From d7901699a8c9a6132a1560d1fd1c8ae1ba9ef9ce Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 18 Aug 2026 02:49:54 +0000 Subject: [PATCH] firewall_gate: check PyAutoHands out now its leg has landed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PyAutoHands#237 cleared the last of issue #198's 9 tenant-firewall findings and added the `--only` gate to Hands' own PR CI. The Mind-side gate deliberately omitted the Hands checkout while Hands main still carried that finding — including it earlier would have reddened this workflow on drift it could not fix. That reason is now gone. With this, the gate verifies the checker against all three organ mains, so an allowlist over-grant or a check that stopped finding real drift fails the PR that authors it — for every organ, not two of three. Verified against a four-organ root before merging Hands' leg: the check reported the single Hands mismatch, and reported OK once the leg was applied. Negative probe re-run on the cleared tree: a bogus manifest name in the genericised file is still flagged. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_013xP1c7XRVQJzxoWAoH92GQ --- .github/workflows/firewall_gate.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/firewall_gate.yml b/.github/workflows/firewall_gate.yml index b27ee340..70e9b3a9 100644 --- a/.github/workflows/firewall_gate.yml +++ b/.github/workflows/firewall_gate.yml @@ -11,10 +11,10 @@ name: Tenant Firewall Gate # Path-filtered to scripts/repos_sync.py (plus this file): registry/prompt # pushes — the overwhelming bulk of Mind traffic — never trigger it. # -# PyAutoHands is deliberately NOT checked out yet: its firewall clear waits -# behind the version-stamp task that claims the repo (PyAutoHands#235 — see -# issue #198's checklist). Add its checkout when that leg lands; absent repos -# are skipped by the check itself. +# All three organs are checked out. PyAutoHands was omitted at first — its +# firewall clear waited behind the version-stamp task that claimed the repo +# (PyAutoHands#235) — and joined once that leg landed as PyAutoHands#237, +# clearing the last of issue #198's 9 findings. on: push: @@ -53,6 +53,11 @@ jobs: with: repository: PyAutoLabs/PyAutoHeart path: PyAutoHeart + - name: Checkout PyAutoHands + uses: actions/checkout@v4 + with: + repository: PyAutoLabs/PyAutoHands + path: PyAutoHands - name: Set up Python uses: actions/setup-python@v5 with: