feat(governance): add contributor branch preflight contract - #47
feat(governance): add contributor branch preflight contract#47HaodiFan wants to merge 22 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
candidate:needs-redaction
EvoZeus Privacy ScanMode: dry-run Findings
Next action
|
github-actions
Bot
added
proof:needed
EvoZeus Proof GateMode: dry-run Proof labels
Missing or weak fields
Next action
|
EvoZeus Queue GuardMode: dry-run Author open PRs: 6 Branch family: codex/dev/20260731-governance-branch-contract Branch family open PRs: 1 Violations
Next action
|
github-actions
Bot
added
risk:github-token
EvoZeus Labeler ReportPR type/risk labels were updated from changed files. Surfaces
Labels
Changed lines
|
github-actions
Bot
added
triage:dirty-pr
EvoZeus Dirty PR CheckMode: dry-run Surfaces
Reasons
Next action
|
EvoZeus Auto ResponseRedaction requiredThe PR appears to include sensitive evidence or private context. Redact secrets, raw logs, customer data, private paths, internal URLs, and unreleased business context before review. Missing real behavior proofThis PR needs real behavior proof before review can continue. Add the command, environment, input, output after the patch, observed result, and what was not tested. Split this PRThis PR appears to mix too many surfaces or protected paths. Split it into one primary layer and one review target. Owner review requiredThis PR changes a protected path. CODEOWNERS review and maintainer approval are required; do not request automerge. Queue limit reachedThis author or branch family appears to exceed the current queue limit. Reduce open PRs or ask a maintainer to override before continuing review. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 471ed9102f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4b39173b43
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8436fa93fc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7e39c09233
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ead91b5088
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1ddcf1e58b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6f3efecc02
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Follow-up commit Validation: |
github-actions
Bot
added
risk:dependency
1 participant
Governance surface changed
新增唯一、版本化的
evozeus.contributor_branchv1.3.1 machine contract、写入前只读 preflight planner、Core/community Skill 门禁与治理说明。Closes #44
Relates to MetaInFLow/EvoZeus-CoEvolve#36。CoEvolve 只消费并执行该合同，不建立平行规则。当前供下游固化的 revision 为
11ef28eed715a46d0dfc35bf443b64701a970a16。Problem with current rule
现有规则只约束分支命名，无法在首次业务写入前确定 canonical base、live Issue、参与者、权限路径、隔离 worktree、new/resume 与 collision/stale handling。调用方还可能自报
direct；过期 ledger 缺少可执行的 Owner 重新确认入口；purpose type 未进入 resume key 时会产生 ledger identity collision。Proposed rule
contracts/v1/contributor-branch-contract.json是 v1.3.1 machine truth，覆盖 Core、UAT repair development、community 与 CoEvolve target consumer 四个 profile。scripts/evozeus-branch-preflight.mjs plan只读解析 Git/GitHub 事实并输出稳定 JSON，固定writes=false。--actor与--permission仅表达期望；gh api user、RepoviewerPermission、archived/disabled 状态与 fork policy 决定实际 direct/fork/local 路径，失配即阻断。保留写权限字符串的 archived/disabled Repo 不解析为 direct。remote.origin的有效 fetch URL 与全部有效 push URL 必须匹配声明 Repo，包含pushurl、insteadOf和pushInsteadOf重写结果。skill-feedback标签或[Skill Feedback]标题前缀。--resume-plan ... --reconfirm-owner生成 refreshed plan，身份变化继续阻断。下游 ledger 持久化仍需独立批准。remote.origin仅接受 exactgithub.comHTTPS/SSH/scp-like identity；任一有效 fetch/push 目标为 lookalike host 或其他 Repo 时阻断。git ls-remote取证；查询不可用、cached base 过期或本地/live remote 同名目标分支分叉均阻断。.git重定向或损坏时阻断。--date时仅从 purpose 匹配的 validated plan target branch 恢复原日期。本 PR 相对
main含 2,460 additions / 7 deletions，共 12 个文件、22 个提交，超过 1,000 行审查阈值。Machine contract、可执行 planner、golden fixtures 与治理指令形成一个完整闭环。建议按三段审查：① machine contract、docs 与 Skill 入口；② planner；③ golden fixtures 与 gate wiring。本地 readiness 使用--allow-cross-layer验证。Before / after
Before：Agent 可在随机 checkout 中按文字规则自行选择分支和权限路径，首次写入前没有统一、可验证计划。
After：Agent 先展示 repo、base ref/commit、branch、live Issue evidence、verified actor、permission evidence、current/canonical checkout status、worktree、resume decision、next action 与 blockers；存在 blocker 时停止。
Abuse cases prevented
--permission direct自行授予 Repo 写权限。ghviewer 不一致仍复用他人 branch plan。pushurl或 Git URL rewrite，后续 push 发往其他 host/Repo。ls-remote触达。.git被重定向到 protected branch 后仍被标记为可恢复。--date时漂移到新 branch。Risk and boundaries
Planner 的 direct/fork 判断与 Issue 核验依赖 GitHub API 可用性与当前登录态，canonical base 与 target branch existence 依赖 effective origin 的 live read-only 查询。权限证据缺失时降级到 local，Issue 或 remote 证据缺失时阻断。Planner 不创建或切换 branch/worktree，不 commit、push 或创建 PR。
Rollout
Rollback
Revert 本 PR 的二十二个 commits 可整体移除合同、planner、tests 与治理入口。未知 profile 或 major version 的 consumer fail closed；不会留下 Git/GitHub 写入状态。
Evidence proof
HaodiFan、RepoMetaInFLow/EvoZeus、viewerPermission=ADMIN；planner 解析direct并核验 [P1][Governance] 将共创分支协议固化为 EvoZeus 开发默认门禁 #44 为 OPEN Issue、非 Pull Request。当前实现 worktree dirty 时返回 blocker 与writes=false。node --test scripts/evozeus-branch-preflight.test.mjs→47 passed；npm test；python3 -m py_compile scripts/check_pr_ready.py scripts/evozeus-coevolve-dispatcher.py；python3 scripts/check_pr_ready.py --base origin/main --allow-cross-layer；git diff --check。11ef28eed715a46d0dfc35bf443b64701a970a16的 Product CI、proof/privacy/schema/dirty/queue gates 与 Vercel 由 GitHub 复验。AI assistance
Codex 编写合同、planner、tests 与治理文档，并在真实本地/GitHub 环境运行验证。Owner review 仍需确认合同口径与 CoEvolve 消费边界。
Owner review
Exact-head update (2026-08-02)
-as_before joining, preserving injective branch naming.b6b14ffaae910d5346bd35f2ae1d9e672a10f83e92629286b8c7e35d922dcb1e.11ef28ehas all repository gates green.