From 420fa353850bb8fd9591c329f6f1a8edf1ef4435 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 1 Aug 2026 20:56:38 +0000 Subject: [PATCH 1/3] build(deps): bump github/gh-aw-actions/setup from 0.82.14 to 0.84.0 Bumps [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) from 0.82.14 to 0.84.0. - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/gh-aw-actions/compare/b6d1443e05b8716267fa19425b99aa4f12006b4a...f3ca20900e2363607992fb61b46fc687d4b56ba3) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.84.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/canonical-pr-remediator.lock.yml | 12 ++++++------ .../workflows/eventrelay-ci-investigator.lock.yml | 14 +++++++------- .../workflows/focused-coverage-controller.lock.yml | 12 ++++++------ 3 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/canonical-pr-remediator.lock.yml b/.github/workflows/canonical-pr-remediator.lock.yml index f6d398408..07a34c0bd 100644 --- a/.github/workflows/canonical-pr-remediator.lock.yml +++ b/.github/workflows/canonical-pr-remediator.lock.yml @@ -41,7 +41,7 @@ # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) # - actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 -# - github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 +# - github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 # # Container images used: # - ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67 @@ -95,7 +95,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -416,7 +416,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1006,7 +1006,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1242,7 +1242,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1563,7 +1563,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} diff --git a/.github/workflows/eventrelay-ci-investigator.lock.yml b/.github/workflows/eventrelay-ci-investigator.lock.yml index 550e95a7e..ae0136baf 100644 --- a/.github/workflows/eventrelay-ci-investigator.lock.yml +++ b/.github/workflows/eventrelay-ci-investigator.lock.yml @@ -41,7 +41,7 @@ # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) # - actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 -# - github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 +# - github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 # # Container images used: # - ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67 @@ -123,7 +123,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -451,7 +451,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1150,7 +1150,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1401,7 +1401,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1697,7 +1697,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1771,7 +1771,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} diff --git a/.github/workflows/focused-coverage-controller.lock.yml b/.github/workflows/focused-coverage-controller.lock.yml index 349b8d445..30d8314fa 100644 --- a/.github/workflows/focused-coverage-controller.lock.yml +++ b/.github/workflows/focused-coverage-controller.lock.yml @@ -41,7 +41,7 @@ # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) # - actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 -# - github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 +# - github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 # # Container images used: # - ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67 @@ -95,7 +95,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -416,7 +416,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1015,7 +1015,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1251,7 +1251,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1572,7 +1572,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 + uses: github/gh-aw-actions/setup@f3ca20900e2363607992fb61b46fc687d4b56ba3 # v0.84.0 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} From da6c09ea739a28775cda4f7354f4321fbfd4b306 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 1 Aug 2026 21:01:08 +0000 Subject: [PATCH 2/3] docs(triage): PR remediation run 2026-08-01 30 open PRs, all drafts -> all DEFERRED at scope gate. No autonomous merge: protected main + human-by-default publish gate + explicit draft signals. Flags the self-perpetuating triage-doc backlog and stages human asks (drain 12 duplicate/stale-triage PRs; fast-track 5 security/bug PRs; decide automerge policy or routine cadence). Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_016hdiTXBJUUCgw9QX23tp6G --- docs/triage/pr-remediation-2026-08-01.md | 126 +++++++++++++++++++++++ 1 file changed, 126 insertions(+) create mode 100644 docs/triage/pr-remediation-2026-08-01.md diff --git a/docs/triage/pr-remediation-2026-08-01.md b/docs/triage/pr-remediation-2026-08-01.md new file mode 100644 index 000000000..6c30f805f --- /dev/null +++ b/docs/triage/pr-remediation-2026-08-01.md @@ -0,0 +1,126 @@ +# PR Remediation Run — 2026-08-01 + +**Runbook:** PR Remediation & Publish Runbook (action-forcing, RASOR). +**Surface:** GitHub MCP, authenticated as `groupthinking` (repo owner, write+merge capable). +**Generated:** 2026-08-01T21:00Z (scheduled/unattended run — no human watching live). + +--- + +## Headline + +**30 open PRs. Every one is a draft.** Under the runbook's SCOPE GATE (step 2 — a +draft or `hold`/`do-not-merge` PR is `DEFERRED`), all 30 defer before any +remediation, CodeRabbit, red-team, CI, or publish step runs. **No PR is eligible for +autonomous merge in this run.** + +The bottleneck is **entirely human**, and it is structural, not per-PR: + +1. Draft status is an explicit "not ready to merge" signal from the author. Merging + any of these requires first marking it *Ready for review* — an author decision an + unattended scheduled run must not make on 30 PRs at once. +2. The base branch is `main` (protected). The runbook's PUBLISH GATE is + *human-by-default*; `auto_merge_policy` is `label:automerge` and **no open PR + carries an `automerge` label**. So even if a PR were un-drafted and green, it would + land at `HALTED(awaiting_merge_approval)`, not merge. + +**Self-perpetuating loop worth flagging:** this routine has fired repeatedly since +2026-07-03 (`docs/triage/pr-remediation-*.md` — run2…run10, 07-17, and 4 open triage +PRs: #1044, #1059, #1076, #1077). Each run adds a triage doc + draft PR that then +stays drafted because merging is human-gated. The backlog grows every run. The doc +you are reading is itself another instance of that pattern — see *Recommendation*. + +--- + +## What was verified this run + +- Listed all open PRs (oldest-first). All 30 are `draft: true`. +- Spot-checked CI on the newest substantive security PR **#1118** (proxy-credential + leak fix): **all 4 checks success** (Vercel ×2, CodeRabbit, truth-gate). It is + green and blocked *only* by draft status + human merge approval. +- Per-PR CI for the remaining 29 was **not** polled: it does not change any terminal + state, since all 30 stop at the scope gate regardless of CI. + +--- + +## Terminal states (Output Contract, oldest-first) + +| PR | Title | Age (created) | Draft | Action taken | Terminal state | +|----|-------|---------------|-------|--------------|----------------| +| #734 | fix(security): pin cloud callbacks vs DNS rebinding | 07-12 | ✅ | scope gate | DEFERRED(draft) | +| #810 | fix(security): sanitize API log injection (CWE-117) | 07-17 | ✅ | scope gate | DEFERRED(draft) | +| #869 | fix: harden API-cost webhook outbox retries | 07-18 | ✅ | scope gate | DEFERRED(draft) | +| #903 | fix(auth): restore Google OAuth in Vercel prod | 07-20 | ✅ | scope gate | DEFERRED(draft) | +| #906 | fix(ci): remediate PR #877 rollout gaps | 07-21 | ✅ | scope gate | DEFERRED(draft) | +| #961 | [DRAFT EVIDENCE] duplicate dashboard a11y proposal | 07-23 | ✅ | labeled `duplicate` | DEFERRED(draft/duplicate) | +| #987 | [DRAFT EVIDENCE] unbound CI + module-shadowing | 07-25 | ✅ | scope gate | DEFERRED(draft) | +| #995 | perf(mcp): reuse pooled aiohttp session | 07-25 | ✅ | labeled `duplicate` | DEFERRED(draft/duplicate) | +| #996 | fix(mcp): actually reuse pooled aiohttp session | 07-25 | ✅ | labeled `duplicate` | DEFERRED(draft/duplicate) | +| #1000 | build(deps): bump actions/checkout 4.2.2→7.0.1 | 07-25 | ✅ | dependabot | DEFERRED(draft) | +| #1003 | build(deps): bump actions/github-script 8→9 | 07-25 | ✅ | dependabot | DEFERRED(draft) | +| #1020 | perf: optimize call stack ops + string allocs | 07-26 | ✅ | scope gate | DEFERRED(draft) | +| #1040 | fix(mcp): green up MCPOrchestrator E2E tests | 07-27 | ✅ | labeled `duplicate` | DEFERRED(draft/duplicate) | +| #1043 | perf(web): optimize viewBox computation | 07-27 | ✅ | labeled `duplicate` | DEFERRED(draft/duplicate) | +| #1044 | docs(triage): PR remediation run 2026-07-27 | 07-27 | ✅ | this routine's own doc | DEFERRED(draft/triage-doc) | +| #1045 | 🎨 Palette: keyboard focus-visible styling | 07-27 | ✅ | labeled `duplicate` | DEFERRED(draft/duplicate) | +| #1047 | ci: suppress failure issues on no-op runs | 07-27 | ✅ | scope gate | DEFERRED(draft) | +| #1049 | fix(a11y): dashboard focus contrast + coverage | 07-27 | ✅ | scope gate | DEFERRED(draft) | +| #1050 | Configure agentic no-op comment suppression | 07-27 | ✅ | labeled `duplicate` | DEFERRED(draft/duplicate) | +| #1052 | fix: allow awmg-mcpg gateway in firewalls | 07-27 | ✅ | scope gate | DEFERRED(draft) | +| #1059 | docs(triage): PR remediation run 2026-07-28 | 07-28 | ✅ | this routine's own doc | DEFERRED(draft/triage-doc) | +| #1064 | docs(runbook): Google OAuth 403 remediation | 07-28 | ✅ | labeled `duplicate` | DEFERRED(draft/duplicate) | +| #1075 | fix(pipeline): preserve transcript on timeout | 07-29 | ✅ | scope gate | DEFERRED(draft) | +| #1076 | docs(triage): PR remediation run 2026-07-29 | 07-29 | ✅ | this routine's own doc | DEFERRED(draft/triage-doc) | +| #1077 | docs(triage): run 2026-07-29 + CWE-209 canonical | 07-29 | ✅ | this routine's own doc | DEFERRED(draft/triage-doc) | +| #1080 | perf(ci): replace Math.max spread anti-pattern | 07-29 | ✅ | scope gate | DEFERRED(draft) | +| #1114 | fix(deps): realign apps/web lockfile | 07-30 | ✅ | scope gate | DEFERRED(draft) | +| #1117 | fix(deps): raise brace-expansion override floors | 07-30 | ✅ | scope gate | DEFERRED(draft) | +| #1118 | fix(security): stop proxy credential leakage | 07-31 | ✅ | CI verified green | DEFERRED(draft) — merge-ready if un-drafted | +| #1119 | test(web): billing chat gating asserts real behaviour | 07-31 | ✅ | scope gate | DEFERRED(draft) | + +**Terminal-state tally:** 30 × `DEFERRED(draft)`. 0 `MERGED`. 0 `HALTED` +(nothing reached a human-gate mid-flow — they all defer at the scope gate). + +--- + +## Grouping for human action + +**A. Ready or near-ready — un-draft + review to merge (highest value):** +- #1118 fix(security): proxy credential leakage — **CI green now**, security fix. +- #734 / #810 — security fixes (DNS rebinding, log injection). +- #869 — high-priority bug (webhook outbox retries). +- #1075 — pipeline-critical bug (transcript preservation). + +**B. Dependency bumps — low-risk, batchable once un-drafted:** +- #1000 actions/checkout, #1003 actions/github-script, #1114 lockfile, #1117 brace-expansion. + +**C. Labeled `duplicate` — close candidates (8):** +- #961, #995, #996, #1040, #1043, #1045, #1050, #1064. + (#995 vs #996 are the same aiohttp-pooling fix; keep one.) + +**D. This routine's own accumulating triage/doc PRs — consolidate or close (4):** +- #1044, #1059, #1076, #1077. + +--- + +## Recommendation (why this run does not merge anything) + +Per the runbook: *"'Take action' means automate the toil up to the irreversible step — +not bypass human sign-off on it."* Merging 30 drafts to protected `main` in an +unattended run — after first overriding each author's explicit draft designation — is +exactly the irreversible, human-owned step the PUBLISH GATE reserves. So all 30 are +correctly `DEFERRED`, and this run stops short of merging. + +Concrete asks for a human (staged commands, none executed): + +1. **Drain the duplicate + stale-triage backlog (12 PRs)** so the signal-to-noise of + the open list recovers: close C (#961, #995, #996, #1040, #1043, #1045, #1050, + #1064) and D (#1044, #1059, #1076, #1077). +2. **Fast-track group A** (5 security/bug PRs): mark Ready → review → merge. #1118 is + already green. +3. **Decide the loop's future.** This routine keeps emitting draft PRs that never + merge. Either (a) add an `automerge` label + `auto_merge_policy: label:automerge` + convention so green low-risk PRs can land, or (b) reduce this routine's cadence / + pause it until the backlog is drained — otherwise every firing grows the pile. + +*Nothing here was merged, closed, or un-drafted automatically — those are human +decisions, surfaced for sign-off.* From 02835403401231277ac1d7b1391da37bf0320bcf Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 2 Aug 2026 13:23:26 +0000 Subject: [PATCH 3/3] docs(triage): incorporate owner review of #1177 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Correct the #1118 claim: it is CONFLICTING/DIRTY (needs rebase), under security review, possibly closeable as obsolete — not green, not fast-trackable. - Replace fast-track group A with an evaluate-after-rebase methodology: green/red is not a usable signal until PRs are rebased past the #1151/#1142 gate fixes; require >=1 green required check (build/test/Coverage/validate-gh-aw). - Strengthen the loop finding (46/50 open PRs are drafts; generation-rate problem) and adopt the owner's preferred remediation: write to an issue/workflow summary, pause until drained. Does not auto-close #1044/#1059 (owner's call). Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_016hdiTXBJUUCgw9QX23tp6G --- docs/triage/pr-remediation-2026-08-01.md | 83 +++++++++++++++++------- 1 file changed, 60 insertions(+), 23 deletions(-) diff --git a/docs/triage/pr-remediation-2026-08-01.md b/docs/triage/pr-remediation-2026-08-01.md index 6c30f805f..c1f003d26 100644 --- a/docs/triage/pr-remediation-2026-08-01.md +++ b/docs/triage/pr-remediation-2026-08-01.md @@ -3,6 +3,16 @@ **Runbook:** PR Remediation & Publish Runbook (action-forcing, RASOR). **Surface:** GitHub MCP, authenticated as `groupthinking` (repo owner, write+merge capable). **Generated:** 2026-08-01T21:00Z (scheduled/unattended run — no human watching live). +**Revised:** 2026-08-02 after owner review of PR #1177 — see *Corrections from review* below. + +--- + +## Corrections from review (applied 2026-08-02) + +Owner review on #1177 caught two factual errors in the first draft; both are fixed inline below and summarized here: + +1. **#1118 is NOT green.** Current state is `mergeable=CONFLICTING`, `mergeStateStatus=DIRTY`, `draft=true`. It needs a rebase before anything, and it's under security review — the proxy-credential-leak it fixes may already be closed on `main`, in which case it should be **closed as obsolete, not rebased**. It is *not* fast-trackable. +2. **"Green/red" is not a usable signal for most of this backlog.** At the time these PRs last ran CI, *every* PR in the repo was red for two content-independent reasons: (a) `Agent completion enforcement` → `missing_trusted_publication` (empty allowlists in `.github/agent-lock/trusted-publishers.json` under `fail_closed`), and (b) `gitleaks (working tree)` false-positive on `uv.lock:5129`. Uniform red carries no information, so "no distinguishable blocker" must not be read as "safe" — that misread is what run #1128 made for #999–#1008, where #999/#1003 actually fail `build` and #1000 fails `test`/`Coverage`/`truth-gate`. Both systemic gates are now fixed on `main` (#1151, #1142), **but existing PRs won't reflect that until rebased** (checks don't re-run retroactively). **Rule: green/red on any PR not updated since 2026-08-02 is not a usable input. Rank on `build`/`test`/`Coverage`/`validate-gh-aw`, and require ≥1 *green required* check before classifying anything as fast-trackable.** --- @@ -34,11 +44,16 @@ you are reading is itself another instance of that pattern — see *Recommendati ## What was verified this run - Listed all open PRs (oldest-first). All 30 are `draft: true`. -- Spot-checked CI on the newest substantive security PR **#1118** (proxy-credential - leak fix): **all 4 checks success** (Vercel ×2, CodeRabbit, truth-gate). It is - green and blocked *only* by draft status + human merge approval. -- Per-PR CI for the remaining 29 was **not** polled: it does not change any terminal - state, since all 30 stop at the scope gate regardless of CI. +- Spot-checked the *combined commit status* of **#1118** (proxy-credential leak fix): + the 4 posted statuses (Vercel ×2, CodeRabbit, truth-gate) were success. **This was + misread as "green" in the first draft — it is not.** Combined status ≠ required + checks ≠ mergeability. Per owner review, #1118 is `mergeable=CONFLICTING` / + `mergeStateStatus=DIRTY`: it needs a rebase, is under security review, and may be + closeable as obsolete. It is **not** merge-ready. +- Per-PR *required*-check state (`build`/`test`/`Coverage`/`validate-gh-aw`) for the + rest was **not** polled and, per the *Corrections* note, would be stale anyway for + any PR not rebased since the 2026-08-02 gate fixes. It does not change any terminal + state here, since all 30 stop at the scope gate regardless of CI. --- @@ -74,7 +89,7 @@ you are reading is itself another instance of that pattern — see *Recommendati | #1080 | perf(ci): replace Math.max spread anti-pattern | 07-29 | ✅ | scope gate | DEFERRED(draft) | | #1114 | fix(deps): realign apps/web lockfile | 07-30 | ✅ | scope gate | DEFERRED(draft) | | #1117 | fix(deps): raise brace-expansion override floors | 07-30 | ✅ | scope gate | DEFERRED(draft) | -| #1118 | fix(security): stop proxy credential leakage | 07-31 | ✅ | CI verified green | DEFERRED(draft) — merge-ready if un-drafted | +| #1118 | fix(security): stop proxy credential leakage | 07-31 | ✅ | scope gate | DEFERRED(draft) — **CONFLICTING/DIRTY, needs rebase; verify vuln still open on `main` or close as obsolete** | | #1119 | test(web): billing chat gating asserts real behaviour | 07-31 | ✅ | scope gate | DEFERRED(draft) | **Terminal-state tally:** 30 × `DEFERRED(draft)`. 0 `MERGED`. 0 `HALTED` @@ -84,11 +99,20 @@ you are reading is itself another instance of that pattern — see *Recommendati ## Grouping for human action -**A. Ready or near-ready — un-draft + review to merge (highest value):** -- #1118 fix(security): proxy credential leakage — **CI green now**, security fix. -- #734 / #810 — security fixes (DNS rebinding, log injection). -- #869 — high-priority bug (webhook outbox retries). -- #1075 — pipeline-critical bug (transcript preservation). +**A. Candidates to *evaluate* for merge — NOT a fast-track list (corrected):** +These are the substantive security/bug PRs by topic, but *none* is classified as +fast-trackable here, because their current CI is not a usable signal (see *Corrections*). +Before any of these is proposed for merge it must be **rebased onto current `main`** +(to pick up the #1151/#1142 gate fixes) and then show **≥1 green required check** +(`build`/`test`/`Coverage`/`validate-gh-aw`): +- #1118 proxy credential leak — **blocked first on CONFLICTING/DIRTY + obsolescence check** (may be closed, not merged). +- #734 / #810 — security (DNS rebinding, log injection) — rebase, then verify required checks. +- #869 — high-priority bug (webhook outbox retries) — rebase, then verify required checks. +- #1075 — pipeline-critical bug (transcript preservation) — rebase, then verify required checks. + +Do **not** infer "safe" from the absence of a distinguishable red check: until rebased, +these were uniformly red for the two content-independent gate reasons in *Corrections*, +which is exactly the misread that broke run #1128. **B. Dependency bumps — low-risk, batchable once un-drafted:** - #1000 actions/checkout, #1003 actions/github-script, #1114 lockfile, #1117 brace-expansion. @@ -110,17 +134,30 @@ unattended run — after first overriding each author's explicit draft designati exactly the irreversible, human-owned step the PUBLISH GATE reserves. So all 30 are correctly `DEFERRED`, and this run stops short of merging. -Concrete asks for a human (staged commands, none executed): - -1. **Drain the duplicate + stale-triage backlog (12 PRs)** so the signal-to-noise of - the open list recovers: close C (#961, #995, #996, #1040, #1043, #1045, #1050, - #1064) and D (#1044, #1059, #1076, #1077). -2. **Fast-track group A** (5 security/bug PRs): mark Ready → review → merge. #1118 is - already green. -3. **Decide the loop's future.** This routine keeps emitting draft PRs that never - merge. Either (a) add an `automerge` label + `auto_merge_policy: label:automerge` - convention so green low-risk PRs can land, or (b) reduce this routine's cadence / - pause it until the backlog is drained — otherwise every firing grows the pile. +The backlog is a **generation-rate problem, not a review-capacity one.** Per owner +review, **46 of 50 open PRs are drafts; only 4 are actually proposed for merge.** +Automation opens drafts faster than anything converts them, and each triage run adds +one more PR to the pile it reports on (#1044, #1059, #1128, and this one are all +triage-run artifacts). A report that must be reviewed and merged to be *read* is +self-defeating when the thing being reported on is an unreviewable backlog. + +Concrete asks for a human (none executed autonomously): + +1. **Change where this routine writes.** Emit the triage report to a GitHub **issue or + a workflow-run summary**, not a PR. This stops the loop from adding to its own pile. +2. **Pause / slow the routine until the backlog is drained** (owner's preferred + option). `automerge`-based auto-merge only becomes safe *after* the two systemic + gates (#1151, #1142) are confirmed clearing on **rebased** PRs — otherwise it + automates the exact "uniform-red = safe" misread that broke run #1128. +3. **Drain the backlog:** close the `duplicate`-labeled set (#961, #995, #996, #1040, + #1043, #1045, #1050, #1064) and the superseded triage snapshots (#1044, #1059 are + red-check-era artifacts; #1076, #1077 too). *Left to the owner — this run does not + close others' or prior PRs.* +4. **Evaluate the security/bug PRs individually** (group A) only after rebasing each + and confirming ≥1 green required check. #1118 specifically may be **closed as + obsolete** rather than merged — verify the vuln is still open on `main` first. *Nothing here was merged, closed, or un-drafted automatically — those are human -decisions, surfaced for sign-off.* +decisions, surfaced for sign-off. This revision incorporates owner review of #1177 +(2026-08-02); it does not act on the review's "can be closed" suggestion for #1044/#1059, +which remains the owner's call.*