Repository navigation
claw: token_shape.t27 -- every App-token job passes with a note when the token cannot be minted (#10576) - #10577
Merged
Merged
Conversation
…the token cannot be minted (#10576) The law behind #10501: a job that mints a TRI CLAW App token carries continue-on-error on the token step and a step-summary note (or a github.token fallback). Run over master it names claw-t27f, claw-sarif, claw-suggest, claw-refresh and claw-batch; auto-merge-ready-prs.yml passes. Sealed, 9 of 9 tests, none vacuous. competitors.md records the Codacy and CodeRabbit precedent. Refs #10576, #10501, #10568 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gHashTag
enabled auto-merge (squash)
October 18, 2026 17:46
This was referenced Oct 18, 2026
…patched job (#10576) claw-batch runs only when an operator dispatches it with a list of PRs. There a token that cannot be minted must fail the run; a green job with a note would hide that nothing was batched. The marker makes that choice explicit and visible in the workflow. Resealed, 10 of 10, none vacuous; removing the clause fails its case. Refs #10576 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 18, 2026
This was referenced Oct 18, 2026
Merged
Merged
4 of 5 tasks
This was referenced Oct 18, 2026
Contributor
This was referenced Oct 18, 2026
Closed
gHashTag
added a commit
that referenced
this pull request
Oct 18, 2026
…annot be minted; claw-refresh can read the queue (#10576) (#10585) * claw: claw-t27f, claw-suggest, claw-refresh pass with a note when the App token cannot be minted; claw-refresh lists PRs 25 a page (#10576) claw-refresh was red on every push to master: its GraphQL listing asked for 100 open PRs with mergeStateStatus a page, and with 207 open the second page outran GitHub's timeout (an HTML 502, "invalid character '<'"). 25 a page lists all 207 in the same time. claw-t27f, claw-suggest and claw-refresh now have the #10568 shape: the token step is continue-on-error, a failure step writes the owner's fix to the step summary, and later steps run only with a token. claw-batch is operator- dispatched and stays red on purpose, marked `# token_shape: red` for the law in specs/claw/token_shape.t27 (#10577). Shrink offset: scripts/mcp-wrapper.sh (-10), ported to specs/port/scripts/mcp-wrapper.t27 and sealed; nothing runs it. Refs #10576 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * claw: refresh is held to the Actions queue -- one merge refreshes at most (100 - queued) / 25 pull requests (#10588) With the GraphQL listing healed, claw-refresh would update up to 30 behind pull requests after every push to master. Each moved head starts about 25 workflow runs, so one merge could queue 750 runs while 886 were already waiting. The master ruleset is not strict, so a refresh only buys freshness: it never unblocks a merge. specs/claw/refresh.t27: - refresh_budget(queued) refreshes nothing at QUEUE_ROOM (100) or more queued runs. Below that it allows (QUEUE_ROOM - queued) / RUNS_PER_REFRESH (25), never more than REFRESH_CAP. An unread count refreshes none. - refresh_plan_queued is what the job calls. It adds one summary line saying which case applied. - refresh_plan_within carries the old body with the cap passed in; refresh_plan keeps its meaning (REFRESH_CAP). - Six new cases: a budget sweep over -1..1000, a busy queue, a quiet queue, an unread queue, a limit above the cap, and the text pins. - Lab results: 50/50 passing, 0 vacuous. Three negative controls fail their cases as they should: cap not lowered, room check removed, unread branch removed. gate-topology.yml claw-refresh: - reads actions/runs?status=queued total_count (permissions gain actions: read) before the listing loop; - passes the count to the harness, which parses it strictly (empty, non-numeric, negative or > i32 is unread); - these inputs were run through the harness on the lab: 886, 0, 30, empty, abc, -, -3 and 99999999999. gen/c/claw/refresh.c regenerated; seal claw_ClawRefresh.json remade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
specs/claw/token_shape.t27: the law behind claw-sarif fails every pull request: it mints the App token before it looks for a changed .t27, and the installation lacks security_events: write #10501. Each job that mints a TRI CLAW App token must putcontinue-on-error: trueon the token step (R1) and either write a step-summary note onsteps.tok.outcome == 'failure'or fall back togithub.token(R2). Its output is one<job>\t<rule>line per violation..trinity/seals/claw_ClawTokenShape.json): 9 of 9 tests pass and none is vacuous. A negative control removes the R1 flag and four tests fail; removing the fallback clause fails the fallback test.docs/claw/competitors.mdrecords the precedent: a gate that cannot judge must not block (Codacy, chore: Stop Codacy gates waiting on coverage for PRs without src changes facioquo/stock-indicators-dotnet#2344; CodeRabbit KB).Not in this PR (tracked in #10576): fixing the four remaining jobs, then wiring the law into claw-drift so it is enforced.
Refs #10576
🤖 Generated with Claude Code