[PR] feat(vetted-ops): make the tracker repo optional so upstream-only policies load [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1245:
URL: https://github.com/apache/magpie/pull/1245

   ## Summary
   
   - **Magpie's own vetted-ops policy does not load, so every operation #1232 added is unreachable.** `config.load()` required `[repos] tracker` unconditionally:
   
     ```text
     vetted-op: config error: 'tracker' must be an 'owner/name' string, got None
     ```
   
     The committed policy names no tracker — the value is private, is not derivable from this repository, and guessing it would risk pointing tracker operations at a public repo. So the ten read-only operations `pr-management-code-review` needs, and the caller entry granting them, have been dead since they merged.
   - **`tracker` is now optional.** Operations that address it fail closed by name, in the builder, before any argv exists.
   - This was the single `[high]` finding from the adversarial review of #1232, and its own recommended alternative to supplying the value.
   
   ## Type of change
   
   - [ ] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
   - [ ] Tool / bridge contract (`tools/<system>/*.md`)
   - [x] Python package (`tools/*/` with `pyproject.toml`)
   - [ ] Groovy reference impl
   - [x] Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM) — the vetted command surface
   - [x] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`) — the tool README
   - [ ] Project template (`projects/_template/`)
   - [ ] CI / dev loop (`prek`, workflows, validators)
   - [ ] Other:
   
   ## Test plan
   
   - [ ] `prek run --all-files` passes
   - [x] For Python packages touched: `uv run pytest` / `ruff check` / `mypy` pass — 62 tests, 6 new.
   - [ ] For Groovy bridges touched: command-line invocation tested end-to-end
   - [ ] For skill changes: eval suite passes for the affected skill
   - [ ] For skill *behaviour* changes: a new or updated eval fixture is included in this PR
   - [x] Other:
     - Verified against the **real committed policy**, not just fixtures. `viewer`, `pr-review-context`, `pr-diff` and `gql-pr-review-threads` now dry-run correctly against `apache/magpie`; before this change every one of them died at load.
     - `prek run --files` clean over every touched path; the commit hook ran the full workspace pytest.
   
   ## RFC-AI-0004 compliance
   
   - [ ] **HITL** — any new mutation is gated on explicit user confirmation
   - [x] **Sandbox** — no new host access.
   - [ ] **Vendor neutrality** — placeholders used in all skill / tool prose
   - [ ] **Conversational + correctable** — agentic-override path documented if behaviour is adopter-tunable
   - [x] **Write-access discipline** — a tracker operation without a tracker is refused, never retargeted.
   - [x] **Privacy LLM** — the refusal is what keeps embargoed tracker content away from a public repository.
   
   ## Linked issues
   
   Fixes the `[high]` finding raised against #1232.
   
   ## Notes for reviewers
   
   - **Why the refusal lives in the builder, not at load.** A refusal is not the dangerous outcome; a tracker operation silently retargeted at `upstream` is, because it would publish embargoed content to a public repository. `_tracker()` raises before an argv exists, so there is no path on which such a command can be constructed at all.
   - **The guard is derived, not enumerated.** `test_every_tracker_operation_refuses_rather_than_retargeting` builds every operation twice — once with a tracker configured, once without — and asserts that any operation whose argv named the tracker in the first case raises in the second. A hand-kept list of "tracker operations" would rot the moment someone adds one. It also asserts the guard matched more than a handful of operations, because a check that matches nothing passes silently and proves nothing.
   - **Absent is not the same as wrong.** A missing `tracker` is fine; a malformed one is still a load error. Silently ignoring a typo'd repo would point operations somewhere unintended, which is precisely what this dispatcher exists to prevent.
   - **This does not enable tracker operations for Magpie.** Nothing in the committed policy grants one, and the security family still needs a real `tracker` value before it can be used here. What changes is that the read-only PR surface no longer waits on that value.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(vetted-ops): make the tracker repo optional so upstream-only policies load [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1245:
URL: https://github.com/apache/magpie/pull/1245


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org