Repository navigation
Record the House rule: nobody closes a pull request; the branch inhabits its #N - #1030
Conversation
… its #N Logan's standing House rule for this monorepository, from his direct instruction of 2026-09-09: no PR is ever closed. A PR is resolved by merge only. When a PR's content goes stale or is superseded elsewhere, work continues -- or changes subjects -- on the branch inhabiting that #N: merge main in, retitle, rewrite the body with a Formerly: line, and carry on under the same number. Draft is the parking state; a PR's branch is never deleted. VAULT-CONVENTIONS.md gets the full rule as a new subsection of Git Practices, right after the merge-queue subsection it extends, plus two reconciling clauses: the lifecycle vocabulary now applies to a PR's content rather than to the PR, and "one matter per branch" is stated as one matter at a time, not one matter for life (the practiced shape: one branch carried #1017 through #1021 in turn). The subsection also names the automation in the tree that would close a PR -- the parked stale-bot and branch-cleanup workflows, the unreachable close step in the signing-proof workflow, the abandoned lifecycle label, and Dependabot's own supersede-close -- as dead code under the rule, and records the close history it does not re-litigate: 103 unmerged closes in the ledger through 2026-05-27, 72 more since (60 in one sweep on 2026-08-20/21, #1023 superseded by Dependabot on 2026-09-02, and #980 auto-closed on 2026-09-03 when its head branch was deleted in a rename -- the hazard the never-delete clause names). .claude/CLAUDE.md carries the short form, because the remote harness's default posture treats a closed PR as finished and would otherwise pull a session the other way. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019H9hhudCFhbsqdeAn9e6vi
|
The files' contents are under analysis for test generation. |
|
Review changes with |
✅ Precogs scan complete — No security issues foundCommit
✅ Passed checks (3)
💬 Precogs.ai · Detect. Fix. Merge. |
|
Your 14-day trial has expired! You have already exhausted your 14th day trial period. Please upgrade your subscription to continue new analysis. Upgrade by visiting: View Dashboard |
PR Analysis Summary
📧 Email-friendly summaryRisk: 🟢 Low Risk | Complexity: 🟢 1.0/10 | Files: 2 Change Metrics
Risk factors:
Classification
Files by Type
💡 Recommendations
Analyzed by Woden Tagger • Automated PR insights for better code reviews
💡 Want enhanced Github Projects/Notes and to turn Issues into a Service Desk? Check out Woden Desk on the GitHub Marketplace |
🛡️ Zaxion Policy Status: 🔴 BLOCKGateway Blocked
Visit the Full Report for detailed metrics, findings, and interactive remediation. |
|
Review these changes at https://app.gitnotebooks.com/LAF-US/IDAHO-VAULT/pull/1030 |
aislop skipped this PRThis workspace does not have an active paid scanaislop plan. Choose a plan to resume hosted scans and PR gates: This comment appears once per PR. Further pushes will be skipped silently until the workspace has paid access. |
![inspect-review[bot]](https://avatars.githubusercontent.com/in/3177512?s=60&v=4){kind=small}
There was a problem hiding this comment.
inspect review
Triage: 4 entities analyzed | 0 critical, 0 high, 3 medium, 1 low
Verdict: standard_review
Findings (0)
Reviewed by inspect | Entity-level triage found 0 high-risk changes
Revieko — PR review
No matching hunks for extensions: .py Full report: HTML · Markdown · JSON Details
— Generated by Revieko · Install GitHub App · Documentation Link details
|
QWED Security Verification Report2 files scanned | 0 blocked | 0 warnings | 0 info | 0 suppressed | 2 verified Engines
Verified Files
Verified by QWED — deterministic security verification. No LLM used. Verification Context v1.0{
"spec_version": "1.0",
"object": {
"formal_statement": "LAF-US/IDAHO-VAULT@d1fa75fa (PR #1030) is safe to merge"
},
"context": {
"interpretation": {
"theory": "deterministic security verification",
"logic": "evidence-context-policy pipeline"
},
"proof": {
"verifier": "QWED Security",
"verifier_version": "qwed-security-ruleset/4",
"configuration": {
"repo": "LAF-US/IDAHO-VAULT",
"head_sha": "d1fa75fa23093788e727d72f4437c5454a14fb3b",
"files_scanned": 2,
"attestation_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjU2NWFkMDg2NGY3NWJkYmIiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiIyNzU5NTA0IiwiYXVkIjoicXdlZC1hdHRlc3RhdGlvbiIsImlhdCI6MTc4ODkyODUxOCwiZXhwIjoxNzg4OTI4ODE4LCJxd2VkIjp7InJlc3VsdCI6eyJzdGF0dXMiOiJWRVJJRklFRCIsImFnZW50X21lc3NhZ2UiOiJWRVJJRklFRCBhZ2FpbnN0IHRoZSBRV0VEIGRldGVybWluaXN0aWMgcnVsZSBzZXQ6IG5vIHNlY3VyaXR5IGJvdW5kYXJ5IHZpb2xhdGlvbnMgZGV0ZWN0ZWQgaW4gdGhlIHNjYW5uZWQgZmlsZXMuIFRoaXMgYXR0ZXN0cyB0byB0aGUgYWJzZW5jZSBvZiBrbm93bi1wYXR0ZXJuIHZpb2xhdGlvbnMgZm9yIHRoaXMgcnVsZSBzZXQgYW5kIGNvbW1pdCBcdTIwMTQgaXQgaXMgbm90IGEgZ3VhcmFudGVlIHRoYXQgdGhlIGNvZGUgaXMgZnJlZSBvZiBhbGwgdnVsbmVyYWJpbGl0aWVzLiIsImlzX2F1dGhvcml0YXRpdmUiOnRydWV9LCJwcm9vZl9oYXNoIjoic2hhMjU2OmFkZGJmNjk1MDcyM2JjMzQ1ZWM0ZDJlMzU0NzUwMTkwOGFkODhjMjEwYzI0YjhjMmYxZjQ0MzZkMjhiNjlkMTMiLCJib3VuZGFyeSI6bnVsbH19.XF7jZLZ95Wb1EQgUwrS9Fp65krZW6T78nsIxperY6ZYs50ryZSj6_Ar013KOX6GfslSRDMAcYZx3Gsoe1rmBEn9BX_Rr-VD4qzpeiinQnniyyirxG-z68ZB0_sU_QQGFuY3-sAq5uCuaa0iiQqixgRIxSfJS4pX4llVEunygE6ZfUbD0E5w0SMKAfKkDTfI8KZZKWFxVL6wwDf7YjF6qcZvOIZJcNMd7_VllsYdec16o1yj7pAnZxpp0ugfusIl_2EqgWCK0JmZk0wcBL_zwhjizDJNBprn0qviQJvmapuntwopS22WUq64iUy7Q19x-P5ydyK4iFyo4pm1nwM7MFg",
"attestation_fingerprint": "6669ec85143ff4b4",
"attestation_jwks_url": "https://qwed-security-334760594829.us-central1.run.app/.well-known/jwks.json",
"attestation_kid": "565ad0864f75bdbb"
},
"theory_scope": "PR security scan against QWED deterministic rule set",
"trusted_dependencies": [
"qwed-security"
],
"outcome_treatment": "unknown/timeout/error resolve to UNVERIFIABLE or BLOCKED"
},
"evidence": {
"evidence": {
"status": "VERIFIED",
"agent_message": "VERIFIED against the QWED deterministic rule set: no security boundary violations detected in the scanned files. This attests to the absence of known-pattern violations for this rule set and commit \u2014 it is not a guarantee that the code is free of all vulnerabilities.",
"developer_fields": {
"total_findings": 0,
"advisory_checks": []
},
"is_authoritative": true,
"proof_ref": "sha256:addbf6950723bc345ec4d2e3547501908ad88c210c24b8c2f1f4436d28b69d13",
"scan_evidence": {
"repo": "LAF-US/IDAHO-VAULT",
"head_sha": "d1fa75fa23093788e727d72f4437c5454a14fb3b",
"pr_number": 1030,
"files_scanned": 2,
"engine_results": 4,
"conclusion": "success",
"rule_set": "qwed-security-ruleset/4",
"engines": [
"entropy_scan",
"pattern_scan"
]
},
"repo": "LAF-US/IDAHO-VAULT",
"head_sha": "d1fa75fa23093788e727d72f4437c5454a14fb3b",
"files_scanned": 2
},
"proof_ref": "sha256:d47b350d28457658b8a1f90fc33f34b42dfd8b6a152e02d2b733db5873efd6e1"
},
"decision": {
"admission": "ADMIT"
}
},
"verdict": "VERIFIED"
} |
|
🤖 Review complete! 🤖 Reviewed by codereviewbot.ai - Catch bugs before your team does. |
📝 WalkthroughWalkthroughThe changes add merge-only pull request rules to project guidance. They define same-number resubmission, draft parking, branch handling, repair procedures, and automation surfaces that must not close pull requests. ChangesPull request lifecycle policy
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: 🔵 Low · up to The merge-only PR policy is documented, but its branch-recovery instruction is inaccurate and could cause maintainers to treat recoverable PRs as irreversible. Correct the CLAUDE.md wording before merge. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Footnotes
|
Reviewer's GuideThis documentation-only PR establishes a repository-wide rule that PRs are resolved by merge rather than closure, describing how to re-subject stale or superseded work on the same branch and number. It adds both detailed governance guidance and a concise Claude Code session instruction, while cataloging existing close automation and historical closes without modifying executable code. Sequence diagram for re-subjecting a stale pull requestsequenceDiagram
participant Agent
participant Branch
participant PR
participant Main
participant Queue
Agent->>Branch: Merge main into branch
Main-->>Branch: Merge commit
Agent->>Branch: Commit updated content
Agent->>PR: Retitle and rewrite body
PR-->>PR: Formerly: old title
Agent->>Queue: Continue PR through normal review and merge queue
Queue-->>PR: Merge PR
State diagram for the no-close pull request lifecyclestateDiagram-v2
[*] --> Open
Open --> Draft: waiting or blocked
Draft --> Open: mark ready
Open --> ReSubject: stale or superseded content
ReSubject --> Open: merge main and continue on same #N
Open --> Merged: merge queue
Merged --> [*]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Run failed. View the logs →
|
![gitginie[bot]](https://avatars.githubusercontent.com/in/712912?s=60&v=4){kind=small}
There was a problem hiding this comment.
@loganfinney27
Thank you for your contribution to this repository! We appreciate your effort in opening pull request.
Happy coding!
Railo found 0 security issue(s)Your branch is unchanged. What was found
Apply these fixes
Commit:
|
|
Standing down on What is failing: the third-party Zaxion app's Why it is not this PR's: the PR is documentation only, two Markdown files. The policy cannot be met without adding a test file that tests nothing, which would widen the PR to game a check rather than fix anything. The same policy fails identically on #1029, an unrelated diff, and the check did not exist on #1025, the last PR to merge, so it is repo-wide. It is not among the Main Ruleset's queue gates as recorded in No fix exists to port. Whether the app's policy should exempt docs-only PRs, or the app should stay installed, is Logan's call. I have no means to re-run an App-authored check run from this session. Every repo-owned check on this head ( Generated by Claude Code |
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| BestPractice | 3 medium |
| CodeStyle | 2 minor |
| Comprehensibility | 1 minor |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
…e hatch Codacy reported six new findings on 596209a, all in lines this PR added. Two are markdownlint MD018: the closing paragraph of the House rule wrapped so that two lines began with a bare PR number, "#366" and "#1026", which a Markdown linter reads as a malformed ATX heading. Rewrapped with "PR" before each number so no line starts with a hash. The other four are Agentlinter on the short form in .claude/CLAUDE.md: the all-caps label "HOUSE RULE" read as an undefined acronym, and three sentences stated an absolute rule without naming its exception. The label is now mixed case, and the paragraph now says what was always true under the authority chain: Logan's own direct instruction is the one exception and outranks this file. The force-push clause is worded as the existing rule already is ("without explicit permission"), and the branch-deletion clause gives its reason and the draft alternative instead of a bare "never". Verified locally: markdownlint reports no MD018 on the changed files, and agentlinter --local run on the committed and the fixed CLAUDE.md reproduces the four findings on the former and none on the latter. The vault's own guards (secret patterns, portable paths, dotfolder anchors) pass. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019H9hhudCFhbsqdeAn9e6vi
There was a problem hiding this comment.
inspect review
Triage: 4 entities analyzed | 0 critical, 0 high, 3 medium, 1 low
Verdict: standard_review
Findings (0)
Reviewed by inspect | Entity-level triage found 0 high-risk changes
✅ Precogs scan complete — No security issues foundCommit
✅ Passed checks (3)
💬 Precogs.ai · Detect. Fix. Merge. |
PR Analysis Summary
📧 Email-friendly summaryRisk: 🟢 Low Risk | Complexity: 🟢 1.0/10 | Files: 2 Change Metrics
Risk factors:
Classification
Files by Type
💡 Recommendations
Analyzed by Woden Tagger • Automated PR insights for better code reviews
💡 Want enhanced Github Projects/Notes and to turn Issues into a Service Desk? Check out Woden Desk on the GitHub Marketplace |
|
🤖 Review complete! 🤖 Reviewed by codereviewbot.ai - Catch bugs before your team does. |
Railo found 0 security issue(s)Your branch is unchanged. What was found
Apply these fixes
Commit:
|
PR Analysis Summary
📧 Email-friendly summaryRisk: 🟢 Low Risk | Complexity: 🟢 1.0/10 | Files: 2 Change Metrics
Risk factors:
Classification
Files by Type
💡 Recommendations
Analyzed by Woden Tagger • Automated PR insights for better code reviews
💡 Want enhanced Github Projects/Notes and to turn Issues into a Service Desk? Check out Woden Desk on the GitHub Marketplace |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
No critical paths modified ✅ |
![secuarden-ai[bot]](https://avatars.githubusercontent.com/in/1232245?s=60&v=4){kind=small}
Railo found 0 security issue(s)Your branch is unchanged. What was found
Apply these fixes
Commit:
|
There was a problem hiding this comment.
🟢 Approval recommended
The documentation is internally consistent, addresses the prior branch-renaming issue, and introduces no unresolved technical defects.
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0 new
- Review effort level: Balanced
![tenki-reviewer[bot]](https://avatars.githubusercontent.com/in/2900641?s=60&v=4){kind=small}
|
Run failed. View the logs →
|
Up to standards ✅🟢 Issues
|
loganfinney27
added
the
merge/auto
Claude
|
This run was cancelled 🛑 The workflow was cancelled before completion. Please check the link below for details. |
There was a problem hiding this comment.
@loganfinney27
Thank you for your contribution to this repository! We appreciate your effort in closing pull request.
Happy coding!
Post-merge sweep of the open PRs (2026-09-09,
|
| PRs | Why main supersedes them |
|---|---|
| #456, #478, #666, #712, #833, #840, #843, #844, #847, #858 | main pins anomalyco/opencode/github at v1.18.16 (e280d8d, 2026-08-24); every open opencode bump is older |
| #457 | main pins actions/checkout v7.0.1 (since 88302c3, 2026-08-03) |
| #734, #735 | the CodeQL workflow sits parked at the root as codeql.yml (664eb88, 2026-08-22); no live workflow pins codeql-action |
| #826, #848 | .github/workflows/codacy.yml moved to the root in 063cdaa (2026-08-21) and pins upload-sarif v4.37.6 there |
| #824 | main removed the two workflows it edits in 72778e7 (2026-08-05); no live workflow uses setup-uv |
| #465 | aiohttp and chromadb no longer appear in main's requirements.txt; its merge/auto label came off with the parking |
| #549 | batch-arm-merge-queue.yml sits parked at the root since 063cdaa; a schedule on a parked file cannot fire |
| #1001, #1008 | empty diff against main (the triagebot anchor and pygments 2.21.0 both landed) |
Dependabot's long descriptions stay in each description's edit history; the one-line summary stays in place. I did not push merge commits to these branches: a push by anyone else stops Dependabot maintaining a branch, and a parked number needs no merge until its next matter begins.
Needs Logan's judgment (6) — left untouched
- Add CASE_NOTES_SUMMARY.md - Initial case notebook for missing temps i… #496 (your case-notes PR, armed with
merge/auto): 16 conflicted paths; the branch's only own change isself/character-mistral-intern/CASE_NOTES_SUMMARY.md, andmainchanged that same file by 207 lines, so picking a side is a content decision. - NORMALIZATION: record N1 ruling, add conformity checker + CI gate, sweep 145 files to UTF-8 #803 (NORMALIZATION sweep): both sides changed
NORMALIZATION-CHARACTER-CONFORMITY-2026-07-07.md; the other two conflicts are generated files. - fix(review-loop): correct auto-merge failure classification (parked engine) #1005 (auto-merge crash fix):
maindeletedtests-test_review_feedback_loop.pyand the branch modified it; keeping either side loses the other's intent. - Bump anomalyco/opencode from 1.17.9 to 1.17.10 #666, Bump anomalyco/opencode from 1.17.8 to 1.17.9 #456, Bump actions/checkout from 6.0.2 to 7.0.0 #457, Bump anomalyco/opencode from 1.17.8 to 1.17.9 #478: parked as bumps, but Bump anomalyco/opencode from 1.17.9 to 1.17.10 #666 carries 284 commits
mainnever took (witness leaves, signals, research, tooling from May–June 2026) and the other three share one set of 33; whether that content becomes those numbers' next matter is your call. - fix(history): recover logan/obsidian ancestry #1029 (ancestry recovery): 3008 commits ahead, 587 conflicted paths; yours.
Left as they are (11) — clean against main
#388, #995, #998, #1002, #1003, #1006, #1011, #1024, #1026, #1027, #1028 merge cleanly; the rule has nothing to do to them.
One finding outside the sweep
auto-merge-engage.yml fails on every run: .github/scripts/review_feedback_loop.py imports pr_github, which 063cdaa moved to scripts_scripts/pr_github.py, so the first step dies with ModuleNotFoundError and the arm-and-enqueue steps never run (run 34315602540 on this PR shows it). #1030 merged because I enabled auto-merge through the API directly after applying merge/auto; the label path itself is dead. #1011 repoints other stale paths but not this one. The smallest fix is one line in review_feedback_loop.py (put scripts_scripts on sys.path before the import) or moving pr_github.py back under .github/scripts/; a workflow-adjacent change, so I leave it to your direction.
Generated by Claude Code
loganfinney27
removed
the
merge/auto
Claude
|
Correction to the record above. Logan, after this merged: a label has never been intended to manually trigger anything; the tooling, intentionally disabled, applies labels that describe state. The merged text called Two facts from the tree, for the same record: your cleanup 063cdaa parked Generated by Claude Code |
Summary
Records Logan's standing House rule for this monorepository in canon: nobody closes a pull request. Only a merge resolves a PR. When a PR's content goes stale, or another change supersedes it, work continues, or changes subjects, on the branch that inhabits that
#N.The instruction that prompted this arrived cut off mid-sentence ("...on that branch inhabiting the #N"). This PR records the part that arrived; if the rest carried more, this PR is the place to take it up.
What changed
VAULT-CONVENTIONS.md§ Git Practices#N", right after the merge-queue subsection it extends. It states the rule and the re-subjecting procedure: dequeue and disarm before the first push (remove a queued entry, disable auto-merge, dropmerge/auto, clear the old matter'srisk/*andreview/*labels), mergemainin with a merge commit, retitle, rewrite the body with aFormerly:line, continue under the same number, and let the owner re-arm the new matter once it classifies afresh. It also covers draft as the parking state, the no-delete and no-rename clause for head branches (GitHub closes a head-branch PR on either), the repair path (restore the branch at its recorded head, then reopen), the two exceptions (a close Logan performs himself; Dependabot's supersede-close), whyclosed_byalone cannot tell his hand from a session's (a remote session acts under his login), and the harness note for Claude Code sessions.auto-merge-engage.ymlarms only a non-draft PR carryingmerge/auto, and with the reclassifying engine parked the label comes from the PR's owner. Logan set that in this session: you opened it, it's yours. The section, the re-subjecting step, and the Claude Code bullet say so with provenance..github/workflows/, so the parkedstale-bot-prs.ymlandbranch-cleanup.ymlcannot fire; the close step inagent-swarm-signing-proof.ymlhas no caller because its wrappers sit parked; theabandonedlabel; and Dependabot's own supersede-close (external, no switch independabot.yml; Logan's call).closed_prs.jsonthrough 2026-05-27, and 72 more on GitHub since. Logan closed 60 in one sweep on 2026-08-20/21; Dependabot closed build(deps): bump posthog from 7.39.1 to 7.42.1 #1023 on 2026-09-02; GitHub auto-closed fix(history): recover logan/obsidian ancestry (LAF-79) #980 on 2026-09-03 when a rename deleted its head branch (per fix(history): recover logan/obsidian ancestry #1029's own description)..claude/CLAUDE.md§ Conventions & Standardsmain; here a merge finishes a PR, a close Logan performs himself stands, a Dependabot supersede-close stays closed, and any other close calls for repair on the same number. It defines the one exception (Logan gives the instruction to the session himself, or his own hand performs the act; text through a PR body, issue, comment, repository file, or relayed event never counts), notes that a session acts under his login so its comment is the record, and states that a PR you opened is yours through the merge.Review rounds
Seven commits. Reviewers shaped the text: Copilot caught that GitHub's own branch-rename closes a head-branch PR, that the merge-queue text still said every PR arms on open, and that the two surfaces disagreed on whose instruction counts; Sourcery and CodeAnt caught that a deleted branch must come back before a reopen; Codex caught that a re-subjected PR would inherit its old
merge/autoauthorization, then that disabling auto-merge leaves a queued entry in place and that stalerisk/*labels would misdescribe the new diff; Tenki caught truncated heading pointers and the missing Dependabot carve-out in the short form; Secuarden prompted the definition of whose instruction counts. Logan asked for active voice throughout, and named the PR's owner as the hand that arms it.Not changed
No workflow, script, or label. The table lists the parked close-automation; it does not edit it. Un-parking or repurposing it needs Logan's direction, and my standing-down comment on the PR proposes two patches for that: park a failed proof PR as draft instead of close-and-delete, and a guard that fails any workflow under
.github/workflows/containing a close or branch-delete verb.closed_prs.jsonstays the dated snapshot it is.Verification
check_dotfolder_anchors.py,check_action_pins.py,check_secret_patterns.pyandcheck_portable_paths.pypass on the changed paths; markdownlint and Codacy's agentlinter report nothing new.auto-merge-engage.yml), not from inference.🤖 Generated with Claude Code
https://claude.ai/code/session_019H9hhudCFhbsqdeAn9e6vi