github-devloop implementation for #1907

[ElonSG]

github-devloop implementation PR for issue #1907

[ElonSG]

github-devloop PR child open

[ElonSG]

github-devloop PR is ready for review

[ElonSG]

github-devloop PR is ready for review

[codecov]

Codecov Report

❌ Patch coverage is 17.33333% with 62 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
libraries/forge/github/check_runs.lua	0.00%	26 Missing ⚠️
libraries/devloop/markers/builders.lua	0.00%	6 Missing ⚠️
libraries/devloop/payloads/builders.lua	0.00%	6 Missing ⚠️
libraries/devloop/markers/facts.lua	0.00%	5 Missing ⚠️
libraries/devloop/requests/review.lua	0.00%	4 Missing ⚠️
libraries/forge/merge/ci_gate.lua	0.00%	4 Missing ⚠️
libraries/devloop/replayer.lua	0.00%	2 Missing ⚠️
libraries/devloop/validators/fixing.lua	0.00%	2 Missing ⚠️
libraries/forge/merge/shared.lua	0.00%	2 Missing ⚠️
libraries/devloop/replay_fields.lua	0.00%	1 Missing ⚠️
... and 4 more

📢 Thoughts on this report? Let us know!

[ElonSG]

github-devloop PR review decision: reject
Three-angle verdicts: minimal=reject structural=reject delete=reject high-risk=approve
Blocking gap: Missing integration proof of own-CI-red fix dispatch cardinality

minimal:
Established saga/work-queue practice requires idempotent redrive identity to include the causal work item, so threading ci_failure_key into the fixing lineage is the right minimal shape; however this PR has not proven the stated minimal acceptance path because own_ci_red_fixing_lineage_test.lua only checks marker/fact/payload dedup lineage, not the required end-to-end "approve + own-CI red → fixing → exactly one fix codex attempt" behavior or identical redrive non-duplication. A narrow integration test over merge-gate replay into fix dispatch for one failed check run would change this.

structural:
Established saga/work-queue practice requires idempotent redrive identity to include the causal work item and liveness to read a durable attempt source-of-truth; this diff threads ci_failure_key through merge-gate, build_replayed_fixing_payload, and is_supported_fixing, but it does not add any durable record or transition proving a dispatch already ran for the current (head, failing check), so the stated acceptance that repeat 5-minute redrive is "WITHOUT climbing the timeout-attempt counter from a stable base forever" remains structurally unimplemented.

delete:
Established saga/idempotent-consumer practice requires retry identity to be derived from the durable causal work item, and the delete-angle case for ci_failure_key depends on reusing the existing merge-gate fact to delete the invariant fixing redrive loop. This diff adds ci_failure_key, but restart replay is wired to marker:merge-gate.ci_failure while the marker/fact field is ci_failure_key, so the liveness redrive path can still rebuild a replay payload without the CI failure fact and fall back to noci; the new surface is therefore not actually consumed where the no-op loop must be collapsed.

high-risk:
Established secure workflow/idempotent-consumer practice requires retry identity to be a bounded, validated causal fact and stale replays to fail closed; this diff satisfies that high-risk standard by deriving ci_failure_key from required check-run facts in required_head_check_run_failure_key, sanitizing/bounding it before marker and handoff use, carrying it through merge_gate_marker, merge_gate_fix_fact, build_replayed_fixing_payload, and valid_fixing_handoff, and rejecting mismatches in act_fix, so the own-ci-red scheduler change adds lineage without giving untrusted CI text or prompt-injected comments new authority.

⟦AI:FKST⟧

[ElonSG]

github-devloop merge gate failed: Missing integration proof of own-CI-red fix dispatch cardinality
Reproduce locally with scripts/run.sh test from the repository root.

[ElonSG]

github-devloop timeout redrive attempt: fixing 1

⟦AI:FKST⟧

[ElonSG]

github-devloop timeout redrive attempt: fixing 2

⟦AI:FKST⟧

[ElonSG]

github-devloop fix pushed for re-review

Previous reviewed head: 3981c3e
New head: 1af8b5f

[ElonSG]

github-devloop PR is ready for review

[ElonSG]

github-devloop PR review decision: reject
Three-angle verdicts: minimal=approve structural=reject delete=approve high-risk=approve
Blocking gap: Missing side-effect-boundary proof for own-CI-red fix dispatch cardinality

minimal:
Under established saga/idempotent work-queue practice, retry identity must include the causal work item; the minimal issue scope is now met because the diff threads ci_failure_key from own-ci-red into the merge-gate marker/handoff/replayed devloop_fixing dedup lineage, and test_own_ci_red_replay_dispatches_one_fixing_payload_keyed_by_failing_check_run proves replay emits one keyed devloop_fixing payload while an identical redrive preserves the same dedup key, closing the named dispatch-cardinality gap without needing broader conformance work in this PR.

structural:
Established saga/work-queue practice requires idempotent side-effect cardinality to be proven at the durable dispatch/consumer boundary, not only by showing repeated payload construction has the same key; the new test_own_ci_red_replay_dispatches_one_fixing_payload_keyed_by_failing_check_run still observes devloop_logging.log_raise from replay twice and asserts matching dedup_key, but it does not prove exactly one consumed devloop_fixing/fix-codex attempt for the current (head, ci_failure_key) or that an identical redrive is suppressed by the real source-of-truth, so the structural data-flow contract named in the prior gap remains unclosed.

delete:
Established saga/idempotent-consumer practice requires retry identity to be derived from the durable causal work item, and delete-angle review should reject added surface unless it collapses a no-op; this revision closes "Missing integration proof of own-CI-red fix dispatch cardinality" by wiring ci_failure_key into the merge-gate marker, replay payload, fixing dedup shape, validation, and an integration replay test that proves one devloop_fixing dispatch per identical failing check lineage, so the added field is justified as reuse of the existing deterministic CI failure fact to delete the invariant noci loop rather than as a parallel repair abstraction.

high-risk:
Established secure workflow/idempotent-consumer practice requires CI-triggered scheduler side effects to use bounded durable causal facts and fail closed on stale replay input; under this high-risk model, the named gap is closed because required_head_check_run_failure_key derives ci_failure_key from required check-run facts, validates it through merge_gate_marker, valid_fixing_handoff, and is_supported_fixing, act_fix rejects merge-gate mismatches, and the new replay test shows repeated own-ci-red redrive emits one devloop_fixing payload with the same dedup key rather than creating a new authority path.

⟦AI:FKST⟧

[ElonSG]

github-devloop fix-loop reflection: continue

Reason:
Established PDCA/OODA plus saga/idempotent work-queue practice requires narrowing feedback against durable causal work identity; the rounds are converging from missing ci_failure_key replay wiring to replay dispatch proof, and the remaining "Missing side-effect-boundary proof for own-CI-red fix dispatch cardinality" is still within the original "approve + own-CI red → fixing → exactly one fix codex attempt" acceptance, not a spec expansion.

[ElonSG]

github-devloop timeout redrive attempt: fixing 14

⟦AI:FKST⟧

[ElonSG]

github-devloop timeout reconcile action: drop

Reason:
state-output-obligation-timeout-after-14-attempts

Structured WHY:
reason_class=state-output-obligation-timeout
from_state=fixing
from_version=ready/github-devloop/issue/ChronoAIProject/fkst-packages/1907/intake/3167490732/review-loop/1/fix/1/fix/2/fix/3/review-meta-action/1
age_minutes=121
budget_minutes=120
attempt=14
attempt_limit=3
driving_queue=devloop_fixing
source_ref.kind=external
source_ref.ref=ChronoAIProject/fkst-packages#pr/1908

⟦AI:FKST⟧