fix(fix-agent): sync package registry policy with code agent

[ascerra]

Summary

Fixes #532 by syncing policies/fix.yaml package_registries with policies/code.yaml, and updating the header comment to describe shared needs without implying the two files must stay identical.

Also fixes a pre-existing gap on registry.yarnpkg.com in both policy files (allow_encoded_slash: true, same class of issue as #531) — called out in review because adding the yarn endpoint to fix without the flag would have copied the latent bug from code.

Companion docs: fullsend-ai/fullsend#6111.

Changes

policies/fix.yaml (#532)

• Add missing registry.yarnpkg.com endpoint (with allow_encoded_slash: true)
• Add missing npx, yarn, yarnpkg, and pnpm binary allowlist entries
• Revise header comment to allow intentional divergence from code agent policy

policies/code.yaml (review follow-up, d44ce69)

• Add allow_encoded_slash: true to the existing registry.yarnpkg.com endpoint — same Code agent can't access npmjs #531 rationale for scoped yarn paths; was already on main without the flag

Test plan

• Verified fix package_registries endpoints and binaries match code (baseline: main at time of Fix agent policy gaps with code agent #532 fix, plus the shared allow_encoded_slash correction on yarnpkg in both files)
• No policy-parity test added — code and fix are separate harnesses and may diverge intentionally over time

[qodo-code-review]

PR Summary by Qodo

Clarify fix agent policy overlap with code agent policy

📝 Documentation 🕐 Less than 5 minutes

AI Description

• Reword the policies/fix.yaml header to describe shared sandbox/network needs with the code
 agent.
• Avoid implying the two policy files must remain identical while allowing intentional divergence.

High-Level Assessment

The PR’s approach is optimal for the goal: clarify intent via a precise header comment without changing policy behavior. Alternatives (e.g., enforcing policy synchronization via tooling) are out of scope for a wording-only clarification and would add unnecessary complexity.

Files changed (1) +5 / -4

Documentation (1) +5 / -4

fix.yamlClarify fix policy header to allow divergence from code policy +5/-4

Clarify fix policy header to allow divergence from code policy

• Updates the header comment to describe shared network/sandbox requirements with the code agent policy while explicitly allowing fix-specific divergence. No functional policy rules are changed.

policies/fix.yaml

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:32 PM UTC · Completed 1:43 PM UTC

Commit: 4bf08a2 · View workflow run →

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] policies/fix.yaml, policies/code.yaml — Both files are under the protected path policies/. The PR links to issue Fix agent policy gaps with code agent #532 and the description explains the rationale for syncing the fix agent's package registry policy with the code agent's, and adding allow_encoded_slash: true to the registry.yarnpkg.com entry in code.yaml. Human approval is always required for protected-path changes, regardless of context.

Previous run

Review

Findings

Medium

• [protected-path] policies/fix.yaml, policies/code.yaml — Both files are under the protected path policies/. The PR links to issue Fix agent policy gaps with code agent #532 and the description explains the rationale for syncing the fix agent's package registry policy with the code agent's. Human approval is always required for protected-path changes, regardless of context.

Low

• [scope-intent-misalignment] policies/fix.yaml:6 — The header comment change introduces "may diverge when fix-specific access is required," which softens the synchronization commitment from issue Fix agent policy gaps with code agent #532. The issue states "they will always need access to the same tools" and prefers a shared policy. However, the PR body explicitly states the intent to describe shared needs without implying the two files must stay identical, which is a reasonable architectural position given the files are separate.

Previous run (2)

Review

Findings

Medium

• [protected-path] policies/fix.yaml — This file is under the protected path policies/. The PR links to issue Fix agent policy gaps with code agent #532 and the description explains the rationale for syncing the fix agent's package registry policy with the code agent's. Human approval is always required for protected-path changes, regardless of context.

Low

• [scope-intent-misalignment] policies/fix.yaml:6 — The header comment change introduces "may diverge when fix-specific access is required," which softens the synchronization commitment from issue Fix agent policy gaps with code agent #532. The issue states "they will always need access to the same tools" and prefers a shared policy. However, the PR body explicitly states the intent to describe shared needs without implying the two files must stay identical, which is a reasonable architectural position given the files are separate.

---

Labels: PR modifies fix agent sandbox policy file

Previous run (3)

Review

Findings

Medium

• [protected-path] policies/fix.yaml — This file is under the protected path policies/. The PR links to issue Fix agent policy gaps with code agent #532 and explains the rationale for the change (clarifying the header comment to allow intentional policy divergence). Human approval is always required for protected-path changes, regardless of the documentation-only nature of this change.

---

Labels: PR updates only a documentation comment in the fix agent sandbox policy file.

[waynesun09]

Automated review findings (review-only sweep).

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 11:44 AM UTC · Ended 11:49 AM UTC

Commit: c4f23c5 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:50 AM UTC · Completed 12:01 PM UTC

Commit: 985bc67 · View workflow run →

[waynesun09]

Automated review findings (review-only sweep).

[MEDIUM] No automated regression test guards package_registries parity (triage's proposed test was never added) (policies/fix.yaml, around the package_registries: block, line 88 — outside this PR's diff hunks so it can't be attached inline)

This is the third time policies/fix.yaml and policies/code.yaml have drifted apart (issue #532 references #399 and #531 as prior instances). Issue #532's triage comment supplied a ready-to-use pytest test comparing package_registries host/binary sets between the two files specifically to prevent recurrence, but this PR (verified at head 985bc67) does not add it, and none of the repo's existing scripts (script-test.yml target scripts, e.g. process-fix-result-test.py, post-fix-test.sh) or workflows (lint.yml, functional-tests.yml, script-test.yml) perform any such comparison. The maintainer's Aug-12 comment on #532 addresses this only via docs (fullsend#6111) and per-repo harness-override guidance, not via an in-repo CI check. Since this PR's own header-comment change now explicitly permits future intentional divergence ("may diverge when fix-specific access is required"), there is no guardrail left to distinguish a future accidental drift from a sanctioned one.

Suggestion: Add the test proposed in the issue-532 triage comment (comparing endpoint hosts and binary paths per network_policies.package_registries block between policies/code.yaml and policies/fix.yaml) as a script-test or pytest case wired into script-test.yml or functional-tests.yml, so a future silent drift fails CI instead of shipping quietly.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:35 AM UTC · Completed 1:48 AM UTC

Commit: d44ce69 · View workflow run →

[waynesun09]

Automated review findings (review-only sweep).

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:16 PM UTC · Completed 3:29 PM UTC

Commit: 76b7bf5 · View workflow run →

[waynesun09]

Verified all review findings are addressed at head 76b7bf5:

• [HIGH] Missing registry.yarnpkg.com endpoint and npx/yarn/yarnpkg/pnpm binaries in policies/fix.yaml — fixed in c4f23c5, confirmed in the diff.
• [MEDIUM] allow_encoded_slash: true missing on the yarnpkg endpoint (same class as #531) — fixed in d44ce69 in both fix.yaml and code.yaml, confirmed in the diff.
• [MEDIUM] ADR 0065 string coupling — resolved in fullsend-ai/fullsend#6111 (e5c996fa): original Context quote restored, divergence documented in a ## Notes annotation instead.
• [MEDIUM] PR body omitting the code.yaml behavior change — body now documents it explicitly with rationale.

The parity-test suggestion from #532 triage was discussed and declined by the maintainer as intentional (code and fix harnesses may diverge by design) — noted, not blocking.

CI is green at head. Approving.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 3:37 PM UTC · Completed 3:51 PM UTC

Commit: 76b7bf5 · View workflow run →

[fullsend-ai-retro]

Retro: PR #766 — fix(fix-agent): sync package registry policy with code agent

Timeline

1. Jul 29: Issue #532 filed — fix agent policy missing registry.yarnpkg.com endpoint and npx/yarn/yarnpkg/pnpm binaries present in code agent policy. Triage agent produced a thorough summary with specific missing entries and a proposed test. Code agent failed due to OCI sandbox creation error (infrastructure, not agent logic). Issue sat for ~2 weeks.
2. Aug 12: Human (ascerra) opened PR #766 as a comment-only change — replacing the header "Identical to the code agent policy" with wording allowing intentional divergence. fullsend-ai-review[bot] ran automatically (run 31601835105) and found only a [protected-path] (MEDIUM) gate and a [low] scope-intent-misalignment observation. A separate manual review sweep (waynesun09) caught the critical gap: the PR reframed Fix agent policy gaps with code agent #532 as intentional design without fixing the actual missing entries. Severity: HIGH.
3. Aug 13: Author addressed the HIGH finding — added missing registry.yarnpkg.com endpoint and npx/yarn/yarnpkg/pnpm binaries. PR retitled to fix(fix-agent): sync package registry policy with code agent and body updated to Fixes #532. A second manual sweep caught that the newly-added registry.yarnpkg.com lacked allow_encoded_slash: true (same bug class as #531).
4. Aug 14: Author fixed allow_encoded_slash in both fix.yaml and code.yaml. A third sweep flagged that the PR body omitted the code.yaml behavior change. Author updated the body, waynesun09 approved with all findings verified, PR merged.

Review quality

fullsend-ai-review[bot] ran 5 times (4 successful, 1 cancelled) across the PR lifecycle and produced zero actionable findings. Its findings were limited to the [protected-path] governance gate and a [low] scope-intent-misalignment that accepted the author's "intentional divergence" framing at face value.

The manual review sweeps (waynesun09, labeled "Automated review findings (review-only sweep)") produced 5 findings, 4 of which led directly to code or documentation changes — including the HIGH finding that transformed the PR from a cosmetic comment change into the substantive policy fix that closed #532.

The bot's [low] scope-intent-misalignment finding was in the right vicinity — it noticed the comment softened the synchronization commitment. But it rated this LOW and accepted the re-framing as "a reasonable architectural position" without verifying whether the underlying issue (#532) was actually addressed by the diff. The manual sweep checked the open issue's requirements against the actual diff and correctly escalated to HIGH.

Evidence for existing issues

• #244 (cross-agent policy consistency): This PR is the third instance of cross-agent policy drift in policies/ (Unnecessary user distinction between code and fix agent #399, Code agent can't access npmjs #531, Fix agent policy gaps with code agent #532). The review bot did not detect the fix.yaml/code.yaml consistency gap despite directly reviewing a change to fix.yaml. This validates Review agent should detect cross-agent policy consistency gaps in policies/ changes #244's proposal for an intent-coherence consistency check across policy files.
• #725 (verify implementation against linked issue AC): The bot's failure to verify the diff addressed Fix agent policy gaps with code agent #532's requirements is a concrete instance of the gap Correctness sub-agent should verify implementation against linked issue acceptance criteria #725 describes, though Correctness sub-agent should verify implementation against linked issue acceptance criteria #725 targets the correctness sub-agent rather than intent-coherence.
• #713 (intent-coherence cross-reference of linked issue AC): Related — this issue proposes that intent-coherence should read linked issue AC and elevate severity when deviations occur, though its focus is specifically on dependent-issue impact.

Code agent infrastructure failure

The code agent's failure on #532 was a sandbox OCI runtime error (crun: unknown version specified), not an agent behavior issue. The issue then sat for ~2 weeks until a human picked it up. This is an infrastructure resilience concern outside the agents repo's scope.

Proposals filed

• Intent-coherence sub-agent should detect doc-only reframing of open issues as non-substantive resolution (in fullsend-ai/agents)