feat(gate): guardrailEscalation.onCleanReview — release the guardrail hold when the escalated review is clean - #9869
Open
JSONbored wants to merge 3 commits into
Open
feat(gate): guardrailEscalation.onCleanReview — release the guardrail hold when the escalated review is clean#9869JSONbored wants to merge 3 commits into
JSONbored wants to merge 3 commits into
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
loopover-ui | 5ae2ba9 | Commit Preview URL Branch Preview URL |
Jul 29 2026, 10:13 PM |
Contributor
|
Important 🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨 ⏳ LoopOver is waiting…LoopOver has seen this pull request and is waiting on CI checks to finish before reviewing it. This comment will update once the review runs. 🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟨 Waiting |
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Bundle ReportChanges will increase total bundle size by 361 bytes (0.0%) ⬆️. This is within the configured threshold ✅ Detailed changes
Affected Assets, Files, and Routes:view changes for bundle: loopover-uiAssets Changed:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #9869 +/- ##
=======================================
Coverage 91.76% 91.76%
=======================================
Files 921 921
Lines 113173 113195 +22
Branches 27244 27256 +12
=======================================
+ Hits 103854 103876 +22
Misses 8034 8034
Partials 1285 1285
Flags with carried forward coverage won't be shown. Click here to find out more.
|
JSONbored
force-pushed
the
feat/guardrail-mode
branch
2 times, most recently
from
July 29, 2026 19:29
a1367ff to
f970cea
Compare
… hold when the escalated review is clean The second half of #9808, as an explicit MODE rather than a policy flip. review -- but the disposition still held it unconditionally: guardrailHit sat in heldForManualReview regardless of what the escalated review found. The 74 held PRs / 14 days kept landing on the maintainer, just with better reviews attached. gate.guardrailEscalation.onCleanReview: hold (default) today's behavior exactly -- human-in-the-loop proceed a clean escalated review releases the guardrail hold and the normal approve/merge path continues -- full-autonomy mode Because it is a manifest field it layers global -> per-repo like everything else, so repos can be flipped one at a time and the mode is reversible without a deploy. Fail-closed on every axis: - `proceed` is inert unless at least one escalation knob is actually SET: the release is justified by extra scrutiny, so absent scrutiny nothing vouches. - the release requires reviewGood -- gate success (which folds in the AI verdict's blockers) AND green CI -- and the disposition re-checks that independently of the caller's flag. - only the guardrail term is released: migration collisions, unlinked-issue holds, advisory-check holds, and unstable merge states all still hold. - the manual-hold reason no longer claims "guarded path -> manual review" for a cleared PR.
…t merges it The manual-review label announces a HOLD. Its emit condition checked `guardrailHit` alone, so once a clean escalated review released that hold (guardrailEscalationCleared), the planner emitted both in one pass: the merge AND the label telling a human to come look at it. Self-contradictory, and it leaves a manual-review label sitting on merged PRs in precisely the full-autonomy mode the feature exists to enable. Also closes the two patch-coverage gaps this PR still carried, both of them the "test both sides" class: - agent-actions: no test made guardrailHit, reviewGood and escalationConfigured true at once, so the fourth conjunct -- `onCleanReview === "proceed"`, the term the whole feature turns on -- was never evaluated at all. Now asserted in both directions against identical input, plus the case where "proceed" is set with NO escalation configured, which must NOT release (that promise is about an escalated review; honouring it without one would leave guarded paths weaker than before the feature). - focus-manifest: onCleanReview was covered through parse but not through resolveEffectiveSettings. Parsing it and dropping it during resolution would silently restore always-hold while the manifest still read as configured for full autonomy.
JSONbored
force-pushed
the
feat/guardrail-mode
branch
from
July 29, 2026 19:30
f970cea to
59b7643
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The second half of #9808, as a mode
#9821 shipped the escalation knobs — a guarded PR now gets a high-effort review — but the disposition still held it unconditionally:
guardrailHitsat inheldForManualReviewregardless of what the escalated review found. The 74 held PRs / 14 days kept landing on the maintainer, just with better reviews attached.proceed: a clean escalated review (gate success + green CI) releases the guardrail hold and the normal approve/merge path continues — the guarded path is protected by the escalated review instead of a human queue. Because it's a manifest field it layers global → per-repo like everything else: repos flip one at a time, and the mode is reversible with a config edit, no deploy.Fail-closed on every axis
proceedis inert unless at least one escalation knob is actually set. The release is justified by extra scrutiny; absent scrutiny, nothing vouches for the guarded path. A config that sets the mode but forgets the escalation changes nothing.reviewGoodindependently of the caller's flag — a red gate or CI still blocks even ifclearedwere mis-set upstream. Pinned by a test.Note
reviewGoodalready folds in the AI verdict: a consensus blocker fails the gate itself, so "clean escalated review" is not a separate, bypassable signal — it's the same gate every other merge decision trusts.Tests
4 disposition cases (release, default-hold byte-identical, only-the-guardrail-term, red-gate-cannot-merge-despite-flag) + engine parse/round-trip/presence/junk-rejection for the new field. Full suite 25,455 passed; docs-drift (both example configs), openapi, contract schemas, dead-source-files green.
Activation
On merge + image: set
onCleanReview: proceedin the three repos' private configs (server-side, no code). Every hold family is then either eliminated, one-shot-closed, or maintainer-only — the full-autonomy target, withholdmode one config edit away if precision degrades.Closes #9808.