chore: wire the intake findings into the harness - #725
Merged
Conversation
…rom the work Two behaviour changes Thomas asked for on 2026-08-13, plus the tool gap they exposed. Ask when unsure, at any step, in any mode. The worker prompt's "choose the reading a careful colleague would" made silent assumptions the instructed behaviour. Now ambiguity has two tiers: mechanical choices land in a PR-body ## Assumptions section the orchestrator adjudicates with Thomas at handover, and a decision that belongs to Thomas ends the worker with NEEDS_DECISION: <question> instead of a guess. Step 7 reads it from the worker log; attended runs ask and relaunch with the answer commented on the ticket, sleep runs defer with the question in the report. Step 2b states that the classifier and the needs:conversation label are detection aids, not the boundary of asking. Manual steps from three sources, not one ticket section. Step 10 merges the ticket's own sections (complete-ticket.mjs --preflight), the PR body's ## Manual steps section the prompt now requires, and the orchestrator's own diff read for new env keys, secrets and vendor-console dependencies, then comments the merged list on the ticket. tools/label-ticket.mjs is new: the only sanctioned label mutation on an existing ticket, validated against the live label list. Measured the same day: needs:conversation could not be applied to #36 through any tool, and the raw-mutation hook correctly blocked gh. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The NEEDS_DECISION and ## Assumptions read now happens at EVERY worker exit, DELIVERED included, because verify-delivery.mjs reads artifacts and never the log, so a delivered branch proves nothing about an unanswered question. A delivered PR with an open question keeps its ticket In Progress under --sleep, never In Review. Assumptions are adjudicated at the step 7 worker-exit read, before the step 8 and 9 loops, so an invalidating answer is ordinary bounded-fixer work rather than a revoked READY; step 10 only prints outcomes. The gh issue edit --add-label/--remove-label contract is now proven by execution per code standard 8: three real invocations against gh 2.97.0 on orbit-tickets#316 (single add, combined add plus remove in one call, re-add), each confirmed by the follow-up label read; the evidence lives in the editLabels comment. The label-ticket success cases now consume a removePath marker on the stubbed edit command, so deleting the editLabels write fails the test instead of passing on a preloaded issue view. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Three edits from the 2026-08-13 intake session: - audit-security checklist, section J: name OpenAI in the processor list, demand plain-terms AI disclosure, and add four items - private object storage plus complete deletion, subscription cancel parity, a trial-charge reminder (arms when ORB-138 applies the price), and no invented social proof (landing JSON-LD verified clean 2026-08-13). - audit-security checklist, section F: a Tier 1 item requiring a crisis response to a self-harm disclosure (closed by orbit-tickets#319). - product-manager agent: the eight-category edge-case pass is now a mandatory output, in fixed order, with silent categories forbidden; the ticket skill sends back a PM return that lacks the pass. Both harnesses pass: node tools/test-tools.mjs and node .claude/hooks/test-hooks.mjs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
The security checklist currently turns conditional obligations into unconditional Tier findings and requires coverage of surfaces the audit cannot access.
Reviewed changes against 6cb20212, covering the complete 12-file diff and the cross-repository behavior it references.
- Edge-case planning: the product-manager contract now emits an ordered eight-category edge-case pass, and
/ticketrejects incomplete PM output. - Security and legal coverage: the audit checklist adds crisis handling, OpenAI disclosure, object-storage deletion, subscription cancellation, trial reminders, and fabricated-social-proof checks.
- Orchestration and ticket tooling: the diff includes worker decision/manual-step handoff rules and the validated
label-ticket.mjsmutation path; these tree changes are already onmainthrough merged PR #724 but remain in this branch's pre-squash ancestry.
GPT Sol ｜ 𝕏
There was a problem hiding this comment.
Important
Merge commit 9e18573e adds no source changes and does not resolve the four checklist findings from the prior review.
Reviewed changes since the Pullfrog review on 6cb20212; the only new commit merges main into the branch.
- Main synchronization:
9e18573ehas zero changed files and removes the already-merged PR #724 changes from the current PR diff. - Review status: the existing four threads still anchor to unchanged lines in
.claude/skills/audit-security/checklist.mdand remain actionable.
GPT Sol ｜ 𝕏
All four findings, all in the audit checklist, all accepted: - SB 243 is conditional context, never the severity basis; the crisis item's Tier 1 stands on Orbit's own product-safety policy. - Cancellation tests obstruction, not step parity; the Play Subscription Center link the app already opens is compliant. - The trial notice tests the duty that applies (trial length, jurisdiction, billing channel); provider-side Stripe delivery counts. - Social proof is scoped to the supplied audit roots; the landing repo and the Play listing go to the Deferred ledger instead of being reported clean from an empty local grep. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Important
The trial-notice correction still allows a Stripe webhook event to stand in for customer-facing delivery, leaving one audit false-negative path to fix.
Reviewed changes since the prior Pullfrog review on 9e18573e; this run covered the corrective commit and rechecked the complete three-file PR diff.
- Separated crisis policy from legal applicability: Kept Orbit's Tier 1 safety bar while making SB 243 conditional context with an accurately narrower statutory duty.
- Corrected cancellation and trial scope: Accepted the existing Play-hosted cancellation path and derived notice duties from jurisdiction, trial duration, and billing channel.
- Deferred inaccessible marketing surfaces: Required the landing repository and live Play listing to remain explicit Deferred-ledger entries rather than allowing empty local searches to imply coverage.
GPT Sol ｜ 𝕏
Pullfrog round 2: customer.subscription.trial_will_end is the trigger for a reminder email, not the notice itself. The check now demands an enabled and sent customer reminder (Stripe or Orbit-sent); receiving or handling the event alone never satisfies it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes since the prior Pullfrog review on 6adeaee3; this run covered the customer-delivery correction and rechecked the complete three-file PR diff.
- Required customer-facing proof: Replaced webhook handling as acceptable notice evidence with proof of an enabled and sent Stripe reminder email or an Orbit-sent equivalent.
- Disqualified trigger-only evidence: Clarified that
customer.subscription.trial_will_endis only the email trigger and that receiving or handling it cannot satisfy the audit check by itself.
GPT Sol ｜ 𝕏
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Three harness edits from the 2026-08-13 intake session (the SaaS-legal reel, the /edge-cases post, and the repo checks that followed):
SupabaseObjectStorageService.csexists), subscription cancel parity, a trial-charge reminder that arms when ORB-138 applies the price, and no invented social proof (landing JSON-LD verified clean 2026-08-13).grep -ri "self-harm|suicide|crisis"across orbit-api returns zero files today; thomasluizon/orbit-tickets#319 implements the fix, this item keeps it from regressing.Verification
Both harnesses pass after the edits:
node tools/test-tools.mjs(ORBIT TOOLS GATE OK) andnode .claude/hooks/test-hooks.mjs(ORBIT HOOKS OK). The pass already ran live in this session's ticket batch and surfaced real silent defaults (a pay gate swallowing a crisis turn, the FAQ cache storing a crisis-shaped answer), which are now encoded in #319's body.🤖 Generated with Claude Code