potiuk opened a new pull request, #355: URL: https://github.com/apache/airflow-steward/pull/355
## Summary - Add a verify-before-claim rule to `tools/gmail/operations.md`: any skill that writes *"Reporter notification still pending โ see draft `<draftId>`"* must call `mcp__claude_ai_Gmail__list_drafts` first and confirm the `draftId` is still in Drafts. If it is gone (sent or discarded), flip the line โ never assert "still pending" without checking. - Reference the rule from the two emission sites that previously wrote the line unconditionally: `security-cve-allocate/SKILL.md` ยง Reporter-notification line options, and `security-issue-sync/SKILL.md` (both the Step 4 status-rollup emission site and the existing stale-draft carry-forward guard). ## Why Without the guard, a "still pending" status comment on sync N self-replicates across every subsequent sync long after the user has actually sent the email โ the same self-replication failure the existing stale-draft-flag rule guards against, but in the positive direction. One `list_drafts` call per pass closes the class. ## Test plan - [ ] `skill-and-tool-validate` exits 0 (verified locally; no hard violations introduced). - [ ] Spot-check that the cross-reference link from the two skills to the canonical rule resolves (`tools/gmail/operations.md#verify-before-claim--never-assert-a-draft-is-still-pending-without-checking`). - [ ] On the next `/security-issue-sync` run with a created-but-unsent draft, confirm the skill calls `list_drafts` before writing the status comment. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
