From 6de596b0c57858442b364c023b5a2bfc5bc01249 Mon Sep 17 00:00:00 2001 From: SUaDtL Date: Sat, 1 Aug 2026 10:33:56 -0400 Subject: [PATCH 1/2] chore(coderabbit): stop re-reviewing the vendored plugin trees This repo vendors one source of truth into three host plugins: sync-core.py copies core/pysrc/*.py byte-identically into each plugin's hooks/ dir, and build-surface.py renders core/surface/ into each plugin per core/hosts.json. CI fails if a copy drifts, so a defect in core/ is mechanically present in every copy. Unconfigured, CodeRabbit reviewed each copy independently. On #576 it left 102 inline comments, 48 of which this config now filters, with SKILL.md flagged 40 times and _releaselib.py 15 times. That volume is what forced the deferrals in #577 and #578. Filters are negation-only: it is undocumented whether a positive pattern flips the list into allowlist mode, and guessing wrong would lose review coverage entirely. Verified against git glob semantics that the 55 authored test files under plugins/ca/hooks/tests/ are not caught; the three authored _host.py files are, which is the accepted cost of not using a positive re-include. Nothing is filtered that was not proven derived: plugins/ca-sandbox/ is absent from core/hosts.json and plugins/ca-pi/generated/ has no verified generator, so both stay reviewed. The gate-events.log append rides along because H-05 refuses to let an audit log be unstaged; the log is machine-appended session state. --- .codearbiter/gate-events.log | 1 + .coderabbit.yaml | 106 +++++++++++++++++++++++++++++++++++ 2 files changed, 107 insertions(+) create mode 100644 .coderabbit.yaml diff --git a/.codearbiter/gate-events.log b/.codearbiter/gate-events.log index 3526fd62..0a145054 100644 --- a/.codearbiter/gate-events.log +++ b/.codearbiter/gate-events.log @@ -1670,3 +1670,4 @@ io.open(sys.argv[2],'w',encoding='utf-8',newline='\n').write(open(sys.argv[1],en [2026-08-01T05:58:23Z] REMIND [H-12] host=claude hook=post-write-edit.py | plugins/ca-pi/CHANGELOG.md is governed by ADR-0013-add-ca-pi-sibling-governance-plugin (Add ca-pi as a sibling governance plugin using the shared core and a thin Pi adapter). If this change contradicts it, route to /ca:reconcile or /ca:adr — do not drift silently. [2026-08-01T06:01:28Z] REMIND [H-12] host=claude hook=post-write-edit.py | README.md is governed by ADR-0006-broad-adoption-oss-posture (Broad-adoption OSS posture, optimizing for adoption over a commercial vertical). If this change contradicts it, route to /ca:reconcile or /ca:adr — do not drift silently. [2026-08-01T06:43:10Z] REMIND [H-12] host=claude hook=post-write-edit.py | core/pysrc/taskwrite.py is governed by ADR-0011-multi-host-codex-plugin-shared-core (Multi-host support — third sibling plugin ca-codex via shared core + thin host adapters). If this change contradicts it, route to /ca:reconcile or /ca:adr — do not drift silently. +[2026-08-01T07:03:13Z] REMIND [H-09] host=codex hook=post-write-edit.py | Crypto/TLS pattern detected. Run the crypto-compliance check + dispatch auth-crypto-reviewer (no MD5/SHA1/DES/3DES/RC2/RC4/Blowfish; do not disable TLS verification). The commit will block until the gate records a pass. diff --git a/.coderabbit.yaml b/.coderabbit.yaml new file mode 100644 index 00000000..9a39fdbc --- /dev/null +++ b/.coderabbit.yaml @@ -0,0 +1,106 @@ +# yaml-language-server: $schema=https://storage.googleapis.com/coderabbit_public_assets/schema.v2.json +# +# CodeRabbit configuration for codeArbiter. +# +# WHY THIS FILE EXISTS +# This repo vendors one source of truth into three host plugins: +# * tools/sync-core.py copies core/pysrc/*.py byte-identically into each +# plugin's hooks/ directory (all but _host.py). +# * tools/build-surface.py renders core/surface/ into each plugin's commands, +# skills, routines, agents and includes, per the +# rules in core/hosts.json. +# CI fails if any copy drifts, so a defect in core/ is mechanically present in +# every copy. Unconfigured, CodeRabbit reviews each copy independently and +# reports the same defect up to four times. Measured on PR #576: 102 inline +# comments, 49 of them (48%) on plugins/ trees, with SKILL.md flagged 40 times +# and _releaselib.py 15 times. That volume is what forced the deferrals in +# issues #577 and #578. + +# Load-bearing. Repo config OUTRANKS the central arbiterForge/coderabbit config +# and REPLACES it outright unless this is true. Without it, every org-wide +# default is silently discarded the moment this file exists. +inheritance: true + +reviews: + # Negation patterns only, deliberately. It is undocumented whether a positive + # pattern flips this list into allowlist mode and silences every path it does + # not name; the downside of guessing wrong is losing review coverage + # entirely, so nothing here is a positive pattern. + path_filters: + # --- rendered from core/surface/ by tools/build-surface.py --- + - "!plugins/ca/commands/**" + - "!plugins/ca/skills/**" + - "!plugins/ca/agents/**" + - "!plugins/ca/includes/**" + - "!plugins/ca-codex/skills/**" + - "!plugins/ca-codex/routines/**" + - "!plugins/ca-codex/includes/**" + - "!plugins/ca-pi/skills/**" + - "!plugins/ca-pi/routines/**" + - "!plugins/ca-pi/agents/**" + - "!plugins/ca-pi/includes/**" + + # Root-level surface renders. Enumerated per plugin rather than globbed, + # so an authored file of the same name in a non-generated plugin (such as + # plugins/ca-sandbox/) is never caught by accident. + - "!plugins/ca/COMMANDS.md" + - "!plugins/ca/SPRINT.md" + - "!plugins/ca/ORCHESTRATOR.md" + - "!plugins/ca-codex/COMMANDS.md" + - "!plugins/ca-codex/SPRINT.md" + - "!plugins/ca-codex/ORCHESTRATOR.md" + - "!plugins/ca-pi/COMMANDS.md" + - "!plugins/ca-pi/SPRINT.md" + - "!plugins/ca-pi/ORCHESTRATOR.md" + + # --- copied from core/pysrc/ by tools/sync-core.py --- + # A single `*` is intended NOT to cross a path separator, so the 55 + # authored test files under plugins/ca/hooks/tests/ stay reviewed. CodeRabbit + # maps these patterns onto git sparse-checkout, where `*` does not cross `/`, + # which is the basis for that reading — but it is not stated outright in the + # docs. VERIFY on the first PR that touches both a hooks/*.py file and a + # hooks/tests/*.py file: the test file must still draw review. + # + # Known cost: this also drops review of the three authored _host.py files, + # since re-including them would require a positive pattern. Three small + # files traded against 55 test files, accepted deliberately. + - "!plugins/ca/hooks/*.py" + - "!plugins/ca-codex/hooks/*.py" + - "!plugins/ca-pi/hooks/*.py" + + # Nothing is filtered here that has not been proven derived. plugins/ca-sandbox/** + # is absent from core/hosts.json, and plugins/ca-pi/generated/ is named as + # though it were built but has no verified generator, so both stay reviewed. + path_instructions: + - path: "core/**" + instructions: >- + This is the single source of truth for all three host plugins. + tools/sync-core.py copies core/pysrc/*.py byte-identically into each + plugin's hooks/ directory, and tools/build-surface.py renders + core/surface/ into each plugin's commands, skills, routines, agents and + includes, following core/hosts.json. CI fails the build if any copy + drifts from its source. Never suggest editing a file under plugins/ to + fix a defect — the fix belongs in core/ and the copies are regenerated + from it. Report each defect once, against the core/ file, and do not + note that the same issue appears in a vendored copy. + + - path: ".codearbiter/**" + instructions: >- + Project governance state, not application code: architecture decision + records, specs, plans, reports and audit logs. Review these for + internal consistency — claims that contradict the code they describe, + status headers left stale after a gate cleared, ledgers that disagree + with the artifact they summarise, cross-references to issues or commits + that do not exist. Do not apply code-style or formatting rules. + gate-events.log, overrides.log, triage.log and decisions/decision-log.md + are append-only by project rule: never suggest rewriting, reordering, + pruning or truncating lines that are already present. + + - path: "**/*.md" + instructions: >- + Prose in this repo is part of the product — skills and commands are + read and executed by agents, so an ambiguous instruction is a defect, + not a style nit. Prioritise findings where prose and the mechanism it + describes disagree, where a documented command or flag no longer + exists, or where an instruction cannot be followed literally without a + contradiction. Deprioritise wording, tone and formatting preferences. From e8e01df8efb4dcb9fafe32416b5a5db6eaa3e75b Mon Sep 17 00:00:00 2001 From: SUaDtL Date: Sat, 1 Aug 2026 10:42:29 -0400 Subject: [PATCH 2/2] docs(coderabbit): correct three claims the review caught CodeRabbit's review surfaced two documentation pages this config's comments were written without: configuration/configuration-inheritance and reference/glossary. Verified both directly rather than taking the review at its word; all three corrections hold. 1. Glob semantics are documented, not inferred. The glossary states `*` matches any filename and `**` matches any directory depth, so `*` does not cross a separator. The comment previously justified that reading via a git sparse-checkout mapping and asked for empirical confirmation on the first PR. Both are now unnecessary: the behaviour is stated outright, and the 55 authored test files under plugins/ca/hooks/tests/ are provably out of the exclusion. 2. Organization global overrides are never discarded. They apply as the final layer after the inheritance chain resolves, whatever a repo sets. The old wording said every org-wide default is discarded without `inheritance: true`; that is true of the central YAML only. 3. Merge semantics are documented: objects deep-merge, arrays take the child's items first then unique parent items, scalars take the child's value. Recorded so the next reader does not re-derive it. The precedence list is also corrected to the published eight levels. --- .coderabbit.yaml | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index 9a39fdbc..3c64ca07 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -16,9 +16,15 @@ # and _releaselib.py 15 times. That volume is what forced the deferrals in # issues #577 and #578. -# Load-bearing. Repo config OUTRANKS the central arbiterForge/coderabbit config -# and REPLACES it outright unless this is true. Without it, every org-wide -# default is silently discarded the moment this file exists. +# Load-bearing. Repo YAML (priority 2) outranks the central +# arbiterForge/coderabbit YAML (priority 3), and without this flag it REPLACES +# the central config outright instead of merging with it, discarding every +# default that file carries the moment this file exists. With it set, objects +# deep-merge, arrays take the child's items first followed by unique parent +# items, and scalars take the child's value. +# +# Organization global overrides are unaffected either way: they apply as the +# final layer after the inheritance chain resolves, whatever this flag says. inheritance: true reviews: @@ -54,12 +60,10 @@ reviews: - "!plugins/ca-pi/ORCHESTRATOR.md" # --- copied from core/pysrc/ by tools/sync-core.py --- - # A single `*` is intended NOT to cross a path separator, so the 55 - # authored test files under plugins/ca/hooks/tests/ stay reviewed. CodeRabbit - # maps these patterns onto git sparse-checkout, where `*` does not cross `/`, - # which is the basis for that reading — but it is not stated outright in the - # docs. VERIFY on the first PR that touches both a hooks/*.py file and a - # hooks/tests/*.py file: the test file must still draw review. + # A single `*` matches any filename and does not cross a path separator, + # while `**` matches any directory depth (CodeRabbit glossary). These + # patterns therefore exclude the 58 generated hook files while leaving the + # 55 authored test files under plugins/ca/hooks/tests/ fully reviewed. # # Known cost: this also drops review of the three authored _host.py files, # since re-including them would require a positive pattern. Three small