feat(vetted-ops): extend the catalogue to the issue family - #1178
Merged
Conversation
Second family in the series, stacked on the PR-management branch. The existing `issue-*` operations address the *tracker* — the private repository the security lifecycle runs in. The issue family works on the project's own public issues, which is a different repository and so needs a different set of operations. `repo-` marks upstream here, matching the existing `repo-file`. Ten operations: view, list, comments, comment, add/remove label, set milestone, add assignee, close, reopen. Confusing the two repositories is the failure that would actually hurt — security-lifecycle content posted to a public issue — so a test walks the whole catalogue and asserts that no `repo-issue-*` / `pr-*` / `gql-*` operation ever names the tracker, and no tracker operation ever names upstream. `pr_labels` becomes `upstream_labels`. GitHub labels are repo-scoped and shared between issues and PRs, so two keys for one label set would have been wrong the moment the issue family arrived; correcting it while the series is still in flight is cheaper than living with it. Two shapes are refused rather than wrapped. `gh search issues` takes a free-text query with no fixed shape, and wrapping it would re-introduce exactly the unbounded surface the catalogue exists to remove. `gh issue create` / `gh pr create` would need a free-text title, since `gh` has `--body-file` but no `--title-file` — and creation is a genuinely novel action, which the spec's non-goals already say keeps its confirmation. Both keep their `ask` rule, and the code says so where a reader will look. Generated-by: Claude Code (Opus 5)
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
potiuk
added a commit
to potiuk/magpie
that referenced
this pull request
Sep 9, 2026
Seven changes have landed behind the previous stamp: the agent-guard plugin move (apache#1170), the doctoc URL fix (apache#1171), the marketplace re-sync plus the self-correcting prek hook (apache#1174), the vetted command surface (apache#1176), and the three PRs that extended its catalogue from 19 to 58 operations (apache#1177, apache#1178, apache#1179). `claude plugin update` compares version strings, so none of that reaches an adopter until the stamp moves. Mechanical: `project.version` edited, then `tools/dev/check-family-plugins.py --fix` propagated it to the five ecosystem manifests and the eleven per-family plugin manifests plus the marketplace entries, and `uv lock` refreshed the workspace's own package version. Generated-by: Claude Code (Opus 5)
potiuk
added a commit
that referenced
this pull request
Sep 9, 2026
Seven changes have landed behind the previous stamp: the agent-guard plugin move (#1170), the doctoc URL fix (#1171), the marketplace re-sync plus the self-correcting prek hook (#1174), the vetted command surface (#1176), and the three PRs that extended its catalogue from 19 to 58 operations (#1177, #1178, #1179). `claude plugin update` compares version strings, so none of that reaches an adopter until the stamp moves. Mechanical: `project.version` edited, then `tools/dev/check-family-plugins.py --fix` propagated it to the five ecosystem manifests and the eleven per-family plugin manifests plus the marketplace entries, and `uv lock` refreshed the workspace's own package version. Generated-by: Claude Code (Opus 5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second family in the series, after #1177.
The existing
issue-*operations address the tracker — the private repository the security lifecycle runs in. The issue family works on the project's own public issues, which is a different repository and so needs a different set of operations.repo-marks upstream here, matching the existingrepo-file. Ten operations: view, list, comments, comment, add/remove label, set milestone, add assignee, close, reopen.Confusing the two repositories is the failure that would actually hurt — security-lifecycle content posted to a public issue — so a test walks the whole catalogue and asserts that no
repo-issue-*/pr-*/gql-*operation ever names the tracker, and no tracker operation ever names upstream.pr_labelsbecomesupstream_labels. GitHub labels are repo-scoped and shared between issues and PRs, so two keys for one label set would have been wrong the moment the issue family arrived; correcting it while the series is still in flight is cheaper than living with it. This is the one change here that touches #1177's surface.Two shapes are refused rather than wrapped.
gh search issuestakes a free-text query with no fixed shape, and wrapping it would re-introduce exactly the unbounded surface the catalogue exists to remove.gh issue create/gh pr createwould need a free-text title, sinceghhas--body-filebut no--title-file— and creation is a genuinely novel action, which the spec's non-goals already say keeps its confirmation. Both keep theiraskrule, and the code says so where a reader will look.🤖 Generated with Claude Code
https://claude.ai/code/session_015qpVgY8ADkD9c7vYZk5imP