ci(patchwarden): soft-fail advisory review failures #789

Merged

pdurlej merged 4 commits from codex/orders/patchwarden-review-run-softfail into main 2026-06-11 08:10:48 +02:00

Conversation 2 Commits 4 Files changed 2 +115 -14

codex commented 2026-06-11 00:52:42 +02:00

Collaborator

Copy link

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

Patchwarden client dry-run is supposed to be an operator signal, not a fragile model availability check. The deterministic contract/pr-check artifacts should remain available even when the advisory model lane times out, returns malformed JSON, or a status/comment publication attempt fails technically.

What changed

• patchwarden contract-pr --execute now retries once without publication if the execute path exits as a technical failure, preserving dry-run artifacts.
• patchwarden review-run and patchwarden resolve-findings now fail soft: they write patchwarden-client-review-error.json and keep deterministic artifacts authoritative.
• The workflow uploads the new review-error artifact.
• Added workflow contract tests covering publication retry and advisory review soft-fail behavior.

Why it changed

Current PRs such as #783, #784, #786, #787, and #788 show red patchwarden-client-dry-run / dry-run despite deterministic gates being fresh/clean or manual-class as expected. Local reproduction showed review-run can fail on Ollama timeout / invalid JSON, and manual-class PRs may lose artifacts if contract publication fails technically.

Files touched

• .forgejo/workflows/patchwarden-client-dry-run.yml
• control-plane/platformctl/tests/test_pr_sanity.py

Relevant context

• .forgejo/workflows/patchwarden-client-dry-run.yml is the external Patchwarden client dogfood lane.
• Automerge readiness still requires the patchwarden-client-dry-run / dry-run context for narrow W6d candidates.
• Model review remains advisory; deterministic contract-pr and pr-check remain the merge-safety evidence.

Runtime evidence

No runtime mutation. Local simulations only:

• contract-pr --execute technical failure retries as dry-run and exits 0 with contract/pr-check artifacts.
• review-run invalid JSON exits 0 with patchwarden-client-review-error.json.

Known constraints

This does not make unsafe classes eligible for automerge. control-plane/, modules/, workflow, runtime, and governance paths remain manual/security-sensitive per existing policy.

Explicit out-of-scope

• No Patchwarden source change.
• No provider credential or secret change.
• No branch protection change.
• No runtime deployment or runner mutation.

Requested decision

Approve the workflow resilience change so existing PRs can be retriggered against deterministic artifacts instead of being blocked by advisory reviewer transport/format failures.

Merge blockers

• Any path where this causes unsafe PR classes to become automerge-eligible.
• Any loss of deterministic contract-pr or pr-check artifacts.
• Any secret/token exposure in logs or artifacts.

Spec sources read

• .forgejo/workflows/patchwarden-client-dry-run.yml — failing workflow path.
• control-plane/platformctl/tests/test_pr_sanity.py — workflow contract tests.
• control-plane/platformctl/tests/test_automerge_readiness.py — required context behavior for automerge readiness.
• .forgejo/workflows/automerge-pilot.yml — confirmed dry-run context remains required.
• /Users/pd/Developer/patchwarden/src/patchwarden/contract_pipeline.py — local diagnostic only, to understand contract-pr exit behavior.
• /Users/pd/Developer/patchwarden/src/patchwarden/contract_publish.py — local diagnostic only, to understand publication exit behavior.

No closing keyword; this is a queue-unblocking CI hardening fix.

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Patchwarden client dry-run is supposed to be an operator signal, not a fragile model availability check. The deterministic contract/pr-check artifacts should remain available even when the advisory model lane times out, returns malformed JSON, or a status/comment publication attempt fails technically. ### What changed - `patchwarden contract-pr --execute` now retries once without publication if the execute path exits as a technical failure, preserving dry-run artifacts. - `patchwarden review-run` and `patchwarden resolve-findings` now fail soft: they write `patchwarden-client-review-error.json` and keep deterministic artifacts authoritative. - The workflow uploads the new review-error artifact. - Added workflow contract tests covering publication retry and advisory review soft-fail behavior. ### Why it changed Current PRs such as #783, #784, #786, #787, and #788 show red `patchwarden-client-dry-run / dry-run` despite deterministic gates being fresh/clean or manual-class as expected. Local reproduction showed `review-run` can fail on Ollama timeout / invalid JSON, and manual-class PRs may lose artifacts if contract publication fails technically. ### Files touched - `.forgejo/workflows/patchwarden-client-dry-run.yml` - `control-plane/platformctl/tests/test_pr_sanity.py` ### Relevant context - `.forgejo/workflows/patchwarden-client-dry-run.yml` is the external Patchwarden client dogfood lane. - Automerge readiness still requires the `patchwarden-client-dry-run / dry-run` context for narrow W6d candidates. - Model review remains advisory; deterministic `contract-pr` and `pr-check` remain the merge-safety evidence. ### Runtime evidence No runtime mutation. Local simulations only: - `contract-pr --execute` technical failure retries as dry-run and exits `0` with contract/pr-check artifacts. - `review-run` invalid JSON exits `0` with `patchwarden-client-review-error.json`. ### Known constraints This does not make unsafe classes eligible for automerge. `control-plane/`, `modules/`, workflow, runtime, and governance paths remain manual/security-sensitive per existing policy. ### Explicit out-of-scope - No Patchwarden source change. - No provider credential or secret change. - No branch protection change. - No runtime deployment or runner mutation. ### Requested decision Approve the workflow resilience change so existing PRs can be retriggered against deterministic artifacts instead of being blocked by advisory reviewer transport/format failures. ### Merge blockers - Any path where this causes unsafe PR classes to become automerge-eligible. - Any loss of deterministic `contract-pr` or `pr-check` artifacts. - Any secret/token exposure in logs or artifacts. ## Spec sources read - `.forgejo/workflows/patchwarden-client-dry-run.yml` — failing workflow path. - `control-plane/platformctl/tests/test_pr_sanity.py` — workflow contract tests. - `control-plane/platformctl/tests/test_automerge_readiness.py` — required context behavior for automerge readiness. - `.forgejo/workflows/automerge-pilot.yml` — confirmed dry-run context remains required. - `/Users/pd/Developer/patchwarden/src/patchwarden/contract_pipeline.py` — local diagnostic only, to understand `contract-pr` exit behavior. - `/Users/pd/Developer/patchwarden/src/patchwarden/contract_publish.py` — local diagnostic only, to understand publication exit behavior. No closing keyword; this is a queue-unblocking CI hardening fix.

codex added the

risk/process

class/security-sensitive

tier/full

merge/manual-security-sensitive

type:bug

domain:ci

labels 2026-06-11 00:52:42 +02:00

codex added 2 commits 2026-06-11 00:52:42 +02:00

ci(patchwarden): soft-fail advisory review lane 6be2d13ebf

ci(patchwarden): retry contract publication as dry-run 01e31e1a5a

patchwarden commented 2026-06-11 01:01:28 +02:00

First-time contributor

Copy link

Patchwarden PR sanity

• Status: advisory_findings
• PR: 789
• Commit: 3db949dd304bd274d27a838c6a7daf0e420895e0
• Security-sensitive label: present
• Authority: advisory model review plus deterministic blockers only
• 3+3 canary: still alive; this does not replace it

Deterministic findings

• info sensitive-path-touched Sensitive path touched — .forgejo/workflows/patchwarden-client-dry-run.yml
  • Evidence: .forgejo/workflows/patchwarden-client-dry-run.yml
  • Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Model reviewers

global-glm / glm-5.1:cloud

• Status: ok

• Verdict: OK

• medium Token environment variable persists during contract-pr retry, may undermine dry-run intent

  • Evidence: In .forgejo/workflows/patchwarden-client-dry-run.yml lines 199-205: export "$PATCHWARDEN_TOKEN_ENV=$PATCHWARDEN_COMMENT_TOKEN"is set before the first run, but the retry at line 207 callsrun_patchwarden_contract_pr without unsetting th
  • Next: Unset the token environment variable before the retry to guarantee dry-run mode: add unset "$PATCHWARDEN_TOKEN_ENV" before the run_patchwarden_contract_pr retry call at line 208.

global-deepseek / deepseek-v4-pro:cloud

• Status: ok
• Verdict: OK
• Findings: none

redteam / kimi-k2.6:cloud

• Status: ok

• Verdict: NOT_OK

• high Ambient secret export enlarges token exposure surface

  • Evidence: .forgejo/workflows/patchwarden-client-dry-run.yml changed from scoped env "$PATCHWARDEN_TOKEN_ENV=$PATCHWARDEN_COMMENT_TOKEN" patchwarden contract-pr ...toexport "$PATCHWARDEN_TOKEN_ENV=$PATCHWARDEN_COMMENT_TOKEN" followed by multiple
  • Next: Wrap the export and contract-pr call in a subshell ( export "$PATCHWARDEN_TOKEN_ENV=$PATCHWARDEN_COMMENT_TOKEN"; run_patchwarden_contract_pr "$@" ) so the token is scoped only to the invocation that needs it, or revert to the env pattern by calling patchwarden directly rather than via a shell fu

Policy notes

• GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
• Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
• Auto-merge is not enabled here.

<!-- patchwarden-pr-sanity:pdurlej/platform:PR-789 --> # Patchwarden PR sanity - Status: `advisory_findings` - PR: `789` - Commit: `3db949dd304bd274d27a838c6a7daf0e420895e0` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings - **`info` `sensitive-path-touched`** Sensitive path touched — `.forgejo/workflows/patchwarden-client-dry-run.yml` - Evidence: `.forgejo/workflows/patchwarden-client-dry-run.yml` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** Token environment variable persists during contract-pr retry, may undermine dry-run intent - Evidence: `In .forgejo/workflows/patchwarden-client-dry-run.yml lines 199-205: `export "$PATCHWARDEN_TOKEN_ENV=$PATCHWARDEN_COMMENT_TOKEN"` is set before the first run, but the retry at line 207 calls `run_patchwarden_contract_pr` without unsetting th` - Next: Unset the token environment variable before the retry to guarantee dry-run mode: add `unset "$PATCHWARDEN_TOKEN_ENV"` before the `run_patchwarden_contract_pr` retry call at line 208. ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`high`** Ambient secret export enlarges token exposure surface - Evidence: `.forgejo/workflows/patchwarden-client-dry-run.yml changed from scoped `env "$PATCHWARDEN_TOKEN_ENV=$PATCHWARDEN_COMMENT_TOKEN" patchwarden contract-pr ...` to `export "$PATCHWARDEN_TOKEN_ENV=$PATCHWARDEN_COMMENT_TOKEN"` followed by multiple` - Next: Wrap the export and contract-pr call in a subshell `( export "$PATCHWARDEN_TOKEN_ENV=$PATCHWARDEN_COMMENT_TOKEN"; run_patchwarden_contract_pr "$@" )` so the token is scoped only to the invocation that needs it, or revert to the `env` pattern by calling patchwarden directly rather than via a shell fu ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.

codex referenced this pull request 2026-06-11 01:40:46 +02:00

docs(prompts): clean stale ADR references #790

ollama added 1 commit 2026-06-11 04:58:26 +02:00

chore(ci): trigger patchwarden contract-pr smoke 63edc7332d

codex commented 2026-06-11 05:26:46 +02:00

Author

Collaborator

Copy link

Patchwarden verdict: BLOCKED
Action: do not merge this head until the blocking module is fixed.
Head 63edc7332d0e61fe7f7343fe9fd0e30dc0944dba.
Run 4c5e3d43-dc2f-4612-8dfa-a695cc933bf7.
Core stack patchwarden-core@v0 sha256:66bb609e751b2a66ddd4dfb58facff5eed54fa33e1c3c93dfbbc5f3cf0d8c3d4; modules: patchwarden.pr.path_classification, patchwarden.pr.required_checks.
Module outcomes: patchwarden.pr.path_classification fail (governance_tier_path); patchwarden.pr.required_checks pass.
Classification is not passable by local contract run: workflow. Path .forgejo/workflows/patchwarden-client-dry-run.yml.

<!-- patchwarden-contract target="forgejo://git.pdurlej.com/pdurlej/platform/pulls/789" --> **Patchwarden verdict: BLOCKED** Action: do not merge this head until the blocking module is fixed. Head `63edc7332d0e61fe7f7343fe9fd0e30dc0944dba`. Run `4c5e3d43-dc2f-4612-8dfa-a695cc933bf7`. Core stack `patchwarden-core@v0` `sha256:66bb609e751b2a66ddd4dfb58facff5eed54fa33e1c3c93dfbbc5f3cf0d8c3d4`; modules: `patchwarden.pr.path_classification`, `patchwarden.pr.required_checks`. Module outcomes: `patchwarden.pr.path_classification` fail (governance_tier_path); `patchwarden.pr.required_checks` pass. Classification is not passable by local contract run: workflow. Path `.forgejo/workflows/patchwarden-client-dry-run.yml`.

ollama added 1 commit 2026-06-11 06:04:16 +02:00

ci(patchwarden): upload contract inspection artifact 3db949dd30

pdurlej merged commit 2a98f71c27 into main 2026-06-11 08:10:48 +02:00

pdurlej deleted branch codex/orders/patchwarden-review-run-softfail 2026-06-11 08:10:48 +02:00

pdurlej referenced this pull request from a commit 2026-06-11 08:10:50 +02:00

Merge pull request 'ci(patchwarden): soft-fail advisory review failures' (#789) from codex/orders/patchwarden-review-run-softfail into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

W6d-automerge-calibration

  

agent/claude-code

Vistula actor: Claude Code.

  

agent/codex

Vistula actor: Codex.

  

agent/hermes

Vistula actor: Hermes Upstream.

  

agent/iskra

Vistula actor: Iskra.

  

agent/ollama

Vistula actor: Ollama or compatible model.

  

agent/patchwarden

Vistula actor: Patchwarden.

  

automerge-candidate

Candidate for narrow W6d autonomous merge readiness pilot

  

class/security-sensitive

Security-sensitive class of service: smallest coherent PRs and full canary

  

cutover-gate

blocks production declare / final RS2000 replacement

  

dependency/blocked

Vistula dependency state: blocked.

  

dependency/blocks-others

Vistula dependency state: blocks other work.

  

dependency/cross-repo

Vistula dependency scope: cross-repository.

  

dependency/needs-confirmation

Vistula dependency state: needs confirmation.

  

domain:agents

Agent identity, delegation, subagents, routing, or workflows.

  

domain:ci

CI, checks, Actions, runners, or release automation.

  

domain:docs

Documentation, packets, practices, or source-of-truth text.

  

domain:forgejo

Forgejo issues, PRs, labels, repo settings, or identity.

  

domain:infra

Infrastructure, storage, backup, DNS, network, or host substrate.

  

domain:memory

Memory, recall, write gates, salience, or Honcho-adjacent behavior.

  

domain:runtime

Runtime services, deploys, daemons, timers, or live behavior.

  

domain:signal

Signal UX, delivery, context, or outbound behavior.

  

domain:ux

Product UX, operator experience, or conversation ergonomics.

  

flow/architecture

Vistula lifecycle: architecture phase in progress.

  

flow/blocked

Vistula lifecycle: blocked on dependency or decision.

  

flow/deployed

Vistula lifecycle: deployed to runtime where applicable.

  

flow/done

Vistula lifecycle: work merged or otherwise done.

  

flow/implementation

Vistula lifecycle: implementation phase in progress.

  

flow/intake

Vistula lifecycle: incoming signal not refined yet.

  

flow/maintained

Vistula lifecycle: maintained/steady state.

  

flow/observed

Vistula lifecycle: observed after delivery.

  

flow/ready

Vistula lifecycle: ready for architecture or implementation.

  

flow/refining

Vistula lifecycle: Hermes/spec refinement in progress.

  

flow/retired

Vistula lifecycle: retired or intentionally closed.

  

flow/review

Vistula lifecycle: review phase in progress.

  

iterating

Orchestrator/Codex actively amending in response to review — operator can ignore until resolved

  

judge/codex-candidate

Candidate for Codex implementation.

  

judge/hermes-candidate

Candidate for Hermes discovery/research.

  

judge/low-confidence

Judgment confidence is low.

  

judge/needs-refinement

Needs clearer evidence or scope.

  

judge/operator-needed

Needs Piotr decision or input.

  

judge/p0

Urgent, operator attention or unblock now.

  

judge/p1

High value, schedule soon.

  

judge/p2

Useful, normal queue.

  

judge/p3

Low priority, keep but do not chase.

  

judge/park

Parked from current attention.

  

judge/patchwarden-candidate

Needs Patchwarden merge-safety attention.

  

judge/stale-priority

Existing priority judgment appears stale.

  

kind/adr

Vistula work kind: architecture decision record.

  

kind/bug

Vistula work kind: bug fix.

  

kind/chore

Vistula work kind: chore.

  

kind/feature

Vistula work kind: feature.

  

kind/infra

Vistula work kind: infrastructure.

  

kind/ops

Vistula work kind: operations.

  

kind/refactor

Vistula work kind: refactor.

  

kind/research

Vistula work kind: research/discovery.

  

large-impact

Per charter §3 review-by-impact: large impact (≥300 LOC OR new module OR identity/secret change OR architectural pivot) — Oracle pre-review recommended

  

merge/auto

Vistula merge mode: automated merge.

  

merge/manual

Vistula merge mode: manual merge.

  

merge/manual-dependency-conflict

Manual merge reason: dependency conflict.

  

merge/manual-failing-tests

Manual merge reason: failing tests.

  

merge/manual-merge-conflict

Manual merge reason: merge conflict.

  

merge/manual-missing-review

Manual merge reason: missing review.

  

merge/manual-operator-preference

Manual merge reason: operator preference.

  

merge/manual-red-zone

Manual merge reason: red-zone risk.

  

merge/manual-security-sensitive

Manual merge reason: security-sensitive work.

  

merge/manual-unclear-scope

Manual merge reason: unclear scope.

  

merge/manual-unknown

Manual merge reason: unknown.

  

meta

meta-decomposition issue; first agent decomposes into atomic children

  

mode:operator-only

Apply step requires explicit operator approval.

  

mode:patchwarden-iskra-approved

Work eligible for Patchwarden/Iskra approval inside repo policy.

  

mode:safe-auto

Low-risk work eligible for lightweight autonomous handling.

  

needs-operator-decision

PR is blocked on operator yes/no decision — fresh-Claude/Codex won't make this call alone

  

needs-triage

decomposing agent has open questions / unknowns

  

not-ready

reviewed but blocked on a precondition

  

observed/erroring

Vistula observation: erroring.

  

observed/needs-followup

Vistula observation: needs follow-up.

  

observed/pending

Vistula observation: pending.

  

observed/retire-candidate

Vistula observation: retire candidate.

  

observed/unused

Vistula observation: unused.

  

observed/used

Vistula observation: used.

  

operator-emotional

operator-emotional importance (Iskra memory etc.)

  

owner-attention

owner must decide; blocks default path

  

phase/02

Phase 02 cataloging

  

phase/03

Phase 03 control plane (platformctl)

  

priority:p0

Immediate safety, uptime, data, or operator-blocking issue.

  

priority:p1

Important active work; should be pulled soon.

  

priority:p2

Useful normal-priority work.

  

priority:p3

Opportunistic cleanup, research, or backlog work.

  

proposed

auto-generated by meta-decomposition; awaiting human review

  

ready-for-agent

reviewed and pickable; agents may claim per cookbook

  

ready-for-operator

PR is ready for operator review/merge — orchestrator finished its part

  

recovery

disaster recovery / restore semantics relevant

  

review:claude-reviewed

Reviewed by Claude-family agent.

  

review:codex-reviewed

Reviewed by Codex-family agent.

  

review:dziadek-reviewed

Reviewed by Dziadek pinch-point reviewer.

  

review:needs-human

Needs human review before merge or apply.

  

risk/exposure

incorrectly public/private/tailnet/auth/routed

  

risk/process

workflow/review/orchestration may produce bad outcomes

  

risk/product

work may have lost owner/user value

  

risk/runtime

platform may not run, recover, validate, behave reproducibly

  

safety:external-write

May write to external systems, users, rooms, repos, or services.

  

safety:no-prod-mutation

Must not mutate production or live external state.

  

safety:prod-impact

May affect production/runtime behavior.

  

safety:secret-touch

Touches secrets, credentials, auth, or secret-adjacent config.

  

size/large

Vistula size: large.

  

size/medium

Vistula size: medium.

  

size/small

Vistula size: small.

  

size/tiny

Vistula size: tiny.

  

size/unknown

Vistula size: not classified yet.

  

source/adr

Vistula source: ADR.

  

source/agent-generated

Vistula source: agent generated.

  

source/manual

Vistula source: manual entry.

  

source/operator-chat

Vistula source: operator chat.

  

source/voice-note

Vistula source: voice note.

  

status:blocked

Blocked by missing dependency, evidence, access, or operator decision.

  

status:codex-ready

Ready for a Codex implementation pass.

  

status:merged:pending-evidence

Merged but waiting for live or artifact evidence before closure.

  

status:needs-evidence

Needs proof, logs, tests, or operator-visible evidence.

  

status:operator-needed

Requires explicit operator input before safe progress.

  

status:parked

Intentionally deferred; not active campaign work.

  

tier/full

Full review tier per ADR-0007

  

tier/lite

Lite review tier per ADR-0007

  

tier/stacked

Stacked PR (base != main) escape hatch per ADR-0017. Requires consolidator-PR plan in PR body.

  

tier:0-platform-substrate

Data, secrets, backup, storage, or critical platform substrate.

  

tier:1-iskra-value-layer

Iskra/OpenClaw behavior, memory, runtime, or value-layer work.

  

tier:2-tools-products-modules

Tools, products, modules, experiments, and lower-blast-radius work.

  

type:bug

Incorrect behavior or regression.

  

type:chore

Maintenance, cleanup, metadata, or operational task.

  

type:docs

Documentation-only work.

  

type:feat

New capability or product behavior.

  

type:policy

Governance, protocol, boundary, or decision-contract change.

  

type:research

Investigation, spike, or evidence-gathering task.

No labels

W6d-automerge-calibration

agent/claude-code

agent/codex

agent/hermes

agent/iskra

agent/ollama

agent/patchwarden

automerge-candidate

class/security-sensitive

cutover-gate

dependency/blocked

dependency/blocks-others

dependency/cross-repo

dependency/needs-confirmation

domain:agents

domain:ci

domain:docs

domain:forgejo

domain:infra

domain:memory

domain:runtime

domain:signal

domain:ux

flow/architecture

flow/blocked

flow/deployed

flow/done

flow/implementation

flow/intake

flow/maintained

flow/observed

flow/ready

flow/refining

flow/retired

flow/review

iterating

judge/codex-candidate

judge/hermes-candidate

judge/low-confidence

judge/needs-refinement

judge/operator-needed

judge/p0

judge/p1

judge/p2

judge/p3

judge/park

judge/patchwarden-candidate

judge/stale-priority

kind/adr

kind/bug

kind/chore

kind/feature

kind/infra

kind/ops

kind/refactor

kind/research

large-impact

merge/auto

merge/manual

merge/manual-dependency-conflict

merge/manual-failing-tests

merge/manual-merge-conflict

merge/manual-missing-review

merge/manual-operator-preference

merge/manual-red-zone

merge/manual-security-sensitive

merge/manual-unclear-scope

merge/manual-unknown

meta

mode:operator-only

mode:patchwarden-iskra-approved

mode:safe-auto

needs-operator-decision

needs-triage

not-ready

observed/erroring

observed/needs-followup

observed/pending

observed/retire-candidate

observed/unused

observed/used

operator-emotional

owner-attention

phase/02

phase/03

priority:p0

priority:p1

priority:p2

priority:p3

proposed

ready-for-agent

ready-for-operator

recovery

review:claude-reviewed

review:codex-reviewed

review:dziadek-reviewed

review:needs-human

risk/exposure

risk/process

risk/product

risk/runtime

safety:external-write

safety:no-prod-mutation

safety:prod-impact

safety:secret-touch

size/large

size/medium

size/small

size/tiny

size/unknown

source/adr

source/agent-generated

source/manual

source/operator-chat

source/voice-note

status:blocked

status:codex-ready

status:merged:pending-evidence

status:needs-evidence

status:operator-needed

status:parked

tier/full

tier/lite

tier/stacked

tier:0-platform-substrate

tier:1-iskra-value-layer

tier:2-tools-products-modules

type:bug

type:chore

type:docs

type:feat

type:policy

type:research

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

3 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pdurlej/platform!789

No description provided.