[Synaeve]

Summary

The Check for changeset scope check rejected release-audit PRs that reword or escalate existing protocol changesets without touching protocol files, which .agents/shortcuts/cut-beta.md asks the release manager to do before each cut (#8360 had to be admin-merged). Changeset-only PRs from a release-audit/ head branch may now edit changeset text and escalate a misclassified bump. Every other PR keeps the existing delete-only and downgrade/removal guards.

Changes

• scripts/check-changeset-protocol-scope.cjs: add isReleaseAuditChangesetMaintenance, true only when the head ref starts with release-audit/ and the whole diff is modifications/deletions of .changeset/*.md. The head ref is read from CHANGESET_SCOPE_HEAD_REF or GITHUB_HEAD_REF on pull_request events, mirroring how the base ref is resolved. No workflow change needed.
• tests/changeset-protocol-scope.test.cjs: cover text edits and escalations on release-audit branches, plus the guards (prefix must be at the start, mixed diffs, new changesets, renames, other branches, empty diff).
• .agents/shortcuts/cut-beta.md: tell the release manager to open the correction PR from a release-audit/<version> branch.

Testing

• node tests/changeset-protocol-scope.test.cjs: passed
• node scripts/check-changeset-protocol-scope.cjs origin/main: passed
• Manual run against a scratch commit escalating a pending changeset from patch to major: fails with no head ref and with fix/foo, passes with GITHUB_HEAD_REF=release-audit/3.3.0-beta.6.

The head ref is author-controlled (a fork can name its branch release-audit/…). It only relaxes a hygiene check for diffs that edit or delete existing changesets, and the PR still needs maintainer review.

No changeset: CI and script tooling only.

Closes #8371

🤖 Generated with Claude Code

[mintlify]

Preview approval required

This pull request comes from a fork, so Mintlify won't build a preview until someone with write access approves commit 65a472e.

Approve preview

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated path touched without required approval.

This PR modifies .agents/shortcuts/cut-beta.md, which matches the gated glob .agents/** (gated_paths: true), while review_decision is REVIEW_REQUIRED (not APPROVED). Per decision rule row 2, the hard approval gate is not satisfied and the outcome must be escalate.

The reviewer surfaced no Critical/High/Medium findings: the change adds a tightly-scoped, fail-closed release-audit/-branch exemption to the changeset protocol-scope gate (admits only M/D edits on changeset-only diffs; new changesets, renames, non-changeset paths, and empty diffs all fall through to the normal check), with matching cut-beta.md guidance and tests. Doc matches code and no changeset is required. The diff is mechanically clean — but the gated-path gate requires a human/CODEOWNERS approval before merge.

Escalation reasons

• .agents/shortcuts/cut-beta.md is under a hard approval gate (.agents/**) and review_decision is REVIEW_REQUIRED — human/CODEOWNERS review required before this can merge.

Why human review

• Modifies .agents/shortcuts/cut-beta.md (matches gated path .agents/**) while review_decision is REVIEW_REQUIRED — requires human/CODEOWNERS approval before merge
• This PR touches a path under a hard, non-overridable approval gate (.agents/shortcuts/cut-beta.md (modified) matches .agents/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated path requires human/CODEOWNERS approval.

This PR modifies .agents/shortcuts/cut-beta.md, which matches the hard, path-based approval gate .agents/** (gated_paths: true). The current GitHub review decision is REVIEW_REQUIRED, not APPROVED, so decision-table row 2 fires: the gate is not satisfied and the PR cannot be auto-approved regardless of how clean the diff is.

No blocking or medium findings exist in this run. The reviewer confirmed the delta — a single fail-closed git rev-parse --abbrev-ref HEAD fallback in defaultHeadRef() wrapped in try/catch returning '' on failure — is clean: the scope gate stays active on git error and the release-audit relaxation remains narrow (M/D on .changeset/*.md only). This is consistent with the prior escalate, which was purely gate-driven (no code concerns then either).

Escalation reasons

• .agents/shortcuts/cut-beta.md (modified) matches gated path .agents/** while review_decision is REVIEW_REQUIRED — a human/CODEOWNERS approval must be recorded before merge.

Once a human/CODEOWNERS approval lands (review_decision: APPROVED), this PR would fall through to a clean approve.

Why human review

• Modifies .agents/shortcuts/cut-beta.md (matches gated path .agents/**) while review_decision is REVIEW_REQUIRED — requires human/CODEOWNERS approval before merge
• This PR touches a path under a hard, non-overridable approval gate (.agents/shortcuts/cut-beta.md (modified) matches .agents/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.