Promote Develop: Policy-Driven PR Review and a Registry-Rendered Agent Policy by ptr727 · Pull Request #3892 · ptr727/ProjectTemplate

ptr727 · 2026-11-05T23:56:16Z

Summary

Promotes #3881, #3884, #3886, #3888, #3889, and #3891 to main.

Closes #3200.
Closes #3885.
Closes #3887.

Per-repository review policy (Read a Per-Repository Review Policy Before Asking Any Bot for a Review #3881). scripts/pr_review.py reads which bots review a repository, on which bases, when, and how often, from the repository's own policy, with the hub default reproducing today's behavior.
Review return on cost (Measure PR Review Return on Cost in the Backlog Report #3886). scripts/backlog_metrics.py measures reviewer cost per useful finding. It is now a uv script, so the metrics server's weekly timer must run it as uv run --no-project --script scripts/backlog_metrics.py from this release on.
After-checks side reviewer (Ask an After-Checks Side Reviewer Once CI Settles, and Compare Ask Times in UTC #3888). An explicit after-checks CodeRabbit or Qodo is asked once CI settles, and ask times compare in UTC.
Commit in place for an operational repository (Let an Operational Repository Commit in Place Through a Repo Agent Policy #3889). The policy file became .github/agent-policy.json, with its schema under review and a guard section that lets gh-write-guard allow an in-place commit on a listed branch.
Agent policy rendered from the registry (Render Each Repository's Agent Policy From the Registry and Apply Its Bot Settings #3891). repo-config/configure.sh renders .github/agent-policy.json from registry/repos.json and applies the bot settings it implies: the Copilot ruleset rule, CodeRabbit's auto-review keys, and Qodo's auto-feedback key. Once this is on main, configure.sh check reports agent-policy drift on every repository until apply --checkout has been run there.
Dependabot (Bump the actions-deps group across 3 directories with 1 update #3884). The actions-deps group bump.

Each feature pull request carried recorded local strict review passes, with every finding fixed, declined with evidence, or filed (#3890).

🤖 Generated with Claude Code

#3881) ## Summary This is the first step of the revised review cutover on #3877. Which bots review a repository's pull requests, on which bases, when, and how often is now a setting in that repository's own `.github/pr-review.json`. A repository carrying none reads the hub's `spec/pr-review.default.json`. That default reproduces the gate's current behavior exactly, so this pull request changes nothing until a repository opts in. Each repository can then be cut over, tested, or rolled back on its own, and the reviewer cost is tuned per repository. - **Schema and reader.** The schema is `spec/pr-review.schema.json`, and `scripts/pr_review_policy.py` reads and validates it. A test holds the two equal. The policy is read from the pull request's base branch, so a pull request cannot change the rules its own review runs under. - **Copilot, governed in full.** - `trigger` is `auto`, `explicit`, or `off`. - `bases` lists the branches it reviews. - `when` can hold the request until the head's checks pass. That makes the push, wait for a green build, then review question a per-repository setting the metrics can compare. - `rounds` and `maxRounds` cap the rounds. A spent cap hands a new head to an attested local pass. - `gate` decides whether the merge waits on Copilot. An `explicit` Copilot must gate, and the reader and schema refuse one that does not, since `wait` requests Copilot only for a round the merge waits on. - Where Copilot is `off`, ungated, or past its cap, no Copilot round is coming. So its refusals, partial rounds, pending requests, and cut history no longer stop an attested local pass from covering the head. - **CodeRabbit and Qodo, kept simple by decision.** Where a policy says `explicit`, each is asked by comment once per new head: `@coderabbitai review`, or `full review`, and `/review`. The ask can optionally wait for green checks. The merge never waits on either, and the reader refuses `gate: true` for them. Their findings reach the digest as they always did. - **Trigger-agnostic text.** The skill and rule text no longer depend on whether a repository's reviews arrive automatically or on request. `wait` requests what the policy owes, and the text names the hub default as a default. `GOVERNANCE.md` "PR Review Etiquette", `drive-pr`, `pr-review-conduct`, `.github/copilot-instructions.md`, `docs/pr-reviewer-reference.md`, and `scripts/README.md` are updated, and the generated skill trees regenerated. - **New statuses.** `status=CHECKS_BEFORE_REVIEW` exits 30 while checks run, 40 when they fail, and 44 when one is stuck or the head is conflicted. It routes to `redrive`. - **Size ceiling.** The CodeRabbit and Qodo reading and asking live in a new `scripts/pr_review_side.py`, and the policy reads off a payload in a new `scripts/pr_review_payload.py`, so `pr_review.py` stays under its size ceiling. `mutated` moves to `scripts/gh_graphql.py` so both modules share it. Not in this pull request: - `repo-config/configure.sh` applying each repository's policy to the bot-side settings. That covers the Copilot ruleset rule and the CodeRabbit and Qodo files, through a local checkout. - The account-level settings repositories. - The metrics. Those are in the sibling `feature/review-metrics` pull request. ## Verification - The full suite passes: 3,481 tests, 11 skipped, run with `uv run --no-project --with-requirements tests/requirements.txt python -m unittest discover -s tests -p 'test_*.py'`. The gate tests that predate the policy pass unchanged under the default, which shows the change is behavior-neutral there. - `tests/test_pr_review_policy.py`, new, covers parsing and refusals, schema parity, base matching, caps, and the Copilot cover decision with the default proven equal to the old one. It also covers head arrival, check holds, and the side asks. Wait-level cases cover a red build exiting 40 without a request, green checks reaching the request, and `--request` skipping the hold. - Each fix in ad9feaa, e4622ee, and 67612c8 has a test that fails with that fix reverted, checked one fix at a time. - ruff format, ruff check, mypy, pyright on the changed scripts, the prose gate against `develop`, and the eol gate all pass. - The local strict passes over 9946909, e4622ee, and 67612c8 are recorded, and 67612c8 is attested. The first two were answered in this push's two edit rounds. The findings still open are below. ## Open findings from the local strict pass (edit budget spent) The fourteen findings listed for 9946909 are answered. Thirteen are fixed in ad9feaa and e4622ee, and the boolean `version` refusal is kept, since `True == 1` would otherwise parse as version 1. Of the seven from the pass over e4622ee, six are fixed in 67612c8. The rest are open, all `introduced`: 1. `scripts/pr_review_side.py` around line 279: an explicit after-checks CodeRabbit or Qodo is never asked when CI outlasts Copilot's round. The ask reads the checks once after the Copilot poll and gets PENDING. `wait` then exits 0, and the merge gate's own `wait` requests nothing. 2. `scripts/pr_review_side.py` around line 75: a DIRTY or unreadable rollup exits 44 through `checks_status`. The wait usage text and the README exit table give 44 only for a stuck check. The held path documents a DIRTY head as 45. 3. Design: `side_asks` in `scripts/pr_review_side.py` repeats the trusted-and-shown filter that `trusted_comments` in `scripts/pr_review_rounds.py` owns. This belongs with #3880, below. 4. Design: `PAYLOAD_KEY = POLICY_KEY` in `scripts/pr_review_policy.py` gives one constant a second name. The test asserting the two agree, and the docstring sentences explaining them, go with it. 5. Design: `request_side_reviews` in `scripts/pr_review_side.py` repeats the post-and-confirm that `comment_on_pr` in `scripts/pr_review.py` does. ## Dropped findings - `ruff check` reporting E402 on `mutated = shared.mutated`: disproved, since `ruff check scripts/pr_review.py` with the pinned config passes. ## Deferred - Sharing the attestation marker and reviewer-login readers between the gate and the metrics report: #3880. Building `side_asks` and `trusted_comments` on one node-level trusted-comment reader belongs with it. `pr_review_rounds.py` has no headroom for that here. - Matching a side-reviewer ask to a head by a server stamp rather than the committer's clock: #3882. Refs #3877, #3758. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

## Why The PR bots are moving from automatic to policy-driven review, per the review-cutover track (#3877). That move needs before and after figures for what each review returns. This adds them to `scripts/backlog_metrics.py`, so a baseline can be captured before any repository changes its `.github/pr-review.json`. ## What Two new tables in the weekly report, read from the window's merged pull requests through one paged GraphQL search per repository, newest created first, capped at 500 with a reached cap named. - **Per bot:** the policy trigger and the branch it was read at, review requests split into review-requested events by a bot actor and everything else, and rounds per reviewed pull request. CodeRabbit's reviewed heads are classed as automatic, explicit, or unclassified from the commit time, the ask and request times, and the first real review. Qodo's rounds are counted as the gate counts them, from its asks and its one standing comment, with no per-head classes. Threaded findings, findings a clean local attestation missed, and findings on all-green heads follow. - **Per repository:** commits per merged pull request, local attestation findings, failing heads, and failing heads after a clean local attestation. Promotion pull requests are left out and counted apart. **The report now runs as a uv script**, `uv run --no-project --script scripts/backlog_metrics.py`, with the same inline metadata as `pr_review.py`. That lets it import the review gate's own readers rather than copies: `attestation` per read commit, `page_flag` for cut connections, `reviewer_nodes` with `refusal_of` for reviewed heads, `side_asks` and `side_command` for asks, `side_rounds` for Qodo, and `VOCABULARIES` for the logins. **The server timer's command has to change to that form**, with uv on the host, before the next weekly run. The policy is read at `develop` where it exists, since feature pull requests are gated there, and otherwise at the default branch. It goes through `pr_review_policy.fetch`, so a file the gate refuses prints `error` and a file it takes as absent prints the hub default's triggers marked `(default)`. The gate's absent test, a 404 or a 422, moves from `pr_review.py` into `gh_graphql.py` as `said_absent`, so both share it. A change to the file inside the window is noted. A failed default-branch, `develop`, policy, or history read still writes the report, names that read on stderr, and exits `1`. A failed review read still writes the backlog and billing tables, says the review figures were unavailable, and exits `1`. ## Verification - `uv run --no-project --with-requirements tests/requirements.txt python tests/test_backlog_metrics.py`: 79 tests pass. Each fix was reverted on its own and its test failed. - The full suite under `uv run --no-project --with-requirements tests/requirements.txt python -m unittest discover -s tests`: 3532 tests pass. - A live run, `uv run --no-project --script scripts/backlog_metrics.py --repo ProjectTemplate --days 7`, exits `0` in 41 seconds. Its per-repository table is identical before and after the switch to the gate's `attestation`. - ruff check and format are clean. mypy reports nothing in the changed files beyond what `develop` already reports. ## Local-review findings, disposed - `introduced`, design, left by the maintainer's decision: the reviewed-heads set in `review_pr` restates `pr_review_rounds.reviewed_heads`'s filter rather than calling it, since the report needs the set and the gate returns a count. Exposing the set there would take `pr_review_rounds.py` past its 700-line ceiling, so #3880 exposes it when it splits that file. - `introduced`, fixed in be564a6: `classify_rounds` compared a `committedDate` keeping the committer's offset with UTC times as strings. `pr_review_checks.utc_instant` now converts each to UTC first, and the gate's `age` builds on it in 787b3b3, so one parser reads every GitHub stamp. - `introduced`, fixed in be564a6: `graphql` duplicated the `GraphQLError` conversion `walked` already makes. - `introduced`, fixed in 787b3b3: the thread loop restated the gate's `thread_author`, and a truncation note named the PR cap whichever cap was reached. - `introduced`, fixed in 9c3240b: the README's commit-date caveat named the wrong count, its markdown-it-py list left out `backlog_metrics.py`, and two docstrings credited the UTC conversion rather than the parse with ordering stamps. - `introduced`, fixed in e4a655b: no test built a review-request event naming CodeRabbit, so dropping events from its round triggers passed every case. ## Pre-existing findings, filed - `scripts/pr_review_side.py:117`, correctness: `side_asked_on_head` makes the same mixed-offset string comparison. Filed as #3887. ## Dropped findings - `spec/audit.py` and `.github/actions/repo-gate/repo_gate.py` keep their own HTTP-status parse beside `said_absent`, a consolidation on text this change did not touch. ## Follow-ups - #3880 shares what remains between the gate and this report. - The 4-week baseline, `--days 28`, is captured once this merges and the timer is moved. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…mes in UTC (#3888) ## Why #3881 left two defects in `scripts/pr_review_side.py`, and #3885 adds two design items and a documentation gap. Each sits on the review-cutover track (#3877), and the pilot needs the first one fixed before any repository gives CodeRabbit or Qodo `when: after-checks`. ## What - **An after-checks side reviewer is asked once CI settles (#3885 item 1).** `side.ask` read the head's checks once, after the Copilot poll. So where a Copilot round already covered the head, or landed first, a check still running gave `PENDING` and only a note. Nothing asked later, since the merge gate's `run_wait` passes `may_request=False`. Now a wait that polls for a Copilot round hands the ask the `await_green` partial, which polls the checks on the wait's own clock and is bounded by `--timeout`. Every other wait reads them once. That covers the checks-hold, unrecorded-request, quota and refusal stops, exit 49, and a held head, whose own poll already waits on the checks. A wait that polled re-reads the payload before its digest and exit code, so a check that went green during the side poll is not judged stuck from a stale read. A pull request merged or closed while its checks settled is asked nothing. - **Ask times compare as instants (#3887).** `side_asked_on_head` compared a comment's UTC `createdAt` with the head's `committedDate` as text, and a `GitTimestamp` keeps the committer's offset. Both now go through `pr_review_checks.utc_instant`. - **Exit 44 names its DIRTY and unreadable holds (#3885 item 2)**, in the `wait` usage text and `scripts/README.md`. The exit-0 text now also names the after-checks exception to "does not poll the checks". - **`PAYLOAD_KEY` is gone (#3885 item 3).** Callers read `pr_review_payload.POLICY_KEY`, and the test asserting the two agree is dropped. - **One post-and-confirm helper (#3885 item 4).** `side.post_comment` posts a conversation comment and says whether its URL and exact body confirm it. `comment_on_pr` and the side asks both call it. `scripts/pr_review.py` sits at 2199 of its 2200-line ceiling after this change. The next change that adds logic there has to move some first, as #3880 plans. Refs #3885, #3887, #3877. The closing keywords belong on the develop -> main promotion PR. ## Verification - The full suite, `uv run --no-project --with-requirements tests/requirements.txt python -m unittest discover -s tests`, ran 3539 tests with 11 skipped, all passing, at 6bd9a5c. The `test_pr_review*` suites pass at the head, 709 tests. - The new `TestSideAskTiming` cases in `tests/test_pr_review_policy.py` were each run against the pre-change scripts or with their fix reverted, and each one failed. Those are the outlasting-CI ask, the poll hand-off per wait path, the merged-during-poll ask, the fresh digest read, and both UTC offsets. - ruff format and check are clean. The pre-commit hook's mypy, prose and EOL gates pass. ## Local-review findings, disposed Three recorded `local-strict-review` passes at the `frontier` tier covered the branch. The third, at 08cb68a, raised nothing. - `introduced`, fixed in bc8e6ae: the digest and exit code came from a payload read before the side poll, so a check that went green during it could read as `NOT_PICKED_UP` and exit 44. - `introduced`, fixed in bc8e6ae: a held head handed the ask a poll, which could delay exit 46 by up to `--timeout`. - `introduced`, fixed in bc8e6ae: a pull request merged while its checks settled could still be asked. - `introduced`, fixed in bc8e6ae: the usage text and the README `0` row still said a covered head's exit 0 never polls the checks. - `introduced`, fixed in 08cb68a: the usage text and README still said any polling wait awaits the checks after the held-head change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…licy (#3889) ## Summary The standard for an operational repository is a direct commit to `develop` in place, in the live checkout the running service reads. Both the maintainer and an agent work this way. The write guard's primary-checkout rule (requirement 6) denied that commit. The only way around it was `GH_WRITE_GUARD_ALLOW_PRIMARY_CHECKOUT`, which lifts every rule-6 denial for the whole session, including `reset`, `stash` and `clean`. This PR adds a narrow exemption for each repository, recorded in a repo-local agent policy file. That file also holds the review policy that already existed. - **One policy file per repository.** `.github/pr-review.json` becomes `.github/agent-policy.json`. - Its current contents move under a `review` section, and a new `guard` section sits beside it. - The spec files are renamed to `spec/agent-policy.schema.json` and `spec/agent-policy.default.json`. - No repository carries the old file yet, so nothing downstream has to move. - Each section stands on its own. A file with no `review` section reads the hub default's review, and `backlog_metrics` marks it `(default)`. - **The guard exemption.** The setting is `guard.primaryCheckout.commitInPlace.branches`. - The guard reads it from `origin/main` only, never from the working tree or `develop`. An agent can push `develop` directly in an operational repository, so reading it there would let an agent grant itself the exemption. Reading it from `main` means only the maintainer's merge grants it. - A missing ref, a missing file, or a malformed section means no exemption. - **What the exemption allows, on a listed branch:** - `add`, `rm` and `mv` of explicit paths. An `add` path cannot be a directory or a run-time word. - A commit that names no pathspec and carries no `-a`, `-p`, `-i`, `-o` or `--amend`, nor any of their long forms. - An unforced push of that branch to `origin`. - It never applies when the same command switches branch. - Everything else rule 6 denies stays denied, and requirement 4 still judges every push. - **The rule text says the same thing.** That covers GOVERNANCE.md "Operational Repositories" and "Repository Boundaries and Write Safety", the `branching-and-release-model` and `repo-worktree` skills, the host-wide safety block, and agent-safety requirement 6. - **The hook-bypass check is fixed too.** `_skips_hooks` now shares one commit-option reader with the exemption. That fixes a latent bug: a short cluster ending in an attached value, such as `-minit`, used to skip the word that followed it. Not in this PR: provisioning the file. `repo-config/configure.sh` will write `.github/agent-policy.json` from the registry, with `workflowModel: operational` filling in the guard section. That lands in the follow-up provisioning PR on the review-cutover track. Until it does, an operational repository needs the file merged to `main` by hand for the exemption to take effect. ## Verification - `gh-write-guard.py --selftest` passes. - The new cases cover both what the exemption allows and the shapes it must deny. - A new live case builds a real repository. It checks that a policy only in the working tree, or committed on `develop` with `origin/main` not yet moved, gives no exemption. It checks that `origin/main` listing `develop` does, that a real directory add is denied, and that a malformed policy gives none. - A copy of the guard that reads `HEAD:` instead of `origin/main` fails the live case. - A separate end-to-end probe in throwaway repositories ran the hook's JSON through the guard. It allowed `add` and `commit` on `develop` while `main` carried the policy. It denied the same commands on a topic branch, and again once the policy left `main`. - The full unittest suite passes: 3545 tests, 11 skipped. So do `spec/validate.py`, the installer tests, `build_dist.py --check` and the pre-commit gate. - `local-strict-review` ran three passes: - Round one raised 11 findings. Ten are fixed, and one is declined: an add of a directory created earlier in the same command can only sweep in files that command made, so the hardening rule declines it. - Round two raised five findings, all fixed. - Round three raised none. Closes #3200 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

… Bot Settings (#3891) ## Summary `repo-config/configure.sh` now renders each repository's `.github/agent-policy.json` from `registry/repos.json`, through the new `scripts/agent_policy.py`. It also applies and checks the bot-side settings the render implies. This is step 1 of the review-cutover track (#3877), built on the `agent-policy.json` shape #3889 introduced. - **Render.** The hub default policy, plus a repo entry's optional `agentPolicy` override (a shallow merge per bot), plus a `guard` section derived from `workflowModel`. An operational repository lists `develop`. `spec/validate.py` refuses a malformed override. - **Rulesets.** The `copilot_code_review` rule lands on the `main` or `develop` ruleset only where the render has an automatic Copilot covering that branch. `repo-config/main.json` stays the template for the rule's parameters. - **`apply --checkout <path>`.** Writes three things into a local checkout of the repository: the policy file, CodeRabbit's `reviews.auto_review.enabled` and `base_branches`, and Qodo's `[config] disable_auto_feedback`. Every other key and comment is kept. A dry run checks the checkout before any API write. The caller commits the files through the ordinary PR flow. - **`check`.** Compares all three files on the default branch with the render. A missing bot file is drift by design: once account-level auto review turns off, a repository without the explicit keys would lose its reviews silently. - **Requirements.** A plain `apply` or `check` derives the facts with the stdlib interpreter, now probed for 3.10. `uv` is needed only for `apply --checkout` and the policy check. ## What to expect after merge - `configure.sh check` reports agent-policy drift on every repository until `apply --checkout` has been run there and the files merged. Today only this hub carries `.coderabbit.yaml` and `.pr_agent.toml`. That rollout is the pilot step on #3877. - On this hub, `apply --checkout` leaves `.coderabbit.yaml` byte-identical. It adds `[config] disable_auto_feedback = false` to `.pr_agent.toml` and writes `.github/agent-policy.json`. ## Local review Three recorded `local-strict-review` passes, at `frontier`. The first found 8 findings and the second found 3. All were fixed except one consolidation in a file this change does not touch, filed as #3890. The third pass, over the final content, found none. ## Pre-existing findings, not filed - `spec/host-tools.json:90` (`pre-existing`): the `why` string says `removesuffix` is called "in spec/audit.py alone", while `scripts/carry.py` and the host-setup scripts call it too. This is a description, not an instruction, and is left as it is. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-11-05T23:56:24Z

Important

Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

Source mode: Auto
Repository: ptr727/ProjectTemplate
Branch: develop
File: .coderabbit.yaml
Commit: b998a7c
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 918eba1d-240b-4292-9784-123039db7eaf

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

codecov · 2026-11-06T00:04:07Z

Codecov Report

❌ Patch coverage is 87.92793% with 134 lines in your changes missing coverage. Please review.
✅ Project coverage is 77.87%. Comparing base (3a81362) to head (b998a7c).
⚠️ Report is 471 commits behind head on main.

Files with missing lines	Patch %	Lines
host-setup/agent-safety/claude/gh-write-guard.py	12.08%	80 Missing ⚠️
scripts/agent_policy.py	89.60%	34 Missing ⚠️
scripts/pr_review_policy.py	92.00%	14 Missing ⚠️
scripts/pr_review_side.py	97.56%	3 Missing ⚠️
spec/validate.py	88.88%	2 Missing ⚠️
scripts/backlog_metrics.py	99.64%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3892      +/-   ##
==========================================
- Coverage   83.31%   77.87%   -5.45%     
==========================================
  Files          29       34       +5     
  Lines        9956    12085    +2129     
==========================================
+ Hits         8295     9411    +1116     
- Misses       1661     2674    +1013

Flag	Coverage Δ
python-3.13	`77.87% <87.92%> (-5.45%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

🟡 Changes recommended

Several critical and moderate active findings remain, including unsafe boolean policy handling, crashes on malformed configuration shapes, symlink-following writes, and acceptance of non-GitHub origins.

5 open issues

Reject boolean policy versions · New
Reject symlinked policy targets before writing · New
Restrict origin parsing to GitHub hosts · New
Handle malformed YAML as drift · New
Handle non-table TOML config as drift · New

What changed in this PR

This pull request promotes policy-driven review behavior and registry-rendered agent policy configuration to main, including operational checkout safeguards, review metrics, documentation, generated skills, tests, and dependency updates. The final review records nine findings across four files.

Changes:

Adds repository-specific reviewer policies, side-review coordination, UTC timestamp handling, and policy-aware coverage decisions.
Renders .github/agent-policy.json and related bot settings from registry configuration.
Adds guarded in-place commits for operational repositories.
Updates review metrics, tests, governance documentation, generated skills, CI workflows, and actions/setup-dotnet pins.

File	Review notes
`tests/test_pr_review.py`	Reviewed.
`tests/test_pr_review_size.py`	Reviewed.
`tests/test_pr_merge.py`	Reviewed.
`tests/test_gh_graphql.py`	Reviewed.
`tests/test_configure_usage.py`	Reviewed.
`tests/test_configure_project.py`	Reviewed.
`tests/test_cli_usage.py`	Reviewed.
`tests/requirements.txt`	Reviewed.
`spec/validate.py`	Reviewed.
`spec/host-tools.json`	Reviewed.
`spec/agent-policy.schema.json`	Reviewed.
`spec/agent-policy.default.json`	Reviewed.
`scripts/pr_review.py`	Reviewed.
`scripts/pr_review_side.py`	[P1] Respect the policy’s base list before requesting Copilot — moderate, 1 vote. Include truncated CodeRabbit review history in the cap check — moderate, 1 vote.
`scripts/pr_review_rounds.py`	[P1] Treat an uncovered base as settled so excluded branches do not block an attested local pass — moderate, 1 vote.
`scripts/pr_review_policy.py`	Reviewed.
`scripts/pr_review_payload.py`	Reviewed.
`scripts/pr_review_checks.py`	Reviewed.
`scripts/pr_review_answers.py`	Reviewed.
`scripts/gh_graphql.py`	[P1] Restrict origin parsing to supported GitHub hosts — critical, 3 votes.
`repo-config/README.md`	Reviewed.
`repo-config/configure.sh`	[P1] Make checkout writeability part of the preflight before API mutations — moderate, 1 vote.
`registry/repos.schema.json`	Reviewed.
`pyproject.toml`	Reviewed.
`host-setup/agent-safety/README.md`	Reviewed.
`host-setup/agent-safety/claude/test_install.py`	Reviewed.
`host-setup/agent-safety/claude/gh-write-guard.py`	[P1] Reject boolean policy versions before granting the primary-checkout exemption — critical, 3 votes.
`host-setup/agent-safety/claude/claude-md-safety.md`	Reviewed.
`GOVERNANCE.md`	Reviewed.
`docs/pr-reviewer-reference.md`	Reviewed.
`.github/workflows/validate-task.yml`	Reviewed.
`.github/workflows/run-codegen-pull-request-task.yml`	Reviewed.
`.github/workflows/get-version-task.yml`	Reviewed.
`.github/skills/repo-worktree/SKILL.md`	Reviewed.
`.github/skills/pr-review-conduct/SKILL.md`	Reviewed.
`.github/skills/drive-pr/SKILL.md`	Reviewed.
`.github/skills/branching-and-release-model/SKILL.md`	Reviewed.
`.github/copilot-instructions.md`	Reviewed.
`.github/actions/nuget-build-default/action.yml`	Reviewed.
`.github/actions/dotnet-publish-default/action.yml`	Reviewed.
`.claude-plugin/fleet-skills/skills/repo-worktree/SKILL.md`	Reviewed.
`.claude-plugin/fleet-skills/skills/pr-review-conduct/SKILL.md`	Reviewed.
`.claude-plugin/fleet-skills/skills/drive-pr/SKILL.md`	Reviewed.
`.claude-plugin/fleet-skills/skills/branching-and-release-model/SKILL.md`	Reviewed.
`.claude-plugin/fleet-skills/.source-digests/repo-worktree`	Reviewed.
`.claude-plugin/fleet-skills/.source-digests/pr-review-conduct`	Reviewed.
`.claude-plugin/fleet-skills/.source-digests/drive-pr`	Reviewed.
`.claude-plugin/fleet-skills/.source-digests/branching-and-release-model`	Reviewed.
`.agents/skills/repo-worktree/SKILL.md`	Reviewed.
`.agents/skills/pr-review-conduct/SKILL.md`	Reviewed.
`.agents/skills/drive-pr/SKILL.md`	Reviewed.
`.agents/skills/branching-and-release-model/SKILL.md`	Reviewed.

_{Review effort: Lite}

ptr727 · 2026-11-06T01:07:11Z

Answers to the four findings Copilot's review on b998a7ca states only in its file table, with no thread. pr_review.py did not count them, filed as #3893.

scripts/pr_review_side.py, "Respect the policy's base list before requesting Copilot": Declined. Copilot is requested on a base its bases do not cover only where a partial round, a cut review history, or a refusal stands on record. scripts/README.md's review-policy paragraph documents this: on a non-default base, those "stand against the attestation". A fresh round is what clears them. Two tests pin it: test_a_partial_on_record_requests_a_round_rather_than_holding and test_a_truncated_review_history_requests_a_round_rather_than_holding in tests/test_pr_review.py.
scripts/pr_review_side.py, "Include truncated CodeRabbit review history in the cap check": Declined under GOVERNANCE.md "Trust Boundaries and Hardening Effort", on likelihood. The miscount needs three things at once: a pull request carrying more than 100 reviews, so reviews(last:100) is cut, a capped explicit CodeRabbit, and its earlier rounds made without a counted ask comment. No fleet pull request comes near that review count, and the consequence is one extra review ask.
scripts/pr_review_rounds.py, "Treat an uncovered base as settled so excluded branches do not block an attested local pass": Declined. That reverses the documented design. scripts/README.md reads a non-default base under the default policy as the case where a partial round, a cut history, or a refusal stand against the attestation. Only an off, ungated, or cap-spent Copilot counts as settled. The two tests above pin it.
repo-config/configure.sh, "Make checkout writeability part of the preflight before API mutations": Declined under GOVERNANCE.md "Trust Boundaries and Hardening Effort". --checkout names the maintainer's own checkout, so a read-only one is a trusted-input mistake. It fails loudly, with a write error and a nonzero exit, and nothing is lost: every API group apply wrote is idempotent, so a rerun once the checkout is writable completes the run.

Merge Gate item 2. Copilot's file table on this head names 52 of the 58 changed files and leaves out scripts/agent_policy.py, scripts/backlog_metrics.py, scripts/README.md, tests/test_agent_policy.py, tests/test_backlog_metrics.py, and tests/test_pr_review_policy.py. So pr_review.py reads coverage=none. The promotion case applies, and each change carries full coverage from its own feature pull request:

Read a Per-Repository Review Policy Before Asking Any Bot for a Review #3881, Measure PR Review Return on Cost in the Backlog Report #3886, Ask an After-Checks Side Reviewer Once CI Settles, and Compare Ask Times in UTC #3888, Let an Operational Repository Commit in Place Through a Repo Agent Policy #3889, and Render Each Repository's Agent Policy From the Registry and Apply Its Bot Settings #3891 each carry a fleet-local-review attestation from the owner at their merged head, against develop.
Bump the actions-deps group across 3 directories with 1 update #3884, the Dependabot bump, carries none. Each of its five files has a Reviewed. row with no note in this promotion's Copilot table, and no Copilot round on this pull request states partial coverage.

dependabot Bot and others added 6 commits November 5, 2026 12:41

Copilot AI lite review requested due to automatic review settings November 5, 2026 23:56

Copilot started reviewing on behalf of ptr727 November 5, 2026 23:56

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Comment thread host-setup/agent-safety/claude/gh-write-guard.py Resolved

Comment thread scripts/agent_policy.py Resolved

Comment thread scripts/gh_graphql.py Resolved

Comment thread scripts/agent_policy.py Resolved

Comment thread scripts/agent_policy.py Resolved

ptr727 mentioned this pull request Nov 6, 2026

Count Copilot Findings Stated Only in a Review Notes File Table #3893

Open

This was referenced Nov 6, 2026

Session Handoff [review-cutover]: #3898 Released as 2.0.1357, Hub Explicit-Review Override Next #3877

Open

State scripts/agent_policy.py's Trusted Inputs So Reviewers Stop Re-Deriving Them #3894

Open

ptr727 merged commit b7f699d into main Nov 6, 2026
14 checks passed

Navigation Menu

Repository navigation

Promote Develop: Policy-Driven PR Review and a Registry-Rendered Agent Policy - #3892

Promote Develop: Policy-Driven PR Review and a Registry-Rendered Agent Policy#3892
ptr727 merged 6 commits into
mainfrom
develop

ptr727 commented Nov 5, 2026

Uh oh!

coderabbitai Bot commented Nov 5, 2026

Uh oh!

codecov Bot commented Nov 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ptr727 commented Nov 6, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ptr727 commented Nov 5, 2026

Summary

Uh oh!

coderabbitai Bot commented Nov 5, 2026

Uh oh!

codecov Bot commented Nov 6, 2026

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ptr727 commented Nov 6, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants