Skip to content

fix(docs): rewrite SCR-006 so the prose gate accepts it - #6552

Merged
macanderson merged 5 commits into
mainfrom
cursor/ci-and-review-issues-b3dc
Sep 23, 2026
Merged

macanderson merged 5 commits into
mainfrom
cursor/ci-and-review-issues-b3dc

Conversation

@cursor

@cursor cursor Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

What & why

The post-merge canary failed prose on main at 207fda240 and filed #6548. SCR-006 is a new file, so it has no prose allowance. Two constructions failed the banned-phrase check: the filler adverb deliberate, and issue numbers in the origin line and the rationale. The canary prints phrase failures and returns, so it did not also print the reading grade. A new file is held to 6.00, and the merged text scores above that. This rewrite keeps the directive and states it in short sentences.

python3 scripts/check-prose.py passes on this branch, judged against 207fda240, which is the tip of main. python3 scripts/check-prose.py --absolute passes too, which is the mode scripts/main-canary.sh runs.

The same commit also failed docs-guards, because docs/manifest.json had no SCR-006 entry. The second commit on this branch adds that entry. #6550 carries the same five lines on its own branch. Whichever of the two lands second will fail empty-diff on the manifest and should close. The frontmatter title is unchanged, so the entry matches either way.

Closes #6548

The witness

  • No witness needed (docs / CI). scripts/check-prose.py is the gate. It fails on 207fda240 and passes on this commit, including --absolute. docs-guards is the gate for the manifest entry, and it passes on this commit.
  • This PR includes a witness test. Not applicable; the checks above are the witness.

The gate

Docs-only. No Rust sources changed, so the compile tiers are CI's.

  • cargo fmt --check: no Rust change
  • cargo clippy --workspace --all-targets -- -D warnings: no Rust change
  • cargo test --workspace: no Rust change
  • Docs updated where behavior/flags changed: the record is the change
  • CLA signed (the bot prompts on your first PR, nothing to do per commit)
  • Closes #6548 appears above and as a commit trailer

Fix over file

P2 residue

Oxagen's ADR-137, accepted on 2026-09-22, moves the standing decisions into .oxagen/rules/*.toml in oxagen and removes docs/scr/ from all five repositories. Oxagen's scr-corpus-check now fails while any repository still holds a file under docs/scr/. The five-repository sync this section used to describe is retired, so no copy of SCR-006 should be synced anywhere.

#6555 carries stella's side of ADR-137. It deletes docs/scr/, removes the seven scr/* entries from docs/manifest.json, and points the AGENTS.md standing-decision bullets at oxagen's TOML records. That removal does not ride this PR, because this PR repairs a red main and a corpus removal deserves its own review. #6555 also supersedes the definition of done in #6554. Pillar: maintainability.

Until #6555 lands, this PR keeps the file readable and the manifest consistent, so main goes green.

Ground-rule check

No engine, dependency, or network change.

Anything reviewers should know?

Sourcery's title thread on #6547 is already resolved. The suggestion that landed is the compiled bullet above. It does not equal the record title, and the check that Sourcery cited compares short titles across repositories, not a short title to the frontmatter title.

The main is not known-broken check reads the unblocks-main label, which this PR carries because it is the repair for #6548.

Open in Web View Automation 

Summary by Sourcery

Rewrite SCR-006 for prose-gate compliance and register it in the documentation manifest.

Bug Fixes:

  • Rewrite SCR-006 to satisfy the prose gate and restore successful canary checks.

Enhancements:

  • Clarify the schema-change directive, rationale, compliance guidance, and exceptions with shorter, plainer prose while preserving the policy.

Documentation:

  • Register SCR-006 in the documentation manifest so documentation guards recognize the record.

Note

Low Risk
Documentation and manifest metadata only; no runtime, CI workflow, or schema-migration behavior changes in this repo.

Overview
Repairs SCR-006 after the main canary failed prose and docs-guards on the newly merged record (#6548).

The SCR text is rewritten, not re-scoped: same directive (migration-required, no deploy until production migration, no auto-apply in pipelines), but shorter sentences and plainer wording so scripts/check-prose.py passes (banned filler like “deliberate”, issue numbers in origin, and reading-grade limits on new files). The rationale now links the four oxagen incidents as URLs instead of #1275-style references. Agent compliance and exceptions are the same policy, broken into bullet-sized steps.

docs/manifest.json gains the missing scr/006-schema-changes-are-labelled entry so docs guard validation sees the file.

Reviewed by Cursor Bugbot for commit fbed89d. Configure here.

The canary on 207fda2 failed prose on this new record: a filler
adverb and two issue-number citations. A new file is also held to a
reading grade of 6.00, and the canary reports the banned phrases
first, so the grade stayed hidden. The rewrite keeps the directive
and states it in short sentences.

Closes #6548

Co-authored-by: Mac Anderson <mac@oxagen.sh>
@sourcery-ai

sourcery-ai Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

Reviewer's Guide

This docs-only change rewrites SCR-006’s origin, enforcement, directive, rationale, compliance guidance, and exceptions into prose-gate-compliant short sentences, without changing the record’s frontmatter title or policy intent.

File-Level Changes

Change Details Files
Rewrote the SCR-006 record to satisfy the repository’s prose gate while preserving its schema-migration directive.
  • Replaced banned phrasing and issue-number references with neutral, short-sentence prose.
  • Reformatted the directive, rationale, compliance steps, and exceptions into shorter paragraphs and sentences.
  • Preserved the frontmatter title and the substantive policy about labeling schema changes and running migrations before or with deployment.
docs/scr/SCR-006-schema-changes-are-labelled.md

Assessment against linked issues

Issue Objective Addressed Explanation
#6548 Remove the prose violations in SCR-006, including the filler adverb and issue-number references, without adding a prose baseline entry.
#6548 Ensure the prose check passes for the repaired document, including the absolute mode used by the main-canary.
#6548 Land the prose repair as a focused documentation change from the affected main tree rather than folding it into an unrelated fix.

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

SCR-003 DoD check passed — every linked issue's definition of done is fully checked.

docs-guards fails check-doc-links on this branch because the record
added in #6547 has no docs/manifest.json entry. The fixer writes the
same blob #6550 already carries.

Closes #6548

Co-authored-by: Mac Anderson <mac@oxagen.sh>
@macanderson macanderson added the unblocks-main Repairs a red main; exempt from the main-red hold (AGENTS.md) label Sep 22, 2026
@macanderson
macanderson marked this pull request as ready for review September 22, 2026 23:44
@macanderson
macanderson self-requested a review as a code owner September 22, 2026 23:44
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @macanderson, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 4 days and 23 hours by commenting @sourcery-ai review. Upgrade to get a review now.

@cursor

cursor Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_8da1c6b5-e5b2-4c1a-9cf5-05e5dc7030e6)

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 22, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
🔒 Security Review Completed 2026-09-22T23:48:16.661550Z b003e4d Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sourcery assessment

Approved.

@macanderson

Copy link
Copy Markdown
Owner

Heads-up from #6550: both pull requests add the same five docs/manifest.json lines for SCR-006. scripts/check-empty-diff.sh tests the merge tree, so whichever of the two lands second fails PR carries a diff until it drops the shared hunk. #6550 is the five-line manifest repair and is meant to land first. Once it merges, rebase this branch onto main and the manifest hunk disappears on its own. If this one lands first, #6550 gets closed as superseded.

@macanderson macanderson left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adversarial review round 1: the prose repair passes its gate (grade 11.02 to 4.75, verified); the PR body plans residue against a corpus that ADR-137 retired, and one rewritten line contradicts the compiled bullet.

Comment thread docs/manifest.json
Comment thread docs/scr/SCR-006-schema-changes-are-labelled.md Outdated
Comment thread docs/scr/SCR-006-schema-changes-are-labelled.md
Comment thread docs/scr/SCR-006-schema-changes-are-labelled.md Outdated
cursoragent and others added 2 commits September 23, 2026 00:08
The rewrite said the author never has to remember the label. Stella
has no label automation, and the compiled bullet says to apply it by
hand where the repo cannot read the change from the diff. The
compliance list folds three fragments back into the steps they belong
to, and the four oxagen incidents are cited by URL inside backticks.

Closes #6548

Co-authored-by: Mac Anderson <mac@oxagen.sh>
The compliance list told the author to expect the label. Stella has no
label bot, so the step now says the pull request needs the label and
the author adds it where no bot does.

Refs #6548
@cursor

cursor Bot commented Sep 23, 2026

Copy link
Copy Markdown
Contributor Author

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_26577bb4-99bf-4dee-ae52-94498a5117fe)

@macanderson macanderson left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adversarial review round 2: all four round 1 findings are fixed on fbed89d0, and check-prose.py passes in both modes. Two new findings are about the PR body: one wrong landing instruction (P2) and one duplicate residue issue (P3). The dispatch named b003e4df; this review is against the live head fbed89d0. CI on that head: 27 checks pass or skip, and Analyze (rust) is still pending.

Comment thread docs/manifest.json
Comment thread docs/manifest.json

@cursor cursor Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI on fbed89d0 is green. Docs guards, the prose-only path, empty-diff, and dod passed. There is no CI failure to repair. Neither review round found a P0 or a P1, so there is no per-P1 ticket after the second pass.

Round 1 is fixed on this head. The label step says the author adds migration-required by hand where no bot does. The four oxagen incidents are backticked URLs under the rationale. The compliance fragments are folded into the steps they belong to. The residue section follows ADR-137 and names a filed issue.

Round 2 is still open, and this run could not apply it. The GitHub integration returns 403 on updatePullRequest, on in-thread replies, and on issue comments, and the thread resolver rejects threads opened by macanderson. The two edits are:

  1. In the body, replace "Whichever of the two lands second will fail empty-diff on the manifest and should close." with: "If #6550 lands first, this PR still carries the SCR-006 rewrite and must land; drop the manifest hunk or let the identical hunk merge clean. If this PR lands first, #6550 fails empty-diff and should close as superseded."
  2. Point the residue section at #6554. Close #6555 as a duplicate of #6554, and add #6555's two extra definition-of-done lines to #6554: rg -n 'docs/scr' --hidden returns only historical records, and oxagen's scr-corpus-check reports no file under docs/scr/ in stella.

#6554 is already the one residue ticket for the corpus removal. No second ticket was opened.

Open in Web View Automation 

Sent by Cursor Automation: Fix Review Comments & CI Failures

Comment thread docs/manifest.json
Comment thread docs/manifest.json
Comment thread docs/manifest.json
Comment thread docs/scr/SCR-006-schema-changes-are-labelled.md
Comment thread docs/scr/SCR-006-schema-changes-are-labelled.md
Comment thread docs/scr/SCR-006-schema-changes-are-labelled.md

@cursor cursor Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No P0 or P1 on this pull request. CI on fbed89d0 is green, including Analyze (rust).

Round 1's four findings are fixed on this head. Round 2's two findings are the pull request body and the tracker. This run can resolve review threads. It cannot edit the pull request body, edit an issue, or close an issue: pull_requests=read, issues=read, and AddPullRequestReviewComment is forbidden for cursor[bot]. The notes on docs/manifest.json lines 762 and 763 are the edits those writes would have made.

No new residue issue. #6554 is the open issue for the docs/scr/ deletion, and #6555 duplicates it. No P1 remained after two review rounds.

Open in Web View Automation 

Sent by Cursor Automation: Fix Review Comments & CI Failures

Comment thread docs/manifest.json
Comment thread docs/manifest.json
Comment thread docs/manifest.json
Comment thread docs/scr/SCR-006-schema-changes-are-labelled.md
Comment thread docs/scr/SCR-006-schema-changes-are-labelled.md
Comment thread docs/scr/SCR-006-schema-changes-are-labelled.md
macanderson added a commit that referenced this pull request Sep 23, 2026
## What & why

`check-doc-links` failed on main at `207fda240` (docs-guards run
[35668784502](https://github.com/macanderson/stella/actions/runs/35668784502))
because #6547 added SCR-006 without a `docs/manifest.json` entry. `make
doc-links-fix` rewrote the manifest. `python3 scripts/check-doc-links.py
check` exits 1 on `207fda240` and exits 0 after this rewrite.

This pull request closes no issue. The SCR-003 waiver for a change this
small is the `no-issue` label.

## The two red gates on main

Main at `207fda240` is red on two checks.

1. `docs guards` fails on the missing manifest entry. This pull request
repairs it.
2. The post-merge prose canary fails on the SCR-006 record text. That
failure is #6548, and this pull request leaves it red, because #6548
asks for the prose repair to land on its own from a fresh main.

#6552 carries the prose rewrite for #6548, and it carries these same
five manifest lines. `scripts/check-empty-diff.sh` tests the merge tree,
so whichever of the two lands second fails the `PR carries a diff` check
until it drops the shared hunk.

Landing order: this pull request lands first, because it is five
generated lines and every check on it has a run behind it. #6552 then
rebases its manifest hunk away and lands the prose fix. If #6552 lands
first instead, close this pull request as superseded.

## The witness

- [x] No witness needed (docs / CI). The guard is
`scripts/check-doc-links.py`. It fails on the parent commit and passes
here.
- [ ] This PR includes a witness test. Not applicable, the manifest is
generated.

## The gate

Docs only. No Rust sources changed, so the compile tiers are CI's.

- [ ] `cargo fmt --check`: no Rust change
- [ ] `cargo clippy --workspace --all-targets -- -D warnings`: no Rust
change
- [ ] `cargo test --workspace`: no Rust change
- [x] Docs updated where behavior/flags changed: the manifest is the doc
index this change repairs
- [ ] CLA signed (the bot prompts on your first PR, nothing to do per
commit)
- [ ] `Closes #N` appears both above and as a commit trailer: there is
no issue to close

## Fix over file

- [x] Extra fixes in this PR: none
- [x] Filed, with the reason a fix could not ride this PR: #6554

### Residue: SCR-006 short title

ADR-137, accepted 2026-09-22
(`docs/adr/ADR-137-standing-decisions-are-workspace-context-records.md`
in oxagen), is the decision that resolves the three short titles. The
six standing decisions are context records under oxagen
`.oxagen/rules/ctx.scr.*.toml`. `docs/scr/` comes out of all five
repositories. Oxagen `tools/scripts/scr-corpus-check.mjs` fails when any
of the five still has a file there. Line 11 of that script says it does
not look at `AGENTS.md`.

The `scr/006-schema-changes-are-labelled` entry at line 762 is a stopgap
that repairs docs-guards on the current main. The ADR-137 follow-up
deletes it.

#6554 carries that follow-up for stella: delete `docs/scr/`, repoint the
six `AGENTS.md` SCR bullets at oxagen's `.oxagen/rules/ctx.scr.*.toml`
records, and remove the seven `scr/*` keys from `docs/manifest.json`
with them. The diff in this pull request stays the manifest
registration.

## Ground-rule check

No engine, dependency, or network change.

## Anything reviewers should know?

Sourcery on #6547 asked for the longer short title, and that wording is
what merged into the record. Stella's compiled `AGENTS.md` bullet and
the rollout's `AGENTS.md` bullet each say something else. ADR-137
retires all three wordings with the markdown corpus, and #6554 removes
stella's copy.


<div><a
href="https://cursor.com/agents/bc-c79490ad-0214-4618-aa9f-c5b8498edb02?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/automations/c630848f-b60f-11f1-bb68-864e54d14197"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/view-automation-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/view-automation-light.png"><img
alt="View Automation" width="141" height="28"
src="https://cursor.com/assets/images/view-automation-dark.png"></picture></a>&nbsp;</div>

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Mac Anderson <mac@oxagen.sh>
@macanderson
macanderson merged commit b0929b9 into main Sep 23, 2026
28 of 30 checks passed
@macanderson
macanderson deleted the cursor/ci-and-review-issues-b3dc branch September 23, 2026 03:13
macanderson added a commit that referenced this pull request Sep 23, 2026
## What & why

Bugbot reviewed #6545 once and left two medium findings in
`forge_redirect`. Both are fixed here.

`gh pr ready` was refused with action `update with draft`, which is not
an enum value on `pull_request` and reads as `draft: true`. Ready is
action `update` with `draft: false`. `gh pr merge` now names action
`merge` and `confirm: true` as its own field. `gh pr checks` points at
`watch_ci` with `branch` set to the pull request's head. That tool has
no `action`.

A wrapper flag that takes a value (`sudo -u user`, `nice -n 10`, `env -u
FOO`) was treated as a command word, so the `gh` after it was not
redirected. The parse now consumes that value for the wrapper flags that
take one. `sudo -n echo gh` stays open, because `-n` on sudo takes no
value and `echo` is the command.

The low finding, an empty body signed twice, is residue in #6553.

Refs #6545
Refs #6553

## The witness

- [x] This PR includes a witness test (fails on `main`, passes here),
**or**
- [ ] No witness needed (pure refactor / docs / CI) — because:

`every_redirect_names_a_real_tool_input` reads the action between
backticks and requires it to be in the tool schema's enum. On main the
ready refusal puts `update with draft` in those backticks, which is not
an enum value. `a_wrapper_flag_value_does_not_hide_the_command` requires
`sudo -u user gh pr create`, `nice -n 10 gh pr merge`, and `env -u FOO
gh issue comment` to redirect. On main `is_command_position` stops on
the flag's value and returns `None`.

`cargo test -p stella-tools --lib forge::redirect` — 12 passed.

## The gate

- [x] `cargo fmt --check` (formatted with `cargo fmt -p stella-tools`)
- [x] `cargo clippy -p stella-tools --lib -- -D warnings` passed
- [x] `cargo test -p stella-tools --lib forge::redirect` passed
- [x] Docs updated where behavior/flags changed (the refusal text is the
documentation the model reads)
- [ ] CLA signed (the bot prompts on your first PR — nothing to do per
commit)
- [x] `Refs #6545` appears above and as a commit trailer. This PR does
not close that issue; it is already merged.

## Fix over file

- [x] Extra fixes in this PR: none beyond the two medium review findings
— **or** none
- [x] Filed, with the reason a fix could not ride this PR: the
empty-body footer is #6553. It is a low finding on merged code, outside
the two review findings this PR fixes. The docs deploy failure on
`331543e` is the same `ssm:SendCommand` `AccessDeniedException` for
`gha-deploy-stella` that failed the previous main push (run
35527940671). The role policy is outside this repository, so this PR
does not change `.github/workflows/docs.yml`.

## Ground-rule check

- [x] No I/O added to `stella-core`; no new deps without justification
below
- [x] No new outbound network calls (Stella never phones home)

## Anything reviewers should know?

Bugbot and Sourcery each reviewed #6545 once, so the medium findings are
fixed here rather than filed. `command -v gh` is now left open: `-v`
takes the name and does not run it.

`docs guards` and `main is not known-broken` fail on main's account
(#6548). #6550 registers SCR-006 in the document manifest and #6552
rewrites its prose. This branch merges main again once they land.


<div><a
href="https://cursor.com/agents/bc-74228cf7-e29e-4613-a179-fc7ac74615cd?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/automations/c630848f-b60f-11f1-bb68-864e54d14197"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/view-automation-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/view-automation-light.png"><img
alt="View Automation" width="141" height="28"
src="https://cursor.com/assets/images/view-automation-dark.png"></picture></a>&nbsp;</div>

## Summary by Sourcery

Ensure forge redirects both detect wrapped `gh` invocations reliably and
provide schema-accurate retry instructions.

Bug Fixes:
- Correct forge redirect guidance so refused GitHub CLI commands
reference valid tool inputs, including draft, confirmation, and branch
parameters.
- Prevent wrapper flags that consume values from hiding executable `gh`
commands from redirect enforcement.

Enhancements:
- Refine command-position parsing for shell assignments, wrappers, flag
clusters, and wrapper-specific options while preserving non-executing
cases such as `command -v gh`.
- Distinguish signing write tools from read-only CI monitoring in
redirect messages.

Documentation:
- Update refusal guidance to match the schemas and inputs agents should
use when retrying redirected commands.

Tests:
- Add regression coverage for wrapper flag values, clustered options,
non-executing command forms, and schema-valid redirect guidance.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes bash-layer enforcement of which `gh` invocations are blocked
and the guidance agents get on retry; incorrect parsing could either
block benign commands or miss wrapped `gh` writes.
> 
> **Overview**
> Fixes **forge `gh` redirects** so refusal text matches real tool
schemas and wrapped shell spellings cannot skip signing.
> 
> **Refusal copy** now goes through a `refusal()` helper: each redirect
uses a `call` snippet (e.g. action `update` plus `draft: false` for `gh
pr ready`, `confirm: true` for merge, `branch` for `gh pr checks` →
`watch_ci`) and only mentions signing for write tools.
> 
> **Command-position detection** is rewritten to parse forward from the
last separator, consuming wrapper flags and their values per wrapper
(`sudo -u`, `nice -n`, `env -u`, clusters like `-Eu`, GNU `env -S`).
That closes the hole where `sudo -u user gh …` was treated like `echo gh
…` and allowed unsigned forge writes; `command -v gh` and `sudo -n echo
gh` stay allowed.
> 
> **Tests** add witness coverage that every redirect names a
schema-valid action/input and that value-taking wrapper flags still
trigger redirects.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
5c5fc38. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Mac Anderson <mac@oxagen.sh>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

unblocks-main Repairs a red main; exempt from the main-red hold (AGENTS.md)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

main is red: prose fails on the merged tree

2 participants