Reproducer improvements

agents_as_skills/reproducer/SKILL.md

@@ -119,10 +119,10 @@ Execute the following steps in order. Track state across steps using these varia
 8. **Check for existing test or open reproducer MR** before creating a new one:
    - Clone `https://gitlab.com/redhat/rhel/tests/<package_name>` to `/git-repos/tests-<package_name>` (omit branch).
    - Look for `Security/<cve_id>/` (CVE) or `Regression/<jira_issue>/` (bug), and grep for the issue/CVE ids.
-   - Call `list_project_merge_requests` on `redhat/rhel/tests/<package_name>` with `state=opened` and label `ymir_reproducer`; match title/description to this issue/CVE.
-   - If found: reserve TF for **this** stream and verify the existing test.
+   - Call `list_project_merge_requests` on `redhat/rhel/tests/<package_name>` with `state=opened` and label `ymir_reproducer`; match open MRs by **`[{{cve_id}}]` or `[{{jira_issue}}]` in the MR title** (not description). CVE MR titles stay `[CVE-…]` across streams; regression MR titles accumulate `[RHEL-…]` keys when another stream extends the same open MR (e.g. `[RHEL-100, RHEL-200]`).
+   - If found: reserve TF for **this** stream and verify the existing test from the MR branch.
      - Works → `success=true`, `test_already_exists=true`, `adapted_existing=false` (no new MR).
-     - Fails on this stream → adapt the test to be portable across streams, re-verify, set `adapted_existing=true` and `existing_mr_url` so orchestration updates the open MR.
+     - Fails on this stream → adapt in the **same** test directory (no duplicate paths/MRs), update `main.fmf` by appending `- verifies: https://issues.redhat.com/browse/{{jira_issue}}` to the `link` list (keep existing entries), re-verify, set `adapted_existing=true` and `existing_mr_url` to the open CVE MR so orchestration updates that MR.
    - If triage says not-affected: still build/verify a test that would catch the issue if present; detection contradicts N/A, non-reproducible supports N/A.
 
 ### Step 2: Get Maintainer Rules
@@ -377,6 +377,8 @@ tag:
   - <cve_id>
   - Security
   - CVE
+link:
+  - verifies: https://issues.redhat.com/browse/{{jira_issue}}
 tier: "1"
 ```
 
@@ -397,11 +399,15 @@ duration: 10m
 tag:
   - <jira_issue>
   - Regression
+link:
+  - verifies: https://issues.redhat.com/browse/{{jira_issue}}
 tier: "1"
 ```
 
 Adjust `duration` based on the test complexity. Use `5m` for simple tests, `10m` for standard tests, and `30m` for tests that require compilation, large inputs, or Valgrind.
 
+The `link` field with `verifies` is **required** — it records which Jira issue the test verifies.
+
 ### Step 5: Copy Reproducer to TF Machine, Run, Iterate
 
 This is the agentic verification loop — the core of the agent. The goal is to verify that the reproducer actually detects the bug on a real RHEL system. This step iterates: copy the test, run it, analyze the result, fix issues, and try again.

ymir/agents/prompts/reproducer/output_format.j2

@@ -89,7 +89,7 @@ Existing test verified on this stream (no changes needed):
 Existing test adapted for this stream:
 ```json
 {
-    "jira_issue": "RHEL-12345",
+    "jira_issue": "RHEL-12346",
     "success": true,
     "reproducer_type": "cve",
     "package": "libfoo",
@@ -98,7 +98,7 @@ Existing test adapted for this stream:
     "test_directory": "Security/CVE-2025-12345",
     "testing_farm_request_id": "tf-request-adapt1",
     "pass_fail_criteria": "PASS: program exits 0 (fix applied). FAIL: SIGSEGV (bug present).",
-    "summary": "Existing Security/CVE-2025-12345/ test failed on RHEL 9; adapted package names and assertions so the same test works on RHEL 9 and RHEL 10. Files updated in the clone for orchestration to push to the open MR.",
+    "summary": "Open MR !12 already had Security/CVE-2025-12345/ from rhel-10.2.z. Adapted the same test for RHEL 9.8 (portable compose checks). Orchestration will push to MR !12's branch — the MR need not be merged first.",
     "not_reproducible_reason": null,
     "test_already_exists": true,
     "existing_mr_url": "https://gitlab.com/redhat/rhel/tests/libfoo/-/merge_requests/12",

ymir/agents/prompts/reproducer/prompt.j2

@@ -87,6 +87,13 @@ Execute the following steps in order.
    an open MR already carries that test. Do **not** skip verification — reuse and
    adapt instead of duplicating.
 
+   **Cross-stream CVE jobs:** Sibling Jira issues (e.g. RHEL-221017 on rhel-10.2.z
+   and RHEL-221014 on rhel-9.8.z) share the same `{{ cve_id }}` and one canonical
+   test directory. An open reproducer MR from the first stream does **not** need
+   to be merged before you adapt for another stream — orchestration updates that
+   same MR. Search open MRs primarily by **`{{ cve_id }}`** in title/description,
+   not only by `{{ jira_issue }}`.
+
    * Clone the RHEL tests repository using `clone_repository`:
      - URL: `https://gitlab.com/redhat/rhel/tests/<package_name>`
      - Do NOT specify a `branch` parameter — omit it so the tool clones the default branch.
@@ -112,11 +119,18 @@ Execute the following steps in order.
      - `project`: `redhat/rhel/tests/<package_name>`
      - `state`: `opened`
      - `labels`: `["ymir_reproducer"]`
-     Match MRs whose title/description mention `{{ jira_issue }}`{% if cve_id %} or `{{ cve_id }}`{% endif %}.
-     If an open MR matches, note its URL as `existing_mr_url`. If the MR source
-     branch has the test but the default branch does not yet, fetch/checkout that
-     branch into the clone (or re-clone and check out the source branch) so you
-     can run the MR's test files.
+     Match MRs whose **title** contains the canonical tag ``[{{ cve_id }}]``{% if cve_id %}
+     (primary for sibling streams — do not match on description text, which may
+     mention unrelated CVEs){% endif %}, or ``[{{ jira_issue }}]`` for regression tests.
+     Orchestration titles new reproducer MRs as ``<package>: [CVE-…] ymir reproducer test``
+     (CVE, stable across streams) or ``<package>: [RHEL-…] ymir reproducer test``
+     (regression). When a regression test is adapted for another stream, the MR
+     title gains an additional ``[RHEL-…]`` key (e.g. ``[RHEL-100, RHEL-200]``).
+     If an open MR matches, note its URL as `existing_mr_url`. **Check out the MR
+     source branch** in the clone (via `get_merge_request_details` + `fetch_branch` +
+     `git checkout`) **before** copying/running the test — the test usually lives
+     only on that branch, not on the default branch yet. The MR does not need to be
+     merged first.
 
    * **If an existing test directory / matching test / open MR is found:**
      1. Continue to steps 3–6 to reserve a Testing Farm machine for **this**
@@ -128,15 +142,19 @@ Execute the following steps in order.
           and `test_directory` set to the relative path of the existing test
           (e.g. `Security/CVE-2025-12345`). Do **not** create new test files or a new MR.
      3. If the existing test does **not** work on this stream:
-        - **Adapt** the test so it works for both the original stream and this one
-          (avoid stream-hardcoded paths/versions; use portable assertions /
-          conditionals where needed).
+        - **Adapt** the test in the **same directory path** already on the open MR
+          (do not create a parallel directory or a second MR for the same CVE).
+        - Make the test portable across streams (avoid stream-hardcoded paths/versions;
+          use portable assertions / conditionals where needed).
+        - Update `main.fmf`: read the existing `link` list and **append**
+          `- verifies: https://issues.redhat.com/browse/{{ jira_issue }}` if that
+          URL is not already present. Do not remove or replace existing link entries.
         - Re-verify on this compose (still within the iteration limit).
         - Leave the adapted files in the clone under the same test directory path.
         - Produce final output with `success`: `true`, `test_already_exists`: `true`,
-          `adapted_existing`: `true`, `existing_mr_url` when updating an open MR,
+          `adapted_existing`: `true`, `existing_mr_url` set to the open CVE MR URL,
           and `test_directory` set to that relative path.
-          Orchestration will push to the existing MR branch (or open a follow-up).
+          Orchestration will push to that MR's source branch (even if unmerged).
      4. Always cancel the TF reservation (step 6) before returning output.
 
    * **If no existing test or open MR is found:** proceed to create a new test (steps 2–6).
@@ -416,6 +434,8 @@ Execute the following steps in order.
      - <cve_id>
      - Security
      - CVE
+   link:
+     - verifies: https://issues.redhat.com/browse/{{ jira_issue }}
    tier: "1"
    ```
 
@@ -436,11 +456,16 @@ Execute the following steps in order.
    tag:
      - <jira_issue>
      - Regression
+   link:
+     - verifies: https://issues.redhat.com/browse/{{ jira_issue }}
    tier: "1"
    ```
 
    Adjust `duration` based on the test complexity. Use `5m` for simple tests, `10m` for standard tests, and `30m` for tests that require compilation, large inputs, or Valgrind.
 
+   The `link` field with `verifies` is **required** — it records which Jira issue
+   the test verifies (same format as package tests in `redhat/rhel/tests/*`).
+
 5. **Copy Reproducer to TF Machine, Run, Iterate**
 
    This is the agentic verification loop — the core of the agent. The goal is to verify that the reproducer actually detects the bug on a real RHEL system. This step iterates: copy the test, run it, analyze the result, fix issues, and try again.