Repository navigation
pr-pipeline: harden issue-lane admission after the ratification marker #7612
Description
Summary
Hardening left open after #7610 (issue-lane admission by owner ratification marker). None blocks that PR; each narrows a path a write-access user could use.
Items
- Same-second edit. The marker counts only when
updated_at === created_at. An edit within the same second as the post passes. Comparing GraphQLlastEditedAt == nullcloses it. - Lookalike-Unicode work-class labels. The held-class refusal matches
/^work-class\s*:/i; a label using lookalike characters slips it. Only a write user can create such a label. Normalize (NFKC plus confusable folding) or refuse any label whose folded form matches. - Who applied a work-class label. Class labels are read from the issue payload without checking who applied them (D31). Checking needs timeline reads for the
labeledactor. - Run token and comments. Whether the issue lane's run token can list issue comments is unverified; if it cannot, admission fails closed. Confirm on the first live admission run and record it.
Done when
- Items 1-3 each have a test that fails before its fix and passes after.
- Item 4 records the first live run's result in this issue.
Out of scope
- Changing who may ratify (listed humans only, D33).
🤖 Generated with Claude Code
Activity
github-actions commentedon Oct 16, 2026
Thanks for the report. Automated triage handed this issue to a maintainer.
Proposed work class: work-class: scoped
Basis: automated intake triage; a maintainer confirms or changes it.
Automated triage. A maintainer reviews it.
kyle-sexton commentedon Oct 16, 2026
Two more from the #7610 local code review:
5.
report-outcome.mjsmatches held classes exactly; apply the same case- and space-normalized refusal aspredicate.mjs(predates #7610).6.
predicate.mjsrefuses held classes under normalized matching but admits only an exact allowed class label. It fails closed today; decide whether admission should normalize too.🤖 Generated with Claude Code
kyle-sexton commentedon Oct 22, 2026
Decision recorded.
Question: Close admission hardening after the ratification marker as obsolete?
Answer: Owner, 2026-10-22, Issue Triage session: "Go with recommendations ... My focus right now is getting the intake, admit, build, refine, review, fix, verify, merge, and post-merge lanes ... working flawlessly as just a continuous conveyor belt." The owner delegated the open calls to the lane within that focus.
Decision: close as obsolete. #7780 removed the ratification marker (
git ls-files | grep ratification.mjsreturns nothing; admission is theagent-readylabel alone), so items 1 and 4 no longer apply. Items 2, 3, 5 and 6 (label-normalization restrictions) fold into #7531, as #7784 was. Reopen if the marker returns.