fix(work-items): loop-lane identity follow-ups (app-slug config, telemetry issue capture, marker rule conflict) #7207

Activity

1. kyle-sexton

   added

   priority: mediumReal value, no hard deadline; normal backlog flow.Real value, no hard deadline; normal backlog flow.

   on Oct 11, 2026
2. github-actions commented on Oct 11, 2026

   

   github-actionsBot

   on Oct 11, 2026 – with GitHub Actions

   Contributor

   More actions

   Thanks for filing this. I read it as four distinct follow-ups from the #7161/#7204 and #7167/#7202 work, each independently fixable:

   1. Add a shared userConfig key for --app-slug so work-loop's lane-telemetry-upsert.sh, babysit-loop's telemetry-upsert.sh, and harness-ops' restart-consumer.sh (fix(harness-ops): restart-consumer reads restart_request from any sentinel comment #7203) can resolve a write identity under an App token without relying on the launch prompt.
   2. Require the telemetry issue's author to match the lane's write identity (same resolution order as fix(source-control): only adopt babysit-loop telemetry comments the lane wrote #7202), so an arbitrary issue with a matching title can't be mistaken for the lane's own telemetry issue.
   3. Reconcile the conflicting escalation-marker rules in escalation-marker.md and c3-ratification-queue.md so a C3 ratification comment can't reappear after its role label is removed.
   4. Give harness-ops' telemetry-upsert.sh (~line 379) the same --app-slug identity resolution as fix(source-control): only adopt babysit-loop telemetry comments the lane wrote #7202/fix(harness-ops): read restart requests only from the lanes' write identity #7206, since it currently only checks gh api user.

   Items 2 and 4 touch write-identity/authorization for telemetry, so I've tagged this for security visibility. Nothing is missing for scoping; each item references its own file. No duplicates found, though it's closely related to #7167, #7202, #7203, and #7206.

   _{Automated triage. A maintainer reviews it.}
3. github-actions

   added

   area: securitySecurity-relevant: vulnerability, hardening, or disclosure follow-up.Security-relevant: vulnerability, hardening, or disclosure follow-up.

   on Oct 11, 2026
4. kyle-sexton

   added

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   on Oct 15, 2026
5. kyle-sexton

   added the

   Bug

   issue type on Oct 15, 2026
6. kyle-sexton

   added a parent issue on Oct 16, 2026

   • pr-pipeline: agents push and label as the GitHub App identity #7558
7. kyle-sexton

   added sub-issues on Oct 18, 2026

   • fix(harness-ops): resolve the lane telemetry comment's write identity under an App token #7999
   • feat(work-items): supply work-loop telemetry's --app-slug from a lane_app_slug userConfig key #8000
   • feat(source-control): supply babysit-loop telemetry's --app-slug from a lane_app_slug userConfig key #8001
   • feat(harness-ops): supply the restart consumer's and lanes telemetry's --app-slug from a lane_app_slug userConfig key #8002
   • docs(work-items): make the C3 ratification marker's at-most-one-ever rule an exception to label-scoped suppression #8003
8. kyle-sexton commented on Oct 18, 2026

   

   kyle-sexton

   on Oct 18, 2026

   MemberAuthor

   More actions

   This was generated by AI during backlog shaping.

   This issue is split into 6 pieces, each sized for one lane PR. Four independent follow-ups, and three still hold as written on origin/main. No plugin declares an app-slug userConfig key. harness-ops telemetry-upsert.sh resolves identity only through gh api user. The two marker rules still disagree. The config-key work spans three plugins at about 5 files each, so it splits per plugin. The trusted-author lookup leaves open whether a telemetry issue a person opened is still valid.

   • filed: fix(harness-ops): resolve the lane telemetry comment's write identity under an App token (fix(harness-ops): resolve the lane telemetry comment's write identity under an App token #7999)
   • filed: feat(work-items): supply work-loop telemetry's --app-slug from a lane_app_slug userConfig key (feat(work-items): supply work-loop telemetry's --app-slug from a lane_app_slug userConfig key #8000)
   • filed: feat(source-control): supply babysit-loop telemetry's --app-slug from a lane_app_slug userConfig key (feat(source-control): supply babysit-loop telemetry's --app-slug from a lane_app_slug userConfig key #8001)
   • filed: feat(harness-ops): supply the restart consumer's and lanes telemetry's --app-slug from a lane_app_slug userConfig key (feat(harness-ops): supply the restart consumer's and lanes telemetry's --app-slug from a lane_app_slug userConfig key #8002)
   • filed: docs(work-items): make the C3 ratification marker's at-most-one-ever rule an exception to label-scoped suppression (docs(work-items): make the C3 ratification marker's at-most-one-ever rule an exception to label-scoped suppression #8003)
   • not filed: fix(harness-ops): accept a lane telemetry issue only from a trusted author: owner-decision: which authors make a telemetry issue valid (only the lanes' write identity, or also the repo's write/admin holders who open one by hand), and which lookups must enforce it (restart consumer, morning-brief, work-loop and babysit-loop discovery)

   Filed pieces are sub-issues of this one, and the paced queue admits them to the lane. Unfiled pieces wait on the blocker shown. The owner approved this split in an attended backlog-shaping session on 2026-10-18.
9. kyle-sexton commented on Oct 18, 2026

   

   kyle-sexton

   on Oct 18, 2026

   MemberAuthor

   More actions

   Decision recorded.

   Question: Lanes find their telemetry issue by searching for its exact title, and anyone can open an issue with that title. The fix makes the issue's author count. The open question is which authors are trusted. Options: (a) only the lane's write identity (the issue's own wording); (b) the lane's write identity plus anyone with write, maintain or admin access to the repository; (c) no author check, relying on the existing check of each comment's author.

   Owner's answer: (b). Every existing telemetry issue (#7396, #3742, #3739 and older ones) was opened by kyle-sexton. Under (a), a lane that moves to an App token, which children 1-3 of this split prepare for, would reject all of them and lose their labels and history. Someone with write access can already edit lane state, so trusting them adds no new attacker. Apply it to every lookup: the restart consumer, morning-brief, and work-loop and babysit-loop discovery. Basis: gh issue list --search "Lane telemetry in:title" output this session; restart-consumer.sh:102-113 (comment-author filter and identity order), :867, :1236 (title search).

   The owner accepted this recommendation as item D1 of a 17-decision batch in an attended backlog-shaping session on 2026-10-18. The batch question: "Accept all 17 batch 5 decisions as recommended, D1, D2, D3, D5 and D17 included? I post a quoted 'Decision recorded.' comment on each of the 11 issues." The owner answered: "Accept all 17 (Recommended)".

   Posted by AI from the owner's answer in that session.
10. kyle-sexton

    added

    status: confirmedA maintainer confirmed the item is real and in scope; ready to be worked.A maintainer confirmed the item is real and in scope; ready to be worked.

    and removed

    needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

    on Oct 19, 2026
11. kyle-sexton commented on Oct 28, 2026

    

    kyle-sexton

    on Oct 28, 2026

    MemberAuthor

    More actions

    Re-triage.

    Sub-issues, all closed (completed):

    • fix(harness-ops): resolve the lane telemetry comment's write identity under an App token #7999: fix(harness-ops): resolve the lane telemetry comment's write identity under an App token #8664 (ad020d0), harness-ops telemetry write identity under an App token (item 4).
    • feat(work-items): supply work-loop telemetry's --app-slug from a lane_app_slug userConfig key #8000: feat(work-items): supply work-loop telemetry's --app-slug from a lane_app_slug userConfig key #8155 (21bb890), work-loop lane_app_slug (item 1).
    • feat(source-control): supply babysit-loop telemetry's --app-slug from a lane_app_slug userConfig key #8001: feat(source-control): supply babysit-loop telemetry's --app-slug from a lane_app_slug userConfig key #8164 (f06240c), babysit-loop lane_app_slug (item 1).
    • feat(harness-ops): supply the restart consumer's and lanes telemetry's --app-slug from a lane_app_slug userConfig key #8002: feat(harness-ops): supply the restart consumer's and lanes telemetry's --app-slug from a lane_app_slug userConfig key #10164 (93251ed), restart consumer and lanes lane_app_slug (item 1).
    • docs(work-items): make the C3 ratification marker's at-most-one-ever rule an exception to label-scoped suppression #8003: docs(work-items): make the C3 ratification marker's at-most-one-ever rule an exception to label-scoped suppression #8157 (b0286b7), C3 marker rule reconciled (item 3).

    Item 2 is still open. The owner decided it on 2026-10-18 (Decision recorded. on this issue, D1): option (b), trust the lane's write identity plus anyone with write, maintain or admin access to the repository, and apply that to every lookup. It is not built. On origin/main:

    • plugins/harness-ops/skills/lanes/scripts/restart-consumer.sh:878-885: resolve_issue_by_title picks the lowest-numbered open issue whose title matches. It is called at :1080 and :1253.
    • The same file at :1250-1252 takes the first gh issue list --search "loop-lane telemetry running per-lane status in:title" hit.
    • plugins/harness-ops/skills/morning-brief/scripts/morning-brief.sh:245: TELEMETRY_SEARCH matches by title.
    • plugins/source-control/skills/babysit-loop/SKILL.md:296 and plugins/work-items/skills/work-loop/SKILL.md:74: the default telemetry issue is "the open issue titled ... (exact match)".

    This narrows a control on a decided rule, with no workflow path, so it is lane work.

    Done when:

    • Every code path that resolves a lane telemetry issue by title (at least the sites listed above; search for others that build the title from a variable) accepts a candidate issue only when its author is the lane's resolved write identity (the fix(source-control): only adopt babysit-loop telemetry comments the lane wrote #7202 resolution order, lane_app_slug included), or a user whose repository permission is write, maintain or admin. A candidate that fails the check is skipped with a warning naming its number and author, and the next match is tried.
    • A failed permission read is reported as an error. It is never treated as trusted, and never as "no telemetry issue".
    • Each changed script has tests for three cases: an issue by the write identity is accepted, an issue by a write-access user is accepted, and an issue with the same title by a read-only or unknown author is skipped.
    • The two SKILL.md defaults state the author rule. A changelog fragment is added for each touched plugin.
12. kyle-sexton

    added

    status: readyTriaged, unblocked, and fully specified; eligible to pick up.Triaged, unblocked, and fully specified; eligible to pick up.

    and removed

    status: confirmedA maintainer confirmed the item is real and in scope; ready to be worked.A maintainer confirmed the item is real and in scope; ready to be worked.

    on Oct 28, 2026
13. melodic-automation-lanes

    added

    status: confirmedA maintainer confirmed the item is real and in scope; ready to be worked.A maintainer confirmed the item is real and in scope; ready to be worked.

    and removed

    status: readyTriaged, unblocked, and fully specified; eligible to pick up.Triaged, unblocked, and fully specified; eligible to pick up.

    on Oct 29, 2026
14. melodic-automation-lanes commented on Oct 29, 2026

    

    melodic-automation-lanesBot

    on Oct 29, 2026

    Contributor

    More actions

    Not admitted to the issue lane: Size unset is not one of small, medium; Uncertainty unset is not one of known, knowable. Admission takes the issue once each of those is met, when intake triages it again (.github/actions/resolve-config/admission-rules.json).
15. kyle-sexton commented on Oct 29, 2026

    

    kyle-sexton

    on Oct 29, 2026

    MemberAuthor

    More actions

    Scope narrowed: item 2 (require the telemetry issue's author to be the lane's write identity) guards against our own actors. It is deferred under the owner's hardening deferral (owner decisions Q15/Q16, 2026-10-29: hardening returns as configuration once open issues and open PRs reach 0). Items 1 (app-slug config key), 3 (marker rule conflict) and 4 (harness-ops telemetry identity under App tokens) stay in scope.
16. kyle-sexton

    added a sub-issue on Oct 30, 2026

    • fix(harness-ops): accept a title-matched lane telemetry issue only when the lane's write identity authored it #11119
17. melodic-automation-lanes commented on Oct 30, 2026

    

    melodic-automation-lanesBot

    on Oct 30, 2026

    Contributor

    More actions

    Every sub-issue of this split is closed by a listed human or a merge (#7999, #8000, #8001, #8002, #8003, #11119), so the lanes App closes it as completed.
18. melodic-automation-lanes

    closed this as completedon Oct 30, 2026