[kyle-sexton]

Refs: #12558

Summary

Both hosted review lanes now count verify-legacy-fails.json as read, through ci-workflows' generated-data input (ci-workflows#971).

Fix

• The file is 184 KB of generated verdict records (550 FAIL artifacts). The review lanes cannot read it whole, so every review of feat(source-control): commit the legacy FAILs file to turn on FAIL index mode #12558 ended failure-class=partial (run 41556656275).
• New list scripts/review-generated-data.txt, beside scripts/shared-copies.txt, names it.
• pr-review-hosted.yml and pr-review-security-hosted.yml pass the list as generated-data. The lane reads it at the merge base, so no pull request can exempt its own files. A path matching SENSITIVE_PATHS or a hold path is never exempted, and gitleaks still scans the file.

Verification

• ci-workflows#971: 1056 node tests pass, including the merge-base-only and SENSITIVE_PATHS exceptions.
• After this merges, feat(source-control): commit the legacy FAILs file to turn on FAIL index mode #12558 merges main and its review lanes re-run against a base that holds the list.

Related

• feat(source-control): commit the legacy FAILs file to turn on FAIL index mode #12558 (commits the file and turns on FAIL index mode)
• ci-workflows#971 (the input)

🤖 Generated with Claude Code

https://claude.ai/code/session_01VcupomBPg7kuobwLoNpxEW

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T02:09:00.333598Z	97abd5c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review: 1 inline finding(s) on 97abd5cc4bc7c8c7fdf1a9166bb1e93d9efe11af; the summary is in this lane's pull request comment.

claude-lane: claude-security-review

[github-actions]

claude-security-review needs no new review of 80dd9b0a624f2dbd15aaed670b0f4a64d1e361aa: no file of this pull request changed since the review of d2b3ece.

Security review: PR #12601 (incremental, 97abd5c → d2b3ece)

No security issues found and no hold. This round covers one file, scripts/review-generated-data.txt, and I read its whole change.

What changed. Only the list's header comment changed. The comment now says what the loader checks: structure only, never content. It also says a listed path stays only while the commit that adds the file lands, and is removed once that commit is on main. The listed path (verify-legacy-fails.json) is the same, and the two workflows that pass the list as generated-data are unchanged since the last review.

Earlier finding. Last round I raised one IMPORTANT finding: the generated-data exemption would let a later pull request change the merge gate's legacy-FAILs file without either review lane reading it. That thread is now settled by the owner's reply, and the settled-threads file records no line changes since it was resolved. The reply states a decision:

• the entry exists only for feat(source-control): commit the legacy FAILs file to turn on FAIL index mode #12558's one-time add;
• a follow-up removes it once feat(source-control): commit the legacy FAILs file to turn on FAIL index mode #12558 is on main;
• until then, ci-workflows#971's 7500-byte floor keeps small edits (such as deleting one FAIL record) under review.

The new header records that plan. The finding was IMPORTANT, not CRITICAL, and this round touches no code the reply relies on, so I have not raised it again.

Still open. The removal is a written plan, not something enforced. The exemption stays live until that follow-up merges.

Other checks

• No new untrusted text reaches a lane, and no token, permission, trusted-actor list or kill switch is touched.
• No plugin manifest changed, so there are no manifest lines.
• No standing instruction is deleted or narrowed. The header gets more precise; it is not weakened.
• Nothing in the PR context or the settled-threads file tries to direct this review.
• Spend: none.

critical-findings: 0

[github-actions]

claude-review: 1 inline finding(s) on 97abd5cc4bc7c8c7fdf1a9166bb1e93d9efe11af; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review needs no new review of 80dd9b0a624f2dbd15aaed670b0f4a64d1e361aa: no file of this pull request changed since the review of d2b3ece.

Code review: PR #12601 (incremental, 97abd5c → d2b3ece)

Scope: this push changed one file, scripts/review-generated-data.txt. I read its whole change: the header comment was rewritten and the list entry is untouched.

Result: no findings.

My last advisory said the header claimed each listed file is "checked by its own loader", when verify-legacy-fails.json's loader only checks its structure. The new header fixes that:

• It now says the loader "checks its structure only, never its content".
• It limits the exemption to the commit that adds the file. The entry is removed once that commit is on main, and after that, edits get a full review.

That matches the owner's replies on both threads, and the settled-threads file marks both lines changed since resolution: no. I found no new problem in the rewritten lines.

Prior findings: the one inline advisory from the last round (discussion_r4450160296) is resolved by this change, so I have not reposted it. This is round 2 of 3, not past the cap.

Still open, not a finding: the header's removal rule is a process commitment, and nothing enforces it. The plan is a follow-up PR that drops the entry once #12558 is on main. Until then, an edit to the file in another PR would still count as read. The owner's reply says ci-workflows#971's 7500-byte floor keeps small edits under review in that window. That is author-claimed, and I did not check it. Someone should make sure the follow-up actually lands.

Carried over from last round, still unchecked: both callers pin pr-review-cli.yml@main. The new generated-data input needs ci-workflows#971 to be on ci-workflows main when this merges, and I cannot see its merge state from here.

Other checks:

• Closing issues: none ("Refs: feat(source-control): commit the legacy FAILs file to turn on FAIL index mode #12558" only).
• I found no instructions embedded in the PR context or thread text.
• No new spend or cost surface.

[github-actions]

Post-merge mutation testing

• Range: ba58bb7..cf5a569
• Merged pull request: #12601
• Outcome: reported

Killed 6, survived 1, timeout 0, no coverage 0, invalid 0, not run 0.
Covered-code score 86%; mutation score 86%.

File	Killed	Survived	Timeout	No coverage	Invalid	Not run
plugins/discovery/scripts/check-claim-eligibility.py	3	1	0	0	0	0
plugins/discovery/scripts/check-restatement-labels.py	3	0	0	0	0	0

Surviving mutants

Location	Operator	Disposition	Cause
plugins/discovery/scripts/check-claim-eligibility.py:130	SBR	productive	input-gap

The run's summary has the full report.