Require CI and Codex review before merging into main #237

Activity

1. HemSoft

   added

   bugSomething isn't workingSomething isn't working

   source:repo-auditCreated from a repository auditCreated from a repository audit

   action-itemActionable work requiring explicit selection or assignmentActionable work requiring explicit selection or assignment

   on Oct 21, 2026
2. HemSoft

   added 4 commits that reference this issue on Oct 23, 2026

   fix: revalidate review evidence and gate test merge revisions (#237)

   c343cb2

   fix: defer review status during trusted-main bootstrap (#237)

   785b19d

   fix: reject malformed review summaries and unrelated triggers (#237)

   7b2cb47

   fix: authenticate review mutations and preserve revocations (#237)

   5b539c4
3. HemSoft commented on Oct 23, 2026

   

   HemSoft

   on Oct 23, 2026

   CollaboratorAuthor

   More actions

   Deferred until the SFL reviewer goes live; required review status will come from the SFL App, not a per-repo App.
4. HemSoft

   added

   blockedBlocked on an external dependency or maintainer decisionBlocked on an external dependency or maintainer decision

   on Oct 23, 2026
5. HemSoft commented on Oct 23, 2026

   

   HemSoft

   on Oct 23, 2026

   CollaboratorAuthor

   More actions

   Deferred by the Chief for subscription pacing; resumes when Codex recovers
6. HemSoft commented on Oct 27, 2026

   

   HemSoft

   on Oct 27, 2026

   CollaboratorAuthor

   More actions

   Maintainer decision from the Chief, under repository autonomy, supplied by Franz for this work on 2026-10-27:

   • Require the exact current CI contexts on main: build, security-scan, rust (ubuntu-latest), rust (windows-latest), rust (macos-latest), rust-metrics, and rust-mutations. These all succeeded in main CI run 40586766568.
   • Require branches to be up to date. Keep conversation resolution and admin enforcement, force-push/deletion restrictions, and all other existing protection settings. Add an active repository ruleset with no bypass actors alongside the existing legacy protection.
   • Require zero approving reviews. HemSoft is the sole human maintainer and Codex uses COMMENTED reviews, so an approval count would deadlock normal merges.
   • Add a trusted workflow that publishes Current-head Codex Review from the full-SHA Codex v1 review summary. It must reject missing, stale, running, or finding-bearing reviews and unresolved conversations. Activate this requirement after the workflow lands and prove it on a throwaway PR. No admin bypass is authorized.
   • Keep path-filtered Package checks conditional. They are required by the maintainer's merge process when triggered, but cannot be unconditional required contexts because unrelated PRs do not start them.
   • Land workflow changes through a reviewed PR with current-head Codex evidence and a Claude audit, then use a guarded merge. Test failed/missing and green required checks without merging the throwaway PR.

   This supersedes the old SFL and subscription-pacing deferrals. Implementation and live enforcement evidence will follow here before closure.
7. HemSoft

   removed

   blockedBlocked on an external dependency or maintainer decisionBlocked on an external dependency or maintainer decision

   on Oct 27, 2026
8. HemSoft commented on Oct 27, 2026

   

   HemSoft

   on Oct 27, 2026

   CollaboratorAuthor

   More actions

   Review-gate implementation decision after examining the prior attempt #250, its Codex findings and Claude audit, and gh-x's current verifier: use the maintainer's explicitly authorized documented-process option for current-head Codex review.

   This supersedes the proposed automated-review-status bullet in the earlier decision comment. A reliable independent status would need an isolated publisher identity plus authenticated mutable evidence and head/test-merge attribution. The prior audit proved that PR-controlled review workflows could self-certify under the shared Actions identity, and that trusting a bot comment author did not authenticate collaborator edits/deletions. Copying gh-x's receipt parser does not resolve these trust boundaries. No App or secret is installed, and no weak check is called a reliable review gate.

   The active ruleset 26000153 already requires all seven real CI contexts, strict up-to-date branches, zero approvals, conversation resolution, and no bypass actors. Existing legacy admin enforcement remains unchanged. The documentation PR will make the review-process distinction explicit, including current-head receipts, stale review handling, one hung-review retry, clean Claude fallback, conditional Package qualification, and expected-head guarded merges. A green GitHub box does not authorize a merge without that review evidence.

   The throwaway PR will verify GitHub's missing/failing/green CI behavior. Review enforcement will be demonstrated honestly as a process refusal before clean current-head evidence, not misrepresented as a server-side approval requirement.
9. HemSoft

   added a commit that references this issue on Oct 27, 2026

   test: demonstrate fail required checks (#237)

   3b97a1b
10. HemSoft commented on Oct 27, 2026

    

    HemSoft

    on Oct 27, 2026

    CollaboratorAuthor

    More actions

    Live negative qualification on throwaway PR #287, head a6ed15a3ea14ab748e6168fb1fa7f3d260f91fe5:

    • The commit used [skip ci], so statusCheckRollup was empty. GitHub reported mergeable: MERGEABLE but mergeStateStatus: BLOCKED.
    • An actual expected-head PUT /repos/hemsoft-dev/codexbar/pulls/287/merge as administrator HemSoft was rejected with HTTP 405: Repository rule violations found, 7 of 7 required status checks are expected. The PR stayed open and main did not move.
    • The same snapshot had no Codex review or clean receipt. The documented review process refused readiness. This is process enforcement; the HTTP 405 above is proof of native CI enforcement, not a native Codex requirement.
    • The next head, 3b97a1b952fa5f8ac1834d2e84d07729d40768af, intentionally starts its document with H2 and must fail the real build job's Markdown lint. Its CI is running. After that rejection is recorded, the document will be fixed and genuinely green CI verified. The throwaway PR will be closed without merging.

    Policy PR #286 records the versioned ruleset and review process. It will not close this issue automatically; closure follows completed live proof and guarded merge.
11. HemSoft commented on Oct 27, 2026

    

    HemSoft

    on Oct 27, 2026

    CollaboratorAuthor

    More actions

    The failing-check test also passes. On throwaway PR #287, head 3b97a1b952fa5f8ac1834d2e84d07729d40768af, the real build job failed in Markdown Lint:

    docs/merge-protection-probe.md:1 error MD041/first-line-heading/first-line-h1
    First line in a file should be a top-level heading
    [Context: "## Intentional lint failure"]
    Process completed with exit code 1.
    

    An actual expected-head merge request as administrator HemSoft returned HTTP 405:

    Repository rule violations found
    6 of 7 required status checks have not succeeded: 1 failing.
    

    GitHub reports the PR as MERGEABLE but BLOCKED. Main remains unchanged. The next commit restores H1 so all seven real checks can qualify. No failing commit will be merged.
12. HemSoft

    added a commit that references this issue on Oct 27, 2026

    test: demonstrate green required checks (#237)

    aa10398
13. HemSoft commented on Oct 28, 2026

    

    HemSoft

    on Oct 28, 2026

    CollaboratorAuthor

    More actions

    Addressed all three findings from the additional Claude audit in commit 39854b7:

    • Apply author/editor and complete edit-history authentication to every review artifact, including legacy Codex receipts and delegated Claude comments/review bodies. Require the fallback receipt to match the actual delegated audit result and revisions.
    • Rename the versioned and live ruleset to Main required CI, so it accurately describes native enforcement. A GET verifies the name; all rules, bypass actors, conditions, enforcement, and legacy protection are unchanged.
    • Link the later process-selection decision and explicitly state that it supersedes the earlier proposed status-workflow bullet.

    Markdown lint and git diff --check pass. The policy PR's new head is 39854b74f0a8809b27a7bc353b633536ffe129c5; fresh Codex review and CI are required. Claude's three threads remain unresolved until the fixes receive clean current-head review. No previous-head clean result is reused.

    The throwaway PR's current head remains aa103989b537c6a1f152f464f677752a3b26afe3, with clean Codex and five green CI checks; strict metrics and macOS are still pending. Native missing/failed merge refusals are already recorded above.
14. HemSoft commented on Oct 28, 2026

    

    HemSoft

    on Oct 28, 2026

    CollaboratorAuthor

    More actions

    Live qualification of throwaway PR #287 is complete on head aa103989b537c6a1f152f464f677752a3b26afe3.

    All seven genuine required contexts passed in CI run 40604401744: build, security-scan, rust (ubuntu-latest), rust (windows-latest), rust (macos-latest), rust-metrics, and rust-mutations. GitHub now reports mergeable: MERGEABLE and mergeStateStatus: CLEAN, with zero approving reviews. No Package job was triggered for this unrelated document.

    The current-head Codex summary is completed, names the full current SHA, and has both findings flags false. GraphQL authenticated the author and editor as the connector Bot; every edit was by that Bot, no edit record was deleted or truncated, and there are zero unresolved review threads. This satisfies the documented review process.

    The same ruleset previously refused actual administrator merges for missing required checks and a failing real build check, both HTTP 405. With real checks green, GitHub allows merging. This positive check reads GitHub's native merge eligibility; the throwaway PR will be closed without merging as planned.

    The active ruleset has zero approvals, no bypass actors, strict up-to-date checks and conversation resolution. Legacy protection remains unchanged. Policy PR #286 still needs clean reviews on its latest fix head and all current-head CI before its guarded merge. Issue #237 stays open until that finishes.
15. HemSoft

    added a commit that references this issue on Oct 28, 2026

    fix: require CI and current-head Codex review process (#286)

    ...

    990854a
16. HemSoft commented on Oct 28, 2026

    

    HemSoft

    on Oct 28, 2026

    CollaboratorAuthor

    More actions

    Completed in PR #286, guarded squash merge 990854aa4c980ef716445cb5c63d90ed1eedc799 at 21:09 EDT on 2026-10-27. The merge pinned reviewed head 39854b74f0a8809b27a7bc353b633536ffe129c5, with no approval, auto-merge, or admin bypass.

    The active Main required CI ruleset now requires the seven exact GitHub Actions contexts from recent main runs: build, security-scan, rust (ubuntu-latest), rust (windows-latest), rust (macos-latest), rust-metrics, and rust-mutations. They are bound to Actions app 15368, with strict up-to-date enforcement, a PR, conversation resolution, zero required approvals, and no bypass actors. Final live GETs match every versioned field. Legacy protection is unchanged as parsed JSON from the before-change response, including admin enforcement, conversation resolution, and disabled force pushes/deletion. No parent rulesets apply.

    The maintainer's process-selection decision is recorded in the merged policy and AGENTS.md. Codex review is required by the documented merge process, not a GitHub approval or status. The policy requires exact-head clean evidence, authentication and complete edit history for every evidence type, stale-head requalification, one hung-review retry then Claude fallback, resolved threads, and an expected-head guarded merge. Conditional Package jobs must pass when triggered; they are not unconditional missing contexts. No new review App or workflow was installed.

    Live proof used throwaway PR #287, closed without merging:

    • Missing checks: actual administrator merge rejected HTTP 405, 7 of 7 required status checks are expected.
    • Failing check: real build failed Markdown lint; actual administrator merge rejected HTTP 405 with 1 failing.
    • Green checks: all seven real checks passed, including macOS, Windows, strict metrics and security, in run 40604401744. GitHub reported CLEAN and MERGEABLE with zero approvals, authenticated clean current-head Codex, and zero unresolved threads. The test branch was removed.
    • The successful guarded merge of PR fix: require CI and current-head Codex review process #286 additionally proves that this policy allows a fully qualified real PR to merge. Missing Codex evidence was handled as a process refusal, not misrepresented as a server-side requirement.

    Merge-head validation is complete: CI run 40605909009 passed all seven jobs on 39854b74f0a8809b27a7bc353b633536ffe129c5. Codex and Claude Opus 5.5 xhigh recheck are clean on that exact head. All three Claude findings were fixed in 39854b7, replied to with the fixing commit, and formally resolved before merging. The final authentication check verified authors, editors and complete undeleted edit histories; zero unresolved threads remained.

    Local cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, cargo test --workspace --locked, Markdown lint, and git diff --check passed. No Rust product, retired C#, dependency, or workflow files changed. Final main verification confirms the ruleset and policy files landed unchanged at 990854a.

    Closing #237 with all requested implementation, review, native CI qualification and guarded-merge evidence complete.
17. HemSoft

    closed this as completedon Oct 28, 2026