Deliver: Harness CI - #56
Merged
Merged
Conversation
Author: architect Waves: 3 Tasks: 6 Out-of-scope deps: no
Plan: .agents/plans/harness-ci.md (Status + approved event written by: node harness/cli.js approve)
Wave 1, Task 1.1 Validated: AC#2, AC#3, AC#5, AC#8 — scripts/test-check-approval-integrity.sh exits 0; all 8 fixture cases exit with documented codes Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Wave 1, Task 1.2 Validated: AC#4, AC#8 — scripts/test-check-events-append-only.sh exits 0; all 6 fixture cases exit with documented codes Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Wave 1, Task 1.3 Validated: AC#6, AC#8 — scripts/test-lint-agent-files.sh exits 0; all 8 fixture cases exit with documented codes Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Wave 2, Task 2.1 Validated: AC#1, AC#2, AC#7 — YAML parses (js-yaml); every job command run locally (harness suite 211/211 via full npm ci — --omit=optional breaks adapter tests that import the SDK, noted in YAML comment; test-*.sh loop; append-only vs origin/main; lint-agent-files exits 1 on known drift as expected; approval-integrity passes on rad/harness-ci and the ordinary-PR path emits an explicit skip notice). Advisory re-emit loop preserves exit codes under pipefail (fail path verified exit 1). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Wave 2, Task 2.2 Validated: AC#8 — CI-checks section usages/exit codes diffed by eye against the three script header comments (0/1/2 each, fail-closed semantics, legacy no-fingerprint fail-open mirror, ownership advisory never failing); RAD_ARCHITECT_OVERRIDE block matches the existing .env.example commented pattern with rationale lines. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ory) into CI Wave 3, Task 3.1 Validated: AC#9 — YAML parsed via yaml.safe_load (6 jobs, scope step inside deliver-integrity behind the detect guard, plan-lint carries continue-on-error: true); local runs of the exact wired command lines: check-scope.sh .agents/plans/harness-ci.md rad/harness-ci main → exit 0 (9 files, all in scope), origin-prefixed head ref also resolves, usage error → exit 2 (fail-closed); lint-plan.sh on the changed plan → exit 0 with two advisory warnings re-emitted as ::warning:: lines by the job loop. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds the missing Agent Scope Map rows for quality-reviewer and accessibility-reviewer (pre-existing drift surfaced by the new lint-agent-files.sh; architect-directed). Plan amended to bring CLAUDE.md into Files in Scope; fingerprint refreshed via re-approval after the tripwire correctly flagged the post-approval edit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The approve-path fixtures (cli.test.js, portable-process-memory.test.js) derive the expected actor from the runner's real git user.email; GitHub runners ship with no git identity, so 2 of 211 tests failed. Workflow-only fix — no test edits. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Delivers the approved harness-ci plan: CI as a second, machine-independent enforcement point for RAD's invariants. Scripts-first — all check logic lives in standalone scripts callable locally with identical exit semantics;
.github/workflows/ci.ymlis a thin wrapper.What landed (3 waves, 6 tasks, all ACs)
Wave 1 — check scripts + fixtures
scripts/check-approval-integrity.sh(+ fixture test, 8 cases): deliver-PR integrity — the gatingapprovedevent must be an ancestor of HEAD, fingerprint must matchrad plan-fingerprint, gate must pass viarad gate --stdin, introducing commit authored by the configured architect (proxy-aware,RAD_ARCHITECT_OVERRIDEsupported); staleowner-claimedprints a non-failing advisory.scripts/check-events-append-only.sh(+ fixture test, 6 cases): fails any PR modifying/deleting existingevents.jsonllines; appended lines must schema-validate.scripts/lint-agent-files.sh(+ fixture test, 8 cases): agent frontmatter lint + CLAUDE.md scope-map bijection, read-only.Wave 2 — workflow + docs
.github/workflows/ci.yml: harnessnode --test(211 tests) + allscripts/test-*.shon every PR; append-only and agent-lint jobs fail-closed; deliver-integrity job withrad/**detection and explicit skip on ordinary PRs; advisories re-emitted as::warning::annotations..env.example(RAD_ARCHITECT_OVERRIDE) +docs/rad-cli.md"CI checks" section incl. the branch-protection adopter prerequisite.Wave 3 — tail:
check-scope.shwired merge-blocking into the deliver job;lint-plan.shadvisory job on plan-touching PRs.Known-red + findings for review
accessibility-reviewer.mdandquality-reviewer.mddeclareroles:but have no Agent Scope Map row. Deliberately NOT fixed in-wave (CLAUDE.md is out of plan scope; the lint is read-only by design). Needs an architect reconcile commit.check-scope.shfail-opens (exit 0) on an unresolvable work-branch ref — CI passesorigin/<head_ref>to work around it (YAML comment); hardening the script is a follow-up finding.npm ci --prefix harnessrather than--omit=optional(YAML comment).Verification
check-scope.sh: 9/9 changed files in declared scope ·check-tests.sh: 3/3 test files present.agents/logs/harness-ci-2026-07-03.md🤖 Generated with Claude Code