DRAFT: T029, U-9: the composed run, permanent: composed.yml and its openxFactory pin (plan 038)

[brettheap]

Lane: openxfactory-4 (openXfactory-4-openDox_extraction)
Authored by lane openXfactory-3, delegated by lane openxfactory-4 (#656 6015602584)

Arc: neutral-product-standalone-operability

T029 [US3] [oXc] U-9, the composed run, permanent (F12.1)

Plan 038 (openxFactory specs/038-opendox-document-tool-self-maintenance/tasks.md, T029), ruled by Brett Heap with the plan, every item as recommended (openxFactory#656 6013547504).

• Realizes: 12.5, F12.1 (both ticked at T082).
• Falsifier: F12.1 (12.5's falsifier, as batch Q's line words it): 16 suites, 0 red; the oracle's ok: … each entered and holding, quoted.
• Ruled: R2Q8; ARC-Q2 (permanent). Decisions: CF-5, N-7a, N-7b, R-1.
• Ruled since the plan:
  • Brett Heap, "Amend F12.1 with --chains (Recommended)" (#656 6016648451). Batch Q (openxFactory#1248) records it at 12.5's falsifier and says T026 and T029 carry it out.
  • The holder's floors ruling (#656 6017860539) gives T029 validate.yml's two floor lines, at the final head only (see "Not done here").
• After: T020–T026, T028.
  • Landed here: T020 (T020, U-1: the governed host for the governed suites that drive the gate verbs (plan 038, P4F-5) #39), T021 (T021, U-2: the gate console's schemas, each read where its owner keeps it, nothing vendored (plan 038, P4F-4) #40), T022 (T022, U-3: the runbook placed from the composed tree, git-ignored, nothing vendored (plan 038, P4F-3) #41, as aefd1091), T023 (T023, U-4: swb-session.js spells the model's two names at its call sites again (plan 038) #42), T024 (T024, U-5: the H-1 shim, ideation_dashboard.session_git answers with opendox.session_git (plan 038, CF-3) #38) and T026 (T026, U-7: the allow-list for 12.5's governed suites, with R-1 (a)'s span kind (plan 038, H-2) #43).
  • Landed in openDox-code: T025 (#91).
  • Not landed: T028, so this PR stays a DRAFT.

Files (this PR's own commits touch only these two)

• .github/workflows/composed.yml (new; job composed).
• tests/composed_host_pin.yaml (new): schema_version: 1, kind: composed-host-pin, commit: 92010d3e67f2c556687e1c3583ed3ca1867f4b8b, openxFactory main's head when authored (read with git ls-remote at 2026-10-06T11:56:20Z). It advances after T030, T064 and T075, each in an openXdox-code PR of its own.

T029's commits:

• d6f4a814: the two files;
• 541852d6: on a pull request, the oracle judges the PR as the landing it would be (Copilot r4195440016);
• 82d95924: the edited trigger (Copilot r4195546545);
• b4993d10: the oracle call takes --chains (#656 6016648451).

Both files are unchanged since b4993d10. The message of 541852d6 also credits the named empty-set refusal, but that refusal was already in d6f4a814.

Base and merges (never rebased). The branch started at #41's head 8d02a1b3, so that the workflow could call T022's scripts/composed_placements.py before T022 landed. It has since merged:

• T022, U-3: the runbook placed from the composed tree, git-ignored, nothing vendored (plan 038, P4F-3) #41's heads 7a149b70, c22b5df7 and 1f2d6858;
• main fc1115d6, at c56675a. Four files conflicted, all of them T020's and T021's that this branch had carried from their PRs: src/openxdox/gate_console.py, tests/conftest.py, tests/test_gate_console_schema_source.py and tests/test_host_plane.py. Main's side was taken for all four. Main's gate_console.py and schema-source test equal T021, U-2: the gate console's schemas, each read where its owner keeps it, nothing vendored (plan 038, P4F-4) #40's final head, and main's conftest.py and test_host_plane.py carry T026's later edits.
• main da736090, at e225b24, with no conflict.
• main 9720925e, at 9a3b8ed1. T022 had landed as aefd1091 (T022, U-3: the runbook placed from the composed tree, git-ignored, nothing vendored (plan 038, P4F-3) #41, squashed), followed by T097 (T097, display harnesses (B): display.js beside the copied module, S7's role keys and the served words (plan 038) #50) and T096's follow-on (T096 follow-on: the validator-root comment names the openxdox package's contracts/ #56). Two files conflicted (add/add), both T022's, which this branch had carried from T022, U-3: the runbook placed from the composed tree, git-ignored, nothing vendored (plan 038, P4F-3) #41's head 1f2d6858: scripts/composed_placements.py and tests/test_composed_placements.py. Main's side was taken for both, and .gitignore auto-merged to main's.

At the head 9a3b8ed1 the branch differs from main 9720925e only in T029's two files.

What the job does, in order

It runs on pull_request (types opened, synchronize, reopened and edited), on push to main (where N-7b's first green run happens), and on workflow_dispatch. Its permissions are contents: read.

1. Checks this repository out with its whole history (the oracle reads the arc's landings since ARC_BASE e28930bf, plan 034 T003).
2. Builds a fresh venv and runs validate.yml's install command (pip install -e ".[test]"), so openDox arrives at the pin pyproject.toml names. F9.2's pin assertion block, verbatim, holds it there.
3. Reads tests/composed_host_pin.yaml, refusing it by name unless its keys are exactly schema_version (the integer 1), kind (composed-host-pin) and commit (40 lowercase hex), with no key given twice.
4. Checks out opensoft/openxFactory at that commit. It initializes ONLY openDox, openXdox and openXwallet, recursively: without them corpus_adapter_openxfactory refuses at import. openxFactory's fourth submodule, installs/omnigent-install, is private (gh api repos/opensoft/Omnigent-Install --jq .private → true). The run never imports it, and this repository's token cannot read it. openxFactory, openDox(-code/-spec), openXdox(-code/-spec) and openXwallet all read false, so no secret is needed. The three .gitmodules URLs are ssh, so the run rewrites them to https in the checkout's own .git/config. It then asserts the checkout's HEAD equals the pin.
5. Runs T022's scripts/composed_placements.py --openxfactory "$OPENXFACTORY".
6. Computes 12.5's governed set exactly as its falsifier does (git grep -l -e 'open-pr' -e 'open_pr' -e 'FakePullRequests' -- 'tests/test_*.py') and holds it to the floor of 16. It does not type the list. Today it has 16 entries.
7. Runs each governed suite alone, with PYTHONPATH="$OPENXFACTORY/scripts" (R1Q23 (a)'s form). Every suite runs whatever the one before it did. The step prints per-suite counts and every red node id from the JUnit reports, and fails if any suite is red.
8. Runs the oracle in 12.5's call as batch Q amends it, with --chains (#656 6016648451): python scripts/protected_suites.py --chains --landings=… --suites=…. It refuses an empty landing list.
   • On a pull request (Copilot r4195440016), GitHub's merge commit is the landing as it would be: the oracle judges a landing by its diff against its first parent (the base) and by the blobs on either side. So that commit joins the landings wherever the body carries the exact line Arc: neutral-product-standalone-operability, which the lander copies into the landing's message.
   • The step first asserts that HEAD's second parent is the pull request's head.
   • Because the body decides, an edited body runs the job again (Copilot r4195546545).
9. Runs tests/integration/test_assembled_surface.py::test_the_assembled_help_tree_is_the_32_entry_tree_the_manifest_records against its recorded golden (R2Q3 (a)). validate.yml leaves this test out (LEFT_OUT).

Steps 8 and 9 run even when step 7 is red, so one run reports every red.

A choice in step 9, for the holder's eye. The help-tree test builds the tree in a child process given the run's environment less PYTHONPATH (its SCRUBBED_ENVIRONMENT), and the child needs doc_health (cli_gate → gate_console:63). So a PYTHONPATH composition can never reach it. The step therefore writes composed-openxfactory-scripts.pth (naming $OPENXFACTORY/scripts) into the run's own venv, after the governed suites have run in R1Q23 (a)'s form, and nothing runs after it. The test file is unchanged. Red first, measured locally:

• the step with that one line removed: FAILED …test_the_assembled_help_tree_is_the_32_entry_tree_the_manifest_records - AssertionError: at openDox-code@dede32b4…: the assembled command line could not be built. The child ended with: ModuleNotFoundError: No module named 'doc_health', step exit 1;
• the step verbatim: 1 passed, step exit 0. The 32-entry golden is unchanged at the pin.

The falsifier, measured now at 9a3b8ed1 (EXPECTED red until T028 lands)

The falsifier proper (16 suites, 0 red, and the oracle's ok) is quoted once T028 has landed and been merged in.

CI at this head:

• composed run 37808303982 (synchronize), and run 37808329039, started by Sourcery's body edit: red on the suites step ONLY. Every other step, the oracle and the help tree included, is a success.
• validate run 37808304034: success.
• SonarCloud: success.

CI ran on python 3.12.15, pytest 8.4.2 and node v22.23.3. Its pull-request merge commit is 31ce700f, which merges this head into main 9720925e. Quoted from run 37808303982:

openDox installed at the pin: openDox-code@dede32b4b6f3d0f147d599776f83628c5af8ff3d
the composed run's host: opensoft/openxFactory@92010d3e67f2c556687e1c3583ed3ca1867f4b8b
governed suites: 16 (the floor is 16)
tests/test_branch_session.py: 132 passed, 0 failed, 0 errors, 0 skipped
tests/test_doxbench_mutation_boundary.py: 80 passed, 0 failed, 0 errors, 0 skipped
tests/test_doxbench_share.py: 34 passed, 0 failed, 0 errors, 0 skipped
tests/test_gate_loop_views.py: 74 passed, 0 failed, 0 errors, 0 skipped
tests/test_gateway_provenance.py: 24 passed, 0 failed, 0 errors, 0 skipped
tests/test_hosted_actor.py: 5 passed, 0 failed, 0 errors, 0 skipped
tests/test_session_commits.py: 22 passed, 0 failed, 0 errors, 0 skipped
tests/test_session_confinement.py: 53 passed, 0 failed, 0 errors, 0 skipped
tests/test_session_gates.py: 81 passed, 0 failed, 0 errors, 0 skipped
tests/test_session_lifecycle.py: 53 passed, 0 failed, 0 errors, 0 skipped
tests/test_session_notebook.py: 39 passed, 0 failed, 0 errors, 0 skipped
tests/test_session_records.py: 29 passed, 0 failed, 0 errors, 0 skipped
tests/test_session_runbook.py: 11 passed, 0 failed, 0 errors, 0 skipped
tests/test_session_transaction.py: 57 passed, 0 failed, 0 errors, 0 skipped
tests/test_session_verbs.py: 65 passed, 0 failed, 0 errors, 0 skipped
tests/test_staging_workbench.py: 62 passed, 17 failed, 4 errors, 0 skipped
TOTAL over 16 suites: 821 passed, 17 failed, 4 errors, 0 skipped; 21 red, in 21 red nodes
the arc's landings since ARC_BASE: 25
the pull request's body carries the arc's trailer, so its merge commit 31ce700f9d140a1b248685813c707f64a44ec790 is judged as the landing it would be
admitted: c41063d6aaad tests/test_gate_loop_views.py, by entry 1 of tests/protected_suite_respellings.yaml
admitted: 839492d905f4 tests/test_gate_loop_views.py, by entry 2 of tests/protected_suite_respellings.yaml
admitted: 56e1c238681a tests/test_branch_session.py, by entry 18 of tests/protected_suite_respellings.yaml
admitted: 36bbef794c52 tests/test_doxbench_share.py, by entries 31, 32, in that order, of tests/protected_suite_respellings.yaml
admitted: 36bbef794c52 tests/test_session_confinement.py, by entries 28, 29, 30, in that order, of tests/protected_suite_respellings.yaml
admitted: 36bbef794c52 tests/test_session_gates.py, by entries 20, 21, 22, in that order, of tests/protected_suite_respellings.yaml
admitted: 36bbef794c52 tests/test_session_verbs.py, by entries 23, 24, 25, 26, 27, in that order, of tests/protected_suite_respellings.yaml
admitted: 36bbef794c52 tests/test_staging_workbench.py, by entries 33, 34, …, 51, in that order, of tests/protected_suite_respellings.yaml
ok: 8 protected edit(s), each entered and holding
1 passed in 0.43s        (the help tree)

The last admitted: line is shortened to 33, 34, …, 51; the run names all nineteen entries. Each run's log also shows an earlier copy of the oracle's lines inside the step's header: that is this body, echoed through PR_BODY, not output.

Local run 7 agrees. It ran the workflow's own run: blocks verbatim at 9a3b8ed1, through a harness that emulates GITHUB_ENV, GITHUB_PATH, GITHUB_OUTPUT and the if: conditions. It used full clones, LANG=C.UTF-8, TERM=dumb and CI=true, with every GIT_*, XF_* and colour variable unset; python 3.12.3, pytest 8.4.2, node v24.21.0.

• Suites: the same per-suite counts, the same TOTAL, and the same 21 red node ids as both CI runs (the sorted lists are equal).
• Oracle: run 7 is a workflow_dispatch at the branch head, where its oracle reads the branch's own first parents (9 landings, ok: 3). The pull-request reading was mirrored locally instead: GitHub's merge of this head into main 9720925e, run through the oracle step's own text as pull_request with the live body. It read 25 landings, judged the merge commit, and read the same eight admitted: lines and ok: 8, as CI did.

The 21 reds are T028's to clear. All 21 are in tests/test_staging_workbench.py, and all of them read openDox's bundle as installed (opendox_bundle.composed()), which is still at the pin dede32b4 (pyproject.toml).

• 18 (14 failed, 4 errors) are the node harness's ERR_MODULE_NOT_FOUND … display.js. At dede32b4 the staging model opens with import { SCOPE_KINDS, … neutralDisplay } from "./display.js";, which the harness's standalone copy cannot resolve.
• 3 are text asserts on the same bundle:
  • test_staging_workbench_view_has_no_write_path: POST is found inside the view's "EDITING POSTURE" comment;
  • test_the_session_surface_added_no_transport_to_the_view_or_the_model: the model's import line;
  • test_only_the_plane_postures_still_stand_as_an_inline_note: showPostureNote( occurs 5 times where 3 are expected.

All 21 are T025's W-1 (A), the import-free staging model, together with its T102 posture rewording. That work has landed in openDox-code (#91, 84f8ed83), but it reaches this repository only when T028 moves pyproject.toml's opendox pin. Read against T025's landed bundle at 84f8ed83:

• the model is import-free;
• the view names no POST, fetch( or XMLHttpRequest;
• showPostureNote( occurs 3 times, the definition and the stands line both present;
• the model holds chat: true, 3 times.

At dede32b4, three of those fail: the model imports, the view's text contains POST, and showPostureNote( occurs 5 times.

--chains is load-bearing on main today. T026 landed as ONE PR (36bbef79) whose entries chain by blob, and with --chains the oracle admits it on five suites (above). Re-run in the local mirror of this head's merge with main 9720925e, the same oracle step without --chains exits 1 with refused: 36bbef794c52 … on the same five: test_doxbench_share.py (entry 31), test_session_confinement.py (28), test_session_gates.py (20), test_session_verbs.py (23) and test_staging_workbench.py (33). With --chains it exits 0 with ok: 8.

Before T020–T026 landed (heads d6f4a814 to b4993d10), the same runs read 82 red, again equal between CI and local node for node. By owner: T023 2, T024 4, T025 34, T026 42. T023, T024 and T026 have since landed here, and T025 in openDox-code; the 82 fell to these 21.

The known pre-existing composed red is tests/test_dependency_direction.py::test_first_attribute_access_refuses_and_names_the_layering. It is outside the 16: that file names none of open-pr, open_pr or FakePullRequests, so the governed set never selects it, and this workflow does not run it.

Guards, red first, and mutants

Each guard was run on bad input through the workflow's own step text, then against a one-line code mutant that disables it. All 23 mutants are KILLED: 17 on the guards (31 cases) and 6 on the pull-request path (8 cases). The workflow text has been unchanged since b4993d10, where these last ran.

• The pin reader (13 cases): kind wrong; schema_version 2, '1' and true; commit short, uppercase, or carrying a newline (an output-injection attempt); an extra key; commit missing; commit given twice; a list; not YAML. Each is refused by name, and the real file passes. Killed: the kind check; the schema_version check; its type check; the commit-shape check; fullmatch→search; exact key set → subset; the duplicate-key loader; the mapping check.

• HEAD == pin: another commit is refused. Killed: the check's exit removed.

• The governed floor: 15 and 0 suites are refused by name. Killed: floor 16→15, and the floor's exit removed.

• A red suite fails the step, in five shapes: a red suite before or after a green one, a collection error, and pytest dying with no report. Killed: the red flag never set; exit 0; the rc not captured.

• The oracle's non-empty landings: ARC_BASE=HEAD is refused. Killed: the exit removed.

• F9.2's pin assertion: another full commit, a short pin and two opendox pins are each refused. Killed: each of its two asserts removed.

• The pull request judged as its landing (8 cases on simulated GitHub merge commits):

  • a weakening edit with no entry is refused;
  • the same edit entered is admitted;
  • two edits to one suite in two blob-chained entries are admitted;
  • a body without the line, an indented line, a push, and a PR touching no governed suite all pass;
  • a HEAD that is not the merge commit is refused.

  Killed: the merge commit never added; every body counted; substring instead of line; the HEAD check's exit removed; the pull_request branch never taken; --chains dropped.

actionlint 1.7.12, with shellcheck, reports nothing on the workflow.

Copilot

• Round 1, at d6f4a814.
  • r4195440016 (High): fix-now in 541852d6.
  • r4195440096: an accepted limit on T022's file; the holder ruled (a), and T022, U-3: the runbook placed from the composed tree, git-ignored, nothing vendored (plan 038, P4F-3) #41 added tests/test_composed_placements.py.
• Round 2, at 570efda2. r4195546545: fix-now in 82d95924.
• Rounds 3 and 4, at 82d95924 and b4993d10. Findings: None.
• Round 5, at b43ebb84. r4201894346 (a tracked-symlink source) was an accepted limit on T022's file. T022, U-3: the runbook placed from the composed tree, git-ignored, nothing vendored (plan 038, P4F-3) #41's 74f3a4f refuses it, and T022's landing (aefd1091) carries it to main and this head.
• Round 6, at a6403f51 (review 5440620961; "Changes recommended", 1 finding). r4205508998 (a symlinked parent directory) was an accepted limit on T022's file. T022, U-3: the runbook placed from the composed tree, git-ignored, nothing vendored (plan 038, P4F-3) #41's 2c86dcc refuses it, with test_a_runbook_reached_through_a_linked_directory_is_refused, and T022's landing (aefd1091) carries it to main and this head.
• Round 7, at 9a3b8ed1 (this head, review 5459770759). 0 open findings, and it lists r4205508998 as resolved since the last review.
• For the holder's gate: round 7's "Changes recommended" carries no finding. Its one line reads the old body: "The draft’s composed suite remains red pending T022 and T028 landing and integration." T022 has since landed, and the red is T028's (above).
• Threads: 5, each answered and resolved; 0 unresolved.

Not done here, and whose it is

• The falsifier proper (0 red, oracle ok) waits for T028, the last of the After set. main is merged in once T028 has landed, and the quote follows. Until then composed is red on the suites step only, on T028's 21.
• validate.yml's MIN_SELECTED and MIN_PASSED floors. Per the holder's ruling (#656 6017860539), T029's Files gain those two lines only, and T029 raises them ONCE. That happens at DRAFT: T029, U-9: the composed run, permanent: composed.yml and its openxFactory pin (plan 038) #44's final head, after main is merged in, and only once the After set has landed and been merged in. The counts are measured at that head, and the CI-form run is quoted. Trigger: the coordinator's message once T028 has landed (T022 already has). Nothing in validate.yml changes before then.
• Making composed a REQUIRED check is the holder's act after the first green run on main (N-7b (a)), recorded in T029's evidence. This PR changes no repository setting, secret or ruleset.
• Pin advances (T030, T064, T075) and T073's composed declarations are separate PRs.
• Inferred, not run: the two created files may need created: admissions in openxFactory's docs/opendox-carve-admissions.yaml at the pin bump (T030).
• A note for the holder: each Sourcery body edit also runs composed, through edited.

🤖 Generated with Claude Code

[sourcery-ai]

Reviewer's Guide

This draft establishes the permanent composed validation path: it pins and composes openxFactory with openDox, safely links carved documents, runs and diagnoses the governed suite set plus oracle/help-tree checks, and updates schema and host-registration plumbing so tests execute against the correct owner-provided contracts and host facets. The workflow is intentionally expected to remain red until the dependent T020–T026 and T028 changes land.

Flow diagram for the permanent composed validation run

flowchart TD
    Checkout[Checkout openXdox-code with full history] --> Install[Create venv and install pinned openDox]
    Install --> Pin[Validate composed_host_pin.yaml]
    Pin --> Host[Checkout pinned openxFactory and selected submodules]
    Host --> Place[Run composed_placements.py]
    Place --> Governed[Compute governed suites and enforce floor of 16]
    Governed --> Suites[Run each governed suite with openxFactory scripts]
    Suites --> Oracle[Run protected_suites.py oracle]
    Oracle --> Help[Run assembled help-tree golden test]
    Suites --> Help

Loading

File-Level Changes

Change	Details	Files
Adds a permanent composed CI workflow that validates openDox against a pinned openxFactory checkout and runs the governed integration surface.	Creates a full-history, Python 3.12 workflow triggered on pull requests, main pushes, and manual dispatch. Installs openDox from its declared commit pin and strictly validates the host pin YAML. Checks out the pinned openxFactory revision with only the required public submodules, rewrites SSH URLs locally, and verifies HEAD. Places the pinned session runbook into the composed tree, computes the governed suite set with a 16-suite floor, runs each suite independently, reports JUnit failures, and executes the protection oracle and assembled help-tree check. Keeps the oracle and help-tree diagnostics available after governed-suite failures, while gating the oracle on successful suite collection/execution. Adds workflow-level permissions, timeout, environment propagation, and virtualenv path setup. Files: .github/workflows/composed.yml, tests/composed_host_pin.yaml, .gitignore	.github/workflows/composed.yml tests/composed_host_pin.yaml .gitignore
Introduces guarded placement of carved documents from the pinned openDox-spec checkout into the composed test tree.	Adds a placement manifest currently containing the session runbook link. Verifies the openDox root's spec gitlink, checked-out spec HEAD, tracked and clean source, ignored destination, and safe existing-link state before making changes. Implements all-or-nothing placement and conservative removal of only links created by the script. Adds the destination to .gitignore so composed artifacts cannot be committed. Files: scripts/composed_placements.py, .gitignore	scripts/composed_placements.py .gitignore
Moves contract-schema resolution from checkout-relative files to owner-controlled packaged or host-registered sources.	Validates packaged gate-action schemas through contracts.verified_bytes() and host demotion schemas through an explicit registration API. Enforces one active host schema source, supports idempotent registration and explicit unregistering, and rejects missing schema files. Validates schema parsing, JSON Schema validity, and application failures as named GateRefused errors. Registers openxFactory's schema directory during composed test setup while leaving lone-checkout behavior explicitly refusing host-owned receipt validation. Files: src/openxdox/gate_console.py, tests/conftest.py, tests/test_gate_console_schema_source.py	src/openxdox/gate_console.py tests/conftest.py tests/test_gate_console_schema_source.py
Adds governed-host selection and isolation for suites that exercise openXdox gate verbs.	Derives the governed suite set using the same markers and floor as the composed workflow, then verifies the explicit governed-host suite list matches gate-verb usage. Registers either openxFactory's composite host in composed runs or a local stand-in carrying openXdox's command, gate-route, and projection columns. Builds host facets only after importing this checkout's openXdox modules, restores sys.path, and rejects modules loaded from another openXdox checkout. Preserves prior host registrations around each test and retains stand-in behavior for non-governed host-plane suites. Adds tests for list coverage, host precedence, column composition, path isolation, and missing/failed openxFactory host imports. Files: tests/conftest.py, tests/test_host_plane.py	tests/conftest.py tests/test_host_plane.py

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[Copilot]

Copilot review overview

🟡 Changes recommended

The PR oracle skips current pull-request commits, and the placement script lacks persistent automated coverage.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Check PR head history instead of temporary merge commit · New
• Add automated tests for placement API safety and idempotence · New

What changed in this PR

Establishes permanent composed validation against pinned openxFactory, including stacked host, schema, and document-placement prerequisites.

Changes:

• Adds governed-host and contract-schema integration.
• Adds safe runbook placement from the composed tree.
• Adds pinned composed CI with governed suites, oracle, and help-tree checks.

File	Description
.github/​workflows/​composed.yml	Defines composed CI validation.
.gitignore	Ignores the placed runbook.
scripts/​composed_placements.py	Safely places composed-tree documents.
src/​openxdox/​gate_console.py	Resolves schemas from their owners.
tests/​composed_host_pin.yaml	Pins the openxFactory host.
tests/​conftest.py	Registers governed hosts and schemas.
tests/​test_gate_console_schema_source.py	Tests schema-source behavior.
tests/​test_host_plane.py	Tests governed-host selection.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

PR-body edits do not rerun the workflow, allowing the oracle result to become stale.

Review effort: Balanced
Findings: 1

Open (1)

• PR body edits do not retrigger oracle validation · New

Resolved since last review (2)

• Check PR head history instead of temporary merge commit
• Add automated tests for placement API safety and idempotence

[Copilot]

Copilot review overview

🔵 Needs a closer look

It remains a draft with cross-repository sequencing dependencies and an intentionally failing composed check.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• PR body edits do not retrigger oracle validation

[Copilot]

Copilot review overview

🔵 Needs a closer look

It remains draft, cross-repository, sequencing-dependent, and intentionally has a failing composed check.

Review effort: Balanced
Findings: None

[Copilot]

Copilot review overview

🟡 Changes recommended

The placement guard accepts tracked symlinks whose target contents are not pinned.

Review effort: Balanced
Findings: 1

Open (1)

• Reject tracked symlinks when validating pinned suite files · New

[Copilot]

Copilot review overview

🟡 Changes recommended

Source validation can still accept symlink-mediated content that is not securely bound to the pinned document.

Review effort: Balanced
Findings: 1

Open (1)

• Reject symlinked parent directories in source path · New

Resolved since last review (1)

• Reject tracked symlinks when validating pinned suite files

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🟡 Changes recommended

The draft’s composed suite remains red pending T022 and T028 landing and integration.

0 open findings

1 resolved since last review

• Reject symlinked parent directories in source path

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[brettheap]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T19:42:52.673884Z	9a3b8ed	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 9a3b8ed113

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".