fix(autofix): Safe sweep pattern bug + auto-dispatch Codex for partial fixes

[stranske]

Why

Testing the autofix system on PR stranske/Manager-Database#84 revealed two issues preventing the system from fully resolving CI failures:

1. Bug: Safe sweep pattern matching fails when repo has Python at root
2. Gap: Non-agent PRs never get Codex fallback, even when quick autofix partially succeeds

Scope

Bug #1: Safe Sweep Pattern Matching

Location: .github/workflows/reusable-18-autofix.yml - "Summarise safe sweep results" step

Problem: When a repo has Python files at the root directory:

• find . -name "*.py" returns . as a directory
• clean_dir="${dir#./}" transforms . → . (not empty)
• Pattern becomes ./** which does NOT match paths like tests/file.py
• Git diff outputs paths without leading ./, so ./** never matches

Evidence:

[autofix] Target directories: .
Found 22 errors (16 fixed, 6 remaining).
[autofix] ERROR: safe sweep produced changes outside allowed globs:
  - tests/test_autofix_validation.py

Fix:

clean_dir="${dir#./}"
if [[ "$clean_dir" == "." || -z "$clean_dir" ]]; then
  allowed_patterns+=("**")  # Match all files at root
elif [[ -n "$clean_dir" ]]; then
  allowed_patterns+=("${clean_dir}/**")
fi

Gap #2: Auto-Dispatch Codex for Partial Fixes

Location: .github/workflows/agents-autofix-loop.yml - "Evaluate workflow_run" step

Current behavior:

const autofixEnabled = configMatch ? configMatch[1] === 'true' : hasAgentLabel;
if (!autofixEnabled) {
  return stop('autofix disabled for this pull request');
}

Problem: Human-created PRs that:

• Get quick autofix (lint/black) ✅
• Have remaining unfixable issues (mypy, test failures) ❌
• Never get Codex dispatch because no agent:codex label

Proposed Design (Option C): Auto-dispatch Codex when quick autofix partially succeeded:

1. Quick autofix runs on all PRs
2. If autofix fixed some issues but Gate still fails...
3. Automatically enable Codex dispatch for that PR
4. Add autofix:escalated label to track

Implementation approach:

• Check autofix workflow outputs for changed=true AND remaining > 0
• OR check if Gate failed after autofix commit was pushed
• Enable Codex dispatch with limited attempts (e.g., 1-2 vs 3 for agent PRs)

Non-Goals

• Changing behavior for PRs with explicit autofix: false in body
• Unlimited Codex retries on non-agent PRs
• Dispatching Codex for PRs where quick autofix made no changes

Tasks

• Fix safe sweep pattern for root directory Python projects
• Add unit test for ./** vs ** pattern matching
• Modify agents-autofix-loop to check for partial autofix success
• Add autofix:escalated label definition
• Limit Codex attempts for auto-escalated PRs (1-2 max)
• Update documentation on autofix behavior

Acceptance Criteria

• Autofix can push fixes when repo has Python at root
• Human PRs with partial autofix success get Codex dispatch
• Auto-escalated PRs have limited retry count
• autofix:escalated label applied when Codex auto-dispatched
• PRs with autofix: false still opt out completely

Test PR

stranske/Manager-Database#84 - Contains intentional lint, mypy, and test failures for validation

[github-actions]

Branch codex/issue-266 created from main.

Option 1 (Invite) is enforced on issue events. PR creation is disabled by design so you are the PR author. Codex only engages on human-authored PRs.

Please open the PR as the author so Codex can work on it:

• Compare link: https://github.com/stranske/Workflows/compare/main...codex/issue-266?expand=1
• Suggested title: Codex bootstrap for #266
• Suggested body (copy/paste):

<!-- meta:issue:266 -->

@codex Your objective is to satisfy the **Acceptance Criteria** by completing each **Task** within the defined **Scope**.

**This round you MUST:**
1. Implement actual code or test changes that advance at least one incomplete task toward acceptance.
2. Commit meaningful source code (.py, .yml, .js, etc.)—not just status/docs updates.
3. **UPDATE THE CHECKBOXES** in the Tasks and Acceptance Criteria sections below to mark completed items.
4. Change `- [ ]` to `- [x]` for items you have completed and verified.

**CRITICAL - Checkbox Updates:**
When you complete a task or acceptance criterion, update its checkbox directly in this prompt file. Change the `[ ]` to `[x]` for completed items. The automation will read these checkboxes and update the PR's status summary.

**Example:**
Before: `- [ ] Add validation for user input`
After:  `- [x] Add validation for user input`

**DO NOT:**
- Commit only status files, markdown summaries, or documentation when tasks require code.
- Mark checkboxes complete without actually implementing and verifying the work.
- Close the round without source-code changes when acceptance criteria require them.
- Change the text of checkboxes—only change `[ ]` to `[x]`.

Review the Scope/Tasks/Acceptance below, identify the next incomplete task that requires code, implement it, then **update the checkboxes** to mark completed items.

[stranske]

Keepalive Function Weaknesses Discovered

Testing PR #267 (which attempted to fix this issue) revealed additional weaknesses in the keepalive system that should be addressed before re-running Codex on this issue.

Finding #1: Agent Modified Wrong Files

Expected files: `reusable-18-autofix.yml`, `agents-autofix-loop.yml`
Actually modified: `merge_manager.js`, `merge-manager.test.js`

Codex found the concept of "`./**` pattern matching" and applied it to the wrong system. The `merge_manager.js` handles automerge allowlists, NOT the autofix safe sweep. This is a semantic understanding failure - Codex matched on keywords but not context.

Finding #2: Keepalive Continued Despite Task Misalignment

Codex explicitly reported:

"Those changes don't map to any of the current PR tasks, so there are no task checkboxes to mark complete"

The keepalive should have:

• Flagged this as problematic
• Paused for human review
• Not counted as "productive" iteration

Instead, it continued iterating.

Finding #3: Task Reconciliation False Positive

PR body shows `- [x] ## Test PR` counted as a completed task, but this is just a markdown header, not a real task.

Finding #4: "No Changes" State Mismatch

Keepalive summary showed `Changes | ⚪ No changes` but the PR diff shows 4 files changed. The `last_files_changed: 0` state doesn't match reality.

---

Comparison with PR #83 (Manager-Database)

Aspect	PR #83	PR #267
Primary goal achieved?	✅ Yes (90% coverage)	❌ No (wrong files)
Correct files modified?	✅ Yes	❌ No
Tasks marked correctly?	⚠️ Under-reported	⚠️ False positive
Agent self-awareness	N/A	✅ Knows work doesn't match
Keepalive response	Stopped too early	Continued despite misalignment

---

Recommended Keepalive Improvements

Issue	Suggested Fix
Wrong file targeting	Add file path hints in issue template (e.g., `Files: reusable-18-autofix.yml`)
False positive tasks	Filter out `## ` headers from checkbox parsing
"No changes" mismatch	Calculate `files_changed` from PR diff, not commit-by-commit
Agent says work doesn't match	Add auto-pause when agent explicitly reports task misalignment
Task completion under-reported	Auto-verify acceptance criteria from CI (coverage %, tests pass, etc.)

---

Action Taken

PR #267 has been closed and the changes stashed. Will resubmit after keepalive improvements are implemented.