[Wibias]

Summary

• Adds an explicit already-published publication mode: when the exact candidate is already on the remote branch, the plan contains one draft create_pr request and no push.
• The broker re-reads the remote branch and base at execution, requires the exact candidate SHA and base ancestry, and verifies the created PR headRefOid after creation. A plan-bound published_head receipt must match the lock before publication completes.
• Adds the supported --replan --reason transition from an existing push-mode lock; it refuses when receipts exist, the pre-open scope changed, or the candidate moved.
• Adds pushMode: "fast-forward": a plain git push only for a proven fast-forward on an existing branch. The default lease plan is unchanged.
• Bumps the package to 1.9.0 and documents both modes.

Validation

• 13/13 exact-head publication tests and 109/109 targeted publication/lifecycle tests pass.
• Pre-open gate on f524109: decision ready, 28 evidence rows cleared, 0 blockers. Reproducible distribution build and manifest/SHA256SUMS verification pass.
• policy-bundle --validate passes after fixing a candidate-side size regression introduced by the earlier ordinary fast-forward rule.

Safety

• Draft-only creation, duplicate-PR prevention, body integrity, hygiene/pre-open/authority binding, checkpoint locking, and default push behavior are unchanged.
• Absent, moved, or non-descendant remotes; wrong repo/base; stale heads/locks; and forged or stale receipts fail closed.
• Known boundary: verification and PR creation are separate reads. A branch that advances between them is caught by post-create head verification, which fails the receipt instead of claiming success.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 612ca83f-b8a3-4954-9b40-a57ca5a1b5c0

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[Wibias]

[GD] Verdict: approve-comment

TLDR

• PR: #493 — feat: support force-free exact-head PR publication
• Head: f5241090 on main (mergeStateStatus: CLEAN)
• Decision: useful and ready to merge
• Usefulness: Removes a real delivery blocker: an exact published candidate can become a draft PR without another push, and a proven fast-forward can publish without force or lease.
• Bugs: none blocking; 13 bug lenses and 6 deterministic probes completed on this head
• Security: none; argv-only subprocess calls, validated refs/remotes, SHA-only API paths, fail-closed verification
• Spec / standards: clean; the documented modes, replan transition, draft-only rule, and receipt semantics match the implementation
• Reviews: no human threads; CodeRabbit skipped the draft and posted no findings after ready
• Base / CI: green on f5241090; base main at 4e682bda; ship gate ready
• Gate: none
• Owner actions (foreign PR): none
• Bottom line: Ship it. Default push behavior, locks, receipts, hygiene/pre-open binding, and draft-only creation are preserved, and the new mode fails closed when the remote branch or base moves.

Full verdict

Semantic propagation

• Concepts audited: publication mode, push mode, plan lock, operation key, publication receipt, published-head verification, replan provenance.
• Authoritative sources: scripts/lib/create-pr-publication-plan.mjs, scripts/lib/create-pr-publication-state.mjs, scripts/lib/lifecycle-mutations.mjs, scripts/lib/mutation-checkpoint.mjs.
• Producers and consumers checked: planner CLI to checkpoint lock to broker preflight and post-create verification, controller receipt reconciliation, completion assertion, and pre-open evidence binding.
• Public/derived representations checked: README mode note, CHANGELOG entry, policy rule GD-GIT-009, CLI usage text, and the checkpoint lock schema.
• Material variant partitions checked: push versus already-published; force-with-lease versus fast-forward versus absent tip; matching, moved, absent, and non-descendant branches; wrong repo and base; forged and stale receipts; readable and failing remote reads.
• Positive and negative assertions checked: exact candidate accepted; absent, moved, non-descendant, foreign-repo, stale-lock, and forged-receipt cases rejected.
• Unmapped surfaces: none.
• Unproven equivalence assumptions: none; the existing push-mode path is re-exercised by the targeted suite.
• Representation mismatches: none.
• Variant coverage gaps: none material; the verification-to-create window is documented and a moved branch fails the post-create head check.
• Axis verdict: pass

Usefulness

The change fixes the observed dead end where an exact candidate is already on the remote branch but the planner still requires a push lease. It also keeps the smaller fast-forward improvement: a proven fast-forward can publish with a plain push. Both are documented and covered by focused tests.

Bugs / correctness

• Method: bug-review.md; static review of the diff plus the focused suites. Bugbot was not needed on this head.
• Findings: none blocking. The fail-closed paths are explicit: absent branch, moved branch, absent base, non-descendant candidate, wrong repo, wrong base, stale lock, and forged or stale receipts all throw.
• Fixed this session: none.

Security

• Scope reviewed: authorization modes, refs and remote validation, subprocess construction, API paths, and receipt provenance.
• Findings: none. Commands use argv arrays, refs pass git check-ref-format, the remote is checked against repository identity, and the compare API receives validated SHAs only.
• Fixed this session: none.

Spec / standards

• Spec source: PR body and the workflow policy modules.
• Gaps: none. The already-published mode contains no push, the initial create stays draft, duplicate prevention is reused, and completion requires both the create_pr and plan-bound published_head receipts.

Reviews

• Owners/maintainers: no open threads.
• Bots: CodeRabbit skipped the draft and posted no findings after the PR became ready.

Base / CI

• Behind/conflicts: clean; head f5241090 on base main 4e682bda.
• Required CI: all required checks pass on the head; the ship gate is ready.

Gate

• Draft/WIP/do-not-merge: cleared; the PR was marked ready before this verdict.
• Merge state: clean.

[Wibias]

[GD] Verdict: approve-comment

TLDR

• PR: #493 — feat: support force-free exact-head PR publication
• Head: b7bf4f90 on main (mergeStateStatus: CLEAN)
• Decision: useful and ready to merge
• Usefulness: Removes the authority-scope defect that blocked the sanctioned merge: the verifier now reconstructs the branch-bound scope that the host signed and passes the approved body through unchanged.
• Bugs: none blocking; 14 required lens rows and 8 deterministic probes recorded on this head
• Security: none; the branch comes from the authenticated grant, inconsistent branch bindings fail closed, and subprocess calls stay argv-only
• Spec / standards: clean; legacy branch-less grants keep their old scope, and the hidden marker no longer alters the approved body
• Reviews: no human threads; CodeRabbit skipped the PR
• Base / CI: green on b7bf4f90; base main at 4e682bda; ship gate ready
• Gate: none
• Owner actions (foreign PR): none
• Bottom line: Ship it. This verdict is bound to b7bf4f90; the earlier f5241090 verdict is superseded and is not reused for this head.

Full verdict

Semantic propagation

• Concepts audited: authority grant scope, signed branch binding, review verdict provenance, hidden marker stamping, merge review evidence.
• Authoritative sources: scripts/lib/authority-scope.mjs, scripts/lib/authority-grant.mjs, scripts/lib/review-verdict-provenance.mjs, scripts/lib/review-verdict-marker.mjs, scripts/lib/merge-review-evidence.mjs.
• Producers and consumers checked: Windows authority host resource/scope to github-mutate head refresh and authorization, marker stamping, publication, verify-verdict-published, and merge review evidence.
• Public/derived representations checked: CHANGELOG 1.9.0 entry, references/mutation-modes.md verdict provenance contract, and the focused test suites.
• Material variant partitions checked: branch-bound versus legacy branch-less grants; missing, mismatched, and tampered branch bindings; wrong head; foreign PR scope; tampered signature; trailing-whitespace body preservation.
• Positive and negative assertions checked: 12/12 verdict-provenance tests, 9/9 branch-grant audit tests, 6/6 head-refresh tests, 6/6 grant-v2 tests, 11/11 Node/C# scope lockstep tests; the real 0101 host-signed grant replay verifies with scopeMatches: true through the fixed pipeline.
• Unmapped surfaces: none.
• Unproven equivalence assumptions: none; unchanged candidate code reuses the same-SHA f524109 review evidence.
• Representation mismatches: none.
• Variant coverage gaps: none material; the old f524109 comment remains published but is not merge evidence for this head.
• Axis verdict: pass

Usefulness

Before this head, merge-pr-driver returned merge_review_authority_missing:review_authority_invalid:scope_mismatch even though the verdict was signed. The fix makes the verifier rebuild the same canonical scope: it reads the authenticated authorityBranch from the signed resource and no longer trims the body before appending the hidden marker. The 1.9.0 publication modes are unchanged.

Bugs / correctness

• Method: static review of the 6-file fix plus focused suites and a real-grant replay.
• Findings: none blocking. Fail-closed paths: branch bound in scope but missing from the resource, resource branch differing from the scope, wrong head, foreign PR scope, tampered signature, and visible-body changes all reject.
• Fixed this session: scope reconstruction and body preservation.
• Boundary: legacy branch-less grants are accepted only against their branch-less scope; they are not upgraded to branch binding.

Security

• Scope reviewed: authority scope canonicalization, grant resource binding, hidden marker handling, verifier decoding, and redemption requirements.
• Findings: none. authorityBranch is read from the signed payload and authenticated by verifyAuthorityGrant; every independently observable effect field still comes from the comment and PR. No shell interpolation, no new secrets, and no loosened mode.
• Fixed this session: verified.

Spec / standards

• Spec source: references/mutation-modes.md, references/github-mutation-broker.md, the Windows issuer design, and the PR workflow policy.
• Gaps: none.

Reviews

• Owners/maintainers: no open threads.
• Bots: CodeRabbit skipped the PR.

Base / CI

• Behind/conflicts: clean; head b7bf4f90 on base main 4e682bda.
• Required CI: all required checks pass on the head (CodeQL, Node 22/24, Windows trace bins, rewrite baseline, dependency review); mergeStateStatus CLEAN; ship gate ready.

Gate

• Draft/WIP/do-not-merge: cleared; the PR is non-draft.
• Merge state: clean.