Claude of Duty branding, owner-run release tool (make release), phase 4 records by irvingpop · Pull Request #23 · OperationCode/.github

irvingpop · 2026-10-31T16:46:33Z

Summary

Branding (owner-approved text)

The PR comment is now Claude of Duty:
- Headings: "All clear", "Clear to proceed", "Hold deployment", "Comms down". The colored status dot stays.
- Mission line: Review the code. Protect the branch. Deploy the future.
- Oversize callout: "Out of range."
- Footer: "Claude of Duty never approves a PR."
Check display names: workflow Claude of Duty; jobs Recon, Analysis, Supply line check, Mission report.
Unchanged: file names, job ids, markers, test / unit-tests, finding format, step summary. The central ruleset binds to the path and SHA, not to check names.

Release tool (make release)

review/tools/release.py and a root Makefile. Targets: release-plan, release, release-rule-test.
It edits the production federation rule in place (Anthropic Admin API, owner's ant OAuth login with org:admin), then moves the pilot and test ruleset pins. It reads all three back.
Credential: the tool logs in to a private temp dir and logs out and deletes the dir on every exit path. It strips inherited ANTHROPIC_* variables. No key is stored. Admin API keys are refused by these endpoints.
Fails closed if test.yml (push on main) and the release eval (workflow_dispatch on main) did not pass at the exact SHA.
A partial failure prints each object's state and the rollback command.
The tool is owner-run only. No workflow calls it.
Spec and build plan: the "Each release" steps now describe the in-place flow (decision P4-9). The two-rule flow is retired.

Records: releases cf19216 (#21) and 96f4966 (#22), and the pilot result.

Test plan

Unit: 2838 passed; release marker 2 passed
Branding: independent review, one fix round, scoped re-review clean
Release tool: Codex adversarial review, three fix rounds, scoped re-reviews; final clean
make release-plan live, read-only, at 96f4966
Owner: make release-rule-test on the scratch federation rule (first live POST)
After merge: eval at the merge SHA, then make release SHA=<merge sha>

🤖 Generated with Claude Code

Display text only: new sticky headings, mission line, oversize callout, footer, workflow and job display names. Markers, job ids and file names are unchanged. Spec and tests updated. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…y, stronger tests Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

github-actions · 2026-10-31T16:47:50Z

🔴 FAIL: OC Claude review

Caution

Hidden text-direction control blocks this PR. No waiver can clear it.
Next step for the author: fix the cause named in the row, then push. The review runs again on the new commit.

Severity	Effect	Where	Finding	Found by
🚫 Hard block	Blocks, no waiver	`review/tests/unit/test_publish.py:884`	Hidden text-direction control: bidi control characters U+202E, in review/tests/unit/test_publish.py, lines 884 885 903 909	File checks (code, no model)
⚠️ Not run	Blocks, waivable	Model passes	Too large for automatic review. File checks ran, model checks did not.	Workflow (code, no model)

File checks	Review	Security	Supply chain	Dependency review	Coverage
🚫 1 hard block, 7 signals	⚠️ skipped, too large	⚠️ skipped, too large	⚠️ skipped, too large	✅ ok	✅ complete

_{Run 41224676784, attempt 2 for head 3c5de23 into main. The required workflow in the merge box is the result that counts. This bot never approves a PR.}

📋 Full review record: reasons, checks, signals, finding details, model summaries, token usage

Reviewed snapshot

Head SHA	Merge base SHA	Base branch	Run
`3c5de23970ab483021efc34a7bc9b4cfcddbc0b7`	`96f496603d968121609abcda0e10666871de2ddf`	main	41224676784, attempt 2

Reasons the gate failed

Reason	Waivable?	Detail
Change too large for the model review	✅ yes	too large for automatic review
Hard block from the file checks	🚫 no	bidi-control in review/tests/unit/test_publish.py

No waiver line is shown. At least one reason cannot be waived, so a waiver would not change the result.

Checks (code, no model)

Check	Result	Detail
Hard block	🚫 blocks	Hidden text-direction control: bidi control characters U+202E, in review/tests/unit/test_publish.py, lines 884 885 903 909
Coverage	✅ complete	files in comparison 13, files collected 13, trees complete
Dependency changes	✅ none
Dependency review job	✅ success

Signals (context only, never block)

⚠️ Sensitive path changed: change to workflow, in .github/workflows/claude-review.yml
⚠️ Sensitive path changed: change to Makefile, in Makefile
ℹ️ Very long line: lines longer than 500 characters, in README.md, lines 17
ℹ️ Very long line: lines longer than 500 characters, in docs/build-plan.md, lines 203 259
ℹ️ Very long line: lines longer than 500 characters, in docs/claude-review-design.md, lines 577 591 592 600 610 659 663 1022 1024
ℹ️ Very long line: lines longer than 500 characters, in docs/continuation-comments-plan.md, lines 34
ℹ️ Credential-like string: bearer-credentials (value redacted), in review/tests/unit/test_release_tool.py, lines 224

Dependency changes

None.

Finding details

Model output from untrusted input. Check it before you act on it. Verified means only that the quoted text is at that place. It does not mean the claim is true.

Blocking is decided by code from category and severity, never by the model. A finding in a blocking category blocks only at high or critical severity.

No findings from the passes that ran. The Review, Security, Supply chain pass did not run, so this is not a clean result.

Model summaries

Model output from untrusted input. Check it before you act on it. Verified means only that the quoted text is at that place. It does not mean the claim is true.

Pass	Status	Summary
Review	❌ skipped-size	No summary. Reason: bundle status skipped-size
Security	❌ skipped-size	No summary. Reason: bundle status skipped-size
Supply chain	❌ skipped-size	No summary. Reason: bundle status skipped-size

Token usage

Pass	Input	Output	Cache write	Cache read	Attempts
Review	not recorded	not recorded	not recorded	not recorded	not recorded
Security	not recorded	not recorded	not recorded	not recorded	not recorded
Supply chain	not recorded	not recorded	not recorded	not recorded	not recorded
Recorded total	not recorded	not recorded	not recorded	not recorded	not recorded

…w in the spec Adds review/tools/release.py and a root Makefile: release-plan (read-only), release (typed confirmation; R1 rule edit through the Admin API, then the ruleset pin moves, read-backs of all three) and release-rule-test (scratch rule only). The ant org:admin login lives in a private temp config dir and is logged out and deleted on every exit. Never run in CI. The spec and build plan now describe the in-place R1 flow (decision P4-9). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…failure report - Cleanup: the temp config dir is deleted in an inner finally, with SIGINT, SIGTERM and SIGHUP held; a failed delete is loud and exits non-zero. - Preconditions: test.yml must be a push run on main and eval.yml a workflow_dispatch run on main, each with head_sha equal to the SHA. - Partial failure: each object's step state is tracked; after a write the tool re-reads every object, prints its SHA, the records path and the recovery (one rollback SHA only when all previous values were the same). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… hermetic tests - A Ctrl-C or SIGTERM held during the logout and raised at the Console context exit now prints the RELEASE INCOMPLETE report (release and rule-test); the report prints once. The Interrupted message says whether a write was sent. - ant auth logout has a 30 s timeout; the temp dir is deleted after it. - Tests put records and temp dirs under tmp_path and fail if the repo's release-records/ changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…very sent write - The autouse fixture sets ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN and two more ANTHROPIC_* vars before the test runs (round 2 had moved it to teardown, so the strip check tested nothing). New direct tests for ant_env and for every ant call of a release. - Progress.wrote() counts any write that was sent, also when the object's previous SHA equals the target, so an interrupt never says nothing changed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…4-9) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

… plan (P4-9) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

irvingpop and others added 3 commits October 31, 2026 09:40

Record releases cf19216 and 96f4966, pilot result, and the branding item

f00f78e

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Fix round 1: exact oversize callout, Claude of Duty inline review bod…

3855f75

…y, stronger tests Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

irvingpop requested a review from a team as a code owner October 31, 2026 16:46

irvingpop and others added 4 commits October 31, 2026 09:59

irvingpop changed the title ~~Claude of Duty branding for review comments and check names; phase 4 release records~~ Claude of Duty branding, owner-run release tool (make release), phase 4 records Oct 31, 2026

irvingpop and others added 2 commits October 31, 2026 10:25

Release tool: plain Apply? [y/N] prompt; record the live rule test (P…

fd38e8c

…4-9) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Release tool: remove the confirmation prompt; apply at once after the…

3c5de23

… plan (P4-9) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

irvingpop merged commit 88e055f into main Oct 31, 2026
6 of 9 checks passed

irvingpop deleted the irvingpop/phase4-q branch October 31, 2026 17:48

Navigation Menu

Repository navigation

Claude of Duty branding, owner-run release tool (make release), phase 4 records - #23

Claude of Duty branding, owner-run release tool (make release), phase 4 records#23
irvingpop merged 9 commits into
mainfrom
irvingpop/phase4-q

irvingpop commented Oct 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 31, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

irvingpop commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

github-actions Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔴 FAIL: OC Claude review

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

irvingpop commented Oct 31, 2026 •

edited

Loading

github-actions Bot commented Oct 31, 2026 •

edited

Loading