Skip to content

fix: preserve version planning after verified integration merges - #79

Merged
coisa merged 2 commits into
mainfrom
codex/fix-version-pr-sync
Oct 30, 2026
Merged

coisa merged 2 commits into
mainfrom
codex/fix-version-pr-sync

Conversation

@coisa

@coisa coisa commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

After squash-merging a PR that contains nested integration merges, version preparation refused the entire transaction when the original PR head proved that a fragment came unchanged from a merge side parent. The post-merge Changelog run 40975395070 hit this case for .changelog/acquire-verified-squash-pr-head.md in PR #78. It used runtime/base ad36660a95affb7ee7444e9009f4b98f8bea21f3; major-channel updates were not involved.

The resolver now excludes only a fully verified candidate whose direct-origin check returns false. It leaves the fragment without an inferred PR link if none qualify, while still considering other qualified candidates. Missing original-head origin, origin outside the complete PR commit delta, repository/merge/blob disagreement, API/Git errors and multiple qualifying PRs continue to refuse. No explicit fragment metadata or reference policy is bypassed.

A read-only replay against the same source base now returns a 0.5.0 dry-run plan with no diagnostics. The replay HTTP adapter rejects remote mutations; no version PR, release or channel was created. This prepares a fix for review, not a deployment or a live workflow rerun.

Validation

  • composer --no-plugins check passed: 2851 unit tests and 100% executable line coverage (6254/6254).
  • Unit tests use injected doubles, including negative candidate selection, another valid candidate, ambiguity and operational failure refusal.
  • Full integration suite: 51 tests / 647 assertions passed, including CLI stack/recovery/publication reconstruction. 164 focused resolver/integration tests passed; disposable Git history tests preserve umbrella/stack rejection of false attribution and authenticated missing-head recovery (success/401).
  • Documentation and the unique pending fragment describe the exact changed refusal boundary.

No workflow contract, channel rule, credentials, existing managed branch or published history changed. Packaging was not rerun: no packaged resources or dependency contract changed. Hosted checks at final head 8b9a8c64a91ec598549774f48c84f9b82897d768: 22 passed, zero failed; the automatic CodeRabbit review is still pending at this checkpoint. No review approval is inferred.

Separate consumer check: Framework run 40976292702 used runtime 203db95e68fc974e95ba1a921f08d01f88851be1 at source 6f6743f6aba53d4944495a3faf1ae9ca99336283; Docker failed while fetching the Alpine APK index over TLS, before the version CLI ran. Isolated read-only replays with that old runtime and this provider fix both produce the same 1.5.4 plan. This PR does not change Framework or retry that run.

@coderabbitai

coderabbitai Bot commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

📝 Summary

Summary by CodeRabbit

  • Bug Fixes
    • Version preparation now succeeds when a verified integration brings in a changeset from another branch, without incorrectly attributing it to the integration pull request.
    • When one possible pull request cannot be verified as the changeset’s origin, other candidates can still be checked. If none qualify, the changeset is included without a pull request link.
    • Missing, conflicting, ambiguous, or unavailable origin evidence still prevents version preparation.

When Git provenance identifies a fragment as imported from a merge side parent, the resolver excludes the integrating pull request from attribution. If no candidate qualifies, version preparation continues without a pull request link. Missing, contradictory, ambiguous, or unavailable provenance still causes preparation to fail.

Changes: Verified integration attribution

Layer / File(s) Summary
Resolver candidate handling
src/Release/Reference/PullRequestReferenceResolver.php, tests/Release/Reference/PullRequestReferenceResolverTest.php
The resolver skips a candidate when direct-origin proof is false. Tests cover unresolved changes, selection of another qualified candidate, and redacted errors when provenance proof fails.
Integration coverage and release notes
tests/Integration/GitFragmentOriginTest.php, tests/Integration/AutomaticPullRequestReferenceTest.php, .changelog/skip-proven-nonimplementation-pr.md, docs/history.md
Integration tests verify that the integrating PR receives no attribution and that status succeeds without adding its PR link. The changelog and history describe the behavior and the provenance conditions that still prevent preparation.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix

Possibly related PRs

Merge Risk: Minimal · up to 8b9a8

Verified integration imports can proceed without an inferred PR link; incomplete provenance still fails. No actionable merge-blocking risk remains.

Pre-merge checks: Passed 5
Check name Status Explanation
Title check Passed The title clearly and concisely describes the main change: preserving version planning after verified integration merges.
Description check Passed The description directly explains the nested integration merge issue, the resolver behavior, preserved refusal cases, and validation results. It is fully related to the changeset.
Docstring Coverage Passed Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentati…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 5 functions across 4 files. (2 skipped: 2 unsupported.)

Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks the merge-side trail,
And leaves the integrator off the tale.
If proof is missing, plans must wait,
If proof is clear, no link need state.
The fragment keeps its words in view,
And hops along with provenance true.

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

Changelog

✅ Contribution check passed.

Head: 8b9a8c64a91ec598549774f48c84f9b82897d768

Base: ad36660a95affb7ee7444e9009f4b98f8bea21f3

Contribution: 1 new valid fragment(s). Policy: ordinary.

  • skip-proven-nonimplementation-pr.md — fixed, patch

    Allows version preparation after a verified integration PR imports a fragment from another branch. The integrator receives no inferred implementation link; missing, contradictory or ambiguous provenance still refuses preparation.

@coisa
coisa marked this pull request as ready for review October 30, 2026 00:11
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-30T00:17:19.912369Z 8b9a8c6 Manual request
🔒 Security Review ✅ Completed 2026-10-30T00:18:22.261835Z 8b9a8c6 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

Copy link
Copy Markdown
Contributor

Code Coverage Report: Only Changed Files listed

Package Base Coverage New Coverage Difference
Overall Coverage 🟢 100% 🟢 100% ⚪ 0%

Minimum allowed coverage is 100%, this run produced 100%

@coisa

coisa commented Oct 30, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 8b9a8c64a9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 8b9a8c64a9

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@coisa
coisa merged commit a8eb052 into main Oct 30, 2026
36 checks passed
@coisa
coisa deleted the codex/fix-version-pr-sync branch October 30, 2026 12:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant