ship: multi-vertical action surface-verification#63
Merged
Conversation
Action surface expansion. The bundle now includes calibrated detectors across migration, http, typescript, and authorization verticals: migration: DM-18 blocking; DM-15/16/17 warning; DM-28 info http: HTTP-01/02/03 warning typescript: TS-02/03 warning authorization: AUTH-01-service-layer warning CFG-01 (env config) is calibrated but substrate-only — its ancestor .env.example walk-up is incompatible with the action's no-clone GitHub Contents API model. See ACTION-EXPANSION-PLAN.md and SELECTION-FILTER.md in the verify-engine substrate repo for the full rationale. PR comment formatter rewritten to enumerate every vertical the action ran on and certify "no findings" explicitly when scans come back clean, so silence becomes a falsifiable claim instead of an absence of signal. Workflow simplified: removes the npm run build:action step that has been failing every PR since 2026-04-12. The bundle is the shipped artifact; rebuilding from substrate-only source files on every PR was a leftover from an earlier iteration and never belonged here. Bundle source: verify-engine commit 21e3bfc on claude/optimize-calibration-sessions-UGxuz. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
One trigger per shape across three verticals: - DM-18 (blocking): ALTER TABLE ... SET NOT NULL without backfill - HTTP-03 (warning): external fetch without AbortController/timeout - AUTH-01-service-layer (warning): Prisma findUnique without scope filter These exist for one purpose: confirm the action's new multi-vertical PR comment renders correctly on a real PR. They will be reverted in a follow-up commit once the comment has been observed and approved. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ards The detectors imported into the action bundle (http-03, http-01-v2, etc.) have CLI entry-point guards using `import.meta.main ?? require.main === module`. Under esbuild's CJS bundling, `import.meta.main` doesn't get rewritten and evaluates oddly at runtime, causing the guarded CLI block to fire at import time and abort with "usage: bun http-03-detector.ts <args>" before the action's run() can do anything. Surfaced by Verify run 24933090501 on this PR (10s failure with the usage line as the only output). Fix: pass --define:import.meta.main=false to esbuild so the guard short- circuits at bundle time. Inside the action bundle the CLI blocks are now unreachable; the standalone CLI usage of detectors continues to work because those scripts are run directly, not via this bundle. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The repo-permissions probe in src/action/github.ts misreads GitHub Actions installation tokens (push: false even when the workflow has the correct pull-requests: write grant). Earlier the preflight failed the action with process.exit(1); that blocks every legitimate GITHUB_TOKEN run inside Actions. Surfaced by Verify run 24933169992 on this PR. Demote to a console::warning. If commenting actually fails, postPRComment will surface the targeted 403 with the same fix-it message at the time it actually matters. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
❌ Verify1 blocking finding across 2 migration files and 2 TypeScript files. Migration vertical — 10 shapes enforced
HTTP vertical — 3 shapes enforced
TypeScript vertical — 2 shapes enforced
Authorization vertical — 1 shape enforced
CFG-01 (env config) is calibrated but enforced via the substrate, not this Action surface.
DM-18: To fix DM-18 (NOT NULL on non-empty table): add a Suppress a migration findingIf the migration targets a known-empty table, add a SQL comment: -- verify: ack DM-18 <reason> |
…ixture Two fixes from the surface test on PR #63. Bug 1 — catalog incompleteness: The migration vertical's catalog block listed only the calibrated shapes (DM-15/16/17/18/28). Grounding-gate shapes (DM-01..05) are not calibrated ledger rows, but they fire as severity:'error' from grounding-gate.ts and fail the build with the default fail-on:'error'. The catalog should enumerate them so a reader who sees DM-01 in the findings table knows it came from the action's enforcement surface, not from somewhere else. Added DM-01..05 to SHAPE_REGISTRY['migration'] with severity:'blocking' (they're blocking-by-effect even if not blocking-by-calibration), and added matching FIX_GUIDANCE entries. index.ts grows GROUNDING_SHAPES alongside BLOCKING_SHAPES so MIGRATION_SHAPES_RUN reflects what actually runs. Reworded the migration-only footer to make clear that "10 shapes across 6 verticals" refers to the calibrated catalog, not the runtime-enforced set this comment is enumerating. Bug 2 — DM-18 fixture too sparse: synthetic_dm18.sql ran ALTER TABLE users without a prior CREATE TABLE, so DM-01 (table not found) fired before DM-18 had a chance. Split into two ordered migrations: 0001_create_users.sql declares the table, 0002_dm18_trigger.sql carries the unsafe ALTER. DM-18 now fires as intended. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…hapes Bundle rebuild reflecting verify-engine commit 0232fb1. Two bugs fixed: 1. Migration-gate cloneSchema bug (substrate): shallow clone shared column references; gate's applyOp mutated caller's schema in place; subsequent gate evaluations on the same column saw the post-op state. DM-18 silently missed when grounding ran before safety on the same ALTER. Fix: deep-clone column objects in both grounding-gate.ts and safety-gate.ts cloneSchema. 2. PR-comment catalog incompleteness: grounding shapes (DM-01..05) fire as severity:'error' and fail the build, but the migration-vertical catalog block listed only calibrated rows. Reader saw `DM-01` in the findings table without finding it in the catalog. Added DM-01..05 to SHAPE_REGISTRY['migration'] with severity:'blocking' and matching FIX_GUIDANCE entries. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bundle rebuild reflecting verify-engine commit 11cdf7f. DM-18 now fails the build under fail-on:'error' as the calibrated blocking tier requires. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The synthetic fixtures served their purpose: PR #63 confirmed the multi-vertical comment renders correctly, all six new shapes (HTTP-01/02/03, TS-02/03, AUTH-01-service-layer) fire on real PR diffs, DM-18 surfaces as severity:'error' and correctly fails the build under fail-on:'error', and the substrate cloneSchema bug was caught. Reverting the fixtures so the public repo's PR-test artifacts don't permanently live in main. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ships the multi-vertical Verify action (9 calibrated shapes across migration, http, typescript, authorization verticals) and the simplified workflow that lets the committed bundle ship without a rebuild step.
Two commits:
0ffe42f— bundle update + workflow fixb54fb17— synthetic test fixtures (will be reverted after PR-comment observation)Test plan
This PR is the surface-verification test. The Verify action will run on this PR itself. Expected behavior:
__test-fixtures__/migrations/synthetic_dm18.sql)__test-fixtures__/synthetic_http03.ts)__test-fixtures__/synthetic_auth01.ts)fail-on: error)After observation:
v1tag.🤖 Generated with Claude Code