Stop progress comments from retriggering agent entrypoint

[sepo-agent-app]

Summary

• Use the job-scoped GITHUB_TOKEN for progress comment creation, updates, cancellation, and final replacement.
• Keep resolved App/PAT credentials limited to deterministic lifecycle and fallback operations.
• Preserve created and edited human-comment triggers for the Simplify edited-comment command routing #455/Simplify edited comment command routing #456 policy.
• Document why job-level bot filtering cannot prevent workflow-run creation.
• Add focused token-wiring, finalization, and trigger regression coverage.

Tests

• npm --prefix .agent run test:ci

Closes #499

[lolipopshock]

@sepo-agent /review

[lolipopshock]

@sepo-agent /answer what's the issue

[sepo-agent-app]

The original bug is that App-authored progress-comment edits spawned recursive Agent Entrypoint runs—48 extra runs were observed from two /answer jobs (#499). PR #500 fixes that with the non-recursive job GITHUB_TOKEN.

The remaining review issue is an identity mismatch:

• New /fix-pr statuses are authored by github-actions[bot].
• Old-status cleanup authenticates as the Sepo App/PAT and only collapses comments authored by that identity.
• Repeated /fix-pr runs can therefore leave stale status comments accumulating.

The core recursion fix works and CI passes; this is a minor cleanup/idempotency regression.

To fix it, send:

@sepo-agent /fix-pr preserve cleanup of both App/PAT-authored and github-actions[bot] fix-pr statuses, with cross-identity regression coverage

---

Sepo activity

Sepo finished — answer · 1m40s · 16 steps

Last message

The original bug is that App-authored progress-comment edits spawned recursive Agent Entrypoint runs—48 extra runs were observed from two /answer jobs (#499). PR #500 fixes that with th…

Activity

• 📖 Read gh issue view 499 --repo self-evolving/repo --json number,title,body,author,comments,labels,state,url (completed)
• ✏️ Edited gh api repos/self-evolving/repo/pulls/500/files --paginate --jq '.[] | select(.filename==".github/workflows/agent-fix-p… (completed)
• 🔧 Used tool gh api -H 'Accept: application/vnd.github.raw+json' 'repos/self-evolving/repo/contents/.github/workflows/agent-fix-pr.y… (completed)
• 📖 Read gh api -H 'Accept: application/vnd.github.raw+json' 'repos/self-evolving/repo/contents/.agent/src/review-summary-minimi… (completed)
• 🔍 Searched gh api -H 'Accept: application/vnd.github.raw+json' 'repos/self-evolving/repo/contents/.agent/src/cli/post-comment.ts?r… (completed)
• 💬 Message "The original bug is that App-authored progress-comment edits spawned recursive Agent Entrypoint runs—48 extra runs were observed from two /answer jobs (#499). PR Stop progress comments from retriggering agent entrypoint #500 fixes that with th…"

---

codex | gpt-5.6-sol[max] | Macmini-runner-2

[lolipopshock]

@sepo-agent /fix-pr preserve cleanup of both App/PAT-authored and github-actions[bot] fix-pr statuses, with cross-identity regression coverage

[github-actions]

Sepo pushed fixes for this PR. Branch: agent/implement-issue-499/codex-31679296821. Requested by @lolipopshock.

• Preserve fix-PR cleanup across App/PAT and github-actions[bot] identities while protecting human and unrelated-bot comments.
• Wire workflow-token cleanup through normal and unsupported finalization paths.
• Add cross-identity regression coverage and lifecycle documentation.
• Full npm --prefix .agent run test:ci passes.

---

Sepo activity

Sepo finished — fix-pr · 7m21s · 45 steps

Last message

{"summary":"- Preserve fix-PR cleanup across App/PAT and github-actions[bot] identities while protecting human and unrelated-bot comments.\n- Wire workflow-token cleanup through normal and unsupported finalization paths.\n- Add cross-ide…

Activity

• 🔧 Used tool (completed)
• 🔧 Used tool git diff -- .agent/src/github-graphql.ts .agent/src/cli/post-comment.ts .agent/src/__tests__/post-comment-cli.test.ts .… (completed)
• 🔧 Used tool git status --short --branch; git diff --check; git diff --stat; git diff --name-only -- .agent/CHANGELOG.md (completed)
• 📖 Read gh pr view 500 --repo self-evolving/repo --json headRefOid,state,url (completed)
• 💬 Message "{"summary":"- Preserve fix-PR cleanup across App/PAT and github-actions[bot] identities while protecting human and unrelated-bot comments.\n- Wire workflow-token cleanup through normal and unsupported finalization paths.\n- Add cross-ide…"

---

codex | gpt-5.6-sol | max | Macmini-runner-4

[lolipopshock]

@sepo-agent /review

[sepo-agent-app]

Rubrics Review

Total Score	Verdict	Rubrics Scored
96	PARTIAL	7

Dimension	Rubric	Result	Score	Evidence
coding_workflow / generic	Reuse existing code	pass	8/8	Extends the central gh helpers, GraphQL client, and existing final-comment merger instead of adding parallel API implementations.
coding_workflow / generic	Keep docs in sync	pass	7/7	The request lifecycle documentation explains non-recursive authentication, fallback behavior, and cross-identity cleanup.
coding_workflow / generic	Read docs and linked context first	pass	6/6	The design follows GitHub’s documented GITHUB_TOKEN behavior, addresses #499, and preserves the #455/#456 edited-command policy with focused trigger coverage.
coding_workflow / generic	Leave release notes to release preparation	pass	8/8	The current PR files do not modify .agent/CHANGELOG.md or other release notes.
coding_workflow / generic	Make surgical changes	pass	8/8	Changes remain confined to token plumbing, affected workflows, focused tests, and lifecycle documentation.
coding_workflow / generic	Make user-facing automation idempotent	pass	7/7	Finalization now cleans with each distinct App/PAT and workflow-token identity. The cross-identity regression test protects human, unrelated-bot, and current-progress comments.
coding_workflow / generic	Surface stateful failures	partial	5/7	Finalization failures are logged and return control to the normal fallback post, but current tests cover successful explicit-token merging rather than a failed workflow-token fetch/PATCH followed by fallback.

Notes

• The earlier repeated-run cleanup warning is resolved at current head 9718d97.
• The current GitHub check passes, and an independent npm --prefix .agent run test:ci passed all runtime, workflow, docs, and shell lanes.
• The smallest useful follow-up is one workflow-token finalization failure regression test; no blocking implementation change is needed.

Findings

• INFO: Under “Surface stateful failures,” add a focused test proving that a workflow-token fetch or PATCH failure is logged and produces the normal App/PAT-authenticated fallback comment.

Final Rubric Verdict

PARTIAL

---

codex | gpt-5.6-sol[max] | Macmini-runner-4

[sepo-agent-app]

AI Review Synthesis

Dual-agent review by Claude and Codex.
Requested by @lolipopshock.

Summary of PR/Issue

PR #500 addresses #499 by routing progress-comment creation, updates, cancellation, and final replacement through the non-recursive job-scoped GITHUB_TOKEN. Human-created and edited-comment triggers remain enabled, while App/PAT credentials remain available for pushes, PR creation, orchestration, and fallback operations. The agent process now receives the least-privilege repository token. A follow-up commit also preserves cleanup across App/PAT and github-actions[bot] identities.

Review

All three current review artifacts agree there are no blocking or warning-level defects on head 9718d97. The rubrics review remains partial only because of optional failure-path test coverage; there is no meaningful disagreement about merge readiness.

Issue	Severity	Description
No actionable issues remain	INFO	The current head resolves the prior cleanup regression and satisfies the token, trigger, authorization, fallback, and idempotency requirements. Remaining observations are optional hardening or separate-scope follow-ups.

Progress

• The previously reported cross-identity cleanup defect is fixed with two identity-scoped cleanup passes and regression coverage protecting human, unrelated-bot, and current-progress comments.
• The current Test Scripts check succeeds, and reviewer artifacts report independent full .agent CI passes.
• Human created and edited triggers remain preserved; release notes are untouched.
• Optional suggestions include testing workflow-token fetch/PATCH failure fallback, documenting internal memory/rubrics commit identity, centralizing token defaults for future routes, and separately considering the unchanged orchestrator-handoff edit.
• The prior old-head warning is superseded by current-head evidence.
• There are no inline comments or review threads. This synthesis posted, replied to, minimized, and resolved none.

Recommended Next Step

NO_AUTOMATED_ACTION: No unresolved actionable work remains; optional INFO follow-ups can be tracked separately.

Final Verdict

SHIP

Action Items

• None — no required branch changes remain.

---

codex | gpt-5.6-sol[max] | Macmini-runner-5

[sepo-agent-app]

Rubrics Update

No changes were committed to agent/rubrics from PR #500.

No rubric changes.

• The only human feedback was a PR-specific /fix-pr request from lolipopshock (CONTRIBUTOR), not an explicit rubric request.
• Bot suggestions were advisory and already covered by “Make user-facing automation idempotent” and “Surface stateful failures.”
• The rubrics branch remains clean; all 40 rubrics validate successfully.

---

codex | gpt-5.6-sol[max] | Macmini-runner-3