Skip to content

chore(v0.3.0): scaffold autonomous-agent pipeline#52

Merged
ayhammouda merged 6 commits into
mainfrom
chore/v0.3.0-agent-pipeline
May 30, 2026
Merged

chore(v0.3.0): scaffold autonomous-agent pipeline#52
ayhammouda merged 6 commits into
mainfrom
chore/v0.3.0-agent-pipeline

Conversation

@ayhammouda
Copy link
Copy Markdown
Owner

@ayhammouda ayhammouda commented May 29, 2026

Summary

Verification

  • git diff --check
  • uv run ruff check src/ tests/
  • uv run pyright src/
  • uv run pytest --tb=short -q (298 passed)
  • uv run python-docs-mcp-server doctor

Notes

This PR prepares the forge operating model only. Do not unleash agents until branch/ruleset enforcement requires PR review + Code Owner review and selected issues are explicitly labeled agent-ready.

Refs #46 #47 #48 #49 #50 #51

Summary by CodeRabbit

  • Documentation
    • Added a strategic roadmap, multiple ADRs and planning specs, an agent execution policy and operational protocol, expanded agent/context guidance, and detailed v0.3.0 work-item docs (cache, serialization, YAML safety, etc.).
  • Chores
    • Added CODEOWNERS-based ownership guidance, autonomous-agent issue/PR templates, and updated reviewer tooling/configuration.

Review Change Stack

ayhammouda and others added 2 commits May 29, 2026 19:02
Add the agent-execution infrastructure and the v0.3.0 agent-ready issue
set so unattended agents can implement the milestone via the issue-and-PR
flow (roadmap decisions 5.12-5.14).

- .github/CODEOWNERS, autonomous-agent issue template, agent PR template
  (enforce forbidden-territory review + required issue/PR structure)
- AGENTS.md: link AGENT-EXECUTION-PIPELINE.md as mandatory agent reading
- .planning/agent-context/*: per-issue single-source-of-truth context (5.14)
- .planning/issues/v0.3.0/*: 6 issue specs (gh #46-#51) + wave index
- track STRATEGIC-ROADMAP + AGENT-EXECUTION-PIPELINE (mandatory reading, §9)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 29, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1832b2d4-e144-4943-978a-0f7fc8fabdb9

📥 Commits

Reviewing files that changed from the base of the PR and between 863bb9f and 5949b0d.

📒 Files selected for processing (11)
  • .github/CODEOWNERS
  • .github/ISSUE_TEMPLATE/autonomous-agent.yml
  • .github/PULL_REQUEST_TEMPLATE/agent.md
  • .planning/issues/v0.3.0/00-README.md
  • .planning/issues/v0.3.0/01-zstd-cache-codec.md
  • .planning/issues/v0.3.0/02-readme-glama-six-tool-refresh.md
  • .planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md
  • .planning/issues/v0.3.0/04-adr-006-serialization.md
  • .planning/issues/v0.3.0/05-adr-001-source-adapters.md
  • .planning/issues/v0.3.0/06-cpython-source-sha-pin.md
  • AGENT-EXECUTION-PIPELINE.md
💤 Files with no reviewable changes (1)
  • .github/PULL_REQUEST_TEMPLATE/agent.md
✅ Files skipped from review due to trivial changes (5)
  • .planning/issues/v0.3.0/06-cpython-source-sha-pin.md
  • .planning/issues/v0.3.0/01-zstd-cache-codec.md
  • .planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md
  • .planning/issues/v0.3.0/02-readme-glama-six-tool-refresh.md
  • .planning/issues/v0.3.0/00-README.md
🚧 Files skipped from review as they are similar to previous changes (5)
  • .github/ISSUE_TEMPLATE/autonomous-agent.yml
  • .planning/issues/v0.3.0/05-adr-001-source-adapters.md
  • .planning/issues/v0.3.0/04-adr-006-serialization.md
  • .github/CODEOWNERS
  • AGENT-EXECUTION-PIPELINE.md

📝 Walkthrough

Walkthrough

This PR adds governance and agent-execution infrastructure: CODEOWNERS, GitHub issue/PR templates, an agent execution pipeline and protocols, strategic roadmap, per-issue v0.3.0 planning docs (agent-context + issue specs), and related repo config.

Changes

Autonomous Agent Infrastructure & v0.3.0 Execution Framework

Layer / File(s) Summary
Repository governance and templates
.github/CODEOWNERS, .github/ISSUE_TEMPLATE/autonomous-agent.yml, .github/PULL_REQUEST_TEMPLATE/agent.md, .coderabbit.yaml, AGENTS.md
Adds CODEOWNERS for sensitive paths, new agent issue/PR templates, review/config settings, and AGENTS guidance instructing agents to read the pipeline before work.
Agent execution pipeline
AGENT-EXECUTION-PIPELINE.md
Canonical operating spec for autonomous agents: forbidden-territory list, required per-issue structure, validation gate, human-review triggers, failure/recovery rules, pre-flight checklist, template sketches, and amendments mechanism.
OpenClaw forge & role protocols
OPENCLAW-FORGE-PROTOCOL.md
Operational protocol defining agent role map, responsibilities, verification flow, labels, automation constraints, and stop conditions.
Strategic roadmap & locked decisions
STRATEGIC-ROADMAP-2026-05-29.md
Adds canonical roadmap, mission/principles, semver milestones, locked decisions table, next moves, and agent pre-flight constraints.
v0.3.0 issue set index
.planning/issues/v0.3.0/00-README.md
Agent-ready index and wave ordering, pre-flight checklist, per-issue prerequisites, and helper commands for labels/issues.
Zstd cache codec
.planning/issues/v0.3.0/01-zstd-cache-codec.md, .planning/agent-context/zstd-cache-codec.md
Issue spec and agent-context describing a versioned zstd codec for the retrieved-docs cache: API, schema migration, tests, and pitfalls.
README six-tool refresh
.planning/issues/v0.3.0/02-readme-glama-six-tool-refresh.md, .planning/agent-context/readme-glama-six-tool-refresh.md
Issue and context to standardize README public surface on exactly six tools, with badge handling, grep checks, allowed/forbidden edits, and validation commands.
PyYAML safe-loader audit
.planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md, .planning/agent-context/pyyaml-safe-loader-audit.md
Security audit issue and context enforcing yaml.safe_load for runtime YAML, adding regression test and YAML trust-boundary doc (without editing SECURITY.md).
ADR-006 serialization
.planning/issues/v0.3.0/04-adr-006-serialization.md, .planning/agent-context/adr-006-serialization.md
Issue wrapper and context for drafting ADR-006 (Serialization), including required Decision Outcome wording, touch-points, and ADR template skeleton.
ADR-001 source adapters
.planning/issues/v0.3.0/05-adr-001-source-adapters.md, .planning/agent-context/adr-001-source-adapters.md
Issue and context documenting source-adapter contract, two current adapters (CPython docs ingestion, PyPI metadata), offline-first exception, and decision-log template.
CPython SHA-pinning
.planning/issues/v0.3.0/06-cpython-source-sha-pin.md, .planning/agent-context/cpython-source-sha-pin.md
Issue and context for pinning CPython source by commit SHA with post-clone verification, test coverage expectations, and supply-chain notes.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related issues

  • #49 (ADR-006 Serialization): ADR-006 planning and pipeline docs included.
  • #50 (ADR-001 Source Adapters): ADR-001 context and issue spec included.
  • #51 (CPython Source SHA Pin): CPython SHA-pin issue/context added.
  • #48 (PyYAML Safe-Loader Audit): PyYAML audit planning and tests specified.
  • #47 (README Six-Tool Refresh): README context and validations added.

Poem

🐰 A roadmap springs to life, branching paths unfold,
Locked decisions gleam like carrots fresh and bold,
Six tasks await the agent's steady paw,
With guardrails strong and validation's sacred law,
Off-chain wisdom blooms—let automation grow! 🌱

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: scaffolding the v0.3.0 autonomous-agent pipeline and related governance templates.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/v0.3.0-agent-pipeline

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@ayhammouda ayhammouda added the 🛑 needs-human-review Agent PR paused at a pipeline §7 trigger; human review required before merge label May 29, 2026
@coderabbiteu
Copy link
Copy Markdown

coderabbiteu Bot commented May 29, 2026

📝 Walkthrough

Walkthrough

This pull request establishes comprehensive autonomous agent execution infrastructure: a strategic roadmap with locked architectural decisions; an operational pipeline policy defining forbidden territory, validation gates, and human-review triggers; GitHub enforcement via CODEOWNERS and templates; and six concrete v0.3.0 work items with supporting architecture/context documentation.

Changes

Autonomous Agent Execution Infrastructure & v0.3.0 Roadmap

Layer / File(s) Summary
Strategic Roadmap & Architectural Principles
STRATEGIC-ROADMAP-2026-05-29.md
Mission, locked architectural principles (offline-first, layered design, pluggable formats), baseline status, v0.3.0–v1.0.0 milestones, locked decisions table, open questions, next three concrete moves, agent scope, review cadence, and amendment tracking.
Agent Execution Pipeline Policy & Guardrails
AGENT-EXECUTION-PIPELINE.md
Operating principles; hard-stop "Forbidden Territory" covering CI/workflows, schema, public APIs, tests, identity/dependency, and policy files; required issue structure; acceptance-criteria rules; validation gate commands (ruff, pyright, pytest, doctor); branch/commit/PR conventions; human-review triggers (forbidden edits, deleted tests, large diffs, new runtime deps, workflow changes); recovery procedures; and pre-flight checklist.
GitHub Infrastructure: Templates, CODEOWNERS, Labels
.github/CODEOWNERS, .github/ISSUE_TEMPLATE/autonomous-agent.yml, .github/PULL_REQUEST_TEMPLATE/agent.md, AGENTS.md
CODEOWNERS assigns @ayhammouda to forbidden-territory paths (CI, schema, migrations, policy docs); autonomous-agent issue template enforces required sections and validation gate references; agent PR template specifies acceptance checklist, validation commands, forbidden-territory attestation, and human-review trigger field; AGENTS.md directs agents to pipeline documentation.
v0.3.0 Issue Set Index & Wave Order
.planning/issues/v0.3.0/00-README.md
Wave-order table of six agent-targetable issues with GitHub links; label-status instructions; live status; pre-flight checklist; maintainer prerequisites; and shell commands for label and issue creation.
Architecture Decision Records (ADR-001 & ADR-006)
.planning/agent-context/adr-001-source-adapters.md, .planning/agent-context/adr-006-serialization.md
ADR-001 documents source adapter layer contract (CPython docs ingestion via sphinx-build JSON from pinned ref; PyPI metadata lookup; offline-first invariant with single documented exception). ADR-006 documents serialization locked constraints (explicit pluggable format, compact JSON default, TOON opt-in gated by study, format parameter scope restrictions, storage choices, conceptual serializer seam).
Task Context Documents & Implementation Specs
.planning/agent-context/zstd-cache-codec.md, .planning/agent-context/cpython-source-sha-pin.md, .planning/agent-context/pyyaml-safe-loader-audit.md, .planning/agent-context/readme-glama-six-tool-refresh.md
Planning docs capture implementation touch-points, operational pitfalls, test expectations, and decision-log templates for zstd cache compression (codec API, table migration, dispatch rules), CPython SHA pinning (config, clone verification, test), YAML safe-loader audit (regression test scanning, trust boundary doc), and README tool-surface refresh (six-tool order sync, badge constraints, RELEASE.md checklist).
v0.3.0 Issue: Zstd Cache Codec & ADR-006
.planning/issues/v0.3.0/01-zstd-cache-codec.md, .planning/issues/v0.3.0/04-adr-006-serialization.md
Issue specs for zstd codec layer (zstandard dependency prerequisite, supported codec listing, test coverage, schema migration via ALTER TABLE, persistent cache wiring, codec dispatch) and ADR-006 markdown production (acceptance criteria, ADR template skeleton, validation commands).
v0.3.0 Issues: README Tool Refresh & YAML Audit
.planning/issues/v0.3.0/02-readme-glama-six-tool-refresh.md, .planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md
Issue specs for six-tool surface documentation sync (README table order, glama.json, RELEASE.md checklist, badge/version constraints, grep validation) and YAML safe-loader audit (yaml.safe_load only, synonyms.yaml identified, regression test scanning, YAML trust boundary doc).
v0.3.0 Issues: ADR-001 & CPython SHA Pin
.planning/issues/v0.3.0/05-adr-001-source-adapters.md, .planning/issues/v0.3.0/06-cpython-source-sha-pin.md
Issue specs for ADR-001 source adapter layer documentation (offline-first principle, CPython docs + PyPI metadata adapters, exception carving) and CPython build hardening (commit SHA pinning, config shape changes, clone-verify logic, test coverage, SECURITY.md threat-model drafting).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 A rabbit hops through code so neat,
Where agents dance to policy beat—
Roadmaps locked and rules so clear,
Golden templates everywhere!
No forbidden paths shall they tread,
With human eyes as guide instead. ✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: scaffolding the autonomous-agent pipeline for v0.3.0.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/v0.3.0-agent-pipeline

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbiteu coderabbiteu Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🧹 Nitpick comments (2)
.planning/agent-context/adr-006-serialization.md (1)

39-44: Minor style lint: vary repeated sentence openings in pitfalls block.

Three consecutive items start with very similar imperative phrasing, which triggered the style lint and makes the section read repetitive. Consider rewording one line for readability.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.planning/agent-context/adr-006-serialization.md around lines 39 - 44, The
three consecutive bullets in the pitfalls block ("Do not invent.", "Do not
implement `format`.", "Don't claim a TOON token win — ...") use repetitive
imperative openings; edit one of these lines (for example change "Do not
implement `format`." to "Implementation of `format` is disallowed in v0.3.x and
gated by the study." or rephrase "Don't claim a TOON token win — ..." to "Claims
of a TOON token win must be avoided until the study completes.") so the sentence
openings vary and the style lint is satisfied while preserving the original
meaning and references to `format` and TOON token rules.
.planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md (1)

21-23: Harden the YAML audit grep patterns to avoid false results.

These patterns are regex-fragile (. is unescaped, spacing variants can be missed). Since this is a security audit checklist, use precise matching (e.g., rg -n with escaped literals/optional whitespace).

Proposed command update
-- [ ] `grep -rn 'yaml.load(' src/ tests/` returns **zero** hits.
-- [ ] `grep -rn 'yaml.safe_load(' src/` returns at least the two expected call sites (`server.py`, `ingestion/sphinx_json.py`).
+- [ ] `rg -nP 'yaml\s*\.\s*load\s*\(' src tests` returns **zero** hits.
+- [ ] `rg -nP 'yaml\s*\.\s*safe_load\s*\(' src` returns at least the two expected call sites (`server.py`, `ingestion/sphinx_json.py`).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md around lines 21 - 23,
Update the checklist regexes to precise, escaped patterns so searches don't miss
spacing or mis-match file extensions: replace the loose patterns like
"yaml.load(", "yaml.safe_load(", and "\.ya\?ml" with anchored/escaped regexes
such as "\byaml\.load\s*\(", "\byaml\.safe_load\s*\(", and "\.ya?ml\b" (or use
ripgrep with -n --pcre2 and those patterns, e.g. rg -n --pcre2
'\byaml\.load\s*\(' '\byaml\.safe_load\s*\(' '\.ya?ml\b') so the audit reliably
matches the intended symbols (yaml.load, yaml.safe_load, and .ya?ml file names)
in .planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/PULL_REQUEST_TEMPLATE/agent.md:
- Around line 17-20: Remove the leading shell prompt characters from the
command-only example block so the lines `uv run ruff check src/ tests/`, `uv run
pyright src/`, `uv run pytest --tb=short -q`, and `uv run python-docs-mcp-server
doctor` appear without a `$ ` prefix; edit the code block in
.github/PULL_REQUEST_TEMPLATE/agent.md to replace each `$ uv ...` line with the
corresponding command-only line to satisfy markdownlint MD014.

In @.planning/issues/v0.3.0/02-readme-glama-six-tool-refresh.md:
- Line 22: Update the acceptance-criteria checklist item that hardcodes the
registry version: replace the literal badge/version reference
`MCP%20Registry-v0.1.4` / `0.2.1` with a version-agnostic requirement (or reword
to "current published registry version at execution time") so the criterion does
not embed a numeric version; modify the checklist text in the same item so it no
longer demands a specific hardcoded version but instead requires the README
badge to reflect the latest published registry when the task is executed.

In `@AGENT-EXECUTION-PIPELINE.md`:
- Line 127: The inline code span used for the commit prefix contains a trailing
space ("agent: ") which triggers MD038; update the code span in
AGENT-EXECUTION-PIPELINE.md so the inline code contains no trailing whitespace
(use "agent:" instead of "agent: "), ensuring the example commit prefix still
reads correctly and passes markdownlint; locate the example commit prefix string
(the code span around agent: ) and remove the trailing space inside the
backticks.
- Around line 309-319: The fenced CODEOWNERS example block is missing a language
tag which triggers MD040; update the opening fence of that block in
AGENT-EXECUTION-PIPELINE.md (the CODEOWNERS sketch) to include a language
identifier (for example change ``` to ```text) so the markdown linter recognizes
the block language and the example renders correctly.

---

Nitpick comments:
In @.planning/agent-context/adr-006-serialization.md:
- Around line 39-44: The three consecutive bullets in the pitfalls block ("Do
not invent.", "Do not implement `format`.", "Don't claim a TOON token win —
...") use repetitive imperative openings; edit one of these lines (for example
change "Do not implement `format`." to "Implementation of `format` is disallowed
in v0.3.x and gated by the study." or rephrase "Don't claim a TOON token win —
..." to "Claims of a TOON token win must be avoided until the study completes.")
so the sentence openings vary and the style lint is satisfied while preserving
the original meaning and references to `format` and TOON token rules.

In @.planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md:
- Around line 21-23: Update the checklist regexes to precise, escaped patterns
so searches don't miss spacing or mis-match file extensions: replace the loose
patterns like "yaml.load(", "yaml.safe_load(", and "\.ya\?ml" with
anchored/escaped regexes such as "\byaml\.load\s*\(", "\byaml\.safe_load\s*\(",
and "\.ya?ml\b" (or use ripgrep with -n --pcre2 and those patterns, e.g. rg -n
--pcre2 '\byaml\.load\s*\(' '\byaml\.safe_load\s*\(' '\.ya?ml\b') so the audit
reliably matches the intended symbols (yaml.load, yaml.safe_load, and .ya?ml
file names) in .planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ead6314d-2800-4379-9f22-af604e77aff2

📥 Commits

Reviewing files that changed from the base of the PR and between 9d6fc7d and 1778273.

📒 Files selected for processing (19)
  • .github/CODEOWNERS
  • .github/ISSUE_TEMPLATE/autonomous-agent.yml
  • .github/PULL_REQUEST_TEMPLATE/agent.md
  • .planning/agent-context/adr-001-source-adapters.md
  • .planning/agent-context/adr-006-serialization.md
  • .planning/agent-context/cpython-source-sha-pin.md
  • .planning/agent-context/pyyaml-safe-loader-audit.md
  • .planning/agent-context/readme-glama-six-tool-refresh.md
  • .planning/agent-context/zstd-cache-codec.md
  • .planning/issues/v0.3.0/00-README.md
  • .planning/issues/v0.3.0/01-zstd-cache-codec.md
  • .planning/issues/v0.3.0/02-readme-glama-six-tool-refresh.md
  • .planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md
  • .planning/issues/v0.3.0/04-adr-006-serialization.md
  • .planning/issues/v0.3.0/05-adr-001-source-adapters.md
  • .planning/issues/v0.3.0/06-cpython-source-sha-pin.md
  • AGENT-EXECUTION-PIPELINE.md
  • AGENTS.md
  • STRATEGIC-ROADMAP-2026-05-29.md

Comment on lines +17 to +20
$ uv run ruff check src/ tests/
$ uv run pyright src/
$ uv run pytest --tb=short -q
$ uv run python-docs-mcp-server doctor
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Drop shell prompts from command-only example block.

Using $ without output triggers MD014 in markdownlint.

Proposed fix
-$ uv run ruff check src/ tests/
-$ uv run pyright src/
-$ uv run pytest --tb=short -q
-$ uv run python-docs-mcp-server doctor
+uv run ruff check src/ tests/
+uv run pyright src/
+uv run pytest --tb=short -q
+uv run python-docs-mcp-server doctor
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
$ uv run ruff check src/ tests/
$ uv run pyright src/
$ uv run pytest --tb=short -q
$ uv run python-docs-mcp-server doctor
uv run ruff check src/ tests/
uv run pyright src/
uv run pytest --tb=short -q
uv run python-docs-mcp-server doctor
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)

[warning] 17-17: Dollar signs used before commands without showing output

(MD014, commands-show-output)


[warning] 18-18: Dollar signs used before commands without showing output

(MD014, commands-show-output)


[warning] 19-19: Dollar signs used before commands without showing output

(MD014, commands-show-output)


[warning] 20-20: Dollar signs used before commands without showing output

(MD014, commands-show-output)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/PULL_REQUEST_TEMPLATE/agent.md around lines 17 - 20, Remove the
leading shell prompt characters from the command-only example block so the lines
`uv run ruff check src/ tests/`, `uv run pyright src/`, `uv run pytest
--tb=short -q`, and `uv run python-docs-mcp-server doctor` appear without a `$ `
prefix; edit the code block in .github/PULL_REQUEST_TEMPLATE/agent.md to replace
each `$ uv ...` line with the corresponding command-only line to satisfy
markdownlint MD014.

## Acceptance criteria

- [ ] `README.md` `## Tools` section lists exactly six rows, including `compare_versions`, in the same order as the `@mcp.tool` declarations in `server.py` (search_docs, get_docs, lookup_package_docs, list_versions, detect_python_version, compare_versions). Verify: the six tool names appear once each in the table.
- [ ] The stale `MCP%20Registry-v0.1.4` badge in `README.md` is updated to the current published registry version (`0.2.1`) **or** made version-agnostic; no badge advertises a version older than the latest release. This is the only allowed edit above the first install code block.
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Avoid hardcoding a “latest” registry version in acceptance criteria.

Requiring 0.2.1 here will age out and create recurring doc-churn. Make the criterion version-agnostic only (or explicitly require “current published version at execution time” without embedding a number).

Based on learnings: Ensure user-facing documentation reflects current behavior before marking work as complete.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.planning/issues/v0.3.0/02-readme-glama-six-tool-refresh.md at line 22,
Update the acceptance-criteria checklist item that hardcodes the registry
version: replace the literal badge/version reference `MCP%20Registry-v0.1.4` /
`0.2.1` with a version-agnostic requirement (or reword to "current published
registry version at execution time") so the criterion does not embed a numeric
version; modify the checklist text in the same item so it no longer demands a
specific hardcoded version but instead requires the README badge to reflect the
latest published registry when the task is executed.

## 6. Branch, Commit, PR Conventions

- **Branch name:** `agent/{issue-number}-{kebab-case-summary}` (e.g., `agent/47-zstd-cache-codec`)
- **Commit prefix:** `agent: ` followed by a short, imperative summary. Conventional-commit scopes optional but encouraged: `agent: cache(codec): add zstd round-trip path`
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Remove space inside inline code span.

The inline code span includes a trailing space (agent: ), which triggers MD038 and can fail markdownlint in strict mode.

Proposed fix
-- **Commit prefix:** `agent: ` followed by a short, imperative summary. Conventional-commit scopes optional but encouraged: `agent: cache(codec): add zstd round-trip path`
+- **Commit prefix:** `agent:` followed by a short, imperative summary. Conventional-commit scopes optional but encouraged: `agent: cache(codec): add zstd round-trip path`
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- **Commit prefix:** `agent: ` followed by a short, imperative summary. Conventional-commit scopes optional but encouraged: `agent: cache(codec): add zstd round-trip path`
- **Commit prefix:** `agent:` followed by a short, imperative summary. Conventional-commit scopes optional but encouraged: `agent: cache(codec): add zstd round-trip path`
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)

[warning] 127-127: Spaces inside code span elements

(MD038, no-space-in-code)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@AGENT-EXECUTION-PIPELINE.md` at line 127, The inline code span used for the
commit prefix contains a trailing space ("agent: ") which triggers MD038; update
the code span in AGENT-EXECUTION-PIPELINE.md so the inline code contains no
trailing whitespace (use "agent:" instead of "agent: "), ensuring the example
commit prefix still reads correctly and passes markdownlint; locate the example
commit prefix string (the code span around agent: ) and remove the trailing
space inside the backticks.

Comment thread AGENT-EXECUTION-PIPELINE.md Outdated
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 6

🧹 Nitpick comments (7)
.github/CODEOWNERS (1)

29-31: 💤 Low value

Overlapping CODEOWNERS entries for .github/.

Lines 29–31 list three entries that overlap:

/.github/                                         `@ayhammouda`
/.github/workflows/                               `@ayhammouda`
/.github/workflows/release.yml                    `@ayhammouda`

The first entry (.github/) already covers the other two. While this redundancy is harmless and may serve as documentation emphasis, you could simplify to reduce noise.

♻️ Optional simplification
-# --- CI/CD and supply chain (release path especially) ---
-/.github/                                         `@ayhammouda`
-/.github/workflows/                               `@ayhammouda`
+# --- CI/CD and supply chain ---
+/.github/                                         `@ayhammouda`
 /.github/workflows/release.yml                    `@ayhammouda`

If you want to emphasize release.yml as especially sensitive, keep it; otherwise the top-level .github/ suffices.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/CODEOWNERS around lines 29 - 31, The CODEOWNERS file has overlapping
entries: "/.github/" already covers "/.github/workflows/" and
"/.github/workflows/release.yml"; remove the redundant lines
("/.github/workflows/" and "/.github/workflows/release.yml") or alternatively
keep only the specific "/.github/workflows/release.yml" and remove the broader
"/.github/" entry to avoid duplication—update the entries so each path is
uniquely owned and leave a single authoritative "/.github/" or the specific
release.yml line referencing `@ayhammouda`.
AGENT-EXECUTION-PIPELINE.md (1)

309-320: 💤 Low value

Consider adding a language identifier to the CODEOWNERS sketch.

The fenced code block at lines 309–320 (.github/CODEOWNERS sketch) has no language identifier. While CODEOWNERS doesn't have a standard syntax highlighter, you could use ```text or ```gitignore for clarity.

📝 Optional addition
-```
+```text
 # Forbidden-territory paths — require maintainer review
 /pyproject.toml                `@ayhammouda`
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@AGENT-EXECUTION-PIPELINE.md` around lines 309 - 320, Update the fenced code
block that contains the "Forbidden-territory paths — require maintainer review"
CODEOWNERS sketch so the opening backticks include a language identifier (e.g.,
change ``` to ```text or ```gitignore) to enable clearer rendering; locate the
block by the unique header line "Forbidden-territory paths — require maintainer
review" and the sample entry "/pyproject.toml                `@ayhammouda`" and
modify only the opening fence.
.planning/issues/v0.3.0/05-adr-001-source-adapters.md (1)

14-25: 💤 Low value

Minor inconsistency in "decider" terminology.

Line 21 uses singular "decider" while the ADR template at line 54 uses plural "Deciders". Consider standardizing to one form for consistency.

📝 Proposed fix for consistency
-- [ ] Status **Accepted**, date `2026-05-29`, decider `@ayhammouda`.
+- [ ] Status **Accepted**, date `2026-05-29`, deciders `@ayhammouda`.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.planning/issues/v0.3.0/05-adr-001-source-adapters.md around lines 14 - 25,
The ADR uses inconsistent decider terminology: replace the singular "decider"
header/field at the top (currently "decider `@ayhammouda`") with the template's
plural "Deciders" to match the rest of the document; update the metadata block
so it reads "Deciders: `@ayhammouda`" (or a comma-separated list if more than
one), keeping the same value and format used elsewhere in the ADR (e.g., the
template header "Deciders") to ensure consistency.
.planning/agent-context/cpython-source-sha-pin.md (1)

66-67: ⚡ Quick win

Clarify the decision log placeholder for SECURITY.md draft.

The blockquote marker on line 67 is visually incomplete. Consider adding placeholder text to make it explicit what content should go here.

📝 Suggested clarification
 - **Draft SECURITY.md threat-model paragraph (for human to paste):**
-  >
+  > [Agent: Draft a 2-3 sentence threat-model paragraph describing the build-index CPython clone as the largest non-runtime attack surface, now hardened via SHA pinning. This text goes in the PR description for human review before inclusion in SECURITY.md.]
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.planning/agent-context/cpython-source-sha-pin.md around lines 66 - 67, The
blockquote marker ">" under the heading "**Draft SECURITY.md threat-model
paragraph (for human to paste):**" is empty; replace it with an explicit
placeholder (e.g., "> TODO: draft threat-model paragraph — include scope,
assets, threats, mitigations") so readers know what content belongs there and
can paste the final paragraph; update the blockquote content to a clear
placeholder string referencing the SECURITY.md threat-model draft.
.planning/issues/v0.3.0/02-readme-glama-six-tool-refresh.md (1)

23-23: ⚡ Quick win

Consider broadening the grep pattern to catch more stale phrasing variations.

The current pattern 'five tools\|5 tools\|exposes five' will miss variations where words appear between "five" and "tools", such as "five read-only tools" or "five MCP tools".

Since the manual verification in criterion 1 provides a backstop, this is low-risk, but a more comprehensive pattern would make the automated check more robust.

Alternative pattern to catch more variations
-- [ ] `grep -rin 'five tools\|5 tools\|exposes five' README.md glama.json server.json` returns zero hits.
+- [ ] `grep -rin '\bfive\b.*\btools\b\|5\s*tools\|exposes\s*five' README.md glama.json server.json` returns zero hits.

This pattern would match "five" followed later by "tools" (catching "five read-only tools", "five MCP tools", etc.), while \b word boundaries prevent false matches in words like "fivefold".

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.planning/issues/v0.3.0/02-readme-glama-six-tool-refresh.md at line 23,
Update the grep pattern in the checklist entry that currently uses 'five
tools\|5 tools\|exposes five' to a broader, word-boundary aware,
case-insensitive pattern that matches "five" followed later by "tools" (allowing
intervening words) and still catches numeric "5 tools"; e.g., replace the
pattern with something like '\bfive\b.*\btools\b\|5\b.*\btools\b'
(case-insensitive) so phrases like "five read-only tools" or "five MCP tools"
are detected while avoiding false positives like "fivefold".
.planning/agent-context/zstd-cache-codec.md (2)

52-56: ⚡ Quick win

Consider adding guidance on schema evolution testing.

The pitfall correctly identifies the TEXT/BLOB mismatch and suggests two approaches, but doesn't mention that schema evolution (ALTER TABLE) should be tested for both "fresh cache" and "migrated cache" scenarios.

Given the acceptance criterion in the issue spec requires "existing on-disk cache opens without error and serves its rows," it would be helpful to note in this pitfall that tests should cover:

  1. Fresh cache (no ALTER needed, compression column exists from CREATE TABLE)
  2. Migrated cache (ALTER TABLE adds compression column to pre-v0.3.0 cache)
  3. Backward-compat read (reading old result_json TEXT entries when compression='none')
📋 Proposed addition to pitfall section
   Either store the blob in a new `BLOB` column and keep `result_json` for the
   `'none'` path, or store all payloads as `BLOB` and record the codec. Simplest
   forward-compatible design: keep `result_json` semantics for `'none'`, add a
   `result_blob BLOB` for compressed codecs, and let `compression` select which
   column to read. Document whichever you choose in the decision log below.
+- **Test both fresh and migrated cache scenarios.** Your tests should cover:
+  (1) a fresh cache where the compression column is created by the initial CREATE TABLE,
+  (2) a migrated cache where ALTER TABLE adds the column to an existing file, and
+  (3) backward-compat reads of pre-v0.3.0 entries that have `compression='none'` and only `result_json TEXT`.
+  The "survives restart" test pattern in `tests/test_persistent_docs_cache.py` provides a model for (3).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.planning/agent-context/zstd-cache-codec.md around lines 52 - 56, Add
guidance to the pitfall section to require explicit schema-evolution tests:
verify the two proposed schemas (keeping result_json TEXT for compression='none'
vs adding result_blob BLOB with a compression column) by testing (1) Fresh cache
creation where CREATE TABLE includes the compression column, (2) Migrated cache
where an older on-disk cache is upgraded via ALTER TABLE to add the compression/
result_blob columns (simulate pre-v0.3.0 state and run migration), and (3)
Backward-compatible reads where existing rows with result_json TEXT and
compression='none' are still read correctly; reference the column names
result_json, result_blob, compression and the ALTER TABLE migration path in the
decision log.

68-71: ⚡ Quick win

Clarify decision log usage expectations.

The decision log template includes four prompts, but it's unclear whether the agent should:

  1. Fill this in-place during implementation (modifying this file)
  2. Copy it to WORKING-NOTES.md
  3. Include it in the PR description
  4. Record it in commit messages

Given the AGENT-EXECUTION-PIPELINE.md requirement for WORKING-NOTES.md when blocked, and the PR template requirement, clarifying where these decisions should be recorded would help agents follow the process correctly.

📋 Proposed clarification
 ## 5. Decision log (fill this in as you work)
+
+Record your implementation decisions here for traceability. If you encounter
+blockers or need to escalate, copy relevant decisions to `WORKING-NOTES.md`
+per pipeline §8. Include a summary of non-obvious decisions in your PR description.
 
 - Chosen value-storage layout (`result_blob` vs reuse `result_json`):
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.planning/agent-context/zstd-cache-codec.md around lines 68 - 71, The
decision-log prompts in .planning/agent-context/zstd-cache-codec.md should not
be edited in-place; when implementing, copy the template contents into
WORKING-NOTES.md and fill them there (per AGENT-EXECUTION-PIPELINE.md) and also
include a concise summary of the filled prompts in the PR description (per PR
template); ensure the implemented commit message references the same decisions
(e.g., "Chosen value-storage layout", "zstd-dict-v1 round-trip", "Default
production codec wired into put()", "Deferred/escalated items") so reviewers can
trace the decision from WORKING-NOTES.md to PR and commits.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.planning/issues/v0.3.0/01-zstd-cache-codec.md:
- Line 39: Clarify and implement the production behavior for the 'zstd-dict-v1'
codec: decide whether to (A) remove 'zstd-dict-v1' from list_supported() until a
production dictionary is shipped, (B) keep it listed but make cache read/write
functions (e.g., list_supported(), the codec registration code and the decoder
path that checks compression=='zstd-dict-v1') explicitly raise a deterministic
error when no dictionary is supplied so reads are treated as misses, or (C) mark
it as future-gated in the spec and add a clear note that production code must
not write entries with compression='zstd-dict-v1' until a follow-up issue
provides the dictionary; update the README/markdown text and the implementation
of list_supported() and codec handling to reflect the chosen option
consistently.
- Line 43: Clarify and implement the configurable default codec by making it an
explicit constructor parameter on PersistentDocsCache (e.g.,
default_codec='zstd') in persistent_cache.py, store it as an instance attribute
(e.g., self.default_codec), use that attribute when writing new cache entries to
set their compression/codec, and leave get() decoding logic unchanged so it
still dispatches by the stored compression field; update the doc text in
.planning/issues/v0.3.0/01-zstd-cache-codec.md to state that the default is set
via the PersistentDocsCache constructor parameter and mention the default value
is 'zstd'.
- Line 41: The acceptance criteria lack a clear strategy for storing compressed
vs uncompressed values in the retrieved_docs_cache table: existing result_json
TEXT cannot hold compressed BLOBs; decide and document which migration approach
to use and update the spec accordingly. Specify either (A) dual-column: add
result_blob BLOB and keep result_json TEXT, set compression column to 'none' or
codec name and read/write logic uses result_blob for compressed codecs and
result_json for 'none' (plus ALTER TABLE to add result_blob if missing), or (B)
single-column: migrate all existing result_json TEXT into a new result_blob BLOB
(ALTER TABLE add result_blob, copy/convert rows, drop result_json), and ensure
the acceptance criteria reference the exact column names (result_json,
result_blob, compression) and the required schema-evolution steps and
verification checks for whichever approach is chosen.

In @.planning/issues/v0.3.0/05-adr-001-source-adapters.md:
- Around line 7-12: The ADR references non-existent repo-relative touch-point
paths; update .planning/issues/v0.3.0/05-adr-001-source-adapters.md to use the
actual module paths under src/mcp_server_python_docs/ (replace
ingestion/cpython_versions.py, ingestion/sphinx_json.py, ingestion/inventory.py,
services/package_docs.py with
src/mcp_server_python_docs/ingestion/cpython_versions.py,
src/mcp_server_python_docs/ingestion/sphinx_json.py,
src/mcp_server_python_docs/ingestion/inventory.py, and
src/mcp_server_python_docs/services/package_docs.py respectively, or add a note
that all listed touch-points are relative to the src/mcp_server_python_docs/
base).

In @.planning/issues/v0.3.0/06-cpython-source-sha-pin.md:
- Line 12: Replace the incorrect pinned CPython tag "v3.14.4" with "v3.14.5"
wherever the CPython release list is defined (look for the literal token
"v3.14.4") and update any tests or clone commands that reference that tag to use
"v3.14.5" instead so the pinned version matches the stable 3.14.5 release.

In `@AGENT-EXECUTION-PIPELINE.md`:
- Line 192: The table entry listing [`AGENTS.md`](AGENTS.md) as "**Needs
update** — add a one-paragraph link to this file" is stale because the PR
already adds the "Autonomous Agent Execution" section linking to
`AGENT-EXECUTION-PIPELINE.md`; update the table row for AGENTS.md to reflect the
true status (e.g., change "**Needs update**" to "**Up to date**" and remove the
action text) or, if the table is intended to show pre-PR state, add a short
clarifying note in that row stating it reflects pre-PR status; locate the row
referencing AGENTS.md in the table and adjust the status/action cell
accordingly.

---

Nitpick comments:
In @.github/CODEOWNERS:
- Around line 29-31: The CODEOWNERS file has overlapping entries: "/.github/"
already covers "/.github/workflows/" and "/.github/workflows/release.yml";
remove the redundant lines ("/.github/workflows/" and
"/.github/workflows/release.yml") or alternatively keep only the specific
"/.github/workflows/release.yml" and remove the broader "/.github/" entry to
avoid duplication—update the entries so each path is uniquely owned and leave a
single authoritative "/.github/" or the specific release.yml line referencing
`@ayhammouda`.

In @.planning/agent-context/cpython-source-sha-pin.md:
- Around line 66-67: The blockquote marker ">" under the heading "**Draft
SECURITY.md threat-model paragraph (for human to paste):**" is empty; replace it
with an explicit placeholder (e.g., "> TODO: draft threat-model paragraph —
include scope, assets, threats, mitigations") so readers know what content
belongs there and can paste the final paragraph; update the blockquote content
to a clear placeholder string referencing the SECURITY.md threat-model draft.

In @.planning/agent-context/zstd-cache-codec.md:
- Around line 52-56: Add guidance to the pitfall section to require explicit
schema-evolution tests: verify the two proposed schemas (keeping result_json
TEXT for compression='none' vs adding result_blob BLOB with a compression
column) by testing (1) Fresh cache creation where CREATE TABLE includes the
compression column, (2) Migrated cache where an older on-disk cache is upgraded
via ALTER TABLE to add the compression/ result_blob columns (simulate pre-v0.3.0
state and run migration), and (3) Backward-compatible reads where existing rows
with result_json TEXT and compression='none' are still read correctly; reference
the column names result_json, result_blob, compression and the ALTER TABLE
migration path in the decision log.
- Around line 68-71: The decision-log prompts in
.planning/agent-context/zstd-cache-codec.md should not be edited in-place; when
implementing, copy the template contents into WORKING-NOTES.md and fill them
there (per AGENT-EXECUTION-PIPELINE.md) and also include a concise summary of
the filled prompts in the PR description (per PR template); ensure the
implemented commit message references the same decisions (e.g., "Chosen
value-storage layout", "zstd-dict-v1 round-trip", "Default production codec
wired into put()", "Deferred/escalated items") so reviewers can trace the
decision from WORKING-NOTES.md to PR and commits.

In @.planning/issues/v0.3.0/02-readme-glama-six-tool-refresh.md:
- Line 23: Update the grep pattern in the checklist entry that currently uses
'five tools\|5 tools\|exposes five' to a broader, word-boundary aware,
case-insensitive pattern that matches "five" followed later by "tools" (allowing
intervening words) and still catches numeric "5 tools"; e.g., replace the
pattern with something like '\bfive\b.*\btools\b\|5\b.*\btools\b'
(case-insensitive) so phrases like "five read-only tools" or "five MCP tools"
are detected while avoiding false positives like "fivefold".

In @.planning/issues/v0.3.0/05-adr-001-source-adapters.md:
- Around line 14-25: The ADR uses inconsistent decider terminology: replace the
singular "decider" header/field at the top (currently "decider `@ayhammouda`")
with the template's plural "Deciders" to match the rest of the document; update
the metadata block so it reads "Deciders: `@ayhammouda`" (or a comma-separated
list if more than one), keeping the same value and format used elsewhere in the
ADR (e.g., the template header "Deciders") to ensure consistency.

In `@AGENT-EXECUTION-PIPELINE.md`:
- Around line 309-320: Update the fenced code block that contains the
"Forbidden-territory paths — require maintainer review" CODEOWNERS sketch so the
opening backticks include a language identifier (e.g., change ``` to ```text or
```gitignore) to enable clearer rendering; locate the block by the unique header
line "Forbidden-territory paths — require maintainer review" and the sample
entry "/pyproject.toml                `@ayhammouda`" and modify only the opening
fence.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 664937d1-ace2-4403-bbc1-5ad3a7f8def4

📥 Commits

Reviewing files that changed from the base of the PR and between 9d6fc7d and 1778273.

📒 Files selected for processing (19)
  • .github/CODEOWNERS
  • .github/ISSUE_TEMPLATE/autonomous-agent.yml
  • .github/PULL_REQUEST_TEMPLATE/agent.md
  • .planning/agent-context/adr-001-source-adapters.md
  • .planning/agent-context/adr-006-serialization.md
  • .planning/agent-context/cpython-source-sha-pin.md
  • .planning/agent-context/pyyaml-safe-loader-audit.md
  • .planning/agent-context/readme-glama-six-tool-refresh.md
  • .planning/agent-context/zstd-cache-codec.md
  • .planning/issues/v0.3.0/00-README.md
  • .planning/issues/v0.3.0/01-zstd-cache-codec.md
  • .planning/issues/v0.3.0/02-readme-glama-six-tool-refresh.md
  • .planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md
  • .planning/issues/v0.3.0/04-adr-006-serialization.md
  • .planning/issues/v0.3.0/05-adr-001-source-adapters.md
  • .planning/issues/v0.3.0/06-cpython-source-sha-pin.md
  • AGENT-EXECUTION-PIPELINE.md
  • AGENTS.md
  • STRATEGIC-ROADMAP-2026-05-29.md


## Acceptance criteria

- [ ] `python -c 'from mcp_server_python_docs.cache.codec import list_supported; print(list_supported())'` prints exactly `['none', 'zstd', 'zstd-dict-v1']`.
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Clarify the production behavior of 'zstd-dict-v1' codec.

Line 39 requires list_supported() to return ['none', 'zstd', 'zstd-dict-v1'], but line 54 explicitly states "no production dictionary artifact ships in this issue" and the context file (lines 59-62) says the codec should "work only when an explicit dictionary object is supplied by tests."

This creates a design question: what happens if production code encounters a cached row with compression='zstd-dict-v1' but no dictionary is available? Should:

  1. The codec raise an error (cache read fails, logged as a miss)?
  2. The codec be excluded from list_supported() until a dictionary ships?
  3. A future issue provide the production dictionary before any code writes 'zstd-dict-v1' entries?

The acceptance criteria should clarify the intended behavior to prevent an autonomous agent from implementing a codec that could break cache reads in production.

💡 Suggested resolution options

Option 1 (safest): Exclude 'zstd-dict-v1' from production surface until dictionary ships:

-- [ ] `python -c 'from mcp_server_python_docs.cache.codec import list_supported; print(list_supported())'` prints exactly `['none', 'zstd', 'zstd-dict-v1']`.
+- [ ] `python -c 'from mcp_server_python_docs.cache.codec import list_supported; print(list_supported())'` prints exactly `['none', 'zstd']`. The `'zstd-dict-v1'` codec is implemented and tested but not included in `list_supported()` until a production dictionary artifact ships in a follow-up issue.

Option 2: Make dictionary-less failure explicit and acceptable:

 - [ ] `python -c 'from mcp_server_python_docs.cache.codec import list_supported; print(list_supported())'` prints exactly `['none', 'zstd', 'zstd-dict-v1']`.
+- [ ] If `decode()` is called with `codec='zstd-dict-v1'` and `dictionary=None`, it raises `ValueError` with a clear message. The persistent cache's best-effort error handling will log and treat it as a cache miss.

Option 3: Document this is future-gated:

Add to scope boundaries:

 **Out of scope (do NOT do these — stop and comment if they seem required):**
 - Training and **packaging a production `zstd-dict-v1` dictionary** from a real `get_docs` corpus — corpus selection is a human judgment call per roadmap §4. The `zstd-dict-v1` codec must *function* with an explicit dictionary object supplied by tests, but no production dictionary artifact ships in this issue.
+- The cache's default codec remains `'zstd'` (no dictionary). No code in this issue writes `compression='zstd-dict-v1'` entries, so the dictionary-less failure path is not exercised in production until a follow-up issue ships the trained dictionary artifact.

Also applies to: 54-54

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.planning/issues/v0.3.0/01-zstd-cache-codec.md at line 39, Clarify and
implement the production behavior for the 'zstd-dict-v1' codec: decide whether
to (A) remove 'zstd-dict-v1' from list_supported() until a production dictionary
is shipped, (B) keep it listed but make cache read/write functions (e.g.,
list_supported(), the codec registration code and the decoder path that checks
compression=='zstd-dict-v1') explicitly raise a deterministic error when no
dictionary is supplied so reads are treated as misses, or (C) mark it as
future-gated in the spec and add a clear note that production code must not
write entries with compression='zstd-dict-v1' until a follow-up issue provides
the dictionary; update the README/markdown text and the implementation of
list_supported() and codec handling to reflect the chosen option consistently.


- [ ] `python -c 'from mcp_server_python_docs.cache.codec import list_supported; print(list_supported())'` prints exactly `['none', 'zstd', 'zstd-dict-v1']`.
- [ ] `uv run pytest tests/cache/test_codec.py -q` passes with **at least 4** new tests covering: round-trip for `'none'`, round-trip for `'zstd'`, round-trip for `'zstd-dict-v1'` using an explicit test-only dictionary object, and graceful decode of a value written under `compression='none'` by a prior server version.
- [ ] The `retrieved_docs_cache` table gains a `compression TEXT NOT NULL DEFAULT 'none'` column, added via `ALTER TABLE ... ADD COLUMN` when an older cache file lacks it (existence-checked), so an existing on-disk cache opens without error and serves its rows.
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick win

Clarify the value-column storage migration strategy.

The acceptance criterion specifies adding a compression TEXT NOT NULL DEFAULT 'none' column via ALTER TABLE, but doesn't specify how to handle the value-column type mismatch: the existing result_json column is TEXT, but compressed payloads are bytes (BLOB).

The context file (.planning/agent-context/zstd-cache-codec.md lines 51-56) correctly identifies this as a pitfall and suggests two approaches:

  1. Dual-column: keep result_json TEXT for 'none', add result_blob BLOB for compressed codecs
  2. Single-column: migrate everything to result_blob BLOB

However, the issue spec doesn't prescribe which approach to take, which could lead to implementation ambiguity for an autonomous agent.

📋 Proposed clarification

Add a bullet to the acceptance criteria specifying the value-column approach, for example:

 - [ ] The `retrieved_docs_cache` table gains a `compression TEXT NOT NULL DEFAULT 'none'` column, added via `ALTER TABLE ... ADD COLUMN` when an older cache file lacks it (existence-checked), so an existing on-disk cache opens without error and serves its rows.
+- [ ] The cache table stores values in a `result_blob BLOB` column (added via ALTER TABLE when missing); `put()` writes compressed bytes to `result_blob` for all codecs including `'none'` (UTF-8 encoded); `get()` reads from `result_blob` when present, falling back to `result_json TEXT` for backward compatibility with pre-v0.3.0 cache files.

Or, if preferring the dual-column approach:

 - [ ] The `retrieved_docs_cache` table gains a `compression TEXT NOT NULL DEFAULT 'none'` column, added via `ALTER TABLE ... ADD COLUMN` when an older cache file lacks it (existence-checked), so an existing on-disk cache opens without error and serves its rows.
+- [ ] For codecs other than `'none'`, the cache table stores compressed bytes in a new `result_blob BLOB` column (added via ALTER TABLE when missing); `get()` checks `compression` and reads from `result_blob` for compressed entries or `result_json` for `'none'` entries.

Based on learnings, this project values changes that are easier to verify and trust—explicit schema evolution acceptance criteria support that goal.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- [ ] The `retrieved_docs_cache` table gains a `compression TEXT NOT NULL DEFAULT 'none'` column, added via `ALTER TABLE ... ADD COLUMN` when an older cache file lacks it (existence-checked), so an existing on-disk cache opens without error and serves its rows.
- [ ] The `retrieved_docs_cache` table gains a `compression TEXT NOT NULL DEFAULT 'none'` column, added via `ALTER TABLE ... ADD COLUMN` when an older cache file lacks it (existence-checked), so an existing on-disk cache opens without error and serves its rows.
- [ ] The cache table stores values in a `result_blob BLOB` column (added via ALTER TABLE when missing); `put()` writes compressed bytes to `result_blob` for all codecs including `'none'` (UTF-8 encoded); `get()` reads from `result_blob` when present, falling back to `result_json TEXT` for backward compatibility with pre-v0.3.0 cache files.
Suggested change
- [ ] The `retrieved_docs_cache` table gains a `compression TEXT NOT NULL DEFAULT 'none'` column, added via `ALTER TABLE ... ADD COLUMN` when an older cache file lacks it (existence-checked), so an existing on-disk cache opens without error and serves its rows.
- [ ] The `retrieved_docs_cache` table gains a `compression TEXT NOT NULL DEFAULT 'none'` column, added via `ALTER TABLE ... ADD COLUMN` when an older cache file lacks it (existence-checked), so an existing on-disk cache opens without error and serves its rows.
- [ ] For codecs other than `'none'`, the cache table stores compressed bytes in a new `result_blob BLOB` column (added via ALTER TABLE when missing); `get()` checks `compression` and reads from `result_blob` for compressed entries or `result_json` for `'none'` entries.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.planning/issues/v0.3.0/01-zstd-cache-codec.md at line 41, The acceptance
criteria lack a clear strategy for storing compressed vs uncompressed values in
the retrieved_docs_cache table: existing result_json TEXT cannot hold compressed
BLOBs; decide and document which migration approach to use and update the spec
accordingly. Specify either (A) dual-column: add result_blob BLOB and keep
result_json TEXT, set compression column to 'none' or codec name and read/write
logic uses result_blob for compressed codecs and result_json for 'none' (plus
ALTER TABLE to add result_blob if missing), or (B) single-column: migrate all
existing result_json TEXT into a new result_blob BLOB (ALTER TABLE add
result_blob, copy/convert rows, drop result_json), and ensure the acceptance
criteria reference the exact column names (result_json, result_blob,
compression) and the required schema-evolution steps and verification checks for
whichever approach is chosen.

- [ ] `uv run pytest tests/cache/test_codec.py -q` passes with **at least 4** new tests covering: round-trip for `'none'`, round-trip for `'zstd'`, round-trip for `'zstd-dict-v1'` using an explicit test-only dictionary object, and graceful decode of a value written under `compression='none'` by a prior server version.
- [ ] The `retrieved_docs_cache` table gains a `compression TEXT NOT NULL DEFAULT 'none'` column, added via `ALTER TABLE ... ADD COLUMN` when an older cache file lacks it (existence-checked), so an existing on-disk cache opens without error and serves its rows.
- [ ] `uv run pytest tests/test_persistent_docs_cache.py -q` still passes (no regression to the existing cache contract), and a new test asserts a value written by the current server reads back identically after a simulated restart with the default production codec.
- [ ] The cache writes new entries with a single configurable default codec (`'zstd'`); `get()` dispatches decode purely off the stored `compression` value, never off the default.
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick win

Specify where the "configurable default codec" is configured.

The acceptance criterion states "cache writes new entries with a single configurable default codec ('zstd')" but doesn't specify the configuration mechanism. Should this be:

  • A hardcoded constant in persistent_cache.py?
  • A constructor parameter for PersistentDocsCache?
  • An environment variable?
  • A field in a config file?

For an autonomous agent to implement this unambiguously, the configuration location and mechanism should be explicit.

📋 Proposed clarification
-- [ ] The cache writes new entries with a single configurable default codec (`'zstd'`); `get()` dispatches decode purely off the stored `compression` value, never off the default.
+- [ ] The cache writes new entries with a hardcoded default codec `'zstd'` (defined as a module-level constant in `persistent_cache.py`); `get()` dispatches decode purely off the stored `compression` value, never off the default.

Or if a parameter is preferred:

-- [ ] The cache writes new entries with a single configurable default codec (`'zstd'`); `get()` dispatches decode purely off the stored `compression` value, never off the default.
+- [ ] `PersistentDocsCache.__init__` accepts an optional `default_codec: str = 'zstd'` parameter; the cache writes new entries with this codec; `get()` dispatches decode purely off the stored `compression` value, never off the default.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- [ ] The cache writes new entries with a single configurable default codec (`'zstd'`); `get()` dispatches decode purely off the stored `compression` value, never off the default.
- [ ] The cache writes new entries with a hardcoded default codec `'zstd'` (defined as a module-level constant in `persistent_cache.py`); `get()` dispatches decode purely off the stored `compression` value, never off the default.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.planning/issues/v0.3.0/01-zstd-cache-codec.md at line 43, Clarify and
implement the configurable default codec by making it an explicit constructor
parameter on PersistentDocsCache (e.g., default_codec='zstd') in
persistent_cache.py, store it as an instance attribute (e.g.,
self.default_codec), use that attribute when writing new cache entries to set
their compression/codec, and leave get() decoding logic unchanged so it still
dispatches by the stored compression field; update the doc text in
.planning/issues/v0.3.0/01-zstd-cache-codec.md to state that the default is set
via the PersistentDocsCache constructor parameter and mention the default value
is 'zstd'.

Comment on lines +7 to +12
## Context

- **Per-issue context file (read first):** [`.planning/agent-context/adr-001-source-adapters.md`](../../agent-context/adr-001-source-adapters.md)
- Pipeline: [`AGENT-EXECUTION-PIPELINE.md`](../../../AGENT-EXECUTION-PIPELINE.md)
- Roadmap: [`STRATEGIC-ROADMAP-2026-05-29.md`](../../../STRATEGIC-ROADMAP-2026-05-29.md) — principles **2.1, 2.2, 2.7**
- Source-adapter touch-points (to describe, not change): `ingestion/cpython_versions.py`, `ingestion/sphinx_json.py`, `ingestion/inventory.py`, `services/package_docs.py`
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify that all listed source-adapter files exist

echo "Checking source-adapter touch-points..."
fd -t f -p 'ingestion/cpython_versions.py'
fd -t f -p 'ingestion/sphinx_json.py'
fd -t f -p 'ingestion/inventory.py'
fd -t f -p 'services/package_docs.py'

echo -e "\nExpected: 4 files found"

Repository: ayhammouda/python-docs-mcp-server

Length of output: 353


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== ADR snippet (lines 1-40) ==="
nl -ba .planning/issues/v0.3.0/05-adr-001-source-adapters.md | sed -n '1,60p'

echo
echo "=== Path existence checks (repo-relative) ==="
for p in \
  'ingestion/cpython_versions.py' \
  'ingestion/sphinx_json.py' \
  'ingestion/inventory.py' \
  'services/package_docs.py' \
  'src/mcp_server_python_docs/ingestion/cpython_versions.py' \
  'src/mcp_server_python_docs/ingestion/sphinx_json.py' \
  'src/mcp_server_python_docs/ingestion/inventory.py' \
  'src/mcp_server_python_docs/services/package_docs.py'
do
  echo "--- $p ---"
  fd -t f -p "$p" || true
done

Repository: ayhammouda/python-docs-mcp-server

Length of output: 171


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== ADR snippet (lines 1-60) with line numbers ==="
python3 - <<'PY'
from pathlib import Path
p = Path(".planning/issues/v0.3.0/05-adr-001-source-adapters.md")
lines = p.read_text(encoding="utf-8").splitlines()
for i, line in enumerate(lines[:60], start=1):
    print(f"{i:4d}: {line}")
PY

echo
echo "=== Path existence checks (repo-relative) ==="
for p in \
  'ingestion/cpython_versions.py' \
  'ingestion/sphinx_json.py' \
  'ingestion/inventory.py' \
  'services/package_docs.py' \
  'src/mcp_server_python_docs/ingestion/cpython_versions.py' \
  'src/mcp_server_python_docs/ingestion/sphinx_json.py' \
  'src/mcp_server_python_docs/ingestion/inventory.py' \
  'src/mcp_server_python_docs/services/package_docs.py'
do
  echo "--- $p ---"
  fd -t f -p "$p" || true
done

Repository: ayhammouda/python-docs-mcp-server

Length of output: 4579


Fix inaccurate source-adapter paths in ADR

The listed touch-points in .planning/issues/v0.3.0/05-adr-001-source-adapters.md (ingestion/... and services/package_docs.py) do not exist at those repo-relative paths. They are present instead under src/mcp_server_python_docs/:

  • src/mcp_server_python_docs/ingestion/cpython_versions.py
  • src/mcp_server_python_docs/ingestion/sphinx_json.py
  • src/mcp_server_python_docs/ingestion/inventory.py
  • src/mcp_server_python_docs/services/package_docs.py
    Update the ADR to use the correct paths (or explicitly document the src/mcp_server_python_docs/ base prefix).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.planning/issues/v0.3.0/05-adr-001-source-adapters.md around lines 7 - 12,
The ADR references non-existent repo-relative touch-point paths; update
.planning/issues/v0.3.0/05-adr-001-source-adapters.md to use the actual module
paths under src/mcp_server_python_docs/ (replace ingestion/cpython_versions.py,
ingestion/sphinx_json.py, ingestion/inventory.py, services/package_docs.py with
src/mcp_server_python_docs/ingestion/cpython_versions.py,
src/mcp_server_python_docs/ingestion/sphinx_json.py,
src/mcp_server_python_docs/ingestion/inventory.py, and
src/mcp_server_python_docs/services/package_docs.py respectively, or add a note
that all listed touch-points are relative to the src/mcp_server_python_docs/
base).

- **Per-issue context file (read first):** [`.planning/agent-context/cpython-source-sha-pin.md`](../../agent-context/cpython-source-sha-pin.md)
- Pipeline: [`AGENT-EXECUTION-PIPELINE.md`](../../../AGENT-EXECUTION-PIPELINE.md)
- Roadmap: [`STRATEGIC-ROADMAP-2026-05-29.md`](../../../STRATEGIC-ROADMAP-2026-05-29.md) §4 (v0.3.0, build-time supply-chain hardening), decision **5.10**
- Touch-points: `ingestion/cpython_versions.py` (`CPythonDocsBuildConfig`, `CPYTHON_DOCS_BUILD_CONFIG`), `__main__.py:210–226` (the `git clone --depth 1 --branch <tag>` call), `tests/test_ingestion.py:53`
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

What are the latest stable release tags for Python 3.10, 3.11, 3.12, 3.13, and 3.14 as of May 2026?

💡 Result:

As of 2026-05-29, the latest stable (final) CPython maintenance releases for each requested Python series are: - Python 3.10: 3.10.20 [1][2] - Python 3.11: 3.11.15 [1] - Python 3.12: 3.12.13 [1][3] - Python 3.13: 3.13.13 [1][4] - Python 3.14: 3.14.5 [1][2] These versions are listed as the “Stable Releases” / “Latest Python 3 Release” on Python’s official downloads/source release pages, and each specific release page reports its release date and version (final). [1][2][3][4]

Citations:


Fix the pinned CPython tag for Python 3.14.

The touch-point versions match the latest stable releases for 3.10/3.11/3.12/3.13 (v3.10.20, v3.11.15, v3.12.13, v3.13.13), but Python 3.14’s latest stable is 3.14.5—update v3.14.4 to v3.14.5 in .planning/issues/v0.3.0/06-cpython-source-sha-pin.md (line 12).

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.planning/issues/v0.3.0/06-cpython-source-sha-pin.md at line 12, Replace the
incorrect pinned CPython tag "v3.14.4" with "v3.14.5" wherever the CPython
release list is defined (look for the literal token "v3.14.4") and update any
tests or clone commands that reference that tag to use "v3.14.5" instead so the
pinned version matches the stable 3.14.5 release.

Comment thread AGENT-EXECUTION-PIPELINE.md
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.coderabbit.yaml:
- Around line 9-11: Update the .coderabbit.yaml path_filters to include
user-facing docs and important config files (e.g., add "*.md" and
"pyproject.toml" alongside "src/**" and "tests/**") and add a corresponding
path_instructions entry for "*.md" that instructs reviewers to focus on whether
user-facing documentation (e.g., README.md) accurately reflects current behavior
when source changes (referenced by src/**) affect APIs, commands, or workflows;
modify the path_filters and add the path: "*.md" instructions block so the
linter/reviewer will not skip docs and packaging files.

In `@OPENCLAW-FORGE-PROTOCOL.md`:
- Around line 78-79: Change the owner for the `agent-ready` label from Vision to
a human maintainer everywhere in the document: update the table row that
currently lists `agent-ready | Vision only` to indicate a human/maintainer
owner, and update any Vision protocol steps that auto-apply or claim
`agent-ready` so they instead require explicit human/maintainer application;
ensure all occurrences of the label `agent-ready` in the Vision protocol section
and the table are consistent with the guardrail that it must be human-applied.
- Line 17: The doc currently conflicts: one place names "Aymen" as the final
human merge authority while another allows "Aymen/Vision" to merge; update the
Markdown to make merge authority human-only by removing or replacing the
"Vision" bot/automation entry so that all merge permissions reference only human
reviewers (e.g., change the "Aymen/Vision" mention to "Aymen" or to a human-only
team), and ensure the PR policy language explicitly forbids automerge and
requires a human sign-off in both the statement that names "Aymen" and the
location that currently lists "Aymen/Vision" so the two sections are consistent.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5ca7659b-2174-4d33-b03b-d2aff6521cbb

📥 Commits

Reviewing files that changed from the base of the PR and between 1778273 and 863bb9f.

📒 Files selected for processing (9)
  • .coderabbit.yaml
  • .github/CODEOWNERS
  • .github/PULL_REQUEST_TEMPLATE/agent.md
  • .planning/issues/v0.3.0/00-README.md
  • .planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md
  • AGENT-EXECUTION-PIPELINE.md
  • AGENTS.md
  • OPENCLAW-FORGE-PROTOCOL.md
  • STRATEGIC-ROADMAP-2026-05-29.md
✅ Files skipped from review due to trivial changes (4)
  • AGENTS.md
  • .planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md
  • .planning/issues/v0.3.0/00-README.md
  • STRATEGIC-ROADMAP-2026-05-29.md
🚧 Files skipped from review as they are similar to previous changes (2)
  • .github/CODEOWNERS
  • .github/PULL_REQUEST_TEMPLATE/agent.md

Comment thread .coderabbit.yaml
Comment on lines +9 to +11
path_filters:
- "src/**"
- "tests/**"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Path filters exclude user-facing docs required by coding guidelines.

The path filters limit review to src/** and tests/**, but:

  1. The coding guideline requires *.md files (user-facing docs) to reflect current behavior.
  2. The src/** instruction on line 18 says to check if "changed source code makes those docs materially inaccurate," but that's impossible if .md files are filtered out.
  3. Config files like pyproject.toml are excluded, missing potential packaging-impact review.
  4. User-facing docs like README.md (referenced in issue #47 context) won't be reviewed.

Consider adding to path_filters:

   path_filters:
     - "src/**"
     - "tests/**"
+    - "*.md"
+    - "pyproject.toml"

And add corresponding path_instructions for *.md:

    - path: "*.md"
      instructions: |
        Focus review on whether user-facing documentation accurately reflects
        current behavior, especially when source code changes in this PR affect
        documented APIs, tool names, commands, or workflows.

As per coding guidelines, *.md: User-facing docs must reflect the current behavior.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.coderabbit.yaml around lines 9 - 11, Update the .coderabbit.yaml
path_filters to include user-facing docs and important config files (e.g., add
"*.md" and "pyproject.toml" alongside "src/**" and "tests/**") and add a
corresponding path_instructions entry for "*.md" that instructs reviewers to
focus on whether user-facing documentation (e.g., README.md) accurately reflects
current behavior when source changes (referenced by src/**) affect APIs,
commands, or workflows; modify the path_filters and add the path: "*.md"
instructions block so the linter/reviewer will not skip docs and packaging
files.

- **Gilfoyle** implements one scoped issue at a time.
- **Heimdall** verifies behavior, packaging, security posture, and release readiness.
- **CodeRabbit** provides automated review signal that Heimdall and Vision must triage.
- **Aymen** remains the final human review authority for protected merges.
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Merge authority is internally inconsistent.

Line 17 says Aymen is final human merge authority, but Line 63 allows Aymen/Vision to merge. This weakens the no-automerge/human-review governance model and should be made human-only.

Proposed doc fix
-    O -- yes --> Q[Aymen/Vision merges manually after protected checks]
+    O -- yes --> Q[Aymen merges manually after protected checks]

As per coding guidelines, "*.md: User-facing docs must reflect the current behavior". Based on learnings, "every PR needs human review, and auto-merge is forbidden."

Also applies to: 63-63

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OPENCLAW-FORGE-PROTOCOL.md` at line 17, The doc currently conflicts: one
place names "Aymen" as the final human merge authority while another allows
"Aymen/Vision" to merge; update the Markdown to make merge authority human-only
by removing or replacing the "Vision" bot/automation entry so that all merge
permissions reference only human reviewers (e.g., change the "Aymen/Vision"
mention to "Aymen" or to a human-only team), and ensure the PR policy language
explicitly forbids automerge and requires a human sign-off in both the statement
that names "Aymen" and the location that currently lists "Aymen/Vision" so the
two sections are consistent.

Comment on lines +78 to +79
| `agent-ready` | Vision only | Issue passed pre-flight and may be picked up by Gilfoyle |
| `agent-in-progress` | Gilfoyle | Gilfoyle has claimed the issue |
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

agent-ready ownership conflicts with the stated guardrail.

This doc assigns agent-ready to Vision, but the PR guardrail says agent-ready must be human-applied. Please make the label owner explicitly human (maintainer) here and in the Vision protocol steps.

Proposed doc fix
-| `agent-ready` | Vision only | Issue passed pre-flight and may be picked up by Gilfoyle |
+| `agent-ready` | Human maintainer only | Issue passed pre-flight and may be picked up by Gilfoyle |
-Before labeling an issue `agent-ready`, Vision must verify:
+Before requesting a human to label an issue `agent-ready`, Vision must verify:

As per coding guidelines, "*.md: User-facing docs must reflect the current behavior". Based on learnings, "agent-ready must be human-applied."

Also applies to: 95-96

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OPENCLAW-FORGE-PROTOCOL.md` around lines 78 - 79, Change the owner for the
`agent-ready` label from Vision to a human maintainer everywhere in the
document: update the table row that currently lists `agent-ready | Vision only`
to indicate a human/maintainer owner, and update any Vision protocol steps that
auto-apply or claim `agent-ready` so they instead require explicit
human/maintainer application; ensure all occurrences of the label `agent-ready`
in the Vision protocol section and the table are consistent with the guardrail
that it must be human-applied.

Copy link
Copy Markdown

@coderabbiteu coderabbiteu Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (2)
AGENT-EXECUTION-PIPELINE.md (2)

131-131: ⚠️ Potential issue | 🟡 Minor

Remove trailing space inside inline code span.

Inline code agent: includes a trailing space and can trigger markdownlint MD038.

Proposed fix
-- **Commit prefix:** `agent: ` followed by a short, imperative summary. Conventional-commit scopes optional but encouraged: `agent: cache(codec): add zstd round-trip path`
+- **Commit prefix:** `agent:` followed by a short, imperative summary. Conventional-commit scopes optional but encouraged: `agent: cache(codec): add zstd round-trip path`
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@AGENT-EXECUTION-PIPELINE.md` at line 131, The inline code snippet currently
contains a trailing space inside the backticks (`agent: `) which triggers
markdownlint MD038; update the markdown in AGENT-EXECUTION-PIPELINE.md to remove
the trailing space so the inline code becomes `agent:` (i.e., replace `agent: `
with `agent:` in the commit prefix example).

197-197: ⚠️ Potential issue | 🟡 Minor

Status row for AGENTS.md appears outdated; verify against current file.

This row says “Needs update”, but this PR claims AGENTS.md already links to this pipeline. Please align the status with actual repo state.

#!/bin/bash
# Verify whether AGENTS.md already contains the autonomous-agent execution section/link.
set -euo pipefail

fd -i '^AGENTS\.md$' --exec sed -n '1,220p' {}
rg -n "Autonomous Agent Execution|AGENT-EXECUTION-PIPELINE\.md" AGENTS.md -C 2
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@AGENT-EXECUTION-PIPELINE.md` at line 197, The status cell for `AGENTS.md` in
the table row referencing `AGENT-EXECUTION-PIPELINE.md` is inconsistent with the
repository content; open `AGENTS.md` and confirm whether it already contains the
one-paragraph link or section titled like "Autonomous Agent Execution" or a
reference to `AGENT-EXECUTION-PIPELINE.md`, then update the table row in
`AGENT-EXECUTION-PIPELINE.md` to reflect the true state: change “Needs update —
add a one-paragraph link to this file” to “Up to date” if the link/section
exists, or actually add the one-paragraph link/section to `AGENTS.md` and leave
the status as “Needs update” until that change is made; use the filenames
`AGENTS.md` and `AGENT-EXECUTION-PIPELINE.md` to locate the places to edit.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@AGENT-EXECUTION-PIPELINE.md`:
- Line 131: The inline code snippet currently contains a trailing space inside
the backticks (`agent: `) which triggers markdownlint MD038; update the markdown
in AGENT-EXECUTION-PIPELINE.md to remove the trailing space so the inline code
becomes `agent:` (i.e., replace `agent: ` with `agent:` in the commit prefix
example).
- Line 197: The status cell for `AGENTS.md` in the table row referencing
`AGENT-EXECUTION-PIPELINE.md` is inconsistent with the repository content; open
`AGENTS.md` and confirm whether it already contains the one-paragraph link or
section titled like "Autonomous Agent Execution" or a reference to
`AGENT-EXECUTION-PIPELINE.md`, then update the table row in
`AGENT-EXECUTION-PIPELINE.md` to reflect the true state: change “Needs update —
add a one-paragraph link to this file” to “Up to date” if the link/section
exists, or actually add the one-paragraph link/section to `AGENTS.md` and leave
the status as “Needs update” until that change is made; use the filenames
`AGENTS.md` and `AGENT-EXECUTION-PIPELINE.md` to locate the places to edit.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7a919a9b-af3d-48b8-bc66-9a70c1decabb

📥 Commits

Reviewing files that changed from the base of the PR and between 1778273 and 863bb9f.

📒 Files selected for processing (9)
  • .coderabbit.yaml
  • .github/CODEOWNERS
  • .github/PULL_REQUEST_TEMPLATE/agent.md
  • .planning/issues/v0.3.0/00-README.md
  • .planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md
  • AGENT-EXECUTION-PIPELINE.md
  • AGENTS.md
  • OPENCLAW-FORGE-PROTOCOL.md
  • STRATEGIC-ROADMAP-2026-05-29.md
✅ Files skipped from review due to trivial changes (4)
  • .coderabbit.yaml
  • .planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md
  • .planning/issues/v0.3.0/00-README.md
  • STRATEGIC-ROADMAP-2026-05-29.md
🚧 Files skipped from review as they are similar to previous changes (3)
  • AGENTS.md
  • .github/PULL_REQUEST_TEMPLATE/agent.md
  • .github/CODEOWNERS

Canonical four-command validation gate now lives only in
AGENT-EXECUTION-PIPELINE.md §5. Issue specs, the PR template, and the
issue template point at it instead of restating it, so a future gate
change touches one file instead of seven.

Also: collapse redundant CODEOWNERS .github/ rules to one (last-match-
wins makes the narrower duplicates no-ops), drop the issue template's
title-check field (the form's title: placeholder already enforces it),
remove the PR template's "What this does NOT touch" section (CODEOWNERS
is the mechanical gate; "Why this triggered human review" is the
disclosure surface), trim pipeline §11 from three dead-pointer
subsections to one paragraph, and replace 00-README's post-hoc
gh issue create loop with a one-paragraph "how this was bootstrapped"
note since #46-#51 already exist.

Net -41 lines across 11 files; no contract change.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@AGENT-EXECUTION-PIPELINE.md`:
- Line 140: The §7 "Why this triggered human review" disclosure is currently
written as always-required; update the AGENT-EXECUTION-PIPELINE.md wording so
that the §7 disclosure is explicitly conditional—e.g., change the statement
under the §7 heading to say "Include this disclosure only if one or more §7
triggers apply (list triggers that applied); otherwise omit"—and ensure any
template or checklist entries that reference "Why this triggered human review"
mirror that conditional language so authors only add it when §7 conditions are
met.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 32cef5a8-bf67-44c5-864e-bb4cb751d678

📥 Commits

Reviewing files that changed from the base of the PR and between 863bb9f and 5949b0d.

📒 Files selected for processing (11)
  • .github/CODEOWNERS
  • .github/ISSUE_TEMPLATE/autonomous-agent.yml
  • .github/PULL_REQUEST_TEMPLATE/agent.md
  • .planning/issues/v0.3.0/00-README.md
  • .planning/issues/v0.3.0/01-zstd-cache-codec.md
  • .planning/issues/v0.3.0/02-readme-glama-six-tool-refresh.md
  • .planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md
  • .planning/issues/v0.3.0/04-adr-006-serialization.md
  • .planning/issues/v0.3.0/05-adr-001-source-adapters.md
  • .planning/issues/v0.3.0/06-cpython-source-sha-pin.md
  • AGENT-EXECUTION-PIPELINE.md
💤 Files with no reviewable changes (1)
  • .github/PULL_REQUEST_TEMPLATE/agent.md
✅ Files skipped from review due to trivial changes (6)
  • .planning/issues/v0.3.0/01-zstd-cache-codec.md
  • .planning/issues/v0.3.0/04-adr-006-serialization.md
  • .planning/issues/v0.3.0/06-cpython-source-sha-pin.md
  • .planning/issues/v0.3.0/03-pyyaml-safe-loader-audit.md
  • .planning/issues/v0.3.0/00-README.md
  • .planning/issues/v0.3.0/02-readme-glama-six-tool-refresh.md
🚧 Files skipped from review as they are similar to previous changes (1)
  • .planning/issues/v0.3.0/05-adr-001-source-adapters.md

- Output (or link to artifact) for the §5 validation gate
- CodeRabbit triage summary when CodeRabbit comments on the PR: blocking, follow-up, false positive, or pending/unavailable
- A short "Why this approach" paragraph if the design wasn't fully prescribed in the issue
- The §7 "Why this triggered human review" disclosure (which doubles as a forbidden-territory near-miss log when applicable; CODEOWNERS is the mechanical enforcement)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Make §7 disclosure explicitly conditional on triggers.

This line reads as always-required, but §7 defines it as trigger-based. Please make the condition explicit to avoid process ambiguity for agent PRs.

Suggested wording
-  - The §7 "Why this triggered human review" disclosure (which doubles as a forbidden-territory near-miss log when applicable; CODEOWNERS is the mechanical enforcement)
+  - If any §7 trigger fired, include the `## Why this triggered human review` disclosure (this can also serve as a forbidden-territory near-miss log; CODEOWNERS is the mechanical enforcement)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@AGENT-EXECUTION-PIPELINE.md` at line 140, The §7 "Why this triggered human
review" disclosure is currently written as always-required; update the
AGENT-EXECUTION-PIPELINE.md wording so that the §7 disclosure is explicitly
conditional—e.g., change the statement under the §7 heading to say "Include this
disclosure only if one or more §7 triggers apply (list triggers that applied);
otherwise omit"—and ensure any template or checklist entries that reference "Why
this triggered human review" mirror that conditional language so authors only
add it when §7 conditions are met.

@ayhammouda ayhammouda removed the 🛑 needs-human-review Agent PR paused at a pipeline §7 trigger; human review required before merge label May 30, 2026
@ayhammouda ayhammouda merged commit 2f502b4 into main May 30, 2026
8 checks passed
@ayhammouda ayhammouda deleted the chore/v0.3.0-agent-pipeline branch May 30, 2026 08:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant