feat(mergecraft): add repository configuration workflow by nisavid · Pull Request #691 · nisavid/provingkit

nisavid · 2026-10-19T22:41:02Z

^{IMPL means non-test source and configuration. TEST means automated verification. DOC means reviewer and user documentation. GEN means generated artifacts. OTHER means files outside those categories. FILES shows added, modified, and removed files as +, ~, and −.}

Summary

Add Mergecraft’s configuring-repositories Skill for GitHub repository creation, assessment, contextual defaults, focused changes, and project-specific CI hardening. It starts from the requested outcome and applicable policy, explains consequential setting relationships, and delegates application and verification through available native tools.

The development baseline has no repository-configuration Skill or member-delivery CLI. This PR integrates the reviewed Skill and its qualification material into maintained source, plus the first nonpassing delivery-validation slice. Complete preservation validation, the Actions caller, remaining hosted cases, and installation remain open work.

Review path

Start with plugins/mergecraft/skills/configuring-repositories/SKILL.md and its four linked guides for triggers, judgment, application, and evidence limits. Existing Git publication, PR publication, review, and configuration writers retain their operations.
Review scripts/validate_member_delivery.py and scripts/member_delivery_preservation.py with tests/test_validate_member_delivery.py. The CLI rejects malformed or contradictory inputs and reports incomplete evidence; it always leaves established_claims empty. Constructed complete envelopes cannot admit a candidate.
Check scripts/validate_mergecraft.py, the focused registration tests, and plugins/mergecraft/README.md. Generated registry rows, the Claude adapter, and the Mergecraft content lock follow their canonical inputs. The Kit definition changes only Mergecraft’s content identity.

Boundary

Owning surface: Mergecraft’s canonical Skill, discovery and validation surfaces; the standalone offline member-delivery CLI.
Issue contributions: Source and installation contract, partial implementation of maintained source and discovery; Workflow implementation and qualification, partial implementation of the Skill, evaluations, and nonpassing validation. Neither issue is complete on merge.
Release, publication, installation, or live-qualification authority: none conferred by this PR. This is development source, with no selected alpha version or delivery cut.

Provenance and compatibility

Source revision or history: integrate the accepted Skill from 87121453 and the nonpassing validator from 745764e7 over maintained source at fc50152d. The validator documentation uses an immutable link to its design.
Compatibility aliases or historical references: no new alias or Slate member. Existing member identities and versions remain unchanged. Source conformance is separate from hosted enforcement, delivery preservation, installation, and fresh client use.

Validation

The Provingkit definition and repository exclusions pass.
Every affected member’s focused tests and source validator pass.
Supported derived locks regenerate without a diff.

At repository root, python -m unittest tests.test_validate_mergecraft tests.test_validate_member_delivery passed 184 tests. Those 184 observed results remain applicable: the final successor changes only the design hyperlink, with executable, schema, fixture, and test dependencies unchanged. They were retained with explicit dependency comparison and independent adjudication, rather than rerun on the final commit.

Final-commit git diff --check, python scripts/validate_mergecraft.py ., python scripts/validate_source_skill_disposition.py ., and python scripts/validate_provingkit.py . all passed. python scripts/validate_mergecraft.py --write-content-lock . also completed with no working-tree diff. Independent source-assembly review is clean. This does not claim a full repository test-suite run or hosted CI result.

Review checklist

The six Agent Plugin members remain independently identified, including Proseweaving.
Member manifests keep independent identities and versions.
Historical Linux or macOS inputs are not presented as current qualification.
This change creates no Provingkit release, tag, release-manifest instance, marketplace publication, or live installation.

Summary by CodeRabbit

New Features
- Added guidance for creating and assessing GitHub repositories, choosing settings, making authorized configuration changes, and hardening CI. Recommendations account for repository policies and existing choices.
- Added an offline validator for prepared member-delivery records. It reports malformed or contradictory records as rejected and missing evidence as incomplete; validation does not admit a delivery.
Documentation
- Added guidance on repository controls, CI security, applying changes, and verifying outcomes.
Tests
- Added evaluation scenarios for repository configuration and coverage for member-delivery validation.

coderabbitai · 2026-10-19T22:41:09Z

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Team
Run ID: de5fb2e9-fac8-40e9-a8ad-470f4e6da6fb

📥 Commits

Reviewing files that changed from the base of the PR and between df030db and 85e78ed.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Team
Run ID: db519e2c-9dde-4f6e-acbe-19331c6cf02c

📥 Commits

Reviewing files that changed from the base of the PR and between fc50152 and df030db.

📒 Files selected for processing: 37

docs/member-delivery-validation.md
evals/mergecraft/skills/configuring-repositories/evals.json
evals/mergecraft/skills/configuring-repositories/fixtures/assess-inherited-controls.md
evals/mergecraft/skills/configuring-repositories/fixtures/changed-producer-and-skipped-result.md
evals/mergecraft/skills/configuring-repositories/fixtures/conflicting-provider-evidence.md
evals/mergecraft/skills/configuring-repositories/fixtures/create-solo.md
evals/mergecraft/skills/configuring-repositories/fixtures/defaults-informed-freeze.md
evals/mergecraft/skills/configuring-repositories/fixtures/focused-outside-catalog.md
evals/mergecraft/skills/configuring-repositories/fixtures/harden-python-content.md
evals/mergecraft/skills/configuring-repositories/fixtures/harden-typescript-private.md
evals/mergecraft/skills/configuring-repositories/fixtures/maintained-writer-and-concurrency.md
evals/mergecraft/skills/configuring-repositories/fixtures/ordinary-edit-near-miss.md
evals/mergecraft/skills/configuring-repositories/fixtures/partial-effect-and-reconciliation.md
evals/mergecraft/skills/configuring-repositories/fixtures/policy-and-privileged-input.md
plugins/mergecraft/.claude-plugin/plugin.json
plugins/mergecraft/CHANGELOG.md
plugins/mergecraft/DEVELOPING.md
plugins/mergecraft/README.md
plugins/mergecraft/plugin.json
plugins/mergecraft/skills/configuring-repositories/SKILL.md
plugins/mergecraft/skills/configuring-repositories/agents/openai.yaml
plugins/mergecraft/skills/configuring-repositories/references/apply-and-verify.md
plugins/mergecraft/skills/configuring-repositories/references/ci-hardening.md
plugins/mergecraft/skills/configuring-repositories/references/decisions.md
plugins/mergecraft/skills/configuring-repositories/references/github-controls.md
plugins/mergecraft/topology.json
release/plugin-content-locks/mergecraft.json
release/provingkit/definition-v1.json
scripts/member_delivery_prepared.schema.json
scripts/member_delivery_preservation.py
scripts/validate_member_delivery.py
scripts/validate_mergecraft.py
tests/fixtures/member_delivery/README.md
tests/fixtures/member_delivery/constructed-complete-record.json
tests/fixtures/member_delivery/prepared-admission-schema.json
tests/test_validate_member_delivery.py
tests/test_validate_mergecraft.py

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

nisavid/ci (manual)

Included review availability: This review used your included allowance. 8 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.

📝 Walkthrough

The PR adds a repository-configuration skill to Mergecraft and a validator for prepared member-delivery records. It also adds schemas, guidance, evaluation fixtures, tests, and validation rules for these changes.

Changes: Member Delivery Validation

Layer / File(s)	Summary
Prepared record contract `scripts/member_delivery_prepared.schema.json`, `tests/fixtures/member_delivery/prepared-admission-schema.json`, `docs/member-delivery-validation.md`	The schemas define correspondence and non-correspondence record forms. The documentation describes validator inputs, outcomes, limitations, and test scope.
Record consistency checks `scripts/member_delivery_preservation.py`	The validator checks request and input identities, record bindings, timestamps, and response consistency. Complete evidence still produces an incomplete result.
CLI handling and validation coverage `scripts/validate_member_delivery.py`, `tests/test_validate_member_delivery.py`, `tests/fixtures/member_delivery/*`	The CLI strictly decodes requests and writes results. Fixtures and tests cover malformed requests, contradictions, and incomplete evidence.

Repository Configuration Skill

Layer / File(s)	Summary
Skill contract and configuration procedures `plugins/mergecraft/skills/configuring-repositories/SKILL.md`, `plugins/mergecraft/skills/configuring-repositories/references/*`, `plugins/mergecraft/topology.json`	The skill and guides describe repository-control assessment, CI hardening, authorized changes, and outcome verification. The topology registers its operation and contract.
Plugin registration and public descriptions `plugins/mergecraft/plugin.json`, `plugins/mergecraft/.claude-plugin/plugin.json`, `plugins/mergecraft/README.md`, `plugins/mergecraft/DEVELOPING.md`, `plugins/mergecraft/CHANGELOG.md`, `plugins/mergecraft/skills/configuring-repositories/agents/openai.yaml`, `release/plugin-content-locks/mergecraft.json`, `release/provingkit/definition-v1.json`	Plugin metadata, public documentation, registries, and content identities include the new skill and its operation relationships.
Evaluation fixtures and repository checks `evals/mergecraft/skills/configuring-repositories/*`, `scripts/validate_mergecraft.py`, `tests/test_validate_mergecraft.py`	Twelve evaluation cases cover configuration and CI scenarios. Validator rules and tests check skill inventory, topology, ownership, and fixture boundaries.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~60 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant CLI as validate_member_delivery.py
  participant Validator as validate_nonpassing
  participant Consumer as consume
  participant Inputs as Request and input files
  participant Report as Output report
  CLI->>Validator: Pass decoded request
  Validator->>Consumer: Consume supported request
  Consumer->>Inputs: Read records and schema
  Inputs-->>Consumer: Return input data
  Consumer-->>Validator: Return rejected or incomplete result
  Validator-->>CLI: Return validation result
  CLI->>Report: Write result and select exit status

Merge Risk: ⚪ Minimal · up to df030

This change adds a repository-configuration skill with its guidance, registration, and evaluation fixtures. It also adds an offline member-delivery validator that reports only rejected or incomplete results and never admits a delivery. No concrete defects were found, the plugin registries are consistent, and the change appears ready to merge.

Security architecture risk: 🔵 Low · up to df030

Repository protections and CI are security-sensitive. The design limits changes to authorized effects, separates untrusted execution from credentials, and addresses uncertain outcomes. Live enforcement and failure recovery remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

inferred — When invoked with sufficient host credentials, the new capability can affect the selected repository's visibility, protections, bypass behavior, workflows, token permissions, and required checks. Consequences can therefore extend to contributors and automation governed by those controls. The documented authority is repository- and effect-scoped, not blanket organization authority; actual host credential scope is not demonstrated.

Trust Boundaries and Controls

observed — The skill distinguishes assessment from mutation authority, requires confirmation of consequential unsettled choices, and forbids inferring paid activation, organization policy changes, deletion, or unrelated work. It requires observing target permissions and capabilities rather than assuming documentation proves access or enforcement.
observed — CI guidance treats fork code, dependency hooks, PR metadata, artifacts, and caches as untrusted inputs. It warns against executing fork-controlled content under privileged events, rejects workflow completion as a trust conversion, and calls for least-privilege tokens and data-safe handling of untrusted strings.
observed — These configuration controls are documented behavioral requirements. The registered skill declares no executable scripts or modules, so the inspected registration does not demonstrate automatic authorization enforcement, provider conditional writes, or runtime isolation.

Resilience and Maintainability Implications

observed — The offline validator preserves a nonpassing boundary when inputs or validation dependencies are unavailable. It also checks declared byte identities and rereads available inputs to detect changes during consumption; none of these outcomes establishes preservation admission.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 75 functions across 5 files. (32 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies the primary change: adding a Mergecraft repository configuration workflow. It is concise and specific.
Description check		The description includes all required sections, identifies the owning surfaces and issues, documents provenance and compatibility, lists validation results and limitations, and completes the review ch…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description includes all required sections, identifies the owning surfaces and issues, documents provenance and compatibility, lists validation results and limitations, and completes the review checklist. It also clearly states that some tests were retained rather than rerun and that no release or live qualification occurred.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 75 functions across 5 files. (32 skipped: 32 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the records by moonlight,
Hashes and timestamps tucked snug and right.
New repository guides join the burrow,
While CI paths get a careful furrow.
“No proof of admission,” says the hare,
Then hops off with a well-checked report to share.}

_{Comment @coderabbitai help to get the list of available commands.}

greptile-apps · 2026-10-19T22:50:47Z

TREX could not finish testing

~~Plan what to test~~
~~Set up the environment and test the changed flows~~
~~Post test results~~

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

chatgpt-codex-connector · 2026-10-19T22:50:50Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T22:55:32.971099Z	`df030db`	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-19T22:54:09.285069Z	`df030db`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

linear-code · 2026-10-23T03:44:11Z

IDV-2140

nisavid mentioned this pull request Oct 19, 2026

Deliver a locally deployed repository-configuration alpha #374

Open

nisavid marked this pull request as ready for review October 19, 2026 22:50

Copilot AI balanced review requested due to automatic review settings October 19, 2026 22:50

Copilot AI reviewed Oct 19, 2026

coderabbitai Bot approved these changes Oct 19, 2026

View reviewed changes

nisavid mentioned this pull request Oct 19, 2026

Bind the alpha to maintained source and an installation contract #375

Open

nisavid linked an issue Oct 19, 2026 that may be closed by this pull request

Bind the alpha to maintained source and an installation contract #375

Open

This was referenced Oct 22, 2026

Provingkit orchestration: charter, thread register, and reconciliation log #256

Open

Maintain host Provingkit rollouts across main, preview, and stable channels #139

Open

Provingkit preview rollout and evidence #66

Open

nisavid added 3 commits October 22, 2026 23:03

feat(mergecraft): integrate repository configuration guidance

016825c

feat(repo-config/delivery): integrate nonpassing validator

f22d624

docs(repo-config/delivery): repair design reference

85e78ed

nisavid force-pushed the nisavid/repo-config-source-integration branch from df030db to 85e78ed Compare October 23, 2026 03:05

nisavid merged commit e5b06b4 into main Oct 23, 2026
16 checks passed

nisavid deleted the nisavid/repo-config-source-integration branch October 23, 2026 03:43

Navigation Menu

Repository navigation

feat(mergecraft): add repository configuration workflow - #691

feat(mergecraft): add repository configuration workflow#691
nisavid merged 3 commits into
mainfrom
nisavid/repo-config-source-integration

nisavid commented Oct 19, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading

Review skipped

Sequence Diagram(s)

Uh oh!

greptile-apps Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

Uh oh!

linear-code Bot commented Oct 23, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

nisavid commented Oct 19, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Review path

Boundary

Provenance and compatibility

Validation

Review checklist

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Sequence Diagram(s)

Uh oh!

greptile-apps Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TREX could not finish testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

Uh oh!

linear-code Bot commented Oct 23, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nisavid commented Oct 19, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading

greptile-apps Bot commented Oct 19, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading