Repository navigation
land: gh-shim-v22-classifier - #1000
Merged
Merged
Conversation
…stacks, extensions) Classifier support for manifest 22, inactive until a signed v22 manifest is installed: pr edit (title/body of the bot's own PR) and the PATCH pulls/<n> spelling route as own-PR bot speech; review-comment replies and the resolveReviewThread/unresolveReviewThread GraphQL mutations route as bot speech; the stack REST writes route as bot speech; gh extension install/upgrade/remove, gh stack merge and PUT merge-async are operator administration; gh-stack subcommands that would write as the operator are refused with the bot route named, or run under the audited operator bypass. The v22 payload preparer chains from the reviewed v21 payload by digest. Implicit-method gh api calls are now classified with the method gh sends (POST when a payload is given); before v22 no POST rule exists, so their classification is unchanged. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
…ine endings Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
The stack-write, pr edit label and pr edit flag refusals now carry the
wording approved on 2026-10-26, with {command} and {flag} as the
substitution points. The tests assert the exact rendered strings against a
copy of the approved text, including one fully spelled-out stack refusal
and one flag refusal. The Plexus-side refusal for a pull request the bot did
not open stays out of AFT.
Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
(cherry picked from commit 6728bdf2b9562552553b1cc31d278d00b8f0d999)
Retargeting a pull request changes what it merges into, which is not bot speech. PATCH pulls/<n> now admits only title and body, the same fields as gh pr edit; a base field is refused before routing in either payload spelling. The api rule rationale says so. Stacks do not need it: each pull request is opened with --base <parent>, and GitHub retargets the rest when the bottom one merges. The pull-PATCH test previously asserted that base was forwarded; it now asserts that base is refused. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com> (cherry picked from commit 7d8adde5ebb6b66ae899fd66b7a0dddace0ae40c)
gh stack push makes no API call, but it writes the stack's branches to GitHub with the operator's git credentials, always as a --force-with-lease push (github/gh-stack cmd/push.go:103-109 calling internal/git/gitops.go:258-305). That is the operator writing, so it joins submit/sync/link/unstack/delete/checkout: refused with the bot route named, or run under GH_SHIM_BYPASS=operator with an audit line. It leaves the mechanical tier of the v22 additions. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com> (cherry picked from commit 7a10e41268381aa28e49a33613e9ee71e05b42a9)
The governed review-thread reader now refuses an aliased mutation field, and a read-only GraphQL document that names resolveReviewThread or unresolveReviewThread anywhere (a fragment, an alias) is no longer passed through as an operator read. New classifier test rows: a second mutation in the same operation, extra input fields, a query naming the mutation through a fragment or an alias, an aliased mutation, a mutation fragment spread, and documents with two operations. Each is refused at v22 and v21 and is not an unbound-safe read. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com> (cherry picked from commit e5418c6b63bb95cfb1c5c62e1edf04abd248ceec)
The wire-goldens holder now takes the bindings reply it answers with, and a new test drives every v22 bot-speech row through the real aft gh-shim with governance reachable over loopback, the recording upstream gh first on PATH and the worker broker variables removed (so the route can only reach the stand-in). Each routed request must carry exactly the declared fields (pr edit with title/body only and author_scope own, the review reply's number and comment id, the thread node id, the stack number and pull request numbers), and each refusal row (base on the pull request PATCH, pr edit --base and label flags, the review-thread lookalikes) must refuse before anything reaches the holder. An ignored variant runs the same rows against a payload draft and records each routed request for the ceremony. Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com> (cherry picked from commit 793ba88a4de0b77f565c474abe5c3cc19f69814f)
Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com> (cherry picked from commit 8a2741d756ce06ffcdf669b1ca8115650eb25b46)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Accepted agent delivery; branch-keyed search descriptor included.