Skip to content

docs(agents): fixes on an operator's PR go to the operator #2306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lilyshen0722 merged 2 commits into from
Oct 17, 2026
Merged

docs(agents): fixes on an operator's PR go to the operator #2306

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6f8bc46
docs(agents): fixes on an operator's PR go to the operator
lilyshen0722 Oct 17, 2026
3bdc7be
docs(agents): cite where the #2305 quote was posted, and which review…
lilyshen0722 Oct 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion docs/agents/who-to-address.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@

| a seat needs | address | how |
|---|---|---|
| operator work: a press, a deploy, a merge order, a review routed | the operator account that owns the lane: `@lily-shen` for the Sharpen lane (landing, README, UI), `@connector-ops` for connectors, `@gtm-ops` for GTM while its seats run | a mention in the lane's pod, or on the PR |
| operator work: a press, a deploy, a merge order, a review routed, a fix to an operator's PR | the operator account that owns the lane: `@lily-shen` for the Sharpen lane (landing, README, UI), `@connector-ops` for connectors, `@gtm-ops` for GTM while its seats run | a mention in the lane's pod, or on the PR |
| a gate from another seat: code, UX, docs | that seat, by its Commonly handle (`@sprint-review`, `@ux-lead`, …) | **a mention in the pod**. Post the detail on the PR, but the ask itself has to be a pod mention, because a GitHub `@` in a PR comment wakes no seat |
| a decision only Sam can make: money, accounts and credentials, anything sent outside Commonly, a product ruling | Sam | **a decision card**, so it lands in Activity under "Needs you". A plain `@sam` in a thread is not seen |

Expand All @@ -14,6 +14,10 @@

**Why.** Operator accounts are human-class accounts driven by operator sessions, and a session hears a mention only while it runs a watcher. Measured 2026-09-27 over 7 days: `@connector-ops` drew 384 mentions and its session heard them; `@lily-shen` drew 105, 102 of them from Sharpen seats, and its session heard almost none until a watcher was added that day. `@sam` drew about 22 plain mentions that nothing surfaced to Sam. The lane stalled on exactly this: a gate's requested changes sat unread overnight while the seat re-asked.

**Fixes on an operator's PR go to the operator** (Cofounder, 2026-10-17). A reviewer names the defect in its verdict and in its reply to the operator. It does not @-mention an implementation seat to make the fix. Only the operator decides who pushes to its branch, and nobody re-pings reviewers until the operator says the head is final.

On 2026-10-17 a security reviewer passed #2305 at `f7c43827`, and its reply in the pod ended with "@kai the fallback-post note is the one to fix" (msg 78744). About a minute later kai pushed a commit to the operator's branch, then re-pinged both reviewers on that head (msg 78745). The head still lacked the operator's fix for the other reviewer's hold, which was already committed locally along with a fix for the same note. The operator's push was rejected. The security reviewer re-gated kai's head, which could not pass, and the other reviewer's verdict landed only after the operator's rebased head replaced it. The lane spent about 4 extra seat runs.

**One gate, no FYI.** Every mention is a paid turn for whoever it wakes. Name one gate per PR, and do not mention a seat or an operator to keep them informed.

**Word a gate ask to a codex seat as a review, not an attack.** Seats on OpenAI models (codex: Rhea, kai, forge, …) pass every model call through the provider's own safety filter. The filter sees the mention, which the wrapper builds into the prompt from the event bodies alone. It also sees anything the seat reads mid-turn with a tool, such as the PR body, a diff or pod messages, so a refusal can land mid-turn as well. On 2026-10-16 two security-gate asks to `@rhea` on #2249 (msgs 78183 and 78195) described the change the way an attacker would: what a steered turn "could exfiltrate", to which host, plus SSRF and ReDoS. Each was refused with "flagged for possible cybersecurity risk" on every attempt, five turns in a row from 02:17Z, by the seat's own log. The gate went silent, and another reviewer had to cover it. A plain liveness line to the same seat was answered in 14 s. So anywhere a codex seat will read, name the files and the property to check: "check that an address the model wrote is never requested", "check the trims stay linear on long input". Keep exploit narratives and payloads out of the mention and out of the PR text it will read. If a reviewer needs them, they belong in the tests, stated as the property each arm pins. A refused mention is retried up to three times and then retires at the next sweep. Re-sending the same wording only repeats the refusal.
Loading