[PR] fix(pr-triage): check every --add-label value in the mark-ready guard [magpie]

["dpol1 (via GitHub)" <gi...@apache.org>]

dpol1 opened a new pull request, #1525:
URL: https://github.com/apache/magpie/pull/1525

   ## Summary
   
   - The `pr-management-triage` mark-ready guard (Golden rule 1b) read only the first `--add-label` value.
     A second `--add-label`, a comma-separated list, or a CSV-quoted entry added `ready for maintainer review` without the check for GitHub Actions runs awaiting approval.
     The guard now checks every label gh would add:
     every `--add-label` value (space and `=` forms), split on commas, with CSV double quotes dropped, trimmed and case-insensitive.
   - New `GuardContext.opts(short, long)` returns every value of a repeated flag, documented next to `opt()` in the agent-guard README.
     A token taken as a value is still scanned as a flag, so `--body --add-label --add-label X` (gh reads the first `--add-label` as the body) still yields `X`.
     `opt()` now returns the first of these values, with unchanged results.
   - Second commit: `command_kinds()` tagged a `gh` segment with `argv[1]`, so `gh -R o/r pr edit` was `gh:-R` and a contributed guard with `TRIGGERS = ["gh:pr"]` never ran for it.
     It now resolves the group with `gh_subcommand()`, as the `git` branch already does with `git_subcommand_index()`; when no group resolves it falls back to `argv[1]` as before.
     No shipped guard triggers on `gh:<group>` today.
   
   ## Type of change
   
   - [ ] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
   - [ ] Tool / bridge contract (`tools/<system>/*.md`)
   - [x] Python package (`tools/*/` with `pyproject.toml`)
   - [ ] Groovy reference impl
   - [ ] Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
   - [ ] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
   - [ ] Project template (`projects/_template/`)
   - [ ] CI / dev loop (`prek`, workflows, validators)
   - [x] Other: skill-owned guard code (`plugins/magpie-pr-management/skills/pr-triage/guards/mark_ready.py`); no `SKILL.md` or prompt material changed
   
   ## Test plan
   
   - [x] `prek run --all-files` passes
   - [x] For Python packages touched: `uv run pytest` / `ruff check` / `mypy` passes — `tools/agent-guard`: 191 passed (6 new), `ruff check` and `ruff format --check` clean, `mypy src` clean
   - [ ] For Groovy bridges touched: command-line invocation tested end-to-end
   - [ ] For skill changes: eval suite passes for the affected skill — not applicable: the `pr-management-triage` evals cover the model's decision table, not the guard; the guard is covered by the agent-guard pytest suite
   - [ ] For skill *behaviour* changes: a new or updated eval fixture is included in this PR
   - [x] Other: tests go through `agent_guard.dispatch()` with the existing fake-`gh` helpers.
         `test_mark_ready_pending_denied_for_every_add_label_form` covers five forms: repeated flag, comma-separated, `=` form, CSV-quoted, flag-as-value.
         Each case failed before the fix.
         `test_gh_group_trigger_fires_past_a_global_flag` failed before the `command_kinds` change.
         The existing single-label deny, clean allow, other-label allow, and override tests still pass.
   
   ## RFC-AI-0004 compliance
   
   No new mutation, host access, outbound message, or LLM hop.
   The change makes an existing deterministic guard deny the label in every form gh accepts.
   
   ## Linked issues
   
   Closes #1493
   
   ## Notes for reviewers (optional)
   
   - `opts()` collects more values than gh would when a flag's value looks like the flag itself.
     For a deny guard that only means more checks, never fewer.
   - Not changed: `_opt_value` / `_opt_values` treat an empty `short` name as matching an empty token or a token starting with `=`.
     That predates this change and can only over-match.
   - `tools/spec-loop/specs/agent-isolation-sandbox.md` does not describe `ctx.opt()` or the mark-ready guard, so no spec states the old behaviour.
     `tools/spec-loop/.last-sync` is behind `main` independently of this change.
   
   `isolated_fingerprint.py` changes in both commits: the `isolated-setup-fingerprint` hook regenerates it because the secure-setup fingerprint covers agent-guard's sources.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(pr-triage): check every --add-label value in the mark-ready guard [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1525:
URL: https://github.com/apache/magpie/pull/1525


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org