fix(audit): exclude OpenClaw agent workspaces from the rule surface - #36
Conversation
The last two "drifted" mirror families on saffron were forge/docs-site and openclaw-forge/docs-site. Neither is drift. Each is an OpenClaw agent workspace whose AGENTS.md is a persona — "You are Scout, working on the Atlas project", with a mission and Slack channel — sitting beside a CLAUDE.md of ai-rules coding imports. Two different kinds of file wearing the two contract names. Scored against each other they report permanent, unfixable drift, and acting on the recommendation would push an agent identity into every coding session in that directory. A directory is treated as a workspace when IDENTITY.md, SOUL.md, USER.md or SCRATCHPAD.md sits beside its AGENTS.md — the workspace file contract, not a path list, so this generalizes to any embedded workspace. Detection uses lstat rather than existsSync because those markers are typically symlinks into a mounted workspace and dangle in a plain checkout; every one of forge/docs-site's was dangling, which is why a first pass with existsSync saw none of them. On saffron this closes Stage A: duplication 0%, drifted 0, governance surface pass. Stages A, B and C now pass and the verdict moves from CRITICAL to NEEDS WORK, Structural Lint 56 -> 66. The only remaining blocker is Stage D context-load pressure, which is a real finding about rule volume.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 22 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
Comment |
1 participant
The last two "drifted" mirror families on saffron were
forge/docs-siteandopenclaw-forge/docs-site. Neither is drift.Each is an OpenClaw agent workspace whose
AGENTS.mdis a persona —— sitting beside a
CLAUDE.mdof ai-rules coding imports. Two different kinds of file wearing the two contract names. Scored against each other they report permanent, unfixable drift, and acting on the recommendation would push an agent identity into every coding session in that directory.Detection
A directory is a workspace when
IDENTITY.md,SOUL.md,USER.mdorSCRATCHPAD.mdsits beside itsAGENTS.md— the OpenClaw workspace file contract, not a path list, so it generalizes to any embedded workspace.Uses
lstat, notexistsSync. Those markers are typically symlinks into a mounted workspace and dangle in a plain checkout:Every one of forge/docs-site's was dangling, so a first pass with
existsSyncdetected none of them.Result on saffron — Stage A closes
Stages A, B and C all pass. The only remaining blocker is Stage D context-load pressure — a real finding about rule volume, not a scoring artifact.
Tests: three in
rule-surface.test.ts— a persona directory is skipped, dangling-symlink markers are still detected, and an ordinary repo is untouched. Suite 382 pass, plus the 2 knownnpm-on-PATH failures.