@windyroad/risk-scorer 0.19.12 → 0.19.13-preview.1284
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/hooks/lib/risk-gate.sh
CHANGED
|
@@ -39,7 +39,7 @@ check_risk_gate() {
|
|
|
39
39
|
# 1. Score file must exist (fail-closed)
|
|
40
40
|
if [ ! -f "$SCORE_FILE" ]; then
|
|
41
41
|
RISK_GATE_CATEGORY="missing"
|
|
42
|
-
RISK_GATE_REASON="No ${ACTION} risk score found. Delegate to wr-risk-scorer:pipeline to assess cumulative pipeline risk. On Codex,
|
|
42
|
+
RISK_GATE_REASON="No ${ACTION} risk score found. Delegate to wr-risk-scorer:pipeline to assess cumulative pipeline risk. On Codex, spawn a fresh typed reviewer for each new assessment; followup_task cannot refresh a completed review marker. Wait for the reviewer and confirm that exact target is completed; then invoke \`interrupt_agent\` exactly once on the completed target before retrying. If it is still running, keep waiting. The compatibility hook persists the completed structured verdict; no transcript parsing or nested codex exec is required. On Claude Code, dispatch the reviewer synchronously (\`run_in_background: false\`) before retrying."
|
|
43
43
|
return 1
|
|
44
44
|
fi
|
|
45
45
|
|
|
@@ -163,7 +163,7 @@ print(('yes' if score > N else 'no') + ' ' + str(N))
|
|
|
163
163
|
if [ "$DENIED" = "yes" ]; then
|
|
164
164
|
RISK_GATE_CATEGORY="threshold"
|
|
165
165
|
RISK_GATE_SCORE="$SCORE"
|
|
166
|
-
RISK_GATE_REASON="${ACTION} risk score ${SCORE}/25 exceeds the project appetite of ${APPETITE}/25 (RISK-POLICY.md). Reduce risk or halt — there is no proceed-anyway path (P377/RFC-029). To proceed within appetite: (1) split the ${ACTION}, (2) add risk-reducing measures and re-score, or (3) if this is incident response, delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') with incident context — it scores the change against the live realised-risk baseline (ADR-042 Rule 1b) and clears it via the risk-reducing path if it is net-risk-reducing."
|
|
166
|
+
RISK_GATE_REASON="${ACTION} risk score ${SCORE}/25 exceeds the project appetite of ${APPETITE}/25 (RISK-POLICY.md). Reduce risk or halt — there is no proceed-anyway path (P377/RFC-029). After remediation on Codex, spawn a fresh typed wr-risk-scorer:pipeline reviewer for this checkout; followup_task does not refresh the recorded score. To proceed within appetite: (1) split the ${ACTION}, (2) add risk-reducing measures and re-score, or (3) if this is incident response, delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') with incident context — it scores the change against the live realised-risk baseline (ADR-042 Rule 1b) and clears it via the risk-reducing path if it is net-risk-reducing."
|
|
167
167
|
return 1
|
|
168
168
|
fi
|
|
169
169
|
|
package/package.json
CHANGED
package/skills/pipeline/SKILL.md
CHANGED
|
@@ -34,7 +34,10 @@ prevents the completion bridge from binding the returned verdict. `$ARGUMENTS`
|
|
|
34
34
|
is already self-contained, so no forked conversation context is required.
|
|
35
35
|
After the Codex agent reports completion, invoke `interrupt_agent` exactly once
|
|
36
36
|
on that completed target so the compatibility hook receives the structured
|
|
37
|
-
result.
|
|
37
|
+
result. After remediation changes the assessed risk, spawn a **new** typed
|
|
38
|
+
reviewer with the updated state. `followup_task` on a completed reviewer does
|
|
39
|
+
not create a new marker generation, so its later score cannot replace the
|
|
40
|
+
recorded score. Do not relaunch the same target or inspect a transcript.
|
|
38
41
|
|
|
39
42
|
```
|
|
40
43
|
subagent_type: wr-risk-scorer:pipeline
|