feat\(pr-pipeline\): stop gating any step on work class \(owner Q85\) - part 2 of 2 #10237

Activity

1. melodic-automation-lanes

   added the

   Task

   issue type on Oct 26, 2026
2. melodic-automation-lanes

   added a parent issue on Oct 26, 2026

   • feat(pr-pipeline): stop gating any step on work class (owner Q85) #9668
3. melodic-automation-lanes

   marked this as blocked on Oct 26, 2026

   • feat\(pr-pipeline\): stop gating any step on work class \(owner Q85\) - part 1 of 2 #10236
4. melodic-automation-lanes

   marked this as blocking on Oct 26, 2026

   • test(work-items): run the new work-loop and attend-queue evals and a live C3 check #7226
5. github-actions

   added

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 26, 2026
6. github-actions commented on Oct 26, 2026

   

   github-actionsBot

   on Oct 26, 2026 – with GitHub Actions

   Last edited by melodic-automation-lanes

   Contributor

   More actions

   Proposed work class: work-class: scoped
   Basis: automated intake triage; the lanes App applied this class.

   Size: Medium
   Complexity: Medium
   Uncertainty: Known
   Flags: none
   Blocked by: none

   Understood: this is part 2 of 2 of #9668. It removes every read that refuses, holds, escalates or routes on a work class under .github, the babysit-prs scripts and plugins/work-items. It also adds test cases for each former gate, showing that a class-less issue or PR and a structural one both pass. The done-when is concrete and checkable by grep and the named test suites. Related: #9668 (the parent) and #10236 (part 1 of 2). I could not tell from the issue whether part 1 must land first, so I listed no blocker.

   _{Automated triage, applied by the lanes App.}
7. github-actions

   added

   priority: mediumReal value, no hard deadline; normal backlog flow.Real value, no hard deadline; normal backlog flow.

   and removed

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 26, 2026
8. melodic-automation-lanes

   added

   status: readyTriaged, unblocked, and fully specified; eligible to pick up.Triaged, unblocked, and fully specified; eligible to pick up.

   work-class: scopedA briefed fix or small feature; blast radius bounded by the brief, tests exist.A briefed fix or small feature; blast radius bounded by the brief, tests exist.

   on Oct 26, 2026
9. melodic-automation-lanes commented on Oct 26, 2026

   

   melodic-automation-lanesBot

   on Oct 26, 2026

   ContributorAuthor

   More actions

   Not admitted to the issue lane yet: blocker #10236 is not closed by a listed human or a merge.
10. melodic-automation-lanes

    added

    agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.Fully specified and briefed; eligible for autonomous pickup from the frontier.

    needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

    and removed

    agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.Fully specified and briefed; eligible for autonomous pickup from the frontier.

    on Oct 29, 2026
11. melodic-automation-lanes commented on Oct 29, 2026

    

    melodic-automation-lanesBot

    on Oct 29, 2026

    ContributorAuthor

    More actions

    The work-resolve-issue lane did not start this issue: it needs a person to make it clearer first.

    Why, in the run's own words:

    Part 2 of ＃9668 is now only the work-items plugin, and the issue doesn't say what replaces its class-based admission. The .github lanes and the babysit-prs merge policy already gate nothing on class except work-class: untrusted-provenance (admit.mjs, apply-verdict.mjs, report-outcome.mjs, babysit_merge_policy.py LANE_CLASS = C2). In plugins/work-items, by contrast, class is the admission model: the work-loop 'Admission gate (work-class, fail-closed)' table (C1/C2 autonomous, C3 bug-fix needs first-drain ratification, C3 feature/C4/C5/unclassified human-gated), rule-admit.sh (admits only C1/C2 admission.rule_admission rules matched against admission.rules by work_class), the list-frontier --autonomous floor on work-class: structural/untrusted-provenance (labels.sh WIT_HUMAN_FLOOR_WORK_CLASS_LABELS, frontier.sh), the attend-queue 'reclassify or stay gated' transition, and labeler provenance over the work-class label. A person needs to decide: (1) Does the plugin keep the work-class: untrusted-provenance / provenance: signal hold the .github side kept, even though the done-when says no read may hold on a class? (2) What does the work-loop admission gate admit once the class table is gone? Is it every agent-ready item that passes the labeler and path/topic hard gates, and is first-drain C3 ratification (and its kind=ratify-c3 queue in attend-queue) dropped? (3) Is rule-admit.sh, together with its binding schema (admission.rules, admission.rule_admission) and the label it writes, deleted or reworked, and if reworked, keyed on what? (4) Does this extend to the autonomy plugin's guardrails/work-classes.md and admission-policy.md, which work-loop defers to? They sit outside the done-when grep. (5) This changes what every consumer of the published work-items plugin admits autonomously. Is that a breaking release, and does the owner Q85 decision (scoped pr-pipeline) cover consumer repositories or only this repository's lanes?

    What the run says it did not do:

    • No edits were made, so tidy, review, build/test and lint did not run: the run stopped at the open decisions above before any edit.

    Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/40810743064

    To retry, answer the question in a comment whose first line is **Decision recorded.**, then remove needs-human and add agent-ready again.
12. kyle-sexton commented on Oct 29, 2026

    

    kyle-sexton

    on Oct 29, 2026

    Member

    More actions

    Re-triage: the hold stays, narrowed to one question. This replaces the five questions from run 40810743064. Four of them are already settled, and one is the owner's.

    What is done. In this repository's pipeline, nothing gates on work class except untrusted-provenance. git grep -n -i -E "work-class|workClass|work_class|lane_class" origin/main -- .github plugins/source-control/skills/babysit-prs/scripts on 2026-10-29 (288f01b), with test files and .md lines left out, finds only these:

    • the untrusted-provenance checks (admit.mjs:132,634, apply-verdict.mjs:226, check-blockers.mjs:7, report-outcome.mjs:177, label-unblocked.mjs:266, babysit_merge_policy.py:103);
    • the class label being applied or reported (apply-verdict.mjs:213-224,514, babysit_merge_policy.py:1723-1724, "Reported as workClass only; nothing decides on it");
    • LANE_CLASS, a failure class rather than a work class (report-check-run.mjs:103, babysit_merge_policy.py:3174);
    • the unread classes key in admission-rules.json:6.

    Part 1, #10236, closed 2026-10-29.

    Settled without the owner

    1. The plugins keep the untrusted-provenance hold. The #9668 decision record says it "stays as a label check everywhere it runs today". The owner's pr-merge decision (#9668) says: "The untrusted-provenance hold stays as a trust gate."
    2. and 3. If the plugins are in scope, these follow from feat(pr-pipeline): stop gating any step on work class (owner Q85) #9668's Fix line, "No step refuses, holds, escalates or routes an issue or pull request by its work class or by a missing one":
       • work-loop admits whatever passes its other hard gates;
       • the C3 first-drain ratification and its kind=ratify-c3 queue go;
       • rule-admit.sh stops matching on work_class;
       • the frontier floor keeps only untrusted-provenance.
    3. If the plugins are in scope, the autonomy plugin's guardrails/work-classes.md and admission-policy.md are in scope too, because work-loop defers to them.

    Q1. Does owner decision Q85 extend to the published work-items and autonomy plugins, or only to this repository's pipeline?

    The case for extending: the #9668 body, posted from the owner's account, names the plugin in its Problem: "and the work-items tracker frontier and rule-admit". Its done-when grep includes plugins/work-items. Q85's words are (#9668):

    the work class: nothing. There's no filtering or further processing with PRs, reviews, and blocks ... I don't think work class needs to be a gate right now. We can always come back in and change our minds.

    The case against: no lane in this repository runs the plugins' admission.

    • docs/conventions/work-items.yaml sets only ai_disclaimer.
    • rule-admit.sh needs a security binding with admission.rule_admission (rule-admit.sh:6-7), and none was found on the WSL host. Whether one exists on other fleet hosts is UNVERIFIED.

    So the remaining change would alter only what consumer repositories admit unattended. Those repositories may lack this repository's other gates: the merge floor, the security review lane and pr-verify.

    • (a) Extend. Rewrite this issue's done-when to cover:

      • work-loop's admission gate, C3 ratification and attend-queue's reclassify transition;
      • rule-admit.sh and its binding schema;
      • labels.sh WIT_HUMAN_FLOOR_WORK_CLASS_LABELS (structural removed, untrusted-provenance kept) and frontier.sh;
      • the autonomy plugin's work-classes.md and admission-policy.md;
      • their evals;
      • a major version bump for both plugins.

      The pipeline and the plugins then share one admission model. Consumers lose a fail-closed gate.

    • (b) This repository only. RECOMMENDED. Close this issue as completed, and amend feat(pr-pipeline): stop gating any step on work class (owner Q85) #9668 to drop plugins/work-items from its scope. The plugins keep their class model for consumers. Basis: the facts above. No lane here runs plugin admission, so (a) changes behavior only for consumers, and in a way that loosens an unattended gate. The .github and pr-merge parts of Q85 are done.

    • (c) Make it configurable. Keep the plugins' class gate as the default and add a setting that turns it off. This adds a mechanism that nothing uses today, because no lane here runs the plugins' admission.

    Answering Q1 unblocks this issue: (b) closes it, and (a) releases it to the issue lane with the rewritten done-when.
13. kyle-sexton commented on Oct 29, 2026

    

    kyle-sexton

    on Oct 29, 2026

    Member

    More actions

    Re-triage: closing as not planned. The scope question in #10237 (comment) is decided on the evidence and the owner's stated direction, option (b): owner decision Q85 (no work-class gate at admission) governs the automation factory, not the published work-items and autonomy plugins.

    Basis:

    • The factory's admission is this repository's .github lanes. admit.mjs already gates on no work class except work-class: untrusted-provenance, and the review and merge lanes gate on none (the lane's own finding on this issue, run 40810743064). Part 2's .github and pr-merge share is done.
    • The owner's direction is that the factory's workflows will be generalized into ci-workflows and applied to every repository in the organization. Repositories join through those lanes, which carry Q85 with them.
    • The published plugins' class-based admission (work-loop, rule-admit.sh, the autonomy plugin's work-class policy) serves repositories outside the factory. No lane here runs it: docs/conventions/work-items.yaml sets only ai_disclaimer. Removing its gate would loosen an unattended fail-closed gate for those consumers, possibly without the factory's merge floor, security lane and pr-verify, and gain nothing for the factory.

    So nothing is left to build here. #9668's scope is amended to match: plugins/work-items is out.

    To reverse: reopen with the consumer case that needs the plugins' admission to drop class gating, and give the plugins a configurable gate (work-items setting) rather than removing it.
14. kyle-sexton

    closed this as not plannedon Oct 29, 2026