Auto-resolve CVE/scan release-blockers: route to a feedback-equipped frontier lane (no human in the loop)

[joryirving]

Goal (the contract)

CVE/scan failures block releases. dispatch auto-detects, grooms, and fixes them with no human in the loop. Any design that routes them to needs-human breaks that contract.

Status: umbrella / architecture

This is not a single coder task — the issueAsk rail correctly demoted a coder attempt on it, because it spans dispatch + foreman + the coder image. Decomposed:

Coder-actionable (filed)

• CI-failure issues: enrich body with parsed scan findings (package → fixed-in → location) at ingest #994 — enrich CI-failure issue bodies with parsed scan findings (package → fixed-in → file/binary location) at ingest. Always-positive, independent of everything below. Ready for the loop.

The crux — needs an architecture decision (not a coder task)

• Give the CVE-fixing lane a build + scan feedback loop (docker + grype/trivy available to the lane), so it reproduces the failing scan, iterates, and only pushes a change it has verified clears the gate — instead of guessing and letting CI reject. This is the load-bearing piece: without it, a stronger model just makes more expensive wrong guesses (evidence: feat: define harness-agnostic agent task contract #393/feat: add groomer next-task mode #406 were automated node-bumps that both failed; the real elixir-gate fix required building the image and running grype). This is foreman/coder-image infra and is the one part that genuinely needs a human (architectural) decision.

Gated on the feedback lane

• Route scan/CVE-classified failures to the frontier lane. Deferred on purpose: routing CVEs to a stronger model without the build+scan loop above is net-negative (higher token cost, same guessing). Do this only once the lane can verify.

GPU backstop (in progress / done)

• Coarser signatures so one break is one issue: fix(ci-failures): stop hashing the job name into the failure signature #989 (drops job name from the signature).
• Recovery-close on green so a self-resolving failure stops re-dispatching: already built (decideAction, healthy state).
• Cap attempts per failure signature.

Why it matters

CVE scan gates block :rolling and every release behind it. #407 alone burned ~98 GPU-minutes on a coder that structurally could not fix it. The fix is a lane that can verify, plus the router and enrichment feeding it — never a human clearing the block.

[itsmiso-ai]

Grooming: promoting to ready. The problem is well-evidenced (#407, ~98 GPU-min wasted) and the fix direction is clear — option 1 (file CI-failure issues as non-claimable by default) is the right first step. The change is localized to the labeling logic in src/lib/ci-failure-ingestion.ts where issues are created: swap the auto-applied coder-claimable labels for a non-claimable status so a human (or the groomer) promotes genuinely code-actionable failures into the queue. Pairs cleanly with #986's recovery-close.

[itsmiso-ai]

Needs a human decision (path: rail-demoted)

review approved; demoted by the issueAsk rail, not re-runnable: issueAsk could not be verified as covering the fetched issue body; review verdict is untrusted

Issue: #988

Posted by the foreman-dispatch-bridge.