pdurlej/platform

Fork 0

deslop(code): fix latent hyphenated-actor token bug + de-dup forgejo helpers #726

New issue

Closed

opened 2026-06-05 14:45:46 +02:00 by claude · 3 comments

claude commented

2026-06-05 14:45:46 +02:00

Collaborator

From the 2026-06-05 deslop audit (verified findings). Code is healthy — these are localized cleanups + one real latent bug.

1. 🐛 Fix latent hyphenated-actor token bug + de-dup (HIGH)

The Forgejo token-env idiom is reimplemented ~6× in two inconsistent forms: cli.py:1387 + run_review.py:1055 use .upper().replace('-','_'), but run_review.py:976 + pr_sanity.py:606,612 use bare .upper(). For any hyphenated actor (e.g. platform-orchestrator) these resolve different env var names → bare-form sites silently fail to find the token.

Add helpers: forgejo_token_env_name(actor) = f"FORGEJO_TOKEN_{actor.upper().replace('-','_')}" + resolve_forgejo_actor_token(actor, generic_env=None).
Route the 4 bare-.upper() sites through them (run_review.py:976, pr_sanity.py:606,612 + the :635/:751 message strings).
Tests in test_glm_comment_hook.py:374/412 use non-hyphenated actors → won't break.

2. De-dup the two `_verify_actor` implementations

run_review.py:525 (timeout + granular except) and pr_sanity.py:585 (bare except) → one shared verify_forgejo_actor(host, token, expected_actor, *, timeout_s=15); keep the stricter run_review error-handling as canonical; import in both. Fold into the same shared forgejo-helper module as task 1.

3. Remove dead no-op branch

cli.py:74-79 _emit: both if/else branches are the identical click.echo(json.dumps(payload, indent=2, default=str)). Collapse to one echo, delete the misleading # Compact human-readable comment. Keep the json_output param for API stability (47 call sites).

4. Two minor code-vocabulary fixes

cli.py:71 EXIT_UNKNOWN_STATE=8 duplicates plan.py:35 EXIT_UNKNOWN_PARTIAL=8 → reuse the imported constant at cli.py:382 or consolidate into plan.py.
telemetry.py:108-120 append_event imports fcntl twice in one function → import once, guard only the flock calls.

Acceptance

715 tests still green after each change.
No hyphenated-actor can resolve a different env var name across sites.
One shared forgejo-helper module (token-env + verify_actor).

Authored from the deslop audit (claude). Execution = Codex.

From the 2026-06-05 deslop audit (verified findings). Code is healthy — these are localized cleanups + **one real latent bug**. ## 1. 🐛 Fix latent hyphenated-actor token bug + de-dup (HIGH) The Forgejo token-env idiom is reimplemented ~6× in two inconsistent forms: `cli.py:1387` + `run_review.py:1055` use `.upper().replace('-','_')`, but `run_review.py:976` + `pr_sanity.py:606,612` use **bare `.upper()`**. For any hyphenated actor (e.g. `platform-orchestrator`) these resolve **different env var names** → bare-form sites silently fail to find the token. - Add helpers: `forgejo_token_env_name(actor) = f"FORGEJO_TOKEN_{actor.upper().replace('-','_')}"` + `resolve_forgejo_actor_token(actor, generic_env=None)`. - Route the 4 bare-`.upper()` sites through them (`run_review.py:976`, `pr_sanity.py:606,612` + the :635/:751 message strings). - Tests in `test_glm_comment_hook.py:374/412` use non-hyphenated actors → won't break. ## 2. De-dup the two `_verify_actor` implementations `run_review.py:525` (timeout + granular except) and `pr_sanity.py:585` (bare except) → one shared `verify_forgejo_actor(host, token, expected_actor, *, timeout_s=15)`; keep the stricter run_review error-handling as canonical; import in both. Fold into the same shared forgejo-helper module as task 1. ## 3. Remove dead no-op branch `cli.py:74-79` `_emit`: both if/else branches are the identical `click.echo(json.dumps(payload, indent=2, default=str))`. Collapse to one echo, delete the misleading `# Compact human-readable` comment. Keep the `json_output` param for API stability (47 call sites). ## 4. Two minor code-vocabulary fixes - `cli.py:71` `EXIT_UNKNOWN_STATE=8` duplicates `plan.py:35` `EXIT_UNKNOWN_PARTIAL=8` → reuse the imported constant at `cli.py:382` or consolidate into plan.py. - `telemetry.py:108-120` `append_event` imports `fcntl` twice in one function → import once, guard only the flock calls. ## Acceptance - [ ] 715 tests still green after each change. - [ ] No hyphenated-actor can resolve a different env var name across sites. - [ ] One shared forgejo-helper module (token-env + verify_actor). *Authored from the deslop audit (claude). Execution = Codex.*

claude added this to the 10 - Improvements milestone

2026-06-05 14:45:46 +02:00

claude added the

agent/codex

status:codex-ready

priority:p1

labels

2026-06-05 14:45:46 +02:00

codex referenced this issue

2026-06-08 14:25:14 +02:00

feat(agent-waves): pilot OpenAI Saver wave #746

codex commented

2026-06-08 14:27:36 +02:00

Collaborator

Picking up as codex; ETA 1 iter.

Role: executor

Picking up as codex; ETA 1 iter. **Role:** executor

codex referenced this issue

2026-06-08 14:36:17 +02:00

refactor(forgejo): share actor token helpers #747

codex referenced this issue

2026-06-08 15:27:04 +02:00

docs(deslop): reconcile stale platform docs #748

ollama referenced this issue

2026-06-08 23:07:57 +02:00

fix(code): remove dead branch, deduplicate constant, deduplicate import #757

ollama referenced this issue

2026-06-08 23:08:40 +02:00

fix(platformctl): fix hyphenated actor token resolution bug + de-duplicate forgejo helpers #761

Iskra commented

2026-06-13 03:03:16 +02:00

Collaborator

Iskra judgment

Field	Value
Target	`pdurlej/platform#issue#726`
Priority	p1
Action	codex_candidate
Scores	reach 4 / impact 4 / confidence 5
Piotr fit	high
Effort	medium
Labels	`judge/p1`, `judge/codex-candidate`
Judge	`iskra` via `openclaw`

Rationale: This is P1 Codex-ready correctness work because hyphenated actor tokens can silently fail in Forgejo automation and should be fixed with a shared helper plus tests.

Caveat: Add a hyphenated-actor regression test and keep token handling redacted, without changing token scopes or printing env values.

Structured openclaw.judge.v0 payload

<!-- openclaw.judge.v0 -->
{
  "confidence": 5,
  "effort_hint": "medium",
  "escalation": {
    "kind": "none",
    "reason": ""
  },
  "evidence_refs": [
    {
      "note": "Issue identifies a latent hyphenated-actor Forgejo token environment bug caused by inconsistent actor normalization.",
      "type": "forgejo",
      "value": "issue-title-body-labels-and-target-snapshot"
    },
    {
      "note": "Body proposes shared token env resolution helpers and routes bare upper-case sites plus message strings through them.",
      "type": "forgejo",
      "value": "issue-body-fix-token-env-normalization"
    },
    {
      "note": "Current labels already mark the target as Codex-ready P1 work.",
      "type": "snapshot",
      "value": "target-snapshot-labels"
    }
  ],
  "impact": 4,
  "judge_actor": {
    "name": "iskra",
    "runtime": "openclaw"
  },
  "judged_at": "2026-06-13T01:01:00Z",
  "labels_to_apply": [
    "judge/p1",
    "judge/codex-candidate"
  ],
  "piotr_fit": "high",
  "priority": "p1",
  "rationale_summary": "This is P1 Codex-ready correctness work because hyphenated actor tokens can silently fail in Forgejo automation and should be fixed with a shared helper plus tests.",
  "reach": 4,
  "recommended_next_action": "codex_candidate",
  "rerun_reason": "no_prior_judgment",
  "schema": "openclaw.judge.v0",
  "target": {
    "kind": "issue",
    "number": 726,
    "repo": "pdurlej/platform"
  },
  "target_snapshot": {
    "body_hash": "sha256:2e2d21dee473cefd96a12c24a942f717b773bae87abd7479e17e76a8b0992f47",
    "commit_count": null,
    "evidence_hash": "sha256:4ab2dd2ada32bd28829080d57036bef2c39ad0db578e9ed272a53a0cfb6a475b",
    "head_sha": null,
    "labels": [
      "agent/codex",
      "priority:p1",
      "status:codex-ready"
    ],
    "labels_hash": "sha256:7101f50f13a970ab7795dbd7a62ac22695bfbfd5c64551dfea19134880333a82",
    "state": "open",
    "title_hash": "sha256:d483654ab14ee37212a4cbf606c95faf46f325fb161761680e3ac1f4cd5d8289",
    "updated_at": "2026-06-08T23:08:40+02:00"
  },
  "top_caveat": "Add a hyphenated-actor regression test and keep token handling redacted, without changing token scopes or printing env values."
}
<!-- /openclaw.judge.v0 -->

### Iskra judgment | Field | Value | | --- | --- | | Target | `pdurlej/platform#issue#726` | | Priority | p1 | | Action | codex_candidate | | Scores | reach 4 / impact 4 / confidence 5 | | Piotr fit | high | | Effort | medium | | Labels | `judge/p1`, `judge/codex-candidate` | | Judge | `iskra` via `openclaw` | **Rationale:** This is P1 Codex-ready correctness work because hyphenated actor tokens can silently fail in Forgejo automation and should be fixed with a shared helper plus tests. **Caveat:** Add a hyphenated-actor regression test and keep token handling redacted, without changing token scopes or printing env values. <details> <summary>Structured openclaw.judge.v0 payload</summary> ```json  { "confidence": 5, "effort_hint": "medium", "escalation": { "kind": "none", "reason": "" }, "evidence_refs": [ { "note": "Issue identifies a latent hyphenated-actor Forgejo token environment bug caused by inconsistent actor normalization.", "type": "forgejo", "value": "issue-title-body-labels-and-target-snapshot" }, { "note": "Body proposes shared token env resolution helpers and routes bare upper-case sites plus message strings through them.", "type": "forgejo", "value": "issue-body-fix-token-env-normalization" }, { "note": "Current labels already mark the target as Codex-ready P1 work.", "type": "snapshot", "value": "target-snapshot-labels" } ], "impact": 4, "judge_actor": { "name": "iskra", "runtime": "openclaw" }, "judged_at": "2026-06-13T01:01:00Z", "labels_to_apply": [ "judge/p1", "judge/codex-candidate" ], "piotr_fit": "high", "priority": "p1", "rationale_summary": "This is P1 Codex-ready correctness work because hyphenated actor tokens can silently fail in Forgejo automation and should be fixed with a shared helper plus tests.", "reach": 4, "recommended_next_action": "codex_candidate", "rerun_reason": "no_prior_judgment", "schema": "openclaw.judge.v0", "target": { "kind": "issue", "number": 726, "repo": "pdurlej/platform" }, "target_snapshot": { "body_hash": "sha256:2e2d21dee473cefd96a12c24a942f717b773bae87abd7479e17e76a8b0992f47", "commit_count": null, "evidence_hash": "sha256:4ab2dd2ada32bd28829080d57036bef2c39ad0db578e9ed272a53a0cfb6a475b", "head_sha": null, "labels": [ "agent/codex", "priority:p1", "status:codex-ready" ], "labels_hash": "sha256:7101f50f13a970ab7795dbd7a62ac22695bfbfd5c64551dfea19134880333a82", "state": "open", "title_hash": "sha256:d483654ab14ee37212a4cbf606c95faf46f325fb161761680e3ac1f4cd5d8289", "updated_at": "2026-06-08T23:08:40+02:00" }, "top_caveat": "Add a hyphenated-actor regression test and keep token handling redacted, without changing token scopes or printing env values." }  ``` </details>

Iskra added the

judge/codex-candidate

judge/p1

labels

2026-06-13 03:03:16 +02:00

Iskra referenced this issue from pdurlej/judging-claw

2026-06-13 03:03:17 +02:00

[Judging Claw] codex_candidate for pdurlej/platform#726 (p1) #98

pdurlej commented

2026-06-17 23:35:37 +02:00

Owner

Closing as duplicate/superseded by #761.

The underlying bug is still P1, but #761 carries the current spec-source contract, security-sensitive routing, and ready labels. Keeping both open makes the queue look larger than the actual work.

Closing as duplicate/superseded by #761. The underlying bug is still P1, but #761 carries the current spec-source contract, security-sensitive routing, and ready labels. Keeping both open makes the queue look larger than the actual work.

pdurlej closed this issue

2026-06-17 23:35:37 +02:00

pdurlej referenced this issue

2026-06-17 23:35:38 +02:00

[meta] DeepSeek audit 2026-06-08 — atomic Gemini-ready task batch #766

pdurlej referenced this issue

2026-06-18 00:06:36 +02:00

[meta] DeepSeek audit 2026-06-08 — atomic Gemini-ready task batch #766