git push no-mistakes
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
feat(agent): add native Grok Build support * feat: add native Grok agent support * no-mistakes(review): Preserve Grok invocation environment * no-mistakes(document): Clarify Grok’s pipeline-only skill role * docs: complete native Grok ExecPlan * no-mistakes(document): Clarify Grok opt-out documentation * no-mistakes: apply CI fixes --------- Co-authored-by: Boris <boriza@users.noreply.github.com> | 11 天前 | |
perf(pipeline): cut CI test latency (#901) * Stop re-execing the race test binary as fake gh so macos CI leaves the 10-minute package cap. GOMAXPROCS=3 go test -race -count=1: internal/pipeline/steps 566.6s -> 92.6s, plus citest 8.2s. The same CI-monitor tests still run under go test ./...; they just no longer share one package timeout with PR/review/git tests. * no-mistakes(review): Clean up helpers and strip valued race flags | 2 天前 | |
chore: backpass extracting memory to skills | 3 天前 | |
perf(pipeline): cut CI test latency (#901) * Stop re-execing the race test binary as fake gh so macos CI leaves the 10-minute package cap. GOMAXPROCS=3 go test -race -count=1: internal/pipeline/steps 566.6s -> 92.6s, plus citest 8.2s. The same CI-monitor tests still run under go test ./...; they just no longer share one package timeout with PR/review/git tests. * no-mistakes(review): Clean up helpers and strip valued race flags | 2 天前 | |
fix: replace the running executable during Windows self-update (#650) * fix: replace the running executable during Windows self-update Fixes #373 * fix(update): assert platform-appropriate permissions in replace tests Windows does not preserve Unix mode bits, so a hard 0751 assertion fails on windows-latest even when the replace logic is correct. Expect 0666 on Windows and keep 0751 everywhere else, and report the expected value in the failure message instead of a hardcoded 751. --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> | 8 天前 | |
Fix install.sh 403s by resolving latest via GitHub's HTML redirect. (#919) The unauthenticated REST latest endpoint is capped at 60 requests per IP per hour, so shared NAT/VPN/CI addresses fail the installer even though the asset download itself is fine. | 1 天前 | |
feat(config): make gate reconcile timings configurable (#862) * fix(scm): distinguish gh auth timeout from authentication failure Wrap Available() failures so context deadlines and a missing gh binary are not reported as "gh CLI is not authenticated". Co-authored-by: Cursor <cursoragent@cursor.com> * no-mistakes: apply CI fixes * no-mistakes: apply CI fixes * feat(config): make gate reconcile timings configurable Expose gate_reconcile_interval and gate_reconcile_timeout as global-only settings (defaults 2m / 30s) so operators can raise the parked-approval reconcile budget for slow host probes without changing the executor. Co-authored-by: Cursor <cursoragent@cursor.com> * no-mistakes(document): Correct gate reconcile and gh auth docs * no-mistakes: apply agent fixes --------- Co-authored-by: Cursor <cursoragent@cursor.com> | 1 天前 | |
feat(agent): add native Grok Build support * feat: add native Grok agent support * no-mistakes(review): Preserve Grok invocation environment * no-mistakes(document): Clarify Grok’s pipeline-only skill role * docs: complete native Grok ExecPlan * no-mistakes(document): Clarify Grok opt-out documentation * no-mistakes: apply CI fixes --------- Co-authored-by: Boris <boriza@users.noreply.github.com> | 11 天前 | |
fix(pipeline): safely publish CI repairs with proven continuity (#887) * feat(ci): make post-repair revalidation opt-in A CI repair used to restart the whole pipeline at Review, so every repaired check cost another full Review, Test, Document, Lint, Push, and PR pass over the change. That is the most expensive single behavior the pipeline has, and it was unconditional. ci.revalidate_repairs selects between the two deliveries. It defaults to false: the repair is published immediately through publishRunHead - the same guarded path the Push step uses, so review-approved-head continuity, the force-with-lease anchor, remote verification, the push binding, and the gate-mirror update all still apply - and the CI monitor keeps watching the same run. Set true to keep the repair local, revoke the run's review approval, and restart validation at Review so no CI repair is published without having been reviewed. The key lives in the existing ci block, so it inherits that block's global config, trusted-default-branch-only sourcing, and repo-overrides-global precedence with no new mechanism. It is a *bool so an explicit project false overrides a global true rather than reading as unset. Both CI fix paths take the same decision: the automatic auto-fix round and the manual round a person authorizes at the CI gate. No-change retries, the durable fix-attempt budget, duplicate-check suppression, transient reruns, merge-conflict handling, force-push safety, custody, and cancellation are untouched. The CI step logs which policy is in force before its first poll. VISION.md gains the constraint this default follows from: cost is a user-visible property of the gate, so a design that clearly adds significant end-to-end latency or token consumption must be opt-in. * no-mistakes(review): Preserve CI repair continuity across rebases * no-mistakes(document): Correct stale CI repair documentation * no-mistakes(ci): Fixed late gate-mirror failures misreporting published CI repairs. Published repairs now continue CI monitoring with a warning after durable remote binding, while Push-step mirror failures still propagate. Added regression coverage. Verified targeted race tests, rebase tests, make lint, and git diff --check * no-mistakes(document): Document late gate-mirror failure handling * fix(ci): decide repair publication by provable continuity A CI repair was published whenever ci.revalidate_repairs was off, and a merge-conflict repair rebases, so its head is not a descendant of the reviewed head. The publication guard was relaxed for that case with a base-ancestry exception, and a repair that reset to the rebase base satisfied it: reproduced, the reviewed commits were force-pushed away while the pipeline reported success. The actor was the CI repair agent itself, so provenance cannot stand in for the proof either. One rule now decides delivery on every CI-fix path, automatic and manual, CI failure and merge conflict alike: a repair is published without revalidating only when its continuity with the reviewed, published head can be PROVEN; when it cannot, the repair revalidates from Review. Continuity is proven when the repaired head is the run's durable review-approved commit or a descendant of it, read through the same reviewApprovedHead accessor the publication guard enforces, so the decision to publish and the guard that permits the push cannot disagree. Every failure to establish it - unreadable run, missing or malformed approval, unverifiable ancestry - counts as unproven. ci.revalidate_repairs still sets the intent identically on every path: false publishes when it is provable, true revalidates outright. Merge-conflict repairs are not carved out; they simply always land in the cannot-be-proven half, because resolving a conflict changes the commit's patch-id and no content-based guard can separate a resolved rebase from a dropped one. They now revalidate rather than being refused, so conflict repair keeps working. The base-ancestry exception and its rewriteBase plumbing are deleted; assertReviewApprovedPushHead is descendant-only again with no exception. Regressions: a genuine conflict rebase revalidates and succeeds; a reset-to-base conflict repair revalidates, never reaches the remote, and the reviewed work survives; an ordinary provable repair still publishes with the flag off and still restarts with it on; a run with no review authority revalidates rather than publishing. * no-mistakes(review): Correct merge-conflict revalidation guidance across all surfaces * no-mistakes(document): Correct CI repair revalidation documentation * no-mistakes(lint): Regenerate no-mistakes skill documentation * fix(push): record a publication only once all of it has settled The gate-mirror update ran after the push binding and the recorded head, which forced a choice between two wrong answers on a mirror failure. Returning the error made the CI monitor call an already published repair failed, and its next attempt then saw a clean, already-advanced head as producing no changes. Swallowing the error left the gate behind the remote for good, and `no-mistakes rerun` resolves its starting head from the gate, so a later rerun silently omitted the published repair. Settle the gate mirror before recording anything durable. Publication is now all-or-nothing: remote push, gate mirror, push binding, and recorded head all land or none of them are recorded. A partial failure is simply retryable - the next attempt re-enters the same path, finds the remote already at this head via an up-to-date no-op push, and completes the publication once the mirror works. The CI-repair warning special case is gone with it. Also correct four surfaces that still said the default publishes every repair, when it publishes only a repair whose continuity is provable, and make the merge-conflict regression conflict for real: the base and the feature now edit the same line, so the resolved rebase genuinely changes the commit's patch-id rather than replaying cleanly. Regressions: an unsettled publication records nothing and the retry completes it; a real conflict rebase revalidates and succeeds; a reset-to-base conflict repair revalidates and the reviewed content survives on the remote. * no-mistakes(review): Make CI repair publication atomic and retryable * no-mistakes(document): Correct CI publication documentation * fix(ci): fire the unsettled-publication retry only on real evidence The retry added for a part-way publication triggered on any clean worktree whose HEAD differed from the run's recorded head. That is not evidence a publication was attempted: a fix agent that commits and then errors leaves exactly that state, and so does a fixture whose recorded head trails the branch. The retry then ran instead of the fix round and the repair agent was never called, which is what broke TestCIStep_BitbucketAutoFixUsesLivePRHeadSHAForLogs on CI. publishRepair now records the commit whose publication it began and could not finish, and clears it on success or when the repair revalidates instead. The retry fires only for that exact commit, so it still settles a stalled publication without spending another fix attempt, and never swallows a fix round. The marker is in memory only: after a daemon restart the next fix attempt settles it instead, at the cost of one attempt, which is the honest accounting rather than a durable claim the process cannot make. Regression: a differing head with no attempted publication still runs the fix agent and never logs the retry. * no-mistakes(review): Retry unsettled publications before evaluating CI checks * no-mistakes(document): Document CI publication retry evidence * fix(ci): bound the publication retry and order the revalidation write Two defects in the repair-publication path, both reported on the PR. The unsettled-publication retry costs no repair attempt by design, so a gate mirror that could never be settled retried on every poll until the CI idle timeout - seven days by default - while the repaired commit already sat on the remote. Bound it to three attempts, then park for a person with the published head named, because a rerun would resume from the stale gate head and omit the repair. CI is testing the published commit, so no fix agent can help; what a person needs is to know the local gate is behind. recordLocalRepair advanced the in-memory head before its durable write. A failed write left the monitor watching a head the run record did not know about, still carrying its old review approval, with the revalidation the call exists to trigger silently lost. Write durably first, then advance. Regressions: the retry stops at its bound and parks naming the published head while spending only one fix attempt; a failed revalidation write leaves both the live head and the review approval untouched. * no-mistakes(review): Persist and safely settle CI publication retries * no-mistakes(document): Clarify CI publication settlement documentation * no-mistakes(ci): Serialized the process-heavy CI repair fixture tests to prevent macOS subprocess exhaustion and indefinite fake-gh stalls. Verified with 3 repeated focused runs, 25 repetitions of the previously hanging case, and the full internal/pipeline/steps suite (passed in 113.6s) * test(ci): stop paying for a monitor loop to assert a delivery decision The macOS job timed out at the 600s package cap: the repair fixture tests each drove the full CI monitor loop, so every case spent provider polls and several subprocesses on a two-core runner to observe something commitRepair already reports. Serializing them made the wall clock worse, not better. Assert the delivery decision from commitRepair - Revalidate, the remote, the review approval, the push binding - and keep exactly one monitor-loop test for the wiring that is genuinely the monitor's: turning a held repair into a restart at Review and stating the policy in force. Four full monitor loops go away and the cases run in parallel again. Coverage is unchanged: every case still asserts the same observables, and the paths that are about the monitor - the fix round not being swallowed, the bounded publication retry - still drive Execute. * revert(ci): strip the unscoped publication-retry machinery Two things were added to this branch by auto-answered review findings that were never in its scope, and the captain has declined both. Removed, not repaired: - retryPendingRepair and its CI poll-loop call site, its bound, and its exhaustion gate. New runtime behaviour in the monitor. - The durable pending-publication state it needed: SetCIPendingPublication, the ci_pending_publish_head / ci_pending_publish_attempts columns and their migration, the StepResult fields, and the restore-on-CI-entry path. A persistence and schema addition. - publishRunHead's publicationProgress return, which existed only to tell that machinery whether the remote had been verified. Three reported defects went with the code that contained them rather than being fixed: a restored pending publication bypassed by a provider skip path, a marker write that could be lost, and a marker never consumed after a daemon restart. They are not reachable once the machinery is gone. Kept unchanged: the uniform provable-continuity rule, the corrected agent guidance and docs, the single-statement UpdateRunPublication, the reference docs that no longer describe the removed mirror warning, and the real merge-conflict regression. Tests that only exercised the removed machinery go with it. What survives still covers behaviour that survives, including that a partial publication records nothing and the next attempt completes it - which is the atomicity guarantee, not the retry. * no-mistakes(document): Deduplicate CI revalidation configuration guidance | 2 天前 | |
fix(cli): scope AXI run resolution to the current branch (#850) * fix(axi): scope status and logs run resolution to the caller's branch `axi status` could report another branch's run as though it were this worktree's, with nothing in the output marking it as unrelated. Several worktrees of one clone, each on its own branch, all read back the same foreign terminal run; a supervising agent judging validation by that read concludes the work failed while its real pipeline is still in flight. Cause, established in `resolveRun` (internal/cli/axi_query.go): the branch-scoped lookup had no terminating branch, so when the caller's branch had no run the function fell through to a repo-wide lookup and returned the repository's active-or-most-recent run on any branch. `runAxiStatus` then rendered it under the same `run:` key a run of the caller's own gets. The active path was never wrong - a branch with its own active run always resolved it - which is why two worktrees reported correctly and the rest did not. - resolveRun stops at the caller's branch: its active run, else its most recent one, else no run. A detached HEAD owns no branch and so resolves nothing rather than guessing. - `axi status` with no run for the branch reports `current_branch`, `runs_on_current_branch: 0`, and the recent-runs table, so a deliberate `--run <id>` inspection stays one step away. - `--run <id>` still renders any run in full, but under `other_branch_run:` with a top-level `current_branch:` when that run's branch differs from the caller's - reusing the home view's `other_branch_active_run` vocabulary, so a consumer keyed on `run:` can never pick up a foreign run. - `axi logs` shares the resolution and is fixed with it; its no-run error now points at `--run <id>`. * no-mistakes(review): Share AXI run snapshot during no-run rendering * no-mistakes(review): Surface branch lookup failures and clarify run selection * no-mistakes(review): Correct detached-HEAD AXI help guidance * no-mistakes(review): Qualify no-run guidance for successful status responses * no-mistakes(review): Preserve explicit AXI run identity and safe guidance * no-mistakes(review): Guard explicit-run gates with proven branch ownership * no-mistakes(document): Clarify branch-scoped AXI documentation * no-mistakes(document): Clarify branch-scoped AXI reporting contracts * no-mistakes: apply CI fixes * chore: ignore the CI-repair agent's in-worktree scratch HOME The CI-repair agent reproduces a failing check locally by pointing HOME at a directory inside the run worktree. That directory fills with Go module and macOS Library caches, and commitRepair stages with `git add -A` (internal/pipeline/steps/ci_fix.go), so the caches were committed onto the branch and pushed to the pull request. | 5 天前 | |
fix(daemon): move test evidence out of system temp storage (#735) * fix(daemon): keep run evidence off shared /tmp and reap it ourselves The test step wrote evidence to os.TempDir()/no-mistakes-evidence. The daemon's service unit exports only HOME, PATH, and proxy variables, so TMPDIR is unset and that resolved to the shared /tmp - which Ubuntu has mounted as a systemd tmpfs since 24.10, putting every screenshot and rendered-HTML artifact in RAM. Nothing in this program ever removed it, either. The directory was a fixed name that accumulated one subdirectory per run, cleaned only by an OS timer we do not control and that has no equivalent on Windows. On one developer machine that was 876 run directories over ten days, 823 of them empty: the test step creates the directory before the agent decides whether it has anything to write. Evidence now lives at <NM_HOME>/evidence/<runID>, owned by internal/paths like every other location. The app root is disk backed on macOS, Linux, and Windows alike, so there is no runtime.GOOS branch and the macOS path is not regressed - it improves, since /var/folders is periodically purged and that silently broke the local artifact paths older PR bodies fall back to. Cleanup is now ours, in three layers: a finished run's empty directory is removed at run cleanup, a reaper bounds the directory by age and count oldest-first after every run and at daemon startup, and the pre-relocation temp directory is drained under the same policy. All three reuse the existing pending/running guard, so a run still in flight is never touched. test.evidence gains local_root, retention, and max_runs. They are global-only: a repository does not get to name a filesystem path this machine's daemon writes to, nor set the retention budget for a directory every repository on the machine shares. There is deliberately no environment variable - the service unit preserves only proxy keys, so an env-gated value would be dropped on the next update. Also removes the second, independent copy of the evidence path in the agent steering preamble, which rebuilt it from os.TempDir() on its own. The executor now resolves the path once and both consumers read it. * no-mistakes(review): Protect unowned directories from evidence reaping * no-mistakes(document): Clarify managed evidence storage scope * no-mistakes: apply CI fixes * no-mistakes: apply CI fixes * fix(daemon): clean run evidence at the recovered-run completion boundary Evidence ownership claims cleanup runs after each run, but only the fresh-run defer called cleanupRunEvidence. A run parked at an approval gate when the daemon stopped is finished by resumeRecoveredRun, which has its own completion defer, so a resumed run kept its empty evidence directory until some later run or a restart happened to sweep it. There are exactly two completion boundaries and both are now covered. The regression test drives resumeRecoveredRun and asserts the directory is gone afterwards; every outcome of a resumed run shares that defer, so the boundary is the thing worth asserting on. * ci: give the test job a budget the Windows leg actually fits in The Windows leg was cancelled at timeout-minutes twice in a row with no verdict, on a suite where every package that reported had passed. It is process-spawn bound rather than compute bound, so it compiles every test binary and then runs the git-backed packages at roughly 10x their Linux cost, and 25 minutes no longer covered that. An evidence-free cancellation is worse than a slow job: it is reported as a check failure and reads as a defect in the change under test, which is exactly how it was read here. The cap stays a runaway guard rather than a target. Linux and macOS finish far inside it, 40 minutes still keeps a wedged runner well short of the six-hour default, and go test -timeout is deliberately unchanged so a genuine hang still produces a goroutine dump first. This does not close the coherence gap behind it: -timeout bounds each test binary while timeout-minutes bounds the whole job including compile, so total wall can still exceed the cap with no binary reaching its own deadline. Bounding per-job wall properly is follow-up work. * chore: pin review auto-fix to the product default in this repo The code default for auto_fix.review is 0 so review findings park for a human decision, but this repo carried no auto_fix block and therefore inherited whatever an operator set globally. With it enabled, a one-line CI timeout change drew a speculative review finding that the auto-fixer answered with a new DB table, a schema migration, and a new package, then spent three rounds finding errors in its own invention. None of it was asked for, and a parked finding would have surfaced the question instead of quietly answering it. Only review is pinned. The deterministic steps keep whatever the operator configured, because a lint or test finding has an objective checker and does not need a human to decide whether the fix belongs. * no-mistakes(review): Reject evidence roots inside managed worktrees * no-mistakes(document): Clarify evidence storage constraints | 17 天前 | |
chore(main): release 1.60.3 (#902) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> | 1 天前 | |
perf(pipeline): cut CI test latency (#901) * Stop re-execing the race test binary as fake gh so macos CI leaves the 10-minute package cap. GOMAXPROCS=3 go test -race -count=1: internal/pipeline/steps 566.6s -> 92.6s, plus citest 8.2s. The same CI-monitor tests still run under go test ./...; they just no longer share one package timeout with PR/review/git tests. * no-mistakes(review): Clean up helpers and strip valued race flags | 2 天前 | |
chore(main): release 1.60.3 (#902) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> | 1 天前 | |
chore(agents): use @AGENTS.md import instead of CLAUDE.md symlink (#758) Co-authored-by: Kun Chen <kun-1@kunchenguid.com> | 15 天前 | |
ci: migrate PR gate to shared action (#821) * ci: flip this repo's own gate to the shared require-no-mistakes action The composite action added in #819 was published but nothing called it - this repository kept running the inline copy it was extracted from. The gate is now a thin caller pinned to 32d396ac0f29135daf7fcb9964aba9d5f4e796d6, the commit that first carried the action. Pinning an already-published commit is the self-certification guard: a PR that edits the action is still fully tested on its own head (the Go tests execute the working-tree verify.py), while the required check judging that PR keeps running the released copy, so a change can never rewrite its own judge. Everything the caller owns is preserved byte-for-byte: the job name "PR must be raised via no-mistakes", the run-name and concurrency identity, the body-bearing-events-only trigger set, the read-only fork boundary, and the release automation exemptions. Those exemptions stay in the job-level `if:` rather than moving to the action's exempt-authors input, because an in-job exemption still needs the run to start and a GITHUB_TOKEN PR's run is created in action_required and never starts. workflow_no_mistakes_required_test.go now owns the CALLER - immutable 40-hex pin, single delegating step, exemptions, triggers, concurrency identity, fork boundary - and drives the real action through a workflow event payload, which is the only thing that proves the input-free wiring reaches a verdict. Per-verdict coverage stays in require_no_mistakes_action_test.go against the same interpreter rather than being duplicated. prsummary_test.go's generator/gate sync check follows the signature marker into verify.py. * no-mistakes(review): Fix workflow pin metadata and exemption coverage * no-mistakes(review): Correct action pin provenance wording * no-mistakes(review): Correct remaining action pin provenance comment * no-mistakes(review): Exercise composite action through caller tests * no-mistakes(review): Enforce exact shared action pin * no-mistakes(document): Update shared action migration documentation | 9 天前 | |
Initial commit | 4 个月前 | |
test(e2e): add antigravity fixture recording and replay coverage (#809) * test(agent): cover antigravity in fakeagent and the e2e user journey * no-mistakes(document): Add antigravity to agent lists, doctor example, and fakeagent doc comment * no-mistakes(document): Add antigravity to agent Values and auto resolution order in docs * feat(recordfixture): capture antigravity fixtures via the owned e2e-record workflow * no-mistakes(review): Assert Antigravity recorder argv forwarding; focused tests pass * fix(recordfixture): stage agy captures atomically and contain the process tree * no-mistakes(review): Test plain fixture replay path by splitting TestRunAgyReplaysRecordedFixture into structured/plain subtests * no-mistakes(review): Validate Antigravity captures and replay configured fixtures reliably * no-mistakes(document): Document Antigravity capture and replay behavior * no-mistakes: apply CI fixes * fix(recordfixture): expect cmd-exe quote escaping in agy argv test; dedupe antigravity docs The windows-core run at 0ba9bd95 failed TestCaptureAgyPlacesForwardedFlagsBeforePromptAndSchemaLast because the fake .cmd agent records Go's literal backslash-quote escaping: cmd.exe %~1 expansion does not undo it, while real agy parses argv with CommandLineToArgvW and sees the unescaped JSON. Assert the escaped schema arg on Windows with a comment explaining the harness-only artifact. After rebasing onto main (#812), agents.md carried two Antigravity adapter sections and two supported-agents table rows. Keep one of each, reflecting final capabilities: session resume via --conversation and terminal-authoritative result precedence (structured_output > result.response > stream deltas). * fix(recordfixture): reject any non-SUCCESS agy result during capture validation validateAgyCapture only inspected the final result status, so a capture containing an ERROR result followed by SUCCESS validated even though the production replay parser treats any ERROR result as fatal. Fail fast on the first non-SUCCESS result and require at least one result event. | 10 天前 | |
fix(pipeline): safely publish CI repairs with proven continuity (#887) * feat(ci): make post-repair revalidation opt-in A CI repair used to restart the whole pipeline at Review, so every repaired check cost another full Review, Test, Document, Lint, Push, and PR pass over the change. That is the most expensive single behavior the pipeline has, and it was unconditional. ci.revalidate_repairs selects between the two deliveries. It defaults to false: the repair is published immediately through publishRunHead - the same guarded path the Push step uses, so review-approved-head continuity, the force-with-lease anchor, remote verification, the push binding, and the gate-mirror update all still apply - and the CI monitor keeps watching the same run. Set true to keep the repair local, revoke the run's review approval, and restart validation at Review so no CI repair is published without having been reviewed. The key lives in the existing ci block, so it inherits that block's global config, trusted-default-branch-only sourcing, and repo-overrides-global precedence with no new mechanism. It is a *bool so an explicit project false overrides a global true rather than reading as unset. Both CI fix paths take the same decision: the automatic auto-fix round and the manual round a person authorizes at the CI gate. No-change retries, the durable fix-attempt budget, duplicate-check suppression, transient reruns, merge-conflict handling, force-push safety, custody, and cancellation are untouched. The CI step logs which policy is in force before its first poll. VISION.md gains the constraint this default follows from: cost is a user-visible property of the gate, so a design that clearly adds significant end-to-end latency or token consumption must be opt-in. * no-mistakes(review): Preserve CI repair continuity across rebases * no-mistakes(document): Correct stale CI repair documentation * no-mistakes(ci): Fixed late gate-mirror failures misreporting published CI repairs. Published repairs now continue CI monitoring with a warning after durable remote binding, while Push-step mirror failures still propagate. Added regression coverage. Verified targeted race tests, rebase tests, make lint, and git diff --check * no-mistakes(document): Document late gate-mirror failure handling * fix(ci): decide repair publication by provable continuity A CI repair was published whenever ci.revalidate_repairs was off, and a merge-conflict repair rebases, so its head is not a descendant of the reviewed head. The publication guard was relaxed for that case with a base-ancestry exception, and a repair that reset to the rebase base satisfied it: reproduced, the reviewed commits were force-pushed away while the pipeline reported success. The actor was the CI repair agent itself, so provenance cannot stand in for the proof either. One rule now decides delivery on every CI-fix path, automatic and manual, CI failure and merge conflict alike: a repair is published without revalidating only when its continuity with the reviewed, published head can be PROVEN; when it cannot, the repair revalidates from Review. Continuity is proven when the repaired head is the run's durable review-approved commit or a descendant of it, read through the same reviewApprovedHead accessor the publication guard enforces, so the decision to publish and the guard that permits the push cannot disagree. Every failure to establish it - unreadable run, missing or malformed approval, unverifiable ancestry - counts as unproven. ci.revalidate_repairs still sets the intent identically on every path: false publishes when it is provable, true revalidates outright. Merge-conflict repairs are not carved out; they simply always land in the cannot-be-proven half, because resolving a conflict changes the commit's patch-id and no content-based guard can separate a resolved rebase from a dropped one. They now revalidate rather than being refused, so conflict repair keeps working. The base-ancestry exception and its rewriteBase plumbing are deleted; assertReviewApprovedPushHead is descendant-only again with no exception. Regressions: a genuine conflict rebase revalidates and succeeds; a reset-to-base conflict repair revalidates, never reaches the remote, and the reviewed work survives; an ordinary provable repair still publishes with the flag off and still restarts with it on; a run with no review authority revalidates rather than publishing. * no-mistakes(review): Correct merge-conflict revalidation guidance across all surfaces * no-mistakes(document): Correct CI repair revalidation documentation * no-mistakes(lint): Regenerate no-mistakes skill documentation * fix(push): record a publication only once all of it has settled The gate-mirror update ran after the push binding and the recorded head, which forced a choice between two wrong answers on a mirror failure. Returning the error made the CI monitor call an already published repair failed, and its next attempt then saw a clean, already-advanced head as producing no changes. Swallowing the error left the gate behind the remote for good, and `no-mistakes rerun` resolves its starting head from the gate, so a later rerun silently omitted the published repair. Settle the gate mirror before recording anything durable. Publication is now all-or-nothing: remote push, gate mirror, push binding, and recorded head all land or none of them are recorded. A partial failure is simply retryable - the next attempt re-enters the same path, finds the remote already at this head via an up-to-date no-op push, and completes the publication once the mirror works. The CI-repair warning special case is gone with it. Also correct four surfaces that still said the default publishes every repair, when it publishes only a repair whose continuity is provable, and make the merge-conflict regression conflict for real: the base and the feature now edit the same line, so the resolved rebase genuinely changes the commit's patch-id rather than replaying cleanly. Regressions: an unsettled publication records nothing and the retry completes it; a real conflict rebase revalidates and succeeds; a reset-to-base conflict repair revalidates and the reviewed content survives on the remote. * no-mistakes(review): Make CI repair publication atomic and retryable * no-mistakes(document): Correct CI publication documentation * fix(ci): fire the unsettled-publication retry only on real evidence The retry added for a part-way publication triggered on any clean worktree whose HEAD differed from the run's recorded head. That is not evidence a publication was attempted: a fix agent that commits and then errors leaves exactly that state, and so does a fixture whose recorded head trails the branch. The retry then ran instead of the fix round and the repair agent was never called, which is what broke TestCIStep_BitbucketAutoFixUsesLivePRHeadSHAForLogs on CI. publishRepair now records the commit whose publication it began and could not finish, and clears it on success or when the repair revalidates instead. The retry fires only for that exact commit, so it still settles a stalled publication without spending another fix attempt, and never swallows a fix round. The marker is in memory only: after a daemon restart the next fix attempt settles it instead, at the cost of one attempt, which is the honest accounting rather than a durable claim the process cannot make. Regression: a differing head with no attempted publication still runs the fix agent and never logs the retry. * no-mistakes(review): Retry unsettled publications before evaluating CI checks * no-mistakes(document): Document CI publication retry evidence * fix(ci): bound the publication retry and order the revalidation write Two defects in the repair-publication path, both reported on the PR. The unsettled-publication retry costs no repair attempt by design, so a gate mirror that could never be settled retried on every poll until the CI idle timeout - seven days by default - while the repaired commit already sat on the remote. Bound it to three attempts, then park for a person with the published head named, because a rerun would resume from the stale gate head and omit the repair. CI is testing the published commit, so no fix agent can help; what a person needs is to know the local gate is behind. recordLocalRepair advanced the in-memory head before its durable write. A failed write left the monitor watching a head the run record did not know about, still carrying its old review approval, with the revalidation the call exists to trigger silently lost. Write durably first, then advance. Regressions: the retry stops at its bound and parks naming the published head while spending only one fix attempt; a failed revalidation write leaves both the live head and the review approval untouched. * no-mistakes(review): Persist and safely settle CI publication retries * no-mistakes(document): Clarify CI publication settlement documentation * no-mistakes(ci): Serialized the process-heavy CI repair fixture tests to prevent macOS subprocess exhaustion and indefinite fake-gh stalls. Verified with 3 repeated focused runs, 25 repetitions of the previously hanging case, and the full internal/pipeline/steps suite (passed in 113.6s) * test(ci): stop paying for a monitor loop to assert a delivery decision The macOS job timed out at the 600s package cap: the repair fixture tests each drove the full CI monitor loop, so every case spent provider polls and several subprocesses on a two-core runner to observe something commitRepair already reports. Serializing them made the wall clock worse, not better. Assert the delivery decision from commitRepair - Revalidate, the remote, the review approval, the push binding - and keep exactly one monitor-loop test for the wiring that is genuinely the monitor's: turning a held repair into a restart at Review and stating the policy in force. Four full monitor loops go away and the cases run in parallel again. Coverage is unchanged: every case still asserts the same observables, and the paths that are about the monitor - the fix round not being swallowed, the bounded publication retry - still drive Execute. * revert(ci): strip the unscoped publication-retry machinery Two things were added to this branch by auto-answered review findings that were never in its scope, and the captain has declined both. Removed, not repaired: - retryPendingRepair and its CI poll-loop call site, its bound, and its exhaustion gate. New runtime behaviour in the monitor. - The durable pending-publication state it needed: SetCIPendingPublication, the ci_pending_publish_head / ci_pending_publish_attempts columns and their migration, the StepResult fields, and the restore-on-CI-entry path. A persistence and schema addition. - publishRunHead's publicationProgress return, which existed only to tell that machinery whether the remote had been verified. Three reported defects went with the code that contained them rather than being fixed: a restored pending publication bypassed by a provider skip path, a marker write that could be lost, and a marker never consumed after a daemon restart. They are not reachable once the machinery is gone. Kept unchanged: the uniform provable-continuity rule, the corrected agent guidance and docs, the single-statement UpdateRunPublication, the reference docs that no longer describe the removed mirror warning, and the real merge-conflict regression. Tests that only exercised the removed machinery go with it. What survives still covers behaviour that survives, including that a partial publication records nothing and the next attempt completes it - which is the atomicity guarantee, not the retry. * no-mistakes(document): Deduplicate CI revalidation configuration guidance | 2 天前 | |
test(e2e): add antigravity fixture recording and replay coverage (#809) * test(agent): cover antigravity in fakeagent and the e2e user journey * no-mistakes(document): Add antigravity to agent lists, doctor example, and fakeagent doc comment * no-mistakes(document): Add antigravity to agent Values and auto resolution order in docs * feat(recordfixture): capture antigravity fixtures via the owned e2e-record workflow * no-mistakes(review): Assert Antigravity recorder argv forwarding; focused tests pass * fix(recordfixture): stage agy captures atomically and contain the process tree * no-mistakes(review): Test plain fixture replay path by splitting TestRunAgyReplaysRecordedFixture into structured/plain subtests * no-mistakes(review): Validate Antigravity captures and replay configured fixtures reliably * no-mistakes(document): Document Antigravity capture and replay behavior * no-mistakes: apply CI fixes * fix(recordfixture): expect cmd-exe quote escaping in agy argv test; dedupe antigravity docs The windows-core run at 0ba9bd95 failed TestCaptureAgyPlacesForwardedFlagsBeforePromptAndSchemaLast because the fake .cmd agent records Go's literal backslash-quote escaping: cmd.exe %~1 expansion does not undo it, while real agy parses argv with CommandLineToArgvW and sees the unescaped JSON. Assert the escaped schema arg on Windows with a comment explaining the harness-only artifact. After rebasing onto main (#812), agents.md carried two Antigravity adapter sections and two supported-agents table rows. Keep one of each, reflecting final capabilities: session resume via --conversation and terminal-authoritative result precedence (structured_output > result.response > stream deltas). * fix(recordfixture): reject any non-SUCCESS agy result during capture validation validateAgyCapture only inspected the final result status, so a capture containing an ERROR result followed by SUCCESS validated even though the production replay parser treats any ERROR result as fatal. Fail fast on the first non-SUCCESS result and require at least one result event. | 10 天前 | |
fix(pipeline): safely publish CI repairs with proven continuity (#887) * feat(ci): make post-repair revalidation opt-in A CI repair used to restart the whole pipeline at Review, so every repaired check cost another full Review, Test, Document, Lint, Push, and PR pass over the change. That is the most expensive single behavior the pipeline has, and it was unconditional. ci.revalidate_repairs selects between the two deliveries. It defaults to false: the repair is published immediately through publishRunHead - the same guarded path the Push step uses, so review-approved-head continuity, the force-with-lease anchor, remote verification, the push binding, and the gate-mirror update all still apply - and the CI monitor keeps watching the same run. Set true to keep the repair local, revoke the run's review approval, and restart validation at Review so no CI repair is published without having been reviewed. The key lives in the existing ci block, so it inherits that block's global config, trusted-default-branch-only sourcing, and repo-overrides-global precedence with no new mechanism. It is a *bool so an explicit project false overrides a global true rather than reading as unset. Both CI fix paths take the same decision: the automatic auto-fix round and the manual round a person authorizes at the CI gate. No-change retries, the durable fix-attempt budget, duplicate-check suppression, transient reruns, merge-conflict handling, force-push safety, custody, and cancellation are untouched. The CI step logs which policy is in force before its first poll. VISION.md gains the constraint this default follows from: cost is a user-visible property of the gate, so a design that clearly adds significant end-to-end latency or token consumption must be opt-in. * no-mistakes(review): Preserve CI repair continuity across rebases * no-mistakes(document): Correct stale CI repair documentation * no-mistakes(ci): Fixed late gate-mirror failures misreporting published CI repairs. Published repairs now continue CI monitoring with a warning after durable remote binding, while Push-step mirror failures still propagate. Added regression coverage. Verified targeted race tests, rebase tests, make lint, and git diff --check * no-mistakes(document): Document late gate-mirror failure handling * fix(ci): decide repair publication by provable continuity A CI repair was published whenever ci.revalidate_repairs was off, and a merge-conflict repair rebases, so its head is not a descendant of the reviewed head. The publication guard was relaxed for that case with a base-ancestry exception, and a repair that reset to the rebase base satisfied it: reproduced, the reviewed commits were force-pushed away while the pipeline reported success. The actor was the CI repair agent itself, so provenance cannot stand in for the proof either. One rule now decides delivery on every CI-fix path, automatic and manual, CI failure and merge conflict alike: a repair is published without revalidating only when its continuity with the reviewed, published head can be PROVEN; when it cannot, the repair revalidates from Review. Continuity is proven when the repaired head is the run's durable review-approved commit or a descendant of it, read through the same reviewApprovedHead accessor the publication guard enforces, so the decision to publish and the guard that permits the push cannot disagree. Every failure to establish it - unreadable run, missing or malformed approval, unverifiable ancestry - counts as unproven. ci.revalidate_repairs still sets the intent identically on every path: false publishes when it is provable, true revalidates outright. Merge-conflict repairs are not carved out; they simply always land in the cannot-be-proven half, because resolving a conflict changes the commit's patch-id and no content-based guard can separate a resolved rebase from a dropped one. They now revalidate rather than being refused, so conflict repair keeps working. The base-ancestry exception and its rewriteBase plumbing are deleted; assertReviewApprovedPushHead is descendant-only again with no exception. Regressions: a genuine conflict rebase revalidates and succeeds; a reset-to-base conflict repair revalidates, never reaches the remote, and the reviewed work survives; an ordinary provable repair still publishes with the flag off and still restarts with it on; a run with no review authority revalidates rather than publishing. * no-mistakes(review): Correct merge-conflict revalidation guidance across all surfaces * no-mistakes(document): Correct CI repair revalidation documentation * no-mistakes(lint): Regenerate no-mistakes skill documentation * fix(push): record a publication only once all of it has settled The gate-mirror update ran after the push binding and the recorded head, which forced a choice between two wrong answers on a mirror failure. Returning the error made the CI monitor call an already published repair failed, and its next attempt then saw a clean, already-advanced head as producing no changes. Swallowing the error left the gate behind the remote for good, and `no-mistakes rerun` resolves its starting head from the gate, so a later rerun silently omitted the published repair. Settle the gate mirror before recording anything durable. Publication is now all-or-nothing: remote push, gate mirror, push binding, and recorded head all land or none of them are recorded. A partial failure is simply retryable - the next attempt re-enters the same path, finds the remote already at this head via an up-to-date no-op push, and completes the publication once the mirror works. The CI-repair warning special case is gone with it. Also correct four surfaces that still said the default publishes every repair, when it publishes only a repair whose continuity is provable, and make the merge-conflict regression conflict for real: the base and the feature now edit the same line, so the resolved rebase genuinely changes the commit's patch-id rather than replaying cleanly. Regressions: an unsettled publication records nothing and the retry completes it; a real conflict rebase revalidates and succeeds; a reset-to-base conflict repair revalidates and the reviewed content survives on the remote. * no-mistakes(review): Make CI repair publication atomic and retryable * no-mistakes(document): Correct CI publication documentation * fix(ci): fire the unsettled-publication retry only on real evidence The retry added for a part-way publication triggered on any clean worktree whose HEAD differed from the run's recorded head. That is not evidence a publication was attempted: a fix agent that commits and then errors leaves exactly that state, and so does a fixture whose recorded head trails the branch. The retry then ran instead of the fix round and the repair agent was never called, which is what broke TestCIStep_BitbucketAutoFixUsesLivePRHeadSHAForLogs on CI. publishRepair now records the commit whose publication it began and could not finish, and clears it on success or when the repair revalidates instead. The retry fires only for that exact commit, so it still settles a stalled publication without spending another fix attempt, and never swallows a fix round. The marker is in memory only: after a daemon restart the next fix attempt settles it instead, at the cost of one attempt, which is the honest accounting rather than a durable claim the process cannot make. Regression: a differing head with no attempted publication still runs the fix agent and never logs the retry. * no-mistakes(review): Retry unsettled publications before evaluating CI checks * no-mistakes(document): Document CI publication retry evidence * fix(ci): bound the publication retry and order the revalidation write Two defects in the repair-publication path, both reported on the PR. The unsettled-publication retry costs no repair attempt by design, so a gate mirror that could never be settled retried on every poll until the CI idle timeout - seven days by default - while the repaired commit already sat on the remote. Bound it to three attempts, then park for a person with the published head named, because a rerun would resume from the stale gate head and omit the repair. CI is testing the published commit, so no fix agent can help; what a person needs is to know the local gate is behind. recordLocalRepair advanced the in-memory head before its durable write. A failed write left the monitor watching a head the run record did not know about, still carrying its old review approval, with the revalidation the call exists to trigger silently lost. Write durably first, then advance. Regressions: the retry stops at its bound and parks naming the published head while spending only one fix attempt; a failed revalidation write leaves both the live head and the review approval untouched. * no-mistakes(review): Persist and safely settle CI publication retries * no-mistakes(document): Clarify CI publication settlement documentation * no-mistakes(ci): Serialized the process-heavy CI repair fixture tests to prevent macOS subprocess exhaustion and indefinite fake-gh stalls. Verified with 3 repeated focused runs, 25 repetitions of the previously hanging case, and the full internal/pipeline/steps suite (passed in 113.6s) * test(ci): stop paying for a monitor loop to assert a delivery decision The macOS job timed out at the 600s package cap: the repair fixture tests each drove the full CI monitor loop, so every case spent provider polls and several subprocesses on a two-core runner to observe something commitRepair already reports. Serializing them made the wall clock worse, not better. Assert the delivery decision from commitRepair - Revalidate, the remote, the review approval, the push binding - and keep exactly one monitor-loop test for the wiring that is genuinely the monitor's: turning a held repair into a restart at Review and stating the policy in force. Four full monitor loops go away and the cases run in parallel again. Coverage is unchanged: every case still asserts the same observables, and the paths that are about the monitor - the fix round not being swallowed, the bounded publication retry - still drive Execute. * revert(ci): strip the unscoped publication-retry machinery Two things were added to this branch by auto-answered review findings that were never in its scope, and the captain has declined both. Removed, not repaired: - retryPendingRepair and its CI poll-loop call site, its bound, and its exhaustion gate. New runtime behaviour in the monitor. - The durable pending-publication state it needed: SetCIPendingPublication, the ci_pending_publish_head / ci_pending_publish_attempts columns and their migration, the StepResult fields, and the restore-on-CI-entry path. A persistence and schema addition. - publishRunHead's publicationProgress return, which existed only to tell that machinery whether the remote had been verified. Three reported defects went with the code that contained them rather than being fixed: a restored pending publication bypassed by a provider skip path, a marker write that could be lost, and a marker never consumed after a daemon restart. They are not reachable once the machinery is gone. Kept unchanged: the uniform provable-continuity rule, the corrected agent guidance and docs, the single-statement UpdateRunPublication, the reference docs that no longer describe the removed mirror warning, and the real merge-conflict regression. Tests that only exercised the removed machinery go with it. What survives still covers behaviour that survives, including that a partial publication records nothing and the next attempt completes it - which is the atomicity guarantee, not the retry. * no-mistakes(document): Deduplicate CI revalidation configuration guidance | 2 天前 | |
fix(pipeline): generate MP4 demos and gate review fixes (#91) * fix(mp4): generate demo.mp4 and require approval for review findings * no-mistakes(document): update README demo output docs | 4 个月前 | |
fix(pipeline): generate MP4 demos and gate review fixes (#91) * fix(mp4): generate demo.mp4 and require approval for review findings * no-mistakes(document): update README demo output docs | 4 个月前 | |
fix(pipeline): generate MP4 demos and gate review fixes (#91) * fix(mp4): generate demo.mp4 and require approval for review findings * no-mistakes(document): update README demo output docs | 4 个月前 | |
fix(pipeline): keep local Test validation targeted (#540) * fix(pipeline): make local Test targeted validation, not full-suite CI Local Test (normal evidence agent and Test-repair) must select the smallest relevant checks and end-user-aligned evidence for the requested intent, and is explicitly forbidden from running a complete repository suite. Repair mode reproduces the specific failure and re-verifies only with focused checks; a generic driver full-suite instruction does not override that product boundary. Remove this repo's broad go test -race ./... commands.test dogfood override so later runs stop paying for local complete-suite walks. Keep the race-enabled full suite in remote CI as the mandatory broad-regression owner. Document the commands.test contract as targeted validation without shell heuristics. * no-mistakes(document): Document targeted local Test contract | 1 个月前 | |
feat(cli): add AXI agent command surface (#241) * feat(cli): add agent-facing AXI commands * no-mistakes(review): Fix branch-scoped AXI run handling * no-mistakes(review): Handle AXI preflight status failures * no-mistakes(review): Fix AXI rerun validation scoping * no-mistakes(review): Fix AXI branch-scoped run resolution * no-mistakes(document): Sync docs with AXI agent flow | 2 个月前 | |
feat(cli): add AXI agent command surface (#241) * feat(cli): add agent-facing AXI commands * no-mistakes(review): Fix branch-scoped AXI run handling * no-mistakes(review): Handle AXI preflight status failures * no-mistakes(review): Fix AXI rerun validation scoping * no-mistakes(review): Fix AXI branch-scoped run resolution * no-mistakes(document): Sync docs with AXI agent flow | 2 个月前 | |
Fix install.sh 403s by resolving latest via GitHub's HTML redirect. (#919) The unauthenticated REST latest endpoint is capped at 60 requests per IP per hour, so shared NAT/VPN/CI addresses fail the installer even though the asset download itself is fine. | 1 天前 | |
fix(telemetry): use self-hosted Umami defaults (#157) * fix(telemetry): use self-hosted Umami config * no-mistakes(document): Update telemetry documentation defaults * no-mistakes(document): Clarify telemetry website ID default | 4 个月前 | |
ci: force release-please tag creation (#126) * ci: force release-please tag creation * no-mistakes: apply agent fixes | 4 个月前 | |
ci: migrate PR gate to shared action (#821) * ci: flip this repo's own gate to the shared require-no-mistakes action The composite action added in #819 was published but nothing called it - this repository kept running the inline copy it was extracted from. The gate is now a thin caller pinned to 32d396ac0f29135daf7fcb9964aba9d5f4e796d6, the commit that first carried the action. Pinning an already-published commit is the self-certification guard: a PR that edits the action is still fully tested on its own head (the Go tests execute the working-tree verify.py), while the required check judging that PR keeps running the released copy, so a change can never rewrite its own judge. Everything the caller owns is preserved byte-for-byte: the job name "PR must be raised via no-mistakes", the run-name and concurrency identity, the body-bearing-events-only trigger set, the read-only fork boundary, and the release automation exemptions. Those exemptions stay in the job-level `if:` rather than moving to the action's exempt-authors input, because an in-job exemption still needs the run to start and a GITHUB_TOKEN PR's run is created in action_required and never starts. workflow_no_mistakes_required_test.go now owns the CALLER - immutable 40-hex pin, single delegating step, exemptions, triggers, concurrency identity, fork boundary - and drives the real action through a workflow event payload, which is the only thing that proves the input-free wiring reaches a verdict. Per-verdict coverage stays in require_no_mistakes_action_test.go against the same interpreter rather than being duplicated. prsummary_test.go's generator/gate sync check follows the signature marker into verify.py. * no-mistakes(review): Fix workflow pin metadata and exemption coverage * no-mistakes(review): Correct action pin provenance wording * no-mistakes(review): Correct remaining action pin provenance comment * no-mistakes(review): Exercise composite action through caller tests * no-mistakes(review): Enforce exact shared action pin * no-mistakes(document): Update shared action migration documentation | 9 天前 | |
ci: simplify release workflow and restore macOS coverage (#147) * ci: drop check and test jobs from release workflow * no-mistakes(review): Restore macOS CI coverage * no-mistakes: apply agent fixes | 4 个月前 | |
perf(pipeline): cut CI test latency (#901) * Stop re-execing the race test binary as fake gh so macos CI leaves the 10-minute package cap. GOMAXPROCS=3 go test -race -count=1: internal/pipeline/steps 566.6s -> 92.6s, plus citest 8.2s. The same CI-monitor tests still run under go test ./...; they just no longer share one package timeout with PR/review/git tests. * no-mistakes(review): Clean up helpers and strip valued race flags | 2 天前 | |
docs: add documentation site and publishing workflow (#36) * feat(docs): add documentation site * no-mistakes(review): harden docs build and Astro version * no-mistakes(review): harden docs Pages deployment workflow * no-mistakes(review): align docs with canonical config keys * no-mistakes(review): fix docs accuracy for config and platform notes * no-mistakes(review): fix docs workflow and CI naming * no-mistakes(review): Scope docs workflow concurrency group * no-mistakes(document): Updated `README.md` to reflect the new documentation site introduced by this change and to document the new `make docs` and `make docs-preview` targets added to the Makefile. * no-mistakes: apply babysit fixes | 4 个月前 | |
ci(workflows): add required checks and generated file guards (#125) | 4 个月前 | |
ci: migrate PR gate to shared action (#821) * ci: flip this repo's own gate to the shared require-no-mistakes action The composite action added in #819 was published but nothing called it - this repository kept running the inline copy it was extracted from. The gate is now a thin caller pinned to 32d396ac0f29135daf7fcb9964aba9d5f4e796d6, the commit that first carried the action. Pinning an already-published commit is the self-certification guard: a PR that edits the action is still fully tested on its own head (the Go tests execute the working-tree verify.py), while the required check judging that PR keeps running the released copy, so a change can never rewrite its own judge. Everything the caller owns is preserved byte-for-byte: the job name "PR must be raised via no-mistakes", the run-name and concurrency identity, the body-bearing-events-only trigger set, the read-only fork boundary, and the release automation exemptions. Those exemptions stay in the job-level `if:` rather than moving to the action's exempt-authors input, because an in-job exemption still needs the run to start and a GITHUB_TOKEN PR's run is created in action_required and never starts. workflow_no_mistakes_required_test.go now owns the CALLER - immutable 40-hex pin, single delegating step, exemptions, triggers, concurrency identity, fork boundary - and drives the real action through a workflow event payload, which is the only thing that proves the input-free wiring reaches a verdict. Per-verdict coverage stays in require_no_mistakes_action_test.go against the same interpreter rather than being duplicated. prsummary_test.go's generator/gate sync check follows the signature marker into verify.py. * no-mistakes(review): Fix workflow pin metadata and exemption coverage * no-mistakes(review): Correct action pin provenance wording * no-mistakes(review): Correct remaining action pin provenance comment * no-mistakes(review): Exercise composite action through caller tests * no-mistakes(review): Enforce exact shared action pin * no-mistakes(document): Update shared action migration documentation | 9 天前 | |
chore(ci): skip pull_request runs for release-please output-only PRs (#617) Exclude the exact release-please output set from every pull_request trigger so GITHUB_TOKEN release PRs create zero workflow runs instead of pending action_required checks. Keep bot job ifs as defense in depth and pin the filter with a config-derived drift test. | 1 个月前 | |
ci: prevent Windows test job timeouts (#645) * perf(ci): keep the Windows test job well inside its timeout The windows-latest test job repeatedly overran timeout-minutes and was cancelled (twice on PR #636). It is not a hang: no test exceeds ~32s, the per-binary `go test -timeout=15m` never fired, and every package that completed reported a normal duration. The job is process-spawn bound. Git-backed packages cost roughly 10x their Linux time on the Windows runner (internal/git 5.7s -> 53s, internal/branchsync 31s -> 415s) because Defender scans every git.exe spawn and every file the temp repos create, and internal/branchsync ran all 52 tests serially, making it the job's 7-minute wall floor. Observed windows job runtimes over 20 recent runs: 10.7-25.3m against a 25m cap, median ~14m. Excludes the ephemeral build and test trees this job creates from Defender scanning, and takes internal/branchsync off the serial critical path with t.Parallel. Locally the package drops from 49.5s to 19.5s with -race clean over repeated runs; no coverage is skipped or weakened. * no-mistakes(review): Harden Windows workflow contract tests * no-mistakes(document): Windows CI documentation already accurate * no-mistakes: apply CI fixes | 29 天前 | |
fix(telemetry): use self-hosted Umami defaults (#157) * fix(telemetry): use self-hosted Umami config * no-mistakes(document): Update telemetry documentation defaults * no-mistakes(document): Clarify telemetry website ID default | 4 个月前 |
git push no-mistakes
干掉所有 slop，开出干净的 PR。
English · 简体中文
no-mistakes 在你真实的远端前面放了一个本地 git 代理。
把分支推给 no-mistakes 而不是 origin，它会拉起一个用完即弃的 worktree，跑一条 AI 驱动的校验流水线，只有每一项检查都通过后才把分支转发到配置的推送目标，并自动开出一个干净的 PR。
- 不阻塞 —— 流水线在隔离的 worktree 里跑，不打断你手头的工作。
- 不挑 agent —— 支持
claude、codex、grok、rovodev、opencode、pi、copilot、antigravity，也可通过acpx使用cursor/acp:<target>，并支持有序 fallback。 - agent 原生 ——
/no-mistakes既能让编码 agent 完成一个任务再过网关，也能直接为已提交的工作过网关：它跑完流水线、让流水线应用安全的修复，剩下的升级给你。 - 人始终说了算 —— 自动修复，还是逐条审查 findings，你决定。
- 默认就是干净 PR —— 推送、开 PR、盯 CI、自动修复失败，一气呵成。
完整文档：https://kunchenguid.github.io/no-mistakes/
工作原理
你的分支
│ git push no-mistakes
▼
┌───────────────────────────────────────────────┐
│ 用完即弃的 worktree —— 你的工作原地不动 │
│ review → test → docs → lint → push → PR → CI │
└───────────────────────────────────────────────┘
│ 每项检查变绿
▼
干净的 PR，已替你开好
每一步要么自己通过，要么停下来给你一条 finding 让你处理。 安全、机械性的修复会自动应用；任何牵涉到你意图的，都会升级给你来 approve（批准）、fix（修复） 或 skip（跳过）。 在每项检查都变绿之前，没有任何东西会到达配置的推送目标。
安装
curl -fsSL https://raw.githubusercontent.com/kunchenguid/no-mistakes/main/docs/install.sh | sh
Windows、Go install 以及从源码构建的说明，见安装指南。
快速上手
$ no-mistakes init
✓ Gate initialized
repo /Users/you/src/my-repo
gate no-mistakes → /Users/you/.no-mistakes/repos/abc123def456.git
remote git@github.com:you/my-repo.git
skill /no-mistakes installed for agents at user level
Push through the gate with:
git push no-mistakes <branch>
$ git checkout my-branch
# 在分支里干点活……
$ git push no-mistakes
* Pipeline started
Run no-mistakes to review.
$ no-mistakes
# 打开当前运行的 TUI
如果是 GitHub fork 贡献，让 origin 指向父仓库，并用 no-mistakes init --fork-url <your-fork-url> 初始化。
在 TUI 里你逐条处理 finding：auto-fix 类自动替你应用（或由你 approve 放行），ask-user 类需要你判断，由你 approve、fix 或 skip。
每项检查变绿后，网关会把你的分支转发到配置的推送目标并替你开好 PR，不用手动 git push origin，也不用手写 PR 正文。
想让编码 agent 无人值守地走完同一套流程？
用 /no-mistakes（见下文）。
触发网关的三种方式
每一处改动都走同一条流水线。改动就绪时，挑一个最贴合你当下工作方式的入口：
git push no-mistakes—— 显式的 Git 路径。把已提交的分支推给网关 remote，而不是origin。no-mistakes—— TUI。改完之后运行它（无需先提交），向导会带你建分支、提交、推过网关，然后挂到这次运行上。no-mistakes -y会把这一切自动做完。/no-mistakes—— agent skill。用/no-mistakes <task>让编码 agent 完成一个任务再过网关，或用裸/no-mistakes为已提交的工作过网关。它跑完流水线、让流水线应用安全的修复，并在任何需要人来拍板的地方停下来问你。
no-mistakes init 会为 Claude Code 及其他 agent 安装 /no-mistakes skill。底层上这个 skill 驱动的是 no-mistakes axi —— 同一套审批流程的非交互式 TOON 接口。
完整的首次运行走查见快速上手。
开发
make build # 构建 bin/no-mistakes（带版本信息）
make test # 运行 go test -race ./...（不含 e2e 套件）
make e2e # 运行打了标签的端到端 agent 旅程套件
make e2e-record # agent 线格式变化时，重新录制 e2e fixtures
make lint # 检查生成的 skill 是否漂移，并跑 go vet ./...
make skill # 重新生成已提交的 no-mistakes skill 文件
make fmt # 运行 gofmt -w .
make demo # 重新生成 demo.gif 和 demo.mp4（需要 vhs 和 ffmpeg）
make docs # 在 docs/dist 构建 Astro 文档站
完整 target 列表见 Makefile。
make e2e-record 会用真实的 claude、codex、opencode 和 antigravity CLI 覆盖 internal/e2e/fixtures/，会消耗真实 API 额度，提交前应当审查。
Star 历史
