Skip to content

Repository navigation

Apply exact dictionary sanctions in Go #888

New issue
New issue
Open
Feature
Open
Apply exact dictionary sanctions in Go#888
Feature
Labels
refinement:readyPassed the Definition of Ready; may be picked up

Description

@tbhb-agent
tbhb-agent
opened on Oct 27, 2026

Problem

Slice 03 of #327 completes sanctions and reviewer reporting at packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:362 and packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:353. An exact allowed dictionary addition must not become whole-file permission.

Acceptance criteria

  1. AC1: Recording an exact permitted dictionary line returns 0 and changes only its allowance evidence.
  2. AC2: An empty or tab-containing allowance returns the observed exit-2 refusal.
  3. AC3: A request to sanction a rule file returns the observed cannot-be-sanctioned diagnostic and status 2.
  4. AC4: A dictionary containing exactly the recorded addition verifies silently with status 0.
  5. AC5: An extra unrecorded line is reported with status 1.
  6. AC6: Removal of a baseline line is reported with status 1 despite an allowed addition.
  7. AC7: The reviewer diff includes the recorded sanctioned-lines suffix.
  8. AC8: A dictionary comparison that fails returns non-success.
  9. AC9: Non-functional: native sanction cases pass on macOS, Linux and Windows.

Scope and non-goals

The allow mode, exact dictionary exceptions and diff suffix under agentrepo prose check-suppressions. Non-goal: a real sanction, changed dictionaries, new approval machinery, widened permitted paths, rollout or shared-suite deletion. No new shell logic. Canonical sources generate the packages and deployments; generated copies are never edited by hand. No edits to shared libraries, guard scripts, merge scripts, ownership rules, workflow files or harness configuration.

Approach

Extend #886/#887. Record shell cases for vocabulary dictionaries, absent-at-baseline dictionaries, repeated lines and multiline rejection before implementation. Preserve read/compare failures; hand the covering Go test identity to #321 without deleting its shared case.

Observed: --allow with .cspell-words.txt charlie returned silent/0 and exactly that addition then verified silent/0. Extra sneaky and removed alpha each produced the corresponding configuration-change reason, TOTAL: 1 finding(s), status 1. Rule-file requests returned cannot be sanctioned/2; a tab line returned single-line-without-tab/2; empty text returned needs-state-path-exact-line/2. Diff returned 0 and printed sanctioned by the operator plus .cspell-words.txt: charlie. A selective dictionary-diff failure injected into the executed unchanged script returned silent status 2, rather than success; ordinary digest comparisons still ran.

Dependencies

Blocked on: #886
Blocked on: #887

#321 owns retirement/adaptation of tests/skills/source/lib/masked-status.bats:205. Supply its named executing Go coverage before #891 changes the source that case extracts.

The caller-switch issue lists #753 under its own Dependencies. #888 does not depend on #753.

Size

S. Existing shared suppression implementation: 263 scc code lines, shared with #886 and #887; this slice owns sanctions and the diff suffix only. Counts use scc 4.1.0; generated package/deployment output and token metadata are excluded, while source, tests, fixtures and frozen copies count. One PR with fewer than 800 changed code lines and at most 2,000 prose lines. No unbuilt Go size is claimed: measure the actual staged diff before publication and split again if the cap is exceeded.

Verify plan

  • AC1, AC2, AC3, AC4, AC5, AC6, AC7: go test ./internal/agentrepo -run '^TestProseSanction' -count=1 -v compares exact streams, status, allowances and diff suffix with shell fixtures.
  • AC8: the same command injects a dictionary-read/comparison failure and compares its non-success with an executed frozen-shell failure fixture; require the extracted helper to exist before using the existing shared-suite intent.
  • AC9: run that command natively on macOS, Linux and Windows; record shell comparisons separately.

At the merged head, record each AC command and result, native platform execution and any skips. Required checks must pass without weakening gates. Obtain independent review of the exact head and record findings dispositions; use signed commits with Assisted-by trailers and the provenance:agent-assisted label. Match documentation to behavior, scan issue/PR text before any later publication, and record the final merge commit and closing reference. This draft authorizes no publication.

Risks

Whole-file permission or masked failures could hide unauthorized changes. Undo: revert the unused Go completion; no actual dictionary is modified by this work.

Operator authority

A standing rule names the operator: packages/agents/source/skills/fix-prose/parts/after.md:12 reserves real dictionary additions to the operator. This port grants none and tests only disposable fixtures.

Activity

  1. tbhb-agent commented on Oct 27, 2026

    @tbhb-agent
    tbhb-agent
    on Oct 27, 2026
    ContributorAuthor

    Refinement: READY — Apply exact dictionary sanctions in Go
    Model: gpt-6-astra

    Child 03 Apply exact dictionary sanctions in Go

    Verdict: READY

    Checked: Exact additions, removal findings, invalid allowances and comparison failures remain consistent with packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:107, packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:128 and packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:362. Replacement coverage precedes the shared-suite handoff. The dictionary-error case independently recounts to seven code lines. The 550-code-line estimate and operator-authority boundary remain appropriate.

    Gaps: None.

    Split: None required.

    Definition of done

    The definition of done for this issue (Feature). Tick each item and give its evidence.

    • D1 The author verified each AC on the merged head, and the Verification section of the pull request cites each AC ID with its evidence: the command and its result, or a link.
    • D2 An independent reviewer approved the exact merged head, and the author resolved each finding or filed it as a follow-up.
    • D3 The required checks pass on that head, and any loosened gate has the owner's approval of that exact head.
    • D4 The leak scans come back clean: gitleaks, devtools' check-leaks.sh with the repository's private-strings list, and the leak review of each post.
    • D5 The author signed each commit, the squash included.
    • D6 The docs match the change (README, docs/, CHANGELOG or help text), or the Verification section says "No doc impact" and why.
    • D7 The commits and the squash have Assisted-by trailers, and the pull request has the provenance:agent-assisted label.
    • D8 The pull request stays within the size limits, or the owner approved its exact head over the hard limit.
    • D9 The author files follow-ups and deferred findings as issues with at least a Problem and numbered AC and lists them under the Related section of the pull request. Any work left in the code links its issue.
    • D10 The merge closes the issue through a closing reference and the board shows Done. The final Status: comment names the merge commit.
    • devtools-1 mise run check is green, and so are the coverage floors mise run cover-go-check and mise run cover-py-check, which check doesn't run.
    • devtools-2 A change to skill sources under packages/agents/source/ commits what mise run generate-skills, then mise run skill-tokens, then apm install rewrite, in that order, and check-generated-skills (part of lint) passes.
    • devtools-3 A consumer-visible change (the vendored payload, a skill, a reusable workflow, a task or a pin) has its consumer steps in docs/agent-skills-migration.md or the adoption docs, or the PR's Verification says "No consumer impact" and why.

    Round: 2 of 3

  2. github-project-automation
    added this to devtoolson Oct 27, 2026
  3. github-project-automation
    moved this to Backlog in devtoolson Oct 27, 2026
  4. tbhb-agent
    added the
    Feature
    issue type on Oct 27, 2026
  5. tbhb-agent
    added a parent issue on Oct 27, 2026
  6. tbhb-agent
    marked this as blocked by 3 issues on Oct 27, 2026
  7. tbhb-agent
    marked this as blocking 2 issues on Oct 27, 2026
  8. tbhb-agent
    added
    refinement:readyPassed the Definition of Ready; may be picked up
    on Oct 27, 2026

  9. tbhb-agent commented on Oct 31, 2026

    @tbhb-agent
    tbhb-agent
    on Oct 31, 2026
    ContributorAuthor

    Refinement: READY — Port exact dictionary sanctions in Go

    Checked

    Confirmed origin identifies tbhb-dev/devtools. The Go approach matches #588 and preserves the existing exact-line sanction and failure behavior in packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:107 and packages/agents/source/skills/fix-prose/shared/scripts/check-suppressions.sh:362. The Verify plan covers AC1–AC9 with checks suited to the stated outcomes, including native platform coverage. The scope fits one PR.

    Issues #886 and #887 are open and appear in the native blocked-by links. #321 and #891 are open; the draft describes their test handoff and sequencing without making them blockers for this work. Per the owner ruling, #753 gates the later caller switch; its stale native link is slated for removal through the relation-commands issue, so it does not block this draft.

    The named source and authority paths are not owner-tier paths under .agents/agent-skills.conf:4 or .agents/agent-skills.conf:9. The operator rule for real dictionary additions is consistent with packages/agents/source/skills/fix-prose/parts/after.md:10.

    Gaps

    None.

    Split

    None required.

    Definition of done

    Planning coverage only: checked items have evidence in the ACs and Verify plan; this does not mean the work is complete.

    • D1 Verify each AC at the merged head and cite its command and result or a link in the PR Verification. Evidence: the Verify plan calls for recording each AC command and result.
    • D2 Obtain independent review of the exact merged head and record findings dispositions. Evidence: the Verify plan requires exact-head review and dispositions.
    • D3 Pass required checks without weakening gates. Evidence: the Verify plan requires required checks to pass without weakening gates.
    • D4 Pass gitleaks, check-leaks.sh with the private-strings list, and the leak review of each post.
    • D5 Sign each commit, including the squash. Evidence: the Verify plan requires signed commits.
    • D6 Match documentation to behavior. Evidence: the Verify plan requires matching documentation to behavior.
    • D7 Add Assisted-by trailers to commits and the provenance:agent-assisted PR label. Evidence: both are specified in the Verify plan.
    • D8 Keep the PR within size limits or obtain owner approval for an over-limit exact head.
    • D9 File follow-ups as issues with a Problem section and numbered ACs, list them under Related, and link deferred code to its issue.
    • D10 Close the issue through a merge reference, set the board to Done, and name the merge commit in the final Status: comment.

    Round: 2 of 3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    refinement:readyPassed the Definition of Ready; may be picked up

    Type

    Feature

    Fields

    Priority

    None yet

    Work type

    None yet

    Projects

    • devtools
      Status
      Backlog

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions