fix(process): #303 H10 — anchor verdict marker to line-start (close self-reference false-open) [decisions-edit]

Second adversarial re-review (of the fix commit itself — dogfooding H10) found a remaining false-open: the `review-verdict:` marker was matched anywhere on a line, so a comment merely QUOTING the positive template — an instruction ("please post: Review-verdict: MERGEABLE @ <head>"), a blocking comment explaining how to clear itself, or the gate's OWN suggestion text echoed into a comment — was classified as a real head verdict and self-approved the merge. Fix: anchor the marker to line-start (`^[[:space:]]*review-verdict:`). A real verdict line starts with the marker; quoted/instructional uses have text before it. Also drops the dead `nosha` var (SC2034). Finding 2 (a BLOCKED mis-anchored to an OLDER sha doesn't retract a MERGEABLE@head) is deliberately NOT "fixed": staleness is symmetric — a pre-fix BLOCKED@oldsha must not block forever after the fix changes the sha and earns a fresh MERGEABLE@head. To retract, re-review head and post BLOCKED@head. Documented in decisions.md. Pipe-tested 21 cases (5 new: instructional-quote, self-reference reason-text, line-start-in-multiline, leading-whitespace, blocking-quotes-template), all deny/ask/allow correct. bash -n + shellcheck clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 19:11:05 +02:00
parent f87a2092c4
commit ff3df39c43
2 changed files with 21 additions and 12 deletions
@@ -113,8 +113,11 @@ comments=$(gq "repos/$owner/$repo/issues/$pr/comments?limit=100")
 if [ -z "$comments" ]; then
  decide ask "H10 merge gate: could not fetch PR #$pr comments to verify a head-referencing review verdict ($short). Confirm the adversarial/Codex review covered the latest commit before merging."
 fi
-# Verdict lines across all comment bodies (the convention marker, case-insensitive).
-verdicts=$(printf '%s' "$comments" | jq -r '.[].body // empty' 2>/dev/null | grep -iE 'review-verdict:' || true)
+# Verdict lines across all comment bodies: a real verdict line STARTS with the marker (after optional
+# leading whitespace). Anchoring to line-start is deliberate — it rejects a comment that merely QUOTES
+# the positive template mid-sentence (an instruction "please post: Review-verdict: MERGEABLE @ <sha>",
+# or the gate's own suggestion text echoed back), which would otherwise self-approve the merge.
+verdicts=$(printf '%s' "$comments" | jq -r '.[].body // empty' 2>/dev/null | grep -iE '^[[:space:]]*review-verdict:' || true)
 if [ -z "$verdicts" ]; then
  decide ask "H10 merge gate: no 'Review-verdict:' comment found on PR #$pr referencing head $short. Post the adversarial/Codex verdict (e.g. 'Review-verdict: MERGEABLE @ $short'), or confirm the review covered the latest commit and approve."
 fi
@@ -123,7 +126,7 @@ fi
 # (git short-sha prefix semantics) — NOT a loose substring test: an older sha that merely contains
 # the head prefix, or the head prefix appearing in an unrelated URL on the line, must NOT count
 # (adversarial false-opens). The verdict token must sit right after the marker on the same line.
-head_pos=0; head_neg=0; stale=0; nosha=0
+head_pos=0; head_neg=0; stale=0
 while IFS= read -r line; do
  [ -n "$line" ] || continue
  # The sha the line references: the hex token in its "@ <sha>" field (>=7 chars), lowercased.
@@ -131,7 +134,7 @@ while IFS= read -r line; do
        | grep -oiE '[0-9a-f]{7,40}' | tr 'A-F' 'a-f' || true)
  is_pos=0
  if printf '%s' "$line" | grep -iqE 'review-verdict:[[:space:]]*(mergeable|approved|lgtm)'; then is_pos=1; fi
-  if [ -z "$ref" ]; then nosha=1; continue; fi
+  [ -z "$ref" ] && continue   # marker present but no @<sha> -> falls through to the final ask
  case "$sha" in
    "$ref"*) if [ "$is_pos" = 1 ]; then head_pos=1; else head_neg=1; fi ;;
    *)       stale=1 ;;