@windyroad/itil 0.47.12-preview.617 → 0.47.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -255,7 +255,7 @@ For each unmatched fresh report, run these steps in order; record the outcome in
|
|
|
255
255
|
|
|
256
256
|
5. **Clear-malicious branch (policy-violation close verdict — fifth implicit verdict per 4.5e-comment-shape table)**: post a brief gated verdict comment per the 4.5e-comment-shape contract — body uses the "We're closing this report. Reason: <plain-language gloss>" template. The `<plain-language gloss>` MUST translate the `wr-risk-scorer:inbound-report` verdict into reporter-readable language (e.g. *"spam / off-topic / disclosure-bypass"*, not the raw verdict-class token). Architect C4: name this verdict as **policy-violation close**, NOT won't-fix — clear-malicious is a stronger close than won't-fix (immediate close vs. deliberated decline). The classification gloss is a load-bearing anti-leakage requirement (JTBD non-blocking advisory): the SKILL contract explicitly forbids substituting the raw `wr-risk-scorer:inbound-report` verdict token into the reporter-facing body. The raw token still ships to the maintainer-side audit-log surface (4.5f) verbatim per ADR-062 § Audit-log surface shape. JTBD-301 acknowledgement contract — silent close is forbidden per ADR-062 Decision Drivers row 1. External-comms gates ride. Then close the upstream issue via `gh issue close <id>`. Append the reporter handle + classification to `docs/audits/inbound-discovery-log.md` for P123 block-list consumption when that ticket lands. Cache entry classification: `clear-malicious-closed`. **Gate-denial sub-branch**: if the verdict-comment gate denies, record `cache_audit_note: gate-denied-clear-malicious-pre-close` and do NOT close the upstream issue (silent close is forbidden — preserve the report for the next pass).
|
|
257
257
|
|
|
258
|
-
6. **Safe-and-valid branch (accepted-into-backlog verdict)**: invoke `/wr-itil:capture-problem --no-prompt <report-body-verbatim>` to create the local ticket. The `--no-prompt` flag
|
|
258
|
+
6. **Safe-and-valid branch (accepted-into-backlog verdict)**: invoke `/wr-itil:capture-problem --no-prompt <report-body-verbatim>` to create the local ticket. The `--no-prompt` flag is the AFK mode marker for the I12 derive-then-ratify dispatch per ADR-060 Amendment 2026-06-02 — capture-problem derives persona + JTBD from the report body; on derivation-failure (no JTBD-NNN citations + no `--persona=` / `--jtbd=` flags supplied), capture halts-with-stderr-directive and no ticket is created (record `cache_audit_note: gate-denied-safe-and-valid-derive-failure`; the report stays uncaptured pending interactive maintainer triage). **Stamp the inbound origin (ADR-076)**: the skeleton writes `**Origin**: internal` by default — Edit it on the freshly-created ticket to `**Origin**: inbound-reported (#<id>)` (the upstream issue/discussion `<id>` polled this pass) so the ADR-076 reported-first tier ranks it ahead of internal tickets. The on-ticket `**Origin**` field, not the regenerable cache, is the authoritative rank input (ADR-076); the cache's `matched_local_ticket` remains the audit/replay record. Verbatim body preservation honors JTBD-301 persona constraint "capture context faithfully without cognitive re-shaping" and JTBD-201 audit-trail fidelity. Then post a gated `gh issue comment` carrying the **accepted-into-backlog verdict** per the 4.5e-comment-shape contract above — body uses the "Thanks for the report. We're tracking this as a real bug — local ticket P<NNN>. The fix will ship in a future release of `@windyroad/<plugin>`; we don't have a firm date yet. Watch this issue for updates, or check our [release notes](<link>) — we'll comment here when the fix lands." template. The `<plugin>` substitution is the package name (e.g. `itil`, `architect`, `retrospective`); the `<link>` substitution is the package's CHANGELOG URL on npm or GitHub. Do NOT include the legacy P229 leak phrasing *"classified via /wr-itil:review-problems Step 4.5e safe-and-valid branch with safe-low-fix-risk"* in the comment body — that's the canonical anti-leakage failure mode (see 4.5e-comment-shape above). The token `safe-low-fix-risk` belongs to the maintainer-side audit-log only and the cache-entry classification column (4.5g), not in user-facing comments. Cache entry classification: `safe-and-valid-local-ticket-created`; populate `matched_local_ticket: P<NNN>` with the freshly-allocated ID. **Gate-denial sub-branch**: if the acknowledgement comment gate denies, the local ticket already exists — record `cache_audit_note: gate-denied-safe-and-valid-acknowledgement` and continue. The acknowledgement comment will retry on the next discovery pass.
|
|
259
259
|
|
|
260
260
|
#### 4.5f. Audit-log append
|
|
261
261
|
|
|
@@ -34,9 +34,15 @@ The user reviews the pending note on their next interactive session and runs `/w
|
|
|
34
34
|
|
|
35
35
|
### Step 0: Preflight (per ADR-019)
|
|
36
36
|
|
|
37
|
-
Before opening the work loop,
|
|
37
|
+
Before opening the work loop, **get the repo into a clean state** so the orchestrator does not iterate against a stale backlog, silently strand prior-session in-flight work, or proceed past an ambiguously-dirty tree (P040, P109, P293). ADR-019 names three branches under the umbrella goal:
|
|
38
38
|
|
|
39
|
-
**
|
|
39
|
+
- **Branch 1 — Pull**: origin moved; trivial fast-forward divergence. Action: `git pull --ff-only` non-interactively (the existing fetch/divergence path below).
|
|
40
|
+
- **Branch 2 — Commit**: pre-existing uncommitted work that belongs in a commit (prior AFK iter hit quota / cancel / crash mid-ticket). Auto-commit when **both** discriminator conditions hold: (a) provenance is unambiguous (attributable to the prior iter's own in-flight flow) AND (b) risk is within appetite per ADR-018. **Deferred — current implementation routes Branch 2 → Branch 3**: the auto-commit mechanism + gate-composition wiring + bats are not yet shipped. Pre-existing uncommitted source edits demote to Branch 3 (halt-with-report) until the follow-up lands.
|
|
41
|
+
- **Branch 3 — AskUserQuestion / AFK-halt**: genuinely messy tree (ambiguous uncommitted state, non-fast-forward divergence, partial-prior-session work whose provenance is unclear). Interactive: `AskUserQuestion` per ADR-013 Rule 1 (four-option report: Resume / Discard / Leave-and-lower-priority / Halt). AFK: halt with structured Prior-Session State report — a **deliberate carve-out from the 2026-06-06 ADR-013 Rule 6 queue-and-continue default** (ambiguous session-continuity state requires user input; non-interactive recovery would mask the bug this preflight is meant to surface).
|
|
42
|
+
|
|
43
|
+
The Branch 1 fetch/divergence table below is the live implementation of Branch 1. The session-continuity detection pass after it is **Branch 3's detection mechanism** — it enumerates the signals that populate the Prior-Session State report when Branch 3 fires.
|
|
44
|
+
|
|
45
|
+
**Branch 1 mechanism:**
|
|
40
46
|
|
|
41
47
|
1. Run `git fetch origin`.
|
|
42
48
|
2. Compare local `HEAD` with `origin/<base>` (default `main`; otherwise the branch the user is on).
|
|
@@ -46,7 +52,7 @@ Before opening the work loop, reconcile local state with origin so the orchestra
|
|
|
46
52
|
|---|---|
|
|
47
53
|
| HEAD at or ahead of origin/<base> | Proceed to Step 1 |
|
|
48
54
|
| origin/<base> ahead, local has no unpushed commits (pure fast-forward) | Run `git pull --ff-only` non-interactively. Log the count of pulled commits in the AFK iteration log. Proceed to Step 1. |
|
|
49
|
-
| origin/<base> ahead, local has unpushed commits (non-fast-forward) | STOP the loop. Report the divergence with `git log --oneline HEAD..origin/<base>` and `git log --oneline origin/<base>..HEAD`. Do NOT attempt to rebase or merge non-interactively — that is a judgment call the persona forbids in AFK mode. |
|
|
55
|
+
| origin/<base> ahead, local has unpushed commits (non-fast-forward) | STOP the loop (Branch 3 routing — non-fast-forward divergence is a "genuinely messy" signal). Report the divergence with `git log --oneline HEAD..origin/<base>` and `git log --oneline origin/<base>..HEAD`. Do NOT attempt to rebase or merge non-interactively — that is a judgment call the persona forbids in AFK mode. |
|
|
50
56
|
|
|
51
57
|
**Network failure**: if `git fetch origin` returns a network error, stop and report. Default behaviour is fail-closed — the user can retry when network is restored.
|
|
52
58
|
|
|
@@ -54,9 +60,9 @@ Before opening the work loop, reconcile local state with origin so the orchestra
|
|
|
54
60
|
|
|
55
61
|
**Cross-cutting**: this rule applies to every AFK orchestrator skill. The next-ID collision guard (ADR-019 confirmation criterion 2) belongs in the ticket-creator skills (`manage-problem` and `wr-architect:create-adr`), not here — see the related problem ticket for that work.
|
|
56
62
|
|
|
57
|
-
####
|
|
63
|
+
#### Branch 3 detection mechanism — session-continuity signal enumeration (per P109)
|
|
58
64
|
|
|
59
|
-
After the fetch/divergence check, Step 0 MUST run
|
|
65
|
+
After the Branch 1 fetch/divergence check, Step 0 MUST run the session-continuity detection pass that populates Branch 3's signal set (and, when the Branch 2 follow-up lands, feeds the Branch 2 / Branch 3 discriminator). The Branch 1 check handles "did origin move under us"; this pass handles the distinct failure mode "did the prior session leave partial work that changes what iter 1 should do". A prior AFK subprocess can exit mid-ticket (quota 429, user-cancel, subprocess crash) and leave observable state in the working tree that the orchestrator must classify before opening the work loop.
|
|
60
66
|
|
|
61
67
|
**Signals to enumerate** (each maps to one `git status --porcelain` / filesystem / `git worktree` probe):
|
|
62
68
|
|
|
@@ -977,8 +983,9 @@ When `AskUserQuestion` is unavailable or the user is AFK, the skill (and the del
|
|
|
977
983
|
| Post-release plugin cache refresh between iters (P233) | After a successful within-appetite Drain action shipped a release to npm, chain `/install-updates` to refresh the plugin cache before the next iter dispatches. Conditional on actual release (skipped when `push:watch` ran alone with no changeset); non-blocking on `/install-updates` failure (degrades to cache-stays-stale, equivalent to pre-amendment behaviour). Mid-loop ask discipline preserved by treating any `/install-updates` AskUserQuestion surface AS the Non-interactive fallback dry-run path. Per ADR-013 Rule 5 + ADR-044 + P130 + P106 + P233 (Step 6.5 Post-release cache refresh subsection). |
|
|
978
984
|
| CI failure during Step 6.5 drain (within-appetite branch) | Diagnose via `gh run view --log-failed`, classify against the closed fixable-in-iter allow-list (P081-class stale-grep-string, hook stub mismatch, test ID drift, environmental flake), fix-and-continue for fixable classes (each retry rides its own ADR-014 commit gate), 3-retry cap per iteration, halt for unrecoverable classes. Ambiguous classification defaults to halt. ADR-013 Rule 5 policy-authorised. Per ADR-026 grounding + ADR-044 framework-resolution boundary + P140 (Step 6.5 Failure handling). |
|
|
979
985
|
| Pipeline risk above appetite (push or release >= 5/25) | Auto-apply scorer remediations incrementally (ADR-042 Rule 2). The agent reads suggestions and decides what to do. Re-score after each apply; drain when within appetite. **Never release above appetite** (ADR-042 Rule 1) — no AskUserQuestion shortcut. Halt the loop with `outcome: halted-above-appetite` if the loop exhausts without convergence (ADR-042 Rule 5). Verification Pending commits excluded from auto-revert (Rule 2b). Per ADR-042 (Step 6.5 Above-appetite branch). |
|
|
980
|
-
| Origin diverged before start | Pull `--ff-only` if trivial; stop with
|
|
981
|
-
|
|
|
986
|
+
| Origin diverged before start (Branch 1) | Pull `--ff-only` if trivial; route to Branch 3 (stop with `git log HEAD..origin/<base>` and reverse report) if non-fast-forward — per ADR-019 (Step 0 Branch 1 / Branch 3). |
|
|
987
|
+
| Pre-existing uncommitted work attributable to prior iter's in-flight flow (Branch 2 — DEFERRED) | Per ADR-019 Branch 2 (currently routes → Branch 3 until follow-up lands the auto-commit mechanism + JTBD-001 gate composition + bats). Auto-commit criteria when shipped: (a) provenance unambiguous AND (b) risk within appetite per ADR-018. Commit subject convention: `chore(preflight): recover prior-session in-flight work — <ticket-ref>` (JTBD-006 audit trail). |
|
|
988
|
+
| Prior-session partial work detected at start (Branch 3 detection — session-continuity dirty: untracked `docs/decisions/*.proposed.md` / `docs/problems/*.md`, `.afk-run-state/iter-*.json` with `is_error: true` or `api_error_status >= 400`, stale `.claude/worktrees/*`, uncommitted SKILL.md/source/ADR edits) | Halt the loop with a structured Prior-Session State report in the AFK summary — deliberate carve-out from the 2026-06-06 Rule 6 queue-and-continue default (ambiguous state would mask the bug this preflight surfaces). Do NOT attempt non-interactive resume. Interactive invocations prompt via `AskUserQuestion` with 4 options (resume / discard / leave-and-lower-priority / halt). Per P109 + ADR-013 Rule 6 + ADR-019 (Step 0 Branch 3 detection mechanism). |
|
|
982
989
|
| Fix verification needed | Skip problem, add to "needs verification" list |
|
|
983
990
|
| Stop-condition #2 with user-answerable skip-reasons | Default: call AskUserQuestion (batched, ≤4 per call, sequential when >4) — the orchestrator's main turn is interactive by construction per ADR-032 subprocess-boundary; user is presumed at the keyboard. Fallback: emit Outstanding Design Questions table when AskUserQuestion is unavailable (Rule 6 fail-safe). Per ADR-013 Rule 1 + P122 (Step 2.5). |
|
|
984
991
|
| Pre-`ALL_DONE` gate sequence at any loop end (every stop-condition + every halt-path that emits a final summary + quota-exhaustion natural end) | Run Step 2.4 sequence UNCONDITIONALLY before `ALL_DONE` emit: gate (a) outstanding-questions surface via Step 2.5b; gate (b) session-level retro via `/wr-retrospective:run-retro`; gate (c) emit `ALL_DONE` only after (a) AND (b) complete. Hard-fail mode: if either gate cannot complete cleanly, halt with directive instead of emit `ALL_DONE` — recovery is the user satisfying the gate and re-invoking the skill. Per ADR-044 framework-resolution boundary + ADR-013 + ADR-014 (retro commits its own work) + P086 (extends iter-level retro to orchestrator-level) + P341 (Step 2.4). |
|