Skip to content

Repository navigation

Detect stray edits and suppression comments in Go #887

New issue
New issue
Open
Feature
Open
Detect stray edits and suppression comments in Go#887
Feature
Labels
refinement:readyPassed the Definition of Ready; may be picked up

Description

@tbhb-agent
tbhb-agent
opened on Oct 27, 2026

Problem

Slice 02 of #327 ports verification against the existing baseline at packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:271. A passing prose linter does not prove the writer stayed within its target.

Acceptance criteria

  1. AC1: Target-only edits with unchanged watched files produce no findings and status 0.
  2. AC2: Deleting an unrelated tracked file produces its stray-edit finding and status 1.
  3. AC3: An unsanctioned dictionary addition produces its configuration-change finding and status 1.
  4. AC4: A newly added suppression in the target produces a line-numbered suppression finding and status 1.
  5. AC5: Each violation report ends with its observed finding total.
  6. AC6: A target mismatch or invalid state returns the existing exit-2 refusal.
  7. AC7: Non-functional: verification changes neither target nor retained workflow evidence.
  8. AC8: Non-functional: native verification cases pass on macOS, Linux and Windows.

Scope and non-goals

Port verification into agentrepo prose check-suppressions. Non-goal: sanction exceptions (#888), new watched classes, hook enforcement, caller switches, frozen-file edits or Bats deletion. No new shell logic. Canonical sources generate the packages and deployments; generated copies are never edited by hand. No edits to shared libraries, guard scripts, merge scripts, ownership rules, workflow files or harness configuration.

Approach

Consume #886's evidence. Record shell fixtures for every watched class, ignored style content, added/modified/deleted paths, all supported suppression forms, moved directives and combined violations before porting those branches. Preserve the oracle's ordering and line sensitivity rather than replacing it with a new policy.

Observed: target-only verify was silent/0. Removing OTHER.md produced OTHER.md:1 [error] stray-edit and TOTAL: 1 finding(s), status 1. Adding charlie to the dictionary without allowance produced linter-config-changed/TOTAL: 1 finding(s), status 1. Appending a Vale suppression at line 2 produced DRAFT.md:2 [error] suppression-comment and the same total/status. Invalid state and wrong target each returned 2.

Dependencies

Blocked on: #886

#888 must complete before #891 can deploy verification with dictionary exceptions. #753 gates rollout, not this additive command. #321's context contract remains shared work; do not edit its library.

Size

M. Existing shared suppression implementation: 263 scc code lines, shared with #886 and #888; this slice owns verification only. Counts use scc 4.1.0; generated package/deployment output and token metadata are excluded, while source, tests, fixtures and frozen copies count. One PR with fewer than 800 changed code lines and at most 2,000 prose lines. No unbuilt Go size is claimed: measure the actual staged diff before publication and split again if the cap is exceeded.

Verify plan

  • AC1, AC2, AC3, AC4, AC5, AC6: go test ./internal/agentrepo -run '^TestProseVerify' -count=1 -v records and compares exact status, stdout, stderr and ordered findings against unchanged shell fixtures.
  • AC7: the same command snapshots target, index and workflow artifacts before/after verification and fails on report-owned changes.
  • AC8: execute the same command natively on macOS, Linux and Windows; record Unix oracle executions separately.

At the merged head, record each AC command and result, native platform execution and any skips. Required checks must pass without weakening gates. Obtain independent review of the exact head and record findings dispositions; use signed commits with Assisted-by trailers and the provenance:agent-assisted label. Match documentation to behavior.

  • Run required repository leak scans and review each issue/PR post for leaks before publication.
  • File follow-ups and deferred findings as issues with a Problem and numbered acceptance criteria; list them under Related.
  • Record the closing reference, set the board status to Done, and leave a final Status: comment naming the merge commit.

This draft authorizes no publication.

Risks

An exclusion or comparison change could hide edits. Do not deploy the incomplete sanction path. Undo: revert this additive slice; shell remains the active verifier.

Operator authority

None

Activity

  1. tbhb-agent commented on Oct 27, 2026

    @tbhb-agent
    tbhb-agent
    on Oct 27, 2026
    ContributorAuthor

    Refinement: READY — Detect stray edits and suppression comments in Go
    Model: gpt-6-astra

    Child 02 Detect stray edits and suppression comments in Go

    Verdict: READY

    Checked: Watched-file comparisons, deletion detection, ignored styles, diagnostic ordering and line-sensitive suppression matching remain consistent with packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:200 and packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:323. Sanctions remain assigned to 03 and required before rollout. Verification, authority, undo and the 650-code-line estimate remain adequate.

    Gaps: None.

    Split: None required.

    Definition of done

    The definition of done for this issue (Feature). Tick each item and give its evidence.

    • D1 The author verified each AC on the merged head, and the Verification section of the pull request cites each AC ID with its evidence: the command and its result, or a link.
    • D2 An independent reviewer approved the exact merged head, and the author resolved each finding or filed it as a follow-up.
    • D3 The required checks pass on that head, and any loosened gate has the owner's approval of that exact head.
    • D4 The leak scans come back clean: gitleaks, devtools' check-leaks.sh with the repository's private-strings list, and the leak review of each post.
    • D5 The author signed each commit, the squash included.
    • D6 The docs match the change (README, docs/, CHANGELOG or help text), or the Verification section says "No doc impact" and why.
    • D7 The commits and the squash have Assisted-by trailers, and the pull request has the provenance:agent-assisted label.
    • D8 The pull request stays within the size limits, or the owner approved its exact head over the hard limit.
    • D9 The author files follow-ups and deferred findings as issues with at least a Problem and numbered AC and lists them under the Related section of the pull request. Any work left in the code links its issue.
    • D10 The merge closes the issue through a closing reference and the board shows Done. The final Status: comment names the merge commit.
    • devtools-1 mise run check is green, and so are the coverage floors mise run cover-go-check and mise run cover-py-check, which check doesn't run.
    • devtools-2 A change to skill sources under packages/agents/source/ commits what mise run generate-skills, then mise run skill-tokens, then apm install rewrite, in that order, and check-generated-skills (part of lint) passes.
    • devtools-3 A consumer-visible change (the vendored payload, a skill, a reusable workflow, a task or a pin) has its consumer steps in docs/agent-skills-migration.md or the adoption docs, or the PR's Verification says "No consumer impact" and why.

    Round: 2 of 3

  2. github-project-automation
    added this to devtoolson Oct 27, 2026
  3. github-project-automation
    moved this to Backlog in devtoolson Oct 27, 2026
  4. tbhb-agent
    added the
    Feature
    issue type on Oct 27, 2026
  5. tbhb-agent
    added a parent issue on Oct 27, 2026
  6. tbhb-agent
    marked this as blocked by 2 issues on Oct 27, 2026
  7. tbhb-agent
    marked this as blocking 3 issues on Oct 27, 2026
  8. tbhb-agent
    added
    refinement:readyPassed the Definition of Ready; may be picked up
    on Oct 27, 2026

  9. tbhb-agent commented on Oct 31, 2026

    @tbhb-agent
    tbhb-agent
    on Oct 31, 2026
    ContributorAuthor

    Refinement: READY — Port prose verification into Go

    Checked

    Gaps

    None.

    Split

    None required.

    Definition of done

    Planning coverage only: checked boxes mean the ACs and Verify plan cover the item; they do not mean the work is complete.

    • D1 Verify each AC at the merged head and cite its command and result in the PR Verification. Evidence: the plan maps AC1–AC8 to checks and requires recording each AC command and result.
    • D2 Obtain independent review of the exact merged head, with findings resolved or filed as follow-ups. Evidence: the plan requires exact-head review and findings dispositions.
    • D3 Pass required checks without loosening gates. Evidence: the plan requires required checks to pass without weakening gates.
    • D4 Pass gitleaks, check-leaks.sh with the repository’s private-strings list, and the per-post leak review. Evidence: the plan requires repository leak scans and leak review of each issue/PR post before publication.
    • D5 Sign every commit, including the squash. Evidence: the plan requires signed commits.
    • D6 Match documentation to the change or explain why there is no impact. Evidence: the plan requires documentation to match behavior.
    • D7 Include Assisted-by trailers and the provenance:agent-assisted label. Evidence: the plan names both.
    • D8 Keep the PR within the size limits or obtain owner approval for an exact head over the limit. Evidence: the Size section sets limits and requires measuring the staged diff and splitting if needed.
    • D9 File follow-ups and deferred findings as issues and list them under Related. Evidence: the plan requires filing them as issues with a Problem and numbered ACs, and listing them under Related.
    • D10 Close the issue through a merge reference, mark the board Done, and name the merge commit in the final Status: comment. Evidence: the plan requires all three records.

    Round: 3 of 3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    refinement:readyPassed the Definition of Ready; may be picked up

    Type

    Feature

    Fields

    Priority

    None yet

    Work type

    None yet

    Projects

    • devtools
      Status
      Backlog

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions