypointp0-gatejob into.github/workflows/ci-gate.ymldocs/guides/P0_Gate_Runbook.mdfor local usage, release archival, and flaky handlingWhy
Before this PR,
p0-conformance-gatehad a frozen category matrix but still lacked:step_drivenThis PR closes the repository-side gap. The only remaining open task in the change is the external repo-admin action that marks
p0-gateas a required protected-branch check.Scope
Included:
tests/integration/test_p0_conformance_gate.pytests/unit/test_p0_gate_ci.pyscripts/ci/p0_gate.py.github/workflows/ci-gate.ymldocs/guides/P0_Gate_Runbook.mddocs/governance/branch-protection.mddocs/guides/Team_Agent_Collab_Playbook.mddocs/README.mdopenspec/changes/p0-conformance-gate/*docs/features/p0-conformance-gate.mdNot included:
TODO / Change Mapping
p0-conformance-gate2.1security integration anchor2.2step-driven integration anchor2.3audit-chain integration anchor3.1CI workflow entrypoint3.3deterministic summary contract4.1local run + troubleshooting docs4.2release archive guidance4.3flaky handling rules3.2addp0-gateas a required branch protection check (repo-admin follow-up)Validation
Executed:
../../.venv/bin/python -m pytest -q tests/integration/test_security_policy_gate_flow.py tests/integration/test_p0_conformance_gate.py tests/unit/test_dare_agent_step_driven_mode.py../../.venv/bin/python -m pytest -q tests/unit/test_dare_agent_security_policy_gate.py tests/unit/test_dare_agent_security_boundary.py tests/unit/test_five_layer_agent.py../../.venv/bin/python -m pytest -q tests/unit/test_p0_gate_ci.py../../.venv/bin/python scripts/ci/p0_gate.pyopenspec validate p0-conformance-gate --type change --strict --json --no-interactive./scripts/ci/check_governance_evidence_truth.shResults:
p0-gateemits the expected PASS summary0issuesReview Focus
Please focus on:
p0-gatecategory bundle matches the frozen scope matrix3.2is already complete