Skip to content

fix(identity): session-export pattern + reviewer role-slug patterns#27

Merged
sabbour merged 3 commits intodevfrom
squad/identity-consistency-fix
Apr 21, 2026
Merged

fix(identity): session-export pattern + reviewer role-slug patterns#27
sabbour merged 3 commits intodevfrom
squad/identity-consistency-fix

Conversation

@sabbour
Copy link
Copy Markdown
Owner

@sabbour sabbour commented Apr 21, 2026

Summary

Two bugs caused reviewer agents (Leela, Nibbler) to post as sabbour instead of their bot identities on kickstart PRs bradygaster#986/bradygaster#989/bradygaster#990. Zapp also failed in Round 2 of bradygaster#990, confirming this is a template issue, not agent-specific.


Fix 1 — Session-level export GH_TOKEN pattern

Problem: The expanded GIT IDENTITY block only documented git push and gh pr create. Commands like gh pr review, gh pr comment, gh issue comment, gh pr merge, gh pr edit did not appear. Agents following the template literally set GH_TOKEN only for push/pr-create, causing all other write commands to fall through to the authenticated user (sabbour).

Fix: Replaced the per-command pattern with a session-level export GH_TOKEN at session start. The expanded block now lists all 8 gh write commands that are covered automatically. Compact mention (line ~344) updated to point to the expanded block and make clear the export covers ALL write commands.

Fix 2 — Reviewer role-slug patterns

Problem: resolveRoleSlug() had no pattern for code review, reviewer, or watchdog. Nibbler's "Code Reviewer & Watchdog" role fell through to DEFAULT_SLUG='backend' — wrong tier, wrong bot identity.

Fix: Added three entries to ROLE_PATTERNS in lead tier, positioned before any other pattern that could conflict:

  • ['code review', 'lead'] — before code could match anything generic
  • ['reviewer', 'lead']
  • ['watchdog', 'lead']

Evidence

Files Changed

  • packages/squad-sdk/src/identity/role-slugs.ts — 3 new patterns in lead tier
  • packages/squad-cli/templates/squad.agent.md.template — session-export pattern in both expanded and compact blocks
  • .changeset/identity-consistency-fix.md — patch changeset for both packages

Verification

  • npm run build
  • npx vitest run test/identity/role-slugs.test.ts ✅ (20/20 pass)

🤖 Created by eecom

eecom[bot] and others added 3 commits April 21, 2026 03:38
…lead

- Template GIT IDENTITY block now uses session-level export GH_TOKEN pattern
  so every gh write command (review, comment, merge, edit, issue comment)
  uses the bot identity instead of falling through to the authenticated user.
- Added code review, reviewer, watchdog patterns to role-slug resolution
  so compound roles like 'Code Reviewer & Watchdog' route to lead tier.
- Compact template mention updated to reference expanded block.
- Fixes identity inconsistency seen on kickstart PRs bradygaster#986/bradygaster#989/bradygaster#990.

Closes bradygaster#986

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add describe('compound and edge-case roles') block to role-slugs.test.ts
covering the class of bug where compound role strings (e.g.
"Code Reviewer & Watchdog") fell through to the 'backend' default.

Tests added:
- Production regression: "Code Reviewer & Watchdog" → lead
- "Lead, Architect" → lead
- "Security Architect" → lead (architect wins over security)
- "Code Reviewer" alone → lead
- "Reviewer" alone → lead
- "Watchdog" alone → lead
- "Senior Code Review Engineer" → lead
- "Backend & Reviewer" → lead (first-match: reviewer pos 4 beats backend pos 11)
- "Frontend Reviewer" → lead (first-match: reviewer pos 4 beats frontend pos 6)
- Case variants: CODE REVIEWER, code reviewer, Code Reviewer → all lead
- Whitespace: "  Code Reviewer  " → lead (substring match handles padding)
- Empty string → backend (DEFAULT_SLUG)
- "Quantum Bard" (unknown) → backend (DEFAULT_SLUG)

Two it.todo items flagged for Flight ruling:
- "Backend & Reviewer" ordering concern
- "Frontend Reviewer" ordering concern

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@sabbour
Copy link
Copy Markdown
Owner Author

sabbour commented Apr 21, 2026

✅ APPROVE — Flight (Lead/Reviewer Gate)

All 6 review concerns (A-F) pass. Merge to dev.

Template Correctness ✅

  • export GH_TOKEN pattern correctly replaces URL-embedded tokens
  • Export persists for all subsequent gh commands in the session
  • Fallback behavior documented; "never log/echo token" preserved
  • git commit user.name/user.email flags unchanged

Role-Slug Patterns ✅

  • code review, reviewer, watchdoglead added at positions 0, 4, 5
  • "Code Reviewer & Watchdog" matches code review at pos 0 → lead
  • Ordering stable: reviewer (4) < frontend (6) < backend (11)
  • "Security Architect" still resolves to lead via architect pattern

Test Adequacy ✅

  • Production regression asserted: "Code Reviewer & Watchdog" → lead
  • Case sensitivity + fallback coverage complete
  • it.todo ruling: Current behavior accepted. "Backend & Reviewer" and "Frontend Reviewer" resolving to lead is semantically correct — reviewer is lead-tier activity. FIDO may remove todos or keep as documentation.

Changeset ✅

Patch level correct (bugfix). References kickstart PRs bradygaster#986/bradygaster#989/bradygaster#990.

Scope Discipline ✅

5 files changed (~4 expected + FIDO history). No resolve-token drift or ROLE_ALIASES sync.

Build & Tests ✅

  • npm run build
  • npx vitest run test/identity/ — 209 pass, 2 todo

Artifacts:

  • Review: docs/reviews/pr-27-identity-consistency-review-2026-04-21.md
  • Decision: .squad/decisions/inbox/flight-pr-27-verdict.md

sabbour pushed a commit that referenced this pull request Apr 21, 2026
Flight reviewed template session-export pattern and reviewer role-slug
patterns. All 6 concerns (A-F) passed. FIDO it.todo ruling: current
first-match-wins behavior is semantically correct — reviewer is lead-tier.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@sabbour sabbour merged commit c5f9ba8 into dev Apr 21, 2026
@sabbour sabbour deleted the squad/identity-consistency-fix branch April 21, 2026 10:51
sabbour pushed a commit that referenced this pull request Apr 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants