pdurlej/platform

Fork 0

feat: use Patchwarden core PR sanity renderer #830

Merged

pdurlej merged 2 commits from codex/use-patchwarden-pr-sanity-renderer into main

2026-06-26 00:41:34 +02:00

codex commented

2026-06-26 00:22:56 +02:00

Collaborator

Summary

delegate platform PR sanity comment rendering to patchwarden pr-sanity-comment
keep auto fallback for local/dev runs without Patchwarden installed
install Patchwarden from pdurlej/patchwarden@main in the trusted-base PR sanity workflow and require the core renderer there

Vistula

Value: quality
Effort: small
Lead time: same-day

Verification

env PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_pr_sanity.py

Refs pdurlej/patchwarden#69

## Summary - delegate platform PR sanity comment rendering to `patchwarden pr-sanity-comment` - keep `auto` fallback for local/dev runs without Patchwarden installed - install Patchwarden from `pdurlej/patchwarden@main` in the trusted-base PR sanity workflow and require the core renderer there ## Vistula - Value: quality - Effort: small - Lead time: same-day ## Verification - `env PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_pr_sanity.py` Refs pdurlej/patchwarden#69

codex added 1 commit

2026-06-26 00:22:56 +02:00

feat: use Patchwarden PR sanity renderer

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 15s

Details

python-ci / Python 3.11 (pull_request) Successful in 40s

Details

python-ci / Python 3.12 (pull_request) Successful in 41s

Details

python-ci / Python 3.13 (pull_request) Successful in 42s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

canary-required / canary (pull_request) Successful in 16s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 3s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 18s

Details

patchwarden-pr-sanity / sanity (pull_request) Failing after 22s

Details

ba9f6a2786

codex added the

agent/codex

class/security-sensitive

judge/patchwarden-candidate

risk/process

tier/full

labels

2026-06-26 00:27:22 +02:00

codex added 1 commit

2026-06-26 00:34:01 +02:00

fix: pass Patchwarden renderer through env

base-is-main / guard (pull_request) Successful in 1s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 18s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 17s

Details

python-ci / Python 3.11 (pull_request) Successful in 41s

Details

python-ci / Python 3.12 (pull_request) Successful in 44s

Details

python-ci / Python 3.13 (pull_request) Successful in 43s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 19s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 3s

Details

canary-required / canary (pull_request) Successful in 15s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 37s

Details

5c90d6b118

ollama referenced this pull request

2026-06-26 00:34:04 +02:00

docs(status): refresh platform operability board #831

codex referenced this pull request

2026-06-26 00:35:23 +02:00

docs(status): refresh platform operability board #832

patchwarden commented

2026-06-26 00:38:37 +02:00

First-time contributor

Patchwarden PR sanity

Verdict: PASS WITH DEGRADED REVIEWER HEALTH - deterministic checks are clean, but this is not an approval signal.

Next step: Rerun PR sanity or inspect the degraded reviewer lane before unattended merge.

PR: 830
Commit: 5c90d6b118aa66c1cf0a524e0609647cf9546a39
Status: eligible_sanity_clean
Reviewer health: degraded
Security-sensitive label: present
Authority: Patchwarden policy signal; branch protection and automerge pilot remain merge authority.
Model mix: glm-5.2:cloud, deepseek-v4-pro:cloud, kimi-k2.7:cloud

What I checked

Changed files: 3
Deterministic blocker scan: blocked
Model reviewer lanes: 3
Comment contract: this comment is updated in place via a hidden Patchwarden marker.

Required Fixes

info sensitive-path-touched Sensitive path touched — .forgejo/workflows/patchwarden-pr-sanity.yml
- Evidence: .forgejo/workflows/patchwarden-pr-sanity.yml
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Reviewer Details

Model reviewer lanes

`global-glm` / `glm-5.2:cloud`

Status: ok
Verdict: OK
medium Patchwarden installed from mutable @main ref without pinning
- Evidence: .forgejo/workflows/patchwarden-pr-sanity.yml: python3 -m pip install "git+https://git.pdurlej.com/pdurlej/patchwarden.git@main"; pr_sanity.py installs via PLATFORMCTL_PATCHWARDEN_BIN env with default 'patchwarden'. No commit SHA pin, so CI
- Next: Pin to a specific commit SHA or tag (e.g. @) and record it in a lockfile/variable; consider verifying a checksum or using a release tag.
low Subprocess invocation trusts PATH-resolved binary without validation
- Evidence: control-plane/platformctl/ci/pr_sanity.py: binary = os.environ.get("PLATFORMCTL_PATCHWARDEN_BIN", "patchwarden"); subprocess.run([binary, "pr-sanity-comment", ...], check=True, capture_output=True, text=True, timeout=30). No explicit path r
- Next: Resolve binary to an absolute path (shutil.which) and optionally run a version/--help sanity check before rendering; the workflow already runs --help but the library path is unguarded.
low Empty stdout check happens after TemporaryDirectory cleanup
- Evidence: control-plane/platformctl/ci/pr_sanity.py: with tempfile.TemporaryDirectory(...) as tmpdir: ... completed = subprocess.run(...); then if not completed.stdout.strip(): raise. The check is outside the with block but uses captured stdout, whic
- Next: Include completed.stderr in the RuntimeError message when stdout is empty to aid diagnosis.

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
medium External dependency on patchwarden core renderer may break PR sanity workflow
- Evidence: .forgejo/workflows/patchwarden-pr-sanity.yml installs patchwarden from git+https://git.pdurlej.com/pdurlej/patchwarden.git@main and sets PLATFORMCTL_PR_SANITY_COMMENT_RENDERER=patchwarden. If the tool is unavailable, incompatible, or produc
- Next: Pin to a specific commit or tag, and consider adding a fallback mechanism in the workflow (e.g., try patchwarden, fallback to platform) to avoid blocking PRs due to renderer issues.
low Arbitrary binary execution via PLATFORMCTL_PATCHWARDEN_BIN environment variable
- Evidence: control-plane/platformctl/ci/pr_sanity.py: render_markdown_with_patchwarden uses os.environ.get('PLATFORMCTL_PATCHWARDEN_BIN', 'patchwarden') to determine the binary to execute. An attacker who can control the environment could execute arbi
- Next: Consider restricting the binary to a known path or validating it against an allowlist, or ensure the environment is fully controlled in CI.

`redteam` / `kimi-k2.7:cloud`

Status: error
Verdict: -
Note: Ollama HTTP 404: {"error": "model 'kimi-k2.7:cloud' not found"}
Findings: none

Policy notes

Patchwarden PR sanity is the first merge-lane signal for this PR.
Models produce findings; Patchwarden/policy produces decisions.
Model findings alone do not fail the status check; they require human or agent disposition.
Formal approval is separate from this comment and requires clean reviewer health.
Automerge remains delegated to branch protection and the automerge pilot.

# Patchwarden PR sanity **Verdict:** PASS WITH DEGRADED REVIEWER HEALTH - deterministic checks are clean, but this is not an approval signal. **Next step:** Rerun PR sanity or inspect the degraded reviewer lane before unattended merge. - PR: `830` - Commit: `5c90d6b118aa66c1cf0a524e0609647cf9546a39` - Status: `eligible_sanity_clean` - Reviewer health: `degraded` - Security-sensitive label: `present` - Authority: Patchwarden policy signal; branch protection and automerge pilot remain merge authority. - Model mix: `glm-5.2:cloud`, `deepseek-v4-pro:cloud`, `kimi-k2.7:cloud` ## What I checked - Changed files: `3` - Deterministic blocker scan: `blocked` - Model reviewer lanes: `3` - Comment contract: this comment is updated in place via a hidden Patchwarden marker. ## Required Fixes - **`info` `sensitive-path-touched`** Sensitive path touched — `.forgejo/workflows/patchwarden-pr-sanity.yml` - Evidence: `.forgejo/workflows/patchwarden-pr-sanity.yml` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Reviewer Details <details> <summary>Model reviewer lanes</summary> ### `global-glm` / `glm-5.2:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** Patchwarden installed from mutable @main ref without pinning - Evidence: `.forgejo/workflows/patchwarden-pr-sanity.yml: python3 -m pip install "git+https://git.pdurlej.com/pdurlej/patchwarden.git@main"; pr_sanity.py installs via PLATFORMCTL_PATCHWARDEN_BIN env with default 'patchwarden'. No commit SHA pin, so CI ` - Next: Pin to a specific commit SHA or tag (e.g. @<sha>) and record it in a lockfile/variable; consider verifying a checksum or using a release tag. - **`low`** Subprocess invocation trusts PATH-resolved binary without validation - Evidence: `control-plane/platformctl/ci/pr_sanity.py: binary = os.environ.get("PLATFORMCTL_PATCHWARDEN_BIN", "patchwarden"); subprocess.run([binary, "pr-sanity-comment", ...], check=True, capture_output=True, text=True, timeout=30). No explicit path r` - Next: Resolve binary to an absolute path (shutil.which) and optionally run a version/--help sanity check before rendering; the workflow already runs --help but the library path is unguarded. - **`low`** Empty stdout check happens after TemporaryDirectory cleanup - Evidence: `control-plane/platformctl/ci/pr_sanity.py: with tempfile.TemporaryDirectory(...) as tmpdir: ... completed = subprocess.run(...); then if not completed.stdout.strip(): raise. The check is outside the with block but uses captured stdout, whic` - Next: Include completed.stderr in the RuntimeError message when stdout is empty to aid diagnosis. ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** External dependency on patchwarden core renderer may break PR sanity workflow - Evidence: `.forgejo/workflows/patchwarden-pr-sanity.yml installs patchwarden from git+https://git.pdurlej.com/pdurlej/patchwarden.git@main and sets PLATFORMCTL_PR_SANITY_COMMENT_RENDERER=patchwarden. If the tool is unavailable, incompatible, or produc` - Next: Pin to a specific commit or tag, and consider adding a fallback mechanism in the workflow (e.g., try patchwarden, fallback to platform) to avoid blocking PRs due to renderer issues. - **`low`** Arbitrary binary execution via PLATFORMCTL_PATCHWARDEN_BIN environment variable - Evidence: `control-plane/platformctl/ci/pr_sanity.py: render_markdown_with_patchwarden uses os.environ.get('PLATFORMCTL_PATCHWARDEN_BIN', 'patchwarden') to determine the binary to execute. An attacker who can control the environment could execute arbi` - Next: Consider restricting the binary to a known path or validating it against an allowlist, or ensure the environment is fully controlled in CI. ### `redteam` / `kimi-k2.7:cloud` - Status: `error` - Verdict: `-` - Note: Ollama HTTP 404: {"error": "model 'kimi-k2.7:cloud' not found"} - Findings: none </details> ## Policy notes - Patchwarden PR sanity is the first merge-lane signal for this PR. - Models produce findings; Patchwarden/policy produces decisions. - Model findings alone do not fail the status check; they require human or agent disposition. - Formal approval is separate from this comment and requires clean reviewer health. - Automerge remains delegated to branch protection and the automerge pilot.