coilyco-flight-deck/ward

Archived

Watch

Replace in-container review quorum with brokered QA handoff #1255

Closed

opened 2026-07-14 08:55:01 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-07-14 08:55:01 +00:00

Owner

Outcome

Remove Ward’s in-container review panel and quorum machinery while preserving independent QA as a first-class brokered workflow step.

QA runs as a separately dispatched role, inspects the candidate revision and evidence, publishes pull-request-native review state, and returns a trusted structured outcome to the Ward merge gate.

Required behavior

Delete the in-container review subsystem and all review-only configuration, flags, smart defaults, prompts, tests, and documentation.
Require brokered QA only for pull-request-and-merge. Other workflows may invoke QA but do not require it.
Bind the QA request to the exact repository, issue, pull request, candidate head revision, workflow, and Ward run identity.
The engineer stops at submitted and never self-declares merge-ready.
QA publishes a native Forgejo pull-request review for the exact head commit, correlated with its Ward run identity.
APPROVED makes the submitted candidate merge-eligible. REQUEST_CHANGES, blocked, failed, stale, missing, wrong-head, wrong-PR, wrong-issue, or untrusted QA fails closed.
Remove self-declared reviewer-family trust. The central actor classifier from #1586 determines whether QA evidence is authoritative.
The director merges only after current CI, trusted current-head QA, and the normal workflow gates pass.
Keep engineer and QA execution isolated. QA feedback returns through the pull request and broker outcome, not an in-container side channel.
Preserve the QA run’s normal Ward artifacts and terminal outcome.

Acceptance

No in-container review panel or quorum path remains in product code, configuration, help, tests, or documentation.
A brokered QA request can be issued for an exact candidate revision.
QA approval and requested changes are visible as native pull-request reviews and correlated with the Ward run.
The merge gate accepts only current, trusted QA evidence for the exact head revision.
A stale review, changed head, failed QA run, or untrusted actor cannot satisfy the gate.
Tests cover dispatch, exact-head binding, approval, requested changes, stale evidence, actor authority, and broker recovery.

Ordering and ownership

Land #1586 before this issue.
Generic dispatch from #1626 is the shipped transport baseline and is not reimplemented here.
This issue absorbs #1187 and #1081.
Repository tests and synthetic Forgejo fixtures are the implementation boundary. Do not use live Forgejo mutations or live broker dispatch for acceptance.

## Outcome Remove Ward’s in-container review panel and quorum machinery while preserving independent QA as a first-class brokered workflow step. QA runs as a separately dispatched role, inspects the candidate revision and evidence, publishes pull-request-native review state, and returns a trusted structured outcome to the Ward merge gate. ## Required behavior * Delete the in-container review subsystem and all review-only configuration, flags, smart defaults, prompts, tests, and documentation. * Require brokered QA only for `pull-request-and-merge`. Other workflows may invoke QA but do not require it. * Bind the QA request to the exact repository, issue, pull request, candidate head revision, workflow, and Ward run identity. * The engineer stops at `submitted` and never self-declares merge-ready. * QA publishes a native Forgejo pull-request review for the exact head commit, correlated with its Ward run identity. * `APPROVED` makes the submitted candidate merge-eligible. `REQUEST_CHANGES`, blocked, failed, stale, missing, wrong-head, wrong-PR, wrong-issue, or untrusted QA fails closed. * Remove self-declared reviewer-family trust. The central actor classifier from #1586 determines whether QA evidence is authoritative. * The director merges only after current CI, trusted current-head QA, and the normal workflow gates pass. * Keep engineer and QA execution isolated. QA feedback returns through the pull request and broker outcome, not an in-container side channel. * Preserve the QA run’s normal Ward artifacts and terminal outcome. ## Acceptance * No in-container review panel or quorum path remains in product code, configuration, help, tests, or documentation. * A brokered QA request can be issued for an exact candidate revision. * QA approval and requested changes are visible as native pull-request reviews and correlated with the Ward run. * The merge gate accepts only current, trusted QA evidence for the exact head revision. * A stale review, changed head, failed QA run, or untrusted actor cannot satisfy the gate. * Tests cover dispatch, exact-head binding, approval, requested changes, stale evidence, actor authority, and broker recovery. ## Ordering and ownership * Land #1586 before this issue. * Generic dispatch from #1626 is the shipped transport baseline and is not reimplemented here. * This issue absorbs #1187 and #1081. * Repository tests and synthetic Forgejo fixtures are the implementation boundary. Do not use live Forgejo mutations or live broker dispatch for acceptance.

coilysiren referenced this issue

2026-07-14 15:27:09 +00:00

director should emit colorized, space buffered, visually distinct messages about the categories of actions its performing on startup #1283

coilyco-ops added the

autonomy

async-consult

priority

labels

2026-07-15 04:51:17 +00:00

coilyco-ops added

priority

and removed

priority

labels

2026-07-29 06:19:23 +00:00

coilyco-ops referenced this issue

2026-07-31 07:25:05 +00:00

Collapse the documentation tree into durable product contracts #1624

coilyco-ops changed title from ~~remove in container review / review quorum~~ to Replace in-container review quorum with brokered QA handoff

2026-07-31 08:10:26 +00:00

coilyco-ops referenced this issue

2026-07-31 08:13:25 +00:00

QA agent 1st class role should communicate to the engineer through 1st class pull request comments / approvals / change requests / etc... #1187

coilyco-ops referenced this issue

2026-07-31 08:13:50 +00:00

Add broker mediated engineer to QA review requests #1081

coilyco-ops referenced this issue

2026-08-05 09:39:08 +00:00

Collapse the documentation tree into durable product contracts #1624

coilyco-ops commented

2026-08-05 09:52:06 +00:00

Owner

Advisor preflight and decision resolved by Kai on 2026-08-05.

Evidence from canonical main:

The obsolete in-container review path still ships in cmd/ward/agent_review.go, internal/reviewpanel, review flags and smart defaults, engineer prompts, tests, and docs.
Brokered QA already ships through the durable broker for the qa role.
QA already records repository, issue, pull request, exact reviewed head SHA, workflow, and run identity.
The director merge gate already rejects missing, stale, wrong-PR, wrong-issue, failed, and wrong-head QA verdicts.
QA currently posts issue-thread machine state rather than a native Forgejo pull-request review.
The merge gate does not yet prove trusted comment authorship. #1586 owns that central actor-admission boundary.

Authoritative narrowed scope:

Delete the in-container review subsystem and all review-only configuration, flags, prompts, tests, and documentation.
Require brokered QA only for pull-request-and-merge. Other workflows may invoke QA but do not require it.
The engineer stops at submitted and never self-declares merge-ready.
QA publishes a native Forgejo pull-request review bound to the exact head commit and correlated with its Ward run identity.
APPROVED makes the submitted candidate merge-eligible. REQUEST_CHANGES, blocked, failed, stale, missing, or untrusted QA fails closed.
Remove self-declared reviewer-family trust. The central actor classifier from #1586 determines whether QA evidence is authoritative.
The director merges only after current CI, trusted current-head QA, and the normal workflow gates pass.
Land #1586 before this issue.

Generic dispatch from #1626 is the shipped transport baseline and is not reimplemented here. This decision clears the consult gate and narrows #1255 to non-overlapping implementation work.

Advisor preflight and decision resolved by Kai on 2026-08-05. Evidence from canonical main: * The obsolete in-container review path still ships in cmd/ward/agent_review.go, internal/reviewpanel, review flags and smart defaults, engineer prompts, tests, and docs. * Brokered QA already ships through the durable broker for the qa role. * QA already records repository, issue, pull request, exact reviewed head SHA, workflow, and run identity. * The director merge gate already rejects missing, stale, wrong-PR, wrong-issue, failed, and wrong-head QA verdicts. * QA currently posts issue-thread machine state rather than a native Forgejo pull-request review. * The merge gate does not yet prove trusted comment authorship. #1586 owns that central actor-admission boundary. Authoritative narrowed scope: * Delete the in-container review subsystem and all review-only configuration, flags, prompts, tests, and documentation. * Require brokered QA only for pull-request-and-merge. Other workflows may invoke QA but do not require it. * The engineer stops at submitted and never self-declares merge-ready. * QA publishes a native Forgejo pull-request review bound to the exact head commit and correlated with its Ward run identity. * APPROVED makes the submitted candidate merge-eligible. REQUEST_CHANGES, blocked, failed, stale, missing, or untrusted QA fails closed. * Remove self-declared reviewer-family trust. The central actor classifier from #1586 determines whether QA evidence is authoritative. * The director merges only after current CI, trusted current-head QA, and the normal workflow gates pass. * Land #1586 before this issue. Generic dispatch from #1626 is the shipped transport baseline and is not reimplemented here. This decision clears the consult gate and narrows #1255 to non-overlapping implementation work.

coilyco-ops added

and removed

labels

2026-08-05 09:52:12 +00:00

coilyco-ops referenced this issue

2026-08-05 10:08:47 +00:00

Remove public verification-fixture mode #1645

coilyco-ops referenced this issue