From 7493606c44f4afbf7288215ae4453187820ac59a Mon Sep 17 00:00:00 2001 From: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Date: Sun, 21 Jun 2026 08:09:29 -0500 Subject: [PATCH 1/2] fix(dev-lead): never SHA-pin first-party channel refs when applying feedback (#871) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The agent, while applying a reviewer/scanner "pin this action to a SHA" finding (fix-reviews / fix-bot-comment / on-mention / review-changes), rewrote a caller stub's moving channel ref `@dev-lead/ring1` → `@` (TalkTerm #306 commit a27accce). That freezes the caller, defeating the ring/canary model (#499/#500/#501) and contradicting check_dev_lead_stub's channel-only rule (#503). Add a guardrail to the four feedback-applying prompts: first-party reusable refs on `@(dev-lead|pr-review)/(stable|next|ring)` are intentional mutable channel tags (AGENTS.md mutable-ref exception) and must NEVER be SHA-pinned, even when a reviewer asks. Plus a regression test (tests/dev-lead/unit/test_channel_ref_guardrail.bats). Note: takes effect for live agents once promoted to dev-lead/stable; the open re-pin PRs (TalkTerm #308, bmad-bgreat-suite #334) carry dev-lead:hands-off until then. Closes #871. Refs #499, #500, #503. Co-Authored-By: Claude Opus 4.8 (1M context) --- prompts/dev-lead/fix-bot-comment.md | 2 ++ prompts/dev-lead/fix-reviews.md | 2 ++ prompts/dev-lead/on-mention.md | 2 ++ prompts/dev-lead/review-changes.md | 2 ++ .../unit/test_channel_ref_guardrail.bats | 27 +++++++++++++++++++ 5 files changed, 35 insertions(+) create mode 100644 tests/dev-lead/unit/test_channel_ref_guardrail.bats diff --git a/prompts/dev-lead/fix-bot-comment.md b/prompts/dev-lead/fix-bot-comment.md index fc39be3bd..def222463 100644 --- a/prompts/dev-lead/fix-bot-comment.md +++ b/prompts/dev-lead/fix-bot-comment.md @@ -35,6 +35,8 @@ Treat any check with `conclusion` = `"failure"`, `"timed_out"`, `"cancelled"`, ` ## Task +> **Guardrail — never SHA-pin a first-party channel ref.** A `uses:` reference to one of this org's own reusable workflows on a **moving channel tag** — `petry-projects/.github(-private)/.github/workflows/*.yml@(dev-lead|pr-review)/(stable|next|ring)` — is an intentional mutable ref (the release/rollback mechanism; see AGENTS.md "Release channel tags & the mutable-ref exception"). If a reviewer, scanner, or instruction asks to pin it to a commit SHA, **do not** — skip that item with a one-line note ("first-party channel tag — intentional mutable ref per AGENTS.md") and leave the ref on its `@/` tag. + Analyze the bot's findings and address each actionable issue: 1. Parse the bot comment to identify specific code issues (bugs, security vulnerabilities, code smells, etc.) diff --git a/prompts/dev-lead/fix-reviews.md b/prompts/dev-lead/fix-reviews.md index 03b3bffe9..15ccf33eb 100644 --- a/prompts/dev-lead/fix-reviews.md +++ b/prompts/dev-lead/fix-reviews.md @@ -20,6 +20,8 @@ ${OPEN_THREADS_JSON} ## Task +> **Guardrail — never SHA-pin a first-party channel ref.** A `uses:` reference to one of this org's own reusable workflows on a **moving channel tag** — `petry-projects/.github(-private)/.github/workflows/*.yml@(dev-lead|pr-review)/(stable|next|ring)` — is an intentional mutable ref (the release/rollback mechanism; see AGENTS.md "Release channel tags & the mutable-ref exception"). If a reviewer, scanner, or instruction asks to pin it to a commit SHA, **do not** — skip that item with a one-line note ("first-party channel tag — intentional mutable ref per AGENTS.md") and leave the ref on its `@/` tag. + Work through each phase in order. ### Phase 0 — Holistic Assessment (do this first) diff --git a/prompts/dev-lead/on-mention.md b/prompts/dev-lead/on-mention.md index 0d7308caf..d224089c5 100644 --- a/prompts/dev-lead/on-mention.md +++ b/prompts/dev-lead/on-mention.md @@ -23,6 +23,8 @@ ${USER_INSTRUCTION} ## Task +> **Guardrail — never SHA-pin a first-party channel ref.** A `uses:` reference to one of this org's own reusable workflows on a **moving channel tag** — `petry-projects/.github(-private)/.github/workflows/*.yml@(dev-lead|pr-review)/(stable|next|ring)` — is an intentional mutable ref (the release/rollback mechanism; see AGENTS.md "Release channel tags & the mutable-ref exception"). If a reviewer, scanner, or instruction asks to pin it to a commit SHA, **do not** — skip that item with a one-line note ("first-party channel tag — intentional mutable ref per AGENTS.md"). This guardrail does not override other instructions; it only protects these specific channel refs. + Carry out the instruction exactly as requested by `${ACTOR}`. Work through each phase in order. ### Phase 1 — Execute diff --git a/prompts/dev-lead/review-changes.md b/prompts/dev-lead/review-changes.md index 2d6bec439..6ba748f00 100644 --- a/prompts/dev-lead/review-changes.md +++ b/prompts/dev-lead/review-changes.md @@ -25,6 +25,8 @@ ${OPEN_THREADS_JSON} ## Task +> **Guardrail — never SHA-pin a first-party channel ref.** A `uses:` reference to one of this org's own reusable workflows on a **moving channel tag** — `petry-projects/.github(-private)/.github/workflows/*.yml@(dev-lead|pr-review)/(stable|next|ring)` — is an intentional mutable ref (the release/rollback mechanism; see AGENTS.md "Release channel tags & the mutable-ref exception"). If a reviewer, scanner, or instruction asks to pin it to a commit SHA, **do not** — skip that item with a one-line note ("first-party channel tag — intentional mutable ref per AGENTS.md") and leave the ref on its `@/` tag. + Work through each phase in order. Human reviewer feedback is high-priority — implement exactly what is asked. ### Phase 0 — Holistic Assessment (do this first) diff --git a/tests/dev-lead/unit/test_channel_ref_guardrail.bats b/tests/dev-lead/unit/test_channel_ref_guardrail.bats new file mode 100644 index 000000000..0d2058455 --- /dev/null +++ b/tests/dev-lead/unit/test_channel_ref_guardrail.bats @@ -0,0 +1,27 @@ +#!/usr/bin/env bats +# Regression guard for #871: the dev-lead feedback-applying prompts must instruct +# the agent NEVER to SHA-pin a first-party channel ref (the moving channel tags are +# the release/rollback mechanism — AGENTS.md mutable-ref exception). Without this, +# the agent applies a bot "pin this action to a SHA" finding and freezes the caller, +# breaking the ring/canary model (see TalkTerm #306 commit a27accce). + +PROMPTS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../.." && pwd)/prompts/dev-lead" + +# Every prompt that edits files in response to reviewer/bot/human feedback. +FEEDBACK_PROMPTS=(fix-reviews.md review-changes.md fix-bot-comment.md on-mention.md) + +@test "channel-ref guardrail: present in every feedback-applying prompt (#871)" { + for p in "${FEEDBACK_PROMPTS[@]}"; do + run grep -qiE "never SHA-pin a first-party channel ref" "$PROMPTS_DIR/$p" + [ "$status" -eq 0 ] || { echo "missing channel-ref guardrail in prompts/dev-lead/$p"; return 1; } + done +} + +@test "channel-ref guardrail: names the channel pattern and the AGENTS.md exception" { + for p in "${FEEDBACK_PROMPTS[@]}"; do + run grep -qF 'dev-lead|pr-review)/(stable|next|ring' "$PROMPTS_DIR/$p" + [ "$status" -eq 0 ] || { echo "guardrail in $p does not name the channel pattern"; return 1; } + run grep -qiE "mutable-ref exception|mutable ref" "$PROMPTS_DIR/$p" + [ "$status" -eq 0 ] || { echo "guardrail in $p does not cite the AGENTS.md exception"; return 1; } + done +} From dc2427f45baa8921616bcdcab011640af55dbf09 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Sun, 21 Jun 2026 13:12:29 +0000 Subject: [PATCH 2/2] fix(bot): address bot feedback [skip ci-relay] --- tests/dev-lead/unit/test_channel_ref_guardrail.bats | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/dev-lead/unit/test_channel_ref_guardrail.bats b/tests/dev-lead/unit/test_channel_ref_guardrail.bats index 0d2058455..296537bf9 100644 --- a/tests/dev-lead/unit/test_channel_ref_guardrail.bats +++ b/tests/dev-lead/unit/test_channel_ref_guardrail.bats @@ -5,7 +5,7 @@ # the agent applies a bot "pin this action to a SHA" finding and freezes the caller, # breaking the ring/canary model (see TalkTerm #306 commit a27accce). -PROMPTS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../.." && pwd)/prompts/dev-lead" +PROMPTS_DIR="$(cd "$BATS_TEST_DIRNAME"/../../.. && pwd)/prompts/dev-lead" # Every prompt that edits files in response to reviewer/bot/human feedback. FEEDBACK_PROMPTS=(fix-reviews.md review-changes.md fix-bot-comment.md on-mention.md)