test(memory): pin sacred-path consistency between memory.py and safety.py #807

Merged

Iskra merged 3 commits from claude/issues/memory-sacred-path-consistency into main 2026-06-26 13:13:55 +02:00

Conversation 4 Commits 3 Files changed 2 +200

claude commented 2026-06-18 15:27:16 +02:00

Collaborator

Copy link

Problem

Sacred-path truth is split. The canonical repo-wide rules live in control-plane/platformctl/safety.py (SACRED_EXACT_PATHS / SACRED_PREFIX_PATHS / SACRED_PATH_GLOBS / SACRED_NAME_GLOBS), and PR #806 generated policies/sacred-paths.yaml from them with a drift test.

But there is a third, independent source of truth that nothing guards against drift:

• memory.py:20 — SACRED_PATH_PATTERNS, a tuple of compiled regexes (.ssh, .codex, secret-material, runtime/legacy-import/env, open-loops.json).
• memory.py:235 — pre_tool_guard uses them to block destructive memory-control-plane operations in the PreToolUse hook: operation in DESTRUCTIVE_OPERATIONS and any(pattern.search(normalized) ...).

If safety.py gains a new sacred concept that the memory hook should also cover, memory.py can silently fall behind.

Investigation (step 1)

Why it is regex-based, and whether it can reuse safety.is_sacred_path. It cannot:

1. Different normalization. pre_tool_guard normalizes with str(Path(path).expanduser()) only (memory.py:234) — no .resolve(). safety._normalize runs Path(...).resolve(strict=False) (safety.py:132), resolving relative paths against the control-plane process CWD. Hook payloads carry raw, possibly-relative or remote (/home/openclaw/...) path strings matched on operation+path alone, so CWD resolution is wrong here.
2. Different concept sets. safety.py is a host-specific absolute-path enforcement layer (safety.py:26-99); memory.py is a coarse component match anywhere in a string.
3. Scopes overlap but neither contains the other. memory.py covers ~/.ssh + secret-material + open-loops.json (absent from safety.py), and intentionally ignores /etc/ssh/sshd_config and the /opt/... host paths (which safety.py owns). So the literal property "no path safety.py treats as sacred is missed by memory.py" is false by design (e.g. /etc/ssh/sshd_config has no .ssh component).

Decision (step 2): option (b) — keep regexes, add a consistency test

Deriving memory.py from safety.py (option a) would change protective behavior. The genuine, testable invariant is agreement where the scopes overlap — the only shared concept is the .codex component.

Test (step 3)

New file control-plane/platformctl/tests/test_memory_sacred_consistency.py:

• Overlap drift guard — every safety.py rule sharing the .codex component is blocked by the memory destructive guard, derived from safety.py's own constants (SACRED_EXACT_PATHS + SACRED_PREFIX_PATHS) so new .codex rules are covered automatically. Includes an anti-vacuity check and a non-circular bidirectional anchor (safety.is_sacred_path AND pre_tool_guard must agree).
• Pattern contract — each of the 5 patterns blocks destructive ops, allows reads, ignores near-misses (e.g. secret-materials.md, my-open-loops.json); a tripwire ties len(SACRED_PATH_PATTERNS) to the fixture set so the pattern tuple can't change without re-checking agreement.
• Canonical anchor — safety.py-only host paths (/etc/ssh/sshd_config, /opt/..., remote workspace) stay sacred under safety.py, asserted positively so a future tightening of memory.py never trips this test.

Also a cross-reference comment at memory.py:20 so the third source of truth is intentional, not silent.

Proof the guard is non-vacuous

Simulating removal of the .codex pattern leaks 6 safety.py sacred paths past the memory guard (~/.codex/AGENTS.md, ~/.codex/config.toml, /home/openclaw/.codex/sessions/, ~/.codex/archived_sessions/, ~/.codex/automations/, ~/.codex/sessions/) → test_safety_overlap_* fails.

Verification

• python3 -m pytest platformctl/tests/test_memory_sacred_consistency.py → 23 passed.
• test_safety_phase3.py → 128 passed (no regression).
• Pre-existing env-only failures in test_memory_control_plane.py (subprocess ModuleNotFoundError: No module named 'click') are unrelated — confirmed identical on the clean baseline with this branch's source stashed.

Classification

Class/security-sensitive (sacred-path enforcement) → tier/full canary + operator merge. No secret values touched.

🤖 Generated with Claude Code

## Problem Sacred-path truth is split. The canonical repo-wide rules live in `control-plane/platformctl/safety.py` (`SACRED_EXACT_PATHS` / `SACRED_PREFIX_PATHS` / `SACRED_PATH_GLOBS` / `SACRED_NAME_GLOBS`), and PR #806 generated `policies/sacred-paths.yaml` from them with a drift test. But there is a **third, independent source of truth** that nothing guards against drift: - [`memory.py:20`](control-plane/platformctl/memory.py#L20) — `SACRED_PATH_PATTERNS`, a tuple of compiled regexes (`.ssh`, `.codex`, `secret-material`, `runtime/legacy-import/env`, `open-loops.json`). - [`memory.py:235`](control-plane/platformctl/memory.py#L235) — `pre_tool_guard` uses them to block destructive memory-control-plane operations in the `PreToolUse` hook: `operation in DESTRUCTIVE_OPERATIONS and any(pattern.search(normalized) ...)`. If `safety.py` gains a new sacred concept that the memory hook should also cover, `memory.py` can silently fall behind. ## Investigation (step 1) **Why it is regex-based, and whether it can reuse `safety.is_sacred_path`.** It cannot: 1. **Different normalization.** `pre_tool_guard` normalizes with `str(Path(path).expanduser())` only ([`memory.py:234`](control-plane/platformctl/memory.py#L234)) — no `.resolve()`. `safety._normalize` runs `Path(...).resolve(strict=False)` ([`safety.py:132`](control-plane/platformctl/safety.py#L132)), resolving **relative** paths against the control-plane process CWD. Hook payloads carry raw, possibly-relative or remote (`/home/openclaw/...`) path strings matched on operation+path alone, so CWD resolution is wrong here. 2. **Different concept sets.** `safety.py` is a host-specific **absolute-path** enforcement layer ([`safety.py:26-99`](control-plane/platformctl/safety.py#L26)); `memory.py` is a coarse **component** match anywhere in a string. 3. **Scopes overlap but neither contains the other.** `memory.py` covers `~/.ssh` + `secret-material` + `open-loops.json` (absent from `safety.py`), and intentionally ignores `/etc/ssh/sshd_config` and the `/opt/...` host paths (which `safety.py` owns). So the literal property "no path `safety.py` treats as sacred is missed by `memory.py`" is **false by design** (e.g. `/etc/ssh/sshd_config` has no `.ssh` component). ## Decision (step 2): option (b) — keep regexes, add a consistency test Deriving `memory.py` from `safety.py` (option a) would change protective behavior. The genuine, testable invariant is **agreement where the scopes overlap** — the only shared concept is the `.codex` component. ## Test (step 3) New file [`control-plane/platformctl/tests/test_memory_sacred_consistency.py`](control-plane/platformctl/tests/test_memory_sacred_consistency.py): - **Overlap drift guard** — every `safety.py` rule sharing the `.codex` component is blocked by the memory destructive guard, derived from `safety.py`'s own constants (`SACRED_EXACT_PATHS + SACRED_PREFIX_PATHS`) so new `.codex` rules are covered automatically. Includes an anti-vacuity check and a non-circular bidirectional anchor (`safety.is_sacred_path` AND `pre_tool_guard` must agree). - **Pattern contract** — each of the 5 patterns blocks destructive ops, allows reads, ignores near-misses (e.g. `secret-materials.md`, `my-open-loops.json`); a tripwire ties `len(SACRED_PATH_PATTERNS)` to the fixture set so the pattern tuple can't change without re-checking agreement. - **Canonical anchor** — `safety.py`-only host paths (`/etc/ssh/sshd_config`, `/opt/...`, remote workspace) stay sacred under `safety.py`, asserted **positively** so a future tightening of `memory.py` never trips this test. Also a cross-reference comment at [`memory.py:20`](control-plane/platformctl/memory.py#L20) so the third source of truth is intentional, not silent. ### Proof the guard is non-vacuous Simulating removal of the `.codex` pattern leaks **6** `safety.py` sacred paths past the memory guard (`~/.codex/AGENTS.md`, `~/.codex/config.toml`, `/home/openclaw/.codex/sessions/`, `~/.codex/archived_sessions/`, `~/.codex/automations/`, `~/.codex/sessions/`) → `test_safety_overlap_*` fails. ## Verification - `python3 -m pytest platformctl/tests/test_memory_sacred_consistency.py` → **23 passed**. - `test_safety_phase3.py` → 128 passed (no regression). - Pre-existing env-only failures in `test_memory_control_plane.py` (subprocess `ModuleNotFoundError: No module named 'click'`) are unrelated — confirmed identical on the clean baseline with this branch's source stashed. ## Classification Class/security-sensitive (sacred-path enforcement) → **tier/full canary + operator merge**. No secret values touched. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude added 1 commit 2026-06-18 15:27:16 +02:00

test(memory): pin sacred-path consistency between memory.py and safety.py ... 250b8ced32

memory.py:20 declares an independent SACRED_PATH_PATTERNS (compiled regexes)
used by pre_tool_guard (memory.py:235) to block destructive memory-control-plane
operations in the PreToolUse hook. This is a third sacred-path truth alongside
safety.py (SACRED_EXACT/PREFIX/PATH_GLOBS/NAME_GLOBS) and the generated
policies/sacred-paths.yaml — and it can drift silently.

Decision: keep the regexes (option b). They cannot reuse safety.is_sacred_path:
that layer resolves Path objects against the process CWD (safety.py:132-133),
which is wrong for hook payloads carrying raw, relative or remote path strings.
The two are genuinely different concept sets whose scopes only overlap (neither
contains the other), so deriving one from the other would change protection.

Add tests/test_memory_sacred_consistency.py pinning the relationship:
- overlap agreement: every safety.py rule sharing the `.codex` component is
  blocked by the memory guard, derived from safety.py's own constants so new
  `.codex` rules are covered automatically (proven non-vacuous: removing the
  pattern leaks 6 safety.py sacred paths past the guard).
- pattern contract: each of the 5 patterns blocks destructive ops, allows reads,
  ignores near-misses; a tripwire ties pattern count to the fixture set.
- canonical anchor: safety.py-only host paths (e.g. /etc/ssh/sshd_config) stay
  sacred under safety.py, asserted positively so tightening memory.py never trips.

Also add a cross-reference comment at memory.py:20 so the third source of truth
is intentional, not silent.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

patchwarden commented 2026-06-18 15:34:15 +02:00

First-time contributor

Copy link

Patchwarden PR sanity

Operator signal: 🛑 STOP - reviewer finding(s) must be addressed or explicitly accepted.

Automerge signal: ❌ NOT READY - no unattended merge or APPROVED review should be published.

Verdict: 🛑 STOP - a model reviewer reported actionable findings.

Next step: Address the reviewer finding(s), or leave a human decision explaining why the risk is accepted.

• PR: 807
• Commit: 7dbee837a933a08bc66f492816430d00ef0bfdd5
• Status: advisory_findings
• Reviewer health: findings
• Security-sensitive label: present
• Authority: Patchwarden policy signal; branch protection and automerge controller remain merge authority.
• Model mix: glm-5.2:cloud, deepseek-v4-pro:cloud, kimi-k2.7-code:cloud

What I checked

• Changed files: 2
• Deterministic blocker scan: clean
• Model reviewer lanes: 3
• Comment contract: this comment is updated in place via a hidden Patchwarden marker.

Approval Handoff

• State: not_ready_reviewer_findings
• Action: address reviewer finding(s) or leave a human decision before any unattended approval.
• Boundary: branch protection and the automerge controller remain merge authority.

Signal Board

• Legend: ✅ evidence is sufficient; 🟡 controller still has work; ⚠️ automation retries first; 🛑/❌ do not approve or merge.

Lane	Signal	Meaning
🧪 Deterministic sanity	✅ clean	No deterministic blockers found.
🧠 Model reviewers	❌ findings	Address reviewer finding(s) before approval.
🛡️ Patchwarden approval	❌ not_ready_reviewer_findings	No unattended APPROVED review should be published.
🚦 Unattended automerge	❌ ineligible	Outside the narrow safe-docs/status unattended lane.
🙋 Owner attention	🔁 automation first	Retry, repair, or inspect automation before asking the owner.

• Scope blocker: non-doc/status path(s): control-plane/platformctl/memory.py, control-plane/platformctl/tests/test_memory_sacred_consistency.py
• Risk label blocker: class/security-sensitive, tier/full
• Security-sensitive blocker: class/security-sensitive is present.
  🧭 Merge authority: branch protection and automerge controller remain authoritative.

Required Fixes

No deterministic blockers.

Reviewer Details

Model reviewer lanes

global-glm / glm-5.2:cloud

• Status: ok
• Verdict: OK
• Findings: none

global-deepseek / deepseek-v4-pro:cloud

• Status: ok
• Verdict: OK
• Findings: none

redteam / kimi-k2.7-code:cloud

• Status: ok

• Verdict: NOT_OK

• high Symlink/path-aliasing bypass of regex-only sacred guard

  • Evidence: memory.py new comment at SACRED_PATH_PATTERNS deliberately rejects filesystem resolution ('Deliberately NOT derived from safety.is_sacred_path... matched on operation+path alone') and keeps component regex search on the raw string. test_mem
  • Next: Resolve the payload against its intended workspace/base directory (not the control-plane CWD) before regex matching, or add an explicit regression test and operator comment accepting the residual aliasing risk and requiring downstream enforcement.

Policy notes

• Patchwarden PR sanity is the first merge-lane signal for this PR.
• Models produce findings; Patchwarden/policy produces decisions.
• Model findings alone do not fail the status check; they require human or agent disposition.
• Formal approval is separate from this comment and requires clean reviewer health.
• Automerge remains delegated to branch protection and the automerge pilot.

<!-- patchwarden-pr-sanity:pdurlej/platform:PR-807 --> <!-- patchwarden.pr_sanity.v1 status=advisory_findings model_health=findings approval_handoff=not_ready_reviewer_findings pr=807 sha=7dbee837a933a08bc66f492816430d00ef0bfdd5 --> # Patchwarden PR sanity **Operator signal:** 🛑 STOP - reviewer finding(s) must be addressed or explicitly accepted. **Automerge signal:** ❌ NOT READY - no unattended merge or APPROVED review should be published. **Verdict:** 🛑 STOP - a model reviewer reported actionable findings. **Next step:** Address the reviewer finding(s), or leave a human decision explaining why the risk is accepted. - PR: `807` - Commit: `7dbee837a933a08bc66f492816430d00ef0bfdd5` - Status: `advisory_findings` - Reviewer health: `findings` - Security-sensitive label: `present` - Authority: Patchwarden policy signal; branch protection and automerge controller remain merge authority. - Model mix: `glm-5.2:cloud`, `deepseek-v4-pro:cloud`, `kimi-k2.7-code:cloud` ## What I checked - Changed files: `2` - Deterministic blocker scan: `clean` - Model reviewer lanes: `3` - Comment contract: this comment is updated in place via a hidden Patchwarden marker. ## Approval Handoff - State: `not_ready_reviewer_findings` - Action: address reviewer finding(s) or leave a human decision before any unattended approval. - Boundary: branch protection and the automerge controller remain merge authority. ## Signal Board - Legend: ✅ evidence is sufficient; 🟡 controller still has work; ⚠️ automation retries first; 🛑/❌ do not approve or merge. | Lane | Signal | Meaning | | --- | --- | --- | | 🧪 Deterministic sanity | ✅ `clean` | No deterministic blockers found. | | 🧠 Model reviewers | ❌ `findings` | Address reviewer finding(s) before approval. | | 🛡️ Patchwarden approval | ❌ `not_ready_reviewer_findings` | No unattended APPROVED review should be published. | | 🚦 Unattended automerge | ❌ `ineligible` | Outside the narrow safe-docs/status unattended lane. | | 🙋 Owner attention | 🔁 `automation first` | Retry, repair, or inspect automation before asking the owner. | - Scope blocker: non-doc/status path(s): `control-plane/platformctl/memory.py`, `control-plane/platformctl/tests/test_memory_sacred_consistency.py` - Risk label blocker: `class/security-sensitive`, `tier/full` - Security-sensitive blocker: `class/security-sensitive` is present. 🧭 Merge authority: branch protection and automerge controller remain authoritative. ## Required Fixes No deterministic blockers. ## Reviewer Details <details> <summary>Model reviewer lanes</summary> ### `global-glm` / `glm-5.2:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.7-code:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`high`** Symlink/path-aliasing bypass of regex-only sacred guard - Evidence: `memory.py new comment at SACRED_PATH_PATTERNS deliberately rejects filesystem resolution ('Deliberately NOT derived from safety.is_sacred_path... matched on operation+path alone') and keeps component regex search on the raw string. test_mem` - Next: Resolve the payload against its intended workspace/base directory (not the control-plane CWD) before regex matching, or add an explicit regression test and operator comment accepting the residual aliasing risk and requiring downstream enforcement. </details> ## Policy notes - Patchwarden PR sanity is the first merge-lane signal for this PR. - Models produce findings; Patchwarden/policy produces decisions. - Model findings alone do not fail the status check; they require human or agent disposition. - Formal approval is separate from this comment and requires clean reviewer health. - Automerge remains delegated to branch protection and the automerge pilot.

Iskra commented 2026-06-23 03:01:19 +02:00

Collaborator

Copy link

Iskra judgment

Field	Value
Target	pdurlej/platform#pull_request#807
Priority	p1
Action	patchwarden_candidate
Scores	reach 4 / impact 4 / confidence 4
Piotr fit	high
Effort	small
Labels	judge/p1, judge/patchwarden-candidate
Judge	iskra via openclaw

Rationale: This pins drift between independent sacred-path guard sources, reducing the chance that destructive memory-control-plane protections silently fall behind governance policy.

Caveat: The packet excerpt does not include the full diff or test output, so review should verify the pinned consistency check matches intended guard semantics.

Structured openclaw.judge.v0 payload

<!-- openclaw.judge.v0 -->
{
  "confidence": 4,
  "effort_hint": "small",
  "escalation": {
    "kind": "patchwarden_review",
    "reason": "The PR touches safety-adjacent guard consistency and should receive focused review before merge."
  },
  "evidence_refs": [
    {
      "note": "Public repository metadata and dry-run packet only.",
      "type": "snapshot",
      "value": "pr-title-body-labels-and-target-snapshot"
    }
  ],
  "impact": 4,
  "judge_actor": {
    "name": "iskra",
    "runtime": "openclaw"
  },
  "judged_at": "2026-06-23T00:00:00Z",
  "labels_to_apply": [
    "judge/p1",
    "judge/patchwarden-candidate"
  ],
  "piotr_fit": "high",
  "priority": "p1",
  "rationale_summary": "This pins drift between independent sacred-path guard sources, reducing the chance that destructive memory-control-plane protections silently fall behind governance policy.",
  "reach": 4,
  "recommended_next_action": "patchwarden_candidate",
  "rerun_reason": "no_prior_judgment",
  "schema": "openclaw.judge.v0",
  "target": {
    "kind": "pull_request",
    "number": 807,
    "repo": "pdurlej/platform"
  },
  "target_snapshot": {
    "body_hash": "sha256:72a1058113741f4db8a168b5a3a50d38c5071b20c4ed5b29e726acffa92b133f",
    "commit_count": 1,
    "evidence_hash": "sha256:abba4c82a8ea0223b969a93da11258eda797de95b31920f6b7bd17241d9d0f52",
    "head_sha": "250b8ced32772af7c9a323cf6a4b4ba942e7d942",
    "labels": [],
    "labels_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "state": "open",
    "title_hash": "sha256:6618066de7fe9b582e7b1d9ddcda6d4948f6a87cabbb1395793b445ed8f0dfd4",
    "updated_at": "2026-06-18T15:34:15+02:00"
  },
  "top_caveat": "The packet excerpt does not include the full diff or test output, so review should verify the pinned consistency check matches intended guard semantics."
}
<!-- /openclaw.judge.v0 -->

### Iskra judgment | Field | Value | | --- | --- | | Target | `pdurlej/platform#pull_request#807` | | Priority | p1 | | Action | patchwarden_candidate | | Scores | reach 4 / impact 4 / confidence 4 | | Piotr fit | high | | Effort | small | | Labels | `judge/p1`, `judge/patchwarden-candidate` | | Judge | `iskra` via `openclaw` | **Rationale:** This pins drift between independent sacred-path guard sources, reducing the chance that destructive memory-control-plane protections silently fall behind governance policy. **Caveat:** The packet excerpt does not include the full diff or test output, so review should verify the pinned consistency check matches intended guard semantics. <details> <summary>Structured openclaw.judge.v0 payload</summary> ```json <!-- openclaw.judge.v0 --> { "confidence": 4, "effort_hint": "small", "escalation": { "kind": "patchwarden_review", "reason": "The PR touches safety-adjacent guard consistency and should receive focused review before merge." }, "evidence_refs": [ { "note": "Public repository metadata and dry-run packet only.", "type": "snapshot", "value": "pr-title-body-labels-and-target-snapshot" } ], "impact": 4, "judge_actor": { "name": "iskra", "runtime": "openclaw" }, "judged_at": "2026-06-23T00:00:00Z", "labels_to_apply": [ "judge/p1", "judge/patchwarden-candidate" ], "piotr_fit": "high", "priority": "p1", "rationale_summary": "This pins drift between independent sacred-path guard sources, reducing the chance that destructive memory-control-plane protections silently fall behind governance policy.", "reach": 4, "recommended_next_action": "patchwarden_candidate", "rerun_reason": "no_prior_judgment", "schema": "openclaw.judge.v0", "target": { "kind": "pull_request", "number": 807, "repo": "pdurlej/platform" }, "target_snapshot": { "body_hash": "sha256:72a1058113741f4db8a168b5a3a50d38c5071b20c4ed5b29e726acffa92b133f", "commit_count": 1, "evidence_hash": "sha256:abba4c82a8ea0223b969a93da11258eda797de95b31920f6b7bd17241d9d0f52", "head_sha": "250b8ced32772af7c9a323cf6a4b4ba942e7d942", "labels": [], "labels_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "state": "open", "title_hash": "sha256:6618066de7fe9b582e7b1d9ddcda6d4948f6a87cabbb1395793b445ed8f0dfd4", "updated_at": "2026-06-18T15:34:15+02:00" }, "top_caveat": "The packet excerpt does not include the full diff or test output, so review should verify the pinned consistency check matches intended guard semantics." } <!-- /openclaw.judge.v0 --> ``` </details>

Iskra added the

judge/p1

judge/patchwarden-candidate

labels 2026-06-23 03:01:20 +02:00

Iskra referenced this pull request from pdurlej/judging-claw 2026-06-23 03:01:20 +02:00

[Judging Claw] patchwarden_candidate for pdurlej/platform#807 (p1) #133

Iskra commented 2026-06-24 03:01:07 +02:00

Collaborator

Copy link

Iskra judgment

Field	Value
Target	pdurlej/platform#pull_request#807
Priority	p1
Action	patchwarden_candidate
Scores	reach 4 / impact 4 / confidence 4
Piotr fit	high
Effort	small
Labels	judge/p1, judge/patchwarden-candidate
Judge	iskra via openclaw

Rationale: This PR appears to pin an important safety invariant between memory hook sacred-path handling and canonical repo-wide sacred-path policy, reducing silent drift in destructive-operation guards.

Caveat: The packet excerpt does not include the full diff or test output, so review should confirm the generated policy and regex coverage preserve intended behavior.

Structured openclaw.judge.v0 payload

<!-- openclaw.judge.v0 -->
{
  "confidence": 4,
  "effort_hint": "small",
  "escalation": {
    "kind": "patchwarden_review",
    "reason": "Patchwarden should verify the consistency test and guard semantics before merge."
  },
  "evidence_refs": [
    {
      "note": "Public repository metadata, prior judgment, labels, and dry-run packet excerpt only.",
      "type": "snapshot",
      "value": "issue-or-pr-title-body-labels-and-target-snapshot"
    },
    {
      "note": "Previous public judgment already classified this as p1 patchwarden-candidate and the target changed since then.",
      "type": "snapshot",
      "value": "previous-public-judgment-and-target-changed-rerun"
    }
  ],
  "impact": 4,
  "judge_actor": {
    "name": "iskra",
    "runtime": "openclaw"
  },
  "judged_at": "2026-06-24T01:00:28Z",
  "labels_to_apply": [
    "judge/p1",
    "judge/patchwarden-candidate"
  ],
  "piotr_fit": "high",
  "priority": "p1",
  "rationale_summary": "This PR appears to pin an important safety invariant between memory hook sacred-path handling and canonical repo-wide sacred-path policy, reducing silent drift in destructive-operation guards.",
  "reach": 4,
  "recommended_next_action": "patchwarden_candidate",
  "rerun_reason": "target_changed",
  "schema": "openclaw.judge.v0",
  "target": {
    "kind": "pull_request",
    "number": 807,
    "repo": "pdurlej/platform"
  },
  "target_snapshot": {
    "body_hash": "sha256:72a1058113741f4db8a168b5a3a50d38c5071b20c4ed5b29e726acffa92b133f",
    "commit_count": 1,
    "evidence_hash": "sha256:174b7ea770f516cdaa0ac16679e9382c01606d5afff1f029f61a52cc6cc07461",
    "head_sha": "250b8ced32772af7c9a323cf6a4b4ba942e7d942",
    "labels": [
      "judge/p1",
      "judge/patchwarden-candidate"
    ],
    "labels_hash": "sha256:0201cd844d34972d5631e146e07a0345e98dbce67192eca387a3cae40e5f2754",
    "state": "open",
    "title_hash": "sha256:6618066de7fe9b582e7b1d9ddcda6d4948f6a87cabbb1395793b445ed8f0dfd4",
    "updated_at": "2026-06-23T03:01:20+02:00"
  },
  "top_caveat": "The packet excerpt does not include the full diff or test output, so review should confirm the generated policy and regex coverage preserve intended behavior."
}
<!-- /openclaw.judge.v0 -->

### Iskra judgment | Field | Value | | --- | --- | | Target | `pdurlej/platform#pull_request#807` | | Priority | p1 | | Action | patchwarden_candidate | | Scores | reach 4 / impact 4 / confidence 4 | | Piotr fit | high | | Effort | small | | Labels | `judge/p1`, `judge/patchwarden-candidate` | | Judge | `iskra` via `openclaw` | **Rationale:** This PR appears to pin an important safety invariant between memory hook sacred-path handling and canonical repo-wide sacred-path policy, reducing silent drift in destructive-operation guards. **Caveat:** The packet excerpt does not include the full diff or test output, so review should confirm the generated policy and regex coverage preserve intended behavior. <details> <summary>Structured openclaw.judge.v0 payload</summary> ```json <!-- openclaw.judge.v0 --> { "confidence": 4, "effort_hint": "small", "escalation": { "kind": "patchwarden_review", "reason": "Patchwarden should verify the consistency test and guard semantics before merge." }, "evidence_refs": [ { "note": "Public repository metadata, prior judgment, labels, and dry-run packet excerpt only.", "type": "snapshot", "value": "issue-or-pr-title-body-labels-and-target-snapshot" }, { "note": "Previous public judgment already classified this as p1 patchwarden-candidate and the target changed since then.", "type": "snapshot", "value": "previous-public-judgment-and-target-changed-rerun" } ], "impact": 4, "judge_actor": { "name": "iskra", "runtime": "openclaw" }, "judged_at": "2026-06-24T01:00:28Z", "labels_to_apply": [ "judge/p1", "judge/patchwarden-candidate" ], "piotr_fit": "high", "priority": "p1", "rationale_summary": "This PR appears to pin an important safety invariant between memory hook sacred-path handling and canonical repo-wide sacred-path policy, reducing silent drift in destructive-operation guards.", "reach": 4, "recommended_next_action": "patchwarden_candidate", "rerun_reason": "target_changed", "schema": "openclaw.judge.v0", "target": { "kind": "pull_request", "number": 807, "repo": "pdurlej/platform" }, "target_snapshot": { "body_hash": "sha256:72a1058113741f4db8a168b5a3a50d38c5071b20c4ed5b29e726acffa92b133f", "commit_count": 1, "evidence_hash": "sha256:174b7ea770f516cdaa0ac16679e9382c01606d5afff1f029f61a52cc6cc07461", "head_sha": "250b8ced32772af7c9a323cf6a4b4ba942e7d942", "labels": [ "judge/p1", "judge/patchwarden-candidate" ], "labels_hash": "sha256:0201cd844d34972d5631e146e07a0345e98dbce67192eca387a3cae40e5f2754", "state": "open", "title_hash": "sha256:6618066de7fe9b582e7b1d9ddcda6d4948f6a87cabbb1395793b445ed8f0dfd4", "updated_at": "2026-06-23T03:01:20+02:00" }, "top_caveat": "The packet excerpt does not include the full diff or test output, so review should confirm the generated policy and regex coverage preserve intended behavior." } <!-- /openclaw.judge.v0 --> ``` </details>

Iskra referenced this pull request from pdurlej/judging-claw 2026-06-24 03:01:08 +02:00

[Judging Claw] patchwarden_candidate for pdurlej/platform#807 (p1) #136

codex referenced this pull request 2026-06-25 12:36:28 +02:00

goal(patchwarden): enable unattended merge-safety loop for eligible Platform PRs #823

codex added the

class/security-sensitive

risk/process

tier/full

owner-attention

status:operator-needed

labels 2026-06-26 00:27:23 +02:00

codex added 1 commit 2026-06-26 10:45:56 +02:00

Merge remote-tracking branch 'origin/main' into claude/issues/memory-sacred-path-consistency bca9b89e8f

codex added 1 commit 2026-06-26 13:04:35 +02:00

Merge remote-tracking branch 'origin/main' into claude/issues/memory-sacred-path-consistency 7dbee837a9

Iskra approved these changes 2026-06-26 13:13:54 +02:00

Iskra left a comment

Copy link

Operator live approval present for #807: branch is current and all latest CI/Patchwarden contexts are green. Approval recorded by Iskra as merge actor for the sacred-path consistency test PR.

Operator live approval present for #807: branch is current and all latest CI/Patchwarden contexts are green. Approval recorded by Iskra as merge actor for the sacred-path consistency test PR.

Iskra merged commit 205a19568b into main 2026-06-26 13:13:55 +02:00

Iskra referenced this pull request from a commit 2026-06-26 13:13:56 +02:00

Merge pull request #807

Sign in to join this conversation.

Reviewers

No reviewers

Iskra

Labels

Clear labels   

W6d-automerge-calibration

  

agent/claude-code

Vistula actor: Claude Code.

  

agent/codex

Vistula actor: Codex.

  

agent/hermes

Vistula actor: Hermes Upstream.

  

agent/iskra

Vistula actor: Iskra.

  

agent/ollama

Vistula actor: Ollama or compatible model.

  

agent/patchwarden

Vistula actor: Patchwarden.

  

automerge-candidate

Candidate for narrow W6d autonomous merge readiness pilot

  

class/security-sensitive

Security-sensitive class of service: smallest coherent PRs and full canary

  

cutover-gate

blocks production declare / final RS2000 replacement

  

dependency/blocked

Vistula dependency state: blocked.

  

dependency/blocks-others

Vistula dependency state: blocks other work.

  

dependency/cross-repo

Vistula dependency scope: cross-repository.

  

dependency/needs-confirmation

Vistula dependency state: needs confirmation.

  

domain:agents

Agent identity, delegation, subagents, routing, or workflows.

  

domain:ci

CI, checks, Actions, runners, or release automation.

  

domain:docs

Documentation, packets, practices, or source-of-truth text.

  

domain:forgejo

Forgejo issues, PRs, labels, repo settings, or identity.

  

domain:infra

Infrastructure, storage, backup, DNS, network, or host substrate.

  

domain:memory

Memory, recall, write gates, salience, or Honcho-adjacent behavior.

  

domain:runtime

Runtime services, deploys, daemons, timers, or live behavior.

  

domain:signal

Signal UX, delivery, context, or outbound behavior.

  

domain:ux

Product UX, operator experience, or conversation ergonomics.

  

flow/architecture

Vistula lifecycle: architecture phase in progress.

  

flow/blocked

Vistula lifecycle: blocked on dependency or decision.

  

flow/deployed

Vistula lifecycle: deployed to runtime where applicable.

  

flow/done

Vistula lifecycle: work merged or otherwise done.

  

flow/implementation

Vistula lifecycle: implementation phase in progress.

  

flow/intake

Vistula lifecycle: incoming signal not refined yet.

  

flow/maintained

Vistula lifecycle: maintained/steady state.

  

flow/observed

Vistula lifecycle: observed after delivery.

  

flow/ready

Vistula lifecycle: ready for architecture or implementation.

  

flow/refining

Vistula lifecycle: Hermes/spec refinement in progress.

  

flow/retired

Vistula lifecycle: retired or intentionally closed.

  

flow/review

Vistula lifecycle: review phase in progress.

  

iterating

Orchestrator/Codex actively amending in response to review — operator can ignore until resolved

  

judge/codex-candidate

Candidate for Codex implementation.

  

judge/hermes-candidate

Candidate for Hermes discovery/research.

  

judge/low-confidence

Judgment confidence is low.

  

judge/needs-refinement

Needs clearer evidence or scope.

  

judge/operator-needed

Needs Piotr decision or input.

  

judge/p0

Urgent, operator attention or unblock now.

  

judge/p1

High value, schedule soon.

  

judge/p2

Useful, normal queue.

  

judge/p3

Low priority, keep but do not chase.

  

judge/park

Parked from current attention.

  

judge/patchwarden-candidate

Needs Patchwarden merge-safety attention.

  

judge/stale-priority

Existing priority judgment appears stale.

  

kind/adr

Vistula work kind: architecture decision record.

  

kind/bug

Vistula work kind: bug fix.

  

kind/chore

Vistula work kind: chore.

  

kind/feature

Vistula work kind: feature.

  

kind/infra

Vistula work kind: infrastructure.

  

kind/ops

Vistula work kind: operations.

  

kind/refactor

Vistula work kind: refactor.

  

kind/research

Vistula work kind: research/discovery.

  

large-impact

Per charter §3 review-by-impact: large impact (≥300 LOC OR new module OR identity/secret change OR architectural pivot) — Oracle pre-review recommended

  

merge/auto

Vistula merge mode: automated merge.

  

merge/manual

Vistula merge mode: manual merge.

  

merge/manual-dependency-conflict

Manual merge reason: dependency conflict.

  

merge/manual-failing-tests

Manual merge reason: failing tests.

  

merge/manual-merge-conflict

Manual merge reason: merge conflict.

  

merge/manual-missing-review

Manual merge reason: missing review.

  

merge/manual-operator-preference

Manual merge reason: operator preference.

  

merge/manual-red-zone

Manual merge reason: red-zone risk.

  

merge/manual-security-sensitive

Manual merge reason: security-sensitive work.

  

merge/manual-unclear-scope

Manual merge reason: unclear scope.

  

merge/manual-unknown

Manual merge reason: unknown.

  

meta

meta-decomposition issue; first agent decomposes into atomic children

  

mode:operator-only

Apply step requires explicit operator approval.

  

mode:patchwarden-iskra-approved

Work eligible for Patchwarden/Iskra approval inside repo policy.

  

mode:safe-auto

Low-risk work eligible for lightweight autonomous handling.

  

needs-operator-decision

PR is blocked on operator yes/no decision — fresh-Claude/Codex won't make this call alone

  

needs-triage

decomposing agent has open questions / unknowns

  

not-ready

reviewed but blocked on a precondition

  

observed/erroring

Vistula observation: erroring.

  

observed/needs-followup

Vistula observation: needs follow-up.

  

observed/pending

Vistula observation: pending.

  

observed/retire-candidate

Vistula observation: retire candidate.

  

observed/unused

Vistula observation: unused.

  

observed/used

Vistula observation: used.

  

operator-emotional

operator-emotional importance (Iskra memory etc.)

  

owner-attention

owner must decide; blocks default path

  

phase/02

Phase 02 cataloging

  

phase/03

Phase 03 control plane (platformctl)

  

priority:p0

Immediate safety, uptime, data, or operator-blocking issue.

  

priority:p1

Important active work; should be pulled soon.

  

priority:p2

Useful normal-priority work.

  

priority:p3

Opportunistic cleanup, research, or backlog work.

  

proposed

auto-generated by meta-decomposition; awaiting human review

  

ready-for-agent

reviewed and pickable; agents may claim per cookbook

  

ready-for-operator

PR is ready for operator review/merge — orchestrator finished its part

  

recovery

disaster recovery / restore semantics relevant

  

review:claude-reviewed

Reviewed by Claude-family agent.

  

review:codex-reviewed

Reviewed by Codex-family agent.

  

review:dziadek-reviewed

Reviewed by Dziadek pinch-point reviewer.

  

review:needs-human

Needs human review before merge or apply.

  

risk/exposure

incorrectly public/private/tailnet/auth/routed

  

risk/process

workflow/review/orchestration may produce bad outcomes

  

risk/product

work may have lost owner/user value

  

risk/runtime

platform may not run, recover, validate, behave reproducibly

  

safety:external-write

May write to external systems, users, rooms, repos, or services.

  

safety:no-prod-mutation

Must not mutate production or live external state.

  

safety:prod-impact

May affect production/runtime behavior.

  

safety:secret-touch

Touches secrets, credentials, auth, or secret-adjacent config.

  

size/large

Vistula size: large.

  

size/medium

Vistula size: medium.

  

size/small

Vistula size: small.

  

size/tiny

Vistula size: tiny.

  

size/unknown

Vistula size: not classified yet.

  

source/adr

Vistula source: ADR.

  

source/agent-generated

Vistula source: agent generated.

  

source/manual

Vistula source: manual entry.

  

source/operator-chat

Vistula source: operator chat.

  

source/voice-note

Vistula source: voice note.

  

status:blocked

Blocked by missing dependency, evidence, access, or operator decision.

  

status:codex-ready

Ready for a Codex implementation pass.

  

status:merged:pending-evidence

Merged but waiting for live or artifact evidence before closure.

  

status:needs-evidence

Needs proof, logs, tests, or operator-visible evidence.

  

status:operator-needed

Requires explicit operator input before safe progress.

  

status:parked

Intentionally deferred; not active campaign work.

  

tier/full

Full review tier per ADR-0007

  

tier/lite

Lite review tier per ADR-0007

  

tier/stacked

Stacked PR (base != main) escape hatch per ADR-0017. Requires consolidator-PR plan in PR body.

  

tier:0-platform-substrate

Data, secrets, backup, storage, or critical platform substrate.

  

tier:1-iskra-value-layer

Iskra/OpenClaw behavior, memory, runtime, or value-layer work.

  

tier:2-tools-products-modules

Tools, products, modules, experiments, and lower-blast-radius work.

  

type:bug

Incorrect behavior or regression.

  

type:chore

Maintenance, cleanup, metadata, or operational task.

  

type:docs

Documentation-only work.

  

type:feat

New capability or product behavior.

  

type:policy

Governance, protocol, boundary, or decision-contract change.

  

type:research

Investigation, spike, or evidence-gathering task.

No labels

W6d-automerge-calibration

agent/claude-code

agent/codex

agent/hermes

agent/iskra

agent/ollama

agent/patchwarden

automerge-candidate

class/security-sensitive

cutover-gate

dependency/blocked

dependency/blocks-others

dependency/cross-repo

dependency/needs-confirmation

domain:agents

domain:ci

domain:docs

domain:forgejo

domain:infra

domain:memory

domain:runtime

domain:signal

domain:ux

flow/architecture

flow/blocked

flow/deployed

flow/done

flow/implementation

flow/intake

flow/maintained

flow/observed

flow/ready

flow/refining

flow/retired

flow/review

iterating

judge/codex-candidate

judge/hermes-candidate

judge/low-confidence

judge/needs-refinement

judge/operator-needed

judge/p0

judge/p1

judge/p2

judge/p3

judge/park

judge/patchwarden-candidate

judge/stale-priority

kind/adr

kind/bug

kind/chore

kind/feature

kind/infra

kind/ops

kind/refactor

kind/research

large-impact

merge/auto

merge/manual

merge/manual-dependency-conflict

merge/manual-failing-tests

merge/manual-merge-conflict

merge/manual-missing-review

merge/manual-operator-preference

merge/manual-red-zone

merge/manual-security-sensitive

merge/manual-unclear-scope

merge/manual-unknown

meta

mode:operator-only

mode:patchwarden-iskra-approved

mode:safe-auto

needs-operator-decision

needs-triage

not-ready

observed/erroring

observed/needs-followup

observed/pending

observed/retire-candidate

observed/unused

observed/used

operator-emotional

owner-attention

phase/02

phase/03

priority:p0

priority:p1

priority:p2

priority:p3

proposed

ready-for-agent

ready-for-operator

recovery

review:claude-reviewed

review:codex-reviewed

review:dziadek-reviewed

review:needs-human

risk/exposure

risk/process

risk/product

risk/runtime

safety:external-write

safety:no-prod-mutation

safety:prod-impact

safety:secret-touch

size/large

size/medium

size/small

size/tiny

size/unknown

source/adr

source/agent-generated

source/manual

source/operator-chat

source/voice-note

status:blocked

status:codex-ready

status:merged:pending-evidence

status:needs-evidence

status:operator-needed

status:parked

tier/full

tier/lite

tier/stacked

tier:0-platform-substrate

tier:1-iskra-value-layer

tier:2-tools-products-modules

type:bug

type:chore

type:docs

type:feat

type:policy

type:research

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

4 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pdurlej/platform!807

No description provided.