Skip to content

feat: implement issue #1997 — Lower the advisory quorum to 5: drop the three reviewers that produce no countable signal (re-file of #1894 AC #3) - #2003

Merged
don-petry merged 3 commits into
mainfrom
dev-lead/issue-1997-20261001-1858
Oct 1, 2026
Merged

don-petry merged 3 commits into
mainfrom
dev-lead/issue-1997-20261001-1858

Conversation

@don-petry

@don-petry don-petry commented Oct 1, 2026 •

Copy link
Copy Markdown
Collaborator

Problem

Lower the advisory quorum to 5: drop the three reviewers that produce no countable signal (re-file of #1894 AC #3)

From the issue: As the fleet operator, I want the advisory quorum to count only reviewers that actually produce a countable signal, so that pr-review stops reaching approval through a timeout fallback on every single PR.

Risk

Low — changes automation shell logic under scripts/, covered by shellcheck (--severity=warning) and the bats suite.

Test plan

Tests added/updated: tests/dev-lead/unit/test_advisory_review_gate.bats,tests/test_reviewer_sources.bats. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the bats suite runs in CI.

Rollback

Revert this PR. No non-revertible side effects (no tags, migrations, or external state).

Monitoring

This PR's Lint (shellcheck) and bats checks show pass/fail; watch subsequent dev-lead / pr-review runs for behavioral regressions.

Closes #1997

Review in cubic

…e three reviewers that produce no countable signal (re-file of #1894 AC #3)
@chatgpt-codex-connector

This comment has been minimized.

@qodo-code-review

This comment has been minimized.

@coderabbitai

This comment has been minimized.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #2003
No changes were committed, but the PR still can't be marked done: required check SonarCloud is still pending. The retry cron will re-attempt automatically. Next attempt after: 2026-10-01T20:12:09Z

@don-petry

Copy link
Copy Markdown
Collaborator Author

Note

@don-petry I reviewed this PR and no code changes were needed, but I can't mark it done yet: required check SonarCloud is still pending. I'll re-check automatically.
Next attempt after: 2026-10-01T20:12:09Z

@don-petry
don-petry enabled auto-merge (squash) October 1, 2026 19:42
@don-petry

Copy link
Copy Markdown
Collaborator Author

No description provided.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the advisory review gate configuration by removing three inactive bots (Copilot PR Reviewer, Codex, and Qodo Merge) from the active advisory-wait set, reducing the count from 8 to 5. The fallback bot list in review-one-pr.sh has been updated accordingly, and a new consistency test has been added to prevent future configuration drift. Corresponding unit tests have also been updated to reflect these changes. There are no review comments, and I have no additional feedback to provide.

Comment thread scripts/review-one-pr.sh Outdated
@codeant-ai

codeant-ai Bot commented Oct 1, 2026

Copy link
Copy Markdown

CodeAnt Nitpicks

1 code suggestion

1. The first grep match is the explanatory comment's _adv_bots='[…] example, so jq parses prose instead of the fallback JSON and the test fails.

Logic error · tests/test_reviewer_sources.bats:231

@donpetry-bot

Copy link
Copy Markdown
Contributor

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-01T20:43:02Z.

@don-petry
don-petry disabled auto-merge October 1, 2026 19:43
@donpetry-bot

Copy link
Copy Markdown
Contributor

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-01T20:43:04Z.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning
Issues addressed: 0
Skipped (informational): 0
No changes needed — Quality Gate passed with zero issues found.
```

@don-petry
don-petry enabled auto-merge (squash) October 1, 2026 19:43
@donpetry-bot

donpetry-bot commented Oct 1, 2026 •

Copy link
Copy Markdown
Contributor
Superseded by automated re-review at 86b3029c8b5636362520aff92295faa1f54baa2b — click to expand prior review.

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 86b3029c8b5636362520aff92295faa1f54baa2b
Cascade: triage → deep+duck (triage: haiku 4.5 [sonnet 5.5, sonnet 5] → deep: opus 5.5 [opus 4.8, sonnet 5.5] + duck: gemini-3.8-flash [sonnet 5.5] → audit: opus 5.5 [opus 4.8, opus 4.7])

Summary

Both reviewers rate the PR MEDIUM and escalate, so they fully agree. Both found the registry, fallback map, literal and tests consistent and the CodeAnt grep nit unfounded, but the required bats check was still pending. The deep reviewer alone found the main issue: shrinking ADVISORY_BOTS also drops copilot, codex and qodo findings from the triage, deep and audit feedback filter, and a code change is needed to fix it. The rubber duck alone asked for confirmation that the codeant RATE_LIMITED test passes, and noted that dropped bots can still block through the thread gate.

Cross-engine agreement

full

Downstream impact

This change is consumed by 8 downstream repo(s) that pin the affected reusable workflow / lib / prompt. Impacted consumers:

Impacted shared surfaces:
  - .github/workflows/dev-lead-reusable.yml
  - .github/workflows/pr-review.yml

Impacted consumers (8, fetching up to 10):
  - petry-projects/.github (pins .github/workflows/dev-lead-reusable.yml)
      .github/workflows/dev-lead.yml
  - petry-projects/.github-private (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review-canary.yml
      .github/workflows/pr-review-trigger.yml
      .github/workflows/test-dev-lead.yml
  - petry-projects/ContentTwin (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review.yml
  - petry-projects/TalkTerm (pins .github/workflows/dev-lead-reusable.yml)
      .github/workflows/dev-lead.yml
  - petry-projects/bmad-bgreat-suite (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review.yml
  - petry-projects/broodly (pins .github/workflows/dev-lead-reusable.yml)
      .github/workflows/dev-lead.yml
  - petry-projects/google-app-scripts (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review.yml
  - petry-projects/markets (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review.yml

Findings

  • minor (scripts/review-one-pr.sh:1041): review-one-pr.sh builds _adv_bots from ADVISORY_BOTS (the approval-wait set) and uses it to filter the feedback that reaches the triage, deep and audit tiers. Shrinking ADVISORY_BOTS to 5 silently drops copilot-pull-request-reviewer, chatgpt-codex-connector and qodo-code-review findings from review context on every run, which contradicts the stated intent that they only leave the approval-wait set. Suggested fix: filter by the dev_lead_trusted or all-sources projection, or explicitly document the change.
  • minor (tests/dev-lead/unit/test_advisory_review_gate.bats:544): The rate-limited gate test now relies on codeant-ai's body 'You have reached your usage limit for code reviews.' matching the gate's rate-limit pattern, which differs from the old Codex-specific text. Confirm via the bats result that it classifies as RATE_LIMITED.
  • info (tests/test_reviewer_sources.bats:231): CodeAnt's nitpick that the grep could match an explanatory comment before the real assignment is refuted. Only line 1051 of review-one-pr.sh matches, and the extraction equals reviewer_sources_advisory_gate_logins.
  • info (tests/test_reviewer_sources.bats:231): The extraction grep -oE "_adv_bots='\[[^]]*\]'" | head -1 is brittle if a comment containing that exact text is added later. Anchoring on ^ _adv_bots= would harden it.
  • info (tests/dev-lead/unit/test_advisory_review_gate.bats:495): Issue Lower the advisory quorum to 5: drop the three reviewers that produce no countable signal (re-file of #1894 AC #3) #1997 AC Optimize review: small-PR and incremental fast paths #4 (derive the count rather than hardcoding it) is only partly met. The unreadable-registry test asserts the literal BOTS=5, and the count could be derived with reviewer_sources_advisory_gate_logins | wc -l. The PR body also does not say that approval-diagnostic.sh is absent from this branch.
  • info: The required bats check and cubic were still IN_PROGRESS and mergeStateStatus was BLOCKED. bats is not installed in the review sandbox, so the suites were not run in full.
  • info (scripts/lib/reviewer-sources.tsv:51): Dropped bots stay dev-lead-trusted and still create threads, so their unresolved threads still block via the thread gate. Only the wait for their review is removed, so a late copilot, codex or qodo review can land after approval.

Reviewed by the PR-review cascade (triage: haiku 4.5 [sonnet 5.5, sonnet 5] → deep: opus 5.5 [opus 4.8, sonnet 5.5] + duck: gemini-3.8-flash [sonnet 5.5] → audit: opus 5.5 [opus 4.8, opus 4.7]). Reply if you need a human review.

Additional tasks

  1. Resolve all unresolved review thread comments from other reviewers
  2. Ensure all CI checks pass after your changes
  3. Rebase on the target branch if behind
  4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

@cubic-dev-ai cubic-dev-ai Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 5 files

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

Comment thread scripts/review-one-pr.sh Outdated
Comment thread scripts/lib/reviewer-sources.tsv
Comment thread tests/test_reviewer_sources.bats Outdated
Comment thread scripts/lib/advisory-review-gate.sh
@don-petry
don-petry disabled auto-merge October 1, 2026 19:49
@donpetry-bot

donpetry-bot commented Oct 1, 2026 •

Copy link
Copy Markdown
Contributor
Superseded by automated re-review at 86b3029c8b5636362520aff92295faa1f54baa2b — click to expand prior review.

Review — fix requested (cycle 2/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 86b3029c8b5636362520aff92295faa1f54baa2b
Review mode: triage-approved (single reviewer)

Summary

The registry change itself is correct: the three rows are flipped, graphite and cubic are untouched, the gate fallback and the _adv_bots literal both match the 5-bot projection, and the tests are updated. CI is green. However, the head SHA is the same one the prior cascade review returned with fix-requested, no new commits have been pushed, and five review threads are still unresolved. One of them is a real behavioral regression in review-one-pr.sh.

Linked issue analysis

Closes #1997. AC1 is met: the three rows are flipped, graphite and cubic stay at advisory_gate=yes, and every rationale records the reason. AC2 is mostly met: the gate fallback and the _adv_bots literal match the registry, and a new consistency test covers the literal. approval-diagnostic.sh is absent from this branch, but the PR body does not say so as the issue asks. AC3 is met: BOTS=5. AC4 is only partly met: the unreadable-registry test still asserts the literal BOTS=5 instead of deriving it. AC5 is met: creates_threads and dev_lead_trusted are unchanged. AC6 is met: there is no closing keyword for #1894. AC5's intent is that the dropped bots "leave the approval-wait set only", but review-one-pr.sh breaks that (see Findings).

Findings

  • minor / blocking (scripts/review-one-pr.sh:1041-1052): _adv_bots is built from ADVISORY_BOTS (the approval-wait set), and it also filters ADVISORY_REVIEW_BODIES, ADVISORY_PR_COMMENTS and ADVISORY_INLINE_COMMENTS, which are fed to the triage, deep and audit tiers. Shrinking ADVISORY_BOTS to 5 means Copilot, Codex and Qodo findings no longer reach review context on any run. That contradicts the issue's statement and this PR's own comment that they "leave only this approval-wait set." The prior cascade review, CodeAnt and cubic all raised this, and it is still unaddressed: there are no new commits since 86b3029c8b5636362520aff92295faa1f54baa2b was reviewed. Fix: filter context by the dev_lead_trusted (or all-sources) registry projection, and keep ADVISORY_BOTS only for the wait gate.
  • unresolved threads: 5 bot review threads are unresolved. 2 are on review-one-pr.sh:1051 (the issue above). 1 is on reviewer-sources.tsv:58 (graphite's check-run signal is uncountable; the issue documents this as a known limitation, so reply and resolve it). 1 is on test_reviewer_sources.bats:238 (head -1 could hide a second stale literal; asserting exactly one match is a cheap hardening). 1 is on advisory-review-gate.sh:41 (no test pins the gate's built-in fallback list against the registry; only the count is asserted). Each one needs a fix, or a reply followed by resolving the thread.
  • info (tests/dev-lead/unit/test_advisory_review_gate.bats:495): AC4 ("nothing hardcodes the count") is only partly met because BOTS=5 is a literal. Deriving it via reviewer_sources_advisory_gate_logins | wc -l would satisfy it.
  • info (PR body): The issue asks the PR to say that approval-diagnostic.sh is absent and therefore skipped. The body does not say this.
  • resolved from prior review: The codeant RATE_LIMITED test question is closed: the bats and unit checks pass. CodeAnt's grep nitpick (that the grep matches a comment) was refuted earlier: the only match is the real assignment.
  • Secret scan: the MCP run_secret_scanning tool is not available in this session. gitleaks CI passed.

CI status

All required checks pass: Lint, shellcheck, ShellCheck, bats, unit, unit-tests, CodeQL, SonarCloud (Quality Gate passed), gitleaks, actionlint, check-model-pins and the stub/structure validators. The dev-lead / review automation runs show CANCELLED/SKIPPED; these are not code checks. One dev-lead/dispatch run is still IN_PROGRESS. mergeStateStatus is BLOCKED (review required).


Reviewed automatically by the PR-review agent (single-reviewer mode: opus 5.5 [opus 4.8, opus 4.7]). Reply if you need a human review.

Additional tasks

  1. Resolve all unresolved review thread comments from other reviewers
  2. Ensure all CI checks pass after your changes
  3. Rebase on the target branch if behind
  4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

@donpetry-bot

donpetry-bot commented Oct 1, 2026 •

Copy link
Copy Markdown
Contributor
Superseded by automated re-review at 2268844dc3ba6bc6b3ae4a87ae827750db32e3cc — click to expand prior review.

Review — fix requested (cycle 3/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 86b3029c8b5636362520aff92295faa1f54baa2b
Cascade: triage → deep+duck (triage: haiku 4.5 [sonnet 5.5, sonnet 5] → deep: opus 5.5 [opus 4.8, sonnet 5.5] + duck: gemini-3.8-flash [sonnet 5.5] → audit: opus 5.5 [opus 4.8, opus 4.7])

Summary

Both reviewers rate risk MEDIUM and agree the registry flip is consistent and CI is green, but they differ on the decision: deep escalates on gates and the rubber duck approves. The reviewers converged on the fragile head -1 grep in the literal-vs-registry test and on graphite's check-run limitation. Their line numbers and category labels differ by one, so these are kept as separate entries. Unique to the deep reviewer: narrowing _adv_bots also drops copilot, codex and qodo findings from the triage feedback, the test hardcodes BOTS=5 against #1997 AC #4, the gate fallback has no drift guard, and 5 review threads are unresolved. Unique to the rubber duck: ADVISORY_REVIEW_GATE.md is stale.

Cross-engine agreement

partial

Downstream impact

This change is consumed by 8 downstream repo(s) that pin the affected reusable workflow / lib / prompt. Impacted consumers:

Impacted shared surfaces:
  - .github/workflows/dev-lead-reusable.yml
  - .github/workflows/pr-review.yml

Impacted consumers (8, fetching up to 10):
  - petry-projects/.github (pins .github/workflows/dev-lead-reusable.yml)
      .github/workflows/dev-lead.yml
  - petry-projects/.github-private (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review-canary.yml
      .github/workflows/pr-review-trigger.yml
      .github/workflows/test-dev-lead.yml
  - petry-projects/ContentTwin (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review.yml
  - petry-projects/TalkTerm (pins .github/workflows/dev-lead-reusable.yml)
      .github/workflows/dev-lead.yml
  - petry-projects/bmad-bgreat-suite (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review.yml
  - petry-projects/broodly (pins .github/workflows/dev-lead-reusable.yml)
      .github/workflows/dev-lead.yml
  - petry-projects/google-app-scripts (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review.yml
  - petry-projects/markets (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review.yml

Findings

  • MINOR (scripts/review-one-pr.sh:1051): _adv_bots drives more than the approval wait. It also filters ADVISORY_REVIEW_BODIES, ADVISORY_PR_COMMENTS and ADVISORY_INLINE_COMMENTS, which become ADVISORY_BOT_FEEDBACK for the cascade tiers. Once the registry flips, copilot, codex and qodo findings drop out of the triage context, which contradicts the PR's 'approval-wait set only' claim and Lower the advisory quorum to 5: drop the three reviewers that produce no countable signal (re-file of #1894 AC #3) #1997 AC feat: add Copilot engine support via REVIEW_ENGINE toggle #5. Split the triage-feedback set from the wait set, or state explicitly that triage feedback narrows too.
  • MINOR (tests/dev-lead/unit/test_advisory_review_gate.bats:495): Lower the advisory quorum to 5: drop the three reviewers that produce no countable signal (re-file of #1894 AC #3) #1997 AC Optimize review: small-PR and incremental fast paths #4 says nothing hardcodes the count. The unreadable-registry test asserts BOTS=5 and NOTICE=9, so it breaks the next time a reviewer is registered. Derive the expected count and membership from reviewer_sources_advisory_gate_logins.
  • MINOR (scripts/lib/advisory-review-gate.sh:41): Nothing checks the members of the gate's built-in fallback ADVISORY_BOTS (_advisory_gate_load_fallback_bots) against the registry. The existing test only checks the registry projection or the count. The literal matches today, but the fallback copy has no drift guard.
  • MINOR (tests/test_reviewer_sources.bats:238): The _adv_bots literal extraction uses grep -oE ... | head -1. If a second literal is added, or a comment contains a matching pattern, the first match is taken and the guard can pass while a stale literal carries the real value. Assert exactly one match or anchor the grep to the assignment line.
  • INFO (tests/test_reviewer_sources.bats:237): The new drift test pipes the grep through head -1, so a second stale _adv_bots literal would go unchecked. There is exactly one match today. Asserting exactly one match would make the guard strict.
  • MINOR (.claude/pr-review-agent/ADVISORY_REVIEW_GATE.md:246): ADVISORY_REVIEW_GATE.md still documents Copilot, Codex and Qodo as advisory-gate bots and shows the old ADVISORY_BOTS map. It is stale after Lower the advisory quorum to 5: drop the three reviewers that produce no countable signal (re-file of #1894 AC #3) #1997.
  • MINOR: 5 advisory review threads are open at the current head with no reply or resolution: codeant review-one-pr.sh:1051, cubic review-one-pr.sh:1051, reviewer-sources.tsv:58, test_reviewer_sources.bats:238 and advisory-review-gate.sh:41. Each needs a fix, or a reply explaining why not.
  • INFO (scripts/lib/reviewer-sources.tsv:58): Graphite-app's clean pass is a check run the gate cannot count, so clean PRs can still fall short of the 5-bot quorum and hit the timeout fallback. This is not a regression and Lower the advisory quorum to 5: drop the three reviewers that produce no countable signal (re-file of #1894 AC #3) #1997 scopes it out. File a follow-up issue to count check runs in the gate.
  • INFO (scripts/lib/reviewer-sources.tsv:57): Graphite's clean pass is only a check run, which the gate cannot count. Graphite stays in the quorum, so a timeout fallback may still occur. The PR documents this as a known limitation.
  • INFO (scripts/lib/advisory-review-gate.sh:41): Dropped bots (copilot, codex, qodo) no longer block approval. If one posts a real finding late, the gate won't wait for it. Dev-lead trust still covers acting on such findings after the fact.

Reviewed by the PR-review cascade (triage: haiku 4.5 [sonnet 5.5, sonnet 5] → deep: opus 5.5 [opus 4.8, sonnet 5.5] + duck: gemini-3.8-flash [sonnet 5.5] → audit: opus 5.5 [opus 4.8, opus 4.7]). Reply if you need a human review.

Additional tasks

  1. Resolve all unresolved review thread comments from other reviewers
  2. Ensure all CI checks pass after your changes
  3. Rebase on the target branch if behind
  4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Addressed by the drift-guard hardening in tests/test_reviewer_sources.bats. The extraction no longer relies on head -1: it collects every _triage_bots='[…]' literal and asserts exactly one match, failing loudly (with the offending matches) if a second — e.g. a prose example in a comment — ever appears, rather than silently feeding jq the wrong line. The sole match in scripts/review-one-pr.sh is the real fallback JSON and jq parses it to the 9-member trusted set, which I verified.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Acknowledged — this is a transient Codex usage-limit notice, not a code finding. No action needed in this PR; the advisory gate already treats a rate-limited bot as non-participating and the pr-review sweep re-reviews once the limit resets.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Acknowledged — this is a Qodo trial-ended/billing-paused notice, not a code finding. No action needed here; Qodo was dropped from the advisory approval-wait quorum in #1997 (it stays dev-lead-trusted), so its paused state does not block this PR.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Acknowledged — this is a CodeRabbit review-limit (rate-limit) notice, not a code finding. No action needed; CodeRabbit is tracked by the rate-limit detector/scorecard but is not part of the advisory approval-wait set, so it does not block this PR.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Acknowledged — SonarCloud reports its Quality Gate as passed (0 new issues, 0 security hotspots). This is a clean informational status with no finding to address.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Dev-Lead — fix-reviews (partial)

A commit was pushed, but not every requested change was applied. Per requested item:

  • scripts/review-one-pr.sh:1051 — applied
  • scripts/review-one-pr.sh:1051 — applied
  • scripts/lib/reviewer-sources.tsv:58 — not applied
  • tests/test_reviewer_sources.bats:238 — applied
  • scripts/lib/advisory-review-gate.sh:41 — not applied

The unaddressed items above still need work.

@don-petry
don-petry enabled auto-merge (squash) October 1, 2026 20:00
@don-petry
don-petry disabled auto-merge October 1, 2026 20:00
@donpetry-bot

Copy link
Copy Markdown
Contributor

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-01T21:01:18Z.

@sonarqubecloud

sonarqubecloud Bot commented Oct 1, 2026

Copy link
Copy Markdown

@donpetry-bot

Copy link
Copy Markdown
Contributor

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-01T21:04:08Z.

@don-petry
don-petry merged commit a307b4c into main Oct 1, 2026
72 of 88 checks passed
@don-petry
don-petry deleted the dev-lead/issue-1997-20261001-1858 branch October 1, 2026 20:22
don-petry pushed a commit that referenced this pull request Oct 1, 2026
#2003 set advisory_gate=no on chatgpt-codex-connector and qodo-code-review
and extended their rationale. This branch added their info_status_pattern.
The merged rows keep main's columns 1-5 (advisory_gate=no), this branch's
pattern, and both rationales.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015fdDZDb4mhT65MU1izeA4R
don-petry pushed a commit that referenced this pull request Oct 1, 2026
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015fdDZDb4mhT65MU1izeA4R

@donpetry-bot donpetry-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 2268844dc3ba6bc6b3ae4a87ae827750db32e3cc
Cascade: triage → deep+duck (triage: haiku 4.5 [sonnet 5.5, sonnet 5] → deep: opus 5.5 [opus 4.8, sonnet 5.5] + duck: gemini-3.8-flash [sonnet 5.5] → audit: opus 5.5 [opus 4.8, opus 4.7])

Summary

Both reviewers rated the risk MEDIUM and approved, so they fully agree. The PR lowers the advisory quorum from 8 to 5 consistently across the registry, the gate fallback literal and review-one-pr.sh, with new consistency tests. Both flagged the same behavior change (triage feedback now covers all trusted bots under the shared 8000-char cap) and the graphite-app check-run limitation, though at different lines, so they were kept as separate entries. The rubber duck added one unique minor point, that the grep regex in the _triage_bots test is fragile, and noted that CI status could not be fully confirmed because of API rate limits.

Cross-engine agreement

full

Downstream impact

This change is consumed by 8 downstream repo(s) that pin the affected reusable workflow / lib / prompt. Impacted consumers:

Impacted shared surfaces:
  - .github/workflows/dev-lead-reusable.yml
  - .github/workflows/pr-review.yml

Impacted consumers (8, fetching up to 10):
  - petry-projects/.github (pins .github/workflows/dev-lead-reusable.yml)
      .github/workflows/dev-lead.yml
  - petry-projects/.github-private (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review-canary.yml
      .github/workflows/pr-review-trigger.yml
      .github/workflows/test-dev-lead.yml
  - petry-projects/ContentTwin (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review.yml
  - petry-projects/TalkTerm (pins .github/workflows/dev-lead-reusable.yml)
      .github/workflows/dev-lead.yml
  - petry-projects/bmad-bgreat-suite (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review.yml
  - petry-projects/broodly (pins .github/workflows/dev-lead-reusable.yml)
      .github/workflows/dev-lead.yml
  - petry-projects/google-app-scripts (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review.yml
  - petry-projects/markets (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
      .github/workflows/dev-lead.yml
      .github/workflows/pr-review.yml

Findings

  • info: CodeAnt claim that the test's grep matches a comment rather than the fallback literal is refuted at head 2268844: the grep returns exactly one match, the real literal on line 1059. (tests/test_reviewer_sources.bats:231)
  • info: Triage feedback bot set moved from the advisory-gate set to the dev_lead_trusted set, adding bots such as coderabbitai. More bots share the 8000-char ADVISORY_BOT_FEEDBACK cap, though each review body is capped at 800 chars. Acceptable. (scripts/review-one-pr.sh:1048)
  • info: Triage feedback set widens from the old advisory subset to all 9 trusted bots, and the 8000-char cap now covers more bots. This is intentional, but the prompt content is no longer byte-identical to before. (scripts/review-one-pr.sh:1039)
  • info: graphite-app stays in the quorum but its clean passes appear only as a check run, which the gate cannot count. Issue #1997 scopes this out. Needs a follow-up issue for gate-side check-run counting. (scripts/lib/reviewer-sources.tsv:58)
  • info: graphite-app stays in the quorum but its clean passes are only a check run, so it can still hit the timeout fallback. Documented in the PR as a known limitation. (scripts/lib/reviewer-sources.tsv:59)
  • info: Cubic P3 is addressed by the new test pinning the ADVISORY_BOTS fallback literal to the registry advisory-gate projection. Verified by hand with REVIEWER_SOURCES_MANIFEST=/nonexistent. (scripts/lib/advisory-review-gate.sh:41)
  • info: The _triage_bots literal test uses a grep -oE '[^]]*' regex, which is fragile if the literal contains a ']' or is reformatted across lines. It fails closed (count != 1). (tests/test_reviewer_sources.bats:262)
  • info: The GitHub API rate limit prevented re-confirming review-thread resolution and CI status. Cubic inline findings are fixed or out of scope, and shellcheck is clean on both changed scripts.

Reviewed by the PR-review cascade (triage: haiku 4.5 [sonnet 5.5, sonnet 5] → deep: opus 5.5 [opus 4.8, sonnet 5.5] + duck: gemini-3.8-flash [sonnet 5.5] → audit: opus 5.5 [opus 4.8, opus 4.7]). Reply if you need a human review.

@donpetry-bot

Copy link
Copy Markdown
Contributor

pr-review approved on PARTIAL advisory evidence: 5/7 required advisory bots reported before the gate's head-age-timeout fallback proceeded. Recorded for the miss-rate metric (#1596).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Lower the advisory quorum to 5: drop the three reviewers that produce no countable signal (re-file of #1894 AC #3)

2 participants