pdurlej/platform

Fork 0

fix(automerge): tolerate stale read token in collect #827

Merged

pdurlej merged 1 commit from codex/issue-823-automerge-read-token-fallback into main

2026-06-25 21:19:03 +02:00

codex commented

2026-06-25 20:53:02 +02:00

Collaborator

Canary status: passed — Forgejo canary-required / canary success; Patchwarden sanity eligible_sanity_clean; all required CI contexts green.

Canary Context Pack

Product story

W6d self-merge calibration should fail for unsafe PRs, not because a stale runner-local read token prevents the controller from collecting public Forgejo facts. PR #826 proved the candidate path is ready, but automerge-pilot run #5911 failed in Collect Forgejo facts with HTTP 401 before readiness, Matrix approval, or merge actor execution.

What changed

automerge_actor.py collect now supports read-only fallback token envs and reports HTTP failures without a Python traceback.
automerge-pilot.yml tries PLATFORM_AUTOMERGE_READ_TOKEN, then ephemeral GITHUB_TOKEN, then PLATFORM_AUTOMERGE_BOT_TOKEN for read-only fact collection.
Approval and merge commands still use only the explicit PLATFORM_AUTOMERGE_BOT_TOKEN path and still reject cousin/operator actors.
Added regression tests for fallback behavior and the workflow contract.

Why it changed

Real dispatch evidence from run #5911 showed the old workflow could have a present but stale/invalid read token and fail before the deterministic readiness gate. That makes the self-merge milestone look broken even when the PR evidence is clean.

Files touched

.forgejo/workflows/automerge-pilot.yml
control-plane/platformctl/ci/automerge_actor.py
control-plane/platformctl/tests/test_automerge_actor.py
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py

Relevant context

#823 — W6d unattended merge-safety loop.
#826 — safe-scope smoke PR ready for controller merge.
Forgejo Actions run #5911 — failed at Collect Forgejo facts with HTTP 401.
docs/forgejo-agent-operations.md — W6d merge actor split and workflow_dispatch contract.

Runtime evidence

No runtime mutation in this PR. One live dispatch was performed for #826 and failed before merge. No credential values were printed or committed.

Known constraints

This does not broaden autonomous merge scope. The fallback is limited to read-only collection. The merge actor remains gated by final readiness, Matrix approval, exact confirmation, and a non-cousin bot token.

Explicit out-of-scope

Rotating or changing runner-local secrets.
Changing Matrix approval semantics.
Merging #826.
Expanding W6d automerge beyond docs/status safe scope.

Requested decision

Approve this as the minimal blocker fix, then rerun automerge-pilot for #826 to complete the self-merge milestone.

Merge blockers

Fallback accidentally used for approve or merge commands.
Loss of exact-head readiness guard.
Any secret value appearing in logs or repo files.

Verification

PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py -q → 57 passed.
PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_automerge_readiness.py control-plane/platformctl/tests/test_pr_sanity.py -q → 60 passed.
PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py -q → 7 passed.
git diff --check → clean.

Spec sources read

.forgejo/workflows/automerge-pilot.yml — failed workflow surface.
control-plane/platformctl/ci/automerge_actor.py — collect/approve/merge actor split.
control-plane/platformctl/tests/test_automerge_actor.py — actor regression tests.
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py — workflow contract tests.
docs/forgejo-agent-operations.md — W6d controller/merge actor contract.
state/cycle/W6d-autonomous-merge-pilot.md — pilot policy notes.

Refs #823

Canary status: passed — Forgejo `canary-required / canary` success; Patchwarden sanity `eligible_sanity_clean`; all required CI contexts green. ## Canary Context Pack ### Product story W6d self-merge calibration should fail for unsafe PRs, not because a stale runner-local read token prevents the controller from collecting public Forgejo facts. PR #826 proved the candidate path is ready, but automerge-pilot run #5911 failed in `Collect Forgejo facts` with HTTP 401 before readiness, Matrix approval, or merge actor execution. ### What changed - `automerge_actor.py collect` now supports read-only fallback token envs and reports HTTP failures without a Python traceback. - `automerge-pilot.yml` tries `PLATFORM_AUTOMERGE_READ_TOKEN`, then ephemeral `GITHUB_TOKEN`, then `PLATFORM_AUTOMERGE_BOT_TOKEN` for read-only fact collection. - Approval and merge commands still use only the explicit `PLATFORM_AUTOMERGE_BOT_TOKEN` path and still reject cousin/operator actors. - Added regression tests for fallback behavior and the workflow contract. ### Why it changed Real dispatch evidence from run #5911 showed the old workflow could have a present but stale/invalid read token and fail before the deterministic readiness gate. That makes the self-merge milestone look broken even when the PR evidence is clean. ### Files touched - `.forgejo/workflows/automerge-pilot.yml` - `control-plane/platformctl/ci/automerge_actor.py` - `control-plane/platformctl/tests/test_automerge_actor.py` - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` ### Relevant context - #823 — W6d unattended merge-safety loop. - #826 — safe-scope smoke PR ready for controller merge. - Forgejo Actions run #5911 — failed at `Collect Forgejo facts` with HTTP 401. - `docs/forgejo-agent-operations.md` — W6d merge actor split and workflow_dispatch contract. ### Runtime evidence No runtime mutation in this PR. One live dispatch was performed for #826 and failed before merge. No credential values were printed or committed. ### Known constraints This does not broaden autonomous merge scope. The fallback is limited to read-only collection. The merge actor remains gated by final readiness, Matrix approval, exact confirmation, and a non-cousin bot token. ### Explicit out-of-scope - Rotating or changing runner-local secrets. - Changing Matrix approval semantics. - Merging #826. - Expanding W6d automerge beyond docs/status safe scope. ### Requested decision Approve this as the minimal blocker fix, then rerun `automerge-pilot` for #826 to complete the self-merge milestone. ### Merge blockers - Fallback accidentally used for `approve` or `merge` commands. - Loss of exact-head readiness guard. - Any secret value appearing in logs or repo files. ## Verification - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py -q` → 57 passed. - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_automerge_readiness.py control-plane/platformctl/tests/test_pr_sanity.py -q` → 60 passed. - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py -q` → 7 passed. - `git diff --check` → clean. ## Spec sources read - `.forgejo/workflows/automerge-pilot.yml` — failed workflow surface. - `control-plane/platformctl/ci/automerge_actor.py` — collect/approve/merge actor split. - `control-plane/platformctl/tests/test_automerge_actor.py` — actor regression tests. - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` — workflow contract tests. - `docs/forgejo-agent-operations.md` — W6d controller/merge actor contract. - `state/cycle/W6d-autonomous-merge-pilot.md` — pilot policy notes. Refs #823

codex added 1 commit

2026-06-25 20:53:02 +02:00

fix(automerge): tolerate stale read token in collect

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 16s

Details

python-ci / Python 3.11 (pull_request) Successful in 41s

Details

python-ci / Python 3.12 (pull_request) Successful in 43s

Details

python-ci / Python 3.13 (pull_request) Successful in 44s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 3m39s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Successful in 17s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 19s

Details

b404a02e59

codex added the

agent/codex

class/security-sensitive

risk/process

labels

2026-06-25 20:53:03 +02:00

patchwarden commented

2026-06-25 21:00:27 +02:00

First-time contributor

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 827
Commit: b404a02e59e1ad65794ecad654193db4f2185073
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

info sensitive-path-touched Sensitive path touched — .forgejo/workflows/automerge-pilot.yml
- Evidence: .forgejo/workflows/automerge-pilot.yml
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: error
Verdict: -
Note: ReadTimeout: The read operation timed out
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `827` - Commit: `b404a02e59e1ad65794ecad654193db4f2185073` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings - **`info` `sensitive-path-touched`** Sensitive path touched — `.forgejo/workflows/automerge-pilot.yml` - Evidence: `.forgejo/workflows/automerge-pilot.yml` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `error` - Verdict: `-` - Note: ReadTimeout: The read operation timed out - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.

codex referenced this pull request

2026-06-25 21:03:26 +02:00

goal(patchwarden): enable unattended merge-safety loop for eligible Platform PRs #823