Skip to content

LINBEE-29986 | fix: hold once until the effort verdict is recorded (v1.1.0) - #3

Merged
nivSwisa1 merged 4 commits into
mainfrom
LINBEE-29986-verdict-contract
Oct 7, 2026
Merged

nivSwisa1 merged 4 commits into
mainfrom
LINBEE-29986-verdict-contract

Conversation

@nivSwisa1

@nivSwisa1 nivSwisa1 commented Oct 7, 2026 •

Copy link
Copy Markdown
Contributor

At medium effort the model kept the verdict in thinking, so nothing was shown or reported (0/5 live runs); a one-time hold now asks for a printf of the verdict line, which the reporter also reads (5/5 live runs).

🤖 Generated with Claude Code

✨ PR Description

Purpose: Enhance the agentic-advisor plugin to enforce recording of effort verdicts before allowing code or file operations.

Main changes:

  • Updated PreToolUse matcher to include Read, Grep, Glob, Task, and Agent tools.
  • Implemented verdict_state to block tool use until a valid verdict line is recorded.
  • Expanded verdict detection to support both assistant text and printf Bash commands.

Generated by LinearB AI and added by gitStream.
AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how

At medium effort the model keeps the verdict in thinking, so nothing was shown
or reported (0/5 live). The hold asks for a printf of the verdict line; the
reporter now reads it from that Bash call too (5/5 live).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 7, 2026 11:00

@orca-security-us orca-security-us Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Orca Security Scan Summary

Status Check Issues by priority
Passed Passed Infrastructure as Code high 0   medium 0   low 0   info 0 View in Orca
Passed Passed OSS Licenses high 0   medium 0   low 0   info 0 View in Orca
Passed Passed SAST high 0   medium 0   low 0   info 0 View in Orca
Passed Passed Secrets high 0   medium 0   low 0   info 0 View in Orca
Passed Passed Vulnerabilities high 0   medium 0   low 0   info 0 View in Orca

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Session-wide verdict detection and markers bypass the hold on subsequent grading runs, and the skill contains conflicting fallback instructions.

Review effort: Balanced
Findings: 1 Medium severity · 1 Low severity

Open (2)
What changed in this PR

Adds a one-time verdict hold so effort decisions remain visible and reportable.

Changes:

  • Enforces and documents the verdict output contract.
  • Expands hook coverage and captures Bash-recorded verdicts.
  • Bumps the plugin and marketplace versions to 1.1.0.
File Description
plugins/​agentic-advisor/​skills/​agentic-advisor/​SKILL.md Documents verdict output requirements and fallback.
plugins/​agentic-advisor/​README.md Describes the new hold behavior.
plugins/​agentic-advisor/​hooks/​hooks.json Expands pre-tool hook matching.
plugins/​agentic-advisor/​hooks/​agentic-advisor-trigger.sh Implements the one-time verdict hold.
plugins/​agentic-advisor/​hooks/​agentic-advisor-report.sh Parses verdicts from Bash calls.
plugins/​agentic-advisor/​.claude-plugin/​plugin.json Bumps plugin version.
.claude-plugin/​marketplace.json Bumps marketplace metadata versions.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread plugins/agentic-advisor/hooks/agentic-advisor-trigger.sh Outdated
Comment thread plugins/agentic-advisor/skills/agentic-advisor/SKILL.md

@gitstream-cm gitstream-cm Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✨ PR Review

The changes implement a sensible one-time hold to force the model to externalize the effort verdict (either as text or as a printf'd Bash call) so it's not lost in "thinking". The dual-source regex matching (assistant text or Bash command) is applied consistently across the reporter and trigger scripts, but widening detection to arbitrary Bash tool_use commands introduces a false-positive risk, and the PreToolUse hook now fires on nearly every tool invocation.

3 issues detected:

🐞 Bug - Matching the verdict pattern against any Bash command text is too permissive and can misattribute unrelated commands as the recorded verdict. 🛠️

Details: The verdict detection now also scans the command field of any assistant-authored Bash tool_use call for the pattern "LinearB: ... (LOW|MEDIUM|HIGH) effort". If the model runs any unrelated Bash command whose text happens to contain this substring (e.g. grepping for the pattern, echoing documentation, or printing an example), it will be incorrectly treated as the actual verdict, corrupting the grading_tokens/duration telemetry.

File: plugins/agentic-advisor/hooks/agentic-advisor-report.sh (230-230)

🛠️ A suggested code correction is included in the review comments.

🐞 Bug - The broad pattern match can be satisfied by unrelated Bash commands that merely contain matching text, bypassing the intended one-time hold. 🛠️

Details: verdict_printed() greps the raw transcript for a line containing both "role":"assistant" and the verdict pattern, now including the possibility that the pattern appears inside an arbitrary Bash tool_use command string rather than the dedicated printf call. This mirrors the same false-positive risk as in agentic-advisor-report.sh and could cause the hold to be skipped even though no genuine verdict was recorded.

File: plugins/agentic-advisor/hooks/agentic-advisor-trigger.sh (48-48)

🛠️ A suggested code correction is included in the review comments.

🚀 Performance - Expanding the matcher increases the frequency of relatively expensive transcript scans on every tool call.

Details: The PreToolUse matcher was widened from Edit|Write to Edit|Write|Read|Grep|Glob|Task|Agent, meaning the trigger script (including the skill_ran/verdict_printed grep over the whole transcript) now runs on nearly every tool invocation during a session, not just file edits. This adds repeated transcript scanning overhead throughout the session.

File: plugins/agentic-advisor/hooks/hooks.json (15-15)

Generated by LinearB AI and added by gitStream.
AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Review using Guidelines Learn how

Comment thread plugins/agentic-advisor/hooks/agentic-advisor-report.sh Outdated
Comment thread plugins/agentic-advisor/hooks/agentic-advisor-trigger.sh Outdated
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 7, 2026 11:05

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

The gate can accept a verdict from an earlier advisor run, and the skill contains conflicting verdict-output instructions.

Review effort: Balanced
Findings: 1 Medium severity · 1 Low severity

Open (2)

@gitstream-cm gitstream-cm Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✨ PR Review

This revision extends the verdict regex to also match printf-ed Bash commands (addressing the earlier medium-effort false-negative issue) and introduces a one-time PreToolUse hold until a verdict is detected. The core mechanism is reasonable, but the new verdict-hold marker is not scoped per repository the way the existing hold/done markers are, which can cause inconsistent behavior across multi-repo sessions.

1 issues detected:

🐞 Bug - The verdict-hold marker only tracks session_id, not per-repo state, unlike equivalent markers elsewhere in the same script. 🛠️

Details: The new verdict-hold marker ($marker_dir/${session_id:-default}.vheld) is keyed only by session_id, unlike the existing .held/.done markers which also incorporate a per-repo key. If a single Claude session touches multiple repositories, the one-time verdict hold will only ever fire for the first repo encountered; subsequent repos where the skill ran but no verdict was printed will never trigger the hold, silently skipping the telemetry-recording nudge.

File: plugins/agentic-advisor/hooks/agentic-advisor-trigger.sh (125-125)

🛠️ A suggested code correction is included in the review comments.

Generated by LinearB AI and added by gitStream.
AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Review using Guidelines Learn how

Comment thread plugins/agentic-advisor/hooks/agentic-advisor-trigger.sh Outdated
…s a Bash verdict

Gate and reporter now ignore Bash commands that merely contain the pattern
(grep/echo), accept a printf on any line of a multi-line command, and key the
one-time hold per skill run so a second repo is gated too. Skill note allows
the printf fallback; README documents the task-complexity axis.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 7, 2026 11:17
Copilot AI previously approved these changes Oct 7, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approved

The latest-run gate, Bash fallback, reporter parsing, documentation, and version updates are consistent with the stated fix.

Review effort: Balanced
Findings: None

Resolved since last review (2)

@gitstream-cm gitstream-cm Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✨ PR Review

The PR extends the verdict-detection pattern to also match Bash printf calls and adds a one-time PreToolUse hold gate; this fixes the medium-effort case where the verdict stayed in "thinking". The implementation is mostly consistent with the stated goal, but the new per-run gating counter has a fragility concern, and several previously raised issues (false-positive substring matching, widened PreToolUse matcher, verdict_printed grep) remain unaddressed in this diff.

1 issues detected:

🐞 Bug - Two independent, differently-implemented counting mechanisms (grep line count vs. jq index) are used to track the same logical "current skill run", risking marker/key misalignment. 🛠️

Details: The vdone marker's uniqueness key ("runs") is derived from a raw grep -cE count of lines in the transcript matching the "skill":"...agentic-advisor..." substring, rather than from an actual count of distinct Skill tool_use invocations. If this substring also appears in tool_result lines that echo back the input, or in any other transcript line unrelated to a genuine new invocation, the count can be inflated or inconsistent across calls. Since verdict_state() independently determines the "latest" Skill call via a different (index-based) mechanism, misalignment between the two counting approaches could cause the per-run vdone marker to be reused or skipped incorrectly, making the one-time hold fire for the wrong run or not fire at all for a genuine new skill invocation.

File: plugins/agentic-advisor/hooks/agentic-advisor-trigger.sh (136-136)

🛠️ A suggested code correction is included in the review comments.

Generated by LinearB AI and added by gitStream.
AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Review using Guidelines Learn how

Comment thread plugins/agentic-advisor/hooks/agentic-advisor-trigger.sh Outdated
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 7, 2026 11:23
Copilot AI dismissed their stale review, a newer Copilot review was requested October 7, 2026 11:24
@gitstream-cm

gitstream-cm Bot commented Oct 7, 2026

Copy link
Copy Markdown

🚦 Automatic AI Review skipped

This pull request has used all 3 of its automatic AI Reviews.

✨ Comment /gs review to run one now.
No arguments needed. It uses the same settings as your automatic reviews: gitStream Settings in Managed Mode, your CM files in Self-Managed.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

Verdict validation accepts malformed output, and frequent tools repeatedly rescan the growing transcript.

Review effort: Balanced
Findings: None

Previously missed (3)

In code that hasn't changed since last review

Medium severity Bash path accepts loose effort substrings as valid verdicts

plugins/​agentic-advisor/​hooks/​agentic-advisor-report.sh:231

The new Bash path records any printf command containing the loose effort substring, not the exact verdict contract. For example, printf 'LinearB: demo HIGH effort' passes both checks and is emitted as a valid telemetry decision despite omitting the required delimiters, evidence, and plan. Use the same full-line validator as the trigger before assigning verdict.

Medium severity Verdict gate accepts prose instead of the complete verdict format

plugins/​agentic-advisor/​hooks/​agentic-advisor-trigger.sh:49

The verdict gate does not enforce the documented verdict shape. This regex accepts any prose substring such as Prose only: LinearB: demo HIGH effort, so the code marks this run as done and permits tools even though no blockquote, evidence, or plan was recorded. Validate the complete > LinearB: <repo> — <LEVEL> effort (<evidence>) — <plan> line here, and keep the reporter's matching rules aligned.

Medium severity Settled marker fails to short-circuit repeated transcript scans

plugins/​agentic-advisor/​hooks/​agentic-advisor-trigger.sh:138

The .vdone marker does not short-circuit the transcript scans: every subsequent Read/Grep/Glob/Task/Agent call still runs skill_ran over the full transcript and then scans it again to calculate runs before checking the marker. Because these newly matched tools are frequent and the transcript grows throughout a session, this adds increasing latency to every operation. Persist the processed transcript offset/run count, or otherwise inspect only content added since the settled marker.

@nivSwisa1

Copy link
Copy Markdown
Contributor Author

Re: Copilot's "Previously missed" — Bash path accepts loose effort substrings (agentic-advisor-report.sh:231) and Verdict gate accepts prose instead of the complete verdict format (agentic-advisor-trigger.sh:49): intentionally not changing.

  • Strict validation would drop real grades. Real output varies: LOW verdicts often omit the — <plan> clause (optional for LOW per SKILL.md), some use - instead of —, some drop the leading > . A full-shape check would lose those decisions from telemetry, and the hold fires only once, so the session would continue without a recorded grade.
  • The false positive doesn't occur in practice. A match must be assistant-authored, after the latest skill call, as text or a printf. The SKILL.md examples are loaded content (not assistant) and the templates use <LOW|MEDIUM|HIGH>, which doesn't match; grep/echo commands containing the pattern are already rejected (tested).
  • Same matcher the reporter has used for text verdicts since July, with no bad rows observed in the data.

Gate and reporter stay aligned on the same lenient rule.

@MishaKav MishaKav left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean and simple, LGTM 🔥

@nivSwisa1
nivSwisa1 merged commit e419e5f into main Oct 7, 2026
13 checks passed
@nivSwisa1
nivSwisa1 deleted the LINBEE-29986-verdict-contract branch October 7, 2026 13:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants