chore: repin the kit's caller stubs to v1.10.0 + land the bonsai-status-sync stub - #26
Merged
Merged
Conversation
…us-sync stub Step 2 of the README release order for v1.10.0 (b394c6d). - templates/github/bonsai-status-sync.yml: replaced the 190-line per-repo copy with the 66-line caller stub, pinned to b394c6d # v1.10.0. This completes the Phase 1 conversion started in #21 — the status machine, actor gate, linkage logic and cascade caveat now live in one central file. - Repinned the other five stubs. Note these jump v1.8.0 -> v1.10.0: v1.9.0 never got its kit repin commit, so the templates sat at 80c35fe through that release while the deployed fleet was waved to a54c91e. This closes that gap. - templates/github/README.md: moved bonsai-status-sync.yml from "Full workflows" to "Caller stubs" (five -> six), and rewrote onboarding step 5 — the board strings are no longer editable per repo, so a board rename is now a kit release + fleet repin rather than a local edit. - README.md: latest tag v1.9.0 -> v1.10.0 with the pin-sequence note, stub is no longer "pending", the kit paragraph now reads six stubs + claude.yml, and the wave-diff basename trap is scoped to the v1.10.0 wave specifically. - lint.yml header's "six reusables" verified still correct (6 workflow_call-only files in .github/workflows/); no change needed. actionlint clean across both halves. The placeholder-pin guard passes. The fleet is NOT waved yet — consumer repos still run the 190-line copy until then.
Member
Author
|
@claude please run /code-review:code-review |
…rapper 0bbb125 is older than the Admin API wrapper: graphql_guard.py does not exist at that SHA. So every fleet runner has been executing admin-graphql.sh with no fail-closed allowlist, leaving the Driver Engineering scope grant as the only control on destructive mutations — exactly the control the 25-scope narrowing was designed to lean on the wrapper for. Bumped in lockstep across both kit files, per the standing rule that a smoke test must verify the revision the implementer actually runs. claude.yml stays a per-repo copy, so no client repo is guarded until a wave copies this out. Not tagged yet — fold into the v1.10.0 wave or cut v1.11.0.
Member
Author
|
Coordination note (from the driver-agents session): the Shopify operator-tripwire block is being added to Decision on the open tag question (per Maria): this PR now carries kit content changes, so it ships as v1.11.0 — content changes get their own tag. After both land: merge, tag v1.11.0, repin stubs to that SHA, then one wave. Please hold the tag/repin/wave until the stacked tripwire PR is merged into this branch. |
… runbooks Review surfaced five problems; this fixes the four that are independent of the v1.11.0 tag decision. - templates/github/bonsai-status-sync.yml header said "Inherits secrets" while the body says "Explicit, NOT `secrets: inherit`". Wrong in the dangerous direction: the natural cleanup from reading the header is to swap the explicit map for `secrets: inherit`, which would hand an issues-triggered, centrally pinned file every org secret the repo holds. actionlint can't see comments, so nothing in CI catches it. Fixed in the stub AND in the scope doc's canonical block so it doesn't regenerate at the next conversion. - Same header claimed omitting `permissions:` yields a 403. It actually yields a silent startup_failure — no check run, no notification. Corrected both copies. - README release-order step 3: documented that the five pre-existing stubs' pin hunks CANNOT apply during this wave. They patch from 80c35fe (v1.8.0) but every deployed stub holds a54c91e (v1.9.0) — v1.9.0 shipped without a kit repin while the 2026-08-01 wave repinned the fleet anyway, so no kit revision has ever carried a54c91e in a pin line. `git apply` would reject all five on target #1. - De-staled both scope docs, which still asserted the stub had not landed: the decision banner, the Why paragraph, the phase table (Phase 5 done), the "Phase 1 landed" section, the placeholder pin in the canonical block, and the BONSAI_TOKEN / @claude-grep citations that moved out of templates/ at the repin. Recounted 261291955: 13 -> 11 across 4 files, since the kit stub no longer carries the actor gate. Stub is 67 lines now. The scope doc's canonical block is byte-identical to the landed file (verified by diff). actionlint clean; placeholder-pin guard passes.
…decision The DRIVER_AGENTS_REF bump inserted 5 lines at templates/github/claude.yml:183, taking the file 460 -> 465. Both scope docs open with an explicit "every file:line citation is re-verified" guarantee, which is exactly why they get trusted without re-checking — so every citation at or past the insertion point was silently wrong. Resolved all ~60 bare `:NNN` citations across both docs to their referent file before touching anything: most point at ticketed-review.yml, pr-first-review.yml, templates/github/README.md, or external claude-code-action sources and were correct. Ten were stale: - reusable-conversion-scope.md: :195/:202-206/:233 -> :200/:207-211/:238, :239 -> :244, :195-197 -> :200-202, :311 -> :316, :449-452 -> :454-457, :304 -> :309, :456 -> :461. - identity-unification-scope.md: :213 -> :218 (assertion 9's private-clone line, which a future session would have executed against a `for` loop), :233 -> :238, :458 -> :463, :195-197 -> :200-202. Two more were stale for a different reason and a +5 would not have fixed them: the `on:` block and actor-gate citations still pointed into templates/github/bonsai-status-sync.yml, which is now a 67-line stub containing neither. Repointed to the stub's :24-33 and the reusable's :139-141. Also recomputed the claude.yml line counts (460 -> 465; comment ratio 291/460 -> 296/465, 64%) and corrected the DRIVER_AGENTS_REF lockstep assertion, which still named 0bbb125 — the exact SHA this PR replaces. README: recorded the v1.11.0 decision and removed the fold-into-v1.10.0 option. Folding would put claude.yml content on 18 branches that exists in no tag, and fleet-pin-audit.sh compares only stub pin lines against the latest tag, so it would report the fleet uniform and green over the gap. actionlint clean. The scope doc's canonical stub block is still byte-identical to the landed file.
…#27) Appends the Shopify Admin API operator tripwire to templates/github/claude.yml's static --append-system-prompt, so the fleet gets the fail-closed wrapper (DRIVER_AGENTS_REF 4d63371) and the instruction block that describes it in one wave. The blockquote is copied from driver-agents docs/agent-instructions-shopify.md @ 4d63371 and is byte-exact after whitespace collapse (978 chars). A kit-side, explicitly non-canonical lead-in precedes it: it un-scopes the block from the conduct rules above and tells the model how to report a trip on a CI rail that has no way to set a job exit code. Review fixes folded in before merge: corrected a new comment that misdescribed the provisioning gate as issues-only when it excludes only /code-review; gave a tripped tripwire a sink so it cannot stop silently on a green job; added a lint.yml guard asserting the prompt survives shell-quote tokenization (one apostrophe upstream silently truncates it, and nothing else would catch that before 18 branches took a copy); and re-anchored the six doc citations the +12 line shift moved. actionlint green, new tokenization guard green.
mcarter-astronautdev
added a commit
to DriverDigital/vite-plugin-shopify-clean
that referenced
this pull request
Aug 2, 2026
Fleet wave for v1.11.0 (90f0d06). - bonsai-status-sync.yml: 190-line per-repo copy -> 67-line caller stub - five caller stubs repinned a54c91e (v1.9.0) -> 90f0d06 (v1.11.0) - claude.yml: DRIVER_AGENTS_REF -> 4d63371 (fail-closed Admin API allowlist) plus the Shopify operator tripwire in the static system prompt Centrally reviewed in DriverDigital/workflows#26 and #27; piloted on vite-plugin-shopify-clean (vars.BONSAI_URL proven to resolve against the caller) and foundrae-blackridge. [skip ci] so no deploy or review run fires.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Step 2 of the README release order for
v1.10.0(b394c6d). Tag is already cut and pushed.What this does
Lands the
bonsai-status-synccaller stub.templates/github/bonsai-status-sync.ymlgoes from the 190-line per-repo copy to the 66-line stub, pinned tob394c6d…# v1.10.0. This is the half that #21 deliberately deferred — a new reusable's stub can't be pinned until the tag containing it exists. The stub is verbatim the one specified indocs/reusable-conversion-scope.md; the only substitution was the placeholder pin.Repins the other five stubs — note they jump
v1.8.0→v1.10.0.v1.9.0never got its kit repin commit. The templates sat at80c35fethrough that release while the deployed fleet was waved toa54c91e, so the fleet has been a release ahead of the kit templates since 2026-08-01. This closes it. I found this while checking preconditions, not from the docs — worth knowing the audit didn't catch it.Three doc edits that were correct before this commit and would be wrong after it:
templates/github/README.md—bonsai-status-sync.ymlmoved from Full workflows to Caller stubs (five → six), and onboarding step 5 rewritten: the board strings now live only in the central reusable, so a board rename is a kit release + fleet repin, not a local edit. Editing them in one repo would silently do nothing.README.md— latest tag, the pin-sequence note above, stub no longer "pending", kit paragraph reads six stubs +claude.yml, and the wave-diff basename trap scoped to the v1.10.0 wave..github/workflows/lint.yml— "six reusables" verified still correct (6workflow_call-only files). No change.Verification
actionlintclean across.github/workflows/andtemplates/github/lint.yml's placeholder-pin guard passes — no@000…000leftissues/pull_request/pull_request_review, all threepermissions:present,BONSAI_BEARER_TOKENenumerated explicitly rather thansecrets: inheritNot in this PR
The fleet is not waved. Consumer repos still run the 190-line copy until the v1.10.0 wave — 18 repo@branch pairs across 11 repos. When that runs, step 3's trap applies: the diff carries
templates/github/bonsai-status-sync.ymland.github/workflows/bonsai-status-sync.ymlwith the same basename, so the wave script must assert no destination path is written twice after the path rewrite. Otherwise the reusable lands in a client repo as the workflow, fires on nothing, and looks green.Phase 2 pilot (
foundrae-blackridge@staging, private leg first) is still to run — thevars.BONSAI_URL-resolves-against-the-caller assertion is the last untested assumption.