Repository navigation
feat(setup)!: new mirrors require two-person approval - #141
Merged
Merged
Conversation
`venfork setup` now writes `approval: two-person` into a new mirror's venfork-config and records that level in the new clone's memory, so a later lowering in that clone is caught. `setup --approval <level>` picks another level at creation (`on` means two-person, as in `stage approval`), so a solo vendor or a CI setup never needs a lowering that stage would ask about later; `off` prints the off warning. A re-run against an existing mirror keeps the stored level and only warns when --approval differs. `venfork clone` never changes the level and records no memory. Mirrors made by older versions have no field, which stays `off`. `venfork stage approval <lower level>` now asks "Lower approval from A to B?" when it can prompt (--yes never answers). The lowering is computed from the config it read, and the write has a lease on that commit with no retry: when venfork-config moved during the confirm, nothing is written and the clone memory is unchanged. After a yes the clone memory records the new level. Without a prompt the level is still written, the memory keeps the level it lowered from, and the next stage in this clone asks a person. Raising the level records it. Level words are matched exactly, so `stage approval constructor` is an unknown level. The setup outro says who may approve at two-person and names `venfork stage approval reviewed` for a vendor who approves an agent's PRs. The headless docs say that a scripted setup plus stage needs `setup --approval off` or `reviewed`. The e2e tiers set `--approval off`. BREAKING CHANGE: on a mirror created by this version, `venfork stage` needs an approved mirror PR (two-person) before it publishes. A script that runs `venfork setup` and then `venfork stage` must pass `setup --approval off` (or `reviewed`) to keep the old behaviour. Existing mirrors are unchanged.
cabljac
force-pushed
the
gate/07-setup-default
branch
from
October 19, 2026 17:26
7ec3b3d to
f2e157e
Compare
cabljac
marked this pull request as ready for review
October 19, 2026 17:29
cabljac
added this pull request to stack #142
October 19, 2026 17:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A new mirror should start with the approval gate on.
venfork setupnow writesapproval: two-personand records that level in the new clone's memory, so a later lowering in that clone is caught.setup --approval <level>picks another level at creation (onmeans two-person), so a headless setup never needs a lowering that stage would ask about. A re-run on an existing mirror keeps its level.clonechanges nothing and writes no memory.venfork stage approval <lower level>now asks a person at a terminal. The lowering is computed from the config it read, and the write has a lease on that commit with no retry, so a config change during the confirm writes nothing. Without a terminal the level is written, and the next stage in that clone asks. The outro and the headless docs say who may approve and when to pass--approval.Why the
!: a script that runssetupthenstageon a new mirror now needssetup --approval off. The e2e tiers pass it.Tests, red first:
tests/unit/commands.test.ts,setup-args,stage-args,tests/integration/approval.test.ts.bun run verifyexits 0. Counts: unit 1315 to 1322, integration 523 to 528.Not verified: e2e tiers and live GitHub. The gh calls are proven only against the stub in
tests/harness/gh-mirror.ts.