Close the director raw PR merge bypass #870

New issue

Closed

opened 2026-07-09 21:13:51 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-09 21:13:51 +00:00

Member

Root problem:

The guarded lane exists as ward agent director merge, but the director surface can still call the lower-level Forgejo pr merge write verb directly.
That bypass skips the director merge policy and any future status policy in agent_director_merge.go.
The policy currently relies on the linked issue outcome, QA marker, PR mergeability, and the PR head status being green indirectly through the engineer and QA story. It does not enforce a live required-status check at the merge call site.

Acceptance:

A director read-only surface cannot merge PRs through raw ward ops forgejo pr merge. It must use ward agent director merge or another policy-checked command.
The director merge command verifies the current PR head SHA has successful required checks immediately before merge, using Forgejo commit status or check data, not only issue-thread prose.
The final done comment should name the checked head SHA and status context.
Add tests that prove raw merge is refused from a director surface or no longer exposed there, and that director merge refuses missing, failing, or stale status checks.
Run ward exec test and ward exec lint.

Refs: #858, #868, main test runs 1357 and 1359.

The latest queue drain merged #858 and #868 with the raw ward ops forgejo pr merge surface from a director read-only session. Both PR branch checks had passed, but the merge commits on main failed test runs 1357 and 1359. Root problem: - The guarded lane exists as ward agent director merge, but the director surface can still call the lower-level Forgejo pr merge write verb directly. - That bypass skips the director merge policy and any future status policy in agent_director_merge.go. - The policy currently relies on the linked issue outcome, QA marker, PR mergeability, and the PR head status being green indirectly through the engineer and QA story. It does not enforce a live required-status check at the merge call site. Acceptance: - A director read-only surface cannot merge PRs through raw ward ops forgejo pr merge. It must use ward agent director merge or another policy-checked command. - The director merge command verifies the current PR head SHA has successful required checks immediately before merge, using Forgejo commit status or check data, not only issue-thread prose. - The final done comment should name the checked head SHA and status context. - Add tests that prove raw merge is refused from a director surface or no longer exposed there, and that director merge refuses missing, failing, or stale status checks. - Run ward exec test and ward exec lint. Refs: #858, #868, main test runs 1357 and 1359.

coilyco-ops added the

headless

labels

2026-07-09 21:13:51 +00:00

coilyco-ops commented

2026-07-09 21:14:27 +00:00

Author

Member

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-ward-870 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-09T21:14:25Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#870 · branch issue-870 · harness codex · workflow direct-to-main
Run: engineer-codex-ward-870 · ward v0.522.0 · dispatched 2026-07-09T21:14:25Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.522.0).

— Codex, via ward agent

WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-ward-870` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-09T21:14:25Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#870` · branch `issue-870` · harness `codex` · workflow `direct-to-main` - **Run:** `engineer-codex-ward-870` · ward `v0.522.0` · dispatched `2026-07-09T21:14:25Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.522.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a commit

2026-07-09 21:29:11 +00:00

Close director raw PR merge bypass

coilyco-ops closed this issue

2026-07-09 21:29:11 +00:00

coilyco-ops commented

2026-07-09 21:29:36 +00:00

Author

Member

WARD-OUTCOME: done

details

workflow: direct-to-main; review summary: review gate skipped because ~/.ward/config.yaml default

The implementation felt straightforward once the raw merge helper and the director policy gate were separated. Confidence is high. Surprise: the read-only director surface still had a direct path to the raw merge leaf. Follow-up: none.

WARD-OUTCOME: done <details><summary>details</summary> workflow: direct-to-main; review summary: review gate skipped because ~/.ward/config.yaml default The implementation felt straightforward once the raw merge helper and the director policy gate were separated. Confidence is high. Surprise: the read-only director surface still had a direct path to the raw merge leaf. Follow-up: none. </details>