OSAC-4808: Classify substantive EP changes as ask

[ItzikEzra-rh]

Summary

• classify substantive PRD and enhancement-proposal changes in osac-project/enhancement-proposals as risk:ask
• assess the impact of approving product and architecture decisions instead of only the runtime impact of a Markdown diff
• keep typo, formatting, link, and other meaning-preserving corrections eligible for risk:ship
• leave classification behavior unchanged for other repositories

Motivation

PR osac-project/enhancement-proposals#240 was classified as risk:ship because it was documentation-only, despite defining user-facing requirements and acceptance criteria that require human review.

Validation

• yamllint --strict .
• CodeRabbit v2 JSON schema validation
• git diff --check

Documentation and CI

• Updated .coderabbit.yaml for osac-project/enhancement-proposals.
• Substantive PRD and enhancement-proposal changes now use risk:ask.
• The classification covers product decisions, architecture decisions, user-facing requirements, and acceptance criteria.
• Meaning-preserving edits remain eligible for risk:ship.
• Risk classification for other repositories remains unchanged.
• Validation includes yamllint --strict ., CodeRabbit v2 JSON schema validation, and git diff --check.

Backward compatibility

• No runtime, API, database, authentication, deployment, or test behavior changes.
• The change affects risk-label classification only.

Risk classification

• Applied label: risk:ask.
• Criteria: The change modifies risk-classification instructions for substantive PRDs and enhancement proposals.
• These documents can define product and architecture decisions, user-facing requirements, and acceptance criteria.
• Meaning-preserving edits do not qualify for risk:ask; typos, formatting changes, and link corrections remain eligible for risk:ship.
• The change does not qualify for risk:show because substantive document changes require explicit risk assessment.

[coderabbitai]

Warning

This pull request changes a CodeRabbit configuration file. Because it comes from a fork or its author is not a repository collaborator, reviews use only the configuration from the target branch. The proposed configuration will take effect after it is merged.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e4214e4e-d835-405d-b07e-11004c234b41

📥 Commits

Reviewing files that changed from the base of the PR and between 7c07045 and 90c2948.

📒 Files selected for processing (1)

• .coderabbit.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The .coderabbit.yaml rules distinguish substantive enhancement proposals from meaning-preserving corrections. Substantive product and architecture changes route to risk:ask, while eligible corrections retain lower-risk handling.

Changes

Enhancement proposal risk routing

Layer / File(s)	Summary
Risk classification rules .coderabbit.yaml	risk:ship excludes substantive changes to requirements, scope, interfaces, architecture, security, compatibility, risks, dependencies, and design decisions. risk:show excludes PRDs and design documents in osac-project/enhancement-proposals. risk:ask assigns substantive changes to human review and permits meaning-preserving corrections.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 90c29

This updates proposal-change routing so substantive product and architecture edits require review while meaning-preserving corrections retain lower-risk handling. No current merge-readiness risk is identified.

Suggested labels: risk:ask

Suggested reviewers: sk-ilya

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: classifying substantive enhancement-proposal changes as risk:ask.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	PASS: The pull request changes only .coderabbit.yaml risk-classification prose. The added and modified lines contain no hardcoded API keys, tokens, passwords, private-key material, credential-bearin…
No-Weak-Crypto	✅ Passed	PASS — The pull request changes only .coderabbit.yaml risk-labeling prose. The added lines contain no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB usage, custom cryptography, or secret comparisons. The …
No-Injection-Vectors	✅ Passed	PASS. The pull request changes only .coderabbit.yaml. The added lines are natural-language risk-label instructions for PRDs and design documents. They add no SQL, shell, eval/exec, deserialization, …
Container-Privileges	✅ Passed	PASS: The pull request changes only .coderabbit.yaml risk-labeling instructions. The diff adds PRD/design-document classification text and does not add or modify a container or Kubernetes manifest. …
No-Sensitive-Data-In-Logs	✅ Passed	PASS. The pull request changes only .coderabbit.yaml risk-classification instructions. The added lines define substantive PRD and design-document criteria. They add no logging implementation, log st…
Ai-Attribution	✅ Passed	AI use is evidenced by the PR commit trailer Assisted-by: OpenAI Codex <noreply@openai.com>. The commit author is iezra@redhat.com. The PR range contains no AI-related Co-Authored-By trailer. Th…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: No-Hardcoded-Secrets

Explanation

PASS: The pull request changes only .coderabbit.yaml risk-classification prose. The added and modified lines contain no hardcoded API keys, tokens, passwords, private-key material, credential-bearing URLs, or long base64/hex strings. They also add no variable assignments.

Full details: No-Weak-Crypto

Explanation

PASS — The pull request changes only .coderabbit.yaml risk-labeling prose. The added lines contain no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB usage, custom cryptography, or secret comparisons. The weak-crypto instruction text remains unchanged from origin/main; its presence is policy text, not cryptographic usage.

Full details: No-Injection-Vectors

Explanation

PASS. The pull request changes only .coderabbit.yaml. The added lines are natural-language risk-label instructions for PRDs and design documents. They add no SQL, shell, eval/exec, deserialization, os.system, or dangerouslySetInnerHTML behavior, and they process no user input. Existing security-rule text remains configuration prose, not executable code.

Full details: Container-Privileges

Explanation

PASS: The pull request changes only .coderabbit.yaml risk-labeling instructions. The diff adds PRD/design-document classification text and does not add or modify a container or Kubernetes manifest. The privilege terms found in .coderabbit.yaml are review instructions, not container settings. No privileged: true, host namespace setting, SYS_ADMIN capability, root execution setting, or allowPrivilegeEscalation: true was introduced in a container/Kubernetes manifest.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS. The pull request changes only .coderabbit.yaml risk-classification instructions. The added lines define substantive PRD and design-document criteria. They add no logging implementation, log statement, or sensitive data. Existing logging and secret-related text is unchanged.

Full details: Ai-Attribution

Explanation

AI use is evidenced by the PR commit trailer Assisted-by: OpenAI Codex <noreply@openai.com>. The commit author is iezra@redhat.com. The PR range contains no AI-related Co-Authored-By trailer. This satisfies the required attribution and avoids the prohibited trailer.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}