pdurlej/platform

Fork 0

goal(patchwarden): enable unattended merge-safety loop for eligible Platform PRs #823

New issue

Closed

opened 2026-06-25 12:36:28 +02:00 by codex · 7 comments

codex commented

2026-06-25 12:36:28 +02:00

Collaborator

Goal

Make pdurlej/platform the practical dogfood target for Patchwarden's real value loop:

PR from Codex/Claude/OpenClaw -> Patchwarden verdict -> agent repair if blocked -> controller approval/merge if eligible -> no Piotr hand-holding for routine safe work.

This is not about adding more governance artifacts. The value is: Piotr can set a slash goal, agents work through issues/PRs, and Patchwarden/ClawSweeper decide whether the PR is safely mergeable or needs repair/human handling.

Current context

Open PRs that should become dogfood inputs:

#806 — sacred paths manifest; security-sensitive/governance.
#807 — memory sacred-path consistency; governance/safety.
#822 — Matrix mobile discovery routing; security-sensitive runtime/exposure.

These may not all be autonomous-merge candidates. That is fine. Patchwarden must clearly say one of:

ready_for_controller_merge
needs_agent_repair
needs_human
blocked_stale_or_missing_evidence

Scope

Ensure Platform PRs run Patchwarden contract checks in a way agents/controllers can consume.
Make Patchwarden comments/statuses actionable: exact blocker, exact repair instruction, exact acceptance condition.
Keep hard-manual/security-sensitive PRs from being auto-merged unless the repo policy explicitly allows it.
Pick or create one low-risk eligible Platform PR to prove the unattended happy path end-to-end.
Have the external controller identity, not the coding worker, publish approval/merge when Patchwarden says it is safe.
Run repo tests/checks before merge and keep evidence attached to the PR.

Acceptance

At least one eligible low-risk Platform PR is approved/merged without Piotr manually interpreting the PR.
Security-sensitive or hard-manual PRs are not auto-merged; Patchwarden gives a clear needs_human/required-evidence answer.
If a PR is blocked, the coding agent receives a concrete repair instruction and can redrive.
Live-head/exact-head checks are enforced before any approval/merge.
No secrets are printed. No branch protection, DNS, auth, ingress, runtime deploy, or public exposure changes are made in this issue.

Non-goals

Do not weaken Platform safety classes to get a green demo.
Do not make Patchwarden itself the long-term controller.
Do not auto-merge critical infra/security-sensitive changes by default.

Patchwarden coordination issue will track the cross-repo implementation.

## Goal Make `pdurlej/platform` the practical dogfood target for Patchwarden's real value loop: PR from Codex/Claude/OpenClaw -> Patchwarden verdict -> agent repair if blocked -> controller approval/merge if eligible -> no Piotr hand-holding for routine safe work. This is not about adding more governance artifacts. The value is: Piotr can set a slash goal, agents work through issues/PRs, and Patchwarden/ClawSweeper decide whether the PR is safely mergeable or needs repair/human handling. ## Current context Open PRs that should become dogfood inputs: - #806 — sacred paths manifest; security-sensitive/governance. - #807 — memory sacred-path consistency; governance/safety. - #822 — Matrix mobile discovery routing; security-sensitive runtime/exposure. These may not all be autonomous-merge candidates. That is fine. Patchwarden must clearly say one of: - `ready_for_controller_merge` - `needs_agent_repair` - `needs_human` - `blocked_stale_or_missing_evidence` ## Scope 1. Ensure Platform PRs run Patchwarden contract checks in a way agents/controllers can consume. 2. Make Patchwarden comments/statuses actionable: exact blocker, exact repair instruction, exact acceptance condition. 3. Keep hard-manual/security-sensitive PRs from being auto-merged unless the repo policy explicitly allows it. 4. Pick or create one low-risk eligible Platform PR to prove the unattended happy path end-to-end. 5. Have the external controller identity, not the coding worker, publish approval/merge when Patchwarden says it is safe. 6. Run repo tests/checks before merge and keep evidence attached to the PR. ## Acceptance - At least one eligible low-risk Platform PR is approved/merged without Piotr manually interpreting the PR. - Security-sensitive or hard-manual PRs are not auto-merged; Patchwarden gives a clear `needs_human`/required-evidence answer. - If a PR is blocked, the coding agent receives a concrete repair instruction and can redrive. - Live-head/exact-head checks are enforced before any approval/merge. - No secrets are printed. No branch protection, DNS, auth, ingress, runtime deploy, or public exposure changes are made in this issue. ## Non-goals - Do not weaken Platform safety classes to get a green demo. - Do not make Patchwarden itself the long-term controller. - Do not auto-merge critical infra/security-sensitive changes by default. ## Related Patchwarden coordination issue will track the cross-repo implementation.

codex added the

judge/p1

judge/patchwarden-candidate

labels

2026-06-25 12:36:28 +02:00

codex referenced this issue from pdurlej/patchwarden

2026-06-25 12:36:59 +02:00

goal(dogfood): implement unattended Patchwarden loops for Platform and Iskra/OpenClaw #237

codex referenced this issue

2026-06-25 14:30:23 +02:00

feat(patchwarden): emit controller merge verdicts #824

codex commented

2026-06-25 14:30:58 +02:00

Author

Collaborator

Progress update from codex:

Opened PR #824: feat(patchwarden): emit controller merge verdicts.
It adds the four controller-facing verdicts requested here and per-blocker repair/acceptance fields.
It also hardens the merge actor: approval/merge now requires verdict: ready_for_controller_merge and matching PR/readiness head SHA.
Security-sensitive/unsafe PRs collapse to needs_human; Patchwarden/check failures to needs_agent_repair; missing/pending/stale evidence to blocked_stale_or_missing_evidence.

Not closing this issue yet: PR #824 is itself control-plane merge-safety work, so it is class/security-sensitive/tier/full and not an unattended happy-path candidate. After #824 lands, the remaining #823 acceptance step is one boring docs/status PR with automerge-candidate to prove the new verdict path end-to-end through the controller.

Progress update from codex: - Opened PR #824: `feat(patchwarden): emit controller merge verdicts`. - It adds the four controller-facing verdicts requested here and per-blocker repair/acceptance fields. - It also hardens the merge actor: approval/merge now requires `verdict: ready_for_controller_merge` and matching PR/readiness head SHA. - Security-sensitive/unsafe PRs collapse to `needs_human`; Patchwarden/check failures to `needs_agent_repair`; missing/pending/stale evidence to `blocked_stale_or_missing_evidence`. Not closing this issue yet: PR #824 is itself control-plane merge-safety work, so it is `class/security-sensitive`/`tier/full` and not an unattended happy-path candidate. After #824 lands, the remaining #823 acceptance step is one boring docs/status PR with `automerge-candidate` to prove the new verdict path end-to-end through the controller.

codex referenced this issue

2026-06-25 15:00:54 +02:00

docs(w6d): dogfood controller verdict path #825

codex commented

2026-06-25 15:11:16 +02:00

Author

Collaborator

Dogfood status update from codex:

PR #825 is open as the low-risk W6d dogfood PR: one state/cycle/ file only, labels include automerge-candidate and W6d-automerge-calibration.
Required PR statuses on head 66061da0b073b9ae86cce2e8c898e9971094a04f are green:
- base-is-main / guard (pull_request) → success
- patchwarden-pr-sanity / sanity (pull_request) → success
- patchwarden-client-dry-run / dry-run (pull_request) → success
Patchwarden commented as patchwarden: eligible_sanity_clean, GLM/DeepSeek/Kimi all OK, no findings.
Local deterministic automerge preflight using the post-#824 readiness code returns:
- status: ready
- verdict: ready_for_controller_merge
- ready: true
- no blockers

Current blocker for fully closing #823: I cannot trigger automerge-pilot.yml from this Codex runtime without a usable codex workflow-dispatch credential. Anonymous dispatch returns HTTP 401; local git credential is ollama and was refused for identity-isolation; local Bitwarden bridge is down (connection refused). I intentionally did not merge #825 as codex, because that would bypass the external-controller acceptance this issue is trying to prove.

Next required action is specifically controller dispatch for PR #825, not code repair.

Dogfood status update from codex: - PR #825 is open as the low-risk W6d dogfood PR: one `state/cycle/` file only, labels include `automerge-candidate` and `W6d-automerge-calibration`. - Required PR statuses on head `66061da0b073b9ae86cce2e8c898e9971094a04f` are green: - `base-is-main / guard (pull_request)` → success - `patchwarden-pr-sanity / sanity (pull_request)` → success - `patchwarden-client-dry-run / dry-run (pull_request)` → success - Patchwarden commented as `patchwarden`: `eligible_sanity_clean`, GLM/DeepSeek/Kimi all `OK`, no findings. - Local deterministic automerge preflight using the post-#824 readiness code returns: - `status: ready` - `verdict: ready_for_controller_merge` - `ready: true` - no blockers Current blocker for fully closing #823: I cannot trigger `automerge-pilot.yml` from this Codex runtime without a usable codex workflow-dispatch credential. Anonymous dispatch returns HTTP 401; local git credential is `ollama` and was refused for identity-isolation; local Bitwarden bridge is down (`connection refused`). I intentionally did not merge #825 as `codex`, because that would bypass the external-controller acceptance this issue is trying to prove. Next required action is specifically controller dispatch for PR #825, not code repair.

codex added the

judge/operator-needed

label

2026-06-25 15:11:48 +02:00

codex commented

2026-06-25 15:53:03 +02:00

Author

Collaborator

Dogfood update after #824/#825:

#824 is merged and landed the readiness/actor verdict wiring.
#825 is merged at exact head 66061da0b073b9ae86cce2e8c898e9971094a04f with merge commit d66681e69c7e241aa13fe33d8b65b2bda4ee4c56.
#825 stayed in the intended W6d safe lane: one state-only file, no runtime/workflow/auth/network/secret change.
Forgejo combined status for the exact head was success with 7 checks, including patchwarden-client-dry-run and patchwarden-pr-sanity.
Patchwarden PR sanity comment was eligible_sanity_clean; deterministic findings: none; GLM/DeepSeek/Kimi verdicts: OK.

Gap found during merge attempt: the first guarded merge API call returned 405 not allowed to merge [reason: Does not have enough approvals]. list_pr_reviews remained empty on #825, so Patchwarden produced comment evidence but did not supply a review approval. The PR was later merged by operator/admin capability. This should be treated as a remaining controller/approval integration gap, not proof that unattended merge is fully solved.

Dogfood update after #824/#825: - #824 is merged and landed the readiness/actor verdict wiring. - #825 is merged at exact head `66061da0b073b9ae86cce2e8c898e9971094a04f` with merge commit `d66681e69c7e241aa13fe33d8b65b2bda4ee4c56`. - #825 stayed in the intended W6d safe lane: one state-only file, no runtime/workflow/auth/network/secret change. - Forgejo combined status for the exact head was `success` with 7 checks, including `patchwarden-client-dry-run` and `patchwarden-pr-sanity`. - Patchwarden PR sanity comment was `eligible_sanity_clean`; deterministic findings: none; GLM/DeepSeek/Kimi verdicts: OK. Gap found during merge attempt: the first guarded merge API call returned `405 not allowed to merge [reason: Does not have enough approvals]`. `list_pr_reviews` remained empty on #825, so Patchwarden produced comment evidence but did not supply a review approval. The PR was later merged by operator/admin capability. This should be treated as a remaining controller/approval integration gap, not proof that unattended merge is fully solved.

codex referenced this issue

2026-06-25 15:54:31 +02:00

docs(w6d): smoke controller self-merge path #826

codex referenced this issue

2026-06-25 20:53:02 +02:00

fix(automerge): tolerate stale read token in collect #827

codex commented

2026-06-25 21:03:26 +02:00

Author

Collaborator

Status update from codex, 2026-06-25:

PR #826 is the safe-scope self-merge smoke PR. It passed Patchwarden/readiness locally and its previous automerge dispatch was attempted by codex.
automerge-pilot run #5911 failed before readiness at Collect Forgejo facts with Forgejo HTTP 401 from the runner-local read token.
PR #827 fixes that blocker by adding read-only token fallback and controlled 401 reporting. It is class/security-sensitive / risk/process, all Forgejo status contexts are green, and Patchwarden sanity reported eligible_sanity_clean.
codex cannot merge #827: Forgejo returned User not allowed to merge PR for the codex PAT. The named merge-fest-forgejo-pat was not available in local Keychain/BW bridge during this session.

Next exact step: merge #827 with a merge-capable identity, then rerun automerge-pilot for #826 with execute_merge=true and confirm=AUTOMERGE_READY_W6D.

Status update from codex, 2026-06-25: - PR #826 is the safe-scope self-merge smoke PR. It passed Patchwarden/readiness locally and its previous automerge dispatch was attempted by codex. - `automerge-pilot` run #5911 failed before readiness at `Collect Forgejo facts` with Forgejo HTTP 401 from the runner-local read token. - PR #827 fixes that blocker by adding read-only token fallback and controlled 401 reporting. It is `class/security-sensitive` / `risk/process`, all Forgejo status contexts are green, and Patchwarden sanity reported `eligible_sanity_clean`. - codex cannot merge #827: Forgejo returned `User not allowed to merge PR` for the codex PAT. The named `merge-fest-forgejo-pat` was not available in local Keychain/BW bridge during this session. Next exact step: merge #827 with a merge-capable identity, then rerun `automerge-pilot` for #826 with `execute_merge=true` and `confirm=AUTOMERGE_READY_W6D`.

codex commented

2026-06-25 21:43:42 +02:00

Author

Collaborator

Status update from codex, 2026-06-25:

#826 was refreshed on top of #827 and rechecked at head 3b1d252a97f18934d7385fffb16aea4ab8272aa0.

Evidence from automerge-pilot run #5944:

Collect Forgejo facts: passed via token_env=GITHUB_TOKEN, proving #827 fixed the stale read-token blocker.
automerge_readiness.py: ready_for_controller_merge, ready=true.
Iskra Matrix approval: approved=true for PR #826 and exact head SHA.
Final merge actor: failed at /api/v1/user with HTTP 401 while loading PLATFORM_AUTOMERGE_BOT_TOKEN.

Interpretation: the remaining blocker is runner-local merge-bot credential validity, not PR readiness and not Patchwarden. I did not bypass this with codex/operator/GITHUB_TOKEN, because the W6d contract requires a separate non-cousin merge actor.

Next exact step: refresh/restore the runner-local PLATFORM_AUTOMERGE_BOT_TOKEN for the W6d merge-bot identity, then rerun automerge-pilot for #826 with execute_merge=true and confirm=AUTOMERGE_READY_W6D.

Status update from codex, 2026-06-25: #826 was refreshed on top of #827 and rechecked at head `3b1d252a97f18934d7385fffb16aea4ab8272aa0`. Evidence from `automerge-pilot` run #5944: - `Collect Forgejo facts`: passed via `token_env=GITHUB_TOKEN`, proving #827 fixed the stale read-token blocker. - `automerge_readiness.py`: `ready_for_controller_merge`, `ready=true`. - Iskra Matrix approval: `approved=true` for PR #826 and exact head SHA. - Final merge actor: failed at `/api/v1/user` with HTTP 401 while loading `PLATFORM_AUTOMERGE_BOT_TOKEN`. Interpretation: the remaining blocker is runner-local merge-bot credential validity, not PR readiness and not Patchwarden. I did not bypass this with codex/operator/GITHUB_TOKEN, because the W6d contract requires a separate non-cousin merge actor. Next exact step: refresh/restore the runner-local `PLATFORM_AUTOMERGE_BOT_TOKEN` for the W6d merge-bot identity, then rerun `automerge-pilot` for #826 with `execute_merge=true` and `confirm=AUTOMERGE_READY_W6D`.

codex added the

owner-attention

status:blocked

labels

2026-06-26 00:59:36 +02:00

codex commented

2026-06-26 00:59:36 +02:00

Author

Collaborator

Current blocker is no longer PR readiness: #826 reached exact-head readiness and Iskra approval, but the automerge run failed validating the runner-local PLATFORM_AUTOMERGE_BOT_TOKEN with HTTP 401. Next action is owner/runner credential repair, then rerun #826 through automerge-pilot.

Current blocker is no longer PR readiness: #826 reached exact-head readiness and Iskra approval, but the automerge run failed validating the runner-local `PLATFORM_AUTOMERGE_BOT_TOKEN` with HTTP 401. Next action is owner/runner credential repair, then rerun #826 through `automerge-pilot`.

codex referenced this issue

2026-06-26 01:43:13 +02:00

docs(status): correct owner-attention count #833

codex referenced this issue

2026-06-26 01:45:15 +02:00

docs(status): correct owner-attention count #833

codex referenced this issue

2026-06-26 02:00:33 +02:00

fix(patchwarden): use patchwarden actor for safe-docs review #834

ollama referenced this issue

2026-06-26 09:49:24 +02:00

fix(ci): load automerge credentials from runner env #837

codex referenced this issue

2026-06-26 09:50:53 +02:00

fix(ci): load automerge credentials from runner env #838

codex commented

2026-06-26 10:41:52 +02:00

Author

Collaborator

Closed after W6d self-merge proof.

PR #838 repaired the automerge credential bridge and was merged by the operator.
Runner env now resolves dedicated automerge credentials from the rs2000 runner-local env path.
First automerge-pilot retry for #826 was correctly blocked as stale after #838 changed main.
#826 was updated with a normal merge from origin/main, CI went green again, and automerge-pilot run #6374 merged it as Iskra.
Merge commit: a1fa6c210197148e881bccdf7a0a042ec44eb6ed.

No secret values were printed or committed. The remaining queue can now use the W6d lane only for PRs that satisfy the deterministic automerge policy; security-sensitive/full-tier PRs remain operator/manual unless the policy explicitly accepts them.

Closed after W6d self-merge proof. - PR #838 repaired the automerge credential bridge and was merged by the operator. - Runner env now resolves dedicated automerge credentials from the rs2000 runner-local env path. - First automerge-pilot retry for #826 was correctly blocked as stale after #838 changed `main`. - #826 was updated with a normal merge from `origin/main`, CI went green again, and automerge-pilot run #6374 merged it as `Iskra`. - Merge commit: `a1fa6c210197148e881bccdf7a0a042ec44eb6ed`. No secret values were printed or committed. The remaining queue can now use the W6d lane only for PRs that satisfy the deterministic automerge policy; security-sensitive/full-tier PRs remain operator/manual unless the policy explicitly accepts them.

codex closed this issue

2026-06-26 10:41:52 +02:00