Skip to content

PR intake: one gate for work no maintainer asked for #362

New issue
New issue
Closed
#406
Closed
PR intake: one gate for work no maintainer asked for#362
#406
Assignees
rocklambros
Labels
priority:P1Maintainers onlyscope:in-focusFeeds the ninety-day committed outcome. Maintainers onlystatus:acceptedIn the backlog. Maintainers onlytype:proposalNew feature or request
Milestone
Governance under OWASP

Description

@rocklambros
rocklambros
opened on Oct 30, 2026

What is wrong

The intake bot checks one thing: whether a pull request mentions an issue carrying status:accepted. Anyone can satisfy that by copying a number from the public accepted list, so pull requests nobody asked for reach the review queue. The week of 2026-10-22 one author opened fifteen in a day against accepted issues nobody had assigned. A one-line comment change to a source file sits in the same queue with the editorial box ticked.

What this asks for

One gate in the intake bot. A pull request is reviewed when a maintainer asked for the work, read from facts the bot can check: the author is on the roster, a roster member reviewed the pull request, a lead merged a pull request of theirs before, the editorial box is ticked and every changed path is on the documentation lane, or the author holds a referenced accepted issue by assignment, or by a prior comment on a help wanted issue. Otherwise it is queued with one comment that says which fact is missing, and the bot owns the queue label (sets it, clears it, lists it on the health issue). It applies to pull requests already open, by a dispatch sweep.

The design is design/2026-10-29-pr-intake-rules-design.md (v3.1, after the premortem in design/2026-10-29-pr-intake-rules-premortem.md), carried by PR #368 until it merges.

Current Priority Scope

Maintainer attention during the relaunch.

Activity

  1. rocklambros
    added this to the Governance under OWASP milestone on Oct 30, 2026
  2. rocklambros
    added
    type:proposalNew feature or request
    scope:in-focusFeeds the ninety-day committed outcome. Maintainers only
    status:acceptedIn the backlog. Maintainers only
    priority:P1Maintainers only
    on Oct 30, 2026
  3. github-project-automation
    added this to ACS Project Trackeron Oct 30, 2026
  4. github-project-automation
    moved this to Needs triage in ACS Project Trackeron Oct 30, 2026

  5. rocklambros commented on Oct 30, 2026

    @rocklambros
    rocklambros
    on Oct 30, 2026
    CollaboratorAuthor

    Rollout for the intake gate, ticked here as each step shows its expected result. Undo at any step: unset PR_INTAKE_ENFORCED, then dispatch mode=retract.

    • Precondition. A project lead either merges the GOVERNANCE and CODEOWNERS reconciliation pull request or writes here that the three roster entries without repository access stay, and why. Link it here.
    • (a) I dispatch mode=dryrun from the integration ref (the workflow on main is still the old one until promotion) with PR_INTAKE_ENFORCED and PR_INTAKE_TOOL_SHA unset. The summary should show zero writes and the line arm with PR_INTAKE_TOOL_SHA=<value>. I post the would-queue numbers and reason codes here. Today that list is PR docs: conformance is a technical measure — it cannot attest human intent #24, PR Batch Guardian log writes and drain them on shutdown #112, PR Record OpenCode host decision-honoring evidence for #92 #113, PR docs: acs-verdict-evidence-v1 predicate (draft) #297, PR Match toolCallRequest summary to schema #253, PR Tighten forward compat for 0.x versions #255, and PR Run AGT pin check and upstream watch in CI #259, and any of three actions clears one: a lead approves it, a lead requests changes on it, or a lead assigns the author on the issue it names.
    • (b) I post the same list in #team-genai-asi-acs-general and put it on the weekly call agenda, and link both here.
    • (c) Leads clear what they want cleared. Done when a second dryrun lists none of those numbers, or a project lead writes "proceed with the remainder" here.
    • (d) A project lead opens a throwaway pull request with auto-merge on, dispatches evaluate on it from the integration ref, and comments here which write the summary reports and what autoMergeRequest reads afterwards. Expected: null.
    • (e) Promote. The next roadmap sweep should render "Queued pull requests" on the health issue, and the next monitor run should log the intake line.
    • (f) Arm. A project lead with repository admin edits the live help wanted label description, dispatches mode=retract with authors=bots to clear the inherited Dependabot labels, then in one sitting outside 03:00 to 04:30 UTC sets PR_INTAKE_TOOL_SHA from the dry run's line, sets PR_INTAKE_LANDED to that day's date, sets PR_INTAKE_ENFORCED=true, and dispatches evaluate. The summary should say mode=enforced.
    • (g) The next morning a project lead reads the health issue and sets PR_INTAKE_BASELINES from its "Queued pull requests" counts, and comments the values and the review date here.
    • (h) A project lead marks this issue completed by hand, which GOVERNANCE counts as delivered.
  6. acs-board-reconciler
    moved this from Needs triage to Accepted in ACS Project Trackeron Oct 30, 2026
  7. rocklambros
    self-assigned this
    on Oct 31, 2026

  8. rocklambros commented on Oct 31, 2026

    @rocklambros
    rocklambros
    on Oct 31, 2026
    CollaboratorAuthor

    Every open pull request gets the same review, on its merits, under the same bar, whoever opened it. A pull request that overlaps work already under review, or that does not fit the issue it names, is reworked or closed with thanks, and each issue it would have closed is linked to the pull request that delivers it instead.

    Step (f), arming, now waits until these ten pull requests clear by one of the three actions in step (a), or close: PR #335, PR #337, PR #340, PR #341, PR #342, PR #343, PR #346, PR #347, PR #348, PR #349. The other steps are not held.

  9. github-project-automation
    moved this from Accepted to In progress in ACS Project Trackeron Nov 1, 2026

  10. rocklambros commented on Nov 1, 2026

    @rocklambros
    rocklambros
    on Nov 1, 2026
    CollaboratorAuthor

    The eight-step rollout above is withdrawn. PR #406 replaces PR #368 with a small check that has no rollout, so the arming hold no longer applies.

  11. rocklambros
    closed this as completedin #406on Nov 1, 2026
  12. github-project-automation
    moved this from In progress to Done in ACS Project Trackeron Nov 1, 2026

  13. rocklambros commented on Nov 1, 2026

    @rocklambros
    rocklambros
    on Nov 1, 2026
    CollaboratorAuthor

    Dropped on purpose in PR #406: the sweep, label clearing, and the health listing.

  14. AngeYobo
    added a commit that references this issue on Nov 1, 2026

    Flag a pull request no lead asked for with one small check (GenAI-Sec…

    895fe60
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

priority:P1Maintainers onlyscope:in-focusFeeds the ninety-day committed outcome. Maintainers onlystatus:acceptedIn the backlog. Maintainers onlytype:proposalNew feature or request

Type

No type

Projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions