source-control:babysit-prs: babysit_resolve_thread.py --autonomous does not enforce severity or own-PR conditions its callers rely on

[kyle-sexton]

babysit_resolve_thread.py machine-enforces two conditions and only two. Read from the source:

• if not thread["botOnly"] and not include_human — participation.
• if (autonomous or only_outdated) and not thread["isOutdated"] — outdatedness.

There is no severity check, no CHANGES_REQUESTED check, and no check on whether the pull request belongs to the invoking agent.

That matters because of what a host permission grant can see. A grant covering source-control-babysit-resolve-thread --autonomous sees the same command shape whether the target is a stale formatting nit or a live P1 security finding on the agent's own PR. The host cannot discriminate, so every condition beyond the two above is advisory in practice no matter how absolutely it is written — and the review-thread merge gate means the agent resolving those threads is the same actor that benefits from resolving them.

Ask

Move the remaining conditions into the resolver, so --autonomous refuses rather than relies on the caller:

1. Severity / blocking state. Refuse a thread whose first comment carries a P1 or security marker, or whose review state is CHANGES_REQUESTED.
2. Own-PR. Refuse when the PR author is the invoking identity, or gate it behind an explicit flag that the wrapper then rejects — the shape source-control-babysit-merge already uses for --allow-unpinned-head.

Both are checkable from data the resolver already fetches. The merge gate and this resolver are the two components that already demonstrate the pattern of enforcing an invariant in code so a host grant can name a bounded command; this closes the gap between what the resolver enforces and what its callers are told it enforces.

Context

Found by the Codex reviewer on melodic-software/dotfiles#315, which hardens the host-side autoMode prose granting this wrapper. That PR restricted thread resolution to this wrapper under --autonomous without --include-human and dropped the raw resolveReviewThread mutation, on the reasoning that a raw mutation carries an opaque thread ID so no stated condition is checkable. The reviewer's follow-up is that the wrapper only partially closes it: two conditions moved into code, three did not, and the host still cannot tell the cases apart.

The dotfiles entry now states plainly which conditions have code behind them and which do not. That honesty is what surfaced this — but a settings file cannot fix it, which is why it is filed here.

Related: #843 (plugin bin/ not on the Bash-tool PATH), #1281 (--apply helpers need mechanically-validated wrappers). Same theme: a host grant is only as narrow as what the named command refuses on its own.

[kyle-sexton]

This was generated by AI during triage.

Verified

Read directly from plugins/source-control/skills/babysit-prs/scripts/babysit_resolve_thread.py at this commit. The resolver machine-enforces exactly the two conditions claimed, and no more:

• :189 — if not thread["botOnly"] and not include_human (participation)
• :193 — if (autonomous or only_outdated) and not thread["isOutdated"] (outdatedness)

Plus two pin refusals not in scope here: :325 refuses --autonomous --resolve without --thread-id, and :345 refuses --allow-unpinned-thread in --autonomous mode.

No severity check, no CHANGES_REQUESTED check, no own-PR check exists in the file. Grepping for severity and CHANGES_REQUESTED returns nothing in the enforcement path.

The skill's own documentation confirms the gap is known and currently stated as a caller obligation rather than an enforced one — :61 describes what the resolver does not do, including "judge a finding's severity."

Classification

• Work class: C4 structural — a security-surface contract change. The resolver is a named target of host permission grants, so what it refuses is the grant's boundary.
• Priority: high. Two compounding factors, recorded because they raise this above the priority: medium default:
  1. Self-dealing. The review-thread merge gate means the agent resolving threads is the same actor that benefits. The own-PR condition is the one that closes that, and it is absent.
  2. The merge lane is live. /source-control:babysit-loop runs against this repository now, so this is an active hole rather than a latent one. A grant covering --autonomous cannot distinguish a stale formatting nit from a live P1 security finding on the agent's own PR.

Per the admission gate, security-surface work routes to the frontier capability tier always, and C4 is human-gated with mandatory human review and merge.

Note for whoever picks this up

PR #1285 (Closes #1265) is open and lands scripts/tests/guard_contract.py — an executable guard-contract table where every row carries the prose claim it backs. Both refusals this item asks for are natural rows in that table rather than new standalone test scaffolding. Sequencing after #1285 avoids building a parallel assertion mechanism. Sibling item #1281 has the same relationship.