Merge pull request 'feat: block approval on full-suite failure without baseline proof (Closes #323)' (#361) from feat/issue-323-full-suite-approval-gate into master

2026-07-07 08:09:13 -05:00
parent 5e023dcc97 a0d68ef66e
commit c20a93602d
2 changed files with 273 additions and 0 deletions
@@ -3652,6 +3652,113 @@ def assess_reviewer_baseline_validation_proof(
    }


+# ---------------------------------------------------------------------------
+# Full-suite failure approval gate (#323)
+# ---------------------------------------------------------------------------
+
+
+def assess_full_suite_failure_approval_gate(
+    *,
+    review_decision: str,
+    full_suite_passed: bool | None,
+    baseline_validation: dict | None = None,
+    baseline_proof: dict | None = None,
+    report_text: str | None = None,
+    project_root: str | None = None,
+) -> dict:
+    """#323: approving a PR whose full suite fails requires baseline proof.
+
+    Default action on a full-suite failure is REQUEST_CHANGES. Approval is
+    allowed only when the #325 baseline proof passes in full (branches/
+    worktree, pinned SHAs, matching failure signatures) and the extra #323
+    fields prove the failures are pre-existing: ``pr_suite_command``,
+    ``baseline_suite_command``, ``new_tests_passed``, and a non-empty
+    ``unrelated_explanation``.
+
+    *review_decision* is the decision the workflow intends to submit; only
+    ``approve`` can be blocked. ``block`` is True when an approval was
+    requested that the proofs do not allow.
+    """
+    decision = (review_decision or "").strip().lower().replace("-", "_")
+    wants_approval = decision == "approve"
+    reasons: list[str] = []
+
+    if full_suite_passed is True:
+        return {
+            "approve_allowed": True,
+            "block": False,
+            "default_action": "proceed",
+            "reasons": [],
+        }
+
+    default_action = "request_changes"
+
+    if full_suite_passed is None:
+        reasons.append(
+            "full-suite result not proven; approval requires a recorded "
+            "full-suite command and result (#323)"
+        )
+    else:
+        if baseline_validation is None:
+            baseline_validation = assess_reviewer_baseline_validation_proof(
+                baseline_proof=baseline_proof,
+                report_text=report_text,
+                project_root=project_root,
+            )
+        proof = baseline_proof or {}
+
+        if not proof:
+            reasons.append(
+                "full suite failed but no baseline proof was provided; "
+                "default action is REQUEST_CHANGES (#323)"
+            )
+        if not baseline_validation.get("proven"):
+            reasons.append(
+                "baseline validation proof missing or failed (#323/#325)"
+            )
+            reasons.extend(baseline_validation.get("reasons", []))
+
+        if proof:
+            worktree = (proof.get("worktree_path") or "").strip()
+            if not _path_under_branches(worktree, project_root):
+                reasons.append(
+                    "baseline comparison must run in a clean baseline "
+                    "worktree under branches/, not the main checkout (#323)"
+                )
+            if not (proof.get("pr_suite_command") or "").strip():
+                reasons.append(
+                    "PR full-suite command/result missing from baseline "
+                    "proof (#323)"
+                )
+            if not (proof.get("baseline_suite_command") or "").strip():
+                reasons.append(
+                    "baseline full-suite command/result missing from "
+                    "baseline proof (#323)"
+                )
+            if proof.get("new_tests_passed") is not True:
+                reasons.append(
+                    "proof that new/changed tests passed is missing (#323)"
+                )
+            if not (proof.get("unrelated_explanation") or "").strip():
+                reasons.append(
+                    "explanation why failures are unrelated to the PR is "
+                    "missing (#323)"
+                )
+            if proof.get("failure_signatures_match") is not True:
+                reasons.append(
+                    "PR and baseline failure signatures do not match; "
+                    "request changes (#323)"
+                )
+
+    approve_allowed = not reasons
+    return {
+        "approve_allowed": approve_allowed,
+        "block": wants_approval and not approve_allowed,
+        "default_action": "proceed" if approve_allowed else default_action,
+        "reasons": reasons,
+    }
+
+
 # ---------------------------------------------------------------------------
 # Identity disclosure (#305)
 # ---------------------------------------------------------------------------