fix(review_receipt): a risk:high PR needs an own receipt on its exact head; no carried SHIP counts

Merged
LA
7d ago
+53-10

Summary

cmux-ad decided on 2026-10-30 (decision 788) that a risk:high PR needs a review receipt on its exact head. docs/ci/risk-tiers.md:21 already says this. The reason: a base merge can change what a risk:high patch does even when there is no conflict.

next-autoland now applies the rule (cmuxterm-hq#5420, exact_receipt). But gh-merge-green's matcher, scripts/ci/review_receipt.py, still accepted a carried SHIP line (Review (...; carried): SHIP at <head> or "... carried from ...") for risk:high. That is a second path to the same gate.

With this change:

  • The review read also asks for the PR's labels.
  • For risk:high, ship_receipt ignores carried lines (exact=True), and the refusal message says why.
  • risk:normal and risk:low keep the carry.

After this merges, cmuxterm-hq's byte-identical copy (tools/agent-guards/review_receipt.py and its .source pin) needs an update.

Testing

  • python3 tests/test_review_receipt.py: 5 failures on main and 48 OK at the head. The new RiskHighExactHead tests cover:
    • both carried-line forms are refused for risk:high (in any case) and still pass for risk:normal, risk:low and no tier;
    • an own SHIP or an approval of the exact head passes;
    • a newer BLOCK still takes the receipt back.
  • python3 tests/test_gh_merge_green.py: 169 OK.
  • python3 scripts/verify-local.py --affected origin/main: 16 of 16 checks passed.

Observed / Not run

  • Observed: the unit tests above.
  • Not run: a live gh-merge-green merge.

Changelog

none

Risk: this changes an enforcer of the risk gate (gh-merge-green). It merges only on an independent review receipt on the exact head.

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Enforces that a risk:high PR requires an independent review receipt on its exact head; a carried SHIP no longer counts for it. A base merge can change what a risk:high patch does even without a conflict, so docs/ci/risk-tiers.md already demands an exact-head receipt; next-autoland applies this rule but gh-merge-green's matcher still accepted carried SHIP lines.

  • The review read now also fetches the PR's labels to detect the risk:high tier (any case).
  • For risk:high, ship_receipt ignores carried receipts (exact=True), and the refusal message says why.
  • risk:normal and risk:low PRs keep the existing carry behavior.
  • After this merges, cmuxterm-hq's byte-identical copy (tools/agent-guards/review_receipt.py and its .source pin) needs the same update.

Summary by CodeRabbit

  • New Features
    • Pull requests labeled risk:high now require an independent SHIP receipt or approval for the exact commit being reviewed. A SHIP receipt carried over from an earlier commit does not meet this requirement.
  • Bug Fixes
    • Other label configurations continue to accept carried SHIP receipts, and a newer BLOCK on a different commit continues to prevent approval.