From 91f0ffe51cc51ccfb41249f7739c56fd5c74cb54 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 20 Feb 2026 23:03:18 +0000 Subject: [PATCH 1/3] Initial plan From 0b93564fc40a759919ba348bf658c1ef3ee6ff54 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 20 Feb 2026 23:16:09 +0000 Subject: [PATCH 2/3] Phase-2: queue idempotency, no-silent-swallow, label-sync trigger, PR template, AGENTS warning, agent least-privilege Co-authored-by: Prekzursil <54636077+Prekzursil@users.noreply.github.com> --- .github/agents/security-sheriff.agent.md | 1 + .github/agents/test-specialist.agent.md | 1 + .github/pull_request_template.md | 30 ++++++++++++++++++++---- .github/workflows/agent-label-sync.yml | 3 +++ .github/workflows/agent-task-queue.yml | 10 ++++++-- AGENTS.md | 7 +++++- 6 files changed, 45 insertions(+), 7 deletions(-) diff --git a/.github/agents/security-sheriff.agent.md b/.github/agents/security-sheriff.agent.md index 78a51df5..6d841d5d 100644 --- a/.github/agents/security-sheriff.agent.md +++ b/.github/agents/security-sheriff.agent.md @@ -9,6 +9,7 @@ You are the Risk Reviewer for security. Rules: - Flag risky changes to auth, secrets, or privilege boundaries. - Prefer least-privilege and explicit error handling. +- `execute` permission is scoped to: `bash scripts/verify` and read-only diagnostic commands only. - Add or improve tests for security-sensitive logic when possible. - Run `bash scripts/verify` for any change you propose. - Do not approve bypassing human review for high-risk changes. diff --git a/.github/agents/test-specialist.agent.md b/.github/agents/test-specialist.agent.md index 87d5a5e5..1124d9db 100644 --- a/.github/agents/test-specialist.agent.md +++ b/.github/agents/test-specialist.agent.md @@ -9,6 +9,7 @@ You are the Deterministic Verifier. Rules: - Prefer tests before production edits. - Keep changes minimal and scoped. +- `execute` permission is scoped to: `bash scripts/verify` and test runner commands only. - Run `bash scripts/verify` before handoff. - Report exact command output in the PR Evidence section. - If verification fails, provide a concise failure diagnosis. diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index eb98ca1d..827e736b 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,5 +1,27 @@ -## Related issues / PRs. Summarize issues. -- # +## Summary -## Summarize Changes -1. +- What changed? +- Why was it needed? + +## Risk + +- Risk level: `low | medium | high` +- Regression surface (frontend/backend/infra/docs/security/release): +- Security/runtime safety impact: + +## Evidence + +- Deterministic verification command: `bash scripts/verify` +- Command output summary: +- Any justified skips: + +## Rollback + +- Rollback command or steps: +- Data/schema/runtime rollback impact: + +## Scope Guard + +- [ ] Change is minimal and task-focused +- [ ] No unrelated refactors included +- [ ] No secrets or private tokens added diff --git a/.github/workflows/agent-label-sync.yml b/.github/workflows/agent-label-sync.yml index 290e09f0..71611c4b 100644 --- a/.github/workflows/agent-label-sync.yml +++ b/.github/workflows/agent-label-sync.yml @@ -3,6 +3,9 @@ name: Agent Label Sync on: workflow_dispatch: push: + branches: + - main + - master paths: - '.github/workflows/agent-label-sync.yml' diff --git a/.github/workflows/agent-task-queue.yml b/.github/workflows/agent-task-queue.yml index 1c8b5227..bcd9278c 100644 --- a/.github/workflows/agent-task-queue.yml +++ b/.github/workflows/agent-task-queue.yml @@ -46,6 +46,12 @@ jobs: c.body?.includes(`- #${issue_number}:`) ); + // Idempotency guard: issue is already fully transitioned; skip all mutations. + if (hadInProgress && existingContract) { + core.info("Issue already in-progress with existing contract; skipping."); + return; + } + let addedInProgress = false; let removedReady = false; @@ -115,7 +121,7 @@ jobs: name: "agent:in-progress", }); } catch (rollbackError) { - core.warning(`Rollback remove agent:in-progress failed: ${rollbackError.message}`); + core.error(`Rollback remove agent:in-progress failed: ${rollbackError.message}`); } } @@ -128,7 +134,7 @@ jobs: labels: ["agent:ready"], }); } catch (rollbackError) { - core.warning(`Rollback add agent:ready failed: ${rollbackError.message}`); + core.error(`Rollback add agent:ready failed: ${rollbackError.message}`); } } diff --git a/AGENTS.md b/AGENTS.md index 4a44a1a9..1e94c180 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -27,4 +27,9 @@ bash scripts/verify - Queue workflow will post a task packet and notify `@copilot`. ## Queue Trigger Warning -Applying label `agent:ready` triggers the queue workflow immediately. + +> ⚠️ **Applying label `agent:ready` triggers the queue workflow immediately.** +> The workflow will transition the issue to `agent:in-progress`, post an Execution Contract +> comment, and notify `@copilot`. This action cannot be silently undone — any rollback +> failure is surfaced as a workflow error. Do not apply `agent:ready` unless the issue is +> fully scoped and ready for autonomous implementation. From 0cd46203ad562c61321049fd429547f5aba92c08 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 20 Feb 2026 23:59:29 +0000 Subject: [PATCH 3/3] fix: consume agent:ready in idempotency guard to prevent ready+in-progress coexistence Co-authored-by: Prekzursil <54636077+Prekzursil@users.noreply.github.com> --- .github/workflows/agent-task-queue.yml | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/.github/workflows/agent-task-queue.yml b/.github/workflows/agent-task-queue.yml index bcd9278c..32dfa57e 100644 --- a/.github/workflows/agent-task-queue.yml +++ b/.github/workflows/agent-task-queue.yml @@ -46,9 +46,24 @@ jobs: c.body?.includes(`- #${issue_number}:`) ); - // Idempotency guard: issue is already fully transitioned; skip all mutations. + // Idempotency guard: issue is already fully transitioned; skip label/comment mutations + // but still consume agent:ready to prevent ready+in-progress co-existence. if (hadInProgress && existingContract) { - core.info("Issue already in-progress with existing contract; skipping."); + if (hadReady) { + try { + await github.rest.issues.removeLabel({ + owner, + repo, + issue_number, + name: "agent:ready", + }); + } catch (error) { + if (error.status !== 404) { + throw error; + } + } + } + core.info("Issue already in-progress with existing contract; skipping duplicate enqueue."); return; }