| Dispatched branch-plan-task self-reported local-preflight clean when 3 real gate findings existed |
During Task 6, a dispatched branch-plan-task subagent self-reported local preflight clean after landing commit e5f914c, but the orchestrating session's own actual re-run of .github/scripts/gitapex_gate_local_preflight.py found 3 real findings (an uncaught MemoryError on a yaml.safe_load call, a function-body-test-coverage gap, and an 11-line patch-coverage gap), fixed in commit 4f2aeee. A batched review-persona read confirmed skills/executing-a-branch-plan/scripts/gitapex_check_task_full_verification.py (the SubagentStop hook, issue #1476) already re-runs pytest and gitapex_gate_local_preflight.py mechanically, but only inside the task's own isolated worktree before that task self-reports complete -- never at Step 6's own main-thread merge-back point. skills/executing-a-branch-plan/references/threat-model-and-authorization.md (lines 416-443, 489-513) already discloses this as an open, unsolved gap for at least one dispatch variant. SKILL.md Step 6 mechanically re-checks the diff (review-persona) and commit messages (gitapex_check_task_commit_provenance.py) in the main thread, but never mechanically re-invokes gitapex_gate_local_preflight.py there, so a false self-report can only be caught by a human or orchestrator happening to re-run it directly. |
At executing-a-branch-plan Step 6's own main-thread merge-back point, mechanically re-invoke gitapex_gate_local_preflight.py against the merged task diff (not trust the dispatched task's own self-report) and fail loudly on any mismatch -- mirroring the precedent gitapex_check_task_commit_provenance.py already set for the same don't-trust-self-report, mechanically-re-verify principle in a different context (commit-message provenance). |
implementing PR adds the check plus a regression test; confirm it fails against a reintroduced instance of the original defect, then passes |
Needs to define what counts as a mismatch worth blocking merge-back on, versus an environment-specific local-preflight difference (e.g. a tool unavailable in the task's own isolated worktree) that is not itself a real defect. |
Refs #2001
Dedup-sweep: 125 open gate-proposal issues at 2026-09-14T03:57:29Z; verdict NEW