pdurlej/platform

Fork 0

ci(patchwarden): publish contract-pr artifacts #782

Merged

pdurlej merged 1 commit from codex/orders/patchwarden-contract-pr into main

2026-06-10 23:47:25 +02:00

codex commented

2026-06-10 23:39:51 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

Patchwarden should stop being an advisory side-channel and start producing an enforceable, head-bound contract status in the platform dogfood workflow.

What changed

patchwarden-client-dry-run.yml now runs patchwarden contract-pr before the legacy pr-check / reviewer-lane path.
When runner-local Patchwarden token material is present, contract-pr --execute publishes patchwarden/contract status and upserts the marker-backed contract comment.
When the token is absent, the workflow stays artifact-only and logs a notice.
The workflow uploads patchwarden-client-contract-pr.json plus the generated contract artifact directory.
Added workflow contract tests and updated CI/Forgejo docs.

Why it changed

Patchwarden PRs #84 and #85 landed the Contract Run evaluator and the contract-pr runner. Platform is the first dogfood client, so this PR wires that capability into the real PR workflow without changing automerge policy yet.

Files touched

.forgejo/workflows/patchwarden-client-dry-run.yml
control-plane/platformctl/tests/test_pr_sanity.py
docs/ci/README.md
docs/forgejo-agent-operations.md

Relevant context

Patchwarden PR #84: executable Contract Run gate.
Patchwarden PR #85: patchwarden contract-pr runner.
docs/forgejo-agent-operations.md: Patchwarden bot/token behavior and W6d split.
docs/ci/README.md: Forgejo Actions trust tiers.

Runtime evidence

Local verification only; no live workflow run yet.

Commands run:

PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_pr_sanity.py control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py -> 47 passed
PYTHONPATH=control-plane python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --markdown /tmp/patchwarden-contract-workflow-lint.md --json /tmp/patchwarden-contract-workflow-lint.json -> 0 findings
PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_automerge_readiness.py -> 13 passed

Known constraints

This touches Forgejo workflow status/comment behavior and should be treated as class/security-sensitive.
The PR does not print or persist token values.
contract-pr --execute depends on existing runner-local token material; absent token means dry-run artifacts only.

Explicit out-of-scope

No change to automerge-pilot.yml required contexts.
No branch protection change.
No webhook/service mode.
No Patchwarden merge or approval API path.
No secret rotation or new Infisical paths.

Requested decision

Review whether this is safe to merge as the first platform-side Contract Run dogfood wiring. After merge, a separate rollout PR can decide when patchwarden/contract becomes an automerge readiness requirement.

Merge blockers

Workflow lint finding.
Accidental exposure of PR-head code to token-bearing steps.
Any reviewer finding that this broadens merge authority rather than only publishing Patchwarden's contract signal.

Spec sources read

AGENTS.md — platform PR/canary/security-sensitive rules.
.forgejo/workflows/patchwarden-client-dry-run.yml — implementation target.
docs/forgejo-agent-operations.md — Patchwarden bot and W6d readiness context.
docs/ci/README.md — CI trust tier and Patchwarden workflow documentation.
control-plane/platformctl/tests/test_pr_sanity.py — existing workflow contract tests.
control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py — workflow lint contract tests.
control-plane/platformctl/tests/test_automerge_readiness.py — confirmed automerge readiness policy remains unchanged.
.forgejo/ci-policy.yaml and control-plane/platformctl/ci/lint_workflows.py — checked linter policy for token/status workflow constraints.

No closing issue keyword: this is follow-on dogfood wiring from merged Patchwarden PRs #84/#85, not an existing platform issue.

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Patchwarden should stop being an advisory side-channel and start producing an enforceable, head-bound contract status in the platform dogfood workflow. ### What changed - `patchwarden-client-dry-run.yml` now runs `patchwarden contract-pr` before the legacy `pr-check` / reviewer-lane path. - When runner-local Patchwarden token material is present, `contract-pr --execute` publishes `patchwarden/contract` status and upserts the marker-backed contract comment. - When the token is absent, the workflow stays artifact-only and logs a notice. - The workflow uploads `patchwarden-client-contract-pr.json` plus the generated contract artifact directory. - Added workflow contract tests and updated CI/Forgejo docs. ### Why it changed Patchwarden PRs #84 and #85 landed the Contract Run evaluator and the `contract-pr` runner. Platform is the first dogfood client, so this PR wires that capability into the real PR workflow without changing automerge policy yet. ### Files touched - `.forgejo/workflows/patchwarden-client-dry-run.yml` - `control-plane/platformctl/tests/test_pr_sanity.py` - `docs/ci/README.md` - `docs/forgejo-agent-operations.md` ### Relevant context - Patchwarden PR #84: executable Contract Run gate. - Patchwarden PR #85: `patchwarden contract-pr` runner. - `docs/forgejo-agent-operations.md`: Patchwarden bot/token behavior and W6d split. - `docs/ci/README.md`: Forgejo Actions trust tiers. ### Runtime evidence Local verification only; no live workflow run yet. Commands run: - `PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_pr_sanity.py control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py` -> 47 passed - `PYTHONPATH=control-plane python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --markdown /tmp/patchwarden-contract-workflow-lint.md --json /tmp/patchwarden-contract-workflow-lint.json` -> 0 findings - `PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_automerge_readiness.py` -> 13 passed ### Known constraints - This touches Forgejo workflow status/comment behavior and should be treated as `class/security-sensitive`. - The PR does not print or persist token values. - `contract-pr --execute` depends on existing runner-local token material; absent token means dry-run artifacts only. ### Explicit out-of-scope - No change to `automerge-pilot.yml` required contexts. - No branch protection change. - No webhook/service mode. - No Patchwarden merge or approval API path. - No secret rotation or new Infisical paths. ### Requested decision Review whether this is safe to merge as the first platform-side Contract Run dogfood wiring. After merge, a separate rollout PR can decide when `patchwarden/contract` becomes an automerge readiness requirement. ### Merge blockers - Workflow lint finding. - Accidental exposure of PR-head code to token-bearing steps. - Any reviewer finding that this broadens merge authority rather than only publishing Patchwarden's contract signal. ## Spec sources read - `AGENTS.md` — platform PR/canary/security-sensitive rules. - `.forgejo/workflows/patchwarden-client-dry-run.yml` — implementation target. - `docs/forgejo-agent-operations.md` — Patchwarden bot and W6d readiness context. - `docs/ci/README.md` — CI trust tier and Patchwarden workflow documentation. - `control-plane/platformctl/tests/test_pr_sanity.py` — existing workflow contract tests. - `control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py` — workflow lint contract tests. - `control-plane/platformctl/tests/test_automerge_readiness.py` — confirmed automerge readiness policy remains unchanged. - `.forgejo/ci-policy.yaml` and `control-plane/platformctl/ci/lint_workflows.py` — checked linter policy for token/status workflow constraints. No closing issue keyword: this is follow-on dogfood wiring from merged Patchwarden PRs #84/#85, not an existing platform issue.

codex added 1 commit

2026-06-10 23:39:51 +02:00

ci(patchwarden): publish contract-pr artifacts

platformctl plan / auto-apply scope (pull_request) Successful in 19s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 17s

Details

python-ci / Python 3.11 (pull_request) Successful in 41s

Details

python-ci / Python 3.12 (pull_request) Successful in 43s

Details

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

python-ci / Python 3.13 (pull_request) Successful in 46s

Details

workflow-lint / lint (pull_request) Successful in 7s

Details

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-client-dry-run / dry-run (pull_request) Failing after 19s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 1m41s

Details

10ef0d6506

Run patchwarden contract-pr in the platform client workflow before the legacy reviewer lane, publish the contract status/comment when a runner-local Patchwarden token is present, and upload the new contract artifacts.

pdurlej merged commit f6041ecfa2 into main

2026-06-10 23:47:25 +02:00

pdurlej deleted branch codex/orders/patchwarden-contract-pr

2026-06-10 23:47:25 +02:00

pdurlej referenced this pull request from a commit

2026-06-10 23:47:26 +02:00

Merge pull request 'ci(patchwarden): publish contract-pr artifacts' (#782) from codex/orders/patchwarden-contract-pr into main

ollama referenced this pull request from a commit

2026-06-10 23:52:03 +02:00

docs(patchwarden): smoke contract-pr workflow

codex referenced this pull request

2026-06-10 23:52:19 +02:00

docs(patchwarden): smoke contract-pr workflow #785

patchwarden commented

2026-06-11 00:11:19 +02:00

First-time contributor

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 782
Commit: 10ef0d65061891e123a8b62179c05b8209d820f7
Security-sensitive label: missing
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: OK
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `782` - Commit: `10ef0d65061891e123a8b62179c05b8209d820f7` - Security-sensitive label: `missing` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.