Skip to content

chore(master): release 4.2.0 - #405

Merged
mlorentedev merged 2 commits into
masterfrom
release-please--branches--master
Aug 26, 2026
Merged

chore(master): release 4.2.0#405
mlorentedev merged 2 commits into
masterfrom
release-please--branches--master

Conversation

@mlorentedev

@mlorentedev mlorentedev commented Aug 25, 2026

Copy link
Copy Markdown
Owner

🤖 I have created a release beep boop

4.2.0 (2026-08-25)

Features

  • add the reviewer registry that makes the triage queue answerable (#407) (2492151)

Bug Fixes

  • spec: record measured evidence on HIVE-384, and stop AC5 reading green (#408) (5fd5aa6)

Documentation

  • correct lesson-094's premise and three reviewer findings from #401 (#406) (66dbf17)
  • record five lessons from the delegate-verb work (#401) (8bc66eb)
  • record why the reviewer registry could not be copied (#409) (2b920ba)

This PR was generated with Release Please. See documentation.

@coderabbitai

coderabbitai Bot commented Aug 25, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

Next included review available in 58 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8f59146b-9f17-470f-9268-43958aa3d1b3

📥 Commits

Reviewing files that changed from the base of the PR and between 2b920ba and 982bc9f.

⛔ Files ignored due to path filters (1)
  • uv.lock is excluded by !**/*.lock
📒 Files selected for processing (3)
  • .release-please-manifest.json
  • CHANGELOG.md
  • pyproject.toml
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch release-please--branches--master

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@mlorentedev

Copy link
Copy Markdown
Owner Author

Review triage

Surfaced by dotf pr triage-queue the moment hive gained a reviewer registry (#403 / #407) — this PR had been sitting with untriaged reviewer output and nothing could see it.

CI: all 6 check runs green (check 3.12/3.13, cross_worker_lock ubuntu + windows, docker, GitGuardian).

Review: none ran. CodeRabbit's commit status reads success; its comment is "Review limit reached". That is a notice about the review, not a review — it names no file, no line, no claim. This PR is unreviewed, and the green check is exactly the signal #403 exists to stop trusting.

Findings: none to dispose of. Nothing was reviewed, so nothing was said.

Content: release-please restating two commits already on master, each reviewed when it merged — 8bc66eb (#401) and 66dbf17 (#406). Four files, the standard release set: .release-please-manifest.json, CHANGELOG.md, pyproject.toml, uv.lock. No source change.

Caveat on that reassurance, stated because it is load-bearing here: #401's own review arrived after it merged, and all five findings were valid — corrected in #406. So "each reviewed when it merged" is weaker for 8bc66eb than the phrase normally implies. The corrections are in this same release, which is the mitigating half.

Recommendation: merge on the human's call, with the unreviewed status on the record. Note that mlorentedev/dotfiles exempts release-please PRs from its attestation gate on exactly this rationale; hive's registry deliberately does not carry that exemption (#407 explains why — prtriage never reads it), so release PRs will keep queueing here for a one-line disposition like this one.

mlorentedev added a commit that referenced this pull request Aug 25, 2026
#407)

Closes #403.

## The problem

```
$ dotf pr triage-queue
pr triage-queue: read reviewer registry: open harness/review-attestation.json: no such file or directory
$ echo $?
1
```

That command exits non-zero for **two different reasons** — work is
pending, or the question could not be answered — deliberately, so an
unanswerable queue is never mistaken for a clear one. Here it was always
the second. The consequence: hive could produce **no queue-clear
evidence for any PR, ever**, so every PR closed with the Definition of
Done's evidence item skipped rather than met.

## The non-obvious part: which marker identifies a review

This is not a copy of the dotfiles registry, and the reason is worth
reading before reviewing the file.

CodeRabbit files **proper reviews through the reviews API** on this
repo. Measured on #401: a 5-finding review reading `**Actionable
comments posted: 5**`, sitting in `reviews[]`. But the queue reads `gh
pr list --json comments`, which returns issue comments **only** and
never `reviews[]`. Matching the review's own text would have left the
queue permanently empty on a repository that is actively being reviewed
— the exact false clear the mechanism exists to prevent.

So the registered marker is the **walkthrough comment** CodeRabbit posts
alongside every review, which is comment-shaped. Verified present on
both PRs open at the time of writing:

| PR | Walkthrough marker | Rate-limit marker | What it was |
|---|---|---|---|
| #401 | ✅ | — | a real 5-finding review |
| #406 | ✅ | ✅ | a decline |

**The limitation this leaves is stated in the file, not left to be
rediscovered:** the walkthrough is *edited* rather than reposted on
re-review, and `createdAt` does not move on an edit — so a second review
after a push may not re-open the queue for a PR already triaged once.
The queue is a floor, not a ceiling. Closing that needs a consumer that
reads `reviews[]`, which is a change to the dotfiles CLI, not to this
file.

## `advisory: true`, measured here rather than inherited

On **#405 and #406**, CodeRabbit was rate limited, posted *"Review limit
reached"*, and its **commit status read `success`**. A green check that
means no review ran is precisely the failure this whole mechanism exists
to catch. Advisory means its *decline* does not refuse the change — a
quota is a billing state of a third party, not a property of the diff —
while its *review* still attests.

Note what the two settings do together, and it is intended: the decline
notice also carries the walkthrough marker, so **a rate-limited PR reads
as output awaiting disposition rather than as a clear queue.** That is
the honest answer.

## Deliberately absent

The `escape` and `exempt` blocks dotfiles carries. Those are read by its
review-attestation **CI gate**, which hive does not run — `prtriage`
reads `reviewers` and `triage.marker` and nothing else. A registry
declaring policy no consumer here enforces is drift with extra steps.
The practical consequence: release-please PRs are not exempted and will
queue for a one-line disposition.

## Verified end to end

```
$ dotf pr triage-queue
1 pull request(s) awaiting a disposition:

  #405   chore(master): release 4.1.1
         coderabbitai reviewed, never triaged, 2026-08-24 20:47
```

Both directions confirmed: **#406 correctly omitted** (it carries a `##
Review triage` comment) and **#405 correctly surfaced** (it does not).
The queue found a real open PR I did not know existed.

`AGENTS.md` gains two bullets in the PR workflow section: how to run the
queue and where to record the disposition, and the warning that
CodeRabbit's green status can mean it never reviewed.
@mlorentedev mlorentedev changed the title chore(master): release 4.1.1 chore(master): release 4.2.0 Aug 25, 2026
@mlorentedev
mlorentedev force-pushed the release-please--branches--master branch from b3b829e to aba734d Compare August 25, 2026 03:24
@mlorentedev

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 25, 2026

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@mlorentedev

Copy link
Copy Markdown
Owner Author

Review triage

Amending the disposition above: it described 4.1.1 and this PR is now 4.2.0 (head e188098). release-please re-cut it after #407 merged — a feat: commit bumps the minor — so the changelog now also carries #407 and #408.

CI: green on the new head.

Review: still none. No new CodeRabbit output arrived after the re-cut; its only walkthrough comment predates the first disposition (02:47Z vs 03:15Z). This PR remains unreviewed.

Worth naming, because this PR is the live example of it. dotf pr triage-queue reports clear for #405 right now, and that is honest about reviewer output while being incomplete about this PR: the content changed after the triage and no new comment marked it. That is exactly the limitation recorded in harness/review-attestation.json and in docs/lessons/lesson-096 (#409) — the walkthrough is edited rather than reposted, createdAt does not move, so the queue is a floor, not a ceiling. Caught here by re-reading the PR rather than by the tool.

Findings: none to dispose of. Content is release-please restating commits already on master, four files, no source change.

Recommendation: unchanged — merge on the human's call with the unreviewed status on the record.

mlorentedev added a commit that referenced this pull request Aug 25, 2026
Lesson 096, from the #403 / #407 work. It merged before this was
written; this carries the part worth keeping.

## The finding

`dotf pr triage-queue` calls `gh pr list --json comments`. GitHub
exposes a PR's discussion through **three separate surfaces** — issue
comments, the reviews API (`reviews[]`), and inline review comments —
and that call returns **only the first**.

On this repo CodeRabbit files *proper* reviews. #401's five findings
live in `reviews[]` as `**Actionable comments posted: 5**`; `comments`
held only the walkthrough. So registering the review's own text as the
marker would have produced a queue that was **permanently, silently
empty on a repository that was being reviewed the whole time**.

The dotfiles registry does not hit this because its second reviewer,
PR-Agent, publishes *through* the comments API — which is why its marker
does not transfer, and why "port the config" was the wrong mental model
for #403.

## Why it is worth a lesson rather than a commit message

The direction of failure. A wrong marker does not error — it returns
*"no reviewer output yet"*, which is also what a genuinely quiet PR
looks like. Same family as
[087](docs/lessons/lesson-087-a-green-review-check-can-mean-did-not-review.md)
and
[094](docs/lessons/lesson-094-a-verification-command-that-selects-zero-tests.md):
**a check that cannot see its subject reports the subject is fine.**

Two rules fall out:

1. When porting a config between repos, verify the **observable** it
keys on against live data in the destination. One `gh api
repos/…/pulls/N/reviews` versus `…/issues/N/comments` settles it in ten
seconds; reading the source registry for an hour does not.
2. Prove a matcher in **both** directions. This one was confirmed by
watching the queue correctly omit a triaged PR *and* correctly surface
an untriaged one it found on its own — #405, a real open release PR
nobody had looked at, invisible until the registry existed.

Docs only. All wikilinks verified against the working tree.
@mlorentedev
mlorentedev force-pushed the release-please--branches--master branch from e188098 to 9ab14ba Compare August 25, 2026 03:43
@mlorentedev
mlorentedev merged commit 5c3bf39 into master Aug 26, 2026
7 checks passed
@mlorentedev
mlorentedev deleted the release-please--branches--master branch August 26, 2026 04:50
@mlorentedev

Copy link
Copy Markdown
Owner Author

🤖 Created releases:

🌻

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant