Repository navigation
claw-sarif: ask for no token without a changed .t27, degrade to a step-summary note when the App cannot mint one (Closes #10501) - #10568
Merged
Conversation
… step-summary note when the App cannot mint one (Closes #10501) claw-sarif was red on every pull request: the token step asked for security_events write before the job knew whether any .t27 changed, and the TRI CLAW installation was never granted that permission. - The have step lists the pull request's files first; with no .t27 among them the job asks for no token and passes, saying so in the step summary. - The token step may fail (continue-on-error); the next step writes the reason and the owner's fix (docs/claw/README.md steps 1-2) to the step summary, and every later step runs only with a minted token. - Shrink offset: scripts/git_commands_tasks_1_4.sh is deleted (a spent one-shot staging script, ported as specs/port/scripts/git_commands_tasks_1_4.t27, referenced only by MIGRATION_AUDIT.md, whose row drops it). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gHashTag
enabled auto-merge (squash)
October 18, 2026 17:37
This was referenced Oct 18, 2026
This was referenced Oct 18, 2026
This was referenced Oct 18, 2026
Merged
Contributor
4 of 5 tasks
gHashTag
added a commit
that referenced
this pull request
Oct 18, 2026
…the token cannot be minted (#10576) (#10577) * claw: token_shape.t27 -- every App-token job passes with a note when the token cannot be minted (#10576) The law behind #10501: a job that mints a TRI CLAW App token carries continue-on-error on the token step and a step-summary note (or a github.token fallback). Run over master it names claw-t27f, claw-sarif, claw-suggest, claw-refresh and claw-batch; auto-merge-ready-prs.yml passes. Sealed, 9 of 9 tests, none vacuous. competitors.md records the Codacy and CodeRabbit precedent. Refs #10576, #10501, #10568 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * claw: token_shape.t27 -- `# token_shape: red` exempts an operator-dispatched job (#10576) claw-batch runs only when an operator dispatches it with a list of PRs. There a token that cannot be minted must fail the run; a green job with a note would hide that nothing was batched. The marker makes that choice explicit and visible in the workflow. Resealed, 10 of 10, none vacuous; removing the clause fails its case. Refs #10576 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
gHashTag
added a commit
that referenced
this pull request
Oct 18, 2026
…annot be minted; claw-refresh can read the queue (#10576) (#10585) * claw: claw-t27f, claw-suggest, claw-refresh pass with a note when the App token cannot be minted; claw-refresh lists PRs 25 a page (#10576) claw-refresh was red on every push to master: its GraphQL listing asked for 100 open PRs with mergeStateStatus a page, and with 207 open the second page outran GitHub's timeout (an HTML 502, "invalid character '<'"). 25 a page lists all 207 in the same time. claw-t27f, claw-suggest and claw-refresh now have the #10568 shape: the token step is continue-on-error, a failure step writes the owner's fix to the step summary, and later steps run only with a token. claw-batch is operator- dispatched and stays red on purpose, marked `# token_shape: red` for the law in specs/claw/token_shape.t27 (#10577). Shrink offset: scripts/mcp-wrapper.sh (-10), ported to specs/port/scripts/mcp-wrapper.t27 and sealed; nothing runs it. Refs #10576 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * claw: refresh is held to the Actions queue -- one merge refreshes at most (100 - queued) / 25 pull requests (#10588) With the GraphQL listing healed, claw-refresh would update up to 30 behind pull requests after every push to master. Each moved head starts about 25 workflow runs, so one merge could queue 750 runs while 886 were already waiting. The master ruleset is not strict, so a refresh only buys freshness: it never unblocks a merge. specs/claw/refresh.t27: - refresh_budget(queued) refreshes nothing at QUEUE_ROOM (100) or more queued runs. Below that it allows (QUEUE_ROOM - queued) / RUNS_PER_REFRESH (25), never more than REFRESH_CAP. An unread count refreshes none. - refresh_plan_queued is what the job calls. It adds one summary line saying which case applied. - refresh_plan_within carries the old body with the cap passed in; refresh_plan keeps its meaning (REFRESH_CAP). - Six new cases: a budget sweep over -1..1000, a busy queue, a quiet queue, an unread queue, a limit above the cap, and the text pins. - Lab results: 50/50 passing, 0 vacuous. Three negative controls fail their cases as they should: cap not lowered, room check removed, unread branch removed. gate-topology.yml claw-refresh: - reads actions/runs?status=queued total_count (permissions gain actions: read) before the listing loop; - passes the count to the harness, which parses it strictly (empty, non-numeric, negative or > i32 is unread); - these inputs were run through the harness on the lab: 886, 0, 30, empty, abc, -, -3 and 99999999999. gen/c/claw/refresh.c regenerated; seal claw_ClawRefresh.json remade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #10501
What changes
claw-sarifin.github/workflows/gate-topology.ymlfailed on every pull request, including Markdown-only ones: thetokstep asked the TRI CLAW App forsecurity_events: writebefore the job looked for a changed.t27, and the installation was never granted that permission ("The permissions requested are not granted to this installation").havestep lists the pull request's files (pull-requests: read,github.token) before anything else. With no changed.t27, it asks for no token and writes "claw/sarif asked for no token - this pull request changes no .t27 file." to the step summary.tokstep iscontinue-on-error. When it fails, the next step writes the reason and the owner's fix (docs/claw/README.md, steps 1-2) to the step summary. Checkout, cosign, the feed and the upload run only whensteps.tok.outputs.tokenis set. This matches the README's promise: "without them the job uploads nothing and says so in its step summary".scripts/git_commands_tasks_1_4.shis deleted (-32 lines). It was a spent one-shot staging script, already ported asspecs/port/scripts/git_commands_tasks_1_4.t27. Its only reference was itsMIGRATION_AUDIT.mdrow, which drops it. The workflow is +12/-10.Evidence (Railway lab, master 8078807 plus this diff)
own_language.c check_all: rc 0.check_budget: rc 0.tri census pin --gate: PASS, no pinned census moved. Shell census: 325 run steps before and after.run:written inside a flow mapping (- {if: ..., run: ...}) is not counted by the shell census..t27. Its ownclaw-sarifrun shows the first scenario: no token is asked for, the job is green, and the step summary carries the note.Owner step (unchanged, outside the repo)
Grant
security_events: writeto the TRI CLAW App and accept it on the gHashTag installation. Until then, PRs with a changed.t27get the step-summary note instead of a red check.🤖 Generated with Claude Code