Skip to content

agent-preflight silently SKIPS the commit-trailer gate on any branch that has not merged main, so every 'all gates green' on a work-in-progress branch is unverified #841

Description

@localai-bot

Claim

scripts/agent-preflight.sh:222-225 guards the trailer check:

# Trailer enforcement reads only committed Git objects.
if git rev-parse --verify -q origin/main >/dev/null 2>&1 &&
   git merge-base --is-ancestor origin/main HEAD &&
   [ "$(git rev-list --count origin/main..HEAD 2>/dev/null || echo 0)" -gt 0 ]; then
  echo "Commit trailers vs origin/main:"
  run "commit-trailers" python3 scripts/check-commit-trailers.py --range "origin/main..HEAD"

git merge-base --is-ancestor origin/main HEAD is false for any branch that has not yet merged current main — which is the normal state of a row branch for most of its life, especially on this repo where origin/main moves several times an hour.

When it is false the gate does not run, and preflight prints no line at all for it. The run reports green. So "preflight all gates green" on a work-in-progress branch is not evidence that trailers are correct; it is evidence that nobody looked.

How it surfaced

On row/VT-FP8-W8A8-CPU-ARM (#468), seven commits carried

Assisted-by: AGENT:claude-opus-5[1m] [claude-code]

which check-commit-trailers.py rejects: [attribution] malformed Assisted-by value. The regex requires a space before the bracket group, so claude-opus-5[1m] is not a valid model token.

Every preflight run on that branch had reported all gates green. The defect only became visible after origin/main was merged in — at which point the ancestor test flipped true, the gate ran for the first time, and redded every commit. The repair then required rewriting all seven commit messages, which turned a plain push into a non-fast-forward one and needed a new branch to land without force-pushing.

The cost is not the malformed trailer. It is that the check was reported as passing when it had not executed — the same class as a test that reports Passed 0.00 sec with zero assertions, or a cases >= N floor set below the real count. An instrument that cannot say what it examined has not reported.

Corroboration: it has already leaked into main

At least two commits already on main carry the same malformed Assisted-by value. They could not have reached main if the gate had run on their branches.

What done looks like

  1. The trailer gate must run on every branch with commits, comparing against the merge base (git merge-base origin/main HEAD) rather than requiring origin/main to be an ancestor. The merge base is well-defined whether or not main has been merged in, and origin/main..HEAD already resolves to it for the common case.
  2. When a gate is genuinely not applicable, preflight must say so by name and count it as skipped rather than printing nothing. A silent omission and a pass are indistinguishable in the output, which is what made this invisible.
  3. Audit the other conditional blocks in this script for the same shape — doc-checkpoint range immediately above sits inside a similar guard.
  4. Repair the trailers already on main, or record them as accepted debt with the reason, in whichever direction a reviewer prefers.

Found while landing #468.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions