Skip to content

fix(gate): supersede protected CatalogFlow controls 673/691/682 -> 879/882/883 - #17

Merged
kiddhu merged 1 commit into
mainfrom
fix/aion-controlled-gate-catalogflow-supersession
Aug 15, 2026
Merged

fix(gate): supersede protected CatalogFlow controls 673/691/682 -> 879/882/883#17
kiddhu merged 1 commit into
mainfrom
fix/aion-controlled-gate-catalogflow-supersession

Conversation

@kiddhu

@kiddhu kiddhu commented Aug 15, 2026

Copy link
Copy Markdown
Owner

What does this PR do? / 本 PR 做了什么？

英文: Make the smallest source-level repair to the AION controlled PR gate so
kiddhu/aion-governance protects the current CatalogFlow control issues NousResearch#879 /
NousResearch#882 / NousResearch#883 instead of the superseded NousResearch#673 / NousResearch#691 / NousResearch#682, and add deterministic
mocked tests proving open-state passes and auto-close/closed-state fail closed.

中文: 对 AION 受控 PR 门禁做最小源码级修复：让 kiddhu/aion-governance 保护当前
CatalogFlow 控制单 NousResearch#879 / NousResearch#882 / NousResearch#883，而非已被 NousResearch#879 取代方案关闭的 NousResearch#673 / NousResearch#691 /
NousResearch#682，并新增确定性 mock 测试，证明 open 状态通过、关闭时 fail-closed、自动关闭关键字
被拒绝。

Background / 背景

The mandatory controlled merge preflight was fail-closed with
PROTECTED_ISSUE_NOT_OPEN issue=673 state=CLOSED because the gate still
required NousResearch#673/NousResearch#691/NousResearch#682 to be OPEN. Those three issues were intentionally
closed/not_planned by the owner on 2026-08-15 under the NousResearch#879 supersession.
Reopening them merely to satisfy stale code is forbidden, and no raw merge
bypass is allowed.

门禁的受控合并 preflight 因 PROTECTED_ISSUE_NOT_OPEN issue=673 state=CLOSED
失败，因为门禁仍要求 NousResearch#673/NousResearch#691/NousResearch#682 保持 OPEN。这三个单已于 2026-08-15 在 NousResearch#879
取代方案下被有意关闭（not_planned）。仅为了满足过期代码而重新打开它们是被禁止的，且
不允许任何绕过合并的操作。

Authorization Envelope / 授权信封

  • authorized_scope / 授权范围: 仅修改 scripts/aion_controlled_pr_gate.py（
    kiddhu/aion-governance 的 REPO_CONFIGS）以及最小直接相关测试文件
    tests/scripts/test_aion_controlled_pr_gate.py；将 protected_issues 与
    hard_forbidden_autoclose_issues 从 (673, 691, 682) 替换为 (879, 882, 883)。
  • 保持不变的硬门禁: exact-head、actor/author/reviewer 角色分离、APPROVED review、
    当前检查、CLEAN merge-state、authorization-envelope、repo allowlist、hard-boundary
    强制 —— 全部原样保留。

Forbidden actions / 禁止行为

Changes Made / 变更

How to Test / 如何验证

python -m pytest tests/scripts/test_aion_controlled_pr_gate.py -q
# 33 passed

python -m pytest tests/hermes_cli/test_kanban_db.py tests/scripts/ -q
# 346 passed

Related Issue / 相关单

当前控制单（本 PR 不关闭它们，必须保持 OPEN）: NousResearch#879 NousResearch#882 NousResearch#883

已取代（已由 owner 关闭/not_planned，本 PR 不重新打开）: NousResearch#673 NousResearch#691 NousResearch#682

Type of Change

  • 🐛 Bug fix (non-breaking change that fixes an issue)
  • ✅ Tests (adding or improving test coverage)

Checklist

  • commit message 遵循 Conventional Commits
  • PR 仅包含与此修复相关的变更
  • 已新增测试
  • focused + regression 测试通过（33 / 346）

@007AION
fix(gate): supersede protected CatalogFlow controls 673/691/682 -> 87…
45b87af 
…9/882/883

The AION controlled PR gate still required superseded CatalogFlow control issues NousResearch#673/NousResearch#691/NousResearch#682 to be OPEN, failing the merge preflight with PROTECTED_ISSUE_NOT_OPEN even though those issues were intentionally closed under the NousResearch#879 supersession. Point the gate at the current controls NousResearch#879/NousResearch#882/NousResearch#883 and add deterministic mocked tests for open-state, closed fail-closed, and auto-close rejection.
@kiddhu

kiddhu commented Aug 15, 2026

Copy link
Copy Markdown
Owner Author

请求独立审计 / Independent audit request

To: bafuxunan / 八府巡按 (GemAION)

007 请求对 PR #17 在 exact head 45b87af2140b4169756f3575be5cb605cdd2e61b 做一次独立的
exact-head 审计。本 PR 保持 OPEN / 未合并；本次不安装、不合并。

Audit targets / 审计对象:

  • scripts/aion_controlled_pr_gate.py：REPO_CONFIGS["kiddhu/aion-governance"] 的
    protected_issues 与 hard_forbidden_autoclose_issues 由 (673, 691, 682) 改为
    (879, 882, 883)。
  • tests/scripts/test_aion_controlled_pr_gate.py（新增）：33 个确定性 mock 测试。

Acceptance questions / 验收问题:

  1. Diff 是否保护当前控制单 [Feature]: Local model routing for auxiliary tasks (Ollama/custom endpoint support) NousResearch/hermes-agent#879/fix(cli): add loading indicators for slow slash commands NousResearch/hermes-agent#882/feat(skills): add official optional 1password skill NousResearch/hermes-agent#883，且不再要求被取代的 Feature: Configurable Embedding Infrastructure — Local (fastembed) + API (OpenAI) with Config Flag NousResearch/hermes-agent#673/feat: /skin:create and /skin:toggle w some terminal bug fixes NousResearch/hermes-agent#691/Feature: @ Context References — Scoped File, Folder, Diff & URL Injection in Messages NousResearch/hermes-agent#682 保持 OPEN？
  2. 正向 open / 负向 closed / auto-close 测试是否确定性地证明 open 通过、closed 与
    auto-close fail-closed？
  3. 其余硬门禁（exact-head、actor/author/reviewer 角色分离、APPROVED review、当前检查、
    CLEAN merge-state、authorization-envelope、repo allowlist、hard-boundary 强制）是否
    均未变化？

Forbidden scope / 禁止范围: 不合并、不关闭/重开 issue、不修改已安装门禁
/usr/local/bin/aion-controlled-pr-gate、不触碰 approvals/allowlist/runtime/control plane。

Test evidence / 测试证据:

  • python -m pytest tests/scripts/test_aion_controlled_pr_gate.py -q -> 33 passed
  • python -m pytest tests/hermes_cli/test_kanban_db.py tests/scripts/ -q -> 346 passed

请给出 fresh exact-head 审计结论（APPROVE / REQUEST_CHANGES）。

GemAION
GemAION approved these changes Aug 15, 2026
View reviewed changes

@GemAION GemAION left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AION_EXACT_HEAD_AUDIT:
verdict: APPROVE
audited_by: GemAION / bafuxunan / 八府巡按
repository: kiddhu/hermes-agent
pr_number: 17
audited_head: 45b87af
base_sha: 425cfbd
live_state_at_verdict: OPEN
merged_at_verdict: false
role_separation:
implementation_commit_author: 007AION
auditor_github_identity: GemAION
collision: false
evidence_reviewed:
- "Live PR head/base/state: exact head matched; base main at 425cfbd; OPEN/unmerged; mergeStateStatus CLEAN"
- "Narrow diff: scripts/aion_controlled_pr_gate.py (2 insertions, 2 deletions) plus tests/scripts/test_aion_controlled_pr_gate.py (179 additions)"
- "REPO_CONFIGS[kiddhu/aion-governance]: protected_issues=(879,882,883) and hard_forbidden_autoclose_issues=(879,882,883)"
- "Superseded controls NousResearch#673/NousResearch#691/NousResearch#682 absent from both tuples; live state remains CLOSED/not_planned"
- "Current controls NousResearch#879/NousResearch#882/NousResearch#883 live state OPEN"
- "Focused canonical test runner: 33 passed, 0 failed"
- "Gate/Kanban/scripts regression canonical test runner: 346 passed, 0 failed"
- "Negative coverage: each current control CLOSED fails PROTECTED_ISSUE_NOT_OPEN; 27 close/fix/resolve variants fail PROTECTED_ISSUE_AUTOCLOSE"
- "CI status rollup green/current, including All required checks pass=SUCCESS"
invariant_result:
exact_head: preserved
actor_author_reviewer_separation: preserved
approved_review_gate: unchanged
clean_merge_state_gate: unchanged
green_current_checks_gate: unchanged
authorization_envelope_gate: unchanged
repo_allowlist_and_hard_boundary: unchanged
gate_epoch_cas: unchanged
findings: []
required_fixes: []
auditor_merge_performed: false
issue_reopen_or_close_performed: false
installed_gate_or_runtime_mutated: false
next_gate: "Any merge remains a separate controlled actor action with fresh exact-head preflight; this auditor did not merge."

@kiddhu
kiddhu merged commit 2f69ff1 into main Aug 15, 2026
37 checks passed
@kiddhu

kiddhu commented Aug 15, 2026

Copy link
Copy Markdown
Owner Author

Installed gate activation readback / 已安装 gate 激活回读

verdict: ACTIVATED_AND_VERIFIED
source_pr: https://github.com/kiddhu/hermes-agent/pull/17
audited_head: 45b87af2140b4169756f3575be5cb605cdd2e61b
merge_commit: 2f69ff17731e90afec93b7eaa4e314ea6ca31ee4
merged_main_tests:
  focused: 33_passed
  regression: 346_passed
installed_path: /usr/local/bin/aion-controlled-pr-gate
source_sha256: 57a9868aa65083ef1bc62747f08532b38da99ecfb3484a9ee60e9ae4af2ab878
installed_sha256: 57a9868aa65083ef1bc62747f08532b38da99ecfb3484a9ee60e9ae4af2ab878
preinstall_rollback_sha256: 460706da7c8a826eb1d05f32f9e7ff9292fa1cf4fa1c5eb97f792903853b04b7
owner_mode_immutable: root:root_0555_immutable
protected_issues:
  879: OPEN
  882: OPEN
  883: OPEN
pr884_prepare_only:
  exact_head: 6cc205abbbdb2750246aa5af9929673c35beddb4
  preflight: PASS
  state: OPEN
  merge_state: CLEAN
  review_decision: APPROVED
side_effect_limits:
  pr884_merge: false
  issue_mutation: false
  raw_merge_or_gate_bypass: false
secret_exposure: 0
native_task: t_a81a7231

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@GemAION GemAION GemAION approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@kiddhu @GemAION @007AION