The merge entry points refuse a missing or below-floor pinned agentrepo #1010

Activity

1. github-project-automation

   added this to devtoolson Oct 31, 2026
2. github-project-automation

   moved this to Backlog in devtoolson Oct 31, 2026
3. tbhb-agent

   added the

   Feature

   issue type on Oct 31, 2026
4. tbhb-agent

   marked this as blocking 3 issues on Oct 31, 2026

   • The lint, populate-description, squash-message and review scripts become wrappers over agentrepo merge #874
   • The squash-merge and merge scripts become wrappers over agentrepo merge #875
   • The preflight scripts become wrappers over agentrepo merge #876
5. tbhb-agent

   marked this as blocked by 2 issues on Oct 31, 2026

   • The binary resolver, permanent launcher and configuration bridges are resolved in Go #932
   • build(agents): protect replacement Go enforcement paths #753
6. tbhb-dev-reviews commented on Oct 31, 2026

   

   tbhb-dev-reviewsBot

   on Oct 31, 2026

   More actions

   Refinement: NOT READY — settle activation, fallback and compatibility before the refusal cutover

   Checked

   • Mechanical gate accepted as supplied; not rerun. Read The merge entry points refuse a missing or below-floor pinned agentrepo #1010, intended parent Epic Move the merge-pr, merge policy and agent-merge-pr scripts into agentrepo merge #324, the Replace complex shell with tested Go, starting with gates and merging #588 shell freeze, chore(backlog): file and link the prerequisites of the Go ports #980, #981 and #982 #986, The binary resolver, permanent launcher and configuration bridges are resolved in Go #932 and its cross-link, build(agents): protect replacement Go enforcement paths #753, and the relevant sibling contracts, including The merge policy reads the APM lockfile and base-owned deployments in Go #859, Cleanup after a verified merge runs in Go #872, The lint, populate-description, squash-message and review scripts become wrappers over agentrepo merge #874, The squash-merge and merge scripts become wrappers over agentrepo merge #875, The preflight scripts become wrappers over agentrepo merge #876 and Run the skill-directory integrity gate in the merge entry points #982. The merge entry points refuse a missing or below-floor pinned agentrepo #1010 has no native parent relationship to Move the merge-pr, merge policy and agent-merge-pr scripts into agentrepo merge #324.
   • Reviewed origin/main at 1263c1fde522f7f7bc4658214df1db73624a8652, matching the remote main head. packages/agents/source/lib/lib.sh:146 resolves through mise and packages/agents/source/lib/lib.sh:149 falls back to PATH. However, a resolved below-floor pin already refuses at packages/agents/source/lib/lib.sh:172, with status 1 through packages/agents/source/lib/lib.sh:45. Correct the Problem's claim that an old resolved pin falls through to a current PATH binary.
   • No PR delivers the complete requested contract. Merged fix(agents): honor the pinned agentrepo version #704 already covers pin preference and below-floor rejection; merged feat(tools): pin agentrepo in the repository mise.toml #999 adds this repository's pin, without enforcing a repository pin in consumers. Open fix(merge): pin gate policy and require machine authority #600 has a supersession comment naming Read gate settings from the pinned base in Go #980/Verify merge skill directories against base lock hashes in Go #981/Run the skill-directory integrity gate in the merge entry points #982 and keeps merge gates take authority and gate settings from the environment and the working tree #499 open for The merge entry points refuse a missing or below-floor pinned agentrepo #1010. The binary resolver, permanent launcher and configuration bridges are resolved in Go #932 owns the resolver, comparer and permanent launcher; retain that ownership. The distinct work here is merge-entry adoption of the refusal contract, including missing-pin refusal and uniform status 2.
   • GraphQL confirms native blockers The binary resolver, permanent launcher and configuration bridges are resolved in Go #932 and build(agents): protect replacement Go enforcement paths #753 on The merge entry points refuse a missing or below-floor pinned agentrepo #1010, and The merge entry points refuse a missing or below-floor pinned agentrepo #1010 as a native blocker of each of The lint, populate-description, squash-message and review scripts become wrappers over agentrepo merge #874, The squash-merge and merge scripts become wrappers over agentrepo merge #875 and The preflight scripts become wrappers over agentrepo merge #876. These edges match the stated ordering. AC1–AC5 all appear in Verify. S, under 300 code lines including tests, is plausible once the activation boundary is settled. Risks and revert are present. No tests or suites were run.

   Gaps

   1. Define the independently deliverable activation boundary. The binary resolver, permanent launcher and configuration bridges are resolved in Go #932 leaves unported entries unchanged; The merge entry points refuse a missing or below-floor pinned agentrepo #1010 must precede The lint, populate-description, squash-message and review scripts become wrappers over agentrepo merge #874–The preflight scripts become wrappers over agentrepo merge #876, which port those entries. Say what a successful merge entry does after The merge entry points refuse a missing or below-floor pinned agentrepo #1010 but before those ports, without adding shell decision logic, a second launcher or a second resolver. Add an observable AC and verification for an eligible pin whose requested merge command is unavailable: the existing frozen workflow remains usable. AC3 currently promises unconditional dispatch to the binary. Main already has a merge group containing only approval (internal/agentrepo/merge_approval.go:16 and internal/agentrepo/merge_approval.go:53), so group presence alone does not establish that a transaction command exists. Preserve The binary resolver, permanent launcher and configuration bridges are resolved in Go #932's boundary for other unported workflows and verify their behavior is unchanged.
   2. Close the fallback question in the bodies. The intended precedence is sound: missing/below-floor pin refuses first; only an eligible pin lacking the required command may reach the frozen fallback. The lint, populate-description, squash-message and review scripts become wrappers over agentrepo merge #874, The squash-merge and merge scripts become wrappers over agentrepo merge #875 and The preflight scripts become wrappers over agentrepo merge #876 already say refusal precedes fallback in Dependencies, but their AC2 preconditions still say only that the installed binary lacks merge. Narrow AC2 and its Verify case in all three, and reconcile The merge entry points refuse a missing or below-floor pinned agentrepo #1010 AC3 with that case. Keep all new policy in tested Go and retain only forwarding shell changes, as Replace complex shell with tested Go, starting with gates and merging #588 requires.
   3. Make missing-pin refusal distinguish repository configuration from tool availability. mise which can return a machine-wide pin, as feat(tools): pin agentrepo in the repository mise.toml #999 documents. AC1's test must include an absent repository pin with a current machine-wide mise pin as well as a current PATH binary. Also cover a declared repository pin whose executable is unavailable while PATH has a usable binary. State the result for that case, assert neither fallback binary runs, and assert refusal occurs before configuration, gates or merge work. An exit-code check alone does not prove those boundaries.
   4. Resolve compatibility and authority. docs/agent-skills-migration.md:9 explicitly supports PATH and no-binary shell fallback. Immediate refusal changes that contract. A Compatibility: deprecates declaration alone does not satisfy the two-release warning period in docs/compatibility.md:3 and docs/compatibility.md:5. Specify the warning/enforcement releases and preserved behavior during the window, or identify the security transition permitted by docs/compatibility.md:7 and the required authority. Replace Operator authority's None with Owner-only GitHub action: naming the exact-head approval for the protected lib.sh change; that approval is already required by AC5 and .agents/agent-skills.conf:9.
   5. Tighten ACs and delivery verification. AC4 requires identical version decisions but does not state which inputs accept or refuse; tie its observable expectations to The binary resolver, permanent launcher and configuration bridges are resolved in Go #932's complete version contract rather than creating another comparer suite with unspecified answers. Move implementation ownership from AC4 and the mixed architecture, documentation and review obligations in AC5 into Scope/Approach/DoD, leaving separate observable outcomes and explicitly prefixed non-functional criteria. Add the canonical generation, token and deployment sequence and verify both harness outputs. Complete the D2 finding-disposition and D9 deferred-code-link obligations below.

   Split

   No additional implementation issue is needed yet. Keep #932's resolver/comparer/launcher separate, keep this issue limited to merge refusal and its compatibility contract, and leave transaction wiring and frozen-fallback adoption with #874–#876. Reassess Size if resolving the pre-port activation requires moving transaction behavior here.

   Definition of done

   Ticks indicate coverage in the current ACs and Verify plan, not completed implementation.

   • D1 The author verified each AC on the merged head, and the Verification section of the pull request cites each AC ID with its evidence: the command and its result, or a link.
   • D2 An independent reviewer approved the exact merged head, and the author resolved each finding or filed it as a follow-up. The current plan names review but omits finding disposition.
   • D3 The required checks pass on that head, and any loosened gate has the owner's approval of that exact head.
   • D4 The leak scans come back clean: gitleaks, devtools' check-leaks.sh with the repository's private-strings list, and the leak review of each post.
   • D5 The author signed each commit, the squash included.
   • D6 The docs match the change (README, docs/, CHANGELOG or help text), or the Verification section says "No doc impact" and why.
   • D7 The commits and the squash have Assisted-by trailers, and the pull request has the provenance:agent-assisted label.
   • D8 The pull request stays within the size limits, or the owner approved its exact head over the hard limit.
   • D9 The author files follow-ups and deferred findings as issues with at least a Problem and numbered AC and lists them under the Related section of the pull request. Any work left in the code links its issue. The current plan omits that code-link requirement.
   • D10 The merge closes the issue through a closing reference and the board shows Done. The final Status: comment names the merge commit.
   • devtools-1 mise run check is green, and so are the coverage floors mise run cover-go-check and mise run cover-py-check, which check doesn't run.
   • devtools-2 A change to skill sources under packages/agents/source/ commits what mise run generate-skills, then mise run skill-tokens, then apm install rewrite, in that order, and check-generated-skills (part of lint) passes.
   • devtools-3 A consumer-visible change has its consumer steps in docs/agent-skills-migration.md or the adoption docs, or the PR's Verification says "No consumer impact" and why. AC5 requires a migration note but does not yet specify the consumer adoption steps and compatibility timeline.

   Round: 1 of 3
7. tbhb-agent

   added

   refinement:activeA refinement round is open; not ready for implementationA refinement round is open; not ready for implementation

   on Oct 31, 2026
8. tbhb-agent

   marked this as blocking on Oct 31, 2026

   • Refuse a missing or below-floor pinned agentrepo after the warning window #1012
9. tbhb-dev-reviews commented on Oct 31, 2026

   

   tbhb-dev-reviewsBot

   on Oct 31, 2026

   More actions

   Refinement: NOT READY — warning scope is clearer, but handoffs and the capability contract still conflict

   Checked

   • Accepted the supplied mechanical PASS; did not rerun the gate. Read the amended body at 11:33:21Z and the one earlier Refinement comment. This is round 2, retaining that round 1 across the amendment as the review brief specifies.
   • Verified origin/main at bfa8937 against GitHub's current main head. The cited resolution and refusal lines are accurate: packages/agents/source/lib/lib.sh:146, packages/agents/source/lib/lib.sh:149, packages/agents/source/lib/lib.sh:172, and status 1 through packages/agents/source/lib/lib.sh:45. The corrected Problem closes the earlier below-floor-fallback claim.
   • Read intended parent Epic Move the merge-pr, merge policy and agent-merge-pr scripts into agentrepo merge #324, shell-freeze Epic Replace complex shell with tested Go, starting with gates and merging #588, prerequisite bodies The binary resolver, permanent launcher and configuration bridges are resolved in Go #932 and build(agents): protect replacement Go enforcement paths #753, sibling contracts The lint, populate-description, squash-message and review scripts become wrappers over agentrepo merge #874–The preflight scripts become wrappers over agentrepo merge #876, Verify merge skill directories against base lock hashes in Go #981 and Run the skill-directory integrity gate in the merge entry points #982, handoff chore chore(backlog): file and link the prerequisites of the Go ports #980, #981 and #982 #986, and enforcement issue Refuse a missing or below-floor pinned agentrepo after the warning window #1012. Read gate settings from the pinned base in Go #980 currently has an empty body, so its current contract cannot be validated. The merge entry points refuse a missing or below-floor pinned agentrepo #1010 has no native parent. GraphQL confirms its native blockers are The binary resolver, permanent launcher and configuration bridges are resolved in Go #932 and build(agents): protect replacement Go enforcement paths #753; Refuse a missing or below-floor pinned agentrepo after the warning window #1012 is natively blocked by The merge entry points refuse a missing or below-floor pinned agentrepo #1010.
   • Reviewed merged PRs fix(agents): honor the pinned agentrepo version #704 and feat(tools): pin agentrepo in the repository mise.toml #999 and the open-PR inventory. fix(agents): honor the pinned agentrepo version #704 delivered pin preference and below-floor refusal; feat(tools): pin agentrepo in the repository mise.toml #999 added this repository's pin. Neither delivers the proposed consumer warning. Open fix(merge): pin gate policy and require machine authority #600 records supersession by Read gate settings from the pinned base in Go #980–Run the skill-directory integrity gate in the merge entry points #982 and retains merge gates take authority and gate settings from the environment and the working tree #499 for follow-up work. No matching open or merged PR delivers this issue's complete scope.
   • Earlier gap 1 is partially closed: AC3 now states the successful pre-port frozen-workflow outcome and preserves other unported workflows. Main registers only merge approval (internal/agentrepo/merge_approval.go:16 and internal/agentrepo/merge_approval.go:53), so a group-only probe is insufficient. The prerequisite capability contract remains unresolved below.
   • Earlier gap 2 remains open in the live sibling bodies and native graph. Earlier gap 3 now covers both missing-pin cases, including a machine-wide mise pin, but verification still omits configuration-order evidence.
   • Earlier gap 4 is closed for the intended scope: warning release N, enforcement N+2 through Refuse a missing or below-floor pinned agentrepo after the warning window #1012, preserved PATH behavior during the window, migration steps and exact-head owner approval are specified. These follow docs/compatibility.md:5, docs/compatibility.md:20 and the documented fallback at docs/agent-skills-migration.md:9. The library is already protected by .agents/agent-skills.conf:9.
   • Earlier gap 5 is mostly closed: explicit version outcomes, a prefixed non-functional shell-freeze constraint, generation/token/deployment order, consumer steps, D2 finding disposition and D9 deferred-code links are present. AC1–AC5 all appear in Verify. Risks and revert are present. S, under 300 code lines including tests, remains plausible with one shared resolver, comparer and launcher. No additional guard or abstraction is justified. No tests or suites were run.

   Gaps

   1. Reconcile the live warning/enforcement handoff. The merge entry points refuse a missing or below-floor pinned agentrepo #1010 now ends at warning, but The lint, populate-description, squash-message and review scripts become wrappers over agentrepo merge #874, The squash-merge and merge scripts become wrappers over agentrepo merge #875 and The preflight scripts become wrappers over agentrepo merge #876 still name The merge entry points refuse a missing or below-floor pinned agentrepo #1010 as the prerequisite that refuses a missing pin, and all three remain natively blocked by The merge entry points refuse a missing or below-floor pinned agentrepo #1010 rather than Refuse a missing or below-floor pinned agentrepo after the warning window #1012. Their AC2 and Verify still use the broad condition that the binary lacks merge, rather than an eligible repository pin lacking the requested command. Refuse a missing or below-floor pinned agentrepo after the warning window #1012 currently blocks none of them. The shared ownership row in Verify merge skill directories against base lock hashes in Go #981 and Run the skill-directory integrity gate in the merge entry points #982 and the cross-link comment on The binary resolver, permanent launcher and configuration bridges are resolved in Go #932 also still assign missing-pin refusal to The merge entry points refuse a missing or below-floor pinned agentrepo #1010. The promised edit once Refuse a missing or below-floor pinned agentrepo after the warning window #1012 is Ready records this inconsistency rather than resolving the previous finding. Align affected bodies, ownership references and native edges with The merge entry points refuse a missing or below-floor pinned agentrepo #1010 warning / Refuse a missing or below-floor pinned agentrepo after the warning window #1012 enforcement, including eligible-pin AC2 and Verify cases. Warning-only completion must not release work that still claims refusal is already delivered.

   2. Establish the shared capability contract AC3 needs. The merge entry points refuse a missing or below-floor pinned agentrepo #1010 excludes capability-probe work and says command availability comes from The binary resolver, permanent launcher and configuration bridges are resolved in Go #932, with no new probe. However, The binary resolver, permanent launcher and configuration bridges are resolved in Go #932 AC5 promises only config and review verdict capability detection; it does not promise detection of individual merge commands. Its launcher AC1 and non-goals describe locating the binary and executing the supplied command, and its transition excludes unported merge entries. Naming the desired frozen outcome closes the behavioral ambiguity, but does not establish the claimed reusable prerequisite. Identify the shared Go capability/launch contract that can select the unchanged frozen workflow for an eligible binary containing only merge approval, or amend the prerequisite and ownership boundary to supply it. Keep the decision in tested Go, reuse one resolver/comparer/launcher, and add no shell branching or second capability probe. The shell entry still sources the loader directly at packages/agents/source/skills/merge-pr/shared/scripts/preflight.sh:30; verify this warning adoption can ship independently before the transaction ports.

   3. Make Verify prove ordering and version parity. AC1's gate and GitHub CLI logs cannot establish that configuration reads also wait for the warning; add a configuration-read trace and assert the warning precedes it. Assert the intended single workflow dispatch explicitly, distinguishing it from version/capability probes. AC4 says the test reads expected decisions from The binary resolver, permanent launcher and configuration bridges are resolved in Go #932's comparer; reading expectations and searching for duplicate code does not compare actual startup decisions or prove platform parity. Exercise merge startup against the stated version fixtures using The binary resolver, permanent launcher and configuration bridges are resolved in Go #932's existing comparer/fixtures and cite the Linux/macOS/Windows checks. Reuse that coverage without adding another comparer or a speculative test framework.

   Split

   The warning/enforcement split into #1010 and #1012 is appropriate. No additional implementation issue is needed. Keep resolver/comparer/launcher ownership with #932 and transaction wiring with #874–#876; reconcile the capability boundary and live handoffs within that split.

   Definition of done

   Ticks indicate coverage in the ACs and Verify plan, not completed implementation. D1's evidence obligation is present; the specific proof gaps above still need correction.

   • D1 The author verified each AC on the merged head, and the Verification section of the pull request cites each AC ID with its evidence: the command and its result, or a link.
   • D2 An independent reviewer approved the exact merged head, and the author resolved each finding or filed it as a follow-up.
   • D3 The required checks pass on that head, and any loosened gate has the owner's approval of that exact head.
   • D4 The leak scans come back clean: gitleaks, devtools' check-leaks.sh with the repository's private-strings list, and the leak review of each post.
   • D5 The author signed each commit, the squash included.
   • D6 The docs match the change (README, docs/, CHANGELOG or help text), or the Verification section says "No doc impact" and why.
   • D7 The commits and the squash have Assisted-by trailers, and the pull request has the provenance:agent-assisted label.
   • D8 The pull request stays within the size limits, or the owner approved its exact head over the hard limit.
   • D9 The author files follow-ups and deferred findings as issues with at least a Problem and numbered AC and lists them under the Related section of the pull request. Any work left in the code links its issue.
   • D10 The merge closes the issue through a closing reference and the board shows Done. The final Status: comment names the merge commit.
   • devtools-1 mise run check is green, and so are the coverage floors mise run cover-go-check and mise run cover-py-check, which check doesn't run.
   • devtools-2 A change to skill sources under packages/agents/source/ commits what mise run generate-skills, then mise run skill-tokens, then apm install rewrite, in that order, and check-generated-skills (part of lint) passes.
   • devtools-3 A consumer-visible change (the vendored payload, a skill, a reusable workflow, a task or a pin) has its consumer steps in docs/agent-skills-migration.md or the adoption docs, or the pull request's Verification says "No consumer impact" and why.

   Round: 2 of 3