Repository navigation
feat(source-control): pr-merge holds only for cost, trust gates and high/critical security #9300
Description
Refs: #9276
Problem
pr-merge's risk scorer holds more than the owner's boundary needs. Any open claude-security-review finding scores HIGH (plugins/source-control/skills/babysit-prs/scripts/babysit_risk.py:221, "claude-security-review": ("security-finding", Risk.HIGH)), and any review flag holds the merge for a human.
Owner decisions (hub tab, ledger .work/backlog-to-zero/interview-checklist.md Q23-Q33; confirmed in the poteto session 2026-10-23, Q692):
- Q25: a review flag holds a merge only for a cost increase, a trust-gate change, or a high or critical security finding; anything else merges, and the owner reviews after.
- Q33: only high or critical claude-security-review findings hold; lower ones no longer score HIGH.
- Q24: trust gates still need the owner's merge:
.github/standards/trusted-actors/trusted-actors.json, the risk scorer itself, the merge gate, and the security review. - Q27: restrictions come off now; risk-tier measurement starts from the removal date.
Q23 (the HIGH path floor cut) is Pipeline Gates' separate change.
Done when
- A claude-security-review finding holds the merge only at high or critical severity; a lower one is reported and does not score HIGH. A finding whose severity cannot be read holds (fail closed).
- A review flag holds only for cost, trust-gate or high/critical security; any other flag is reported and does not hold.
- Trust-gate paths still score HIGH and wait for the owner, whatever the floor switch says.
- Tests cover each severity, an unreadable severity, each flag class, and each trust-gate path.
Related
Metadata
Metadata
Assignees
Type
Fields
No fields configured for Feature.
Activity
kyle-sexton commentedon Oct 23, 2026
Decision recorded. The owner confirmed Q23-Q33 for pr-merge in the poteto session (2026-10-23, Q692, "Yes, go with recommendations"): Q25 and Q33 as stated in the body, Q24 trust gates kept, Q27 restrictions off now. poteto builds Q25 and Q33 in the scorer; Pipeline Gates keeps the Q23 floor cut.
kyle-sexton commentedon Oct 23, 2026
Decision recorded. The owner chose (2026-10-23, Q693, "Approved"): of the security lane's tiers (CRITICAL / IMPORTANT / SUGGESTION,
plugins/review/skills/security-review/SKILL.md:69), only CRITICAL holds a merge, which is what main does since #9280. IMPORTANT and SUGGESTION findings are reported and do not hold. A missing or unreadable severity still counts as CRITICAL (fail closed).kyle-sexton commentedon Oct 23, 2026
Decision recorded. The owner confirmed in the poteto session (2026-10-23, Q694, "Yes"): while the pipeline is built, the only owner-merge hold is a change that adds or widens entries in
.github/standards/trusted-actors/trusted-actors.json. The risk scorer, merge gate, pipeline config, workflows and the security review workflow merge normally. A review flag holds only for a cost increase, a trusted-actors widening, or a CRITICAL security finding (Q693). This supersedes the Q24 list in the body and the Q48 narrowing.