fix(agentic-engineering): forbid transferring a gh --json field name from a REST or GraphQL surface - #199

🤖 Generated by the Agentic Engineer

Readiness record — tried and evaluated as a user at 5416b84

Definition prose with no runtime surface of its own; the validator that pins it is the exercisable user surface:

• RED: with the widened bullet in the fixture stub and a new neutralising case in place, the unmodified validator rejected the widened wording nine times across the desired-state fixtures (174 passed, 8 failed, every failure carrying the vocabulary pin's error) — the old pin does not admit the new text.
• GREEN: after widening the pinned string, 182 passed, 0 failed; the new case that rewrites the cross-surface clause to permit transfer fails as intended.
• Real tree: ./scripts/validate-manifests.sh passes on the merged branch, refresh-desired-state-digests.sh --check is clean, and the version gate reports 4.4.23 → 4.4.24 on top of the base that fix(surveyor): require selection evidence before survey completion #193 moved.
• Pin derivation: the pinned paragraph was generated from the surveyor text by whitespace normalisation and asserted to match before it was written, never retyped.

Consumer half: monorepo#3207 ported the subcommand-to-subcommand rule into the deployment overlay; this PR is the generic half #190 describes.

🤖 Generated by the Agentic Engineer

@coderabbitai review

@devantler I will review the changes in #199.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

🤖 Generated by the Agentic Engineer

CodeRabbit refused this head on quota (Review rate limited), so the round advances to the next lane.

@codex review

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 5416b84d5e

🤖 Generated by the Agentic Engineer

The merge with main (a sibling moved the plugin to 4.4.24) staled the earlier Codex green at 5416b84; this head carries the same change on top of the new base at 4.4.25.

@coderabbitai review

#!/bin/bash
set -euo pipefail

printf '%s\n' '== HEAD =='
git rev-parse HEAD
git status --short
git show --no-patch --format=fuller HEAD

printf '%s\n' '== Changed files against merge base with main =='
base="$(git merge-base HEAD origin/main)"
printf 'merge-base: %s\n' "$base"
git diff --name-status "$base"...HEAD
git diff --stat "$base"...HEAD

printf '%s\n' '== Diff =='
git diff --find-renames --find-copies --no-ext-diff "$base"...HEAD

printf '%s\n' '== Outlines of changed source-like files =='
git diff --name-only "$base"...HEAD | while IFS= read -r file; do
  case "$file" in
    *.js|*.mjs|*.cjs|*.ts|*.tsx|*.json|*.yaml|*.yml)
      printf '\n-- %s --\n' "$file"
      ast-grep outline "$file" --items all 2>/dev/null || true
      ;;
  esac
done

#!/bin/bash
set -euo pipefail

printf '%s\n' '== Validator contract and surrounding desired-state checks =='
sed -n '410,485p' scripts/validate-manifests.sh

printf '%s\n' '== Fixture setup, assertion helper, and changed tests =='
sed -n '620,710p' scripts/validate-manifests.test.sh
sed -n '915,985p' scripts/validate-manifests.test.sh
rg -n -C 3 'check_fail\(|make_desired_state\(|validate-manifests' scripts/validate-manifests.test.sh

printf '%s\n' '== Complete changed agent section =='
sed -n '1,110p' plugins/agentic-engineering/agents/portfolio-surveyor.agent.md

printf '%s\n' '== Agent definition digest verification =='
sha256sum plugins/agentic-engineering/agents/portfolio-surveyor.agent.md
python3 - <<'PY'
import json
with open("plugins/agentic-engineering/resources/provider-neutral.desired-state.json", encoding="utf-8") as f:
    data = json.load(f)
print(data["agents"]["portfolio-surveyor"]["definitionSha256"])
PY

printf '%s\n' '== Version declarations and contract references =='
rg -n -C 1 '"version": "4\.4\.(24|25)"|agentic-engineering.*4\.4\.(24|25)' \
  -g '*.json' -g '*.md' -g '*.sh' .
rg -n -C 2 'Every `gh --json` vocabulary is local to its subcommand|actions/runs|gh run list --json' \
  -g '*.md' -g '*.sh' -g '*.json' .

#!/bin/bash
set -euo pipefail

printf '%s\n' '== Desired-state JSON shape and SHA references =='
jq 'paths(scalars) as $p | select(($p | join(".")) | test("portfolio-surveyor|definitionSha256")) | {path: $p, value: getpath($p)}' \
  plugins/agentic-engineering/resources/provider-neutral.desired-state.json
rg -n -C 4 'portfolio_surveyor_sha256|actual_portfolio_surveyor_sha256|definitionSha256|portfolio-surveyor.*digest' \
  scripts/validate-manifests.sh scripts/validate-manifests.test.sh

printf '%s\n' '== Plugin version declarations =='
rg -n -C 1 '"version": "4\.4\.(24|25)"|agentic-engineering.*4\.4\.(24|25)' \
  -g '*.json' -g '*.md' -g '*.sh' . || true

printf '%s\n' '== JSON vocabulary contract references =='
rg -n -C 2 'Every `gh --json` vocabulary is local to its subcommand|actions/runs|gh run list --json' \
  -g '*.md' -g '*.sh' -g '*.json' . || true

printf '%s\n' '== Full validator assertion block =='
rg -n -A 90 -B 8 'portfolio_survey_json_vocabulary_contract' scripts/validate-manifests.sh

printf '%s\n' '== Test harness assertion helpers =='
sed -n '130,175p' scripts/validate-manifests.test.sh

@devantler Review complete for head 5beb110861c33cb643dc524ed2956e172e42b01f.

I found no issues.

The surveyor rule, validator pin, negative fixture, version manifests, and desired-state SHA-256 are consistent. The fixture rejects the permitted cross-surface transfer as required.

You are interacting with an AI system.

🤖 Generated by the Agentic Engineer

Readiness addendum at 5beb110 — merged with main after a sibling moved the plugin to 4.4.24, re-bumped to 4.4.25; generated digest conflict resolved by regeneration. validate-manifests.sh clean, self-test 185 passed, 0 failed, digests current, version gate 4.4.24 → 4.4.25, CI green at this head. Codex had already completed clean at the previous head 5416b84; the merge staled that green, so a fresh review is requested here.

🤖 Generated by the Agentic Engineer

CodeRabbit answered the request as a chat prompt rather than a review (no review ran at this head), so the round advances to the next lane. Codex completed clean on this change at the previous head 5416b84; this head is the same change on top of the 4.4.24 base.

@codex review

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 5beb110861