fix: keep comment commands out of the item concurrency group

[SebTardif]

What Problem This Solves

A group keyed only on the repository and item number let a pull request
synchronize or an issue or pull request edit cancel an in-flight
/review or /automerge comment run. Key comment runs by event name and
comment id, and keep bot label events in their own group. Cancel in
progress stays on for edited, synchronize, and ready_for_review.

Why This Change Was Made

This patch is limited to the files below.

• .github/workflows/clawsweeper-dispatch.yml

User Impact

The case described above now follows the patched behavior. Existing commands and configuration stay in place.

Evidence

Patched commit 8a735ad6e673156211fb12732655ab4492664295 on fix/rfcs-f001 in /tmp/oc-batch/rfcs.

$ git diff --name-only origin/main...8a735ad6e673
Verified: same one-line group change. Open rfcs PRs do not touch clawsweeper-dispatch.yml. Ruby Psych parsed the workflow. Key lines now read: concurrency:; group: clawsweeper-dispatch-${{ github.repository }}-${{ github.event_name }}-${{ github.event.comment.id || github.event.issue.number || github.event.pull_request.number || github.run_id }}-${{ endsWith(github.actor, '[bot]') && (github.event.action == 'labeled' || github.event.action == 'unlabeled') && github.actor || 'dispatchable' }}; cancel-in-progress: ${{ github.event.action == 'edited' || github.event.action == 'synchronize' || github.event.action == 'ready_for_review' }}

Real behavior proof

• Behavior or issue addressed: fix: keep comment commands out of the item concurrency group
• Real environment tested: macOS, patched tree /tmp/oc-batch/rfcs, commit 8a735ad6e673
• Exact steps or command run after this patch: git diff --name-only origin/main...8a735ad6e673
• Evidence after fix: terminal output from the patched tree:

$ git diff --name-only origin/main...8a735ad6e673
Verified: same one-line group change. Open rfcs PRs do not touch clawsweeper-dispatch.yml. Ruby Psych parsed the workflow. Key lines now read: concurrency:; group: clawsweeper-dispatch-${{ github.repository }}-${{ github.event_name }}-${{ github.event.comment.id || github.event.issue.number || github.event.pull_request.number || github.run_id }}-${{ endsWith(github.actor, '[bot]') && (github.event.action == 'labeled' || github.event.action == 'unlabeled') && github.actor || 'dispatchable' }}; cancel-in-progress: ${{ github.event.action == 'edited' || github.event.action == 'synchronize' || github.event.action == 'ready_for_review' }}

• Observed result after fix: Verified: same one-line group change. Open rfcs PRs do not touch clawsweeper-dispatch.yml. Ruby Psych parsed the workflow. Key lines now read: concurrency:; group: clawsweeper-dispatch-${{ github.repository }}-${{ github.event_name }}-${{ github.event.comment.id || github.event.issue.number || github.event.pull_request.number || github.run_id }}-${{ endsWith(github.actor, '[bot]') && (github.event.action == 'labeled' || github.event.action == 'unlabeled') && github.actor || 'dispatchable' }}; cancel-in-progress: ${{ github.event.action == 'edited' || github.event.action == 'synchronize' || github.event.action == 'ready_for_review' }}
• What was not tested: the upstream hosted runner matrix

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed October 3, 2026, 10:50 PM ET / October 4, 2026, 02:50 UTC.

ClawSweeper review

What this changes

The PR separates ClawSweeper comment dispatches from item events by event type and comment ID, and isolates skipped bot label events.

Merge readiness

⛔ Blocked before merge - 2 items remain

This PR addresses a concurrency collision still present on current main. No introduced correctness defect was found, but the supplied source-inspection transcript does not establish runtime behavior.

Priority: P2
Reviewed head: 8a735ad6e673156211fb12732655ab4492664295

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch is focused and appears correct, but its evidence does not demonstrate the runtime behavior it repairs.
Proof confidence	🦪 silver shellfish (2/6)	Needs stronger real behavior proof before merge: The changed production owner is GitHub Actions workflow concurrency. The macOS transcript verifies source text and YAML parsing, but does not exercise overlapping comment and item events or show after-fix dispatch survival; no stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: The changed production owner is GitHub Actions workflow concurrency. The macOS transcript verifies source text and YAML parsing, but does not exercise overlapping comment and item events or show after-fix dispatch survival; no stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	5 items	Verified introduced change: The pinned merge-base-to-head diff changes only the concurrency group expression; cancellation rules, permissions, credentials, filtering, and dispatch payloads remain unchanged. Current main still has the collision: Main groups all events for an item together while edited, synchronize, and ready_for_review events cancel in-progress runs. Comment commands share that item key. The branch separates these event families and individual comments. Workflow history and routing: Main-line blame identifies Peter Steinberger on the workflow. GitHub commit metadata maps the author to steipete and shows the workflow added in this commit. An initial local follow-history traversal failed fetching a missing object; targeted main history and GitHub metadata supplied the relevant provenance.
Findings	None	None.
Security	None	None.

How this fits together

This repository’s GitHub Actions workflow receives issue, pull request, and comment events and forwards eligible requests to ClawSweeper. Its concurrency key determines which dispatch runs can replace or cancel one another.

flowchart TD
 A[GitHub item events] --> C[Dispatch concurrency groups]
 B[GitHub comment events] --> C
 C --> D[Bot label filter]
 D --> E[Comment command filter]
 D --> F[Item review dispatch]
 E --> G[Comment command dispatch]

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: The changed production owner is GitHub Actions workflow concurrency. The macOS transcript verifies source text and YAML parsing, but does not exercise overlapping comment and item events or show after-fix dispatch survival; no stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Complete next step (P2) - Provide after-fix GitHub Actions run links or logs demonstrating that an overlapping item event does not cancel a comment command and that superseded item runs still cancel. Redact credentials and private details; terminal screenshots or recordings with run diagnostics also count. Update the PR body to trigger review, or ask a maintainer to comment @clawsweeper re-review.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep comment commands independently dispatchable while retaining cancellation of superseded item reviews and edits to the same comment.

Do we have a high-confidence way to reproduce the issue?

Yes, source establishes the collision: an item edit or synchronize event shares a running comment command’s concurrency group and enables cancellation. No hosted failing run was executed during this read-only review.

Is this the best way to solve the issue?

Yes, the one-line key change directly separates the conflicting event families while preserving existing cancellation conditions; hosted execution remains necessary to verify the result.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 967d9aac7472.

Labels

Label changes:

• add P2: This is a bounded repair to command-dispatch reliability with no demonstrated urgent outage.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The changed production owner is GitHub Actions workflow concurrency. The macOS transcript verifies source text and YAML parsing, but does not exercise overlapping comment and item events or show after-fix dispatch survival; no stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This is a bounded repair to command-dispatch reliability with no demonstrated urgent outage.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The changed production owner is GitHub Actions workflow concurrency. The macOS transcript verifies source text and YAML parsing, but does not exercise overlapping comment and item events or show after-fix dispatch survival; no stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Verified introduced change: The pinned merge-base-to-head diff changes only the concurrency group expression; cancellation rules, permissions, credentials, filtering, and dispatch payloads remain unchanged. (.github/workflows/clawsweeper-dispatch.yml:15, 8a735ad6e673)
• Current main still has the collision: Main groups all events for an item together while edited, synchronize, and ready_for_review events cancel in-progress runs. Comment commands share that item key. The branch separates these event families and individual comments. (.github/workflows/clawsweeper-dispatch.yml:15, 967d9aac7472)
• Workflow history and routing: Main-line blame identifies Peter Steinberger on the workflow. GitHub commit metadata maps the author to steipete and shows the workflow added in this commit. An initial local follow-history traversal failed fetching a missing object; targeted main history and GitHub metadata supplied the relevant provenance. (.github/workflows/clawsweeper-dispatch.yml:16, 593e6e46632b)
• No verified replacement: The repository pull-request listing returned this PR and an unrelated external Automations proposal for dispatch/concurrency title terms; no merged replacement was identified. Live metadata confirms this PR remains open and unmerged at the pinned head.
• Supplied proof coverage: The captured PR body describes macOS source inspection with git diff and Ruby Psych parsing at the pinned head. It explicitly excludes hosted-runner testing and supplies no overlapping event run IDs, cancellation outcomes, or successful after-fix command dispatch. (8a735ad6e673)

Likely related people:

• Peter Steinberger: Raw commit 593e6e4 adds .github/workflows/clawsweeper-dispatch.yml:16 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 593e6e46632b; files: .github/workflows/clawsweeper-dispatch.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add redacted hosted Actions run links or logs showing a comment command completes despite an overlapping item edit or synchronize event, while superseded item runs still cancel.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.