fix(import): allow issue-only duplicate closes

[vincentkoc]

Summary

• stop requiring a code fix before closing duplicates in issue-only clusters
• preserve fix-first behavior for clusters containing pull requests
• keep issue-only clusters quarantined when any member has a security signal

Validation

• node --test test/import-gitcrawl-clusters.test.mjs (8/8)
• npm run validate (6,699 jobs)

[clawsweeper]

Codex review: needs changes before merge. Reviewed August 30, 2026, 7:28 AM ET / 11:28 UTC.

ClawSweeper review

What this changes

The branch changes GitCrawl cluster-job generation so non-security, issue-only autonomous clusters no longer require a prior fix before closeout, with coverage for issue-only, mixed, and security-signaled clusters.

Regression provenance

Possible regression — probable (reviewed change; failure trace). No predecessor PR is attributed.

Merge readiness

⛔ Blocked by patch quality or review findings - 5 items remain

Keep this PR open: its issue-only condition clears the shared fix-first guard for every close classification, not only duplicates, so superseded and fixed-by-candidate closeouts can bypass the intended repair-or-merge path. The author is a repository member, so automated closure is not appropriate in any case.

Priority: P1
Reviewed head: 62039ae65b18eeff123b6781792d0745d11a47a9

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The proposed policy change has a clear P1 safety regression despite focused fixture coverage.
Proof confidence	🌊 off-meta tidepool	Not applicable: This member-authored PR is exempt from the external-contributor proof gate; its generated-job fixtures are still insufficient to establish that non-duplicate closeouts remain quarantined.
Patch quality	🦪 silver shellfish (2/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This member-authored PR is exempt from the external-contributor proof gate; its generated-job fixtures are still insufficient to establish that non-duplicate closeouts remain quarantined.
Evidence reviewed	5 items	Introduced guard removal: The introduced hunk sets require_fix_before_close to false whenever a cluster has no pull requests and no security signal, even when merge permission is enabled; it does not restrict that false value to duplicate actions. Causal applicator path: The applicator returns immediately when require_fix_before_close is false; its duplicate-only exemption exists only after the guard is enabled. Therefore the generated false value also admits superseded and fixed-by-candidate classifications without a landed fix. Existing duplicate-specific behavior: The current applicator already exempts classification duplicate while retaining the fix-first guard for all other classifications, showing the required policy boundary is action-specific rather than cluster-shape-specific.
Findings	1 actionable finding	[P1] Preserve the fix-first guard for non-duplicate closeouts
Security	None	None.

How this fits together

GitCrawl import turns clustered GitHub reports into Clownfish job files. Those job permissions guide the planning worker and the final applicator that comments on or closes duplicate and superseded reports.

flowchart LR
  A[GitCrawl cluster data] --> B[Cluster-job importer]
  B --> C[Generated job permissions]
  C --> D[Planning worker]
  D --> E[Close-action classification]
  E --> F[Final applicator]
  F --> G[GitHub issue or PR closeout]

Loading

Before merge

• Preserve the fix-first guard for non-duplicate closeouts (P1) - For an issue-only cluster this writes require_fix_before_close: false, so validateFixFirstClose returns before reaching its duplicate-only exception. A planned close_superseded or close_fixed_by_candidate can therefore bypass the required fix or merge path. Keep that guard enabled and model any exception as duplicate-only policy.
• Resolve merge risk (P1) - Merging this branch would let non-security issue-only clusters emit superseded or fixed-by-candidate closeouts without the intended fix-first quarantine.
• Complete next step (P2) - A narrow mechanical repair can preserve duplicate-only planning while preventing the introduced bypass for non-duplicate closeouts.
• Improve patch quality - Retain the shared fix-first guard and add a distinct duplicate-only planning permission.
• Improve patch quality - Add planner/applicator boundary coverage showing duplicate closes may proceed while superseded and fixed-by-candidate closes remain blocked.

Findings

• [P1] Preserve the fix-first guard for non-duplicate closeouts — scripts/import-gitcrawl-clusters.mjs:277-282

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Introduced policy coverage	1 production condition changed; 3 new importer fixtures	All new tests inspect generated frontmatter, leaving the planner/applicator classification boundary untested.

Merge-risk options

Maintainer options:

1. Constrain the exception to duplicates (recommended)
   Keep the shared fix-first guard enabled and add a separate, default-deny duplicate-only planning permission with tests proving superseded and fixed-by-candidate actions remain blocked.
2. Pause the proposal
   Close or defer this branch if duplicate closeout policy should not gain a distinct planning permission.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Add a default-deny duplicate-only planning permission for eligible issue-only clusters; retain the fix-first guard for superseded and fixed-by-candidate actions and add focused boundary tests.

Technical review

Best possible solution:

Introduce an explicit duplicate-only planning permission for eligible issue-only clusters while retaining require_fix_before_close for every non-duplicate closeout, then cover both planning and application boundaries.

Do we have a high-confidence way to reproduce the issue?

Yes—source inspection gives a high-confidence path: generate a non-security issue-only autonomous cluster with merge enabled, then plan a superseded or fixed-by-candidate closeout; the generated false guard bypasses the applicator's fix-first validation.

Is this the best way to solve the issue?

No. A cluster-wide false guard is broader than the requested duplicate exception; a default-deny duplicate-only planning permission preserves the current non-duplicate safety invariant.

Full review comments:

• [P1] Preserve the fix-first guard for non-duplicate closeouts — scripts/import-gitcrawl-clusters.mjs:277-282
  For an issue-only cluster this writes require_fix_before_close: false, so validateFixFirstClose returns before reaching its duplicate-only exception. A planned close_superseded or close_fixed_by_candidate can therefore bypass the required fix or merge path. Keep that guard enabled and model any exception as duplicate-only policy.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 2ac8814a9d48.

Labels

Label changes:

• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🦪 silver shellfish, so this older rating label is no longer current.

Label justifications:

• P1: The introduced policy broadening can prematurely close non-duplicate issue reports in autonomous cluster processing.
• merge-risk: 🚨 automation: The change alters generated automation permissions and bypasses a guard used by the close-action applicator.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This member-authored PR is exempt from the external-contributor proof gate; its generated-job fixtures are still insufficient to establish that non-duplicate closeouts remain quarantined.

Evidence

Acceptance criteria:

• [P1] node --test test/import-gitcrawl-clusters.test.mjs.
• [P1] node --test test/apply-result.test.mjs.
• [P1] npm run validate.

What I checked:

• Introduced guard removal: The introduced hunk sets require_fix_before_close to false whenever a cluster has no pull requests and no security signal, even when merge permission is enabled; it does not restrict that false value to duplicate actions. (scripts/import-gitcrawl-clusters.mjs:277, 62039ae65b18)
• Causal applicator path: The applicator returns immediately when require_fix_before_close is false; its duplicate-only exemption exists only after the guard is enabled. Therefore the generated false value also admits superseded and fixed-by-candidate classifications without a landed fix. (scripts/apply-result.mjs:275, 2ac8814a9d48)
• Existing duplicate-specific behavior: The current applicator already exempts classification duplicate while retaining the fix-first guard for all other classifications, showing the required policy boundary is action-specific rather than cluster-shape-specific. (scripts/apply-result.mjs:1099, 2ac8814a9d48)
• Current-main comparison: Current main retains the original require_fix_before_close expression and removes this branch's tests, so the proposed unsafe broadening has not landed. (scripts/import-gitcrawl-clusters.mjs:277, 2ac8814a9d48)
• Area history: The affected import path has recent related maintenance by Vincent Koc, including the branch commit and prior queue/merge work; the branch commit has parent 3ec596c. (scripts/import-gitcrawl-clusters.mjs:277, 62039ae65b18)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (108 earlier review cycles; latest 8 shown)

• reviewed 2026-08-15T19:02:19.748Z sha 62039ae :: found issues before merge. :: [P1] Keep superseded closes behind the fix-first guard
• reviewed 2026-08-21T16:09:53.478Z sha 62039ae :: needs changes before merge. :: [P1] Limit the exception to duplicate closures
• reviewed 2026-08-23T07:03:55.153Z sha 62039ae :: needs changes before merge. :: [P1] Limit the exception to duplicate closures
• reviewed 2026-08-23T21:54:57.930Z sha 62039ae :: needs changes before merge. :: [P1] Keep superseded closures behind the fix-first guard
• reviewed 2026-08-25T00:08:47.964Z sha 62039ae :: found issues before merge. :: [P1] Keep superseded closes behind the fix-first guard
• reviewed 2026-08-26T10:04:27.669Z sha 62039ae :: found issues before merge. :: [P1] Keep superseded closes behind the fix-first guard
• reviewed 2026-08-28T23:02:12.848Z sha 62039ae :: needs changes before merge. :: [P1] Keep non-duplicate closeouts behind the fix-first guard
• reviewed 2026-08-29T15:00:23.340Z sha 62039ae :: needs changes before merge. :: [P1] Keep non-duplicate closeouts behind the fix-first guard