Fail closed on incomplete project priority audits

[Chris0Jeky]

Summary

• Traverse every ProjectV2 page and require a stable, complete snapshot before reporting clean.
• Fail closed on incomplete/unstable project data, invalid same-repository Issue labels, source or write-plan drift, option-shape drift, and partial writer failures.
• Derive PR Priority from complete typed references while recording external Issues as visible non-authority: their labels never rank, external-only PRs derive Priority V, and same-repository body fallback remains available after an external closing reference.
• Validate the complete plan before mutation, fingerprint ignored-reference evidence, always audit after any write attempt, and report verified post-Apply state.
• Run the authentication-free parser/SelfTest gate in Required CI and document the operator contract.

Live data remediation

• Classified and verified all 130 previously unlabeled Taskdeck Issues with exactly one Priority label: I=5, II=9, III=2, IV=18, V=96.
• Pre-Apply guarded snapshot: 1,472/1,472 unique project items; 665 Issues, 807 PRs, no other or cross-repository project content.
• Pre-Apply field drift after the closing directive was validated: 141 items (131 Issues and 10 PRs); 12 external Issue references were recorded as ignored non-authority.
• Reviewed Apply: 141/141 attempts succeeded.
• Built-in complete post-Apply audit: zero remaining drift.
• Separate fresh read-only audit at project updatedAt=2026-07-27T01:28:11Z: 1,472/1,472 items across 15 pages, 12 ignored external references, zero updates.

Exact-head local verification

Head: e78a6ef18c070c360c9a1807f74a22ae564b5e78

• PowerShell parser: passed.
• Windows PowerShell 5.1 SelfTest: 64/64.
• Compatibility SelfTest: 64/64.
• Linux PowerShell 7.4 container SelfTest: 64/64.
• Docs governance, Golden Principles, and GitHub operations governance: passed.
• Failure-ledger tests: 11/11; hook smoke matrix passed.
• Actionlint 1.7.12: passed.
• Diff check: passed.
• DCO: 16/16 branch commits signed.
• Two independent exact-head reviews found one shared canonical-doc drift; fixed in e78a6ef1. No implementation, correctness, security, or data-integrity findings remain locally.
• GitHub closing-reference set: exactly the same-repository implementation issue.

Remaining merge gate

Hosted exact-head CI, CI Extended, CodeQL, fresh Codex review triage, and final conversation/thread inspection remain required before merge.

Closes #1458

[Chris0Jeky]

Adversarial correctness review — changes requested

Reviewed exact head 8c6c5285271b3907e9f38ccc1a044ba278fa547f. Before reviewing, I checked all PR conversation surfaces: 0 issue comments, 0 inline comments, 0 submitted reviews, and 0 review threads.

MEDIUM — the default audit can still certify a policy-mismatched PR priority

At scripts/github/Sync-TaskdeckProjectPriority.ps1:869-875, a PR with no derived issue and any existing non-empty Priority has needsUpdate reset to false unless -StrictFallbackPriority is supplied. That conflicts with the required policy in docs/GITHUB_PROJECT_AUTOMATION.md:88-94, which says no-derived-issue PRs must be Priority V, and with #1458's acceptance criterion that the final audit prove no mismatched PR Priority. The new canonical verification commands also omit -StrictFallbackPriority, so complete: true / needsUpdate: 0 can still be a false clean result (for example, a no-reference PR already set to Priority I).

Expected fix: make policy-exact fallback checking the clean-audit default (or make every canonical final-audit invocation strict and prevent non-strict mode from claiming policy-clean), and add a regression where a no-reference PR has an existing non-V priority and must be reported for update.

MEDIUM — linked closing issues are not part of PR priority derivation

The ProjectV2 query at scripts/github/Sync-TaskdeckProjectPriority.ps1:67-82 retrieves only PR body/labels, and lines 843-852 derive solely from regex matches in the body. The required derivation order in docs/GITHUB_PROJECT_AUTOMATION.md:88-94 says closingIssuesReferences comes first. A PR linked through GitHub's Development relationship but without a matching body token is therefore treated as “no derived issue” and can be assigned/preserved at the wrong priority.

Expected fix: retrieve and completeness-check closingIssuesReferences (including repository identity and priority labels), derive from those before body references, and add a regression for a closing issue link absent from the PR body.

MEDIUM — the pre-Apply stamp does not cover the inputs used to build the write plan

Lines 895-900 compare only ProjectV2 totalCount and updatedAt. Expected priorities, however, are derived from Issue labels and PR body/reference data. Those are separate content objects and are never compared again after the long pagination/audit pass. A label/body/reference change can therefore leave the checked project stamp unchanged while the script applies a stale priority plan; there is also an unavoidable check-to-first-write window. The documented post-audit detects damage after the write but does not prevent it.

Expected fix: immediately before mutation, recompute and compare the complete source-derived update plan (or re-read/compare each affected source and current field before its write), abort with zero writes on drift, and add an injected regression proving source drift produces no item-edit calls. Keep the post-Apply complete audit because the batch remains non-transactional.

LOW — deterministic option-shape failure can occur after partial writes

Lines 902-919 validate each expected Priority option inside the mutation loop. If an early update uses a valid option and a later update references a missing/drifted option, the early write lands before the helper throws. This is an avoidable partial-apply error path.

Expected fix: validate the entire update plan and all option IDs before the pre-Apply stamp and before the first mutation; cover “later option missing => zero writes” in the Apply-path regression tests.

Evidence

• PowerShell parser: 0 errors.
• -SelfTest: 17/17 passed.
• Live -Limit 1000 -Json: exited 1 as expected at 1,459 items.
• Complete live read-only -Json: traversed the project and exited 1 on the same 130 invalid issue-label items.
• No -Apply invocation and no repository/project mutation performed.

The cursor pagination, ordinal item/cursor handling, stable page count/stamp checks, nested-connection truncation guards, and invalid-issue-label fail-closed behavior otherwise held under this review.

[Chris0Jeky]

Independent project-automation safety review — changes requested

Reviewed exact head 8c6c5285271b3907e9f38ccc1a044ba278fa547f with a project-automation/data-policy lens. Before reviewing, I checked all PR issue comments, review summaries, inline comments, and review threads; all four sets were empty at this head.

MEDIUM

1. PR reference derivation can silently choose Priority V for a PR whose linked/referenced issue has a different priority.
   • scripts/github/Sync-TaskdeckProjectPriority.ps1:16-88,714-749,843-853
   • The canonical policy in docs/GITHUB_PROJECT_AUTOMATION.md:88-94 requires closingIssuesReferences first, then body references. The GraphQL query does not request closingIssuesReferences, so a sidebar/manual closing link that is not represented in body text is invisible.
   • The body parser also accepts owner/repo#N but returns only N; Get-IssuePriority then always resolves that number against $Repository. I reproduced Refs owner/other#42 becoming only integer 42, so a qualified cross-repository reference can be resolved as Chris0Jeky/Taskdeck#42 instead.
   • Finally, if references exist but their issue has zero/multiple Priority labels, Get-IssuePriority returns null, the nulls are filtered out, and the PR falls through to pr-no-derived-issue-fallback. For an empty PR project field (or with -StrictFallbackPriority), -Apply can therefore write Priority V instead of failing closed.
   • Expected fix: preserve repository identity in references; query and prioritize closingIssuesReferences; distinguish “no references” from “references whose priority is indeterminate”; fail closed on the latter and on unsupported cross-repository assumptions. Add self-tests for a linked closing issue absent from the body, a qualified cross-repo body reference, and a referenced issue with invalid priority labels.

LOW

2. The human-action record links project cleanup to unrelated issue GEN-00 [TRACKER]: Generalist expansion wave (ADR-0046) - artefact intake beyond transcripts, project dossiers, generalist reach #1327.
   • OUTSTANDING_TASKS.md:94
   • #1327 is the open GEN-00 generalist-expansion tracker, not a project-access/priority-sync task. Because this file is the required cold-start handoff, the heading #1327 project access / #1458... misroutes future sessions and duplicates GEN-00 [TRACKER]: Generalist expansion wave (ADR-0046) - artefact intake beyond transcripts, project dossiers, generalist reach #1327's real tracker entry above.
   • Expected fix: remove the #1327 attribution here and make Project priority audit silently omits items beyond 1,000 #1458 the sole issue reference (or use an actual project-access issue if one exists).

Evidence and residual gate

• PowerShell parser: 0 errors.
• Offline self-test: 17/17 passed.
• Positive ceiling: exited 1 at live totalCount=1459, as intended.
• Complete read-only audit: exited 1 on the same 130 missing-priority-label issues, as intended; no project write was made.
• Targeted reads confirm Restore Taskdeck Codex deny-floor adapter and prove live hook trust #1456, Add pinned Codex deny-floor adapter #1457, and Project priority audit silently omits items beyond 1,000 #1458 currently hold project Priority I.
• Docs governance, golden-principles, and GitHub-ops governance gates passed.
• Four documented prunable worktrees are clean and ancestors of main; the Add pinned Codex deny-floor adapter #1457 and Project priority audit silently omits items beyond 1,000 #1458 worktrees are clean and correctly retained.

The 1,458-item count in the docs is a truthful timestamped snapshot; the live total is now 1,459 because the project has grown, so I do not consider that drift a finding. #1458 appropriately remains open and this PR correctly avoids Closes #1458. Do not merge until both findings are fixed, the new exact head is re-reviewed, and exact-head CI/Extended are green. No -Apply should run while the 130 issue labels remain unclassified.

[Chris0Jeky]

Review-fix evidence — exact head d9cfd2526e84365cc1e4b6e52737df446e46bac1

Every finding from the two 8c6c5285 adversarial reviews is addressed:

• Default PR fallback could false-clean → cd8f3d56 makes no-reference fallback unconditionally Priority V and adds a regression.
• Closing links/repository-qualified or indeterminate references were unsafe → cd8f3d56 adds complete fail-closed closingIssuesReferences, preserves repository identity for body references, gives closing links precedence, and refuses missing/multiple/unreadable referenced-issue priorities.
• Pre-Apply guard omitted source-plan drift → cd8f3d56 rebuilds the complete snapshot, reference/label sources, option map, and write plan immediately before mutation; injected drift coverage proves zero writer calls.
• A later missing option could follow an earlier write → cd8f3d56 validates the complete option plan before the current-state check and first writer call; regression proves zero writes.
• GEN-00 [TRACKER]: Generalist expansion wave (ADR-0046) - artefact intake beyond transcripts, project dossiers, generalist reach #1327 was misattributed in the human-action file → d9cfd252 makes Project priority audit silently omits items beyond 1,000 #1458 the sole cleanup reference and records the newly exposed PACK-01: Add starter-pack manifest schema and validator foundation #123 data gate.
• CLI compatibility after strict-by-default behavior → f30df1d2 retains -StrictFallbackPriority as a no-op and removes the superseded stamp-only helper.

Verification on the resulting tree:

• parser: 0 errors
• SelfTest: 27/27; compatibility invocation: 27/27
• live -Limit 1000 -Json: expected exit 1 at 1,459 items
• complete live read-only audit: expected exit 1 on referenced issue PACK-01: Add starter-pack manifest schema and validator foundation #123's missing Priority label
• docs governance, Golden Principles, GitHub ops governance, and git diff --check: passed
• no -Apply or audit-remediation write ran

The stricter pass invalidates the preliminary six-PR count; docs and PR body now say no trustworthy PR write plan exists until issue labels are classified.

[Chris0Jeky]

@codex review

Please review exact head d9cfd2526e84365cc1e4b6e52737df446e46bac1, including the full PowerShell apply-safety refactor and the fixes mapped in the preceding comment.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: d9cfd2526e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Independent project-automation safety re-review — changes requested

Reviewed exact head d9cfd2526e84365cc1e4b6e52737df446e46bac1. I first re-read all five conversation surfaces: the three owner comments, the later @codex request and bot no-major-issues response, zero submitted reviews, zero inline comments, and zero review threads.

The prior findings are resolved at this head: closing links are complete and take precedence; body references retain repository identity; indeterminate issue priorities fail closed; no-reference fallback is unconditionally Priority V; the source/plan/options are rebuilt before writes; option validation precedes the recheck and writer; and OUTSTANDING_TASKS.md now makes #1458 the sole cleanup reference.

MEDIUM — body references do not verify that owner/repo#N is actually an Issue

• scripts/github/Sync-TaskdeckProjectPriority.ps1:1073-1098,1387-1390
• The live IssueLabelProvider calls gh issue view and returns labels only. GitHub CLI accepts pull-request numbers through gh issue view; the provider never returns or validates the referenced object's type, repository, or number. Get-IssuePriority therefore treats any returned labels as an Issue's priority.
• This is live-confirmed, not hypothetical: the new audit says referenced issue Chris0Jeky/Taskdeck#123 lacks Priority. REST proves PACK-01: Add starter-pack manifest schema and validator foundation #123 is instead merged pull request https://github.com/Chris0Jeky/Taskdeck/pull/123 (pull_request is present on the issue endpoint). Historical PR bodies Remove redundant companion status doc reference from masterplan #64 and [Batch A][v0] Port baseline demo seed and MVP-first UX defaults #303 contain Closes #123, which is how this non-Issue token enters derivation.
• Today it fails closed only because PR PACK-01: Add starter-pack manifest schema and validator foundation #123 has no labels. If a referenced PR happened to carry exactly one canonical Priority label, the helper would accept that PR label as an Issue priority and could apply the wrong project value. The PR body and STATUS / MASTERPLAN / OUTSTANDING_TASKS also currently direct the maintainer to fix a nonexistent “issue PACK-01: Add starter-pack manifest schema and validator foundation #123” label defect.

Expected fix: make the provider return and validate an explicit content type plus canonical repository/number identity (for example, reject an API response containing pull_request, or use a typed GraphQL Issue lookup). A body token that resolves to PullRequest must never participate in Issue-priority derivation; fail closed with an accurate wrong-content-type diagnostic rather than inviting a Priority label on that PR. Add a regression where the provider returns a Priority-labelled PullRequest and prove it cannot influence the plan. Correct the live evidence/handoff text for #123 and identify the invalid PR-body references instead.

Verification

• Parser: 0 errors.
• -SelfTest: 27/27; compatibility invocation with -StrictFallbackPriority: 27/27.
• Live -Limit 1000 -Json: expected exit 1 at 1,459 items.
• Complete live read-only audit: exit 1 at the misclassified PACK-01: Add starter-pack manifest schema and validator foundation #123 boundary, reproducing the finding.
• Docs, Golden Principles, and GitHub-ops governance gates: passed.
• PR Fail closed on incomplete project priority audits #1488 project metadata is exactly Status=Review, Priority I.
• No -Apply, repository edit, branch edit, or audit-remediation write was performed by this review.

No other CRITICAL/HIGH/MEDIUM/LOW finding remains in this lens. Re-review the new exact head after this content-type boundary and handoff text are fixed; exact-head CI must also be fully green before merge.

[Chris0Jeky]

Exact-head correctness re-review — changes requested

Reviewed exact head d9cfd2526e84365cc1e4b6e52737df446e46bac1. Before this verdict I read all five current PR conversation comments (both original changes-requested reviews, the fix-evidence mapping, the exact-head Codex request, and Codex's no-major-issues response), plus all review submissions and inline threads; there are 0 submitted reviews and 0 inline threads.

The prior findings are resolved: canonical Priority V fallback is unconditional, complete closing links take precedence, repository identity is preserved, indeterminate issue priorities fail closed, the full source/option/write plan is rebuilt before mutation, all options validate before the first writer call, #1327 is no longer misattributed, and the former strict switch remains accepted as a compatibility no-op. The new exact-head refactor nevertheless has the following gaps.

MEDIUM — body references do not verify that the target is an Issue

Get-BodyIssueReferences / Get-IssuePriority at scripts/github/Sync-TaskdeckProjectPriority.ps1:968-1098 model every matched owner/repo#N as an issue. The live provider at lines 1387-1391 calls gh issue view ... --json labels, which also succeeds for pull requests and returns no object type.

This is not hypothetical: the exact-head audit now fails on “referenced issue #123”, but #123 is a merged pull request, not an Issue, and it has no labels. The helper therefore turns an ordinary PR-to-PR body reference into an invalid-issue gate. If the referenced PR happened to carry a Priority label, it could instead derive a priority from the wrong object class. The PR body, STATUS/MASTERPLAN, and OUTSTANDING_TASKS.md consequently misdirect cleanup toward assigning an issue Priority to PR #123.

Expected fix: make the body-reference provider return and validate __typename (or equivalent REST type), exclude PullRequest targets from issue-priority derivation, and fall back to Priority V only when no actual Issue references remain. Preserve fail-closed behavior for real Issues whose priority is unreadable/missing/multiple. Add regressions for PR-only body references and mixed PR+Issue references, then correct the #123 data-gate documentation.

MEDIUM — a partial writer failure bypasses the mandatory post-Apply audit

Invoke-PriorityUpdatePlan throws from lines 1309-1316 as soon as a writer fails. The caller at lines 1431-1435 is outside the post-audit try, which starts only at line 1437. If write 1 succeeds and write 2 fails, the command exits immediately: it reports a non-transactional partial count, but never runs the promised complete post-Apply audit at lines 1437-1449. That audit is most important on precisely this partial-failure path, and docs/GITHUB_PROJECT_AUTOMATION.md:168 currently promises it unconditionally.

Expected fix: retain structured attempted/succeeded counts and always attempt the complete post-write audit after any writer attempt, including partial failure; preserve both the original write error and audit result/error in the final diagnostic. Add an injected test where one writer succeeds and the next throws, asserting that the post-audit provider still runs and the partial state is reported truthfully.

LOW — successful Apply output still reports the pre-Apply state

After a successful post-audit, $postApplyContext is used only to check updates.Count and is discarded. JSON at lines 1453-1469 still emits the initial $snapshot and $updates, so it can report postApplyVerified: true beside stale needsUpdate: N, old project stamp/page data, and the old mismatch list. Text output at lines 1473-1495 similarly says items still “need” sync and prints their old actual values after verifying the final project is clean. This contradicts the Testing Guide's present-state interpretation of needsUpdate and makes machine/readable handoff evidence ambiguous.

Expected fix: after successful Apply, expose the post-audit snapshot/audit as current truth (needsUpdate: 0, current stamp/pages/items), while retaining separately named planned/applied evidence if useful. Label the human output as initial vs final. Add a successful mocked Apply/output regression.

Verification

• PowerShell parser: 0 errors.
• -SelfTest: 27/27 passed.
• Compatibility invocation -SelfTest -StrictFallbackPriority: 27/27 passed.
• Live -Limit 1000 -Json: exited 1 as expected at 1,459 items.
• Docs governance, Golden Principles, GitHub-ops governance, and full diff whitespace checks: passed.
• Targeted GitHub reads confirmed PACK-01: Add starter-pack manifest schema and validator foundation #123 is a PullRequest and has no labels.
• No -Apply, repository edit, or project-data mutation was performed.

The pagination, ordinal identity/cursor checks, closing-link completeness guards, repository-aware issue keys, deterministic fingerprints, source-plan drift guard, and pre-write option validation otherwise held under this pass.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d9cfd2526e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Final review-fix evidence — exact head ab178ce17f0c2ed95cc850ee335402e427330944

Every finding from the d9cfd252 re-reviews is addressed:

• Body references could treat PullRequests as Issues → 732f92f9 adds a typed REST provider, validates repository/number/type, ignores validated PullRequest targets, and covers PR-only, mixed PR/Issue, unsupported-type, and identity-mismatch cases.
• Partial writer failure skipped the mandatory post-Apply audit → 732f92f9 returns structured write outcomes, always attempts the complete audit after any writer attempt, and preserves both writer and audit results/errors. Injected partial and dual-failure tests cover the boundary.
• Successful Apply output retained stale pre-Apply state → 732f92f9 builds current output from the verified post-audit state while retaining separately named planned/attempted/applied evidence.
• PACK-01: Add starter-pack manifest schema and validator foundation #123 and operator docs were factually stale → ab178ce1 corrects STATUS, MASTERPLAN, OUTSTANDING_TASKS, testing, project-automation, and runbook guidance. The final live audit ignores PR PACK-01: Add starter-pack manifest schema and validator foundation #123 and fails closed on actual external Issue dotnet/efcore#35983; the referring item remains unidentified because GraphQL rate was exhausted.

Final local evidence: parser 0 errors; SelfTest 36/36 in normal and compatibility modes; docs governance, Golden Principles, GitHub operations governance, and diff whitespace checks passed; both commits are DCO-signed; two focused final script reviews found no remaining issue. No -Apply or project-priority remediation write ran.

Fresh exact-head two-lens review, Codex review, and CI are required after this push; prior evidence is superseded.

[Chris0Jeky]

@codex review

Please review exact head ab178ce17f0c2ed95cc850ee335402e427330944, including the typed-reference boundary, non-transactional partial-write audit path, final output semantics, and updated operator/handoff truth.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: ab178ce17f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Exact-head correctness review — changes requested

Reviewed exact head ab178ce17f0c2ed95cc850ee335402e427330944. I re-read the complete PR conversation, all review submissions, and the one inline thread immediately before this verdict, including Codex's exact-head no-major-issues response. The implementation fixes from the prior reviews are functionally correct, but the independent coverage lens found two LOW findings. Under this repository's zero-skip review policy they should be closed before merge.

LOW — the new live typed-reference adapter has no deterministic regression

Get-LiveReferenceTarget at scripts/github/Sync-TaskdeckProjectPriority.ps1:173-213 owns the REST response boundary that distinguishes Issue from PullRequest and derives canonical repository/number identity. The 36 self-tests exercise Resolve-PriorityReferenceTarget only with already-normalized synthetic targets (New-SelfTestReferenceTarget and injected providers); none exercises REST pull_request detection, repository_url parsing, or the raw label shape. The live #123 run is valuable evidence, but it is not a repeatable regression, so this exact adapter can regress while all 36 checks remain green.

Expected fix: extract/inject the raw-response normalization boundary and add deterministic cases for Issue and PullRequest responses, canonical repository/number extraction, and malformed/incomplete identity rejection.

LOW — multi-item writer ordering and option-ID mapping are unasserted

The partial-failure test at lines 1070-1105 proves two writer calls and one post-audit, while the successful-output test at lines 1129-1174 writes only one item. Neither captures the (itemId, optionId) sequence. The production loop at lines 1590-1617 is correct now, but a regression that reorders updates or supplies the wrong Priority option ID could still leave all current tests green.

Expected fix: use at least two planned updates with different priorities, capture each writer invocation, and assert the exact ordered item/option pairs as well as counts.

Prior findings rechecked

• Typed, repository-matching body targets now ignore PullRequests and fail closed for real invalid Issues.
• A partial writer failure now retains structured counts, always invokes the post-Apply audit after a writer attempt, and composes writer plus audit truth.
• Successful Apply reporting now uses the authoritative post-audit snapshot while retaining separately named planned/attempted/applied evidence.
• Updated operator/handoff docs accurately retract the preliminary PR plan and retain the external-Issue policy/data gate.

The old Codex inline thread on PR-as-Issue handling is substantively fixed by 732f92f9, but it is still unresolved in GitHub; reply with the fix evidence and resolve the thread before merge.

Verification

• Windows PowerShell 5.1.26100.8894 parser: 0 errors.
• -SelfTest: 36/36.
• -SelfTest -StrictFallbackPriority: 36/36.
• Docs governance, Golden Principles, GitHub-operations governance: passed.
• git diff --check origin/main...HEAD: passed.
• Exact-head CI and CI Extended were still in progress at the review instant.
• No -Apply, repository edit, or project-data mutation was performed by this review.

[Chris0Jeky]

Exact-head operations and data-safety review - changes requested

Reviewed exact head ab178ce17f0c2ed95cc850ee335402e427330944. I re-read every issue comment, review submission, inline comment/thread, and the full origin/main...HEAD diff before this verdict, including the exact-head Codex response and the independent correctness review posted after it.

MEDIUM - unresolved cross-repository policy is already enabled in the write plan

The handoff and PR body correctly defer whether cross-repository Issues participate in Taskdeck Priority derivation, but the implementation has already chosen yes whenever an external repository happens to expose exactly one label named Priority I through Priority V.

Resolve-PriorityReferenceTarget accepts every identity-matching Issue and adds its labels to the derivation cache (scripts/github/Sync-TaskdeckProjectPriority.ps1:1355-1369); the cross-repository self-test at lines 880-903 explicitly requires owner/other#42 to derive Priority I. The declared -Repository boundary is now unused. Consequently, after the present dotnet/efcore missing-label blocker changes, -Apply can silently inherit a coincidentally named label governed by another repository before the maintainer has answered the recorded policy question.

Fail closed on every cross-repository Issue until that policy is ratified, or put participation behind an explicit reviewed opt-in whose default is off. Pin the boundary and both same-repository/cross-repository cases in the self-test; do not make an external repository's label taxonomy authoritative by coincidence.

LOW - the durable failure ledger still records the false-clean path as resolved

docs/agentic/failure_ledger.jsonl:11 and rendered FAILURE_LEDGER.md:19 still say the project-sync problem was resolved by the old scanned 1000 / 0 needing sync run. This PR proves that exact evidence was a capped false all-clear, yet it does not append a corrective/open failure record or regenerate the rendered ledger. A future session using the required durable ledger can therefore inherit the disproven resolution and repeat the unsafe command path.

Append a factual #1458 failure/correction entry in failure_ledger.jsonl using the repository format, retain the historical record rather than rewriting history, and regenerate FAILURE_LEDGER.md.

Prior operations findings rechecked

• Body targets are now typed and canonical repo/number identity is validated; Taskdeck PACK-01: Add starter-pack manifest schema and validator foundation #123 is ignored as a PullRequest.
• Real Issues with missing/multiple Priority labels, unreadable objects, or identity mismatches fail closed.
• A partial writer failure stops further writes, retains counts/error identity, and still attempts the complete post-Apply audit.
• Successful output is built from the authoritative post-audit state while preserving separately named planned/attempted/applied evidence.
• Closing references are non-closing (closingIssuesReferences: []), no -Apply ran, Project priority audit silently omits items beyond 1,000 #1458 remains open, and the live invalid-data/policy gate is disclosed.
• The old Codex inline finding is fixed on this head but remains formally unresolved and outdated; reply with the fix evidence and resolve it before merge.

Verification

• PowerShell parser: 0 errors.
• -SelfTest: 36/36.
• -SelfTest -StrictFallbackPriority: 36/36.
• Docs governance, Golden Principles, GitHub operations governance, and git diff --check origin/main...HEAD: passed.
• Live REST type evidence: Taskdeck PACK-01: Add starter-pack manifest schema and validator foundation #123 is a PullRequest; dotnet/efcore #35983 is an Issue with no Taskdeck Priority label.
• Live ProjectV2 audit was not independently rerun: only 42 GraphQL points remained. Prior live evidence was inspected but is not claimed as this review's execution.
• Exact-head checks at verdict: 25 success, 9 pending, 5 skipped, 0 failed.
• No repository edit, project mutation, or -Apply invocation was performed by this read-only review.

[Chris0Jeky]

Immediate-wrap checkpoint — exact head 74af364c3bf7f3b4cc8b957a6a263a7dad4730ca

The final review findings are saved and mapped:

• Cross-repository Issue authority defaulted on → 0d124f5c threads canonical -Repository through content/cache/resolver paths and fails closed on external Issues.
• Raw REST normalization lacked regression coverage → 0d124f5c extracts the raw adapter and tests Issue/PullRequest, identity, malformed, and mismatch cases.
• Multi-writer order/option mapping was unasserted → 0d124f5c adds ordered two-priority dispatch evidence.
• The capped 1,000-item false all-clear was missing from the durable ledger → 74af364c appends an open Project priority audit silently omits items beyond 1,000 #1458 correction and regenerates the rendered ledger.

Local final evidence: parser 0; SelfTest 53/53 normal + compatibility; three docs/ops gates; failure-ledger tests 3/3; diff check; DCO sign-offs. The old Codex inline thread received fix evidence and is resolved. No -Apply or project-priority remediation write ran.

Maintainer requested immediate wrap, so fresh review/Codex/CI on this new head are not complete and earlier-head evidence is superseded. PR remains draft and must not merge until those gates run.

[Chris0Jeky]

@codex review

Please review exact head 74af364c3bf7f3b4cc8b957a6a263a7dad4730ca. Earlier review evidence is superseded by the final script and documentation commits.

[Chris0Jeky]

Exact-head correctness review — changes requested

Reviewed exact head 74af364c3bf7f3b4cc8b957a6a263a7dad4730ca. Before this verdict I re-read all 14 PR conversation comments, both submitted reviews, and the one inline thread (resolved/outdated, with its fix evidence), then independently inspected the exact diff and executable self-test.

MEDIUM — the body-reference parser silently drops later references in one clause

Get-BodyIssueReferences at scripts/github/Sync-TaskdeckProjectPriority.ps1:1499-1527 matches only the first #N following a closing/reference keyword. That conflicts with the documented policy that the highest urgency across derived PR issues determines Priority.

This is reproducible on the exact head: Refs #41, #42 produces only #41. With #41 at Priority II and #42 at Priority I, New-PriorityAuditState derives Priority II and builds an update plan from it; the required highest priority is Priority I. The same omission can hide a second repository-qualified reference such as Refs #41, owner/other#42, bypassing the intended fail-closed cross-repository boundary because the second target is never resolved.

Expected fix: parse every valid reference in a single reference clause while preserving the repository identity for each, then retain the existing typed resolution and cross-repository rejection. Add deterministic regressions for comma/and-separated same-repository references with different priorities and for a later cross-repository reference that must fail closed.

Verification

• Exact-head PowerShell parser: 0 errors.
• Exact-head offline -SelfTest: 53/53 passed.
• Exact-head direct parser probe and injected audit scenario reproduced the dropped-reference/wrong-priority behavior above.
• git diff --check 8d45d044..74af364c: passed.
• No -Apply, project-priority write, branch, or working-tree modification was performed by this review.

The pagination, stable snapshot, typed target, source-plan drift, option-preflight, partial-write audit, and post-Apply report paths otherwise held under this correctness pass. Exact-head CI was still running at review time and remains a separate merge gate.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 74af364c3b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Security and fail-closed review — changes requested

Reviewed exact head 74af364c3bf7f3b4cc8b957a6a263a7dad4730ca. Before this verdict I re-read all PR conversation comments, submitted reviews, inline comments, and review threads (the one inline thread is resolved/outdated with fix evidence), then independently inspected the exact diff and script self-test.

MEDIUM — supported colon-form body references are silently ignored

Get-BodyIssueReferences at scripts/github/Sync-TaskdeckProjectPriority.ps1:1499-1527 requires whitespace immediately after the keyword, so it rejects the supported GitHub form Closes: #10 (and the helper's own non-closing Refs: #10). On this exact head, direct parser probes produced no references for Closes: #10, CLOSES: #10, or Refs: #10, while their whitespace forms are parsed.

This can build a Priority V fallback/write plan when the referenced same-repository Issue has a higher priority. For Refs: #N, there is no closingIssuesReferences safety net: the body parser is the sole derivation path. It therefore violates the documented “parse PR body references” policy and makes an operator's conventional colon-form reference silently non-authoritative rather than failing closed.

Expected fix: accept the optional colon in the keyword separator without broadening the reference grammar or dropping repository identity, and add deterministic regressions for same-repository Closes: #N / Refs: #N (plus an external colon-form reference that still fails closed).

Verification

• Exact-head PowerShell parser: 0 errors.
• Exact-head offline -SelfTest: 53/53 passed.
• Exact-head direct parser probes reproduced the ignored colon forms.
• git diff --check 8d45d044..74af364c: passed.
• No -Apply, project-priority write, branch, or working-tree modification was performed by this review.

The final head correctly preserves typed target identity, same-repository-only authority, source/plan rechecks, option preflight, and post-write audit handling in the paths inspected. Exact-head CI remains a separate required merge gate.

[Chris0Jeky]

Fix evidence for the two exact-head review findings:

• Review 4780777471 (multiple references in one clause): fixed in 34c163c3. Get-BodyIssueReferences now parses every same-clause reference, so Refs #41, #42 and #43 considers all three priorities and a later cross-repository Issue reaches fail-closed validation.
• Comment 5081668686 (colon directives): fixed in 34c163c3. Closing/reference directives now accept the optional colon form (Closes: #N, Refs: #N), including qualified references; external colon-form Issues remain rejected.

Exact-head local verification at 34c163c30ebf7e2594ac7d29a61f2bcf3c727f95:

• PowerShell parser: PASS
• offline SelfTest: 57/57 (normal) and 57/57 (-StrictFallbackPriority compatibility)
• docs governance, Golden Principles, and GitHub operations governance: PASS
• failure-ledger projection tests: 3/3
• git diff --check: PASS
• DCO trailers: 11/11 PR commits

This push invalidates the prior review and CI evidence. Fresh independent reviews and exact-head automation are being collected; the PR remains draft, and no -Apply or remediation write was run.

[Chris0Jeky]

@codex review

Please review exact head 34c163c30ebf7e2594ac7d29a61f2bcf3c727f95, including the parser fixes and regressions for the two current-head MEDIUM findings.

[Chris0Jeky]

Security and fail-closed re-review — no new findings

Reviewed exact head 34c163c30ebf7e2594ac7d29a61f2bcf3c727f95. Before this verdict I re-read all current PR conversation comments, submitted reviews, inline comments, and review threads (the single thread remains resolved/outdated), then independently inspected the full exact diff and the changed parser path.

The prior optional-colon finding is resolved. Direct exact-head probes now parse Closes: #10, CLOSES: #10, and Refs: #10; they also retain every item in Refs: #41, #42 and #43 and preserve a later qualified external reference so existing typed, default-off cross-repository validation can reject it. The parser still rejects malformed Close#99.

No new CRITICAL/HIGH/MEDIUM/LOW issue found in the security/fail-closed/operator-safety paths reviewed. In particular, the revised clause parser preserves repository identity, feeds all references through typed target checks, and retains the pre-write source/plan/options guard plus mandatory post-write audit behavior.

Verification

• Exact-head PowerShell parser: 0 errors.
• Exact-head offline -SelfTest: 57/57 passed.
• Direct parser edge probes: passed, including colon, multi-reference, and cross-repository forms.
• git diff --check 8d45d044..34c163c3: passed.
• No -Apply, project-priority write, branch, or working-tree modification was performed by this review.

Residual gate: no live Apply or exact-head CI/Extended success is claimed here; both remain separate merge evidence.

[Chris0Jeky]

Exact-head correctness re-review — no findings

Reviewed exact head 34c163c30ebf7e2594ac7d29a61f2bcf3c727f95. I re-read all current PR conversation comments, submitted reviews, and the single inline thread (resolved/outdated), then independently inspected the full exact diff and exercised the changed parser plus the priority derivation boundary.

The prior multi-reference finding is resolved: Refs #41, #42 and #43 returns all three references and the injected Priority II/I/III scenario derives Priority I. Colon forms also retain all identities, and Refs: #41, owner/other#42 reaches the existing fail-closed cross-repository check rather than being silently dropped.

No new CRITICAL/HIGH/MEDIUM/LOW correctness or data-integrity issue found in this pass. The revised parser preserves per-reference repository identity and order, while the already-reviewed complete-snapshot, typed-reference, source/write-plan recheck, option preflight, partial-write/post-audit, and post-Apply reporting paths remain coherent.

Verification

• Exact-head PowerShell parser: 0 errors.
• Exact-head offline -SelfTest: 57/57, including -StrictFallbackPriority compatibility.
• Direct exact-head probes: multi-reference, colon, qualified, and late cross-repository forms passed; injected derivation selected the highest Priority.
• git diff --check 8d45d044..34c163c3: passed.
• No -Apply, project-priority write, branch, or working-tree modification was performed.

Residual gates: this is not live ProjectV2/Apply evidence, and exact-head CI was still in progress at review time.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 34c163c30e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Exact-head gate checkpoint — 34c163c30ebf7e2594ac7d29a61f2bcf3c727f95

The implementation/review/automation gate is now complete on this unchanged head:

• local parser PASS; SelfTest 57/57 normal + 57/57 compatibility; docs/Golden/GitHub-ops PASS; failure-ledger tests 3/3; diff check PASS; DCO 11/11
• correctness re-review 4780791332: no findings
• security/fail-closed re-review 5081698582: no findings
• Codex response 5081703682: no major issues
• CI run 30185169399: success (16/16 jobs)
• CI Extended run 30185169442: success (14 success, 5 intentional skips)
• CodeQL run 30185168403: success (4/4 jobs)
• review threads: 0 unresolved

This does not clear the live data-policy blocker. The complete read-only audit still found 130 Taskdeck Issue items without truthful Priority labels and encountered historical external Issue authority; no -Apply or remediation write has run. The PR therefore remains draft/non-closing, issue #1458 remains Blocked / Priority I, and this checkpoint is not a merge recommendation.

[Chris0Jeky]

Live data-remediation checkpoint — 2026-07-27

The missing Issue authority is now repaired without running -Apply:

• 130 previously unlabeled Taskdeck Issues were semantically classified against current urgency, independently reviewed, and given exactly one Priority label.
• Live REST re-read verified 130/130 with zero mismatches: Priority I=5, II=9, III=2, IV=18, V=96.
• A guarded direct ProjectV2 cursor audit then proved a stable snapshot of 1,472/1,472 unique items at updatedAt=2026-07-27T00:46:45Z: 665 Issues, 807 PRs, zero other/cross-repository project content.
• All 665 Issues now have exactly one Priority label.

Current project-field drift on that stable snapshot is 142 items: 131 Issues and 11 PRs. Of those, 137 fields are empty (131 Issues, including new #1497, plus PRs #1477/#1478/#1479/#1481/#1483/#1484). The five non-empty PR drifts are #66 I→V, #269 IV→V, #1342 I→II, #1373 II→V, and this PR #1488 I→V while its body has no eligible Refs/closing directive.

No project-field -Apply has run. The branch is locally reconciled with current main in signed merge b1a5f984; the remaining code lane is implementing visible/non-authoritative external references, same-repo prevalidation, ignored-reference fingerprinting, and a Required-CI parser/SelfTest gate. A reviewed Apply and a separate complete zero-drift audit remain required before merge.

[Chris0Jeky]

Independent exact-head review — findings fixed

Reviewed commit e78a6ef18c070c360c9a1807f74a22ae564b5e78 with separate correctness and operations/security lenses.

MEDIUM

1. Canonical live-state docs described the superseded external-reference policy and pre-remediation data gate.

   • Affected: docs/STATUS.md, docs/IMPLEMENTATION_MASTERPLAN.md, and the unchecked OUTSTANDING_TASKS.md item.
   • Fixed in e78a6ef1: all three now record the verified 130-label remediation, stable 1,472-item snapshot, 142 field drifts, and visible/non-authoritative external-reference policy. The historical 2026-07-26 changelog entry remains intact with a dated superseding entry.

2. The PR body lacked an intentional issue directive, so the reviewed plan would have treated this PR as fallback Priority V.

   • Fixed in current PR metadata: the body now contains exactly one closing directive for the Priority-I implementation issue. The complete live plan will be regenerated before Apply.

No CRITICAL, HIGH, LOW, implementation-correctness, security, or data-integrity findings remain from either lens.

Fix verification

• PowerShell parser: passed.
• SelfTest: 64/64.
• Docs governance: passed.
• Golden Principles: passed.
• GitHub operations governance: passed.
• git diff --check: passed.
• DCO: 16/16.
• Worktree clean; current origin/main is an ancestor.

Hosted exact-head checks, closing-reference verification, live Apply, and a separate complete zero-drift audit remain merge gates.

[Chris0Jeky]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: e78a6ef18c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Live Apply and zero-drift evidence — exact head e78a6ef18c070c360c9a1807f74a22ae564b5e78

The reviewed ProjectV2 plan has been applied and independently re-audited:

• pre-Apply complete plan: 1,472/1,472 items, 141 updates (131 Issues, 10 PRs), 12 external Issue references recorded as ignored non-authority
• Apply preflight/source recheck: passed before the first write
• writer result: 141/141 attempts succeeded
• built-in complete post-Apply audit: zero remaining drift; postApplyVerified=true
• separate fresh read-only audit: 1,472/1,472 across 15 pages, zero updates
• final post-body-update audit at project updatedAt=2026-07-27T01:29:54Z: 1,472/1,472 across 15 pages, 12 ignored external references, zero updates
• GitHub closing-reference set: exactly Chris0Jeky/Taskdeck#1458
• no branch/head change occurred during the data operation

The live data gate is clear. Hosted exact-head checks, the requested Codex response, and final comment/thread triage remain before merge.