f48dd2f20b
All-Bun sub-agent that watches open PRs on Gitea, reads ship-claims, and hard-blocks merges when the code doesn't back the claim. First commit of N; this is the skeleton. Dynamic/static/inference/kb checks + poller land in follow-up commits on this same branch. - auditor/types.ts — Claim, Finding, Verdict, PrSnapshot shapes - auditor/gitea.ts — minimal API client (listOpenPrs, getPrDiff, postCommitStatus, postReview). Live-proven: returned 0 open PRs against our repo (which IS the current state — every commit today went to main directly, which is the problem this auditor is meant to prevent) - auditor/policy.ts — stub `assembleVerdict` + severity rules. Intentionally conservative defaults: strong claim + zero evidence = block, not warn. - auditor/README.md — how to run + the hard-block mechanism Workflow discipline change: starting with this branch, no more direct pushes to main. Every change lands as a PR. When this auditor is fully built and running, it'll review its own completion PR — the recursive self-test. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
66 lines
2.4 KiB
TypeScript
66 lines
2.4 KiB
TypeScript
// Shared types for the claim-auditor. Every field exists for a reason;
|
|
// if something can't be verified from a check, it goes into `evidence`
|
|
// so the verdict is inspectable, not a black box.
|
|
|
|
export type CheckKind = "static" | "dynamic" | "inference" | "kb_query";
|
|
|
|
export type Severity = "info" | "warn" | "block";
|
|
|
|
export interface Claim {
|
|
// Verbatim phrase that raised the claim — e.g. "Phase 38 shipped",
|
|
// "verified end-to-end", "works after restart". Used as the "what
|
|
// does the author assert" input to downstream checks.
|
|
text: string;
|
|
// Where it came from. `commit_sha` is the short hash; `location`
|
|
// is a file:line for in-diff claims, or "pr_body" / "commit_message".
|
|
commit_sha: string;
|
|
location: string;
|
|
// Heuristic rating of how strong the claim is. "green+tested"
|
|
// is strong; "should work" is weak. Drives sensitivity — stronger
|
|
// claims get harder-blocked on weak evidence.
|
|
strength: "weak" | "moderate" | "strong";
|
|
}
|
|
|
|
export interface Finding {
|
|
check: CheckKind;
|
|
severity: Severity;
|
|
claim_text?: string;
|
|
// Free-form short description: "field added but never read", "no
|
|
// test covers this code path", "cloud model says placeholder".
|
|
summary: string;
|
|
// Concrete evidence: file paths, line numbers, log excerpts, test
|
|
// output, cloud-model verdict. No handwaving.
|
|
evidence: string[];
|
|
}
|
|
|
|
export interface Verdict {
|
|
pr_number: number;
|
|
head_sha: string;
|
|
audited_at: string;
|
|
overall: "approve" | "request_changes" | "block";
|
|
findings: Finding[];
|
|
// Real numbers that downstream policy can gate on. e.g. if the
|
|
// hybrid test produced latency numbers or token counts, they
|
|
// surface here so /auditor/history is queryable.
|
|
metrics: Record<string, number>;
|
|
// Short one-line justification for the `overall` verdict. What
|
|
// gets posted as the commit-status description in Gitea (max 140
|
|
// chars) must fit here.
|
|
one_liner: string;
|
|
}
|
|
|
|
export interface PrSnapshot {
|
|
number: number;
|
|
head_sha: string;
|
|
base_sha: string;
|
|
title: string;
|
|
body: string;
|
|
state: "open" | "closed" | "merged";
|
|
author: string;
|
|
// Array of commit messages in the PR (not diffs — those are
|
|
// fetched on-demand per-check).
|
|
commits: Array<{ sha: string; message: string; author: string }>;
|
|
// File paths touched by the PR, with lines-added / lines-removed.
|
|
files: Array<{ path: string; additions: number; deletions: number }>;
|
|
}
|