dev-lead: deferred review findings

This is the repo's single tracking issue for bot review findings that dev-lead judged valid but out of scope for the PR they were raised on (#2045, AC6). Review-thread deferrals () and issue-comment out-of-scope dispositions both point here. Each deferred finding is appended with a link to its originating review comment, which the harness checks before it resolves the thread.

From PR #1953 (`scripts/canary_report.sh`)

These five Codex findings were deferred on 2026-10-01 and resolved by hand on 2026-10-03 (see #2045). Until now, none of them was tracked anywhere.

No latency data: emit_token_record writes no duration_ms, so the latency bar has no real data. feat: implement issue #1951 — [Phase 2] Canary go/no-go report: compare deep-tier cost, cache-read cost and latency by model from token-usage artifacts #1953 (comment) (PRRT_kwDOR9SdIs6mUIgJ)
Fixed-judge calls count toward controlled arms: they are not excluded. This needs a generator/judge role field in telemetry. feat: implement issue #1951 — [Phase 2] Canary go/no-go report: compare deep-tier cost, cache-read cost and latency by model from token-usage artifacts #1953 (comment) (PRRT_kwDOR9SdIs6mUuMq)
Failures are swallowed: per-file parse/filter failures in the shared _collect_one_artifact are not propagated. feat: implement issue #1951 — [Phase 2] Canary go/no-go report: compare deep-tier cost, cache-read cost and latency by model from token-usage artifacts #1953 (comment) (PRRT_kwDOR9SdIs6mWpvH)
Unpaired comparisons: controlled comparisons do not require paired cases. This needs a per-case id in telemetry. feat: implement issue #1951 — [Phase 2] Canary go/no-go report: compare deep-tier cost, cache-read cost and latency by model from token-usage artifacts #1953 (comment) (PRRT_kwDOR9SdIs6mWpvL)
Estimated cache usage counts as real: fallback-estimated cache usage is not treated as insufficient. This needs a measured/estimated provenance flag. feat: implement issue #1951 — [Phase 2] Canary go/no-go report: compare deep-tier cost, cache-read cost and latency by model from token-usage artifacts #1953 (comment) (PRRT_kwDOR9SdIs6nP1Ur)

Thanks for tracking these deferred findings from PR #1953 in one place. Several of them (generator/judge role, per-case id, measured/estimated provenance) depend on new telemetry fields. Which of these five would you like addressed first, so we can scope the telemetry changes around it?

Deferred from PR #2049 (CodeRabbit Security Architecture Review): (1) resolve_deferred_bot_threads' final recheck→resolve window is not atomic against concurrent human comments/tracker edits; (2) the body-only automation-marker discriminator (#1415) could let a human comment quoting a marker bypass later-comment/disposition checks — consider binding exemptions to trusted author identity.

Retrying an addressed-thread resolution failure after the applied terminal. It needs the Follow-up to #1609 (slice 2): gate dev-lead thread resolution on the pass having advanced the PR head #1617 resolution gate to allow resolving on a retry pass with no commit; that predates PR feat: implement issue #2045 — dev-lead: no deferred/out-of-scope outcome for review threads — a valid finding dev-lead defers stays unresolved forever and blocks merge #2049. Deferred from feat: implement issue #2045 — dev-lead: no deferred/out-of-scope outcome for review threads — a valid finding dev-lead defers stays unresolved forever and blocks merge #2049 (comment)

Generated by Claude Code

PR #1909 thread #1909 (comment) (PRRT_kwDOR9SdIs6lAyfg): persona-runner pre-gate uses github.token, which cannot read a private SOURCE_REPO; gate fails closed (skips). Needs a cross-repo read credential or source-side signal gathering — design/secret-scope decision.

PR #2149 (comment #2149 (comment), codeant-ai nitpick): scripts/lib/test-tamper-guard.sh ttg_scan_pass treats a test file renamed earlier in the PR as 'absent at merge base', so later edits/skips on the renamed path bypass the guard. Needs rename-aware merge-base lookup (git diff -M mb base).

From PR #2157: #2157 (comment) — a commit skipped by git rebase as already applied has no rewrite-map successor, so its claim is retracted; map skipped commits to their upstream equivalent. Also #2157 (comment) — a cancelled run can leave a pushed rebased fix cited by its old SHA; persist the rewrite mapping or recover the successor before retracting.

#2135 (comment) — Add config/ai-engines.json to both agents' autocut watch paths in petry-projects/.github/standards/canary-rings.json (requires changes to canonical canary registry in another repo)

From PR #2158 — #2158 (comment): The fresh test-suite job installs only bats, not the engine CLIs the dispatch job installs; a DEV_LEAD_TEST_CMD using one would exit 127 on both runs. Needs a decision on which CLIs the test job may install.

From PR #2158 — #2158 (comment): Give the test-suite job a test-only handoff without state.json (comment body, reviewer metadata) and result.bundle. Needs a second artifact and a digest scheme for it.

From PR #2158 — #2158 (comment): A PR closed while the test job runs exits 0 in checkout_pr_in_worktree before the push phase can retract the work job's claim replies. The early exit runs at top level before retract_unlanded_claims is defined, so it needs a restructure.

From PR #2158 — #2158 (comment): Run the PR's test suite across an OS/container boundary, not just a separate job (the suite shares the step's runner user and can reach GITHUB_OUTPUT via /proc). Needs a sandbox design of its own; the job split in this PR removes secrets, which is the #2143 scope.

Deferred from PR #2182: #2182 (comment) — the five collapsed agent-ingress rows in scripts/fleet_monitor.sh are skipped (warning, not error) while petry-projects/.github publishes no standards/workflows/agent-ingress.yml canonical; drift coverage begins once that template is published (org-template repo, outside this PR).

Run dispatch correlation race condition in feature-ideation.yml (PR #1796): Requires maintainer decision on whether to evolve the workflow_dispatch trigger shape to support nonce-based correlation.
#1796 (comment)

Deferred from PR #1796 thread #1796 (comment) — feature-ideation.yml redispatch: gh workflow run returns no run id, so exact per-dispatch run correlation needs a nonce workflow_dispatch input, which changes the stub trigger shape the header forbids. Needs a maintainer decision (reusable/template change upstream). Current code is best-effort: created-at >= dispatch time, with workflow-runs-page fallback.

PR #1796 thread #1796 (comment): .github/workflows/feature-ideation.yml redispatch step links the dispatched run by creation time (>= dispatch_time minus 5s), which is best-effort. A concurrent workflow_dispatch in the same window could still be linked. Exact per-dispatch correlation needs a nonce workflow_dispatch input, which changes the stub trigger shape the header forbids, so it needs a maintainer decision.

PR #1796 — #1796 (comment) : feature-ideation.yml redispatch run lookup is timestamp-based (best-effort); a concurrent workflow_dispatch in the same window could be linked instead. True per-dispatch correlation needs a nonce input on the stub's workflow_dispatch trigger (or run-name keyed on it), which the stub header forbids without a maintainer decision.

PR #2135 thread #2135 (comment) — Same: require validate-ai-engines in the merge ruleset / merge queue

PR #2135 thread #2135 (comment) — Ensure config/ai-engines.json triggers canary releases (canary agent_ref_paths); the consumer manifest already lists it, deployed-channel comparison is separate

PR #2135 thread #2135 (comment) — Make Lint / validate-ai-engines (or engine-config-validate) a required ruleset context

PR #2135 thread #2135 (comment) — providers.fallback_order cannot steer primary while workflows inject REVIEW_ENGINE/DEV_LEAD_ENGINE=claude; needs workflow wiring change

Deferred from PR #2308 (CodeRabbit summary, Linked Issues check): the workflow_run trigger in templates/ci-failure-analyst.yml and this repo's caller stub is a follow-up to land only after the reusable workflow is promoted to the pinned channel (channel-skew sequencing, AGENTS.md). Stub is a synced org template, so the change belongs in petry-projects/.github standards.

Deferred from PR #2368 (#2368 (comment)): the TalkTerm, software-factory and markets rows in profile/README.md have empty Description cells because those repos have no GitHub About description. The catalog is generated from live About metadata, so the fix is to set About descriptions on those three repos and let the next README refresh pick them up.

Deferred from PR #2370 (CodeRabbit summary comment IC_kwDOR9SdIs8AAAABdmBMjA, #2370): in the repo-template BOOTSTRAP heredoc, (1) fullstack Dependabot guidance should add a pip entry per Python manifest dir; (2) sonar.projectKey/sources/tests examples carry inline # comments that break when copied into a .properties file. Both must be fixed upstream in repo-template, since the seeder heredocs mirror it byte-for-byte (drift guard).

Deferred from PR #2370 (seeder heredocs deliberately mirror combsmith/repo-template#252 byte-for-byte; the fix belongs upstream in repo-template, then re-mirror). Codex findings on BOOTSTRAP.md/AGENTS.md content:

fix(seed): mirror repo-template#252 docs into seed-repo-template.sh heredocs #2370 (comment) — derive instruction languages from STACK
fix(seed): mirror repo-template#252 docs into seed-repo-template.sh heredocs #2370 (comment) — remove inline comments from sonar properties example
fix(seed): mirror repo-template#252 docs into seed-repo-template.sh heredocs #2370 (comment) — install Homebrew bash in prerequisites
fix(seed): mirror repo-template#252 docs into seed-repo-template.sh heredocs #2370 (comment) — shellcheck glob with no matching scripts
fix(seed): mirror repo-template#252 docs into seed-repo-template.sh heredocs #2370 (comment) — placeholder check on missing files
fix(seed): mirror repo-template#252 docs into seed-repo-template.sh heredocs #2370 (comment) — preserve Bats tests allowed by STACK=none exception

docs(bootstrap): fix runbook defects raised on .github-private#2370 (#…

Deferred from PR #2374 (#2374 (comment)): BOOTSTRAP.md step 4 language detection uses find . -name '*.py'/*.sh, which scans ignored dirs (.venv, node_modules). Fix belongs upstream in repo-template (e.g. use git ls-files); the seeded copy must stay blob-identical to it.

fix(seed): mirror repo-template#255 BOOTSTRAP.md/AGENTS.md into seed-…

Navigation Menu

Repository navigation

dev-lead: deferred review findings #2047

From PR #1953 (`scripts/canary_report.sh`)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

dev-lead: deferred review findings #2047

Description

From PR #1953 (scripts/canary_report.sh)

Activity

github-actions commented on Oct 3, 2026

don-petry commented on Oct 4, 2026

don-petry commented on Oct 9, 2026

don-petry commented on Oct 9, 2026

don-petry commented on Oct 9, 2026

don-petry commented on Oct 9, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 10, 2026

don-petry commented on Oct 12, 2026

don-petry commented on Oct 19, 2026

don-petry commented on Oct 20, 2026

don-petry commented on Oct 20, 2026

don-petry commented on Oct 20, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

From PR #1953 (`scripts/canary_report.sh`)