fix(review): explain-change artifact medium should look up repo visibility itself #6951

Activity

1. github-actions

   added

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 11, 2026
2. github-actions commented on Oct 11, 2026

   

   github-actionsbot

   on Oct 11, 2026 – with GitHub Actions

   Contributor

   More actions

   Thanks for the report. Automated triage handed this issue to a maintainer.

   _{Automated triage. A maintainer reviews it.}
3. github-actions

   added

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   on Oct 11, 2026
4. kyle-sexton commented on Oct 11, 2026

   

   kyle-sexton

   on Oct 11, 2026 – with Claude

   MemberAuthor

   More actions

   Draft PR: #7087 (branch fix/6951-artifact-visibility-lookup).

   Most of this issue was already fixed by #7026, which landed after the issue was filed: /source-control:pull-request view --out facts.json looks the visibility up over REST, and the artifact gate reads it with --publish-gate --facts. The PR closes the gap that remained. digest-policy.mjs --publish-gate no longer accepts a visibility typed on the command line, only --facts <facts.json>. Verified with the explain-change node suite (102 pass, 0 fail), a before/after run of the CLI, the affected-tests runner and the changelog fragment checks.

   Left for a human: the PR does not copy publish-hosted.mjs's host check (gh auth status --hostname) into read-pr.sh's visibility lookup. It only matters for a non-github.com host reached through an enterprise env token, and read-pr.sh is being rewritten in #7081. The reasons are in the PR body.

   The needs-human label is still on this issue; I left it for Kyle to clear.

   ---

   Generated by Claude Code
5. kyle-sexton commented on Oct 11, 2026

   

   kyle-sexton

   on Oct 11, 2026 – with Claude

   MemberAuthor

   More actions

   Handoff note for whoever picks this up next. The overnight Claude run has stopped, and Kyle is moving issue work to Cursor.

   • Branch: fix/6951-artifact-visibility-lookup
   • PR: fix(review): take the artifact gate's visibility only from the view facts #7087 (draft)
   • State: PR opened, verified PASS (body changed Closes -> Refs: the host check the issue names is not done; follow-up after fix(source-control): read pull-request facts and diffs over REST in view #7081)
   • Notes: Most of the issue was already fixed by merged refactor(skills): route generic skills' forge work through source-control actions #7026; this closes the remaining gap (--publish-gate accepts --facts only). Host check for enterprise tokens not copied into read-pr.sh (follow-up; fix(source-control): read pull-request facts and diffs over REST in view #7081 rewrites it). Closes vs Refs for Kyle if he counts the host check
   • Next step: Review the draft PR; decisions for Kyle are listed in its body. Mark it ready once Kyle agrees (that starts the CI test and review lanes), then drive CI green.

   Where a branch is listed it is pushed, so it can be taken over as is. A draft PR shows a red ci-status by design until it is marked ready.

   ---

   Generated by Claude Code
6. kyle-sexton commented on Oct 13, 2026

   

   kyle-sexton

   on Oct 13, 2026

   MemberAuthor

   More actions

   Decision recorded. The owner approved applying independently verified recommendations on 2026-10-12.

   • Does fix(review): take the artifact gate's visibility only from the view facts #7087 close fix(review): explain-change artifact medium should look up repo visibility itself #6951, or does fix(review): explain-change artifact medium should look up repo visibility itself #6951 stay open for the host check? → Keep Refs; fix(review): explain-change artifact medium should look up repo visibility itself #6951 stays open for the host check after fix(source-control): read pull-request facts and diffs over REST in view #7081 lands
     Basis: fix(review): explain-change artifact medium should look up repo visibility itself #6951 comment 2026-10-11T16:20 (handoff); plugins/source-control/skills/pull-request/scripts/read-pr.sh:125 has --hostname but no gh auth status check; plugins/review/skills/explain-change/scripts/publish-hosted.mjs:76 has it

   Wants the explain-change artifact gate to use a looked-up visibility, not the model's. #7026 (merged) did most of it, and draft #7087 removes the command-line visibility input; the gh host check for enterprise hosts is deferred until #7081 rewrites read-pr.sh.

   Verified by an independent fresh-context check (confirmed, risk low): gh issue view 6951 + handoff comment 2026-10-11T16:20; PR #7087 OPEN draft, Refs: #6951, MERGEABLE, head c180932; body defers read-pr.sh host check to after #7081; PR #7081 OPEN draft (rewrites read-pr.sh), #7026 MERGED, #6783 MERGED; digest-policy.mjs:14 on origin/main still '--publish-gate |--facts'; publish-hosted.mjs:76 'gh auth status --hostname'; read-pr.sh:125 --hostname without auth status check

   Admission to an agent lane stays with the work-class rules and owner ratification.
7. kyle-sexton

   added the

   Bug

   issue type on Oct 15, 2026
8. kyle-sexton

   removed

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   on Oct 15, 2026
9. kyle-sexton commented on Oct 17, 2026

   

   kyle-sexton

   on Oct 17, 2026

   MemberAuthor

   More actions

   Admitted in owner batch A1 (mechanical).
10. kyle-sexton

    added

    agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.Fully specified and briefed; eligible for autonomous pickup from the frontier.

    on Oct 17, 2026
11. kyle-sexton

    closed this as completedin #7731on Oct 17, 2026
12. kyle-sexton

    reopened this on Oct 17, 2026
13. kyle-sexton commented on Oct 17, 2026

    

    kyle-sexton

    on Oct 17, 2026

    MemberAuthor

    More actions

    Reopened on the owner's decision (2026-10-17): the 2026-10-13 decision kept this open (Refs, not Closes) for the host check after #7081. Lane PR #7731 closed it with Closes; that lane bug is tracked in #7741 and fixed by #7762.
14. github-actions

    added

    needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

    on Oct 17, 2026
15. kyle-sexton commented on Oct 18, 2026

    

    kyle-sexton

    on Oct 18, 2026

    MemberAuthor

    More actions

    This was generated by AI during triage.

    Verified: the remaining gap still holds on main

    Default branch: e59e0be. #7087 (artifact gate takes visibility only from the view facts), #7081 (view reads over REST; the rewrite this item waited for) and #7731 are all merged. What the 2026-10-13 decision kept this open for is still missing:

    • plugins/source-control/skills/pull-request/scripts/read-pr.sh:207-214 looks visibility up with gh api --hostname "$host" "repos/$repo_path", where host comes from the PR URL, with no check that gh is logged in to that host.
    • The explain-change lookup does check it: plugins/review/skills/explain-change/scripts/repo-visibility.mjs:27-28 returns UNKNOWN when !ghLoggedIn(host).
    • read-pr.sh already does an auth status --hostname check for the API host (line 140), but not for the visibility lookup.

    Open linked PRs: none.

    Triage: briefed, delegable (Bug, priority: medium, work-class: scoped). The agent-ready admission from owner batch A1 stands; this pass adds the work class and the brief.

    Agent Brief

    Type: Bug
    Summary: The pull-request view's visibility lookup reports UNKNOWN for a host gh is not logged in to.

    Current behavior: /source-control:pull-request view looks the repository's visibility up on the host named in the PR URL whether or not gh is logged in there. A host gh is not logged in to could be anyone's server and answer "public" for a private repository; that answer then feeds the explain-change artifact publish gate.

    Desired behavior: The view's visibility lookup first confirms gh is logged in to the PR's host; when it is not, visibility is UNKNOWN and no request is sent to that host. github.com and logged-in hosts behave as today. This matches the explain-change visibility lookup.

    Key interfaces:

    • pull-request view facts: the visibility field (PUBLIC, PRIVATE, INTERNAL, or UNKNOWN).

    Acceptance criteria:

    • A test with a PR URL on a host the gh stub reports as not logged in yields visibility: UNKNOWN and records no api call to that host.
    • A test with a logged-in host still yields the looked-up visibility.
    • The existing read-pr tests pass.

    Out of scope:

    • The explain-change publish gate and its hosted path.
    • GraphQL vs REST transport (already REST).
16. kyle-sexton

    added

    work-class: scopedA briefed fix or small feature; blast radius bounded by the brief, tests exist.A briefed fix or small feature; blast radius bounded by the brief, tests exist.

    status: readyTriaged, unblocked, and fully specified; eligible to pick up.Triaged, unblocked, and fully specified; eligible to pick up.

    priority: mediumReal value, no hard deadline; normal backlog flow.Real value, no hard deadline; normal backlog flow.

    and removed

    needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

    on Oct 18, 2026