Skip to content

Add a reusable gated workflow that opens daily closeout PRs for items delivered by merged pull requests #132

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
unbraind merged 2 commits into from
Oct 16, 2026
Merged

Add a reusable gated workflow that opens daily closeout PRs for items delivered by merged pull requests #132

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b3b5f33
feat: add reusable gated closeout workflow
unbraind Oct 16, 2026
6aef689
fix: scope closeout evidence gates and compact plans
unbraind Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions .agents/pm/history/pm-github-0x3y.jsonl
View file
Open in desktop

Large diffs are not rendered by default.

37 changes: 35 additions & 2 deletions .agents/pm/tasks/pm-github-0x3y.toon
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,44 @@ id: pm-github-0x3y
title: Add a reusable gated closeout PR workflow
description: Follow up on pm-github closeout with a workflow_call automation surface after command acceptance. Reuse the gated sync safety model without changing its existing workflow or inputs.
type: Task
status: open
status: in_progress
priority: 2
tags: []
created_at: "2026-10-14T21:46:44.372Z"
updated_at: "2026-10-14T21:46:44.372Z"
updated_at: "2026-10-16T05:52:04.621Z"
author: codex-agent
acceptance_criteria: "Run verified closeout on a bot branch and open or update a PR; never push main; validate tracker privacy, regenerate changelog, and dispatch required CI before publication.; Test clean, malicious, no-op, permission-limited and repeat invocations with explicit evidence; document least-privilege callers."
comments[17]{created_at,author,text}:
"2026-10-16T00:45:04.810Z",codex-agent,"Claimed. Implement a separate workflow_call without changing sync inputs or behavior. Preserve default-branch resolution, npm project containment, exact extension pin, full changed-path allowlist, staged-diff privacy gate, strict health, leased bot-only push and owned-PR lookup. Closeout scans merged PRs since 1970-01-01 to avoid missing deliveries after schedule gaps. Tests execute the real workflow bash with real SDK trackers and isolated Git remotes; only HTTP and external command boundaries are injected."
"2026-10-16T00:54:37.782Z",codex-agent,"Implementation and caller docs are complete. Safety helpers intentionally mirror the unchanged sync workflow, with executable parity assertions. Clean nested-project closeout opens one owned PR and repeat invocation edits it; malicious acceptance criteria is refused by the proposed-diff gate. Pure no-op and zero-close caller-only tracker drift publish nothing. Read, contents-write, PR-write and CI-dispatch refusals are explicit. Added a fixed bot/default-branch separation guard. Linked tests are running via pm test; repository policy disables automatic test-result tracking, so verified receipts will be recorded in comments."
"2026-10-16T00:56:48.557Z",codex-agent,"Behavioural revert proofs: node --test --test-name-pattern=behavioural test/closeout-workflow.test.ts passed 2/2 (zero failures/skips). With only the staged-diff privacy scan call removed from the executable scope helper, malicious acceptance criteria and copied close evidence were committed and pushed to the isolated bare remote and a PR receipt was created. The intact workflow refuses that same fixture before push. With only the zero-close/no-tracker-diff conditional removed, a run reporting closed=0 opened a PR containing caller-only tracker drift; the intact workflow creates no remote branch or PR for the same zero-close case. These are real tracker mutations, real Git commits/pushes and bash extracted from the actual workflow; only HTTP/publication command boundaries are injected."
"2026-10-16T01:10:06.476Z",codex-agent,"Linked workflow acceptance: pm test pm-github-0x3y --run --only-last --progress executed node --test test/closeout-workflow.test.ts and passed 13/13, with 0 failures, skips, cancellations or todos. The earlier focused contract command also passed. Covered owned-PR repeat behavior, schedule without repository metadata, all requested refusal/no-op cases, both behavioural reverts, input validation and competing-writer lease rejection. PM returned evidence_recording.reason=tracking_disabled under repository policy; this comment retains the verified receipt without changing that policy."
"2026-10-16T01:13:07.054Z",codex-agent,"Final permission review: closeout reads the Checks API, not GitHub issues. The caller and reusable job now grant checks:read instead of sync issues:read; contents:write, pull-requests:write and actions:write remain unchanged. Official GitHub Checks API documentation requires the read grant for private check runs. The permission-limited fixture now also denies only check-run reads and verifies zero writes/publication. Re-running the full gates on this final configuration; sync remains untouched."
"2026-10-16T01:16:45.532Z",codex-agent,"Permission regression now passes through pm test: the fixture denies all PR reads, then denies only check-run reads. Both runs fail explicitly before publication and leave the item in progress. Existing command gap encountered: unavailable head evidence is returned as a skip receipt with exit 0, without a typed error code. The workflow checks unavailable/incomplete evidence in the receipt and turns it into a clear failure; command behavior remains unchanged. Final contract test and lint/typechecking pass with checks:read in both caller and reusable job. Full release gates are restarting with implementation frozen."
"2026-10-16T02:08:16.197Z",codex-agent,"Final npm gate passed with CI identity isolation: env HOME=$(mktemp -d) GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 npm run release:check. Tests 694/694; failures/skips/cancellations/todos all 0. Exact coverage across 13 authored modules: lines 10040/10040, statements 10040/10040, functions 255/255, branches 2832/2832. Thresholds and package pins unchanged. Production audit reports 0 vulnerabilities; docstrings, zero-duplication, privacy, pack dry-run, changelog and publish-attestation checks passed. Starting the requested Bun gate and final full linked-test run."
"2026-10-16T02:19:44.776Z",codex-agent,"Bun validation exposed a test-fixture setup defect: the package receipt parser combined stdout and stderr, so first-use npm update notices after JSON made parsing fail in a fresh home. Reproduced with the fresh-home contract command (failed before the fix), separated stdout from diagnostic streams, then the identical command passed 1/1. Lint and test typechecking pass. Production workflow logic is unchanged. Earlier npm result was 694/694 with exact complete coverage; both complete gates are being rerun after this test-only fix. Added the fresh-home regression to linked tests."
"2026-10-16T02:34:54.392Z",codex-agent,"Final unfiltered linked-test run passed: pm test pm-github-0x3y --run --progress completed all 4/4 registered commands with exit 0 and every failure category at 0. The full workflow suite passed 13/13 with 0 failures/skips/cancellations/todos; the focused contract, permission-limited token and fresh-home package-receipt regressions each passed. Automatic test-result recording remains disabled by repository policy, so this comment preserves the verified receipt. Both required release gates remain in progress after the test-helper stream fix."
"2026-10-16T03:05:47.391Z",codex-agent,"Npm release:check passed again after the package-receipt stream fix, using isolated CI identity. Tests 694/694 with 0 failures/skips/cancellations/todos. Coverage remains exact across 13 authored modules: lines 10040/10040, statements 10040/10040, functions 255/255, branches 2832/2832. Production audit 0 vulnerabilities; every static, privacy, pack, changelog and attestation stage passed. The final 4/4 PM linked commands are also green. Starting the corrected Bun release gate on this same frozen implementation."
"2026-10-16T03:39:34.857Z",codex-agent,"Both final release gates passed on the corrected frozen implementation: npm run release:check and bun run release:check, each with isolated CI identity and 694/694 tests; failures/skips/cancellations/todos all 0. Both report exact coverage across 13 authored modules: lines 10040/10040, statements 10040/10040, functions 255/255, branches 2832/2832. Unchanged thresholds and dependency pins; 0 duplicated authored lines and 0 production vulnerabilities. Docstrings, privacy, pack, changelog and publish-attestation checks passed in both gates. All 4/4 PM linked commands passed, including the 13/13 executable workflow cases, both behavioural revert proofs and fresh-home regression. Existing sync workflow and caller template remain unchanged. PM command gap: unreadable head evidence is a zero-exit skip receipt without a typed error code; the workflow explicitly refuses it. Full-history API cost and live caller adoption remain operational considerations. Leaving this item in progress for orchestrator verification on feat/reusable-closeout-workflow."
"2026-10-16T03:55:37.384Z",codex-agent,"Review round 1: confirmed the workflow scans PR-level checks without requiring a blocked local tracker row, and incomplete merge metadata shares the unavailable rule. Plan: inspect a real read-only report, add stable plan decision codes, gate only local evidence refusals with separate merge handling, compact default plans and PR summaries, preserve full JSON/full output, and prove regressions by behavioural revert."
"2026-10-16T04:00:49.178Z",codex-agent,"Live read-only pm-brief dry run since 2026-10-01 confirmed 47 full rows: 2 closes, 9 already-terminal skips, 35 foreign-repository skips and 1 duplicate selection. Original row fields were item/pr/action/reason; PR checks carried rule/reason/passed/ok. New additive decision codes distinguish head_evidence_unavailable from incomplete_merge and preserve full JSON; default TOON and review PR summaries list actionable rows and count routine skips. Summary content passes a dedicated privacy gate before publication."
"2026-10-16T04:03:07.870Z",codex-agent,"Behavioural revert proof: restoring only the original workflow PR-check predicate made all 3 selected regressions fail (unlinked unavailable, linked incomplete merge, unlinked incomplete merge; exit 1). Restoring only the uncompacted report behaviour and rebuilding made both compact-report and packed CLI output regressions fail (2 tests; exit 1). Restored fixes. Updated output-focused acceptance passes 3/3; linked pm test compact-report run passes 1/1. Real pm-brief before/after default output is 76 to 25 lines (67.1% reduction), with identical 47 full plan rows and unchanged 2 intended closes."
"2026-10-16T04:44:48.115Z",codex-agent,"Initial full npm gate: 702/702 tests passed with zero failures/skips/cancellations, but the unchanged 100% branch gate correctly refused 99.89% coverage. Source-level registration coverage missed compact/default and full flag branches because the SDK test harness defaults to JSON. Strengthened the existing handler test to assert compact skip counts and full row preservation with global JSON disabled; that focused test passes 1/1 and lint passes. No production code or threshold changes. Re-running both complete release gates with these assertions."
"2026-10-16T05:19:04.632Z",codex-agent,"Fresh bun run release:check passed: 702/702 tests, zero failures/skips/cancellations/todos; all 13 authored modules have exact 100/100/100/100 coverage (10068/10068 lines and statements, 256/256 functions, 2845/2845 branches). Typecheck/build/docstrings/lint, zero duplication, privacy, production audit, pack, changelog check and release attestation all passed. The previously missed output branches now execute in direct handler tests. Latest origin/main is already contained. Starting the final npm release gate at unchanged thresholds."
"2026-10-16T05:52:03.065Z",codex-agent,"Final npm run release:check and bun run release:check both passed with isolated HOME/Git identity: 702/702 tests each; zero failures, skips, cancellations or todos; exact 100/100/100/100 coverage across all 13 authored modules (10068 lines/statements, 256 functions, 2845 branches, all covered). All remaining release checks passed at unchanged thresholds and dependency pins. Revert baseline b3b5f33: node --test --test-name-pattern='unavailable evidence.*(unlinked|incomplete)' test/closeout-workflow.test.ts failed 3/3 selected regressions with only the original workflow evidence predicate restored. After restoring only uncompacted report behaviour and rebuilding, node --test --test-name-pattern='compact report|packed CLI' test/closeout.test.ts failed 2/2 selected regressions. Fixes restored before successful gates. The workflow's exact summary projection on the captured real pm-brief report yields 2 actionable rows and skip counts already_terminal=9, other_repository=35, duplicate_selection=1. Default output is 76 to 25 lines; all 47 rows remain in JSON/full output. Caller pins must target a release emitting decision codes. Releasing the claim for orchestrator verification; the item remains in_progress."
files[5]{path,scope}:
.github/workflows/pm-github-closeout.yml,project
closeout.ts,project
index.ts,project
test/closeout-workflow.test.ts,project
test/closeout.test.ts,project
tests[5]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,source_ref}}:
node --test --test-name-pattern=closeout.contract test/closeout-workflow.test.ts,project,1200,codex-agent,"2026-10-16T00:51:51.522Z",local_mutation,feat/reusable-closeout-workflow
node --test test/closeout-workflow.test.ts,project,1200,codex-agent,"2026-10-16T00:52:51.590Z",local_mutation,feat/reusable-closeout-workflow
node --test --test-name-pattern=permission-limited test/closeout-workflow.test.ts,project,1200,codex-agent,"2026-10-16T01:13:36.961Z",local_mutation,feat/reusable-closeout-workflow
env HOME=$(mktemp -d) GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 node --test --test-name-pattern=closeout.contract test/closeout-workflow.test.ts,project,1200,codex-agent,"2026-10-16T02:19:38.716Z",local_mutation,feat/reusable-closeout-workflow
"node --test --test-name-pattern=\"compact report\" test/closeout.test.ts",project,180,codex-agent,"2026-10-16T04:00:12.763Z",local_mutation,feat/reusable-closeout-workflow
docs[2]{path,scope}:
docs/closeout-workflow-caller.yml,project
README.md,project
body: ""
Loading
Loading