pdurlej/platform

Fork 0

feat(patchwarden): emit controller merge verdicts #824

Merged

pdurlej merged 1 commit from codex/issue-823-patchwarden-verdict into main

2026-06-25 14:56:14 +02:00

codex commented

2026-06-25 14:30:23 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

Platform PRs should give agents and the merge controller a deterministic next action instead of forcing Piotr to interpret a generic blocked result. Routine low-risk PRs need a machine-readable path to controller merge; security-sensitive or stale-evidence PRs must fail closed with a clear reason.

What changed

automerge_readiness.py now keeps legacy status/ready and adds controller-facing verdict values: ready_for_controller_merge, needs_agent_repair, needs_human, and blocked_stale_or_missing_evidence.
Readiness artifacts now include per-blocker code, reason, repairInstruction, and acceptanceCondition.
needs_human outranks repair/evidence blockers so security-sensitive or unsafe-scope PRs cannot be hidden behind missing checks.
automerge_actor.py now refuses approval/merge unless the readiness artifact has verdict: ready_for_controller_merge and the PR head SHA matches readiness.pr.headSha.
W6d/Patchwarden docs describe the new contract.

Why it changed

Issue #823 needs a consumable Patchwarden/automerge contract for the loop: PR -> verdict -> agent repair or controller merge or human handling. The old ready/not_candidate/blocked output was safe but too coarse for unattended operation.

Files touched

control-plane/platformctl/ci/automerge_readiness.py
control-plane/platformctl/ci/automerge_actor.py
control-plane/platformctl/tests/test_automerge_readiness.py
control-plane/platformctl/tests/test_automerge_actor.py
docs/forgejo-agent-operations.md
state/cycle/W6d-autonomous-merge-pilot.md

Relevant context

docs/forgejo-agent-operations.md Autonomous Merge Readiness v0
state/cycle/W6d-autonomous-merge-pilot.md W6d policy notes
platform issue #823

Runtime evidence

No runtime mutation, no deploy, no branch-protection change, no token read/print. This is repo/control-plane only.

Known constraints

This PR itself is not an automerge candidate. It touches control-plane merge-safety behavior and must stay manual/full-review. The low-risk dogfood PR required by #823 should run after this PR lands on main.

Explicit out-of-scope

No change to W6d safe path scope.
No auto-merge of class/security-sensitive PRs.
No branch protection, DNS, auth, ingress, runtime deploy, or public exposure change.
No controller retry-loop/attempt counter; future controller can use the new verdicts to implement that.

Requested decision

Review whether the readiness artifact and merge actor now fail closed while giving agents enough repair instructions to redrive.

Merge blockers

Any canary or Patchwarden finding that shows needs_human can be bypassed.
Any issue where a stale/mismatched readiness artifact can approve or merge a newer PR head.
Any broadening of automerge scope beyond W6d docs/status safe paths.

Verification

PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_automerge_readiness.py control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_pr_sanity.py → 68 passed.
git diff --check → clean.
Local verdict smoke: ready docs candidate -> ready_for_controller_merge; failed check -> needs_agent_repair; security-sensitive candidate -> needs_human; missing evidence -> blocked_stale_or_missing_evidence.
Broader PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests did not collect because this local interpreter lacks click; focused CI-adjacent suites above passed.

External advisory checks

AntiGravity/Gemini sanitized readability check: output is executable for controller/agent; accepted one safety improvement and made merge actor require explicit verdict: ready_for_controller_merge instead of accepting a legacy ready=true artifact.
Ollama/Kimi sanitized red-team was attempted; result was off-scope for this Forgejo API client change and no finding was accepted.

Spec sources read

docs/forgejo-agent-operations.md — Forgejo/Patchwarden/automerge contract.
control-plane/platformctl/ci/automerge_readiness.py — readiness policy implementation.
control-plane/platformctl/ci/automerge_actor.py — approval/merge actor guard.
control-plane/platformctl/tests/test_automerge_readiness.py — readiness tests.
control-plane/platformctl/tests/test_automerge_actor.py — actor tests.
.forgejo/workflows/automerge-pilot.yml — workflow consumer of readiness/actor.
.forgejo/workflows/patchwarden-client-dry-run.yml — Patchwarden client status/artifact path.
.forgejo/workflows/patchwarden-pr-sanity.yml — Patchwarden sanity status path.

Refs #823

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Platform PRs should give agents and the merge controller a deterministic next action instead of forcing Piotr to interpret a generic `blocked` result. Routine low-risk PRs need a machine-readable path to controller merge; security-sensitive or stale-evidence PRs must fail closed with a clear reason. ### What changed - `automerge_readiness.py` now keeps legacy `status`/`ready` and adds controller-facing `verdict` values: `ready_for_controller_merge`, `needs_agent_repair`, `needs_human`, and `blocked_stale_or_missing_evidence`. - Readiness artifacts now include per-blocker `code`, `reason`, `repairInstruction`, and `acceptanceCondition`. - `needs_human` outranks repair/evidence blockers so security-sensitive or unsafe-scope PRs cannot be hidden behind missing checks. - `automerge_actor.py` now refuses approval/merge unless the readiness artifact has `verdict: ready_for_controller_merge` and the PR head SHA matches `readiness.pr.headSha`. - W6d/Patchwarden docs describe the new contract. ### Why it changed Issue #823 needs a consumable Patchwarden/automerge contract for the loop: PR -> verdict -> agent repair or controller merge or human handling. The old `ready/not_candidate/blocked` output was safe but too coarse for unattended operation. ### Files touched - `control-plane/platformctl/ci/automerge_readiness.py` - `control-plane/platformctl/ci/automerge_actor.py` - `control-plane/platformctl/tests/test_automerge_readiness.py` - `control-plane/platformctl/tests/test_automerge_actor.py` - `docs/forgejo-agent-operations.md` - `state/cycle/W6d-autonomous-merge-pilot.md` ### Relevant context - `docs/forgejo-agent-operations.md` Autonomous Merge Readiness v0 - `state/cycle/W6d-autonomous-merge-pilot.md` W6d policy notes - platform issue #823 ### Runtime evidence No runtime mutation, no deploy, no branch-protection change, no token read/print. This is repo/control-plane only. ### Known constraints This PR itself is not an automerge candidate. It touches control-plane merge-safety behavior and must stay manual/full-review. The low-risk dogfood PR required by #823 should run after this PR lands on `main`. ### Explicit out-of-scope - No change to W6d safe path scope. - No auto-merge of `class/security-sensitive` PRs. - No branch protection, DNS, auth, ingress, runtime deploy, or public exposure change. - No controller retry-loop/attempt counter; future controller can use the new verdicts to implement that. ### Requested decision Review whether the readiness artifact and merge actor now fail closed while giving agents enough repair instructions to redrive. ### Merge blockers - Any canary or Patchwarden finding that shows `needs_human` can be bypassed. - Any issue where a stale/mismatched readiness artifact can approve or merge a newer PR head. - Any broadening of automerge scope beyond W6d docs/status safe paths. ## Verification - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_automerge_readiness.py control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_pr_sanity.py` → 68 passed. - `git diff --check` → clean. - Local verdict smoke: ready docs candidate -> `ready_for_controller_merge`; failed check -> `needs_agent_repair`; security-sensitive candidate -> `needs_human`; missing evidence -> `blocked_stale_or_missing_evidence`. - Broader `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests` did not collect because this local interpreter lacks `click`; focused CI-adjacent suites above passed. ## External advisory checks - AntiGravity/Gemini sanitized readability check: output is executable for controller/agent; accepted one safety improvement and made merge actor require explicit `verdict: ready_for_controller_merge` instead of accepting a legacy `ready=true` artifact. - Ollama/Kimi sanitized red-team was attempted; result was off-scope for this Forgejo API client change and no finding was accepted. ## Spec sources read - `docs/forgejo-agent-operations.md` — Forgejo/Patchwarden/automerge contract. - `control-plane/platformctl/ci/automerge_readiness.py` — readiness policy implementation. - `control-plane/platformctl/ci/automerge_actor.py` — approval/merge actor guard. - `control-plane/platformctl/tests/test_automerge_readiness.py` — readiness tests. - `control-plane/platformctl/tests/test_automerge_actor.py` — actor tests. - `.forgejo/workflows/automerge-pilot.yml` — workflow consumer of readiness/actor. - `.forgejo/workflows/patchwarden-client-dry-run.yml` — Patchwarden client status/artifact path. - `.forgejo/workflows/patchwarden-pr-sanity.yml` — Patchwarden sanity status path. Refs #823

codex added the

class/security-sensitive

tier/full

judge/p1

judge/patchwarden-candidate

labels

2026-06-25 14:30:23 +02:00

codex added 1 commit

2026-06-25 14:30:23 +02:00

feat(patchwarden): emit controller merge verdicts

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 15s

Details

python-ci / Python 3.13 (pull_request) Successful in 42s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 18s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 4m17s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

python-ci / Python 3.11 (pull_request) Successful in 41s

Details

python-ci / Python 3.12 (pull_request) Successful in 42s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Successful in 16s

Details

2344f63b9e

codex referenced this pull request

2026-06-25 14:30:58 +02:00

goal(patchwarden): enable unattended merge-safety loop for eligible Platform PRs #823

patchwarden commented

2026-06-25 14:38:20 +02:00

First-time contributor

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 824
Commit: 2344f63b9ee3b96ef96cd45a4cef939952f0ace7
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: error
Verdict: -
Note: ReadTimeout: The read operation timed out
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `824` - Commit: `2344f63b9ee3b96ef96cd45a4cef939952f0ace7` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `error` - Verdict: `-` - Note: ReadTimeout: The read operation timed out - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.