pdurlej/patchwarden

Fork 0

goal(dogfood): implement unattended Patchwarden loops for Platform and Iskra/OpenClaw #237

New issue

Open

opened 2026-06-25 12:36:59 +02:00 by codex · 6 comments

codex commented

2026-06-25 12:36:59 +02:00

Collaborator

Goal

Turn Patchwarden's June 2026 vision into visible operator value across both dogfood repos:

pdurlej/platform: Patchwarden evaluates PRs and enables controller-driven merge for eligible safe work.
pdurlej/iskra-openclaw: OpenClaw/ClawSweeper consumes Patchwarden verdicts, redrives blocked PRs, and publishes approval/merge when safe.

This is the practical North Star: Piotr sets a slash goal, agents work through issues/PRs, Patchwarden prevents unsafe merges, and the external controller handles approval/merge without Piotr manually interpreting every PR.

Cross-repo implementation targets

Platform issue: pdurlej/platform#823
Iskra/OpenClaw issue: pdurlej/iskra-openclaw#500

Patchwarden responsibility

Patchwarden should provide the policy/verdict/evidence layer for both repos:

Produce exact-head PR verdicts that classify each PR as:
- ready_for_controller_merge
- needs_agent_repair
- needs_human
- blocked_stale_or_missing_evidence
Emit actionable repair instructions when blocked: why, what to do next, and the acceptance condition.
Preserve the boundary: Patchwarden is not the steady-state executor; ClawSweeper/OpenClaw/controller identities own review/merge/job writes.
Require live-head recheck before approval or merge.
Keep hard-manual/security-sensitive classes fail-closed unless repo policy explicitly allows the class.
Make the operator-facing status show the current blocker and next actor, not just artifact inventory.

Acceptance

platform#823 reaches one real eligible PR approved/merged or clearly blocked by Patchwarden without Piotr interpreting the PR manually.
iskra-openclaw#500 reaches one real PR redriven or merged through the controller loop.
At least one non-mergeable/stale PR exercises the needs_agent_repair or blocked_stale_or_missing_evidence path.
Patchwarden status/docs reflect this as the primary live dogfood wedge, not as an abstract enterprise governance layer.
No secrets are printed, no branch protection/DNS/auth/ingress/runtime deploy/public exposure changes are made by Patchwarden Core.

Non-goals

Do not weaken safety classes to get a demo.
Do not make Patchwarden itself the long-term visible merge actor.
Do not add new artifact bureaucracy unless it directly helps the unattended loop.

## Goal Turn Patchwarden's June 2026 vision into visible operator value across both dogfood repos: - `pdurlej/platform`: Patchwarden evaluates PRs and enables controller-driven merge for eligible safe work. - `pdurlej/iskra-openclaw`: OpenClaw/ClawSweeper consumes Patchwarden verdicts, redrives blocked PRs, and publishes approval/merge when safe. This is the practical North Star: Piotr sets a slash goal, agents work through issues/PRs, Patchwarden prevents unsafe merges, and the external controller handles approval/merge without Piotr manually interpreting every PR. ## Cross-repo implementation targets - Platform issue: https://git.pdurlej.com/pdurlej/platform/issues/823 - Iskra/OpenClaw issue: https://git.pdurlej.com/pdurlej/iskra-openclaw/issues/500 ## Patchwarden responsibility Patchwarden should provide the policy/verdict/evidence layer for both repos: 1. Produce exact-head PR verdicts that classify each PR as: - `ready_for_controller_merge` - `needs_agent_repair` - `needs_human` - `blocked_stale_or_missing_evidence` 2. Emit actionable repair instructions when blocked: why, what to do next, and the acceptance condition. 3. Preserve the boundary: Patchwarden is not the steady-state executor; ClawSweeper/OpenClaw/controller identities own review/merge/job writes. 4. Require live-head recheck before approval or merge. 5. Keep hard-manual/security-sensitive classes fail-closed unless repo policy explicitly allows the class. 6. Make the operator-facing status show the current blocker and next actor, not just artifact inventory. ## Acceptance - `platform#823` reaches one real eligible PR approved/merged or clearly blocked by Patchwarden without Piotr interpreting the PR manually. - `iskra-openclaw#500` reaches one real PR redriven or merged through the controller loop. - At least one non-mergeable/stale PR exercises the `needs_agent_repair` or `blocked_stale_or_missing_evidence` path. - Patchwarden status/docs reflect this as the primary live dogfood wedge, not as an abstract enterprise governance layer. - No secrets are printed, no branch protection/DNS/auth/ingress/runtime deploy/public exposure changes are made by Patchwarden Core. ## Non-goals - Do not weaken safety classes to get a demo. - Do not make Patchwarden itself the long-term visible merge actor. - Do not add new artifact bureaucracy unless it directly helps the unattended loop.

codex added the

area:v0-core

domain:ci

judge/p1

judge/codex-candidate

labels

2026-06-25 12:36:59 +02:00

codex referenced this issue

2026-06-25 13:39:29 +02:00

Add dogfood loop verdict contract #237 #238

pdurlej referenced this issue from a commit

2026-06-25 13:46:57 +02:00

Merge pull request 'Add dogfood loop verdict contract #237' (#238) from codex/dogfood-loop-verdict into main

codex referenced this issue

2026-06-25 13:58:41 +02:00

Make dogfood verdicts job-plan consumable #237 #239

pdurlej referenced this issue from a commit

2026-06-25 14:00:26 +02:00

Merge pull request 'Make dogfood verdicts job-plan consumable #237' (#239) from codex/dogfood-loop-controller-plan into main

codex referenced this issue

2026-06-25 14:03:47 +02:00

Right-size rigor for single-operator dogfood (less enterprise ceremony, bias toward the wedge) #235

codex commented

2026-06-25 14:03:47 +02:00

Author

Collaborator

Patchwarden-side progress landed:

#238 merged dogfood-loop-verdict-check, the read-only exact-head classifier for ready_for_controller_merge, needs_agent_repair, needs_human, and blocked_stale_or_missing_evidence.
#239 merged a job handoff inside the dogfood verdict, so external Platform/OpenClaw controllers can pass it through job-plan-check and materialize the next action without Patchwarden writing jobs, reviews, or merges.

Remaining acceptance is cross-repo/live: Platform #823 and Iskra/OpenClaw #500 still need to consume the handoff and produce real loop evidence. Keeping this issue open for that.

Patchwarden-side progress landed: - #238 merged `dogfood-loop-verdict-check`, the read-only exact-head classifier for `ready_for_controller_merge`, `needs_agent_repair`, `needs_human`, and `blocked_stale_or_missing_evidence`. - #239 merged a `job` handoff inside the dogfood verdict, so external Platform/OpenClaw controllers can pass it through `job-plan-check` and materialize the next action without Patchwarden writing jobs, reviews, or merges. Remaining acceptance is cross-repo/live: Platform #823 and Iskra/OpenClaw #500 still need to consume the handoff and produce real loop evidence. Keeping this issue open for that.

codex referenced this issue

2026-06-25 15:11:48 +02:00

feat: add dogfood loop queue handoff #240

codex commented

2026-06-25 15:20:20 +02:00

Author

Collaborator

Update after #240:

Added dogfood-loop-queue-check and patchwarden.dogfood_loop_queue.v1.
The queue consumes multiple dogfood-loop-verdict artifacts, dedupes by job/target identity, orders materializable next actions, and exposes actionable, needs_human, blocked, or empty for external Platform/OpenClaw runners.
external_wiring_backlog now points the dogfood loop runner at the queue handoff, not a single PR verdict.
docs/status.html, docs/status.json, docs/STATUS.md, the architecture inventory, schema README, handoff registry, and self-usable milestone are updated.
Verified locally with full PYTHONPATH=src python3 -m unittest discover -s tests and git diff --check; Forgejo exact-head CI for #240 was green before merge.

Boundary remains unchanged: Patchwarden still does not write jobs, publish reviews, approve, merge, or run agents. The queue is a read model for the external runner, which must still recheck live state before acting.

Update after #240: - Added `dogfood-loop-queue-check` and `patchwarden.dogfood_loop_queue.v1`. - The queue consumes multiple `dogfood-loop-verdict` artifacts, dedupes by job/target identity, orders materializable next actions, and exposes `actionable`, `needs_human`, `blocked`, or `empty` for external Platform/OpenClaw runners. - `external_wiring_backlog` now points the dogfood loop runner at the queue handoff, not a single PR verdict. - `docs/status.html`, `docs/status.json`, `docs/STATUS.md`, the architecture inventory, schema README, handoff registry, and self-usable milestone are updated. - Verified locally with full `PYTHONPATH=src python3 -m unittest discover -s tests` and `git diff --check`; Forgejo exact-head CI for #240 was green before merge. Boundary remains unchanged: Patchwarden still does not write jobs, publish reviews, approve, merge, or run agents. The queue is a read model for the external runner, which must still recheck live state before acting.

codex referenced this issue

2026-06-25 15:31:04 +02:00

feat: expose dogfood queue in status server #241

codex commented

2026-06-25 15:35:24 +02:00

Author

Collaborator

Update after #241:

patchwarden status-serve now exposes /dogfood-loop-queue.json.
The endpoint consumes dogfood loop verdict artifacts through the existing local artifact index, not arbitrary verdict-file paths from HTTP query.
Optional filters: expected_target_sha and expected_target_id.
This makes the operator/controller-facing status able to show the current queue-level blocker and next actor/action for dogfood loops without manually assembling CLI inputs.
Verified locally with full PYTHONPATH=src python3 -m unittest discover -s tests and git diff --check; Forgejo exact-head CI for #241 was green before merge.

Cross-repo state noted from merged work:

platform#824 landed the Platform readiness/actor verdict contract for issue #823, but it was explicitly a manual/full-review safety PR, not the low-risk eligible dogfood PR required to finish acceptance.
iskra-openclaw#501 landed the Iskra/OpenClaw PR controller loop for issue #500, defaulting to dry-run and keeping live actions guarded.

Remaining #237 acceptance is therefore external live/dogfood exercise: one eligible Platform PR approved/merged or clearly blocked without operator interpretation, one Iskra PR redriven or merged through the controller loop, and at least one stale/repair path exercised.

Update after #241: - `patchwarden status-serve` now exposes `/dogfood-loop-queue.json`. - The endpoint consumes dogfood loop verdict artifacts through the existing local artifact index, not arbitrary verdict-file paths from HTTP query. - Optional filters: `expected_target_sha` and `expected_target_id`. - This makes the operator/controller-facing status able to show the current queue-level blocker and next actor/action for dogfood loops without manually assembling CLI inputs. - Verified locally with full `PYTHONPATH=src python3 -m unittest discover -s tests` and `git diff --check`; Forgejo exact-head CI for #241 was green before merge. Cross-repo state noted from merged work: - platform#824 landed the Platform readiness/actor verdict contract for issue #823, but it was explicitly a manual/full-review safety PR, not the low-risk eligible dogfood PR required to finish acceptance. - iskra-openclaw#501 landed the Iskra/OpenClaw PR controller loop for issue #500, defaulting to dry-run and keeping live actions guarded. Remaining #237 acceptance is therefore external live/dogfood exercise: one eligible Platform PR approved/merged or clearly blocked without operator interpretation, one Iskra PR redriven or merged through the controller loop, and at least one stale/repair path exercised.

codex commented

2026-06-25 15:53:09 +02:00

Author

Collaborator

Dogfood update:

pdurlej/platform#824 is merged and landed the Platform readiness/actor verdict wiring.
pdurlej/iskra-openclaw#501 is merged and landed the Iskra/OpenClaw controller loop wiring.
pdurlej/platform#825 is merged at exact head 66061da0b073b9ae86cce2e8c898e9971094a04f, merge commit d66681e69c7e241aa13fe33d8b65b2bda4ee4c56.
#825 was a real low-risk W6d dogfood PR: one state-only file, exact-head green status (7/7 success), Patchwarden PR sanity eligible_sanity_clean, no deterministic findings, GLM/DeepSeek/Kimi all OK.

Important gap: a guarded merge API attempt before the final merge returned 405 not allowed to merge [reason: Does not have enough approvals]. list_pr_reviews for #825 is still empty, so Patchwarden currently emits clean comment evidence but does not create an approval review. That means #237 has Platform-side evidence for a clean candidate, but the approval-review/automerge handoff is still incomplete and should remain a tracked gap unless a later PR proves bot/controller approval end-to-end.

Dogfood update: - `pdurlej/platform#824` is merged and landed the Platform readiness/actor verdict wiring. - `pdurlej/iskra-openclaw#501` is merged and landed the Iskra/OpenClaw controller loop wiring. - `pdurlej/platform#825` is merged at exact head `66061da0b073b9ae86cce2e8c898e9971094a04f`, merge commit `d66681e69c7e241aa13fe33d8b65b2bda4ee4c56`. - #825 was a real low-risk W6d dogfood PR: one state-only file, exact-head green status (`7/7 success`), Patchwarden PR sanity `eligible_sanity_clean`, no deterministic findings, GLM/DeepSeek/Kimi all OK. Important gap: a guarded merge API attempt before the final merge returned `405 not allowed to merge [reason: Does not have enough approvals]`. `list_pr_reviews` for #825 is still empty, so Patchwarden currently emits clean comment evidence but does not create an approval review. That means #237 has Platform-side evidence for a clean candidate, but the approval-review/automerge handoff is still incomplete and should remain a tracked gap unless a later PR proves bot/controller approval end-to-end.

codex referenced this issue

2026-06-25 21:05:11 +02:00

fix: order dogfood approval before merge #242

codex commented

2026-06-25 21:13:41 +02:00

Author

Collaborator

Milestone closed: PR #242 is merged.

What landed:

dogfood loop queue now orders publish_positive_review before merge_pull_request when both actions are present for the same head;
merge jobs stay blocked while the approval handoff is the active controller action;
schema fixture dogfood-loop-queue.approval-before-merge.json proves the approval-before-merge ordering and target consistency.

Verification:

local focused tests passed (test_dogfood_loop_verdict, test_dogfood_loop_queue, test_artifact_schema_contract);
full suite passed before PR creation;
PR #242 Forgejo checks passed (patchwarden-contract-pr, status-drift, fallow-py);
merged at exact head 52fbf175a98ab2e2fc647fc09eac20db5d3adb95.

Remaining #237 scope: live external controller/ClawSweeper consumption and non-happy-path repair/redrive evidence are still open.

Milestone closed: PR #242 is merged. What landed: - dogfood loop queue now orders `publish_positive_review` before `merge_pull_request` when both actions are present for the same head; - merge jobs stay blocked while the approval handoff is the active controller action; - schema fixture `dogfood-loop-queue.approval-before-merge.json` proves the approval-before-merge ordering and target consistency. Verification: - local focused tests passed (`test_dogfood_loop_verdict`, `test_dogfood_loop_queue`, `test_artifact_schema_contract`); - full suite passed before PR creation; - PR #242 Forgejo checks passed (`patchwarden-contract-pr`, `status-drift`, `fallow-py`); - merged at exact head `52fbf175a98ab2e2fc647fc09eac20db5d3adb95`. Remaining #237 scope: live external controller/ClawSweeper consumption and non-happy-path repair/redrive evidence are still open.

codex referenced this issue from pdurlej/platform

2026-06-25 23:10:14 +02:00

fix: make PR sanity comment actionable #829

pdurlej referenced this issue from a commit

2026-06-25 23:21:08 +02:00

Merge pull request #829

codex commented

2026-06-25 23:21:48 +02:00

Author

Collaborator

Follow-up landed in platform PR #829: pdurlej/platform#829

Merged commit: 9434b28e69dfc889b8c6365747fe446032199ef7.

What changed for unattended loops:

PR sanity comment now uses a ClawSweeper-style sentinel layout: verdict first, explicit next step, checked surface, required fixes, folded reviewer details, and hidden patchwarden.pr_sanity.v1 metadata.
Removed the stale 3+3 canary: still alive; this does not replace it copy.
Updated model route to glm-5.2:cloud, deepseek-v4-pro:cloud, and kimi-k2.7:cloud red-team.
Added modelHealth so eligible_sanity_clean no longer hides skipped/error reviewer lanes.

Verification:

python3 -m pytest control-plane/platformctl/tests/test_pr_sanity.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py
Platform PR #829 CI green after applying class/security-sensitive.

Dogfood note: PR #829 itself still showed the old comment layout because patchwarden-pr-sanity.yml intentionally checks out trusted base main, not untrusted PR head. The new layout will appear on the next platform PR after this merge.

Follow-up landed in platform PR #829: https://git.pdurlej.com/pdurlej/platform/pulls/829 Merged commit: `9434b28e69dfc889b8c6365747fe446032199ef7`. What changed for unattended loops: - PR sanity comment now uses a ClawSweeper-style sentinel layout: verdict first, explicit next step, checked surface, required fixes, folded reviewer details, and hidden `patchwarden.pr_sanity.v1` metadata. - Removed the stale `3+3 canary: still alive; this does not replace it` copy. - Updated model route to `glm-5.2:cloud`, `deepseek-v4-pro:cloud`, and `kimi-k2.7:cloud` red-team. - Added `modelHealth` so `eligible_sanity_clean` no longer hides skipped/error reviewer lanes. Verification: - `python3 -m pytest control-plane/platformctl/tests/test_pr_sanity.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - Platform PR #829 CI green after applying `class/security-sensitive`. Dogfood note: PR #829 itself still showed the old comment layout because `patchwarden-pr-sanity.yml` intentionally checks out trusted base `main`, not untrusted PR head. The new layout will appear on the next platform PR after this merge.

codex referenced this issue

2026-06-26 01:20:12 +02:00

docs: surface dogfood loop wedge #246

codex referenced this issue

2026-06-26 01:40:31 +02:00

docs: refresh dogfood status after iskra adapter merge #247

codex referenced this issue from pdurlej/platform

2026-06-26 02:00:34 +02:00

fix(patchwarden): use patchwarden actor for safe-docs review #834

codex referenced this issue

2026-06-26 02:14:58 +02:00

fix(pr-sanity): clarify approval handoff state #248