Add role-boundary proofs for reviewer queue workflows (Issue #175) #192

2026-07-05T14:42:58-05:00

jcwalker3 commented

2026-07-05 14:42:58 -05:00

Closes #175

Summary

Added assess_role_boundary() to make reviewer/author role separation explicit and fail closed for silent reviewer-queue to author-implementation pivots.
Wired role-boundary status into build_final_report() so missing or warning-level proof downgrades and violations block the report/merge allowance.
Added #175 harness tests for unapproved author mutations after reviewer queue work, mixed namespace use without justification, author tasks performing reviewer-only mutations, and scratch-only evidence claims.
Updated the LLM workflow docs and review template to require role-boundary proof and explicit reporting of mixed namespace use.

Tests run

python3 -m py_compile review_proofs.py tests/test_review_proofs.py: passed, exit 0
python3 -m py_compile $(git ls-files '*.py'): passed, exit 0
/Users/jasonwalker/Development/Gitea-Tools/venv/bin/python -m pytest tests/test_review_proofs.py -q --tb=short: 49 passed in 0.03s
/Users/jasonwalker/Development/Gitea-Tools/venv/bin/python -m pytest tests/test_review_proofs.py tests/test_pr_queue_inventory.py -q --tb=short: 65 passed in 0.29s
/Users/jasonwalker/Development/Gitea-Tools/venv/bin/python -m pytest tests/ --ignore=branches -q: 689 passed, 6 skipped in 7.13s
git diff --check prgs/master...HEAD: passed, exit 0

Secret/provenance sweep

Method: git diff prgs/master...HEAD | grep -iE 'token|secret|password|key|credential|http|Authorization:|Bearer |BEGIN (RSA|OPENSSH|PRIVATE) KEY' || true
Result: no matches; no credentials or production endpoints found in the changed diff.

Confirmation

No PR review, approval, request-changes review, merge, or manual issue closure was performed under this author profile.

Closes #175 ## Summary - Added `assess_role_boundary()` to make reviewer/author role separation explicit and fail closed for silent reviewer-queue to author-implementation pivots. - Wired role-boundary status into `build_final_report()` so missing or warning-level proof downgrades and violations block the report/merge allowance. - Added #175 harness tests for unapproved author mutations after reviewer queue work, mixed namespace use without justification, author tasks performing reviewer-only mutations, and scratch-only evidence claims. - Updated the LLM workflow docs and review template to require role-boundary proof and explicit reporting of mixed namespace use. ## Tests run - `python3 -m py_compile review_proofs.py tests/test_review_proofs.py`: passed, exit 0 - `python3 -m py_compile $(git ls-files '*.py')`: passed, exit 0 - `/Users/jasonwalker/Development/Gitea-Tools/venv/bin/python -m pytest tests/test_review_proofs.py -q --tb=short`: `49 passed in 0.03s` - `/Users/jasonwalker/Development/Gitea-Tools/venv/bin/python -m pytest tests/test_review_proofs.py tests/test_pr_queue_inventory.py -q --tb=short`: `65 passed in 0.29s` - `/Users/jasonwalker/Development/Gitea-Tools/venv/bin/python -m pytest tests/ --ignore=branches -q`: `689 passed, 6 skipped in 7.13s` - `git diff --check prgs/master...HEAD`: passed, exit 0 ## Secret/provenance sweep - Method: `git diff prgs/master...HEAD | grep -iE 'token|secret|password|key|credential|http|Authorization:|Bearer |BEGIN (RSA|OPENSSH|PRIVATE) KEY' || true` - Result: no matches; no credentials or production endpoints found in the changed diff. ## Confirmation No PR review, approval, request-changes review, merge, or manual issue closure was performed under this author profile.

jcwalker3 added 1 commit 2026-07-05 14:42:58 -05:00

Add role-boundary proofs for reviewer queue workflows 574a9ea7c1

jcwalker3 referenced this pull request

2026-07-05 14:48:59 -05:00

Harden issue-filing final reports: Controller Handoff, full SHAs, and exact mutation capability proof #191

jcwalker3 referenced this pull request

2026-07-05 14:53:16 -05:00

Tighten A-level reviewer proof requirements after #173 merge #179

jcwalker3 referenced this pull request

2026-07-05 14:55:07 -05:00

Investigate false-empty PR queue reports when Gitea-Tools has open PRs #194

sysadmin referenced this pull request

2026-07-05 14:57:52 -05:00

Investigate false-empty PR queue reports when Gitea-Tools has open PRs #194

jcwalker3 referenced this pull request

2026-07-05 15:13:27 -05:00

Add hard queue-target resolution wall before PR inventory or empty-queue claims #200

jcwalker3 referenced this pull request

2026-07-05 15:13:37 -05:00

Add hard queue-target resolution wall before PR inventory or empty-queue claims #201

jcwalker3 referenced this pull request

2026-07-05 15:13:46 -05:00

Add hard queue-target resolution wall before PR inventory or empty-queue claims #202

sysadmin reviewed 2026-07-05 15:24:43 -05:00

sysadmin left a comment

Blind review (sysadmin / prgs-reviewer)

Pinned head: 574a9ea7c109d04de170b7004d2b8f2b9e2f30cf
Live head recheck: matches pinned; PR open and mergeable.

Scope (#175)

Adds assess_role_boundary() and wires it into build_final_report() to fail closed on silent reviewer→author pivots, unapproved author mutations after blind queue review, mixed namespace use without justification, and scratch-only evidence claims. Four files; docs/tests aligned. No weakening of existing review/merge gates — additive stricter checks only.

Validation (reviewer rerun)

py_compile review_proofs.py tests/test_review_proofs.py — passed
pytest tests/test_review_proofs.py — 49 passed
pytest tests/test_review_proofs.py tests/test_pr_queue_inventory.py — 65 passed
pytest tests/ --ignore=branches — 695 passed, 6 skipped
git diff --check prgs/master...HEAD — clean
Secret sweep — no credential matches

Approved.

## Blind review (sysadmin / prgs-reviewer) **Pinned head:** `574a9ea7c109d04de170b7004d2b8f2b9e2f30cf` **Live head recheck:** matches pinned; PR open and mergeable. ### Scope (#175) Adds `assess_role_boundary()` and wires it into `build_final_report()` to fail closed on silent reviewer→author pivots, unapproved author mutations after blind queue review, mixed namespace use without justification, and scratch-only evidence claims. Four files; docs/tests aligned. No weakening of existing review/merge gates — additive stricter checks only. ### Validation (reviewer rerun) - `py_compile review_proofs.py tests/test_review_proofs.py` — passed - `pytest tests/test_review_proofs.py` — **49 passed** - `pytest tests/test_review_proofs.py tests/test_pr_queue_inventory.py` — **65 passed** - `pytest tests/ --ignore=branches` — **695 passed, 6 skipped** - `git diff --check prgs/master...HEAD` — clean - Secret sweep — no credential matches Approved.

sysadmin merged commit 4e8b6cc5a9 into master

2026-07-05 15:24:45 -05:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#192