refactor: extract smoke workspace table to config/repos.yaml + firewall gate - #147
Merged
Conversation
…ll gate Clears the three PyAutoHeart tenant-firewall findings by the recorded decision rule (PyAutoMind#198): - heart/smoke.py: WORKSPACES + IMPORT_NAMES move to a smoke: block in config/repos.yaml — the declared config surface an adopting fork replaces — behind a strict loader (the version_skew idiom: a missing block fails loudly). Which workspaces exist is instance policy, not runner mechanics. Residual --root help reworded to 'organism root'. - tests/test_smoke.py: synthetic LibraryA/LibraryB chains under an 'organism' root — nothing matches a spec against a real repo list. - tests/test_release_run.py: per_project key -> demo_workspace — merged generically, never matched. heart-tests.yml restructures to a path-based checkout with a PyAutoMind sibling and gains the repos_sync.py firewall leg via its new --only selector, so future instance-fact drift fails in the PR that authors it. Note: the gate step needs the --only selector on PyAutoMind main — merge after the PyAutoMind PR.
This was referenced Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The PyAutoHeart leg of PyAutoLabs/PyAutoMind#198 (tenant-firewall drift: refactor-first clear + PR-time gates). Merges after PyAutoLabs/PyAutoMind#199 — the new CI gate step invokes the
--onlyselector from a PyAutoMind checkout ofmain, so that step stays red until that PR lands (expected; noted in the #198 sequencing comment).Changes
Clears the three PyAutoHeart firewall findings by the recorded decision rule — extract, don't allowlist:
heart/smoke.py:WORKSPACES+IMPORT_NAMESmove to a newsmoke:block inconfig/repos.yaml— the declared config surface an adopting fork replaces — behind a strict loader on theversion_skewidiom (workspace_library()): a missing block raisesKeyErrorrather than silently preparing nothing. Which workspaces exist is instance policy, not runner mechanics; behaviour is unchanged for every existing invocation (keys, directories, chains identical). The residual--rootargparse help is reworded to "organism root".bin/pyauto-heart help smokeprose now points at the config block instead of hardcoding the six keys.tests/test_smoke.py→ syntheticLibraryA/LibraryBchains under anorganismroot: nothing insmoke.pymatches a spec against a real repo list.tests/test_release_run.py→per_projectkeydemo_workspace: merged generically, never matched.Gate (Phase B):
.github/workflows/heart-tests.ymlrestructures from a bare root checkout topath: PyAutoHeart+ aPyAutoLabs/PyAutoMindsibling (the layout--rootneeds), moves pip/pytest underworking-directory:, and adds the firewall step:repos_sync.py --check --only "tenant firewall (organ code)" --root "$GITHUB_WORKSPACE".The identity of the new
smoke:block is drift-checked against the body map by thecheck_heartextension in PyAutoLabs/PyAutoMind#199 (closing the same identity-unchecked gapversion_skew:had).Verification
PYTHONPATH=. python3 -m heart.smoke --help→ workspace choices load from config, identical key set.PYAUTO_ROOT=<root> python3 heart/checks/manifest_drift.py→ "manifest_drift identity in sync (11 surfaces vs repos.yaml)" against the branch trio.smoke:block is flagged by the newcheck_heartleg (exit 1).Generated by Claude Code