Repository navigation
test(planning): one-command attended re-pin for interview-defenses digest pins #6334
Description
Problem
plugins/planning/tests/interview-defenses.test.sh pins sha256 digests of guarded sections of the interview skill and says only an attended run may recompute a pin. That holds: on 2026-10-04 the auto-mode classifier denied an agent's re-pin edit ("Security Test Removal") even after the user had approved the new text, and it also denied an agent's plain run of reattach-slice.test.sh. The user then had to run three hand-built sed lines, one at a time, because the session's worktree isolation refuses chained commands that also touch git. That cost several round trips for a two-line change.
Proposal
Add --repin <section-label> to the test (or a sibling repin.sh). It recomputes that one section's digest, rewrites only that pin constant, takes the justification sentence as an argument and inserts it beside the existing ones, then reruns the test and prints PASS/FAIL. The attended step then becomes one ! line the user runs after reading the diff. The pin stays human-gated; only the mechanics shrink.
Acceptance
- One command re-pins one section and adds its justification comment; every other pin is left byte-identical.
- The command refuses a section label that does not exist, and changes nothing when the digest already matches.
Activity
github-actions commentedon Oct 4, 2026
Thanks for the report. Automated triage handed this issue to a maintainer.
Automated triage. A maintainer reviews it.
kyle-sexton commentedon Oct 13, 2026
Decision recorded. The owner approved applying independently verified recommendations on 2026-10-12.
--repin <label>flag on interview-defenses.test.sh or as a sibling repin.sh? → sibling repin.shBasis: plugins/planning/tests/interview-defenses.test.sh:103 (ATTENDED_ONLY text), :226 (pin_section signature), :252 (digest failure text); issue body (classifier denial 2026-10-04); judgment on placement
Asks for a one-command attended re-pin (flag or sibling script) for the sha256 section pins in the planning interview-defenses test, so a re-pin is one
!line instead of hand-built sed. Nothing on main implements it; the test still only prints the attended-only instruction.Verification notes:
Verified by an independent fresh-context check (confirmed, risk low): gh issue view 6334 (open, no owner decision); origin/main plugins/planning/tests/interview-defenses.test.sh:103 ATTENDED_ONLY, :224-228, :238 pin_section(), :248-254 failure text, :458-462 call shape (label, file, open, close, sha literal on its own line); git ls-tree plugins/planning/tests: no repin tooling; git log -5 on the test: #7302 records a re-pin justification, no repin script; gh pr list search repin interview-defenses: #5426, #6541, #7302 (none add tooling)
Admission to an agent lane stays with the work-class rules and owner ratification.
kyle-sexton commentedon Oct 13, 2026
Owner batch-ratified this admission in an attended session on 2026-10-12: work-class: scoped. Rule: class C1-C3, no trust surface, the independent check confirmed the recorded decision, and no owner step remains.
kyle-sexton commentedon Oct 18, 2026
Agent Brief
Type: Feature
Summary: Add a sibling repin script that re-pins one interview-defenses section digest in one command.
Current behavior:
The interview-defenses test pins sha256 digests of guarded interview sections and says only an attended run may recompute one. Re-pinning means hand-built edits to the pin constant and a justification comment.
Desired behavior:
repin.shbeside the test takes a section label and a justification sentence. It recomputes that section's digest, rewrites only that section's pin constant, inserts the justification beside the existing ones, reruns the test and prints PASS or FAIL.Key interfaces:
repin.sh <section-label> <justification>: exit codes for success, unknown label and no-op.Acceptance criteria:
scripts/run-test-file.shon the new script's test passes.scripts/check-changelog-fragments.sh.Out of scope:
This was generated by AI during backlog shaping. The owner approved this in an attended backlog-shaping session on 2026-10-17.
melodic-automation-lanes commentedon Oct 18, 2026
The work-resolve-issue run that
agent-readystarted failed before it reported, or the token broker refused it because its workflow files differ from main's. work-unblock removed and addedagent-readyback to start a fresh run on main's workflow files. It does this once per version of those files, so if this run fails the same way, a person looks at it.melodic-automation-lanes commentedon Oct 18, 2026
The work-resolve-issue lane stopped partway through this issue and needs a person.
Why, in the run's own words:
Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/39095229195
To retry, remove
needs-humanand addagent-readyagain.melodic-automation-lanes commentedon Oct 18, 2026
The work-resolve-issue run that
agent-readystarted failed before it reported, or the token broker refused it because its workflow files differ from main's. work-unblock removed and addedagent-readyback to start a fresh run on main's workflow files. It does this once per version of those files, so if this run fails the same way, a person looks at it.