ci: remi-proof status blocks harness PRs until remi has proven their exact head by TusanHomichi · Pull Request #125 · FieldmouseWorks/wend

TusanHomichi · 2026-10-16T00:36:04Z

Requested by Peter · project thread

Before: "Codex, then remi, then sign-off" for harness PRs was a convention people had to remember. GitHub showed a harness PR as green even though CI never ran its changed tools, because the gate copies tools/ and adapters/ from base. A fix for networking or the bootloader passed on chroot alone, and nothing on the PR said what it was waiting on.

After: every PR gets a remi-proof commit status. Most fix and route PRs pass at once. A PR stays pending ("needs a remi pass at : ") until someone with push access records remi's verdict on that exact commit if it:

touches tools/, adapters/, boxes/ or wend;
adds, changes or newly pins a fix a chroot can't judge: one with a net.* or fs.layout op, or one that installs, removes or reinstalls a kernel, bootloader, initramfs, init or network package;
or is labeled needs-remi (the label exists now).

A new push resets the status, because statuses belong to a commit. Once Peter makes it a required check, it blocks the merge button.

How it works:

Trigger: .github/workflows/remi-proof.yml runs on pull_request_target, so the base copy always runs and a PR can't edit its own judge.
What it reads: it never checks out or runs PR code. It reads the file list (both ends of a rename) and labels, plus fix and route TOML from the contents API, which it only parses. A removed fix is judged from base.
Failing closed: anything it can't read or parse counts as needing remi. So does a file list the API truncates.
Hand-recorded verdicts: it never overwrites a status a person recorded. It checks again just before posting, and it skips posting if the PR moved on while it read it.
Forks and remi: fork authors can't post statuses, since that needs push access. remi is never reached.
Older PRs: workflow_dispatch re-judges an open PR by number.

CONTRIBUTING gains layer 4, "Proof on remi", with the exact gh api and curl commands to record a verdict. gate.yml's branch-protection note lists the new required status.

Tested by running the classifier against the live API with the POST stubbed:

PR	Result	Why
#123	pending	it changes adapters and tools
#116	success	Rust client only
#98	pending	it changes boxes
#92	pending	`el10-network-keyfiles` (`net.ifcfg-to-keyfile`), and the route newly pins it

Run over every fix in the repo, it flags exactly these 8: drop-sysvinit-for-trixie, wheezy-purge-dhcp3-transitional, wheezy-reinstall-module-init-tools, el10-network-keyfiles, el9-networkmanager, el7-usrmove, el7-var-run and jammy-ifupdown-dns-to-resolved. actionlint is clean.

This workflow can't judge its own PR: pull_request_target uses base's copy, so it starts working after merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DYHHin9QGaqhRGgxvTT8Ju

… their exact head The gate judges PRs with the base branch's tools and adapters, so a PR that changes them is only ever tested on remi. remi-proof.yml (pull_request_target, base's copy, never runs PR code) passes PRs that leave tools/, adapters/, boxes/ and wend alone, and leaves the rest pending until someone with push access records remi's verdict on that commit. A `needs-remi` label opts any other PR in. CONTRIBUTING gains the layer and the exact command to record a verdict. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DYHHin9QGaqhRGgxvTT8Ju Signed-off-by: Claude <noreply@anthropic.com>

chatgpt-codex-connector · 2026-10-16T00:36:12Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T04:37:15.944613Z	`0b56def`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 23611f1b96

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…k before posting A fix (or a route newly pinning one) with a net.* or fs.layout op, or one that installs, removes or reinstalls a kernel, bootloader, initramfs, init or network package, now needs a remi pass too. Outside contributors won't know to add needs-remi. The fix and route files are read from the API as TOML and only parsed. The classifier is Python now, and it skips posting if the PR moved on while it read it or if a verdict was recorded by hand in the meantime. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DYHHin9QGaqhRGgxvTT8Ju Signed-off-by: Claude <noreply@anthropic.com>

…named pin counts Review found two ways round the fix check: package names in other ops' arguments (rpm.transit's reinstall, rpm.drop-unneeded's packages, service.enable's unit) were never read, and a route pin looked up by name took the first hop's file, so a harmless fix of the same name under another hop hid a network one. Now every name-shaped string in any step argument is matched, case-insensitively, against a wider BOOTNET (network-manager, systemd, dhcp-client, netbase, firewalld, lvm2, mdadm, cryptsetup), and a pin needs remi if any hop's file of that name does. The CONTRIBUTING heading loses "(harness changes only)", which is no longer true. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DYHHin9QGaqhRGgxvTT8Ju Signed-off-by: Claude <noreply@anthropic.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cc6e31d73d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

iptables, ip6tables, ebtables, arptables, nftables and ufw join BOOTNET: a chroot never loads a ruleset, so el10-drop-el8-iptables-ebtables and el7-drop-unused-iptables-service now need a remi pass when they change or are newly pinned (Codex review). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DYHHin9QGaqhRGgxvTT8Ju Signed-off-by: Claude <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DYHHin9QGaqhRGgxvTT8Ju Signed-off-by: Claude <noreply@anthropic.com>

Signed-off-by: Claude <noreply@anthropic.com>

TusanHomichi · 2026-10-16T04:17:28Z

@codex review

The head is now 8404251. It merges in main (#123, #126) on top of the firewall fix from your last finding.

Generated by Claude Code

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 840425177c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…ell as added Codex review: editing a network fix into a harmless one, or unpinning one from a route, changed a real boot but posted success, because only the head side was read. A changed fix is now judged at base and head, and a changed route's pins are compared both ways, each looked up in its own tree. A route pin whose file can't be fetched (anything but a 404 on a hop) now counts as unreadable. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DYHHin9QGaqhRGgxvTT8Ju Signed-off-by: Claude <noreply@anthropic.com>

TusanHomichi · 2026-10-16T04:25:51Z

@codex review

986f274 judges a changed fix at base and at head, and checks a route's pins in both directions.

Generated by Claude Code

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 986f274950

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

… on a new base Codex review: gate.yml runs from the PR and defines the required checks, and remi-proof.yml becomes the next judge, so a PR changing either now needs a recorded verdict, except a PR only Dependabot touched (verified commits, the dco job's rule). `edited` joins the triggers, since retargeting a PR changes its diff. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DYHHin9QGaqhRGgxvTT8Ju Signed-off-by: Claude <noreply@anthropic.com>

TusanHomichi · 2026-10-16T04:32:40Z

@codex review

In 0b56def, the required-check workflows need a verdict (Dependabot-only PRs are exempt), and edited is now a trigger.

Generated by Claude Code

chatgpt-codex-connector · 2026-10-16T04:37:14Z

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 0b56deff4a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

TusanHomichi · 2026-10-16T04:37:36Z

Claude review: SIGN-OFF at 0b56def.

An independent Claude reviewer signed off at 986f274 after three rounds. Its two blocking findings are fixed: package names in any op's arguments are now checked, and a route pin can no longer hide behind a same-named fix.
986f274..0b56def adds the required-check workflows (gate.yml and remi-proof.yml, Dependabot-only PRs exempt) and the edited trigger. I read that diff and tested it: ci: move every action off node20, pinned by commit SHA #108 comes out pending, and Dependabot's build(deps): bump the cargo group in /client with 3 updates #111 is recognised as Dependabot-only.
Codex found no issues at 0b56def. All 7 Codex threads are answered and resolved.
Required checks are green on this head, and it is up to date with main (0dfbdd4).
Trust model: the workflow runs base's copy under pull_request_target, never checks out or runs PR code, and only parses PR files as TOML. Every unreadable or unknown case comes out pending, and a crash posts nothing.

Generated by Claude Code

TusanHomichi self-assigned this Oct 16, 2026

github-actions Bot added the needs-claude-review Waiting on the Claude review layer label Oct 16, 2026

chatgpt-codex-connector Bot reviewed Oct 16, 2026

View reviewed changes

Comment thread .github/workflows/remi-proof.yml Outdated

Comment thread .github/workflows/remi-proof.yml Outdated

claude added 2 commits October 16, 2026 00:39

chatgpt-codex-connector Bot reviewed Oct 16, 2026

View reviewed changes

Comment thread .github/workflows/remi-proof.yml Outdated

claude added 3 commits October 16, 2026 00:49

CONTRIBUTING: rewrap the remi layer's list at 120 columns

241d998

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DYHHin9QGaqhRGgxvTT8Ju Signed-off-by: Claude <noreply@anthropic.com>

Merge main into #125 (#123, #126)

8404251

Signed-off-by: Claude <noreply@anthropic.com>

chatgpt-codex-connector Bot reviewed Oct 16, 2026

View reviewed changes

Comment thread .github/workflows/remi-proof.yml Outdated

Comment thread .github/workflows/remi-proof.yml Outdated

chatgpt-codex-connector Bot reviewed Oct 16, 2026

View reviewed changes

Comment thread .github/workflows/remi-proof.yml

Comment thread .github/workflows/remi-proof.yml Outdated

TusanHomichi merged commit 82939b1 into main Oct 16, 2026
6 checks passed

TusanHomichi deleted the claude/remi-proof-check-h1t6p3 branch October 16, 2026 04:37

This was referenced Oct 16, 2026

docs: who wend is for; client fetches from wend's archive; remi-proof in the merge step; Ubuntu VM tier #130

Merged

ci: record remi verdicts through a dispatched workflow #135

Merged

Conversation

TusanHomichi commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

TusanHomichi commented Oct 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

TusanHomichi commented Oct 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

TusanHomichi commented Oct 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 16, 2026

Uh oh!

TusanHomichi commented Oct 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

TusanHomichi commented Oct 16, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 16, 2026 •

edited

Loading