Harden three classes from the profiles cycle - #16
Merged
Conversation
Runs dev-workflow:harden-finding on the three classes that recurred through the risk/security/validation profiles work. All three land as text; none reaches a mechanical rung, and each ledger row says so rather than implying otherwise. unverified-enforcement-claim, 4th occurrence, rung P — prompt-standards item 11 gains two rules: where the reader can reach the authoritative source, cite it instead of restating it (with invariant 8's self-contained-template exception named), and delete a mechanism claim that has needed a fourth correction rather than refining it again. From a paragraph describing the hook's path matcher that took four consecutive Gate-B corrections, each a subtler version of the last, and closed only when the enumeration was deleted. rewrite-drops-prior-condition, NEW class, rung 1 — a new AGENTS.md Don't: never replace a decision procedure without listing its old conditions and marking each kept, moved, or deliberately dropped. Ten instances in one cycle, one of which briefly made an eligible profile sufficient for a Gate-B skip: a gate-off path invented by the change that exists to close one. docs-drift, 4th occurrence with a new mechanism, rung P — a standing lens on every Gate-B call in both §5 copies: "which existing statements does this diff falsify?" It found a shipped command that would have let a one-line fix skip Gate B, plus two docs teaching a rule the same change had narrowed. Two escalations deliberately refused, with the reasoning in the rows: both lineages' latest entries are rung-2 checks guarding one spelling each (Target-model lines; prose count claims), and both new defects fall outside those spellings — the over-escalation those rows warn about by name. Gate B: 7 findings at pass 1, then 1, 1, and clean on both branches at pass 4. Three of those findings were this change committing the classes it hardens — the item-11 fix reaching only the repo copy, the new rule contradicting invariant 8, and the lens claiming no check could reach the class. Verification: full battery green — shellcheck (6 files), hook tests, check-invariants + suite (123 assertions), check-version-bump + suite (36 assertions), claude plugin validate --strict; exit 0.
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe changes add Gate-B review lenses and prompt-quality rules, document new hardening categories and incidents, clarify CodeRabbit completion verification, and release the dev-workflow plugin as version 0.7.1. ChangesGate-B hardening
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryThis PR adds prose-based hardening guidance for three recurring documentation and review-process failure classes.
Confidence Score: 5/5The PR appears safe to merge, with the repository and downstream prompt copies preserving the intended conditions while clearly stating that the new safeguards are prose-based. The changed guidance is reachable in its intended repository and scaffolded contexts, the authoritative and downstream-neutral copies retain the same operative exception and fourth-correction threshold, and the taxonomy, ledger, changelog, and version changes remain consistent with their consumers. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart LR
A[Repository guidance] --> B[CLAUDE.md Gate-B lens]
A --> C[Prompt standards item 11]
A --> D[AGENTS.md rewrite rule]
B --> E[workflow-init inline templates]
C --> E
E --> F[Downstream project guidance]
D --> G[Hardening taxonomy and ledger]
Reviews (1): Last reviewed commit: "harden: three classes from the profiles ..." | Re-trigger Greptile |
…ot a hazard Fourth occurrence (#12, #13, #15, #16 — the last observed while writing this row): the status check passes while the comment reads "Review rate limited" and the live head has no review record. The row now says never merge on the check alone; the review count is the arbiter, and the verification command runs on every merge rather than when something looks off. Docs-only (docs/**.md), so Gate B is N/A per CLAUDE.md §5's prose exemption.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/hardening-taxonomy.md`:
- Around line 75-78: Update the rewrite-drops-prior-condition definition in the
taxonomy entry to change “one the old prose carried” to “one of the conditions
the old prose carried,” preserving the surrounding wording and aliases.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e39a751d-b0a1-4e44-92b1-a711945d8103
📒 Files selected for processing (9)
AGENTS.mdCLAUDE.mddocs/hardening-log.mddocs/hardening-taxonomy.mddocs/pr-review-bots.mddocs/prompt-standards.mdplugins/dev-workflow/.claude-plugin/plugin.jsonplugins/dev-workflow/CHANGELOG.mdplugins/dev-workflow/commands/workflow-init.md
PR #16 review finding: "one the old prose carried" was ambiguous; it now reads "one of the conditions the old prose carried". Docs-only (docs/**.md), so Gate B is N/A per CLAUDE.md §5's prose exemption. Validated directly rather than by a finding-triage subagent — the PR edits instruction-bearing paths, which the command's step-0 precheck routes to manual validation.
dsnger
added a commit
that referenced
this pull request
Jul 27, 2026
Observed on #16 within one PR: head c6c1850 had the message and count 0 (unreviewed); head 85c5ce5 had the same message and count 1 (reviewed). So the message is not the tell — the count is the only arbiter, and it must be re-run per head, since every push moves the target. Docs-only (docs/**.md), so Gate B is N/A per CLAUDE.md §5's prose exemption.
dsnger
force-pushed
the
harden-profiles-cycle-classes
branch
from
July 27, 2026 12:09
de04c8a to
85c5ce5
Compare
This was referenced Jul 27, 2026
dsnger
added a commit
that referenced
this pull request
Jul 27, 2026
Docs-only, two files, no plugin path — no version bump. CodeRabbit leaves Wait for after five consecutive unreviewed heads (#12, #13, #15, #16, #17 — the last with zero review records on the PR) followed by a genuine review on #18. Real findings source, unpredictable delivery, and a completion signal that fires regardless of whether a review happened: the opportunistic category by this file's own definition. Wait for is now empty. Row additions: the status check goes green whether or not a review happened, and `@coderabbitai review` is a no-op while automatic reviews are active (CodeRabbit's own message on #17), which retroactively explains #14's "re-trigger produced nothing". Plan corrected to Free; "Pro Plus" was observed on PR #1 only. The count rule's two facts separated: the per-head count remains the arbiter of whether a head was reviewed, for any bot; the recorded-human-decision requirement binds only bots under Wait for, and is dormant while that list is empty. Every head reaching a PR has already passed Gate B, so a quiet supplementary reviewer needs no exception. MANIFEST.md: the bare `CLAUDE.md` row resolved to the repo root and produced a false Major on #18. Qualified to source-files/CLAUDE.md, with the three files distinguished, and root §6 (context canary) recorded as deliberately outside the §1–§5 template range and never to be synced into the scaffolded template. Pre-merge diagnostic: per-head count 1 on head 2634bf2 — reviewed. One Minor finding (drop or explicitly optionalize the re-trigger step) collected, not actioned, per §5's Minor/Nit rule. Gate B: N/A — every path is explanatory documentation per §5's prose rule. Battery green at each commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Runs
dev-workflow:harden-findingon the three classes that recurred through the profiles work (#15). All three land as text; none reaches a mechanical rung, and each ledger row says so instead of implying otherwise.unverified-enforcement-claimrewrite-drops-prior-conditiondocs-driftPlus the new class in
docs/hardening-taxonomy.mdwith its boundary againstdocs-driftdrawn, three ledger rows, and 0.7.0 → 0.7.1.Why these rungs, and two refused escalations
Both lineages' latest entries are rung-2 checks in
scripts/check-invariants.sh— but each guards exactly one spelling (Target model:lines; prose count claims), and both new defects fall outside those spellings. The 2026-07-26 rows warn about precisely this by name:harden-findingcompares fingerprints only, so a later in-class defect outside the guarded spelling gets proposed for a stronger rung than anything justifies, and a human validates that proposal. The reasoning is written into each row rather than the number being taken silently.One arithmetic correction found during review: the
unverified-enforcement-claimrow said fifth occurrence. The 2026-07-26 row resolves the 2026-07-25pendingrow rather than recording a new defect, so it is the fourth. Since the refused escalation rests on that count, the row now carries the arithmetic.Item 11 was sharpened rather than split into a new item 13: a new numbered item ripples the checklist count through prompt-standards, the
/workflow-inittemplate and AGENTS.md invariant 11 — all pinned together by check 4b, the rung-2 hardening for a sibling class. The hardening would have broken the checker guarding its neighbour.What the gate caught
Gate B ran 7 findings at pass 1, then 1, 1, and clean on both branches at pass 4. Three of the seven were this change committing the classes it hardens:
docs/prompt-standards.md, leaving the inline template — the thing downstream projects actually receive — unhardened;Pass 3 then found the downstream copy saying "third or fourth correction" where the authoritative one says "fourth" — neutralising incident details had quietly loosened a threshold, giving two shipped copies two different decision rules. Neither branch found that by grep; both found it by reading the copies side by side.
Verification
Full battery green — shellcheck (6 files), hook tests,
check-invariants+ suite (123 assertions),check-version-bump+ suite (36 assertions),claude plugin validate --strict; exit 0. Findings files and per-pass artifacts are in.context/codex-reviews/.One caveat stated rather than glossed: while confirming the threshold parity I ran a regex that did not match the repo copy's line-wrapped phrasing, so it reported disagreement on text that was already correct. Parity was confirmed by reading both copies. A check that returns a wrong answer is the
verification-masks-failureclass in miniature, and it is recorded here rather than left to look like a passing check.Summary by CodeRabbit