Skip to content

v0.8.0 — The GitHub issue runner

Choose a tag to compare

View all tags
@dharrisHub dharrisHub released this 16 Aug 14:48
· 14 commits to main since this release
v0.8.0
5290153

The release that lets the loop work a repository's own issues, unattended, and stop exactly where a human should take over.

The GitHub issue runner

  • exolvra-genesis work makes one pass: it claims an issue a maintainer labelled exolvra:ready, runs the loop against the issue as the spec (and the repo's standing gates as the bar), and ends with evidence — a pull request on a win, a draft PR carrying the open question on a block, a triage comment naming exactly what is missing when nothing checkable can be derived. Humans keep every merge decision.
  • exolvra-genesis queue lists eligible and in-flight issues across allowlisted repos; queue --fleet renders the fleet page. Both read-only.
  • examples/issue-runner.yml — adopt by copying one file into GitHub Actions; the runner login ships pre-filled.

Safety as mechanisms, not promises

  • Every write requires a resolvable identity. A token GitHub will not name (installation and Actions tokens) needs --runner-login / EXOLVRA_GENESIS_RUNNER_LOGIN, or the run exits 2 before any issue is read.
  • One module owns all GitHub traffic — a fetch planted anywhere else fails the suite. One module owns git; force-push is structurally absent and pushes are confined to the exolvra-genesis/issue-… namespace.
  • Issue content is data, never instructions: commands are derived only from the issue's own checkable text, hostile markup and bidi controls are neutralized in everything written back, and secrets pasted into issues render [redacted] on every surface — branch names and evasive Unicode encodings included.
  • A tampered issue snapshot downgrades a win to a blocked draft. A claim is heartbeat-guarded; forged heartbeats are disbelieved ("a heartbeat cannot postdate the comment that carries it").

How it was judged

Built by the loop against docs/specs/issue-runner-spec.md: eight blind write-safety passes over the foundations, then assembled rounds ending on two consecutive blind WINs on a frozen brief and a frozen tree. Roughly forty findings across the run, each fixed and re-verified by replaying the critic's own attack. Then one live pass against a real repository carried a real issue to a real merged pull request. The suite grew 677 → 1050 tests. The postmortem — including the process rules the run produced — ships in docs/postmortems/.

npm publish of 0.8.0 follows shortly; until it lands, run the CLI from this repo (cd cli && npm install && npm run build).

Assets 2
Loading