pr-pipeline: review-lane hold follow-ups from the #9361 security review #9369

Activity

1. github-actions

   added

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 23, 2026
2. github-actions commented on Oct 23, 2026

   

   github-actionsBot

   on Oct 23, 2026 – with GitHub Actions

   Last edited by melodic-automation-lanes

   Contributor

   More actions

   Proposed work class: work-class: scoped
   Basis: automated intake triage; the lanes App applied this class.

   Size: Medium
   Complexity: Medium
   Uncertainty: Known
   Flags: none
   Blocked by: none

   Decision recorded. The owner answered in the Refinement and Issue Triage sessions (2026-10-25), deciding the open items below on the facts:

   go with whatever the facts/data/metrics + /discovery:research says and ensure we're aligned with SOLID, DRY/SSOT principles

   [quote truncated; the full decision is at the link]

   #9369 (comment)

   The decision settles every open question: per-PR run-name matching (item 1), kill-switch pass only when read as on and a trusted person authored the PR (2), no change to hold-paths (3), exemption only when all commits are exempt (4), and a literal needs-human check (5). Item 6 is confirmed later from run history; an unattended run can't do that, so the other items are triaged as usual. No duplicates found.

   _{Automated triage, applied by the lanes App.}
3. github-actions

   added

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   and removed

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 23, 2026
4. github-actions

   added the

   Task

   issue type on Oct 23, 2026
5. melodic-automation-lanes

   added

   status: needs-decisionAwaiting a human or maintainer judgment call.Awaiting a human or maintainer judgment call.

   on Oct 23, 2026
6. kyle-sexton commented on Oct 26, 2026

   

   kyle-sexton

   on Oct 26, 2026

   MemberAuthor

   More actions

   Decision recorded. The owner answered in the Refinement and Issue Triage sessions (2026-10-25), deciding the open items below on the facts:

   go with whatever the facts/data/metrics + /discovery:research says and ensure we're aligned with SOLID, DRY/SSOT principles

   I should only ever be in the loop ONLY when necessary (intent/vision changed, something came up during implementation that impacts trajectory/alignment, OR a high security risk) - I've covered this all before

   No owner ledger (.work/*/interview-checklist.md, .work/gh-monitor-owner-decisions/) names this issue. No ledger entry for OD-8 or for a Q48 about hold-paths was found; the Q48 rows in .work/*/interview-checklist.md are on other subjects. Every item below tightens a gate or leaves it as is; none widens one. The review rated each MEDIUM or LOW.

   1. Item 1: review runs matched to a PR by head SHA only.
      Decided: Give both review callers a run-name carrying the PR number, and have both readers keep only runs whose display_title names this PR. Both readers still pick by head_sha alone: ci-status (.github/workflows/pr-require-checks.yml:4217, :4297-4299) and rerun-ci-status (.github/workflows/pr-feedback-dispatch.yml:335, :472-481). The pr-unblock dispatchers already match runs by display_title (.github/scripts/pr-unblock/fix-docs-dispatch.mjs:210), so this reuses that pattern.
   2. Item 2: the kill switch's pass.
      Decided: A lane stopped by a kill switch passes only on a PR a trusted person authored, and only when the switch was read as on, not when check-kill-switch failed closed on an unreadable variable. Today a stop counts on the report step's notice (pr-require-checks.yml:4212-4213), and the report step runs whenever proceed is not true (.github/workflows/pr-review-hosted.yml:125, :151-157). Of the body's two options this is the narrower one: pr-merge is unchanged and a person's PRs still merge; only agent-authored PRs wait for a review, which is the gap the body names ("a review-only stop leaves agent PRs merging with no AI review"). The pr-merge-refuses option also stops merges of PRs a person wrote, so it is not taken. OD-8's own text was not found in this repository or .work/; the body reports it chose no merge freeze, and neither part of this decision freezes pr-merge.
   3. Item 3: the gate runs from the PR's own copy of its workflows.
      Decided: No change. hold-paths "never holds by itself" (pr-review-hosted.yml:197); adding files to it only adds review scrutiny. A rewritten gate reaches a merge only through a PR pr-merge lists, which is a lanes App, trusted-actor or Dependabot PR (.github/workflows/pr-merge.yml:620-627), and a lane patch cannot touch .github/workflows/**: every patch row refuses github-workflows (.github/actions/resolve-config/patch-rules.json:3, :14, :24, :35, :54, :64).
   4. Item 4: an exempt author's PR after a pushed fix.
      Decided: ci-status exempts a PR from the review requirement by author only when every commit on it is authored by an exempt account. Today the check reads only the PR author's id (pr-require-checks.yml:4230, :4248). This keeps fix-ci working on those PRs and makes the review wait once an agent commit lands. The review lanes do run after such a push: they skip a [bot] sender only when its id is not in allowed-bot-sender-ids, which holds the lanes App (pr-review-hosted.yml:16-18, :183), so the wait ends.
   5. Item 5: hold label name divergence.
      Decided: ci-status also fails on the literal needs-human label, besides the tracker's human-gated label. The callers hardcode hold-label: needs-human (pr-review-hosted.yml:199), and ci-status reads the tracker value (pr-require-checks.yml:4023-4034). A workflow with: cannot read the tracker file, so the literal check is the smaller change.
   6. Item 6: the rerun listener unproven live.
      Decided: Check it from run history, as a criterion below. Basis: the body says rerun-ci-status runs from main, so the PR that added it could not exercise it.

   Build: host session (every item but 6 edits .github/workflows/**, which lane patches refuse, .github/actions/resolve-config/patch-rules.json:64).

   Acceptance criteria:

   • Both review callers set a run-name with the PR number, and ci-status's review-lane step and rerun-ci-status count only runs whose display_title names this PR; a test shows a second PR's review on the same head SHA is not counted.
   • A kill-switch stop counts as a pass only when the switch was read as on and a trusted person authored the PR; a test shows an unreadable switch and an agent-authored PR both fail.
   • The author exemption applies only when every commit on the PR is authored by an exempt account; a test shows an exempt PR with a lanes App commit needs both review lanes.
   • ci-status fails on a needs-human label even when the tracker names a different human-gated label; a test covers it.
   • The PR links one pr-feedback-dispatch.yml run whose rerun-ci-status job re-ran ci-status on a PR after a review run completed.

   Builder: the Automation Lanes session builds this from the owner's machine, because the fix edits .github/workflows, which the lanes App cannot push. agent-ready stays off so the issue lane does not race the build.
7. kyle-sexton

   added

   status: confirmedA maintainer confirmed the item is real and in scope; ready to be worked.A maintainer confirmed the item is real and in scope; ready to be worked.

   and removed

   status: needs-decisionAwaiting a human or maintainer judgment call.Awaiting a human or maintainer judgment call.

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   on Oct 26, 2026
8. kyle-sexton commented on Oct 26, 2026

   

   kyle-sexton

   on Oct 26, 2026

   MemberAuthor

   More actions

   Released for re-triage under the owner's 2026-10-26 rule: a person is involved only for "1. A change in original intent/vision 2. Something comes up during implementation ... that alters intent/vision or the primary design 3. If there is a HIGH/CRITICAL security issue". None applies here, so the hold label came off and intake triage runs again now.

   To hold this issue again, add needs-human (or status: needs-decision) and name which of the three applies.
9. github-actions

   added

   priority: mediumReal value, no hard deadline; normal backlog flow.Real value, no hard deadline; normal backlog flow.

   on Oct 26, 2026
10. melodic-automation-lanes

    added

    status: readyTriaged, unblocked, and fully specified; eligible to pick up.Triaged, unblocked, and fully specified; eligible to pick up.

    admission-deferred

    needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

    on Oct 26, 2026
11. melodic-automation-lanes commented on Oct 26, 2026

    

    melodic-automation-lanesBot

    on Oct 26, 2026

    Contributor

    More actions

    Refinement. A read-only run explored this repository, searched its issues and pull requests, and read the allowed docs to draft what follows. On an issue a listed human filed, it counts as the issue's spec once posted, while unedited; it is still model text, so check it.

    Intended outcome: Tighten the review-lane gate so reviews are matched per PR, kill-switch stops and author exemptions pass only on safe cases, and the needs-human label always holds, per the owner's recorded decision on items 1, 2, 4 and 5.

    Acceptance criteria

    • Both review callers set a run-name containing the PR number, and ci-status's review-lane step (pr-require-checks.yml) and rerun-ci-status (pr-feedback-dispatch.yml) count only runs whose display_title names this PR.
    • A test shows a second PR's review run on the same head SHA is not counted for this PR.
    • A kill-switch stop counts as a lane pass only when the switch was read as on and a trusted person authored the PR.
    • A test shows an unreadable kill switch (check-kill-switch failed closed) fails the lane, and an agent-authored PR with a stopped lane also fails.
    • The author exemption from the review requirement applies only when every commit on the PR is authored by an exempt account.
    • A test shows an exempt-author PR carrying a lanes App commit needs both review lanes.
    • ci-status fails on a needs-human label even when .work-item-tracker.json names a different human-gated label, and a test covers it.
    • Item 3 (hold-paths and default-branch gate code) is left unchanged, and pr-merge.yml is not changed.
    • The PR links one pr-feedback-dispatch.yml run whose rerun-ci-status job re-ran ci-status on a PR after a review run completed (item 6, from run history).

    Dependencies

    • Host session build: every edit is under .github/workflows/**, which lane patches refuse (patch-rules.json:64), so the Automation Lanes session builds it with agent-ready off.
    • Item 6 waits on a real pr-feedback-dispatch.yml run after the run-name change merges; the unattended run cannot verify it live.

    Related work

    • feat(pr-pipeline): turn on review-lane holds and require both review lanes in ci-status #9361 (related): PR that added review-lane holds; this issue is its security-review follow-up.
    • fix(pr-pipeline): ci-status rejects a review lane's no-change skip after a base merge #9822 (related): Another ci-status review-lane requirement fix in the same step.
    • pr-pipeline: re-run the review lanes on lane-source-changed instead of labeling needs-human #10076 (related): Touches the same review-lane rerun and hold behavior.
    • pr-pipeline: harden the lane-escalation gate for address-feedback #9419 (related): Sibling hardening of lane gates in pr-pipeline.

    Sources read

    • /home/runner/work/_temp/refine-data/context.json: the owner's Decision recorded comment fixes the approach for items 1, 2, 4 and 5, leaves item 3 unchanged, and checks item 6 from run history.
    • .base/.github/workflows: only pr-refine.yml, work-resolve-issue.yml and pr-unblock.yml use run-name or display_title, so the review callers have no PR-numbered run-name yet.

    _{Automated refinement by the lanes App. Intake triages the issue again with it.}
12. github-actions

    removed

    needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

    on Oct 26, 2026
13. melodic-automation-lanes

    added

    work-class: scopedA briefed fix or small feature; blast radius bounded by the brief, tests exist.A briefed fix or small feature; blast radius bounded by the brief, tests exist.

    on Oct 26, 2026
14. melodic-software-github-iac

    removed

    admission-deferred

    on Oct 26, 2026