Render Each Repository's Agent Policy From the Registry and Apply Its Bot Settings by ptr727 · Pull Request #3891 · ptr727/ProjectTemplate

ptr727 · 2026-11-05T23:11:16Z

Summary

repo-config/configure.sh now renders each repository's .github/agent-policy.json from registry/repos.json, through the new scripts/agent_policy.py. It also applies and checks the bot-side settings the render implies. This is step 1 of the review-cutover track (#3877), built on the agent-policy.json shape #3889 introduced.

Render. The hub default policy, plus a repo entry's optional agentPolicy override (a shallow merge per bot), plus a guard section derived from workflowModel. An operational repository lists develop. spec/validate.py refuses a malformed override.
Rulesets. The copilot_code_review rule lands on the main or develop ruleset only where the render has an automatic Copilot covering that branch. repo-config/main.json stays the template for the rule's parameters.
apply --checkout <path>. Writes three things into a local checkout of the repository: the policy file, CodeRabbit's reviews.auto_review.enabled and base_branches, and Qodo's [config] disable_auto_feedback. Every other key and comment is kept. A dry run checks the checkout before any API write. The caller commits the files through the ordinary PR flow.
check. Compares all three files on the default branch with the render. A missing bot file is drift by design: once account-level auto review turns off, a repository without the explicit keys would lose its reviews silently.
Requirements. A plain apply or check derives the facts with the stdlib interpreter, now probed for 3.10. uv is needed only for apply --checkout and the policy check.

What to expect after merge

configure.sh check reports agent-policy drift on every repository until apply --checkout has been run there and the files merged. Today only this hub carries .coderabbit.yaml and .pr_agent.toml. That rollout is the pilot step on Session Handoff [review-cutover]: #3898 Released as 2.0.1357, Hub Explicit-Review Override Next #3877.
On this hub, apply --checkout leaves .coderabbit.yaml byte-identical. It adds [config] disable_auto_feedback = false to .pr_agent.toml and writes .github/agent-policy.json.

Local review

Three recorded local-strict-review passes, at frontier. The first found 8 findings and the second found 3. All were fixed except one consolidation in a file this change does not touch, filed as #3890. The third pass, over the final content, found none.

Pre-existing findings, not filed

spec/host-tools.json:90 (pre-existing): the why string says removesuffix is called "in spec/audit.py alone", while scripts/carry.py and the host-setup scripts call it too. This is a description, not an instruction, and is left as it is.

🤖 Generated with Claude Code

… Bot Settings repo-config/configure.sh now renders .github/agent-policy.json from registry/repos.json through the new scripts/agent_policy.py. The render is the hub default policy, plus a repo entry's optional agentPolicy override per bot, plus a guard section derived from workflowModel. - The Copilot code review rule lands on the main or develop ruleset only where the rendered policy has an automatic Copilot covering it. - apply --checkout writes the policy file and the CodeRabbit and Qodo auto-trigger keys into a local checkout, preserving every other key and comment, after a dry-run preflight that runs before any API write. - check compares all three files on the default branch with the render. - spec/validate.py rejects a malformed agentPolicy entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- A plain apply or check derives the policy facts with the stdlib interpreter, so uv is needed only for apply --checkout and the policy check. - A checkout must be its work tree's top level. - An automatic Qodo must cover main and develop, since it reviews every pull request. - CodeRabbit base branches are anchored, since CodeRabbit searches where the policy full-matches. - An emptied base_branches keeps the comment block before the next key. - The policy check reads through pr_review_policy.contents_reader, the origin URL is parsed by the new gh_graphql.origin_slug, and an unreadable file exits 2 rather than the drift code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- configure.sh's interpreter probe asks for 3.10, the oldest the policy render runs on, so a stock macOS 3.9 is refused with a message rather than a traceback. - anchored() wraps any base carrying an alternation, so CodeRabbit's search covers exactly what the policy's full match does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-11-05T23:11:24Z

Important

Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

Source mode: Auto
Repository: ptr727/ProjectTemplate
Branch: feature/configure-agent-policy
File: .coderabbit.yaml
Commit: 22519c5
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 2e66ec35-7c15-40f0-8a11-161eccd81d68

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

ptr727 · 2026-11-05T23:11:34Z

A recorded local strict-review pass covers head 73302dc0d55df1a689535bff8ec6a2a9d21ce595, the content this pull request carries at that commit against develop, and it recorded 0 findings.

Copilot

🟡 Changes recommended

Several active critical and moderate findings leave normal configuration files rejected or crashed on invalid shapes and permit unsafe writes or checkout verification, so changes are required before approval.

7 open issues

What changed in this PR

This pull request makes repository agent policies registry-driven and synchronizes the resulting Copilot, CodeRabbit, Qodo, and operational settings across repositories.

Changes:

Adds scripts/agent_policy.py to render, validate, write, and check repository policy files.
Updates repo-config/configure.sh to apply policy-derived bot settings and Copilot rulesets.
Adds registry validation, tests, dependencies, and documentation for the new configuration flow.

File	Summary	Review findings
`tests/test_gh_graphql.py`	Tests remote URL slug parsing.	No findings recorded.
`tests/test_configure_usage.py`	Tests interpreter probing and configure setup.	No findings recorded.
`tests/test_configure_project.py`	Tests checkout and policy preflight behavior.	No findings recorded.
`tests/test_cli_usage.py`	Adds CLI usage coverage for the policy script.	No findings recorded.
`tests/test_agent_policy.py`	Tests rendering, writing, checking, and ruleset composition.	No findings recorded.
`tests/requirements.txt`	Adds YAML and TOML test dependencies.	No findings recorded.
`spec/validate.py`	Validates registry agent-policy overrides.	No findings recorded.
`spec/host-tools.json`	Documents the updated Python interpreter floor.	No findings recorded.
`scripts/README.md`	Documents the agent-policy utility and policy-driven reviews.	No findings recorded.
`scripts/gh_graphql.py`	Adds shared remote URL parsing.	[P2, moderate, 2 votes] Restrict remote parsing to supported GitHub origins.
`scripts/agent_policy.py`	Implements policy rendering, bot-setting updates, checkout writes, and drift checks.	[P1, critical, 1 vote] Accept TOML table objects when updating Qodo configuration. [P2, moderate, 4 votes] Report non-mapping YAML as drift instead of crashing. [P2, moderate, 4 votes] Report non-table TOML sections as drift instead of dereferencing them. [P1, moderate, 1 vote] Preserve empty bot files for drift checking. [P1, critical, 2 votes] Refuse symlinked checkout targets before writing. [P2, nit, 2 votes] Preserve existing line endings when rewriting bot files. [P1, critical, 1 vote] Sanitize Git’s inherited environment before verifying the checkout.
`repo-config/README.md`	Documents policy application, checking, and ruleset behavior.	No findings recorded.
`repo-config/configure.sh`	Applies policy files and derives Copilot ruleset configuration.	No findings recorded.
`registry/repos.schema.json`	Defines registry-level policy overrides.	No findings recorded.
`pyproject.toml`	Configures type-checker handling for new dependencies.	No findings recorded.
`docs/pr-reviewer-reference.md`	Updates reviewer configuration guidance.	No findings recorded.

_{Review effort: Lite}

codecov · 2026-11-05T23:18:00Z

Codecov Report

❌ Patch coverage is 89.68481% with 36 lines in your changes missing coverage. Please review.
✅ Project coverage is 77.87%. Comparing base (b38e084) to head (22519c5).
⚠️ Report is 105 commits behind head on develop.

Files with missing lines	Patch %	Lines
scripts/agent_policy.py	89.60%	34 Missing ⚠️
spec/validate.py	88.88%	2 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #3891      +/-   ##
===========================================
- Coverage    81.60%   77.87%   -3.74%     
===========================================
  Files           26       34       +8     
  Lines         9070    12085    +3015     
===========================================
+ Hits          7402     9411    +2009     
- Misses        1668     2674    +1006

Flag	Coverage Δ
python-3.13	`77.87% <89.68%> (-3.74%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

The writer read each existing file with its line endings intact, then wrote the planned text as LF, flattening a CRLF checkout's files. The plan now writes CRLF wherever the file it replaces is CRLF. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ptr727 · 2026-11-05T23:19:41Z

A recorded local strict-review pass covers head 30eb9ee4e111a8193d1557e636b6be466fe8a816, the content this pull request carries at that commit against develop, and it recorded 0 findings.

ptr727 · 2026-11-05T23:19:56Z

Correction to my decline on the "Refuse symlinked checkout targets before writing" thread (scripts/agent_policy.py): repo-config/README.md "Agent Policy" says the caller commits the files "through the ordinary pull request flow". It does not itself say the branch is created from develop. The decline rests on the fleet branching model, where that flow is a feature branch off develop holding the maintainer's own merged content. Its conclusion is unchanged.

The Windows unit test job failed eight tests: - The YAML and TOML planners parsed a CRLF file and emitted mixed endings, since the round-trippers keep a carriage return inside a comment. They now parse LF text, and plan() restores CRLF on write. - The contents reader and interpreter probe tests put a /bin/sh shim on PATH, which native Windows does not run. The reader now takes an injectable runner, and the probe test shadows py and python3 with bash functions. - The ruleset composition test passed unquoted Windows paths to bash, which dropped their backslashes. They are now quoted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ptr727 · 2026-11-05T23:41:07Z

A recorded local strict-review pass covers head 22519c5756a88565c679a359fc4f08b296607cde, the content this pull request carries at that commit against develop, and it recorded 0 findings.

…t Policy (#3892) ## Summary Promotes #3881, #3884, #3886, #3888, #3889, and #3891 to `main`. Closes #3200. Closes #3885. Closes #3887. - **Per-repository review policy (#3881).** `scripts/pr_review.py` reads which bots review a repository, on which bases, when, and how often, from the repository's own policy, with the hub default reproducing today's behavior. - **Review return on cost (#3886).** `scripts/backlog_metrics.py` measures reviewer cost per useful finding. It is now a uv script, so the metrics server's weekly timer must run it as `uv run --no-project --script scripts/backlog_metrics.py` from this release on. - **After-checks side reviewer (#3888).** An explicit after-checks CodeRabbit or Qodo is asked once CI settles, and ask times compare in UTC. - **Commit in place for an operational repository (#3889).** The policy file became `.github/agent-policy.json`, with its schema under `review` and a `guard` section that lets `gh-write-guard` allow an in-place commit on a listed branch. - **Agent policy rendered from the registry (#3891).** `repo-config/configure.sh` renders `.github/agent-policy.json` from `registry/repos.json` and applies the bot settings it implies: the Copilot ruleset rule, CodeRabbit's auto-review keys, and Qodo's auto-feedback key. Once this is on `main`, `configure.sh check` reports agent-policy drift on every repository until `apply --checkout` has been run there. - **Dependabot (#3884).** The actions-deps group bump. Each feature pull request carried recorded local strict review passes, with every finding fixed, declined with evidence, or filed (#3890). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ptr727 and others added 3 commits November 5, 2026 14:37

Copilot AI lite review requested due to automatic review settings November 5, 2026 23:11

ptr727 added the comments Permits the comment lines the pull request adds or edits, which the prose gate otherwise refuses label Nov 5, 2026

Copilot started reviewing on behalf of ptr727 November 5, 2026 23:11

View session

Copilot AI reviewed Nov 5, 2026

View reviewed changes

ptr727 merged commit b998a7c into develop Nov 5, 2026
13 checks passed

ptr727 mentioned this pull request Nov 5, 2026

Promote Develop: Policy-Driven PR Review and a Registry-Rendered Agent Policy #3892

Merged

ptr727 deleted the feature/configure-agent-policy branch November 6, 2026 01:00

This was referenced Nov 6, 2026

Session Handoff [review-cutover]: #3898 Released as 2.0.1357, Hub Explicit-Review Override Next #3877

Open

State scripts/agent_policy.py's Trusted Inputs So Reviewers Stop Re-Deriving Them #3894

Open

Navigation Menu

Repository navigation

Render Each Repository's Agent Policy From the Registry and Apply Its Bot Settings - #3891

Render Each Repository's Agent Policy From the Registry and Apply Its Bot Settings#3891
ptr727 merged 5 commits into
developfrom
feature/configure-agent-policy

ptr727 commented Nov 5, 2026

Uh oh!

coderabbitai Bot commented Nov 5, 2026 •

edited

Loading

Uh oh!

ptr727 commented Nov 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Nov 5, 2026 •

edited

Loading

Uh oh!

ptr727 commented Nov 5, 2026

Uh oh!

ptr727 commented Nov 5, 2026

Uh oh!

ptr727 commented Nov 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ptr727 commented Nov 5, 2026

Summary

What to expect after merge

Local review

Pre-existing findings, not filed

Uh oh!

coderabbitai Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ptr727 commented Nov 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ptr727 commented Nov 5, 2026

Uh oh!

ptr727 commented Nov 5, 2026

Uh oh!

ptr727 commented Nov 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Nov 5, 2026 •

edited

Loading

codecov Bot commented Nov 5, 2026 •

edited

Loading