fix(agent): gate undrafting a PR instead of refusing it

[patroza]

Why

The gh shim treated gh pr ready as forbidden and told the caller to run pnpm pr:ready instead. That enforces the gate by making the agent remember a second command — the weakest kind of enforcement, because forgetting it produces an error rather than a validated PR.

It also produced the worst possible outcome in a repository that has the shim but no pr:ready equivalent: publishing blocked outright, with no route forward. A guard with no sanctioned path is not a safety measure, it is a dead end.

What

Invert it. When a coding agent runs a command that would publish a PR — gh pr ready, or the ready_for_review / markPullRequestReadyForReview API routes — the shim runs the same ship gate pnpm pr:ready runs, then lets the command through.

Only a failing gate stops the publish. The checks now run on every path to publishing, rather than on the one path someone remembered to take.

How

vp check → vpr typecheck → vp run test already exit non-zero on failure inside runAgentShipGate, so a red gate stops the publish for free and a green one falls through to the real gh.

pnpm pr:ready is unchanged and still the path worth using: it resolves PR state, errors clearly when there is no open PR, and runs gate-only when the PR is already ready. It sets AGENT_PR_SHIP=1 for its own undraft call, which the shim reads as "this gate already passed", so the gate runs once rather than twice.

inspectAgentGhCommand returning { blocked } no longer described what happens, so it is now requiresShipGate returning { required }. Renamed at every call site — there is no alias.

Two properties preserved deliberately: humans stay ungated (the shim only acts on coding-agent env markers), and ordinary gh calls pay nothing, because the gate module is imported lazily and only once a publishing command is recognised. gh is on the hot path for pr view/pr list and must not carry the gate's startup cost.

Verified live: gh pr ready on this branch printed running the ship gate first and proceeded into vp check, rather than refusing. Policy tests updated to the new semantics — 22 passing, including one asserting the message describes a gate running rather than a refusal.

Remarks

Ownership checked with pnpm fork:overlay-owner: all touched paths resolve to fork/changes.

Worth noting for symmetry: macs-scanner carries the same shim design and still refuses rather than gates. Same change applies there, not included here.

🤖 Generated with Claude Code

[patroza]

Why

The gh shim treated gh pr ready as forbidden and told the caller to run pnpm pr:ready instead. That enforces the gate by making the agent remember a second command — the weakest kind of enforcement, because forgetting it produces an error rather than a validated PR.

It also produced the worst possible outcome in a repository that has the shim but no pr:ready equivalent: publishing blocked outright, with no route forward. A guard with no sanctioned path is not a safety measure, it is a dead end.

What

Invert it. When a coding agent runs a command that would publish a PR — gh pr ready, or the ready_for_review / markPullRequestReadyForReview API routes — the shim runs the same ship gate pnpm pr:ready runs, then lets the command through.

Only a failing gate stops the publish. The checks now run on every path to publishing, rather than on the one path someone remembered to take.

How

vp check → vpr typecheck → vp run test already exit non-zero on failure inside runAgentShipGate, so a red gate stops the publish for free and a green one falls through to the real gh.

pnpm pr:ready is unchanged and still the path worth using: it resolves PR state, errors clearly when there is no open PR, and runs gate-only when the PR is already ready. It sets AGENT_PR_SHIP=1 for its own undraft call, which the shim reads as "this gate already passed", so the gate runs once rather than twice.

inspectAgentGhCommand returning { blocked } no longer described what happens, so it is now requiresShipGate returning { required }. Renamed at every call site — there is no alias.

Two properties preserved deliberately: humans stay ungated (the shim only acts on coding-agent env markers), and ordinary gh calls pay nothing, because the gate module is imported lazily and only once a publishing command is recognised. gh is on the hot path for pr view/pr list and must not carry the gate's startup cost.

Verified live: gh pr ready on this branch printed running the ship gate first and proceeded into vp check, rather than refusing. Policy tests updated to the new semantics — 22 passing, including one asserting the message describes a gate running rather than a refusal.

Remarks

Ownership checked with pnpm fork:overlay-owner: all touched paths resolve to fork/changes.

Worth noting for symmetry: macs-scanner carries the same shim design and still refuses rather than gates. Same change applies there, not included here.

🤖 Generated with Claude Code

[patroza]

Why

The gh shim treated gh pr ready as forbidden and told the caller to run pnpm pr:ready instead. That enforces the gate by making the agent remember a second command — the weakest kind of enforcement, because forgetting it produces an error rather than a validated PR.

It also produced the worst possible outcome in a repository that has the shim but no pr:ready equivalent: publishing blocked outright, with no route forward. A guard with no sanctioned path is not a safety measure, it is a dead end.

What

Invert it. When a coding agent runs a command that would publish a PR — gh pr ready, or the ready_for_review / markPullRequestReadyForReview API routes — the shim runs the same ship gate pnpm pr:ready runs, then lets the command through.

Only a failing gate stops the publish. The checks now run on every path to publishing, rather than on the one path someone remembered to take.

How

vp check → vpr typecheck → vp run test already exit non-zero on failure inside runAgentShipGate, so a red gate stops the publish for free and a green one falls through to the real gh.

pnpm pr:ready is unchanged and still the path worth using: it resolves PR state, errors clearly when there is no open PR, and runs gate-only when the PR is already ready. It sets AGENT_PR_SHIP=1 for its own undraft call, which the shim reads as "this gate already passed", so the gate runs once rather than twice.

inspectAgentGhCommand returning { blocked } no longer described what happens, so it is now requiresShipGate returning { required }. Renamed at every call site — there is no alias.

Two properties preserved deliberately: humans stay ungated (the shim only acts on coding-agent env markers), and ordinary gh calls pay nothing, because the gate module is imported lazily and only once a publishing command is recognised. gh is on the hot path for pr view/pr list and must not carry the gate's startup cost.

Verified live: gh pr ready on this branch printed running the ship gate first and proceeded into vp check, rather than refusing. Policy tests updated to the new semantics — 22 passing, including one asserting the message describes a gate running rather than a refusal.

Remarks

Ownership checked with pnpm fork:overlay-owner: all touched paths resolve to fork/changes.

Worth noting for symmetry: macs-scanner carries the same shim design and still refuses rather than gates. Same change applies there, not included here.

🤖 Generated with Claude Code

[patroza]

Why

The gh shim treated gh pr ready as forbidden and told the caller to run pnpm pr:ready instead. That enforces the gate by making the agent remember a second command — the weakest kind of enforcement, because forgetting it produces an error rather than a validated PR.

It also produced the worst possible outcome in a repository that has the shim but no pr:ready equivalent: publishing blocked outright, with no route forward. A guard with no sanctioned path is not a safety measure, it is a dead end.

What

Invert it. When a coding agent runs a command that would publish a PR — gh pr ready, or the ready_for_review / markPullRequestReadyForReview API routes — the shim runs the same ship gate pnpm pr:ready runs, then lets the command through.

Only a failing gate stops the publish. The checks now run on every path to publishing, rather than on the one path someone remembered to take.

How

vp check → vpr typecheck → vp run test already exit non-zero on failure inside runAgentShipGate, so a red gate stops the publish for free and a green one falls through to the real gh.

pnpm pr:ready is unchanged and still the path worth using: it resolves PR state, errors clearly when there is no open PR, and runs gate-only when the PR is already ready. It sets AGENT_PR_SHIP=1 for its own undraft call, which the shim reads as "this gate already passed", so the gate runs once rather than twice.

inspectAgentGhCommand returning { blocked } no longer described what happens, so it is now requiresShipGate returning { required }. Renamed at every call site — there is no alias.

Two properties preserved deliberately: humans stay ungated (the shim only acts on coding-agent env markers), and ordinary gh calls pay nothing, because the gate module is imported lazily and only once a publishing command is recognised. gh is on the hot path for pr view/pr list and must not carry the gate's startup cost.

Verified live: gh pr ready on this branch printed running the ship gate first and proceeded into vp check, rather than refusing. Policy tests updated to the new semantics — 22 passing, including one asserting the message describes a gate running rather than a refusal.

Remarks

Ownership checked with pnpm fork:overlay-owner: all touched paths resolve to fork/changes.

Worth noting for symmetry: macs-scanner carries the same shim design and still refuses rather than gates. Same change applies there, not included here.

🤖 Generated with Claude Code

[patroza]

Why

The gh shim treated gh pr ready as forbidden and told the caller to run pnpm pr:ready instead. That enforces the gate by making the agent remember a second command — the weakest kind of enforcement, because forgetting it produces an error rather than a validated PR.

It also produced the worst possible outcome in a repository that has the shim but no pr:ready equivalent: publishing blocked outright, with no route forward. A guard with no sanctioned path is not a safety measure, it is a dead end.

What

Invert it. When a coding agent runs a command that would publish a PR — gh pr ready, or the ready_for_review / markPullRequestReadyForReview API routes — the shim runs the same ship gate pnpm pr:ready runs, then lets the command through.

Only a failing gate stops the publish. The checks now run on every path to publishing, rather than on the one path someone remembered to take.

How

vp check → vpr typecheck → vp run test already exit non-zero on failure inside runAgentShipGate, so a red gate stops the publish for free and a green one falls through to the real gh.

pnpm pr:ready is unchanged and still the path worth using: it resolves PR state, errors clearly when there is no open PR, and runs gate-only when the PR is already ready. It sets AGENT_PR_SHIP=1 for its own undraft call, which the shim reads as "this gate already passed", so the gate runs once rather than twice.

inspectAgentGhCommand returning { blocked } no longer described what happens, so it is now requiresShipGate returning { required }. Renamed at every call site — there is no alias.

Two properties preserved deliberately: humans stay ungated (the shim only acts on coding-agent env markers), and ordinary gh calls pay nothing, because the gate module is imported lazily and only once a publishing command is recognised. gh is on the hot path for pr view/pr list and must not carry the gate's startup cost.

Verified live: gh pr ready on this branch printed running the ship gate first and proceeded into vp check, rather than refusing. Policy tests updated to the new semantics — 22 passing, including one asserting the message describes a gate running rather than a refusal.

Remarks

Ownership checked with pnpm fork:overlay-owner: all touched paths resolve to fork/changes.

Worth noting for symmetry: macs-scanner carries the same shim design and still refuses rather than gates. Same change applies there, not included here.

🤖 Generated with Claude Code

[patroza]

Why

The gh shim treated gh pr ready as forbidden and told the caller to run pnpm pr:ready instead. That enforces the gate by making the agent remember a second command — the weakest kind of enforcement, because forgetting it produces an error rather than a validated PR.

It also produced the worst possible outcome in a repository that has the shim but no pr:ready equivalent: publishing blocked outright, with no route forward. A guard with no sanctioned path is not a safety measure, it is a dead end.

What

Invert it. When a coding agent runs a command that would publish a PR — gh pr ready, or the ready_for_review / markPullRequestReadyForReview API routes — the shim runs the same ship gate pnpm pr:ready runs, then lets the command through.

Only a failing gate stops the publish. The checks now run on every path to publishing, rather than on the one path someone remembered to take.

How

vp check → vpr typecheck → vp run test already exit non-zero on failure inside runAgentShipGate, so a red gate stops the publish for free and a green one falls through to the real gh.

pnpm pr:ready is unchanged and still the path worth using: it resolves PR state, errors clearly when there is no open PR, and runs gate-only when the PR is already ready. It sets AGENT_PR_SHIP=1 for its own undraft call, which the shim reads as "this gate already passed", so the gate runs once rather than twice.

inspectAgentGhCommand returning { blocked } no longer described what happens, so it is now requiresShipGate returning { required }. Renamed at every call site — there is no alias.

Two properties preserved deliberately: humans stay ungated (the shim only acts on coding-agent env markers), and ordinary gh calls pay nothing, because the gate module is imported lazily and only once a publishing command is recognised. gh is on the hot path for pr view/pr list and must not carry the gate's startup cost.

Verified live: gh pr ready on this branch printed running the ship gate first and proceeded into vp check, rather than refusing. Policy tests updated to the new semantics — 22 passing, including one asserting the message describes a gate running rather than a refusal.

Remarks

Ownership checked with pnpm fork:overlay-owner: all touched paths resolve to fork/changes.

Worth noting for symmetry: macs-scanner carries the same shim design and still refuses rather than gates. Same change applies there, not included here.

🤖 Generated with Claude Code

[patroza]

Why

The gh shim treated gh pr ready as forbidden and told the caller to run pnpm pr:ready instead. That enforces the gate by making the agent remember a second command — the weakest kind of enforcement, because forgetting it produces an error rather than a validated PR.

It also produced the worst possible outcome in a repository that has the shim but no pr:ready equivalent: publishing blocked outright, with no route forward. A guard with no sanctioned path is not a safety measure, it is a dead end.

What

Invert it. When a coding agent runs a command that would publish a PR — gh pr ready, or the ready_for_review / markPullRequestReadyForReview API routes — the shim runs the same ship gate pnpm pr:ready runs, then lets the command through.

Only a failing gate stops the publish. The checks now run on every path to publishing, rather than on the one path someone remembered to take.

How

vp check → vpr typecheck → vp run test already exit non-zero on failure inside runAgentShipGate, so a red gate stops the publish for free and a green one falls through to the real gh.

pnpm pr:ready is unchanged and still the path worth using: it resolves PR state, errors clearly when there is no open PR, and runs gate-only when the PR is already ready. It sets AGENT_PR_SHIP=1 for its own undraft call, which the shim reads as "this gate already passed", so the gate runs once rather than twice.

inspectAgentGhCommand returning { blocked } no longer described what happens, so it is now requiresShipGate returning { required }. Renamed at every call site — there is no alias.

Two properties preserved deliberately: humans stay ungated (the shim only acts on coding-agent env markers), and ordinary gh calls pay nothing, because the gate module is imported lazily and only once a publishing command is recognised. gh is on the hot path for pr view/pr list and must not carry the gate's startup cost.

Verified live: gh pr ready on this branch printed running the ship gate first and proceeded into vp check, rather than refusing. Policy tests updated to the new semantics — 22 passing, including one asserting the message describes a gate running rather than a refusal.

Remarks

Ownership checked with pnpm fork:overlay-owner: all touched paths resolve to fork/changes.

Worth noting for symmetry: macs-scanner carries the same shim design and still refuses rather than gates. Same change applies there, not included here.

🤖 Generated with Claude Code

[patroza]

Why

The gh shim treated gh pr ready as forbidden and told the caller to run pnpm pr:ready instead. That enforces the gate by making the agent remember a second command — the weakest kind of enforcement, because forgetting it produces an error rather than a validated PR.

It also produced the worst possible outcome in a repository that has the shim but no pr:ready equivalent: publishing blocked outright, with no route forward. A guard with no sanctioned path is not a safety measure, it is a dead end.

What

Invert it. When a coding agent runs a command that would publish a PR — gh pr ready, or the ready_for_review / markPullRequestReadyForReview API routes — the shim runs the same ship gate pnpm pr:ready runs, then lets the command through.

Only a failing gate stops the publish. The checks now run on every path to publishing, rather than on the one path someone remembered to take.

How

vp check → vpr typecheck → vp run test already exit non-zero on failure inside runAgentShipGate, so a red gate stops the publish for free and a green one falls through to the real gh.

pnpm pr:ready is unchanged and still the path worth using: it resolves PR state, errors clearly when there is no open PR, and runs gate-only when the PR is already ready. It sets AGENT_PR_SHIP=1 for its own undraft call, which the shim reads as "this gate already passed", so the gate runs once rather than twice.

inspectAgentGhCommand returning { blocked } no longer described what happens, so it is now requiresShipGate returning { required }. Renamed at every call site — there is no alias.

Two properties preserved deliberately: humans stay ungated (the shim only acts on coding-agent env markers), and ordinary gh calls pay nothing, because the gate module is imported lazily and only once a publishing command is recognised. gh is on the hot path for pr view/pr list and must not carry the gate's startup cost.

Verified live: gh pr ready on this branch printed running the ship gate first and proceeded into vp check, rather than refusing. Policy tests updated to the new semantics — 22 passing, including one asserting the message describes a gate running rather than a refusal.

Remarks

Ownership checked with pnpm fork:overlay-owner: all touched paths resolve to fork/changes.

Worth noting for symmetry: macs-scanner carries the same shim design and still refuses rather than gates. Same change applies there, not included here.

🤖 Generated with Claude Code