Repository navigation
Kernel: a change to a model Lens's own inputs needs a person (#140) - #293
Merged
Merged
Conversation
config/hooks.json lists pr-review's own inputs as Lens inputs of a model Lens: its manifest and the prompt beside it, its rubric, and the Harness's task and engine. tools/hooks/protected.py gives the Kernel their patterns as model_lens_inputs, from the same reading as protected_paths. A pull request that changes one converges only once every model Lens has reviewed its head and a person has judged it: a person with write access, neither author nor last pusher, approving this content, or the Maintainer's own change, which the Maintainer opened and pushed, since GitHub counts no author's approval of their own pull request. It waits in verifying, model_lens_input_needs_person, naming each pattern, the Maintainer's to see, and a queued item leaves the queue. A list that cannot be read defers as protected_paths_unreadable. Decision 0045, numbered at enqueue. Eleven mutants, each killed by hand the CI way; two older ones follow the text they break. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…val (#140) A converged change to a model Lens's input goes back to verifying when a Lens's App dismisses the person's approval. The Lifecycle declares the transition, bounded by the Run ceiling, as the Lens's other moves out of converged are, and the transitions test has facts that reach the new wait. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…pass, Argon and Muse The Maintainer's own change is no person's judgment of a head: a session may push as the Maintainer (L-44), so the clause that read it as one is gone, and such a change waits for another person's approval, as ruling 3 says. A person's approval counts as that person's latest verdict, so a later request for changes supersedes it, and only a person's dismissal ends it (L-17); the Lifecycle's converged-to-verifying by a Lens goes with that. The list now holds what makes it, config/hooks.json, config/defaults.json and tools/hooks/protected.py, so no change the Lens alone judges can take a row off it or rename the model Lens; harness/ is matched whole, and roles/pr-review/ beside roles/pr-review.*. The author's and the last pusher's approvals, a rename out of a listed path and the latest-verdict reading each have a case and a mutant. Decision 0045 says so, and names kernel/gate.py, kernel/coverage.py and config/authority.json as not covered, for the orchestrator. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… model Lens's input (#140) config/defaults.json joined pr-review's own inputs in the fix round, and a change to one waits for a person's approval, which no world gives, so the Maintainer's worlds waited for ever. The Maintainer now touches config/authority.json, a protected path that needs the model review alone, and every world rests as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… on the list The Maintainer's ruling of 2026-10-21 on ruling 3: a change to a model Lens's own inputs converges on an approval of its current head by donpetry-bot or any other account with write access other than its author, the last pusher excluded too; never an App's or a Lens's. His own changes converge once he approves as the machine user in the browser. The Factory's own approving act never supplies it: no Decision issues an approval for such a change until a qualifying approval stands, with a boundary test for that loop. kernel/gate.py, kernel/coverage.py and config/authority.json join pr-review's inputs (the orchestrator, 2026-10-21). The record takes 0046, since 0045 is on main. The simulator's Maintainer touches the feed's table, which is no model Lens's input. Three mutants for the judge, each killed by hand the CI way. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 23 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Oct 21, 2026
This was referenced Oct 21, 2026
don-petry
added a commit
that referenced
this pull request
Oct 22, 2026
…t's 0047 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
don-petry
added a commit
that referenced
this pull request
Oct 22, 2026
…no clock; the mint, the scratch folder and the schema walk fail closed The record takes 0048, by the order the Factory Builder set: #293 keeps 0046 and #296 takes 0047. CI's shard 2 said the signal mutant SURVIVED: its one test was marked as timed by the wall clock, which the mutation check skips. The stand-in now says on a pipe that a read has begun and holds it until the script is signalled, so no clock is read and the test runs under the mutation check; dash kills the mutant. Codex on PR 298: - A mint curl says failed is never trusted, however whole its answer reads: the token is revoked and the run stops. - The raw answers' scratch directory is held outside the repo, as OUT is, through a link too; the template names TMPDIR, which macOS's mktemp -d alone ignores here. - check_apps reads a facts schema whose properties or $defs are not objects as unreadable instead of raising. - The grounding says what P-47 recorded: admin and write, a maintainer's role read as write, and read; triage was not tried. - The Controller's metadata grant names read:facts.actor.can_write, as the reader's does. - A permission is a repo's: read and kept by repo and login, and its cost counted per repo, never "one request an item". Each new guard has a test and a mutant. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #140.
What this is. With one model family, the only judge of a change to a model Lens's own inputs that is not the Lens is a person. A pull request that changes one now converges only once every model Lens has reviewed its head, as before, and an account with write access other than its author has approved that head, by the Maintainer's ruling on ruling 3. Decision 0046, numbered at enqueue.
What it holds.
config/hooks.jsonlists pr-review's own inputs as a model Lens's inputs:roles/pr-review.*,roles/pr-review/, its rubric,harness/whole, the gate, coverage and the authority table, and the files that make the list (config/hooks.json,config/defaults.json,tools/hooks/protected.py)config/hooks.jsonmodel_lens_inputs, from the same reading asprotected_pathstools/hooks/protected.py::model_lens_inputsverifying,model_lens_input_needs_person, naming each pattern, the Maintainer's to see; a queued item leaves the queuekernel/derive.pya_judge,judged_by_a_personreading, held bytest_the_factorys_own_approval_never_supplies_the_judgmentprotected_paths_unreadablereadable_rulesa_lens_input_needs_you: approve, or closeconfig/feed.jsonThe Maintainer's ruling on ruling 3 (2026-10-21, through the orchestrator): "an APPROVAL of the current head by donpetry-bot or any other account with write access, other than the PR's author", and not the last pusher. His own changes converge once he approves as donpetry-bot in the browser, or a colleague approves. Posted on #140. The orchestrator added the gating files to the list.
Not here. The base-branch read of
config/hooks.jsonwaits onadapters/settings.py, as 0020's rows do.Verify.
make verifyon agit archiveexport,SIM_SEEDS=40. The simulator's Maintainer world now touchesconfig/authority.json, sinceconfig/defaults.jsonis on the list and no world gives a person's approval. Mutants: 18 for this rule, plus three older ones that follow the text they break, each killed by hand the CI way. The capped run cannot takekernel/derive.py, which has more than 40.Reviews and the fix round.
harness/__init__.pyandroles/pr-review/prompt.mdwere not coveredharness/whole, androles/pr-review/🤖 Generated with Claude Code