From b52fa907d989b94bdf991df06fdf3776eb2ff4d9 Mon Sep 17 00:00:00 2001 From: Wolfgang Schoenberger <221313372+wolfiesch@users.noreply.github.com> Date: Mon, 31 Aug 2026 19:39:24 -0700 Subject: [PATCH 1/3] docs: explain pull request verification routing --- docs/verification.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/verification.md b/docs/verification.md index 325afbc..3e0cbe8 100644 --- a/docs/verification.md +++ b/docs/verification.md @@ -24,6 +24,12 @@ cargo build --release --locked --manifest-path host-rs/Cargo.toml -p agenttab-ho The workspace checks TypeScript adapters, extension code, installer, OMP adapter, and package builds. The architecture gates cover manifest identity, required and optional permission behavior, RPC schemas, forbidden legacy surface, and Rust IPC framing. They do not operate a real signed-in browser. +## Pull request routing + +Pull requests that change only `README.md`, `CHANGELOG.md`, `LICENSE`, documentation text under `docs/`, or a top-level GitHub Markdown file use the lightweight CI lane. The classifier still scans added public text for credentials, private paths, session identifiers, and private hosts. Source, manifest, workflow, nested GitHub, executable documentation, mixed, empty, or ambiguous changes use the full cross-platform lane. + +Branch protection requires the stable `verify` check. An event-driven review gate publishes `exact-head-review` only when the automated review commit matches the current pull-request head. A new push invalidates that status and requires a fresh review; unresolved review threads remain merge blockers. + ## Live browser evidence Use a disposable Chrome profile and a disposable test account. Reload the unpacked extension through Chrome's extension UI, then observe the actual surface after every UI action. Exercise: From b90a1a10d16845cc5f3b5dcc85f49e086049c798 Mon Sep 17 00:00:00 2001 From: Wolfgang Schoenberger <221313372+wolfiesch@users.noreply.github.com> Date: Mon, 31 Aug 2026 19:44:16 -0700 Subject: [PATCH 2/3] ci: keep exact-head review in shipping gate --- .github/workflows/review-gate.yml | 75 ------------------------------- docs/verification.md | 4 +- 2 files changed, 2 insertions(+), 77 deletions(-) delete mode 100644 .github/workflows/review-gate.yml diff --git a/.github/workflows/review-gate.yml b/.github/workflows/review-gate.yml deleted file mode 100644 index e38bc25..0000000 --- a/.github/workflows/review-gate.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Review Gate - -on: - pull_request_review: - types: [submitted] - -permissions: - checks: write - contents: read - -jobs: - publish-exact-head-review: - name: publish-exact-head-review - if: ${{ github.event.review.user.login == 'copilot-pull-request-reviewer[bot]' }} - runs-on: ubuntu-latest - timeout-minutes: 2 - steps: - - name: Publish exact-head review result - uses: actions/github-script@v7 - with: - script: | - const owner = context.repo.owner; - const repo = context.repo.repo; - const head = context.payload.pull_request?.head?.sha; - const reviewed = context.payload.review?.commit_id; - const exactHead = Boolean(head && reviewed && head === reviewed); - const output = { - title: exactHead - ? "Automated review matches the pull-request head" - : "Automated review is stale", - summary: exactHead - ? `Review commit ${reviewed} matches the current pull-request head.` - : `Review commit ${reviewed || "missing"} does not match pull-request head ${head || "missing"}.`, - }; - - if (!head) { - core.setFailed("The pull-request head SHA is missing from the review event."); - return; - } - - const existing = await github.rest.checks.listForRef({ - owner, - repo, - ref: head, - check_name: "exact-head-review", - filter: "latest", - per_page: 1, - }); - const check = existing.data.check_runs[0]; - if (check) { - await github.rest.checks.update({ - owner, - repo, - check_run_id: check.id, - status: "completed", - conclusion: exactHead ? "success" : "failure", - completed_at: new Date().toISOString(), - output, - }); - } else { - await github.rest.checks.create({ - owner, - repo, - name: "exact-head-review", - head_sha: head, - status: "completed", - conclusion: exactHead ? "success" : "failure", - completed_at: new Date().toISOString(), - output, - }); - } - - if (!exactHead) { - core.setFailed("The automated review does not match the current pull-request head."); - } diff --git a/docs/verification.md b/docs/verification.md index 3e0cbe8..eaec312 100644 --- a/docs/verification.md +++ b/docs/verification.md @@ -26,9 +26,9 @@ The workspace checks TypeScript adapters, extension code, installer, OMP adapter ## Pull request routing -Pull requests that change only `README.md`, `CHANGELOG.md`, `LICENSE`, documentation text under `docs/`, or a top-level GitHub Markdown file use the lightweight CI lane. The classifier still scans added public text for credentials, private paths, session identifiers, and private hosts. Source, manifest, workflow, nested GitHub, executable documentation, mixed, empty, or ambiguous changes use the full cross-platform lane. +Pull requests that change only `README.md`, `CHANGELOG.md`, `LICENSE`, documentation files ending in `.md`, `.rst`, or `.txt` under `docs/`, or a top-level `.github/*.md` file use the lightweight CI lane. The classifier still scans added public text for credentials, private paths, session identifiers, and private hosts. Source, manifest, workflow, nested GitHub, executable documentation, mixed, empty, or ambiguous changes use the full cross-platform lane. -Branch protection requires the stable `verify` check. An event-driven review gate publishes `exact-head-review` only when the automated review commit matches the current pull-request head. A new push invalidates that status and requires a fresh review; unresolved review threads remain merge blockers. +Branch protection requires the stable `verify` check. The automatic review ruleset requests a fresh review after every push, and the repository shipping command refuses to merge unless the latest automated review commit matches the current pull-request head. Unresolved review threads remain merge blockers. ## Live browser evidence From 7cb51d6ec7b219de343c20d84ef825f13b568dbb Mon Sep 17 00:00:00 2001 From: Wolfgang Schoenberger <221313372+wolfiesch@users.noreply.github.com> Date: Mon, 31 Aug 2026 19:47:56 -0700 Subject: [PATCH 3/3] docs: clarify review freshness check --- docs/verification.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/verification.md b/docs/verification.md index eaec312..4cff257 100644 --- a/docs/verification.md +++ b/docs/verification.md @@ -28,7 +28,7 @@ The workspace checks TypeScript adapters, extension code, installer, OMP adapter Pull requests that change only `README.md`, `CHANGELOG.md`, `LICENSE`, documentation files ending in `.md`, `.rst`, or `.txt` under `docs/`, or a top-level `.github/*.md` file use the lightweight CI lane. The classifier still scans added public text for credentials, private paths, session identifiers, and private hosts. Source, manifest, workflow, nested GitHub, executable documentation, mixed, empty, or ambiguous changes use the full cross-platform lane. -Branch protection requires the stable `verify` check. The automatic review ruleset requests a fresh review after every push, and the repository shipping command refuses to merge unless the latest automated review commit matches the current pull-request head. Unresolved review threads remain merge blockers. +Branch protection requires the stable `verify` check. The automatic review ruleset requests a fresh review after every push. Before merging, confirm that the latest automated review commit matches the current pull-request head; if the commits differ, request another review. Unresolved review threads remain merge blockers. ## Live browser evidence