[deanbot]

What changed and why

#151 limited a PR thread to trusted authors. The issue a PR closes was still read unfiltered: the executor's claim step printed the issue body before the author check ran, and every role read the issue with gh issue view --comments. So anyone who could comment on the issue could add "also delete the tests", and it read as the operator's direction.

• scripts/pr-thread.mjs --repo owner/repo --issue <n> (alongside --pr) prints:

  • one ISSUE block: id:, author:, trusted: yes|no (the same trusted-authors / allow-author-associations rule), state:, labels:, at:, then title: and the indented body only when the author is trusted;
  • then the trusted comments as COMMENT blocks;
  • then UNTRUSTED <count>.

  A deleted author (null user) is (unknown) and untrusted. A PR's number, an unreadable block, a missing issue or a failed gh call exits 2 with nothing on stdout, and the block is read before the issue. Giving both --pr and --issue, or neither, exits 1 with no gh call.

• Executor (all three adapters). The claim re-fetch is pr-thread.mjs --issue, and the author check is its trusted: line. No outsider text reaches the model before the decision, and the model no longer compares logins. Exit 2 means no author check and never a claim. Resume and implement read the issue through the script too.

• Reviewer and QA (all three adapters). They read the linked issue through the script. An untrusted author's issue states no criteria: criteria come only from trusted comments on the issue or on the PR. With none, the reviewer posts one [reviewer] Question: and QA posts BLOCKED, each asking the operator to state the criteria on the PR. Both waiters read the PR's comments, not the issue's, so a comment on the issue would wake neither.

• The claim race is claims.mjs --race <your claim's id> (all three executors). It prints RACE_WON, RACE_LOST, RACE_UNTRUSTED <login> or RACE_UNKNOWN, decided on ids, times and trust by the same rule, and never a comment's text. The race used to be a raw gh api listing that printed every [executor] Claimed by comment's full body, an outsider's included, so anyone could put text in front of the executor at claim time. No executor lists claim comments itself any more. On RACE_UNKNOWN or a failed run, the executor never labels.

• Every text carries the same The issue rule: never gh issue view or a raw gh api read of the issue or its comments, never fetch what UNTRUSTED counts, and exit 2 means act on nothing from the issue.

• SPEC, AGENTS.md (script list) and the Claude Code README's known limits are updated.

• The test fake gh's issues/N route now passes through user, author_association, title, body, created_at and pull_request from the fixture.

Done, and the checks that show it

All in scripts/test/run.mjs, in the "trusted issue (#153)" section unless named.

• The script prints the issue's body and only trusted comments, then UNTRUSTED <count>, and exits 2 on an unreadable block.

  • A mixed thread gives the exact expected output, with block-like body lines (ISSUE, UNTRUSTED 0) indented and no outsider text or login.
  • Only outsiders commenting gives UNTRUSTED 1.
  • trusted-authors decides.
  • An unreadable block gives exit 2 with no /issues/ call in the gh log.
  • Also covered: a failed gh call, a 404, a PR's number, bad arguments, and #9.

• Every executor, reviewer and QA text reads the issue only through the script. Text tests check that every role carries the rule and that no adapter text has gh issue view or a raw gh api read of an issue or its comments. The only exceptions are the claim-race listing (Claims: only a trusted author's claim comment counts #134) and writes (-X POST, -X DELETE). The "author check" section checks that every executor re-fetches through the script, treats exit 2 as no author check, skips trusted: no with one comment, and never hands the issue to the operator.

• The issue body counts only for a trusted author. An untrusted author gives trusted: no with no title or body anywhere in the output, as does a deleted author even with OWNER association. A text test checks that every reviewer and QA text takes no criteria from such an issue.

• Tests. The issue asked for a mixed thread, only outsiders, an untrusted author and an unreadable block; all four are above.

• The claim race prints no comment text (section "claims.mjs"):

  • an outsider's lower, multi-line [executor] Claimed by x claim is ignored and none of its text is printed;
  • also covered: the 10-minute window, a later claim, an untrusted own claim (RACE_UNTRUSTED <login>), an unknown id, trusted-authors, an unreadable block (exit 2) and bad arguments.

  Text tests check that every executor runs --race, labels only on RACE_WON, and lists no claim comments. The issue comments: only a trusted author's comment on the issue counts as direction #153 raw-read test no longer exempts the old listing.

Mutation-checked, each caught by the tests above:

• the race counting untrusted claims or ignoring the window;
• printing the title and body for an untrusted author;
• dropping the comment filter;
• reading the issue before the block.

Calls a reviewer might push back on

• Skip, not hand-off (the issue's open question). An untrusted author's issue keeps Executor: the pre-claim re-fetch asks gh issue view for authorAssociation, which it doesn't have #81's single [executor] Skipped: comment and is never claimed. Handing it to the operator would let anyone fill the operator's queue just by filing issues. An outsider's issue the operator wants worked is re-filed (or its content carried into a new issue) by a trusted author. A milestone or label a maintainer adds doesn't make its body direction: the text is still the outsider's (SPEC says so too).
• The reviewer and QA ask for criteria on the PR, not the issue, because their waiters wake on the PR's comments. A trusted comment already on the issue still counts.
• pick-next.mjs is unchanged. It reads issue bodies for Depends on inside the script and prints only a number, so no text reaches the model. An outsider's issue costs one pick, which the author check then skips. An outsider can't add an issue to a milestone, so the WAIT-on-a-milestone path is unaffected.
• The untrusted author's login is printed (author: mallory). The Skipped: comment names it, and a GitHub login is validated to its own character set.

Known limits

• The --issue output gives labels and state but not the milestone. No role reads the milestone from the issue.

Restart note

All three roles (executor, reviewer, QA) need a fresh session: their texts changed. Setup doesn't need re-running, because the existing scripts/* allow rule covers the new call.

Closes #153