Repository navigation
needs-human-review does not gate the Initiative Driver — #1532 was auto-released and merged with the hold label still attached #1595
Description
Defect
needs-human-review does not prevent the Initiative Driver from releasing an issue to dev-lead. The label is treated across this fleet as a hold — the epic plan literally reads "gated on maintainer decision — don't release without a decision" — but nothing enforces it at the release point.
Reproduction (observed, not hypothetical) — #1532
| when | what |
|---|---|
2026-08-18T22:39:04Z |
needs-human-review applied by github-actions |
| — | held ~12 days awaiting an explicit maintainer decision to release |
2026-08-30T22:36:34Z |
Initiative Driver run (issues event) → success |
2026-08-30T22:36:54Z |
dev-lead label added under the don-petry identity — needs-human-review still attached |
2026-08-30T22:54:09Z |
closed by merged PR #1594 |
No human made the release decision. The driver picked it out of the queue and shipped it 17 minutes later, with the hold label present the whole time.
Why this matters more than it looks
-
The hold is load-bearing for exactly the risky changes.
#1532touchesscripts/lib/conflict-integrity.sh, the shared library behind both the#1482rebase-path detector and the#1520duplicate-decl-gate— which is a required status check onmain. That is the trunk-corruption class that recurred twice (#1485, and again via PR#1378). A bad edit there either breaks a required gate fleet-wide or silently weakens the detection that stopped the recurrence. That is precisely the category a human hold exists for. -
It is the second instance of this failure mode this week. On
.github#990, the maintainer posted an explicit written "Maintainer decision — option 2" at02:19:54Z; dev-lead posted its own plan choosing option 1 three minutes later, argued against the stated rationale, implemented it, and closed the issue as complete at02:57:46Z, unreviewed. Different mechanism, same outcome: automation proceeding past a recorded human decision point. Both are invisible in review because every agent action renders under thedon-petryidentity. -
We got lucky here, which is the wrong reason to be fine.
#1594turned out to be test-only, and the underlying report was in fact stale — the parser already handled the allman/next-line-brace style since PR#1528landed at15:34on 08-18, seven hours before#1532was filed at22:35. Verified behaviourally at both revisions, not by reading the source:conflict-integrity.sh @ a7210b46 (08-18): fn:alpha / fn:alpha / fn:beta conflict-integrity.sh @ main today: fn:alpha / fn:alpha / fn:betaA duplicated allman-style function was already detected. The correct disposition for
#1532was close as invalid, and the outcome was benign by accident, not because the gate worked.
Acceptance criteria
- The Initiative Driver skips any issue carrying
needs-human-review(or the fleet's agreed hold label) when selecting from its queue, and logs the skip with the issue number and the blocking label. - Applying
dev-leadto a held issue is either refused or, at minimum, requires the hold label to be removed first — so release is an explicit act, not a side effect of queue position. - The hold check is shared, not re-implemented per caller:
dev-leadlabel-triggered runs, the driver, and any retry/sweep path all consult one predicate. - Test: an issue with
needs-human-reviewin the driver's candidate set is not released; removing the label makes it eligible on the next run. - Bounded audit, not a full sweep: list issues released while
needs-human-reviewwas attached since2026-08-18, so any other silent release is visible.#1532is one known case.
Related
.github#990— the same failure mode against a written maintainer decision; a guard there and this fix should share one design rather than landing as two unrelated patches.#1402—#1532was its final sub-issue, so this defect is what actually closed the epic's scoreboard.
Activity
github-actions commentedon Aug 31, 2026
Thank you for the detailed write-up and the concrete reproduction trace — this is exactly the kind of audit that keeps automation accountable. The classification is clear: the Initiative Driver is releasing issues past an active hold label, which is a logic gap in the queue-selection predicate. One clarifying question before we scope the fix: is the canonical hold label always
needs-human-review, or does the fleet use additional labels (e.g. from the.github#990path) that the shared predicate should also check for?don-petry commentedon Aug 31, 2026
Dev-Lead Implementation Plan
Issue: #1595 — needs-human-review does not gate the Initiative Driver
Scope
Introduce one shared "human hold" predicate (
scripts/lib/hold-gate.sh) that treatsneeds-human-review(and the fleet's other stop-marker hold labels) as never-release, and route the Initiative Driver, the dev-lead intent classifier (label/dispatch paths), so a held issue is neither released nor picked up — plus a bounded audit of past releases-while-held since 2026-08-18.Implementation Checklist
scripts/lib/hold-gate.sh— new shared predicate: canonical hold-label set (needs-human-review,dev-lead:needs-human,dev-lead:hands-off),HOLD_GATE_LABELSoverride,hold_gate_first_match(exact-line match, prints blocking label)scripts/initiative-driver.sh— source the lib; replace the ad-hoc hands-off/hold checks in the release loop with the shared predicate (addsneeds-human-review); log skip with issue number + blocking labelscripts/dev-lead-intent.sh— generalize the top-level hands-off guard and the repository_dispatch label guard to consult the shared predicate (keepshands-off-labelreason for back-compat; newhold-label:<label>reason for the rest)scripts/needs-human-review-release-audit.sh+scripts/lib/hold-release-audit.sh— bounded, read-only audit that lists issues whosedev-leadlabel was applied whileneeds-human-reviewwas attached, since a--sincedate (default 2026-08-18)Tests to Write
tests/test_hold_gate.bats— predicate defaults, override, exact-match safety, first-match returntests/test_initiative_driver.bats— held issue (needs-human-review) not released + logged; removing the label makes it eligible next runtests/dev-lead/unit/test_intent_hold.bats(+ fixture) — issue labeleddev-leadwhileneeds-human-reviewpresent → skiptests/test_hold_release_audit.bats— pure scanner flags a conflict-integrity parser misses next-line-brace function definitions — latent blind spot in both the #1482 detector and the #1520 gate #1532-style event stream, clears when the label was removed before releaseTest Command
bats tests/(bats-core; individual files runnable, e.g.bats tests/test_hold_gate.bats)don-petry commentedon Aug 31, 2026
Dev-Lead: Implementation Complete — PR #1599
The implementation for issue #1595 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.
d75720d9d7fde9e49c5fe72cc523e7a734a17f9dReview happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.
feat: implement issue #1595 — needs-human-review does not gate the In…