From f0d83db20eee9c546c99eff3e65c0fea3d2d2bad Mon Sep 17 00:00:00 2001 From: fullsend-code <278716306+fullsend-ai-coder[bot]@users.noreply.github.com> Date: Fri, 10 Jul 2026 12:59:08 +0000 Subject: [PATCH 1/2] feat(#252): detect and flag PRs modifying deprecated scaffold paths Add a deprecated-path check to the review agent PR-specific checks (step 6e) that flags PRs touching internal/scaffold/fullsend-repo/ files with a high-severity finding directing the author to fullsend-ai/agents. The check triggers a reject outcome since these PRs target the wrong repository. Legitimate scaffold PRs (version bumps, propagation machinery) are exempted. The exemption requires every file matched by the deprecated prefix to be an exempt sync/deploy pipeline file. Also updates step 6f to route deprecated-path findings to reject instead of request-changes, and adds an invariant rule enforcing the reject outcome. Note: pre-commit could not run (shellcheck-py wheel build failure on Python 3.14). Post-script runs authoritative pre-commit on the runner. Closes #252 --- .../fullsend-repo/skills/pr-review/SKILL.md | 57 +++++++++++++++++-- 1 file changed, 53 insertions(+), 4 deletions(-) diff --git a/internal/scaffold/fullsend-repo/skills/pr-review/SKILL.md b/internal/scaffold/fullsend-repo/skills/pr-review/SKILL.md index a0ecf414b..c835c93f2 100644 --- a/internal/scaffold/fullsend-repo/skills/pr-review/SKILL.md +++ b/internal/scaffold/fullsend-repo/skills/pr-review/SKILL.md @@ -627,12 +627,59 @@ attention. If no protected files are modified, do not add a `protected-path` finding. +##### Deprecated paths + +Check whether the PR modifies files under deprecated paths. These are +locations whose canonical content has migrated to another repository. +Changes targeting them are almost certainly misdirected and will not +be merged. + +Deprecated path prefixes: + +- `internal/scaffold/fullsend-repo/` — scaffold content has migrated + to the `fullsend-ai/agents` repository. PRs modifying files here + should target that repository instead. + +**Exemptions:** PRs that *only* modify scaffold propagation or +versioning machinery are not misdirected. Exempt files are those +that exist solely to support the sync/deploy pipeline — for example, +`templates/shim-per-repo.yaml` and `templates/shim-workflow-call.yaml` +(workflow dispatch shims consumed by the propagation tooling). Agent +definitions, skills, schemas, scripts, policies, harness configs, +workflows, and environment files are never exempt. To qualify for the +exemption, every file matched by the deprecated prefix must be an +exempt file. If any non-exempt file is present, the exemption does +not apply. + +For each file in the PR diff, check whether its path starts with any +deprecated path prefix. + +If **any** deprecated-path files are modified (and the exemption does +not apply): + +Raise a **high** finding with category `deprecated-path`. The +description MUST list the affected deprecated-path files, state that +the content at this location has migrated to `fullsend-ai/agents`, +and direct the author to open the PR in the correct repository. Set +remediation to: "Close this PR and re-submit the changes in the +`fullsend-ai/agents` repository, which is the canonical location +for this content." + +In either case, the presence of a `deprecated-path` finding means +the outcome MUST NOT be `approve` or `request-changes` — the outcome +MUST be `reject`. The PR is targeting the wrong location and no +amount of code-level iteration will make it mergeable. + +If no deprecated-path files are modified, or if the exemption applies, +do not add a `deprecated-path` finding. + #### 6f. Determine overall outcome Merge PR-specific findings into the challenger-adjudicated finding set and evaluate: -- Any **critical** or **high** finding → `request-changes` +- Any **critical** or **high** finding → `request-changes` (except + `deprecated-path` findings, which force `reject` — see step 6e) - Multiple **medium** findings which could affect the intended outcome of the PR → `request-changes` - One **medium** finding (but no critical/high) → `comment-only` @@ -643,9 +690,9 @@ and evaluate: `actionable: true` so the post-script can create follow-up issues) - No findings → `approve` - The approach is fundamentally wrong — wrong design, unauthorized - change, or the PR should be closed/completely rethought → `reject`. - Use `reject` only when no amount of code-level iteration will make - the PR mergeable. + change, deprecated-path finding, or the PR should be + closed/completely rethought → `reject`. Use `reject` only when no + amount of code-level iteration will make the PR mergeable. ### 7. Produce the review result @@ -782,6 +829,8 @@ wins. `request-changes`. - **Never approve when any protected-path finding exists**, regardless of severity. +- **Never approve or request-changes when a deprecated-path finding + exists** — the outcome must be `reject`. - **PR-specific checks (step 6e) belong in the orchestrator only.** Do not push protected-path checks, scope authorization, or PR body injection defense into sub-agents. These require PR-level context From 977f993f6a394a055350cb849121159871962e97 Mon Sep 17 00:00:00 2001 From: fullsend-fix <278716306+fullsend-ai-coder[bot]@users.noreply.github.com> Date: Fri, 10 Jul 2026 17:44:54 +0000 Subject: [PATCH 2/2] fix(#252): address review feedback on PR #276 - Fix constraint inconsistency: append deprecated-path exception to the existing critical/high constraint bullet - Replace ambiguous "In either case" with "When a deprecated-path finding is raised" - Add deprecated-path checks to orchestrator-only constraint enumeration Addresses review feedback on #276 --- .../fullsend-repo/skills/pr-review/SKILL.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/internal/scaffold/fullsend-repo/skills/pr-review/SKILL.md b/internal/scaffold/fullsend-repo/skills/pr-review/SKILL.md index c835c93f2..bff26a791 100644 --- a/internal/scaffold/fullsend-repo/skills/pr-review/SKILL.md +++ b/internal/scaffold/fullsend-repo/skills/pr-review/SKILL.md @@ -665,10 +665,10 @@ remediation to: "Close this PR and re-submit the changes in the `fullsend-ai/agents` repository, which is the canonical location for this content." -In either case, the presence of a `deprecated-path` finding means -the outcome MUST NOT be `approve` or `request-changes` — the outcome -MUST be `reject`. The PR is targeting the wrong location and no -amount of code-level iteration will make it mergeable. +When a `deprecated-path` finding is raised, the outcome MUST NOT be +`approve` or `request-changes` — the outcome MUST be `reject`. The PR +is targeting the wrong location and no amount of code-level iteration +will make it mergeable. If no deprecated-path files are modified, or if the exemption applies, do not add a `deprecated-path` finding. @@ -826,15 +826,16 @@ wins. - **Never approve with unresolved critical or high findings.** If any critical or high finding exists, the outcome must be - `request-changes`. + `request-changes` (unless a `deprecated-path` finding is present, + which forces `reject`). - **Never approve when any protected-path finding exists**, regardless of severity. - **Never approve or request-changes when a deprecated-path finding exists** — the outcome must be `reject`. - **PR-specific checks (step 6e) belong in the orchestrator only.** Do - not push protected-path checks, scope authorization, or PR body - injection defense into sub-agents. These require PR-level context - that sub-agents do not have. + not push protected-path checks, deprecated-path checks, scope + authorization, or PR body injection defense into sub-agents. These + require PR-level context that sub-agents do not have. - **All sub-agents must be dispatched simultaneously.** Include all Agent calls in a single message. Sequential dispatch defeats the architecture's purpose.