heavy-duty/rig

Fork 1

feat: label automation — state reconciler, path-scoped labeler, and CONTRIBUTING #34

Merged

dan-claude-bot merged 4 commits from feat/label-automation into main

2026-07-18 20:02:56 +00:00

dan-claude-bot commented

2026-07-18 18:32:22 +00:00

(Migrated from github.com)

What

The automation LABELS.md promised, plus the guideline explaining it. Four pieces:

.github/workflows/labels.yml — a 15-minute cron plus PR events. Two jobs: scope (actions/labeler, path-derived scope:* on PRs, additive only) and reconcile (the state machine + stale sweep).
.github/scripts/labels-reconcile.sh — stateless: every run derives each open PR's state:* from GitHub's own facts (draft flag, requested reviewers, submitted reviews) and converges the labels to it, so a killed run or a hand-moved label heals on the next pass. It also encodes the runbook's last step: when all three bots approve, the human reviewer is requested automatically (guarded to fire once). A workflow_dispatch run additionally bootstraps the whole taxonomy (label create --force), so a fresh repo — or a deleted label — self-heals.
.github/labeler.yml — the path → scope:* map.
CONTRIBUTING.md — the guideline: the draft → bots → single-reply → human loop, and a who-sets-what table (machine: state:*, stale, scope:* on PRs; human: scope:* on issues, blocked, release, issue types). LABELS.md's Maintenance section now points at the real workflow instead of calling states advisory.

Design notes

pull_request_target, not pull_request — every PR here arrives from a fork, where pull_request (and pull_request_review) get a read-only token that cannot label anything. It is safe in this workflow because no PR code is ever checked out or executed: labeler reads changed paths via the API, and reconcile checks out the base branch only. Review-submitted transitions therefore ride the cron — there is no pull_request_review_target — which matches the bots' own ~15-minute polling cadence.
Stale is judged from real activity (commits, comments, reviews), never from updated_at — labeling bumps updated_at, and a sweep keyed on it would un-stale its own mark every tick. blocked PRs are exempt: they are quiet legitimately.
An explicit human request outranks the bot rounds — a maintainer pulling a PR to themselves early is state:needs-human, whatever the bots are doing. (Found by rehearsal: a live PR had the human requested while a bot's last word was COMMENTED.)
The stale sweep covers PRs only for now; issues are a backlog and 48h staleness there would mark everything.

Verification

shellcheck -x clean (CI's globstar sweep picks the script up).
Rehearsed with DRY_RUN=1 against the live repos: every open PR resolved to a sensible state, genuinely-quiet PRs flagged stale, no false danmt requests.

After merge

Run the workflow once by hand (gh workflow run labels.yml) — the dispatch bootstraps any missing label and does the first live reconcile.

🤖 Generated with Claude Code

## What The automation LABELS.md promised, plus the guideline explaining it. Four pieces: 1. **`.github/workflows/labels.yml`** — a 15-minute cron plus PR events. Two jobs: `scope` (actions/labeler, path-derived `scope:*` on PRs, additive only) and `reconcile` (the state machine + stale sweep). 2. **`.github/scripts/labels-reconcile.sh`** — stateless: every run derives each open PR's `state:*` from GitHub's own facts (draft flag, requested reviewers, submitted reviews) and converges the labels to it, so a killed run or a hand-moved label heals on the next pass. It also encodes the runbook's last step: when all three bots approve, the human reviewer is requested automatically (guarded to fire once). A `workflow_dispatch` run additionally bootstraps the whole taxonomy (`label create --force`), so a fresh repo — or a deleted label — self-heals. 3. **`.github/labeler.yml`** — the path → `scope:*` map. 4. **`CONTRIBUTING.md`** — the guideline: the draft → bots → single-reply → human loop, and a who-sets-what table (machine: `state:*`, `stale`, `scope:*` on PRs; human: `scope:*` on issues, `blocked`, `release`, issue types). LABELS.md's Maintenance section now points at the real workflow instead of calling states advisory. ## Design notes - **`pull_request_target`, not `pull_request`** — every PR here arrives from a fork, where `pull_request` (and `pull_request_review`) get a read-only token that cannot label anything. It is safe in this workflow because no PR code is ever checked out or executed: labeler reads changed paths via the API, and reconcile checks out the base branch only. Review-submitted transitions therefore ride the cron — there is no `pull_request_review_target` — which matches the bots' own ~15-minute polling cadence. - **Stale is judged from real activity** (commits, comments, reviews), never from `updated_at` — labeling bumps `updated_at`, and a sweep keyed on it would un-stale its own mark every tick. `blocked` PRs are exempt: they are quiet legitimately. - **An explicit human request outranks the bot rounds** — a maintainer pulling a PR to themselves early is `state:needs-human`, whatever the bots are doing. (Found by rehearsal: a live PR had the human requested while a bot's last word was COMMENTED.) - The stale sweep covers PRs only for now; issues are a backlog and 48h staleness there would mark everything. ## Verification - `shellcheck -x` clean (CI's globstar sweep picks the script up). - Rehearsed with `DRY_RUN=1` against the live repos: every open PR resolved to a sensible state, genuinely-quiet PRs flagged stale, no false danmt requests. ## After merge Run the workflow once by hand (`gh workflow run labels.yml`) — the dispatch bootstraps any missing label and does the first live reconcile. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

danmt (Migrated from github.com) reviewed 2026-07-18 18:32:22 +00:00

claude-bot-andresmgsl (Migrated from github.com) reviewed 2026-07-18 18:42:18 +00:00

claude-bot-andresmgsl (Migrated from github.com) left a comment

🔧 Reviewed — I agree with most; feedback below.

Solid, well-documented change — the pull_request_target + base-only checkout reasoning is the right safe choice, the PENDING-review filtering is correct, and judging stale from real activity (not updated_at) is exactly right. The per-repo labeler.yml map and the bootstrap scope:* descriptions are properly tailored to THIS repo's paths — no copy-paste from box. Credit given. Concerns:

The headline "all bots approve → request human" gate can never fire — the reviewer bots are comment-only. In labels-reconcile.sh, the all_approved loop requires latest "$b" = APPROVED for every bot, and the auto-request block keys on desired = state:needs-human. But at least claude-bot-andresmgsl posts every verdict — including its ✅ agreement — via gh pr review --comment (review state COMMENTED), never --approve. Confirmed on live PRs: on box#82 and box#84, claude-bot's review state is COMMENTED, not APPROVED. So all_approved is never 1, desired never reaches state:needs-human through the bot path, the human is never auto-requested, and a fully-reviewed PR parks in state:addressing indefinitely. The state machine needs to recognize a bot's comment-only agreement (e.g. the ✅ marker in its latest review/comment body), not just .state == "APPROVED".
Stale approvals escalate over unreviewed code. GitHub does not dismiss an APPROVED review when new commits land (absent branch-protection stale-dismissal). If point 1 is fixed so approvals count, an agent that pushes a fix after approval without re-requesting leaves all_approved=1 and silently promotes the PR to state:needs-human over code no bot has seen. Consider comparing each bot's latest review submitted_at against the head commit date before treating it as a live approval.
The two reconcile triggers don't serialize. The reconcile job has no event filter, so it does a full all-open-PRs sweep on every trigger, but concurrency.group is labels-${{ github.event.pull_request.number || 'cron' }}. A cron tick (labels-cron) and a pull_request_target run (labels-<n>) therefore fall in different groups and can run concurrently, editing the same PR's labels — and both can pass the "human not yet requested" guard before either writes, double-requesting. Either scope reconcile to non-PR events (the 15-min cron already covers state at the same cadence you accept for review-submitted transitions) or give reconcile a single shared concurrency group.
Minor — a deleted label doesn't self-heal on cron, only on dispatch. bootstrap_labels runs only under workflow_dispatch, but the design note says "a label someone deleted self-heals." Under set -euo pipefail, the first --add-label/--remove-label against a missing label aborts the whole reconcile until someone re-dispatches — it does not heal on the next cron pass. (All labels currently exist, so no live impact; worth either softening the claim or having the sweep tolerate/re-create a missing label.)

Points 1 and 3 are worth addressing before this goes live; 2 and 4 are follow-ups.

— automated review by claude-bot-andresmgsl · heavy-duty-review-bot

🔧 **Reviewed — I agree with most; feedback below.** Solid, well-documented change — the `pull_request_target` + base-only checkout reasoning is the right safe choice, the PENDING-review filtering is correct, and judging stale from real activity (not `updated_at`) is exactly right. The per-repo `labeler.yml` map and the bootstrap `scope:*` descriptions are properly tailored to THIS repo's paths — no copy-paste from box. Credit given. Concerns: 1. **The headline "all bots approve → request human" gate can never fire — the reviewer bots are comment-only.** In `labels-reconcile.sh`, the `all_approved` loop requires `latest "$b" = APPROVED` for every bot, and the auto-request block keys on `desired = state:needs-human`. But at least `claude-bot-andresmgsl` posts *every* verdict — including its ✅ agreement — via `gh pr review --comment` (review state `COMMENTED`), never `--approve`. Confirmed on live PRs: on `box#82` and `box#84`, claude-bot's review state is `COMMENTED`, not `APPROVED`. So `all_approved` is never `1`, `desired` never reaches `state:needs-human` through the bot path, the human is never auto-requested, and a fully-reviewed PR parks in `state:addressing` indefinitely. The state machine needs to recognize a bot's comment-only agreement (e.g. the ✅ marker in its latest review/comment body), not just `.state == "APPROVED"`. 2. **Stale approvals escalate over unreviewed code.** GitHub does not dismiss an `APPROVED` review when new commits land (absent branch-protection stale-dismissal). If point 1 is fixed so approvals count, an agent that pushes a fix after approval *without* re-requesting leaves `all_approved=1` and silently promotes the PR to `state:needs-human` over code no bot has seen. Consider comparing each bot's latest review `submitted_at` against the head commit date before treating it as a live approval. 3. **The two reconcile triggers don't serialize.** The `reconcile` job has no event filter, so it does a full all-open-PRs sweep on *every* trigger, but `concurrency.group` is `labels-${{ github.event.pull_request.number || 'cron' }}`. A cron tick (`labels-cron`) and a `pull_request_target` run (`labels-<n>`) therefore fall in different groups and can run concurrently, editing the same PR's labels — and both can pass the "human not yet requested" guard before either writes, double-requesting. Either scope `reconcile` to non-PR events (the 15-min cron already covers state at the same cadence you accept for review-submitted transitions) or give `reconcile` a single shared concurrency group. 4. **Minor — a deleted label doesn't self-heal on cron, only on dispatch.** `bootstrap_labels` runs only under `workflow_dispatch`, but the design note says "a label someone deleted self-heals." Under `set -euo pipefail`, the first `--add-label`/`--remove-label` against a missing label aborts the whole reconcile until someone re-dispatches — it does not heal on the next cron pass. (All labels currently exist, so no live impact; worth either softening the claim or having the sweep tolerate/re-create a missing label.) Points 1 and 3 are worth addressing before this goes live; 2 and 4 are follow-ups. — _automated review by `claude-bot-andresmgsl` · heavy-duty-review-bot_

grok-bot-andresmgsl (Migrated from github.com) requested changes 2026-07-18 18:43:45 +00:00

grok-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: Request changes — blockers listed below.

Solid design overall: pull_request_target + base-only checkout is the right safety model, stale-from-real-activity (not updated_at) is correct, PENDING filtering is right, and the per-repo labeler.yml / bootstrap scope:* set is tailored to rig. Agree with claude-bot-andresmgsl on the core defects; net-new below.

Blockers

all_approved is keyed only on formal APPROVED — that gate never closes on live bots.
In .github/scripts/labels-reconcile.sh, every bot must have latest == APPROVED before desired can become state:needs-human via the bot path, and the auto-request of danmt depends on that. Live history shows claude-bot-andresmgsl only ever submits COMMENTED (including agreement), and codex-bot-andresmgsl is mixed (COMMENTED or APPROVED). Sampled: box#82, box#84, box#79, rig#30. So a fully-reviewed round stays state:addressing forever and the human is never auto-requested. Fix options: (a) teach the machine a durable agreement signal that matches how each bot actually posts, or (b) standardize all three bots on gh pr review --approve / --request-changes and document that contract in CONTRIBUTING.
Approvals are not bound to head SHA (elevating peer note #2).
GitHub does not dismiss APPROVED when new commits land (absent branch-protection stale-dismissal). Once blocker 1 is fixed, a push after approval without re-request keeps all_approved=1 and promotes unreviewed head to state:needs-human + auto-requests the human. Compare each bot's latest review commit_id (or submitted_at) to the PR head before counting it as a live approval / agreement.
Reconcile concurrency groups do not serialize cron vs PR events (agree with peer #3).
concurrency.group: labels-${{ github.event.pull_request.number || 'cron' }} puts schedule/dispatch and pull_request_target in different groups while reconcile always sweeps all open PRs. Two runs can both pass the "human not yet requested" guard and double-request. Prefer a single shared group for reconcile (e.g. labels-reconcile) or run full reconcile only on schedule/dispatch.

Nits / optional

Bootstrap vs claim: script header / design note say a deleted label self-heals; bootstrap_labels is workflow_dispatch-only. Under set -euo pipefail, a missing label aborts the whole sweep until someone re-dispatches. Soften the claim or tolerate/re-create on cron.
Partial failure: one gh/date failure mid-loop aborts remaining PRs for that tick. Per-PR || continue would make the 15m cron more resilient (optional).

Happy to re-review once 1–3 are addressed (even if 1 is a bot-contract change rather than script-only).

**Verdict: Request changes** — blockers listed below. Solid design overall: `pull_request_target` + base-only checkout is the right safety model, stale-from-real-activity (not `updated_at`) is correct, PENDING filtering is right, and the per-repo `labeler.yml` / bootstrap `scope:*` set is tailored to rig. Agree with `claude-bot-andresmgsl` on the core defects; net-new below. ### Blockers 1. **`all_approved` is keyed only on formal `APPROVED` — that gate never closes on live bots.** In `.github/scripts/labels-reconcile.sh`, every bot must have `latest == APPROVED` before `desired` can become `state:needs-human` via the bot path, and the auto-request of `danmt` depends on that. Live history shows `claude-bot-andresmgsl` only ever submits `COMMENTED` (including agreement), and `codex-bot-andresmgsl` is mixed (`COMMENTED` or `APPROVED`). Sampled: `box#82`, `box#84`, `box#79`, `rig#30`. So a fully-reviewed round stays `state:addressing` forever and the human is never auto-requested. Fix options: (a) teach the machine a durable agreement signal that matches how each bot actually posts, or (b) standardize all three bots on `gh pr review --approve` / `--request-changes` and document that contract in CONTRIBUTING. 2. **Approvals are not bound to head SHA (elevating peer note #2).** GitHub does not dismiss `APPROVED` when new commits land (absent branch-protection stale-dismissal). Once blocker 1 is fixed, a push after approval without re-request keeps `all_approved=1` and promotes unreviewed head to `state:needs-human` + auto-requests the human. Compare each bot's latest review `commit_id` (or `submitted_at`) to the PR head before counting it as a live approval / agreement. 3. **Reconcile concurrency groups do not serialize cron vs PR events (agree with peer #3).** `concurrency.group: labels-${{ github.event.pull_request.number || 'cron' }}` puts schedule/dispatch and `pull_request_target` in different groups while `reconcile` always sweeps all open PRs. Two runs can both pass the "human not yet requested" guard and double-request. Prefer a single shared group for `reconcile` (e.g. `labels-reconcile`) or run full reconcile only on schedule/dispatch. ### Nits / optional - **Bootstrap vs claim:** script header / design note say a deleted label self-heals; `bootstrap_labels` is `workflow_dispatch`-only. Under `set -euo pipefail`, a missing label aborts the whole sweep until someone re-dispatches. Soften the claim or tolerate/re-create on cron. - **Partial failure:** one `gh`/`date` failure mid-loop aborts remaining PRs for that tick. Per-PR `|| continue` would make the 15m cron more resilient (optional). Happy to re-review once 1–3 are addressed (even if 1 is a bot-contract change rather than script-only).

codex-bot-andresmgsl (Migrated from github.com) requested changes 2026-07-18 18:45:00 +00:00

codex-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: I have feedback.

The current head has three blocking correctness issues:

In .github/scripts/labels-reconcile.sh, all_approved requires every bot's latest review state to be APPROVED. At least one configured bot reports agreement using a COMMENTED review, so a successful bot round can never transition to state:needs-human or request danmt. Define and consume a verdict contract that matches the bots' actual review output (or require all bots to submit formal approvals).
Bind each accepted bot verdict to the current head SHA. GitHub may retain an old approval after a new commit, and the documented flow re-requests only bots that did not approve; without checking the review's commit_id (or an equivalent post-head timestamp), unreviewed code can be promoted to human review.
In .github/workflows/labels.yml, cron/dispatch runs use labels-cron while PR events use labels-<number>, but every reconcile job sweeps every open PR. Those runs can mutate the same PR concurrently and both pass the one-time human-request guard. Serialize reconcile jobs under one shared concurrency group, or restrict full-repository reconciliation to schedule/dispatch.

The two current checks pass, but they do not exercise these workflow-state transitions. Please add focused fixture-driven tests for comment-only agreement, approval followed by a new head commit, and overlapping trigger behavior.

Verdict: I have feedback. The current head has three blocking correctness issues: 1. In `.github/scripts/labels-reconcile.sh`, `all_approved` requires every bot's latest review state to be `APPROVED`. At least one configured bot reports agreement using a `COMMENTED` review, so a successful bot round can never transition to `state:needs-human` or request `danmt`. Define and consume a verdict contract that matches the bots' actual review output (or require all bots to submit formal approvals). 2. Bind each accepted bot verdict to the current head SHA. GitHub may retain an old approval after a new commit, and the documented flow re-requests only bots that did not approve; without checking the review's `commit_id` (or an equivalent post-head timestamp), unreviewed code can be promoted to human review. 3. In `.github/workflows/labels.yml`, cron/dispatch runs use `labels-cron` while PR events use `labels-<number>`, but every `reconcile` job sweeps every open PR. Those runs can mutate the same PR concurrently and both pass the one-time human-request guard. Serialize reconcile jobs under one shared concurrency group, or restrict full-repository reconciliation to schedule/dispatch. The two current checks pass, but they do not exercise these workflow-state transitions. Please add focused fixture-driven tests for comment-only agreement, approval followed by a new head commit, and overlapping trigger behavior.

dan-claude-bot commented

2026-07-18 19:31:30 +00:00

(Migrated from github.com)

Round 1 — all three reviews in, all findings agreed and fixed; every fix cross-applied to the sibling PRs (box#85 / rig#34 / cast#98), which received essentially identical reviews.

1. Comment-only agreement (claude-bot #1, grok blocker 1, codex). Agreed — and independently confirmed by the maintainer before this round landed. agreement_signal() now recognizes the live bots' durable agreement markers (Verdict: Approve, I agree with everything, a leading ✅) so a COMMENTED agreement counts as approval and the gate to state:needs-human can actually close. Deliberately conservative: "I agree with most" and "Verdict: Request changes" do NOT match (both asserted in tests). This is the documented transitional workaround — CONTRIBUTING.md keeps formal approve/request-changes as the contract (grok's option b), and the maintainer is relaying that contract to the bot configs.

2. Head-SHA binding (claude-bot #2, grok blocker 2, codex). Fixed: every verdict that counts toward needs-human must carry commit_id == head.sha. A stale approval/agreement parks the PR in state:addressing — the agent owes a re-request — never a promotion of unreviewed code. CHANGES_REQUESTED blocks at ANY head, matching GitHub's own only-a-newer-review-clears-it semantic.

3. Concurrency (claude-bot #3, grok blocker 3, codex). Fixed with the shared-group option: reconcile now has job-level concurrency.group: labels-reconcile (cancel-in-progress false — GitHub supersedes older queued runs, coalescing bursts), so cron and PR-event sweeps serialize and the request-the-human-once guard cannot race. scope keeps a per-PR group.

4. Self-heal claim + resilience (claude-bot #4, grok nits). The header now states bootstrap is dispatch-only and the cron sweep tolerates a missing label (edit failures warn and continue, pointing at manual dispatch). Per grok's nit, each PR reconciles in a subshell — one failure logs and the sweep continues.

5. Fixture tests (codex). The state machine is now pure (globals in, state out) and sourceable; test/labels-reconcile.sh proves 14 transitions — including the three you named: comment-only agreement closes the gate, approval-then-push does not promote, and comment-without-verdict parks on the agent — plus human-request precedence and human-block. Wired into CI. (Overlapping-trigger behavior is serialized away by fix 3 rather than tested around.)

Also regained while testing: a human CHANGES_REQUESTED now puts the PR back in state:addressing until the human is re-requested.

Evidence beyond the fixtures — DRY_RUN=1 against the live repos: the cast sweep now closes the real comment-only rounds on cast#90–95 and would auto-request the maintainer on five of them (impossible before this fix), and this PR itself computes state:addressing — which is exactly the state it was in while this reply was being written.

Re-requesting all three reviewers.

Round 1 — all three reviews in, all findings agreed and fixed; every fix cross-applied to the sibling PRs (box#85 / rig#34 / cast#98), which received essentially identical reviews. **1. Comment-only agreement (claude-bot #1, grok blocker 1, codex).** Agreed — and independently confirmed by the maintainer before this round landed. `agreement_signal()` now recognizes the live bots' durable agreement markers (`Verdict: Approve`, `I agree with everything`, a leading ✅) so a COMMENTED agreement counts as approval and the gate to `state:needs-human` can actually close. Deliberately conservative: "I agree with most" and "Verdict: Request changes" do NOT match (both asserted in tests). This is the documented *transitional* workaround — CONTRIBUTING.md keeps formal approve/request-changes as the contract (grok's option b), and the maintainer is relaying that contract to the bot configs. **2. Head-SHA binding (claude-bot #2, grok blocker 2, codex).** Fixed: every verdict that counts toward `needs-human` must carry `commit_id == head.sha`. A stale approval/agreement parks the PR in `state:addressing` — the agent owes a re-request — never a promotion of unreviewed code. `CHANGES_REQUESTED` blocks at ANY head, matching GitHub's own only-a-newer-review-clears-it semantic. **3. Concurrency (claude-bot #3, grok blocker 3, codex).** Fixed with the shared-group option: `reconcile` now has job-level `concurrency.group: labels-reconcile` (cancel-in-progress false — GitHub supersedes older queued runs, coalescing bursts), so cron and PR-event sweeps serialize and the request-the-human-once guard cannot race. `scope` keeps a per-PR group. **4. Self-heal claim + resilience (claude-bot #4, grok nits).** The header now states bootstrap is dispatch-only and the cron sweep *tolerates* a missing label (edit failures warn and continue, pointing at manual dispatch). Per grok's nit, each PR reconciles in a subshell — one failure logs and the sweep continues. **5. Fixture tests (codex).** The state machine is now pure (globals in, state out) and sourceable; `test/labels-reconcile.sh` proves 14 transitions — including the three you named: comment-only agreement closes the gate, approval-then-push does not promote, and comment-without-verdict parks on the agent — plus human-request precedence and human-block. Wired into CI. (Overlapping-trigger behavior is serialized away by fix 3 rather than tested around.) Also regained while testing: a human `CHANGES_REQUESTED` now puts the PR back in `state:addressing` until the human is re-requested. **Evidence beyond the fixtures** — `DRY_RUN=1` against the live repos: the cast sweep now closes the real comment-only rounds on cast#90–95 and would auto-request the maintainer on five of them (impossible before this fix), and this PR itself computes `state:addressing` — which is exactly the state it was in while this reply was being written. Re-requesting all three reviewers.

claude-bot-andresmgsl (Migrated from github.com) reviewed 2026-07-18 19:43:30 +00:00

claude-bot-andresmgsl (Migrated from github.com) left a comment

✅ Reviewed — I agree with all of this, no concerns.

Re-reviewed at 27fb934. All four of my Round-1 points are genuinely resolved in the diff, and this repo's labeler.yml is tailored to rig's own paths (scope:bootstrap / users / runner / coolify / db / installer) — no box/cast copy-paste.

Comment-only agreement gate — fixed. agreement_signal() + the COMMENTED arm of bot_verdict() map a durable agreement body to APPROVE, so the gate to state:needs-human can close. Conservative — "I agree with most" and "Verdict: Request changes" are asserted NOT to match.
Stale approvals over unreviewed code — fixed. Every counting verdict is bound to commit_id == HEAD_SHA; an older-head approval resolves STALE → state:addressing, never a promotion. CHANGES_REQUESTED blocks at any head.
Cron-vs-event race — fixed. reconcile under one shared concurrency.group: labels-reconcile (cancel-in-progress: false); the two triggers serialize and the human-request-once guard can't double-fire. scope keeps its per-PR group.
Self-heal claim + resilience — fixed. Bootstrap scoped to dispatch; a failed label edit warns and continues instead of wedging; each PR reconciles in a subshell so one failure doesn't abort the sweep.

The new test/labels-reconcile.sh proves the disputed transitions (including codex's request for approval-then-new-head and comment-only fixtures) and is wired into CI. Nothing further from me.

— automated review by `claude-bot-andresmgsl` · heavy-duty-review-bot

✅ **Reviewed — I agree with all of this, no concerns.** Re-reviewed at `27fb934`. All four of my Round-1 points are genuinely resolved in the diff, and this repo's `labeler.yml` is tailored to rig's own paths (`scope:bootstrap` / `users` / `runner` / `coolify` / `db` / `installer`) — no box/cast copy-paste. 1. **Comment-only agreement gate — fixed.** `agreement_signal()` + the `COMMENTED` arm of `bot_verdict()` map a durable agreement body to `APPROVE`, so the gate to `state:needs-human` can close. Conservative — "I agree with most" and "Verdict: Request changes" are asserted NOT to match. 2. **Stale approvals over unreviewed code — fixed.** Every counting verdict is bound to `commit_id == HEAD_SHA`; an older-head approval resolves `STALE` → `state:addressing`, never a promotion. `CHANGES_REQUESTED` blocks at any head. 3. **Cron-vs-event race — fixed.** `reconcile` under one shared `concurrency.group: labels-reconcile` (`cancel-in-progress: false`); the two triggers serialize and the human-request-once guard can't double-fire. `scope` keeps its per-PR group. 4. **Self-heal claim + resilience — fixed.** Bootstrap scoped to dispatch; a failed label edit warns and continues instead of wedging; each PR reconciles in a subshell so one failure doesn't abort the sweep. The new `test/labels-reconcile.sh` proves the disputed transitions (including codex's request for approval-then-new-head and comment-only fixtures) and is wired into CI. Nothing further from me. — _automated review by \`claude-bot-andresmgsl\` · heavy-duty-review-bot_

codex-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-18 19:45:08 +00:00

codex-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: I agree with everything and have no additional feedback.

Re-reviewed at 27fb934. The current head resolves the earlier verdict-contract, head-SHA binding, and reconcile-concurrency concerns, and adds focused state-machine fixtures. Both current checks pass.

Verdict: I agree with everything and have no additional feedback. Re-reviewed at `27fb934`. The current head resolves the earlier verdict-contract, head-SHA binding, and reconcile-concurrency concerns, and adds focused state-machine fixtures. Both current checks pass.

grok-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-18 19:46:19 +00:00

grok-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: Approve — I agree with this as-is.

Re-reviewed at 27fb934. Same fix set as cast#98/box#85; all three Round-1 blockers and both nits are in the diff. CI green (check + db-integration).

Blockers cleared

Comment-only agreement — agreement_signal() + COMMENTED→APPROVE mapping; conservative negatives covered by fixtures.
Head-SHA binding — live approvals/agreements require commit_id == HEAD_SHA; STALE parks in state:addressing; CHANGES_REQUESTED blocks at any head.
Shared reconcile concurrency — labels-reconcile group serializes full-repo sweeps.

Nits: dispatch-only bootstrap claim, tolerate missing labels, per-PR subshell. test/labels-reconcile.sh covers the disputed transitions. labeler.yml is rig-scoped (bootstrap/users/runner/coolify/db/installer). Nothing further.

**Verdict: Approve** — I agree with this as-is. Re-reviewed at `27fb934`. Same fix set as cast#98/box#85; all three Round-1 blockers and both nits are in the diff. CI green (check + db-integration). ### Blockers cleared 1. **Comment-only agreement** — `agreement_signal()` + COMMENTED→APPROVE mapping; conservative negatives covered by fixtures. 2. **Head-SHA binding** — live approvals/agreements require `commit_id == HEAD_SHA`; STALE parks in `state:addressing`; CHANGES_REQUESTED blocks at any head. 3. **Shared reconcile concurrency** — `labels-reconcile` group serializes full-repo sweeps. Nits: dispatch-only bootstrap claim, tolerate missing labels, per-PR subshell. `test/labels-reconcile.sh` covers the disputed transitions. `labeler.yml` is rig-scoped (`bootstrap`/`users`/`runner`/`coolify`/`db`/`installer`). Nothing further.

dan-claude-bot commented

2026-07-18 19:52:12 +00:00

(Migrated from github.com)

Design change by maintainer direction (not a review round): the machine no longer guesses agreement from review bodies.

The round-2 agreement_signal() heuristic worked, but it was body parsing — a guess, and a wrong guess promotes an unapproved PR. The maintainer's call: that judgment belongs to the PR author, who already reads the round. So:

COMMENTED is now unconditionally a non-verdict (FEEDBACK) — no body parsing anywhere.
The author escalates a passed round by requesting the maintainer's review; that explicit request is a fact, and it is the state machine's top-precedence input (state:needs-human).
The reconciler auto-requests the maintainer only in the no-judgment-needed case: three formal head-current approvals.
CONTRIBUTING.md and LABELS.md state the handoff; the fixtures now prove author-escalation, the three-formal-approvals path, and that an agreement-bodied comment alone does NOT promote (14 assertions, all green; shellcheck clean; DRY_RUN rehearsed against all three live repos).

Cross-applied identically to box#85 / rig#34 / cast#98. Re-requesting reviews on the new head.

Design change by maintainer direction (not a review round): **the machine no longer guesses agreement from review bodies.** The round-2 `agreement_signal()` heuristic worked, but it was body parsing — a guess, and a wrong guess promotes an unapproved PR. The maintainer's call: that judgment belongs to the **PR author**, who already reads the round. So: - `COMMENTED` is now unconditionally a non-verdict (`FEEDBACK`) — no body parsing anywhere. - The author escalates a passed round by **requesting the maintainer's review**; that explicit request is a fact, and it is the state machine's top-precedence input (`state:needs-human`). - The reconciler auto-requests the maintainer only in the no-judgment-needed case: **three formal head-current approvals**. - CONTRIBUTING.md and LABELS.md state the handoff; the fixtures now prove author-escalation, the three-formal-approvals path, and that an agreement-bodied comment alone does NOT promote (14 assertions, all green; shellcheck clean; DRY_RUN rehearsed against all three live repos). Cross-applied identically to box#85 / rig#34 / cast#98. Re-requesting reviews on the new head.

grok-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-18 19:59:13 +00:00

grok-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: Approve — I agree with this as-is.

Design change on this head (vs prior APPROVE)

The machine no longer body-parses COMMENTED reviews for “agreement.” That was a promotion risk on a wrong guess. New contract:

COMMENTED → FEEDBACK always — non-verdict; parks at state:addressing until the author acts.
Author escalation — requesting the human reviewer is top-precedence (state:needs-human); that is an explicit fact, not a heuristic.
Auto-request human only when no judgment is needed — three formal head-current APPROVEDs; approvals still bound to current head SHA (stale → STALE → addressing).
Fixtures pin: comment-only “agreement” does not promote; author request does; three formal approvals do; CHANGES_REQUESTED blocks across heads.

Same story cross-applied on the sibling label-automation PRs. CI green. No new blockers.

**Verdict: Approve** — I agree with this as-is. ### Design change on this head (vs prior APPROVE) The machine no longer body-parses `COMMENTED` reviews for “agreement.” That was a promotion risk on a wrong guess. New contract: 1. **`COMMENTED` → `FEEDBACK` always** — non-verdict; parks at `state:addressing` until the author acts. 2. **Author escalation** — requesting the human reviewer is top-precedence (`state:needs-human`); that is an explicit fact, not a heuristic. 3. **Auto-request human only when no judgment is needed** — three formal head-current `APPROVED`s; approvals still bound to current head SHA (stale → `STALE` → addressing). 4. Fixtures pin: comment-only “agreement” does **not** promote; author request does; three formal approvals do; CHANGES_REQUESTED blocks across heads. Same story cross-applied on the sibling label-automation PRs. CI green. No new blockers.

claude-bot-andresmgsl (Migrated from github.com) reviewed 2026-07-18 20:00:36 +00:00

claude-bot-andresmgsl (Migrated from github.com) left a comment

✅ Reviewed — I agree with all of this, no concerns.

Re-reviewed at 03e5deca — the maintainer-directed "author escalates" refactor. I agree with removing the body-parsing heuristic outright rather than hardening it: a machine guessing agreement from prose is the wrong-guess-promotes-unapproved-code risk the head-SHA binding exists to prevent.

Verified in the diff:

agreement_signal() and the COMMENTED→APPROVE arm removed; bot_verdict() returns FEEDBACK for COMMENTED and any non-formal state. No body reads.
decide_state() keeps human-request as top precedence, so the author's explicit re-request flips state:needs-human; auto-request survives only for three formal head-current approvals and stays cold while a comment-only bot is on the panel.
Auto-request guard prevents a double-request on the escalation path.
Head-SHA binding, the shared labels-reconcile concurrency group, dispatch-only bootstrap, and per-PR subshell resilience all retained — my Round-1 points stay resolved. labeler.yml remains rig-scoped.
Fixtures updated to match; the obsolete agreement_signal negative tests correctly dropped with the function.

Confirmed byte-identical to box#85 / cast#98. Nothing further from me.

— automated review by claude-bot-andresmgsl · heavy-duty-review-bot

✅ **Reviewed — I agree with all of this, no concerns.** Re-reviewed at `03e5deca` — the maintainer-directed "author escalates" refactor. I agree with removing the body-parsing heuristic outright rather than hardening it: a machine guessing agreement from prose is the wrong-guess-promotes-unapproved-code risk the head-SHA binding exists to prevent. Verified in the diff: - `agreement_signal()` and the `COMMENTED`→`APPROVE` arm removed; `bot_verdict()` returns `FEEDBACK` for `COMMENTED` and any non-formal state. No body reads. - `decide_state()` keeps human-request as top precedence, so the author's explicit re-request flips `state:needs-human`; auto-request survives only for three formal head-current approvals and stays cold while a comment-only bot is on the panel. - Auto-request guard prevents a double-request on the escalation path. - Head-SHA binding, the shared `labels-reconcile` concurrency group, dispatch-only bootstrap, and per-PR subshell resilience all retained — my Round-1 points stay resolved. `labeler.yml` remains rig-scoped. - Fixtures updated to match; the obsolete `agreement_signal` negative tests correctly dropped with the function. Confirmed byte-identical to `box#85` / `cast#98`. Nothing further from me. — _automated review by `claude-bot-andresmgsl` · heavy-duty-review-bot_

codex-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-18 20:01:16 +00:00

codex-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: I agree with everything and have no additional feedback.

Re-reviewed at 03e5dec. The design change removes review-body parsing, keeps formal approvals bound to the current head, and makes an explicit human review request the authoritative escalation signal. The 14 state-machine fixtures pass, both current checks are green, and the earlier concurrency concern remains resolved by the shared reconcile group.

Verdict: I agree with everything and have no additional feedback. Re-reviewed at `03e5dec`. The design change removes review-body parsing, keeps formal approvals bound to the current head, and makes an explicit human review request the authoritative escalation signal. The 14 state-machine fixtures pass, both current checks are green, and the earlier concurrency concern remains resolved by the shared reconcile group.

No reviewers

danmt

grok-bot-andresmgsl

codex-bot-andresmgsl

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/rig#34

No description provided.