This is an automated email from the ASF dual-hosted git repository.
terrymanu pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/shardingsphere.git
The following commit(s) were added to refs/heads/master by this push:
new 125ccf29d59 Unify Codex PR review output under Formal Review (#39626)
125ccf29d59 is described below
commit 125ccf29d59012817e65dc3f29a8565751adf3a9
Author: Liang Zhang <[email protected]>
AuthorDate: Fri Aug 28 22:14:50 2026 +0800
Unify Codex PR review output under Formal Review (#39626)
---
.codex/harness/agents/cases.toml | 19 ++++++
.codex/skills/review-pr/SKILL.md | 78 +++++++---------------
.../skills/review-pr/references/evidence-access.md | 10 +--
AGENTS.md | 2 +-
4 files changed, 49 insertions(+), 60 deletions(-)
diff --git a/.codex/harness/agents/cases.toml b/.codex/harness/agents/cases.toml
index 28c0d028da2..149cc0f613d 100644
--- a/.codex/harness/agents/cases.toml
+++ b/.codex/harness/agents/cases.toml
@@ -1026,6 +1026,25 @@ forbidden_actions = ["edit_code", "edit_non_code",
"mutate_git", "mutate_remote"
required_reasons = ["review_passed", "git_read_only"]
critical = true
+[[cases]]
+id = "local_candidate_review_uses_formal_output"
+group = "operations"
+description = "Uses the Formal Review output contract for a complete
local-candidate code review."
+phase = "review output gate and ordinary completion loop"
+ordinary_loop = true
+profile = "review-pr"
+prompt = "A complete Code Correctness Review of an authorized local candidate
targeting pull request 123 has found one confirmed blocker, so the Formal
Review result is Not Mergeable. The local commit is not public. Return the
overall code review recommendation now with the required Formal Review
structure, and identify it as a local candidate separately in Coverage; do not
edit, hand off, or change Git."
+decision = "proceed"
+required_actions = []
+allowed_actions = []
+forbidden_actions = ["edit_code", "edit_non_code", "propose_commit_message",
"mutate_git", "mutate_remote"]
+required_reasons = []
+required_summary_terms = ["### Result", "Review Result: Not Mergeable", "###
Evidence", "### Coverage", "local candidate"]
+forbidden_summary_terms = ["Local Preflight"]
+policy_binding_profile = "review-pr"
+policy_assertions = [{source = "agents", statements = ["Every complete review
or recommendation uses Formal Review: `### Result`, one `Review Result: ...`
line, `### Evidence`, and `### Coverage`.", "This includes local candidates;
identify local-only changes in `### Coverage`."]}, {source = "review-pr",
statements = ["Use Formal Review Mode for every complete code review result or
recommendation, including pre-handoff review of a local candidate.", "Identify
a local candidate and its lo [...]
+critical = true
+
[[cases]]
id = "layered_response_when_details_needed"
group = "operations"
diff --git a/.codex/skills/review-pr/SKILL.md b/.codex/skills/review-pr/SKILL.md
index 6d0eb5b3029..386ea3546f2 100644
--- a/.codex/skills/review-pr/SKILL.md
+++ b/.codex/skills/review-pr/SKILL.md
@@ -5,7 +5,7 @@ description: >-
discussions from public or authorized repository evidence. Use for
code-correctness or
mergeability decisions, CI-focused review, root-cause and regression
analysis, complete
consolidated findings, copy-ready committer feedback, challenged findings,
multi-round
- review, and the repository completion loop's Local Candidate Preflight Mode.
+ review, and formal review of local implementation candidates in the
repository completion loop.
---
# Review PR
@@ -15,14 +15,11 @@ description: >-
Judge the latest reviewed scope from root cause, behavior, contracts, tests,
and
public or user-authorized repository evidence. Select one output mode:
-- `Formal Review Mode`: return one formal result for a PR review,
code-readiness
- judgment, mergeability decision, or CI review.
-- `PR Discussion Reply Mode`: return a copy-ready committer reply for a review
- thread, author or maintainer objection, or challenged finding. Do not add a
- formal verdict unless requested.
-- `Local Candidate Preflight Mode`: review an authorized local implementation
- targeting an existing PR and return findings to the repository completion
- loop. Do not describe local-only work as the public PR state.
+- `Formal Review Mode`: return one formal result for a public PR review,
authorized local-candidate review, code-readiness judgment, mergeability
decision, or CI review.
+- `PR Discussion Reply Mode`: return a copy-ready committer reply only when
the user explicitly requests a review-thread response, author or maintainer
objection reply, or challenged-finding reply. Do not add a formal verdict
unless requested.
+
+Use Formal Review Mode for every complete code review result or
recommendation, including pre-handoff review of a local candidate.
+Identify a local candidate and its local-only delta in `### Coverage`; do not
create a separate local-preflight result format or describe local-only work as
the public PR state.
## Review Focus
@@ -34,8 +31,7 @@ Review focus is independent from output mode.
| `Mergeability Review` | The user asks whether the PR can be merged,
approved, or landed | Review code and required CI or checks |
| `CI Review` | The user asks about checks, Actions, logs, or CI failures |
Treat CI evidence as the primary target |
-Explicit user scope wins. Local Candidate Preflight uses `Code Correctness
-Review` unless the user explicitly requests CI.
+Explicit user scope wins. Formal Review of a local candidate uses `Code
Correctness Review` unless the user explicitly requests CI.
In Code Correctness Review, unreviewed CI is not an evidence gap. Runtime facts
may still be required from code, official specifications, public reproductions,
@@ -51,14 +47,12 @@ confirmed findings consolidated by fix boundary,
needs-discussion conditions,
incomplete-evidence gaps, and Completion Gate state.
Output mode must not affect candidate discovery, proof, classification,
-coverage, or convergence. Never use a previous Local or Formal result as
+coverage, or convergence. Never use a previous Formal Review result as
evidence or as a conclusion to match. Treat previous public findings only as
hypotheses whose cited facts must be reverified.
Two reviews with the same effective candidate, requirements, focus, and
-evidence must produce the same canonical assessment. Local and Formal modes may
-resolve different candidates and render different status labels, but they must
-not apply different code-correctness judgment. A changed focus, requirement,
+evidence must produce the same canonical assessment. Public-PR and
local-candidate reviews may resolve different candidates, but they must apply
the same code-correctness judgment and Formal Review result mapping. A changed
focus, requirement,
or external fact changes the review basis and may legitimately change the
assessment. Mergeability or CI evidence may add external-state findings or
gaps, but it must not change code-correctness findings derived from an
otherwise
@@ -68,10 +62,7 @@ unchanged basis.
1. Review only. Do not modify PR code, post comments, submit reviews, resolve
threads, rerun workflows, or change remote state without explicit authority.
-2. Formal review scope is the latest target PR head and the complete GitHub
- changed-file list. Use local triple-dot semantics when reproducing it. A
- discussion reply starts from the latest head, thread context, and affected
- behavior; expand to complete scope only when the claim depends on it.
+2. Public-PR Formal Review scope is the latest target PR head and the complete
GitHub changed-file list; use local triple-dot semantics when reproducing it.
Local-candidate Formal Review scope follows `Local Candidate Scope` below. A
discussion reply starts from the latest head, thread context, and affected
behavior; expand to complete scope only when the claim depends on it.
3. Public community conclusions use only public evidence and sanitized
verification summaries. Private-repository conclusions may use authorized
repository evidence but must remain within the user-authorized task and
@@ -83,8 +74,7 @@ unchanged basis.
5. Treat every concern as a candidate until it passes the Finding Proof Gate.
6. Do not turn uncertainty, inaccessible evidence, tool failure, skipped
verification, or uninspected counter-evidence into a blocker.
-7. In Formal Review and Local Candidate Preflight, do not select a verdict,
- stop at the first blocker, or publish findings before the Completion Gate.
+7. In Formal Review, do not select a verdict, stop at the first blocker, or
publish findings before the Completion Gate.
Consolidate findings by independent fix boundary and return the complete
current-head set once. Only an explicit request for status, narrow review,
or
early high-risk blockers authorizes a partial result.
@@ -101,7 +91,7 @@ Read each applicable canonical reference directly through
EOF before judging the
- Read [non-regression
rules](../code-implementation/references/rules/non-regression.md) for
functional or performance regression assessment of any changed code candidate.
- Read [verification rules](../code-implementation/references/verification.md)
before choosing, running, or assessing local verification.
-Local Candidate Preflight invoked from an active implementation task may reuse
an applicable reference only when the outer workflow already read that exact
file through EOF.
+A Formal Review of a local candidate invoked from an active implementation
task may reuse an applicable reference only when the outer workflow already
read that exact file through EOF.
This Skill does not call `code-implementation` back, acquire write authority,
or create a circular workflow.
## Scope and Evidence
@@ -117,10 +107,7 @@ For formal reviews:
- Prefer PR facts, same-repository issues, code and tests, ShardingSphere
documentation and conventions, then external official specifications.
-For Local Candidate Preflight targeting an existing PR, resolve the same public
-requirements and code-correctness evidence before applying the authorized local
-delta. Record any explicit local requirement that extends the public PR scope
-as a distinct part of the review basis.
+For Formal Review of a local candidate targeting an existing PR, resolve the
same public requirements and code-correctness evidence before applying the
authorized local delta. Record any explicit local requirement that extends the
public PR scope as a distinct part of the review basis.
For discussion replies, establish the latest public head, complete thread
context, relevant earlier review, and affected production or test paths. Fetch
@@ -225,7 +212,7 @@ review.
## Completion Gate and Scripts
-Apply the Completion Gate to every Formal Review and Local Candidate Preflight.
+Apply the Completion Gate to every Formal Review.
Apply it to a discussion reply only when the reply makes or changes an overall
readiness conclusion.
@@ -247,10 +234,7 @@ readiness conclusion.
- Keep temporary ledger data private and remove only the exact ledger created
for the current review.
-If the gate cannot pass, return the mode-appropriate incomplete result. In
-Formal Review, when confirmed blockers coexist with a gap that could hide more
-blockers, list them as confirmed partial facts but do not present them as the
-complete change-request set.
+If the gate cannot pass in Formal Review, return `Review Incomplete`. In a
discussion reply, state the incomplete evidence without a formal verdict. When
confirmed blockers coexist with a gap that could hide more blockers, list them
as confirmed partial facts but do not present them as the complete
change-request set.
## Formal Decision Contract
@@ -259,7 +243,7 @@ evaluation:
1. If the gate fails, use `Review Incomplete`, even when some blockers are
already confirmed.
-2. If public evidence disproves the problem model, expected behavior,
ownership,
+2. If admissible evidence disproves the problem model, expected behavior,
ownership,
protocol or SQL semantics, compatibility assumption, or solution direction,
use `Not Mergeable` with `Feedback Mode: Needs Discussion`.
3. If at least one candidate passes the Finding Proof Gate, use `Not Mergeable`
@@ -271,23 +255,18 @@ pending CI prevents Mergeable in Mergeability Review. A
relevant CI failure is
a blocker when attributable to the PR and an incomplete gap when attribution is
unclear.
-## Local Candidate Preflight Mode
+## Local Candidate Scope
- Use the latest public PR head plus authorized local commits, index changes,
and working-tree changes as the effective candidate.
- Verify with read-only Git that local `HEAD` equals or descends from the
public
- head. Otherwise return `Local Preflight Result: Incomplete`.
+ head. Otherwise return `Review Incomplete`.
- Review from the public PR merge-base through the working tree. Scope is the
union of GitHub files and the authorized local delta; exclude unrelated local
changes.
-- Apply Code Correctness Review through the canonical assessment, including the
- same proof and completion gates, triggered high-risk criteria, and
- convergence loop.
-- Map a failed Completion Gate or needs-discussion condition to `Local
Preflight
- Result: Incomplete`, confirmed findings to `Local Preflight Result: Changes
- Required`, and a complete assessment with neither to `Local Preflight Result:
- Pass`.
-- Keep this Skill review-only. The outer active implementation loop fixes safe
in-scope findings and reruns preflight; scope expansion, architecture choices,
and high-risk actions return to their existing authorization gates. This Skill
never activates that loop.
+- Apply Code Correctness Review through the canonical assessment, including
the same proof and completion gates, triggered high-risk criteria, convergence
loop, and Formal Decision Contract.
+- State in `### Coverage` that the effective candidate includes authorized
local changes, identify their scope separately from the public PR, and never
present them as the public PR state.
+- Keep this Skill review-only. The outer active implementation loop fixes safe
in-scope findings and reruns Formal Review; scope expansion, architecture
choices, and high-risk actions return to their existing authorization gates.
This Skill never activates that loop.
## Multi-Round and Challenged Findings
@@ -316,6 +295,8 @@ logs, or emojis.
### Formal Review
+Use this format for both public-PR and local-candidate reviews.
+
- `Mergeable`: `### Result` with exactly one bold
`Review Result: Mergeable` line and a concise reason; `### Evidence`;
`### Coverage`.
@@ -335,11 +316,7 @@ For each blocking issue include:
- `Required Change` for Change Request, or `Discussion Needed` for Needs
Discussion.
-Do not add patch-level changes after selecting Needs Discussion. Do not include
-placeholder headings. In `### Coverage`, report the reviewed head,
authoritative
-requirements and files accounted for, behavior clusters, completed discovery
-lenses, unresolved gaps, and CI scope. In Code Correctness Review, state that
-the result is code-scope only and CI was not reviewed.
+Do not add patch-level changes after selecting Needs Discussion. Do not
include placeholder headings. In `### Coverage`, report the candidate type,
reviewed head, authoritative requirements and files accounted for, behavior
clusters, completed discovery lenses, unresolved gaps, and CI scope. For a
local candidate, identify authorized local commits, index changes, or
working-tree changes separately from the public PR state. In Code Correctness
Review, state that the result is code-scope o [...]
### PR Discussion Reply
@@ -347,13 +324,6 @@ Return only the copy-ready reply in the fenced Markdown
block. State whether the
finding is retained, withdrawn, or needs clarification, then give the public
evidence and minimum next action. Do not force a formal verdict.
-### Local Candidate Preflight
-
-Return `### Local Preflight`, exactly one bold Local Preflight Result line,
-confirmed required findings or needs-discussion conditions when present, and
-`### Coverage`. Identify the effective candidate, applicable requirements,
-review focus, and unresolved gaps in Coverage.
-
### Correction
Begin with `### Correction`, then `Previous Finding`, `Current Status`
diff --git a/.codex/skills/review-pr/references/evidence-access.md
b/.codex/skills/review-pr/references/evidence-access.md
index 23825a687c2..571159f7906 100644
--- a/.codex/skills/review-pr/references/evidence-access.md
+++ b/.codex/skills/review-pr/references/evidence-access.md
@@ -17,8 +17,8 @@
# Evidence Access
-Read this reference when a Formal Review, Local Candidate Preflight targeting
-an existing PR, or PR Discussion Reply requires current GitHub facts, or when
+Read this reference when a Formal Review of a public PR or local candidate,
+or a PR Discussion Reply requires current GitHub facts, or when
the selected review focus requires CI or Actions evidence.
## Public and Authorized Evidence Boundary
@@ -64,7 +64,7 @@ failure of one secondary endpoint does not make all GitHub
evidence unavailable.
Do not print or retain token values, redirect URLs, auth details, or raw large
responses.
-For Formal Review and Local Candidate Preflight targeting an existing PR:
+For Formal Review targeting an existing PR, including review of a local
candidate:
- Record the latest public head SHA, base ref and SHA, merge-base when local
Git
is used, and the authoritative changed-file list.
@@ -74,9 +74,9 @@ For Formal Review and Local Candidate Preflight targeting an
existing PR:
`/pulls/{number}/files` when both are available.
- Treat a mismatch or stale head as an incomplete scope, not as a PR blocker.
-For Local Candidate Preflight, apply the authorized local delta only after
+For Formal Review of a local candidate, apply the authorized local delta only
after
establishing that public context. Treat local implementation narratives and
-previous Local or Formal results as neither evidence nor conclusions to match.
+previous Formal Review results as neither evidence nor conclusions to match.
When an explicit local requirement extends the public PR scope, record it
separately rather than presenting it as public evidence.
diff --git a/AGENTS.md b/AGENTS.md
index 76715f6dff7..1b7000c1d1f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -158,7 +158,7 @@ Use the matching repository Skill when its trigger applies:
- Issue diagnosis and copy-ready maintainer replies: `$analyze-issue`.
- Unit-test generation or systematic coverage work: `$gen-ut`. This
code-changing workflow composes with `code-implementation`, including its
pre-write functional and performance non-regression assessment.
-- PR correctness, side effects, mergeability, GitHub review replies, or the
pre-handoff review of an authorized implementation targeting an existing PR:
`$review-pr`. For pre-handoff review, use its Local Candidate Preflight Mode.
Standalone review remains read-only and uses the direct reference routes above
without activating `code-implementation`.
+- Use `$review-pr` for PR correctness, side effects, mergeability, CI,
discussion replies, and pre-handoff review targeting a PR. Every complete
review or recommendation uses Formal Review: `### Result`, one `Review Result:
...` line, `### Evidence`, and `### Coverage`. This includes local candidates;
identify local-only changes in `### Coverage`. Use PR Discussion Reply only
when explicitly requested. Standalone review is read-only and does not activate
`code-implementation`.
If a matching specialized repository Skill is unavailable, apply an equivalent
manual checklist, record the fallback in the plan or final response, and
continue without installing it. Do not create a new Skill merely to hold
task-specific instructions.
