squash-commit-body auto-close trap: PR body clean but squashed commit bodies leak trap pattern (caught #87 in PR #94 dogfood)

[kiki830621]

Problem

Original text (觀察自 PR #94 squash-merge 後 2 秒):
「squash commit message 把 6 個 commit 的 body 合進來，其中一個 commit body 含 Closes: #87（單引號內的反例引用）→ GitHub auto-close parser context-blind，引號不認、上下文不認 → #87 在 merge 後 2 秒被 closed by commit d2125fe，bypass /idd-close。同 cluster 的 #74 因為沒人寫 Closes: #74 在 commit body 所以倖免。」
— Source: PR #94 dogfood

PR #94（cluster #87 + #74）修了 idd-verify Step 0.8 PR-body auto-close-trailer scan gate。但 PR 自己 merge 後，#87 被 auto-close —— 反諷地被自己 cluster 修的 trap 咬到。

Root cause

不在 PR body（pre-merge gh pr view --json closingIssuesReferences 為空）。問題在 squash 行為：

• gh pr merge --squash 預設把所有 squashed commits 的 message body 合入 squash commit message

• 其中 commit d918270 的 body 含這句作為 R1 verify finding 的解釋：

  R1 verify (/idd-verify --pr 94) found the Step 0.8 regex missed the colon form 'Closes: #87'

• 單引號裡的 Closes: #87 是反例引用，但 GitHub auto-close parser context-blind（不認單引號、不認 markdown code、不認上下文）

• squash commit d2125fe 進 main → GitHub 認 Closes: #87 → 自動 close #87，bypass /idd-close 的 closing summary / checklist gate / phase update / distribution sync

Timeline

2026-05-19T00:48:35Z  PR #94 merged (squash commit d2125fe)
2026-05-19T00:48:37Z  #87 auto-closed by kiki830621 commit=d2125fe (2 秒後)

#74 state 保持 OPEN — commit bodies 沒有 literal Closes: #74。

Type

bug

Affected

• idd-verify Step 0.8 — current 設計只 gh pr view --json closingIssuesReferences（only PR body）。對於 squash workflow，PR body 乾淨但 squash commit message 髒，gate 無感
• 任何 IDD commit message / PR description 提到 trap pattern 作反例（教學、debug 報告、verify findings、closing summaries 引用前一輪的 finding）都會觸發
• 影響面比 PR body trap 更廣：trap pattern 在 IDD 工作流中作為 ABCD 反例被引用的場景非常多

Expected

Trap detection 同時 cover PR body + squash 之後的 commit message。候選方向（不預判，待 diagnose 決定）：

• A. Step 0.8 擴展掃 commit bodies — gh pr view --json commits -q '.commits[].messageBody' 額外丟進 closingIssuesReferences-style 檢查；但 GitHub closingIssuesReferences 本身已 squash-aware? 待驗證
• B. Predict squash message — 若 PR merge strategy = squash（gh pr view --json mergeStateStatus,...），在 verify 階段組出預期的 squash commit message（PR title + concatenated commit bodies），跑 trap scan
• C. 反例書寫紀律 — IDD 自己的 commit / PR / closing comment 引用 trap pattern 時用 markdown code fence 或 zero-width-space 隔開（如 Closes​: #87）。但這只防 IDD 自身，外部 contributor 無感
• D. gh pr merge wrapper — IDD 提供 wrapper script 在 squash 前掃 squashed message，trap 命中 → 強制 user 確認或自動 --body overwrite

Actual

#87 在 PR #94 merge 後 2 秒被 auto-close，bypass IDD 整個 close pipeline（closing summary / checklist gate / phase=closed body sync / Step 6.5 distribution sync）。事後需要手動補 closing summary + phase sync。

Impact

• Step 0.8 false-negative：clean PR body + dirty commit body 仍 trap。
• IDD audit trail 損壞：受影響的 issue 沒走過 IDD 紀律的 close 流程。
• Recursion potential：本 issue body 自己就含多個 Closes: #87 字串（為了說明 root cause）。寫修這 issue 的 PR 也會撞到相同問題 — /idd-verify --pr <N> 的新 gate 必須涵蓋 squash predicted message，否則修這 issue 的 PR 自己又會 trip。

Discovered

• PR cluster: fix PR-body auto-close trap (#87 #74) #94 dogfood，cluster [bug] /idd-all PR template contains literal 'Closes #N' that triggers GitHub auto-close — defeats IDD close-gate discipline #87 + idd-implement PR body template: anti-trailer warning text triggers auto-close (recursion trap) #74，squash-merge d2125fe
• 觸發 commit body 出處：d918270 fix: idd-verify Step 0.8 — use closingIssuesReferences instead of hand-rolled regex (Refs #74 #87) 的 body

Notes

• 同 cluster #74 倖免：commit bodies 沒有 literal Closes: #74（純運氣 — 沒人提 #74 作為反例）
• 這個 issue 自己也碰到同一 trap：body 含 Closes: #87。filing 之後別跑 gh pr merge --squash 修它，否則 [bug] /idd-all PR template contains literal 'Closes #N' that triggers GitHub auto-close — defeats IDD close-gate discipline #87 之外可能撞 cross-repo close trigger（雖然 [bug] /idd-all PR template contains literal 'Closes #N' that triggers GitHub auto-close — defeats IDD close-gate discipline #87 已 closed，但 trap pattern 還在 issue body 裡仍可能 surface 別的 timeline event）
• 若修這個 issue 的 PR 把這個 issue body 引用進 commit message，新的 trap 又會 fire

---

Current Status

Phase: closed
Last updated: 2026-05-19 by idd-close

Complexity

Plan — decision-heavy (3 detection strategies) + risk-sensitive boundary (security/discipline gate) + cross-file refactor (idd-verify Step 0.8 + CLAUDE.md anti-trailer discipline)

Next

Closed via PR #98 (squash e0d61e7).
Closing summary: #97 (comment)

[kiki830621]

Diagnosis

Type

bug

Root Cause / Analysis

PR #94 dogfood 證實：Step 0.8（v2.60.1）的偵測面 = PR body only，而 GitHub auto-close 的觸發面 = PR body ∪ merge commit message。兩個面不一致，trap 從沒被 cover 的 channel 滲漏。

具體成因鏈：

1. closingIssuesReferences 只解析 PR body — 這是 GitHub 對 PR body trailer 的權威 parse，pre-merge 計算，不包含 commit message bodies

2. gh pr merge --squash 預設行為 — 把所有 squashed commit 的 messageBody 接龍進 squash commit message:

   <PR title> (#<PR-num>)
   
   * <commit1 subject>
   
   <commit1 messageBody 全文>
   
   * <commit2 subject>
   
   <commit2 messageBody 全文>
   ...
   

3. GitHub auto-close parser context-blind — 對 squash 後的 merge commit message 跑同一支 keyword regex（(close[sd]?|fix(e[sd])?|resolve[sd]?):? #[0-9]+），不認單引號、不認 markdown、不認上下文

4. PR cluster: fix PR-body auto-close trap (#87 #74) #94 commit d918270 messageBody 開頭（已驗證 via gh pr view --json commits）:

   R1 verify (/idd-verify --pr 94) found the Step 0.8 regex missed the colon form 'Closes: #87' — a GitHub-documented auto-close form.

   單引號裡的 Closes: #87 是反例引用，但 squash 後變成 main 上的 commit message → GitHub regex fire → #87 被 auto-closed 2 秒在 merge 後

5. #74 倖免純運氣 — 沒有任何 commit body 寫 literal Closes: #74

Evidence

$ gh pr view 94 --json closingIssuesReferences -q '.closingIssuesReferences[]'
# (empty pre-merge — PR body 乾淨，Step 0.8 pass)

$ gh pr view 94 --json commits --jq '.commits[] | select(.oid | startswith("d918270")) | .messageBody[:200]'
# 開頭就是 "...R1 verify ... missed the colon form 'Closes: #87' — a GitHub-documented..."

$ gh issue view 87 --json closedAt,stateReason
# closedAt=2026-05-19T00:48:37Z (merge 2026-05-19T00:48:35Z — 2 秒後 auto-close)

Impact

影響的檔案:

• plugins/issue-driven-dev/skills/idd-verify/SKILL.md Step 0.8（gate 本身需擴展）
• plugins/issue-driven-dev/CLAUDE.md 或 idd-implement/SKILL.md Commit Conventions 段（補 anti-trailer 寫作紀律）
• 可能需新建 plugins/issue-driven-dev/references/squash-trap.md 文件化候選解

影響的使用者流程：

• 任何使用 squash-merge 的 PR（IDD 預設）— 若 commit body 含 keyword pattern 即觸發
• 特別常見於 IDD 自身工作流：verify findings / debug discussion / closing summary 經常引用 trap pattern 作反例
• 外部 contributor 不知道 IDD 寫作紀律 → 更容易撞

Audit trail 損壞:trap fire 後 /idd-close 整條 pipeline 被 bypass — closing summary / checklist gate / ### Distribution Sync 都跳過。需事後人工補救（如 #87 在這次 close 流程中所做）。

Strategy

3-source detection + writing discipline + dogfood retroactive:

• Step 0.8 v2 — 3 來源 scan(plugins/issue-driven-dev/skills/idd-verify/SKILL.md ~ line 215–250):
  • Source 1（既有，保留）: gh pr view --json closingIssuesReferences — GitHub 對 PR body 的權威 parse
  • Source 2（新增）: gh pr view --json commits -q '.commits[].messageBody' — per-commit body 跑 trap regex
  • Source 3（新增）: 預測 squash message（concat: PR title + PR body + each commit subject/body）→ 跑 trap regex
• Reintroduce 受控 trap regex(僅 for source 2/3,不動 source 1):

  (^|[^-/[:alnum:]])(close[sd]?|fix(e[sd])?|resolve[sd]?)[[:space:]]*:?[[:space:]]+#[0-9]+
  

  R1/R2 教訓全部 baked in:\b 升為 (^|[^-/[:alnum:]]) 避開 /idd-close FP;:? 含 colon form;[[:space:]]* 含 colon-無空格 變形
• Trigger 行為(warn-only,follow Step 0.8 既有 spirit):列出 per-commit 命中 + 教使用者三種修法:
  1. git rebase -i origin/main + git commit --amend 改寫該 commit body（用 markdown code fence 或拆字: Closes #N literal letter N）
  2. gh pr merge --squash --body "<custom>" merge 時手動指定乾淨 squash message
  3. 接受並手動修補:merge 後 /idd-close 處理 post-hoc audit（如 [bug] /idd-all PR template contains literal 'Closes #N' that triggers GitHub auto-close — defeats IDD close-gate discipline #87 此次 fallback）
• Anti-trailer 寫作紀律(plugins/issue-driven-dev/CLAUDE.md 新增 ## Discussing Trap Pattern in Text 段):討論 trap pattern 時必須用 (a) markdown code fence 三反引號、(b) 拆字 Closes + 空格 + #N、(c) zero-width-space Closes​: #N，或 (d) 用 #NN/#NNN 假數
• Dogfood retroactive:新 Step 0.8 跑回 PR cluster: fix PR-body auto-close trap (#87 #74) #94（雖已 merged），驗證能正確 flag commit d918270 的 'Closes: #87'(via gh pr view 94 --json commits)
• False-positive test:/idd-close #87 #74 等 IDD skill invocation 出現在 commit body 不能觸發（R1 教訓）

Complexity

Plan —— Layer P 命中以下三項:

• Decision-heavy with 2+ valid approaches: detection strategy A vs B vs A+B（issue body 的 candidate options）。Strategy 已 narrow 到 A+B（3 來源），但 regex 形式、trigger 嚴格度（warn vs ask vs abort）、寫作紀律放哪一個檔案、是否要做 gh pr merge wrapper 都還是 design choice
• 觸及 risk-sensitive 邊界:這個 gate 本身是 security/discipline 邊界。false-negative = #87-type incident 再來;false-positive = 阻擋 legitimate PR（含 /idd-close #N skill invocation 的 PR）。R1 → R2 → R3 的 verify 教訓全在這個 gate 周圍 — 一個 approval gate 比直接 implement 安全
• Cross-file refactor 範圍:idd-verify SKILL.md Step 0.8 + plugins/issue-driven-dev/CLAUDE.md anti-trailer 紀律 + 可能新 reference doc — 至少 2 個 file 改動，非單檔 fix

不是 Spectra:Step 0.8 是 IDD 自身內部 gate,沒對外暴露 published API / protocol 給 future callers。

Risks

• Regex 重新 introduce 帶 R1 漏洞:R1 regex 漏了 colon form;這次再要回來必確認 colon form :? + space 變形涵蓋。Plan tier 的 Implementation Plan 必明寫 test cases
• False-positive 重來:若 commit body 引用 /idd-close #87 風格的 IDD skill invocation,新 Step 0.8 必須像 R1 一樣排除 [^-/[:alnum:]] prefix
• Cross-repo close trailer:owner/repo#NNN 形式 GitHub 也認 — 這個變形 R1 沒處理,Plan 階段需明確決定是否擴展
• Squash message 預測偏離:不同 gh 版本 / 不同 merge strategy（squash vs merge vs rebase）squash message 格式可能略異。Source 2（per-commit scan）對所有 strategy 都 robust;Source 3（predicted squash）對非 squash strategy 是 overkill 但無害
• 使用者疲勞:每個 PR verify 都要看一次新警告，可能 over-trigger。Plan 階段需決定預設 verbosity / 是否只在實際命中時 surface
• 回溯施救成本:這個 fix 本身的 PR 又必然會在 commit body 提到 Closes: #N（為了解釋 root cause）→ 修這 issue 的 PR 自己會 trip new gate。建議 Plan 階段討論時用 markdown code fence 隔離（dogfood the 紀律）

Vagueness Pre-check

• V1: 3 — issue body + diagnosis specify gate file (idd-verify Step 0.8), 3 detection sources (closingIssuesReferences / per-commit messageBody / predicted squash), regex with R1/R2 lessons baked-in; remaining decisions are implementation-level not WHAT-level
• V4: 2 — Strategy checklist has 6 verifiable items; explicit dogfood acceptance (new gate retroactively flags commit d918270 of PR cluster: fix PR-body auto-close trap (#87 #74) #94) + FP guard (/idd-close #N skill invocations must not fire)
• Triggered: no — both axes ≤ 3

Sister Concerns Filed (mid-diagnose, v2.47.0+ #528)

Skipped per user choice. 1 candidate surfaced but kept in-scope for Plan-tier deliberation:

• Cross-repo close trailer (owner/repo#NNN form) — Risks section flagged it as Plan-tier decision; will decide include-or-defer when drafting Implementation Plan. Audit trail kept here.

[kiki830621]

Implementation Plan (Plan tier)

Files & Changes

• plugins/issue-driven-dev/skills/idd-verify/SKILL.md (Step 0.8 region, ~line 215–251) — expand from 1-source to 2-source scan:

  • Source 1 (kept): gh pr view --json closingIssuesReferences — GitHub's authoritative parse of PR-body trailers
  • Source 2 (NEW): gh pr view --json commits --jq '.commits[] | "\(.oid)\n\(.messageBody)\n---"' → per-commit body regex scan; reports (commit oid, line snippet) pairs for each hit
  • Source 3 (predicted squash message via concat): dropped (see Decision Points)
  • Update the scan_pr_body_trailers TaskCreate description on line ~133 to scan_pr_body_and_commits_trailers reflecting expanded scope
  • Update prose on line ~219 to acknowledge closingIssuesReferences covers PR body only; commit bodies need separate scan; cite PR cluster: fix PR-body auto-close trap (#87 #74) #94 dogfood as evidence

• plugins/issue-driven-dev/CLAUDE.md (Commit Conventions section, append new subsection) — anti-trailer writing discipline:

  • New ### Discussing trap pattern in commit/PR text subsection under existing ## Commit Conventions
  • Three safe forms when referencing trap pattern as example:
    • Markdown code fence: ``` Closes #N ``` (preferred — visible + explicit)
    • Literal letter N: Closes #N with capital N, no digit (also visible; mirrors existing pr-flow.md:127 "Forbidden in PR body" pattern)
    • Cite via issue link not keyword: see PR #94 #issuecomment-...
  • Why: GitHub's auto-close parser is context-blind, scans commit/PR text regardless of quotes/markdown/intent

• plugins/issue-driven-dev/skills/idd-verify/SKILL.md (Step 0 TaskCreate bootstrap, ~line 133) — rename the TaskCreate entry from scan_pr_body_trailers to scan_pr_body_and_commits_trailers reflecting Source 2

Sequencing & Dependencies

Independent edits — files have no ordering dependency. Single commit can stage both.

Decision Points

1. Why drop Source 3 (predicted squash message simulation)? — Source 2 (per-commit scan) catches the trap across all merge strategies (squash / merge / rebase), because GitHub's parser fires off any commit body that lands on main, regardless of how it got there. Squash concatenates bodies but doesn't introduce new keywords; the trap pattern must already exist in some commit's body. Source 3 would be squash-specific and redundant given Source 2.

2. Regex form — (^|[^-/[:alnum:]])(close[sd]?|fix(e[sd])?|resolve[sd]?)[[:space:]]*:?[[:space:]]+#[0-9]+ with grep -iE (case-insensitive). R1/R2 lessons baked in:

   • (^|[^-/[:alnum:]]) prefix guard excludes /idd-close #N IDD skill invocations + idd-close-skill hyphenated tokens (R1 false-positive fix from commit 5831128)
   • :? covers colon form Closes: #N (R1 gap → R2 redesign moment)
   • [[:space:]]+ requires explicit space (GitHub requires space between keyword and #)
   • Same-repo #NNN form only — cross-repo owner/repo#N and issue-URL forms are out of scope (see Out-of-scope)

3. Trigger verbosity — warn-only (consistent with current Step 0.8 spirit). Per-hit output lists:

   ⚠️  Commit <oid-short> body contains close-keyword pattern:
        "<line snippet>"
        → will auto-close referenced issue on merge.
        Fix options:
          (a) git rebase -i origin/main → amend commit <oid> → wrap example in code fence or use literal letter N
          (b) gh pr merge $PR --squash --body "<custom>" — override squash message text
          (c) accept; manually post-hoc /idd-close after merge (last resort)
   

   No abort. False-positive rate must be low enough that warn-only doesn't desensitize users.

4. Writing discipline placement — extend plugins/issue-driven-dev/CLAUDE.md Commit Conventions section (not new reference doc). Rationale: the convention lives next to the auto-close-trailer ban rule already there; one anti-trailer discipline section, not split.

5. gh pr merge wrapper / /idd-merge skill — explicitly deferred, not in this PR. Would be a heavier solution (own skill, own gate). The verify-time warn pathway is sufficient first step; if false-positive rate stays low after a month of dogfood, can revisit a dedicated merge wrapper later.

Risks & Mitigations

• Regex re-introduction brings back R1 vulnerabilities — Mitigation: explicit test cases in Implementation Plan (see Test Plan), retroactive dogfood against PR cluster: fix PR-body auto-close trap (#87 #74) #94 (must flag commit d918270's 'Closes: #87' AND not flag 5831128's /idd-close reference).

• Cross-repo trailer (owner/repo#N) form — Mitigation: explicit Out-of-scope; file as follow-up issue after this PR ships if needed (per #97 Sister Concerns Filed audit trail — Plan tier confirms defer). The current regex won't catch it, but squash-commit-body auto-close trap: PR body clean but squashed commit bodies leak trap pattern (caught #87 in PR #94 dogfood) #97 reproduces only the same-repo squash trap.

• User fatigue from warnings on every verify — Mitigation: warn only when actual hits found (skip the section entirely on clean PRs, same as current Step 0.8 behavior for empty closingIssuesReferences).

• Meta-recursion: the PR that fixes this issue might itself contain trap pattern in commit bodies — Mitigation: dogfood the new gate on this PR's own commits (the implement-time test); follow the new CLAUDE.md discipline when writing commit messages discussing trap pattern (use code fence).

• Source 2 cost — gh pr view --json commits returns all commits; for large PRs this could be slow but is bounded by PR size. Step 0.8 is already a verify-time gate; one extra gh call is acceptable.

• Multi-line commit body regex — grep operates per-line by default; commit messageBody can span multiple lines. Need to confirm gh pr view --json commits --jq returns the body verbatim and that line-based grep correctly identifies the offending line (it should — line is the natural unit for both commits[].messageBody and GitHub's regex match).

Test Plan

• RED → GREEN — retroactive dogfood:

  • Before fix: PR cluster: fix PR-body auto-close trap (#87 #74) #94 was merged with commit d918270 whose body contained 'Closes: #87'. The old Step 0.8 (PR body only) saw closingIssuesReferences: [] and passed. Confirm this is the current behavior by running the existing Step 0.8 bash against PR cluster: fix PR-body auto-close trap (#87 #74) #94 — must return no warning.
  • After fix: same command path + new Source 2 scan over PR cluster: fix PR-body auto-close trap (#87 #74) #94's commits must flag commit d918270 (hits Closes: #87) and must NOT flag commit 5831128 (contains /idd-close #N but with / prefix → excluded). Both verifiable with a few gh pr view --json commits commands.

• False-positive test (preserved from R1 lesson):

  • PR body containing /idd-close #87 #74 (existing pattern in PR cluster: fix PR-body auto-close trap (#87 #74) #94 body) → not flagged by Source 1 (closingIssuesReferences empty) AND not flagged by Source 2 (the line is in PR body not commit body)
  • Commit body containing /idd-close #87 IDD skill invocation reference → not flagged (regex prefix guard)

• Variant coverage:

  • Closes #42 (bare form) → flagged
  • Closes: #42 (colon form) → flagged
  • closes #42 (lowercase) → flagged (case-insensitive)
  • Fixes #42 / Resolves #42 → flagged
  • closed #42 / resolved #42 (past tense) → flagged
  • Closes#42 (no space) → not flagged (space required by GitHub)
  • Closes #42 in test data → flagged (false-positive — GitHub would also auto-close, so this is consistent with GitHub's parser)

• Bash sanity:

  • bash -n clean on new Step 0.8 block
  • gh pr view --json commits jq query produces parseable lines
  • Empty PR (no commits) → Source 2 returns nothing, no error

• No formal test framework — SKILL.md is prose; verification is grep assertions + bash -n + retroactive dogfood. Same approach as PR cluster: fix PR-body auto-close trap (#87 #74) #94 itself.

Out-of-scope (will NOT be touched)

• Cross-repo close trailer (owner/repo#N / https://github.com/owner/repo/issues/N forms) — defer to follow-up issue. Different regex shape; squash-commit-body auto-close trap: PR body clean but squashed commit bodies leak trap pattern (caught #87 in PR #94 dogfood) #97 reproduces only same-repo squash trap; would creep scope. Confirmed defer per #97 Sister Concerns audit (user chose "Skip — in Plan tier decide").
• gh pr merge wrapper / /idd-merge skill — defer; verify-time warn pathway is the lighter first fix.
• Predicted squash message simulation (Source 3) — dropped; Source 2 already covers all merge strategies (see Decision Point 1).
• Zero-width-space convention in CLAUDE.md — listed as anti-pattern in writing discipline (invisible chars are fragile); preferred forms are code fence + literal letter N.
• README.md skill catalog — Step 0.8 is internal verify behavior, not a new user-facing skill or flag; README stays untouched (consistent with v2.60.1 close decision).
• Other idd-* skills' anti-trailer warning template wording — already fixed in PR cluster: fix PR-body auto-close trap (#87 #74) #94 (v2.60.1); no template re-edits needed here.

Tangential Observations (filed mid-plan, v2.42.0+ #524)

Skipped per user choice. 1 candidate surfaced but kept in-scope of this Plan's Decision Points:

• /idd-merge skill / gh pr merge wrapper (merge-time gate stronger than verify-time warn) — Decision Point 5 commits to revisit after ~1 month dogfood of the verify-time fix; will file then if data justifies.

[kiki830621]

Implementation Complete

Checklist (synced from TaskList)

• plugins/issue-driven-dev/skills/idd-verify/SKILL.md Step 0.8 region — extended from 1-source to 2-source scan (Source 1 keeps closingIssuesReferences, Source 2 adds per-commit messageBody regex with R1/R2/R3 lessons baked in) → commit fb66733
• plugins/issue-driven-dev/skills/idd-verify/SKILL.md line 133 — renamed Step 0 bootstrap TaskCreate scan_pr_body_trailers → scan_pr_body_and_commits_trailers with updated description → commit fb66733
• plugins/issue-driven-dev/CLAUDE.md Commit Conventions — appended ### 引用 trap pattern 作反例的寫作紀律 (v2.61.0+, #97) subsection: 3 safe forms table (markdown code fence visual / literal letter N actual suppression / cite via link), anti-pattern note about quotes not suppressing parser, why context-blind matters → commit fb66733

Legend: - [x] done · - [~] skipped · - [-] won't fix
idd-close will refuse to close if any - [ ] remains in this checklist.

Changes

• fb66733 fix: idd-verify Step 0.8 — scan commit bodies in addition to PR body (Refs squash-commit-body auto-close trap: PR body clean but squashed commit bodies leak trap pattern (caught #87 in PR #94 dogfood) #97)
  • 2 files changed, 85 insertions(+), 14 deletions(-)

Files Changed

 plugins/issue-driven-dev/CLAUDE.md                 | 16 +++++
 plugins/issue-driven-dev/skills/idd-verify/SKILL.md | 83 ++++++++++++++++++----
 2 files changed, 85 insertions(+), 14 deletions(-)

Implement-time findings

All three Plan-defined verifications PASS:

1. bash -n on Step 0.8 region — clean. No syntax error in the expanded block.

2. Retroactive dogfood against PR cluster: fix PR-body auto-close trap (#87 #74) #94 — the new Source 2 regex flags commit d918270 (the trap source that auto-closed #87) and correctly skips commits 5831128 / 747e0ec which contain /idd-close #N IDD skill invocations (prefix guard works).

3. Variant table (7 trap forms HIT, 4 safe forms NO HIT):

   Form	Status	Why
   bare / colon / lowercase / past-tense (7 inflections of close/fix/resolve)	HIT	trap regex matches each
   Closes#N (no space after keyword)	NO HIT	GitHub also requires space
   /idd-close #N (IDD skill invocation)	NO HIT	prefix guard [^-/[:alnum:]] excludes / prefix
   idd-close-skill #N (hyphenated token)	NO HIT	prefix guard excludes -
   Closes #N (literal letter N, no digit)	NO HIT	trailing [0-9]+ cannot match N

4. Self-dogfood: ran the new Source 2 regex against this commit's own message body — NO HIT. The discipline added to CLAUDE.md was applied to the commit message itself (letter N for examples, no real digits after keywords).

Scope Compliance

In-scope: 2 files modified, both directly in the Plan. No drift into other skills, README, or unrelated files. Cross-repo trailer support intentionally deferred per Decision Point D7.

Sister Bugs Filed (mid-impl, Step 5.7)

To be filled by Step 5.7 sweep.

Next: verification pending

Sister Bugs Filed (mid-impl, v2.44.0+ #526)

none surfaced — implementation touched only the 2 files specified in the Plan; no adjacent same-root-cause sibling files encountered. The cross-repo trailer concern (D7) and /idd-merge wrapper (D6) are Plan-documented out-of-scope decisions, not undiscovered sister bugs.

[kiki830621]

🔍 /idd-verify R1 — CONDITIONAL PASS (PR #98). 5/6 reviewers pass; Devil's Advocate + Codex agree on 1 HIGH finding: Source 2 misses commit-subject channel (empirical evidence: 8ac8206 auto-closed #70, a82867d auto-closed #26). 1-line jq fix proposed in same PR. Master report: #98 (comment)

[kiki830621]

🔍 /idd-verify R2 — PASS (PR #98). 6/6 reviewers pass; R1's DA-H1 (subject-channel gap) empirically closed. Devil's Advocate explicitly recommends MERGE. 3 cosmetic nits remain (docs wording, non-blocking). Master report: #98 (comment)

[kiki830621]

Closing Summary

Problem

PR #94 (v2.60.1, cluster fix for #87 + #74) added idd-verify Step 0.8 — a PR-body auto-close-trailer scan using gh pr view --json closingIssuesReferences (GitHub's authoritative parse). When PR #94 itself was squash-merged, GitHub auto-closed #87 2 seconds after merge — bypassing the very gate the PR was adding. Root cause: GitHub's auto-close parser fires off any close-keyword + #<digit> substring in the merge commit message. gh pr merge --squash concatenates every squashed commit's subject + body into that message. One of PR #94's commits had a body that quoted the trap pattern as a verify-finding example (single-quoted); single quotes don't suppress the context-blind parser.

#74 was spared by pure luck — no commit body contained a literal Closes: #74.

Step 0.8 v1's detection face = PR body only;
trap trigger face = PR body ∪ every commit subject ∪ body landing on main.
Two faces, out of sync.

Root Cause

Step 0.8 v1 (PR #94, v2.60.1) used closingIssuesReferences exclusively. That field is GitHub's authoritative parse of trailers in the PR body — and only the PR body. GitHub never pre-computes closing references for commit messages; the parser only runs at merge time on the resulting commit message (squash result, or individual commits for merge / rebase strategies). The v1 gate's coverage left every commit body and subject landing on main unscanned.

Solution

Extend Step 0.8 to a 2-source scan in plugins/issue-driven-dev/skills/idd-verify/SKILL.md:

• Source 1 (kept, GitHub authoritative — PR body): gh pr view --json closingIssuesReferences
• Source 2 (NEW — per-commit messageHeadline + messageBody, local regex):
  • gh pr view --json commits --jq '.commits[] | "===\(.oid)===\n\(.messageHeadline // "")\n\(.messageBody // "")"'
  • Trap regex: (^|[^-/[:alnum:]])(close[sd]?|fix(e[sd])?|resolve[sd]?)[[:space:]]*:?[[:space:]]+#[0-9]+ with tolower($0) (case-insensitive)
  • R1/R2/R3 lessons baked in: prefix guard (^|[^-/[:alnum:]]) excludes /idd-close IDD skill invocations and hyphenated tokens; :? covers the colon form (R1's gap → R2 redesign source from PR cluster: fix PR-body auto-close trap (#87 #74) #94); [[:space:]]+ mirrors GitHub's space requirement
  • Same-repo #N form only; cross-repo owner/repo#N deferred (Plan D7)

Plus writing-discipline subsection in plugins/issue-driven-dev/CLAUDE.md under ## Commit Conventions: code fence is visual only (the parser is context-blind); literal letter N is the actual suppression; cite-via-link is strongest. Single/double quotes do NOT suppress the parser. This is the write-time root fix; Source 2 is defence-in-depth at verify time.

R2 (in-PR fix after R1 verify) extended Source 2's jq filter from body-only to headline + body after Devil's Advocate + Codex independently agreed on the missed-subject channel (DA-H1), with empirical evidence: 8ac8206 headline resolves #N → auto-closed #70; a82867d headline fix #N → auto-closed #26. R1's body-only filter would have missed both.

Verification

• 6-AI cross-verify on PR fix: idd-verify Step 0.8 — scan commit bodies (#97) #98, 2 rounds:
  • R1 (fb66733): CONDITIONAL PASS — DA + Codex independently surfaced subject-channel gap with empirical incidents.
  • R2 (92fdf58): 6/6 PASS — Devil's Advocate explicitly recommends MERGE. Empirical re-confirmation: both 8ac8206 and a82867d headlines now HIT under R2's logic.
• bash -n on the expanded Step 0.8 region: clean.
• Retroactive dogfood vs PR cluster: fix PR-body auto-close trap (#87 #74) #94: regex hits commit d918270 (the original trap source) and does NOT hit 5831128 / 747e0ec (which contain /idd-close #N IDD skill invocations — prefix guard works).
• Self-dogfood (post-merge): the squash commit e0d61e7 on main is clean under the new 2-source Step 0.8 — the discipline added to CLAUDE.md held for both the commit message body AND headline. The PR that fixes the squash-commit-body trap does not itself trigger it.
• Master verify reports:
  • R1: fix: idd-verify Step 0.8 — scan commit bodies (#97) #98 (comment)
  • R2: fix: idd-verify Step 0.8 — scan commit bodies (#97) #98 (comment)

Changes

Squashed into e0d61e7 on main (PR #98):

• fb66733 (R1) — fix: idd-verify Step 0.8 — scan commit bodies in addition to PR body (Refs squash-commit-body auto-close trap: PR body clean but squashed commit bodies leak trap pattern (caught #87 in PR #94 dogfood) #97)
• 92fdf58 (R2 amend, force-pushed) — fix: idd-verify Step 0.8 — scan commit subject + body in addition to PR body (Refs squash-commit-body auto-close trap: PR body clean but squashed commit bodies leak trap pattern (caught #87 in PR #94 dogfood) #97)

2 files / 93 ins / 14 del:

• plugins/issue-driven-dev/skills/idd-verify/SKILL.md — Step 0.8 expanded to 2 sources + bootstrap TaskCreate description renamed
• plugins/issue-driven-dev/CLAUDE.md — appended ### 引用 trap pattern 作反例的寫作紀律 (v2.61.0+, #97) subsection

Residuals (non-blocking, ACCEPTED by R2 6/6 PASS)

• Logic L1 — Closes:#42 no-space form: unconfirmed if GitHub honors; will file follow-up if surfaces in practice
• 3× cosmetic wording drift in SKILL.md (line 133 TaskCreate description and line 290 warning header still say "messageBody"/"commit bodies"; lines 267-269 prose contains literal example incidents) — runtime correct, pure docs nits

Closing Follow-ups Filed

none — R2's 3 cosmetic nits did not warrant separate issues; will be cleaned up in a subsequent passing PR if surfaced.

Distribution Sync

• Detected: plugin (this repo hosts the marketplace; issue-driven-dev plugin)
• Choice: chain to /plugin-tools:plugin-update issue-driven-dev
• Outcome: bumped plugin.json + marketplace.json 2.60.1 → 2.61.0 (commit d39ad1b), pushed to origin/main, ran claude plugin marketplace update issue-driven-development + claude plugin update issue-driven-dev@issue-driven-development — installed version confirmed v2.61.0. Minor bump because Step 0.8 gains a new detection source (channel coverage expansion).
• At: 2026-05-19T02:20:01Z