diff --git a/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/CHUNK_MAP.md b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/CHUNK_MAP.md new file mode 100644 index 00000000..287b516a --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/CHUNK_MAP.md @@ -0,0 +1,10 @@ +# Chunk Map: WS-ENG-007 - Concurrent PR Review Reconciliation + +| Order | Chunk | Purpose | Risk | State | +|---:|---|---|---:|---| +| 1 | `WS-ENG-007-01` | Add deterministic reviewed-patch identity and conservative base-delta review preservation | L1 | Proposed | +| 2 | `WS-ENG-007-02` | Add structured reviewer-track and upstream-finding reconciliation | L1 | Blocked on 01 merge and explicit start | +| 3 | `WS-ENG-007-03` | Add merge-group CI parity and queue-readiness proof | L1 | Blocked on 02 merge and explicit start | + +Each chunk is one PR and stops after merge. Every successor requires a separate +explicit signed start. diff --git a/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/DECISIONS.md b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/DECISIONS.md new file mode 100644 index 00000000..b09cc6d6 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/DECISIONS.md @@ -0,0 +1,47 @@ +# Decisions: WS-ENG-007 - Concurrent PR Review Reconciliation + +## D1 - CI always reruns on the combined tree + +Review preservation never preserves CI results across a base advance. + +## D2 - Preserve internal tracks, not human approval + +GitHub approval and explicit human merge ownership remain governed by branch +protection and repository policy. + +## D3 - Effective patch identity is mandatory + +File-path disjointness is insufficient. Preservation requires the same +canonical PR-authored delta and declared boundary non-impact. + +## D4 - Unknown means stale + +Missing objects, ambiguous dependencies, conflicts, or unsupported merge shapes +invalidate conservatively. + +## D5 - Upstream resolution requires a predicate + +A finding is resolved upstream only when its closed resolution predicate is +deterministically `true` on the exact candidate tree. `false` remains +`still_valid`; `unknown` makes every reviewer track stale because the affected +set is not proven. + +## D6 - Merge queue comes last + +Do not enable merge queue until both required workflows and evidence gates prove +`merge_group` parity. + +## D7 - One shared Git evidence implementation + +Extract strict tree/delta primitives for reuse; do not create a second parser +or rely on fuzzy patch application. + +## D8 - Closed repository-owned boundaries + +PRs cannot declare their review surface. A versioned policy graph derives path +classes, transitive impacts, and reviewer escalation. + +## D9 - Detection and lifecycle states differ + +`unknown` is a reconciliation result; `track_stale` for every track is its +mandatory reviewer lifecycle consequence. Neither is a claimant override. diff --git a/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/DISCOVERY.md b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/DISCOVERY.md new file mode 100644 index 00000000..3327edb8 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/DISCOVERY.md @@ -0,0 +1,61 @@ +# Discovery: WS-ENG-007 - Concurrent PR Review Reconciliation + +Discovery was performed read-only against trusted `main` at merge +`9033a97a4be6d762cae4b210018ef81a079395c2`. + +## Repository behavior found + +- Branch protection requires `agent-gates` and `test`, uses strict up-to-date + checks, enforces protection for administrators, requires one approval, and + dismisses stale reviews. +- `.github/workflows/backend.yml` and `agent-gates.yml` run for pull requests; + neither declares `merge_group`. +- `scripts/check_internal_review_evidence.py` records one reviewed SHA and + rejects every non-evidence path changed between that SHA and the PR head. +- The evidence gate does not distinguish PR-authored changes from a later base + merge, does not bind a patch manifest, and cannot preserve reviewer tracks. +- Loop-memory merge records already preserve base/head/tree identities and + deterministic deltas, providing conventions that can be reused without + making generated memory a pre-merge authority. + +## Relevant files + +| Path | Relevance | +|---|---| +| `scripts/check_internal_review_evidence.py` | Current coarse reviewed-SHA invalidation. | +| `scripts/workstream_agent_gate.py` | Computes changed files for PR gate routing. | +| `scripts/test_agent_gates.py` | Deterministic policy tests and synthetic repositories. | +| `.github/workflows/agent-gates.yml` | Required policy check; lacks merge-group trigger. | +| `.github/workflows/backend.yml` | Required backend/fan-in check; lacks merge-group trigger. | +| `.agent-loop/templates/INTERNAL_REVIEW_EVIDENCE.md` | Human-readable review provenance template. | +| `.agent-loop/templates/PR_TRUST_BUNDLE.md` | Human merge summary and CI integrity surface. | +| `.agent-loop/policies/repository-engineering-policy.md` | Canonical review and merge boundaries. | +| `AGENTS.md` | Mandatory agent behavior. | + +## Important distinction + +GitHub approval dismissal and internal reviewer validity are separate. GitHub +may require a renewed human approval after a branch update. This initiative +does not bypass that rule; it prevents unnecessary internal agent fanout when +the reviewed patch is provably unchanged. + +## Closed initial boundary vocabulary + +The repository-owned v1 graph classifies every tracked path into one or more of +`workflow_ci`, `auth_security`, `payment_compensation`, `database_schema`, +`shared_interface_contract`, `generated_policy_process`, `product_runtime`, +`tests_coverage`, or `docs_only`. Unmatched, malformed, or ambiguously mapped +paths are `unknown`. + +Transitive edges are repository-owned: workflow/CI reaches tests/coverage and +generated process; database/schema reaches consuming runtime, interfaces, and +tests; shared interfaces reach consuming runtime/tests; auth and payment reach +their runtime, interfaces, migrations, audit, and tests; generated process +reaches workflows, schemas, templates, and gates. `unknown` invalidates all +tracks. A PR never authors or narrows this graph. + +## Unknowns reserved for later human administration + +- Exact GitHub merge-queue repository-setting API behavior. +- Hosted context behavior after queue enablement. These block administrative + enablement, not repository-side parity planning. diff --git a/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/INTENT.md b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/INTENT.md new file mode 100644 index 00000000..b82b8f49 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/INTENT.md @@ -0,0 +1,81 @@ +# Intent: WS-ENG-007 - Concurrent PR Review Reconciliation + +## Problem being solved + +When one concurrent PR merges, another open PR must be validated against the +new `main`. Today the repository correctly reruns strict CI, but its internal +review evidence is invalidated coarsely by commit ancestry. Unrelated upstream +changes can therefore trigger full reviewer fanout, while a finding already +fixed upstream can remain misleadingly open. + +## Why this work matters + +Workstream permits distinct initiatives to run concurrently. That concurrency +must remain safe without making every merge restart every other initiative's +human-agent review loop. + +## Current behavior + +- Required GitHub checks are strict and require an up-to-date branch. +- GitHub dismisses stale approvals after new commits. +- Internal evidence binds one reviewed code SHA and rejects any later + non-evidence path. +- The repository has no `merge_group` workflow support, reviewed-patch identity, + base-delta classifier, or structured upstream-finding disposition. + +## Target behavior + +- CI always validates the exact combined tree proposed for merge. +- A base advance that provably leaves the reviewed patch and risk boundaries + unchanged preserves unaffected internal reviewer tracks. +- Findings fixed by trusted `main` are recorded as resolved upstream, not + repeated against the PR. +- Deterministically known overlap, dependency impact, or effective-diff change + reruns the derived affected tracks. Ambiguity, conflict, or any unknown + impact fails closed and stales every track. +- Human approval remains the final merge checkpoint. + +## Design chosen + +Bind reviews to an immutable base tree, head tree, effective patch manifest, +declared boundary manifest, and reviewer-track impact manifest. Reconcile each +new trusted-main base deterministically. Add merge-group CI only after the +classifier and evidence model are proven. + +## Alternatives considered + +- Always rerun every reviewer: safe but defeats useful concurrency. +- Preserve reviews whenever changed file paths are disjoint: insufficient for + dependencies, generated contracts, migrations, and shared interfaces. +- Trust GitHub comments or chat to close findings: mutable and not canonical. +- Allow an AI-only semantic judgment to preserve approval: not deterministic + enough for a merge gate. + +## Boundaries preserved + +Signed starts, one active chunk per initiative, required CI, coverage floors, +internal reviewer independence, CodeRabbit's supplementary role, explicit +human merge approval, and automated post-merge memory remain unchanged. + +## Expected risks + +False preservation is more dangerous than redundant review. Any unclassified +dependency or changed effective patch must invalidate conservatively. + +## What must not change + +No product behavior, auth/payment/data policy, coverage threshold, contributor +permission, automatic merge authority, or bypass for conflicts and failed CI. + +## How this will be proven + +Deterministic synthetic Git histories will cover disjoint base changes, +overlapping files, dependency-boundary changes, upstream-resolved findings, +conflicts, rebases, merge commits, squash-equivalent patches, missing objects, +forged manifests, and merge-group combined trees. + +## Human decisions required + +Approve each implementation chunk and the later repository-setting change that +enables GitHub merge queue. No queue or automatic merge setting changes in the +planning intake. diff --git a/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/PLAN.md b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/PLAN.md new file mode 100644 index 00000000..0750a2bd --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/PLAN.md @@ -0,0 +1,183 @@ +# Plan: WS-ENG-007 - Concurrent PR Review Reconciliation + +## Approach + +Implement the trust model in three ordered chunks. + +First, introduce deterministic reviewed-patch and base-advance evidence. A +review is preserved only when the original PR patch can be reconstructed, the +same patch applies to new `main`, its resulting effective delta is identical, +and neither the new-base delta nor declared dependency boundaries affect the +reviewer's track. Ambiguity invalidates. + +Second, add structured reviewer-track and finding reconciliation. Findings have +stable IDs, target evidence, owner track, and a machine disposition. Trusted +upstream changes may resolve a finding only when a deterministic predicate +proves the finding is absent in the combined tree. A `false` result keeps the +finding valid and reruns its owning track; `unknown` stales every track. Human +approval is never synthesized. + +Third, add `merge_group` workflow support and combined-tree evidence. Only +after repository tests prove parity will a human administrator enable GitHub's +merge queue and align required checks. + +## Canonical Git evidence + +One shared `scripts/git_tree_evidence.py` module is the only Git tree/delta +authority. Loop-memory and review reconciliation consume it; neither may build a +second parser or use fuzzy `git apply` behavior. + +Patch identity is canonical JSON (UTF-8, sorted keys, compact separators) with +repository identity, unique reviewed trusted-main base commit/tree, reviewed +head commit/tree, and raw-path-sorted records containing `path`, `operation`, +`old_mode`, `old_oid`, `new_mode`, and `new_oid`. Renames are always delete plus +add, never similarity guesses. SHA-256 covers the serialization. Object type and +mode are independently recomputed. Symlinks, executables, binary/empty blobs, +deletes, and directory/file transitions retain exact modes and OIDs. Submodules, +unsupported types, duplicate/invalid paths, multiple merge bases, +missing/pruned objects, and non-unique bases fail closed. + +The candidate is built by an exact three-tree operation over reviewed base, +reviewed head, and latest trusted-main trees. Latest-main-to-candidate records +must equal the original canonical patch records exactly. Conflict, partial or +full upstream absorption, empty effective patch, changed mode/blob/result, or a +different manifest invalidates. + +## Boundary and track authority + +`.agent-loop/policies/review-boundaries.json` is the sole closed, versioned +boundary graph. Reconciliation derives boundaries; PR evidence only records the +derived version, digest, and result. Version drift, unknown path, unknown class, +unknown edge, cycle, ambiguous traversal, or unclassified multi-boundary impact +makes the affected set unprovable and therefore invalidates all tracks. +Targeted invalidation is permitted only when every path, class, edge, and +transitive impact is known. + +Chunk 01 owns immutable Git evidence, boundary derivation, and the impacted +track set. Chunk 02 alone owns structured findings, upstream predicates, rerun +results, and final track evidence lifecycle. + +The v1 minimum track map uses only exact evidence-gate names: `workflow_ci` +routes `CI integrity`, `architecture`, `senior engineering`, `security/auth`, +`QA/test`, and `test delta`; `auth_security` routes `security/auth`, +`architecture`, `senior engineering`, `QA/test`, `product/ops`, and +`test delta`; `payment_compensation` routes `security/auth`, `product/ops`, +`architecture`, `senior engineering`, `QA/test`, and `test delta`; +`database_schema` routes `architecture`, `security/auth`, `senior engineering`, +`QA/test`, `CI integrity`, `product/ops`, and `test delta`; +`shared_interface_contract` routes `architecture`, `senior engineering`, +`QA/test`, `product/ops`, `reuse/dedup`, `docs`, and `test delta`; +`generated_policy_process` routes all tracks; `product_runtime` routes +`senior engineering`, +`QA/test`, `security/auth`, `product/ops`, `architecture`, `reuse/dedup`, and +`test delta`; `tests_coverage` routes `QA/test`, `CI integrity`, +`senior engineering`, and `test delta`; `docs_only` routes `docs` and +`senior engineering`. Aliases, case changes, and unknown names fail closed. +Multi-class paths take the union; `unknown` routes all. + +## Finding predicate grammar + +Finding IDs are `SHA-256` over compact, sorted-key UTF-8 JSON with the literal +version `workstream-review-finding-id-v1` and exactly these immutable identity +fields: repository, initiative, chunk, canonical reviewer track, repository- +owned rule ID, and target. Target contains the raw repository path, target kind, +immutable original object identity or diagnostic key, predicate kind, and the +predicate's immutable expected value. Mutable severity, message wording, +disposition, candidate/upstream evidence, timestamps, reviewer session, and +rerun results are excluded. A duplicate digest with non-byte-identical +canonical identity payload rejects the complete evidence set as a collision; +it is never silently deduplicated. An exact duplicate canonical payload/ID is +also rejected as duplicate evidence, yielding `unknown` and all tracks stale. + +Every predicate is a resolution predicate: `true` means the exact candidate +proves the finding resolved; `false` means `still_valid`. `blob_equals` is true only +for the expected blob, `blob_absent` and `path_absent` only when the bound path +is absent, `mode_equals` only for the expected mode, and `diagnostic_absent` +only when a repository-owned typed checker reports the diagnostic absent. A +`diagnostic_absent` identity additionally binds the checker repository path, +checker blob OID, declared checker version, diagnostic code, input-schema +SHA-256, and output-schema SHA-256. Evaluation records the same fields from the +checker actually loaded from the candidate tree; any identity, version, or +schema mismatch is `unknown` and invalidates all tracks. +Before evaluation, a renamed or recreated bound target is `unknown`; missing is +false for equals predicates and true only for absence predicates when identity +continuity is not ambiguous. Evaluator error, contradiction, unsupported target, +or identity ambiguity is `unknown`; every `unknown` mandates all tracks become +`track_stale`. A finding +fixed on main but reintroduced by the PR evaluates false and remains +`still_valid`. Arbitrary commands, code, expressions, regexes, URLs, comments, +and claimant-authored dispositions are forbidden. + +Findings are linked only when their immutable identity payloads have the same +repository, initiative, chunk, raw target path, target kind, and original +object identity or diagnostic code key. Unlinked findings never block +one another. Linked findings are contradictory when their predicate kinds or +immutable expected values assert mutually exclusive candidate facts: distinct +`blob_equals` OIDs, distinct `mode_equals` modes, an absence predicate paired +with an equality predicate, or distinct diagnostic checker/schema identities +for the same diagnostic code. Linked-set evaluation is atomic: only an all-true, +contradiction-free set resolves every member; any `false` with no unknown or +contradiction makes every linked member `still_valid`; and any `unknown`, +contradiction, or cross-track disagreement makes every linked member `unknown` +and stales all tracks. + +## Merge-queue activation checkpoint + +Chunk 03 proves repository-side readiness with static and synthetic merge-group +fixtures only. GitHub cannot emit a real merge-group event before queue +enablement. After 03 merges, a separately authenticated human administrator may +enable the queue, submit two approved concurrent PRs in both orderings, verify +the exact intermediate group SHAs/trees and required contexts, and immediately +disable/roll back on any mismatch. Final trees may be identical for disjoint +changes; every intermediate base, ordered input set, group SHA/tree, and +evidence record must remain distinct. The workflow cannot enable or merge. + +## Human and CI invariants + +Every preserved internal track still requires fresh CI on the exact candidate +or merge-group SHA. GitHub may dismiss stale human approval after any update. +This system neither preserves nor synthesizes it, and the specific PR still +requires explicit human merge approval. + +## Preservation algorithm + +```text +reviewed base + reviewed PR patch -> reviewed combined tree +latest trusted main + same patch -> candidate combined tree + +if patch cannot apply, effective patch changes, boundaries overlap, +required evidence is missing, or classification is uncertain: + invalidate affected tracks (or all tracks when impact is unknown) +else: + preserve unaffected internal tracks + +always: + run required CI on the candidate combined tree + retain explicit human merge approval +``` + +## Alternatives rejected + +- Path-disjointness alone. +- Timestamp/comment-based staleness. +- Automatic AI declarations that a semantic change is harmless. +- Enabling merge queue before workflows support `merge_group`. +- Folding this work into CI-02B, whose approved scope is semantic test lanes. + +## Verification strategy + +- Synthetic repositories with exact tree/blob identities. +- Adversarial base advances across overlapping and indirect boundaries. +- Rebase, merge, squash-equivalent, conflict, deleted-object, and forged-record + cases. +- Workflow assertions proving identical required checks for PR and merge group. +- Repository-side static and synthetic assertions proving two concurrent PR + orderings preserve required-check parity. Real hosted two-ordering evidence + is collected only at the separate post-merge human-admin activation + checkpoint: temporarily enable the queue, verify the emitted group commits, + trees, and contexts, and retain or immediately disable it based on results. + +## Stop conditions + +Stop if preservation depends on mutable PR prose, inaccessible commits, an +unbounded semantic judgment, weakened CI, or automatic human approval. diff --git a/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/RISKS.md b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/RISKS.md new file mode 100644 index 00000000..426eb28d --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/RISKS.md @@ -0,0 +1,12 @@ +# Risks: WS-ENG-007 - Concurrent PR Review Reconciliation + +| Risk | Severity | Mitigation | +|---|---:|---| +| A semantic dependency is missed despite disjoint paths | Critical | Closed boundary manifests; unknown impact invalidates all tracks. | +| A changed effective PR patch retains approval | Critical | Bind base/head trees and canonical patch manifest; recompute on latest main. | +| Upstream finding is falsely marked resolved | High | Require a deterministic target predicate; `false` reruns the owning track and `unknown` invalidates all tracks. | +| GitHub merge queue bypasses required checks | Critical | Add and test `merge_group` parity before administrative enablement. | +| Review preservation becomes human-approval automation | Critical | Preserve only internal agent tracks; GitHub/human approval remains external and mandatory. | +| Base objects disappear after branch cleanup | High | Store tree/blob manifests and test pruned-object failure/reconstruction boundaries. | +| Conservative rules still cause excess review | Medium | Measure invalidation reasons; refine only with reviewed deterministic rules. | +| Concurrent queue entries interact | High | Validate each exact merge-group SHA and invalidate on queue recomputation. | diff --git a/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/STATUS.md b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/STATUS.md new file mode 100644 index 00000000..ec2a58d1 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/STATUS.md @@ -0,0 +1,9 @@ +# STATUS: WS-ENG-007 - Concurrent PR Review Reconciliation + +- Phase: planning intake +- Gate: stopped +- Active planning chunk: none +- Active implementation chunk: none +- Proposed implementation successor: `WS-ENG-007-01` +- Separate explicit start required: true +- Current gate: planning review and human approval diff --git a/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/chunks/WS-ENG-007-01-reviewed-patch-base-delta.md b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/chunks/WS-ENG-007-01-reviewed-patch-base-delta.md new file mode 100644 index 00000000..889f6c8a --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/chunks/WS-ENG-007-01-reviewed-patch-base-delta.md @@ -0,0 +1,136 @@ +# Chunk Contract: WS-ENG-007-01 - Reviewed Patch and Base-Delta Reconciliation + +## Parent initiative + +`WS-ENG-007` — Concurrent PR Review Reconciliation + +## Goal + +Replace ancestry-only internal-review invalidation with deterministic patch +identity and conservative, track-aware base-advance reconciliation. + +## Risk class + +L1 / engineering merge integrity + +## Start phase + +`implementation` + +## Allowed files + +```text +AGENTS.md +.agent-loop/policies/repository-engineering-policy.md +.agent-loop/templates/INTERNAL_REVIEW_EVIDENCE.md +.agent-loop/templates/PR_TRUST_BUNDLE.md +.agent-loop/policies/review-boundaries.json +.agent-loop/schemas/review-base-reconciliation.schema.json +scripts/git_tree_evidence.py +scripts/update_post_merge_memory.py +scripts/check_internal_review_evidence.py +scripts/reconcile_review_base.py +scripts/test_agent_gates.py +scripts/test_git_tree_evidence.py +scripts/test_update_post_merge_memory.py +.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/STATUS.md +.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-01-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-01-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-01-external-review-response.md +.agent-loop/merge-intents/WS-ENG-007-01.json +``` + +## Not allowed + +- Workflow, branch-protection, merge-queue, product, backend, migration, + coverage, or human-approval changes. +- Preservation based only on path disjointness, timestamps, PR prose, chat, or + an unrecorded AI judgment. +- Automatic preservation when objects, boundaries, or classification are + missing or ambiguous. + +## Acceptance criteria + +- [ ] One shared Git evidence module independently recomputes repository, + reviewed trusted-main commit/tree, unique merge base, reviewed head/tree, + object types/modes/OIDs, candidate base/tree, and effective delta; copied + PR-authored hashes are never accepted as proof. +- [ ] Canonical JSON uses UTF-8, sorted keys, compact separators, SHA-256, and + raw-path-sorted records containing path, add/delete/modify operation, + old/new mode, and old/new blob OID. Renames are delete plus add. +- [ ] Symlink, executable, binary, empty, delete, and directory/file transitions + preserve exact Git identities. Submodule, unsupported type, duplicate or + invalid path, multiple base, missing/pruned object, and forged identity + fail closed. +- [ ] Extracting shared Git primitives leaves existing loop-memory manifests, + deltas, signed input payloads, generated projections, schemas, lifecycle, + and authority behavior byte-for-byte unchanged across existing fixtures. + Reconciliation is not a pre-merge dependency of post-merge memory, and a + shared-helper failure fails closed independently in both consumers. +- [ ] A repository-owned versioned boundary graph derives path classes and + transitive track impacts. Unknown path/class/edge, cycle, ambiguity, + version drift, or omitted indirect dependency invalidates all tracks; + targeted invalidation is allowed only for deterministically known impact, + and PRs cannot narrow it. +- [ ] Exact three-tree reconciliation constructs the candidate without context + fuzz. Latest-main-to-candidate records must exactly equal the original + base-to-head records. Upstream absorption, empty patch, changed output, + or conflict invalidates. +- [ ] Identical effective patch plus provably unaffected boundaries may preserve + only unaffected internal tracks. +- [ ] Changed patch, conflict, overlap, dependency-boundary impact, missing + object, forged digest, or unknown classification invalidates fail closed. +- [ ] Legacy evidence remains valid only under today's exact-head rule and can + never preserve review across a base advance. New malformed, extra, + missing, duplicate/unknown track, foreign repository/initiative/chunk, + or mismatched candidate evidence fails closed and prior review evidence + cannot be rewritten in place. +- [ ] Synthetic histories cover merge, rebase, squash-equivalent, unrelated, + overlapping, deleted-object, conflict, and indirect-boundary cases. +- [ ] Required CI still reruns on the latest combined tree, and human approval + is never synthesized or preserved by this gate. +- [ ] The synthetic matrix expects `preserve` only for a truly disjoint base + addition with identical patch/boundaries. It expects invalidation for + same-path same/different result, upstream delete/rename/mode/binary change, + conflict, multiple base, PR merge/rebase/squash ancestry with unequal + trees, missing object, forged identity/digest, indirect dependency, + workflow/generated-contract/migration impact, empty/already-applied patch, + and text-similar but tree-different output. Every case asserts exact + impacted tracks; unknown invalidates every track. +- [ ] No tests/checks are deleted, skipped, xfailed, deselected, weakened, or + substituted for real Git-object proof. + +## Verification commands + +```bash +python3 scripts/test_agent_gates.py +python3 scripts/test_git_tree_evidence.py +python3 scripts/test_update_post_merge_memory.py +python3 scripts/reconcile_review_base.py --validate-fixtures +python3 scripts/check_internal_review_evidence.py +python3 scripts/check_loop_memory_state.py +python3 scripts/check_markdown_links.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +Can any base change preserve a reviewer when the effective patch or dependency +boundary changed? Does every uncertain case invalidate safely? + +## Stop conditions + +Stop if deterministic patch reconstruction or conservative boundary impact +cannot be proven from immutable Git evidence. diff --git a/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/chunks/WS-ENG-007-02-finding-track-reconciliation.md b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/chunks/WS-ENG-007-02-finding-track-reconciliation.md new file mode 100644 index 00000000..55a9c2c1 --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/chunks/WS-ENG-007-02-finding-track-reconciliation.md @@ -0,0 +1,148 @@ +# Chunk Contract: WS-ENG-007-02 - Finding and Reviewer-Track Reconciliation + +## Parent initiative + +`WS-ENG-007` — Concurrent PR Review Reconciliation + +## Goal + +Record internal findings structurally and determine whether trusted upstream +changes resolve them, leave them valid, or require targeted reviewer reruns. + +## Risk class + +L1 / review authority and audit evidence + +## Start phase + +`implementation` + +## Allowed files + +```text +AGENTS.md +.agent-loop/policies/repository-engineering-policy.md +.agent-loop/templates/INTERNAL_REVIEW_EVIDENCE.md +.agent-loop/templates/PR_TRUST_BUNDLE.md +.agent-loop/schemas/review-finding.schema.json +scripts/check_internal_review_evidence.py +scripts/reconcile_review_base.py +scripts/test_agent_gates.py +.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/STATUS.md +.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-02-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-02-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-02-external-review-response.md +.agent-loop/merge-intents/WS-ENG-007-02.json +``` + +## Not allowed + +- Treating CodeRabbit or mutable GitHub comments as canonical internal evidence. +- AI-only automatic finding closure without a deterministic predicate. +- Synthesizing human approval or skipping CI. +- Workflow, merge-queue, product, backend, or coverage changes. + +## Acceptance criteria + +- [ ] Each finding has a stable ID, reviewer track, severity, immutable target + evidence, closed predicate enum, and computed disposition. The ID is + SHA-256 over compact sorted-key UTF-8 JSON with version + `workstream-review-finding-id-v1` and exactly repository, initiative, + chunk, canonical reviewer track, repository-owned rule ID, and target. + Target binds raw path, target kind, immutable original object or + diagnostic key, predicate kind, and immutable expected value. Severity, + wording, disposition, changing evidence, timestamps, reviewer session, + and rerun results are excluded. A duplicate digest with a different + canonical payload rejects the complete evidence set. An exact duplicate + payload/ID is also rejected as duplicate evidence and returns `unknown` + with every track stale. +- [ ] Reconciliation returns exactly `still_valid`, `resolved_upstream`, + or `unknown`; `unknown` deterministically produces lifecycle state + `track_stale` for every track. Targeted reruns are permitted only when + path, class, edge, and transitive impact are all deterministically known. +- [ ] Predicates are limited to `blob_equals`, `blob_absent`, `mode_equals`, + `path_absent`, and repository-owned typed `diagnostic_absent`. Arbitrary + commands, code, expressions, regex, URLs, comments, and claimant-authored + dispositions are rejected. +- [ ] All predicates are resolution predicates: true means resolved and false + means still valid. Per-predicate tests cover true/false on original, + trusted-main, and candidate trees; equals-on-missing is false, + absence-on-unambiguous-missing is true, and rename/recreation, evaluator + error, or identity ambiguity is unknown and stales every track. +- [ ] `diagnostic_absent` binds checker repository path, checker blob OID, + declared checker version, diagnostic code, and SHA-256 digests of its + input and output schemas. Candidate evaluation records the same identity; + any checker, version, or schema mismatch is `unknown` and stales every + track. +- [ ] Upstream resolution cites trusted-main commit/tree and deterministic proof. +- [ ] `resolved_upstream` requires an immutable original finding, trusted-main + change to its bound target, true predicate in the exact candidate, and no + linked non-resolved or contradictory finding. Findings link only on the + same repository, initiative, chunk, raw path, target kind, and original + object or diagnostic code key; unrelated findings never block. + Distinct expected blob OIDs or modes, absence versus equality, or distinct + checker/schema identities for one diagnostic code are contradictions. + Linked-set evaluation is atomic: all true and contradiction-free resolves + every member; any false without unknown/contradiction makes every member + `still_valid`; any unknown, contradiction, or cross-track disagreement + makes every member `unknown` and stales all tracks. A fix on main + reintroduced by the PR remains `still_valid`. +- [ ] Unaffected tracks remain valid while impacted tracks rerun and produce new + evidence bound to the candidate combined tree. +- [ ] Cross-track, renamed-path, deleted-target, dependency, forged-record, and + contradictory-finding tests fail closed. Duplicate IDs, recreated targets, + evaluator failure, PR-authored `resolved_upstream`, and evidence copied + across repository/initiative/chunk return `unknown` and stale tracks. + Tests cover linked versus unrelated findings and every closed + contradiction pair. +- [ ] Canonical-ID tests prove field/key insertion order yields byte-identical + compact sorted-key UTF-8 JSON and digest; changing each included field, + including version and every nested target field, changes the ID; changing + every excluded mutable field does not. Missing, extra, duplicate-key, + noncanonical track/path/value, invalid UTF-8, and non-JSON values fail + closed. Exact duplicate payload/ID is rejected. An injected identical + digest for non-byte-identical payloads rejects the complete evidence set; + tests inject the digest result and never attempt a real SHA-256 collision. +- [ ] Linked-set tests cover all-true, all-false, true/false, true/unknown, + false/unknown, every declared contradiction pair, and cross-track + disagreement on same-track and different-track cases. They assert the + atomic outcomes: all true resolves all; any false alone keeps all linked + members `still_valid`; any unknown, contradiction, or cross-track + disagreement returns `unknown` and stales all tracks. Exact duplicates + follow the duplicate rejection rule, and unrelated findings never affect + one another. +- [ ] Track identifiers are exactly `senior engineering`, `QA/test`, + `security/auth`, `product/ops`, `architecture`, `CI integrity`, `docs`, + `reuse/dedup`, and `test delta`; aliases, spelling, or case drift fails. +- [ ] No test deletion, skip/xfail/deselection, assertion weakening, coverage + reduction, or replacement of combined-tree proof with mocks is allowed. + +## Verification commands + +```bash +python3 scripts/test_agent_gates.py +python3 scripts/check_internal_review_evidence.py +python3 scripts/check_markdown_links.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +Can an upstream change falsely close a finding or preserve the wrong track? + +## Stop conditions + +Stop if finding resolution requires mutable conversation or unbounded semantic +judgment. diff --git a/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/chunks/WS-ENG-007-03-merge-group-parity.md b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/chunks/WS-ENG-007-03-merge-group-parity.md new file mode 100644 index 00000000..45bf240b --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/chunks/WS-ENG-007-03-merge-group-parity.md @@ -0,0 +1,118 @@ +# Chunk Contract: WS-ENG-007-03 - Merge-Group CI Parity + +## Parent initiative + +`WS-ENG-007` — Concurrent PR Review Reconciliation + +## Goal + +Run required policy and backend checks on GitHub's exact merge-group tree and +prove repository readiness before a human administrator enables merge queue. + +## Risk class + +L1 / required CI and merge admission + +## Start phase + +`implementation` + +## Allowed files + +```text +.github/workflows/agent-gates.yml +.github/workflows/backend.yml +AGENTS.md +.agent-loop/policies/repository-engineering-policy.md +docs/operations_post_merge_memory.md +scripts/workstream_agent_gate.py +scripts/check_internal_review_evidence.py +scripts/reconcile_review_base.py +scripts/test_agent_gates.py +.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/STATUS.md +.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-03-internal-review-evidence.md +.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-03-pr-trust-bundle.md +.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-03-external-review-response.md +.agent-loop/merge-intents/WS-ENG-007-03.json +``` + +## Not allowed + +- Enabling merge queue or changing branch protection from repository code. +- Renaming, removing, skipping, or weakening required checks, tests, coverage, + services, or human approval. +- Trusting a pull-request head check for a different merge-group SHA. + +## Acceptance criteria + +- [ ] Both required workflows support `merge_group` and retain pull-request and + trusted-main behavior. +- [ ] `agent-gates` and final `test` contexts run on and bind the exact + `github.sha` merge-group commit/tree. PR-head success never satisfies a + group, and no group success is reused across another group SHA. +- [ ] Synthetic evidence binds queue base SHA plus ordered PR-head inputs. First group and + recomputed successor groups after member merge, removal, or update are + distinct. For disjoint PRs the eventual final tree may match across + orderings, but every intermediate group SHA/tree and evidence record is + independently bound and never reused. +- [ ] Required context names are exactly `agent-gates` and terminal `test` for + pull request and merge group, with no event-only path filter, conditional, + continue-on-error, skipped-success, shard/fan-in, or coverage weakening. +- [ ] Every `github.event.pull_request.*` use, checkout ref/SHA, concurrency + group/cancellation, permission, secret, service, artifact, shard-plan, + API-E2E, coverage-combine, and failure-propagation path is audited for + merge-group payload safety. +- [ ] Workflows/jobs have read-only minimum permissions, no + `pull_request_target`, no write token or secret exposed to checked-out + code, and immutable action pins. +- [ ] Backend shards, API E2E, coverage combine, global 78 percent, and every + protected 90 percent floor remain unchanged and blocking. +- [ ] Repository-side static and synthetic tests prove two concurrent PR + orderings preserve required-check parity without bypass or duplicate + internal reviewer fanout for disjoint changes. +- [ ] Human-admin enablement steps, rollback, and required-check verification + are documented; the chunk itself does not mutate repository settings. +- [ ] YAML parsing/topology tests and negative fixtures cover missing trigger, + renamed/duplicate/spoofed context, PR-only conditional/payload field, + concurrency collision, cancelled/skipped/recomputed group, skipped fan-in, + partial shard success, stale group SHA, and coverage artifact omission. +- [ ] The chunk claims repository-side readiness only. After merge, a separately + authenticated human administrator may enable queue, generate real groups + for both orderings, verify exact contexts/SHAs, and immediately disable on + mismatch. Workflow code has no setting or merge authority. +- [ ] No tests/checks are deleted, skipped, xfailed, deselected, weakened, or + replaced by mocks; required contexts and coverage floors cannot change. + +## Verification commands + +```bash +python3 scripts/test_agent_gates.py +python3 -c 'from scripts.test_agent_gates import test_merge_group_workflow_parity; test_merge_group_workflow_parity()' +python3 scripts/check_internal_review_evidence.py +python3 scripts/check_loop_memory_state.py +python3 scripts/check_markdown_links.py +python3 -c 'import pathlib, yaml; [yaml.safe_load(p.read_text()) for p in map(pathlib.Path, [".github/workflows/agent-gates.yml", ".github/workflows/backend.yml"])]' +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] architecture +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +Do required checks bind the exact queue tree, and is administrative queue +enablement still a separate explicit human action? + +## Stop conditions + +Stop if required context parity, exact merge-group identity, or safe rollback +cannot be proven. diff --git a/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-PLAN-internal-review-evidence.md b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-PLAN-internal-review-evidence.md new file mode 100644 index 00000000..6276c2ba --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-PLAN-internal-review-evidence.md @@ -0,0 +1,111 @@ +# Internal Review Evidence: WS-ENG-007-PLAN + +## Chunk + +`WS-ENG-007-PLAN` - Concurrent PR Review Reconciliation Planning + +open sub-agent sessions: none + +valid findings addressed: yes + +## Reviewed Revision + +Reviewed code SHA: da29deafd13b1f7fdacaf5aa32af2c26adeef0d0 + +Reviewed at: 2026-07-23T05:01:30Z + +Reviewer run IDs: senior-engineering=/root/eng006_senior_arch_docs; QA/test=/root/eng006_qa_ci_tests; security/auth=/root/eng006_security_ops_reuse; product/ops=/root/eng006_security_ops_reuse; architecture=/root/eng006_senior_arch_docs; docs=/root/eng006_senior_arch_docs; CI-integrity=/root/eng006_qa_ci_tests; reuse/dedup=/root/eng006_security_ops_reuse; test-delta=/root/eng006_qa_ci_tests + +The `/root/eng006_*` values are durable runtime session identifiers inherited +from the available reviewer pool; they are not claims that WS-ENG-006 evidence +was reused. Each session was explicitly reassigned to review +`WS-ENG-007-PLAN`, and the mapping above records every track covered by that +exact initiative-specific task and reviewed SHA. + +## Reviewed Change + +- Defined deterministic reviewed-patch identity and conservative three-tree + reconciliation against exact current trusted `main`. +- Defined a closed repository-owned boundary graph and canonical reviewer-track + vocabulary for targeted invalidation. +- Defined structured finding predicates where `true` means resolved, `false` + means still valid, and `unknown` stales every track. +- Defined a versioned canonical finding-ID payload, immutable diagnostic-checker + identity, atomic linked-finding outcomes, and injected collision proof. +- Required byte-for-byte preservation of existing signed loop-memory behavior + while extracting one shared Git-evidence authority. +- Planned merge-group workflow parity without granting workflow code repository + setting or merge authority. +- Split implementation into three separately started, PR-sized chunks and kept + the initiative stopped. + +## Reviewer Results + +| Reviewer | Result | Blocking findings | Notes | +|---|---:|---|---| +| senior engineering | PASS AFTER FIXES | None | Confirmed deterministic identity, conservative invalidation, scope ownership, and operational rollback. | +| QA/test | PASS AFTER FIXES | None | Confirmed predicate truth semantics, adversarial matrices, exact-tree proof, and static/synthetic queue readiness. | +| security/auth | PASS AFTER FIXES | None | Confirmed fail-closed boundary handling, no human-approval reuse, and no workflow authority expansion. | +| product/ops | PASS | None | Confirmed human checkpoints and understandable invalidation reasons remain visible. | +| architecture | PASS AFTER FIXES | None | Confirmed one shared Git-evidence authority and byte-for-byte loop-memory parity. | +| CI integrity | PASS AFTER FIXES | None | Confirmed exact required-check parity, unchanged coverage floors, and no pre-enable hosted-event dependency. | +| docs | PASS AFTER FIXES | None | Confirmed the plan distinguishes internal track preservation from GitHub human approval. | +| reuse/dedup | PASS AFTER FIXES | None | Confirmed extraction of existing Git primitives instead of a second parser. | +| test delta | PASS | None | No tests changed; contracts prohibit skips, deselection, assertion weakening, or threshold reduction. | + +## Valid Findings Addressed + +- Replaced ambiguous patch application with canonical Git object manifests and + exact three-tree reconstruction. +- Closed special-file, rename, deletion, pruned-object, multiple-base, and + unsupported-object failure behavior. +- Replaced claimant-authored boundaries with a repository-owned closed graph + and exact canonical track identifiers. +- Closed finding identity and resolution-predicate semantics, including + reintroduction and ambiguity handling. +- Separated repository-side static/synthetic merge-group readiness from the + later authenticated human-admin enable, verify, and rollback checkpoint. +- Added explicit byte-for-byte signed loop-memory parity and independent + fail-closed consumer requirements. +- Narrowed every chunk to exact allowed paths and single ownership boundaries. +- Addressed all six CodeRabbit findings: canonical IDs, linked contradiction + outcomes, explicit merge-group synthetic verification, universal unknown + invalidation, immutable checker identity, and reviewer-session provenance. +- Reconciled exact GitHub combined head `da29deaf` (tree `1d66e04b`) with + trusted `main` at `73b45792`. The upstream AUTH-10B2 delta does not modify + WS-ENG-007 planning or merge-intent paths, the evidence checker, Git-tree + primitives, required workflows, or queue authority. All reviewer tracks + explicitly reapproved this combined head; fresh Backend CI remains required + for the already-merged AUTH runtime and test inputs. +- Replaced the slash-form finding schema version with the non-route literal + `workstream-review-finding-id-v1` after exact-head CI correctly rejected the + former text as a noncanonical API prefix; all reviewers reapproved the + mechanical change and the authorization documentation scan passes locally. + +## Commands Run + +```bash +git diff --check +python3 scripts/update_post_merge_memory.py validate-merge-intent --repository-root . --base-ref origin/main +python3 scripts/check_internal_review_evidence.py +python3 scripts/check_loop_memory_state.py +python3 scripts/test_agent_gates.py +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +``` + +The final results are recorded in the adjacent PR trust bundle after the two +evidence-only planning review files are added. + +## Remaining Risks + +- Conservative uncertainty can still force a full internal reviewer rerun. +- Merge-queue activation requires a distinct authenticated human-admin + checkpoint after chunk 03 merges. +- Each implementation chunk must independently prove its contract and cannot + reuse this planning review as implementation evidence. + +## Stop Condition + +The initiative remains stopped. `WS-ENG-007-01` requires the planning intake to +merge and then a separate explicit signed start on exact current `main`. diff --git a/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-PLAN-pr-trust-bundle.md b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-PLAN-pr-trust-bundle.md new file mode 100644 index 00000000..ed27efac --- /dev/null +++ b/.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-PLAN-pr-trust-bundle.md @@ -0,0 +1,81 @@ +# PR Trust Bundle: WS-ENG-007-PLAN + +## Goal + +Plan a deterministic way for concurrent PRs to preserve still-valid internal +agent review while always rerunning CI on the exact latest combined tree. + +## What Changed + +- Added intent, discovery, decisions, risks, plan, status, and a three-chunk + implementation map for concurrent PR review reconciliation. +- Added exact contracts for reviewed-patch/base-delta proof, finding and track + reconciliation, and merge-group CI parity. +- Added the one required merge intent naming `WS-ENG-007-01` as the same- + initiative successor behind a separate explicit start. + +## Design + +The design reconstructs and verifies an exact candidate tree from canonical Git +objects. A repository-owned boundary graph decides which internal reviewer +tracks an upstream delta can affect. Structured resolution predicates classify +findings as resolved, still valid, or unknown; uncertainty always invalidates. +Human GitHub approval is never preserved or automated by this mechanism. + +## Scope Control + +This is planning evidence only. It changes no runtime, workflow, test, +dependency, coverage threshold, branch protection, merge queue setting, signed +loop-memory generator, or authorization behavior. + +## Reviewer Results + +All nine required internal tracks passed exact planning commit +`da29deafd13b1f7fdacaf5aa32af2c26adeef0d0` after trusted AUTH-10B2 main head +`73b45792` was merged and all valid internal and CodeRabbit findings were +repaired. The only changes after that reviewed combined head are this trust +bundle and the adjacent internal-review record. No reviewer session remains +open. PR #187 itself changes no backend, test, workflow, or coverage file; the +combined tree contains already-merged AUTH tests that fresh exact-head Backend +CI must revalidate. + +## External Review + +CodeRabbit raised six actionable planning findings. All were accepted and +closed: versioned canonical finding identity, deterministic linked/contradiction +outcomes, an explicit merge-group synthetic test command, universal all-track +invalidation for unknown impact, immutable diagnostic-checker identity, and +initiative-specific explanation of inherited reviewer session IDs. Its PR- +description warning is addressed in the complete trust-bundle PR body. The +reported Checkov import failure is CodeRabbit tool-environment output, not a +repository check failure and not a reason to weaken or add repository CI. +The first repaired exact-head Agent Gates run then identified the slash-form +schema marker as a noncanonical API prefix. The marker is now route-neutral, +the stale authorization documentation scan passes, and all internal tracks +reapproved the exact repair. + +## CI Integrity And Test Delta + +No CI or test file changed. The plan explicitly preserves the repository-wide +78 percent and protected-subsystem 90 percent coverage floors and prohibits +skips, deselection, weakened assertions, or changed required-check semantics. + +## Remaining Risks + +- Unknown or ambiguous deltas deliberately rerun more reviewer tracks. +- Real merge-group evidence cannot exist until a human administrator enables + the queue after chunk 03; mismatch requires immediate disablement. +- The design has no effect until all separately reviewed chunks are implemented + and merged. + +## Human Review Focus + +Confirm that only internal agent review can be preserved, exact combined-tree +CI always reruns, overlap and uncertainty invalidate conservatively, and no +implementation starts from this planning PR. + +## Human Merge Ownership + +Only the user may approve and merge this PR. After merge, the initiative remains +stopped until the user explicitly starts `WS-ENG-007-01` through signed loop +memory on exact current `main`. diff --git a/.agent-loop/merge-intents/WS-ENG-007-PLAN.json b/.agent-loop/merge-intents/WS-ENG-007-PLAN.json new file mode 100644 index 00000000..0753c7ed --- /dev/null +++ b/.agent-loop/merge-intents/WS-ENG-007-PLAN.json @@ -0,0 +1,9 @@ +{ + "chunk_id": "WS-ENG-007-PLAN", + "chunk_title": "Concurrent PR Review Reconciliation Planning", + "initiative_id": "WS-ENG-007", + "next_chunk_id": "WS-ENG-007-01", + "next_chunk_title": "Reviewed Patch and Base-Delta Reconciliation", + "next_requires_explicit_start": true, + "schema_version": 2 +}