ready-to-review-mergeable ships by copy-paste: 7 repos, 3 divergent versions, and session state written into the working tree

[lapc506]

Measured, 2026-07-31

/ready-to-review-mergeable and stop-prs-green.sh are copied per repo. There is no propagation mechanism, and they have already diverged.

Repo	stop-prs-green.sh	CURRENT_REPO fallback
dojo-os	221 lines	DojoCodingLabs/dojo-os
freedom-academy-admin	115 lines	line absent
freedom-academy-demolab-gcp	115 lines	line absent
freedom-academy-moodle-plugins	115 lines	line absent
dojo-infra-gitops	221 + 1 line changed	DojoCodingLabs/dojo-infra-gitops

Read via gh api repos/…/contents/.claude/hooks/stop-prs-green.sh, distinguishing "line absent" from "could not read" — all four were read successfully.

The three freedom-academy copies are 106 lines older and predate cross-repo handling entirely. Everything dojo-os learned — including the plugin PR #370 lesson its own header documents — never propagated.

The asymmetry is what makes it durable: dojo-os is the repo that evolves and the repo where the hook gets exercised, so the stale copies are stale and unnoticed.

Three defects, in order of durability

1. Distribution is copy-paste

Porting the command to a sixth repo today required hand-editing the CURRENT_REPO fallback, which is hardcoded to DojoCodingLabs/dojo-os:

CURRENT_REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner 2>/dev/null)
if [[ -z "$CURRENT_REPO" ]]; then
  CURRENT_REPO="DojoCodingLabs/dojo-os"
fi

Copying that verbatim reproduces the exact cross-repo bug the header warns about one screen above: a bare 23 in the state file gets evaluated against dojo-os#23 — an unrelated PR — and the gate passes or blocks on the wrong evidence.

A value that must change on every port is a distribution problem, not a config problem.

2. Session state lives in the working tree

STATE_FILE=".claude/.implement-prs" — written by the agent, read by the hook. It is the only channel between an in-context instruction and an out-of-context enforcer, so the mechanism is necessary. The location is not.

• Not gitignored in any repo that ships the hook. Surfaces as ??; a git add . commits it.
• Shared across sessions in one checkout, and across worktrees.
• Survives abandonment. The hook deletes it when everything is green, but not when a session dies — so the next session starts gated on PRs it never opened.

Measured today: 0 of 50 open PRs across 5 repos touch it, and it 404s on the default branch of all 6 repos. The risk has never materialised. .gitignore shipped as a stopgap in dojo-infra-gitops; the real fix is the session scratch directory, keyed by session, which only makes sense to do once — upstream.

3. The gh-failure path is unobservable

- gh / network failure -> exit 0 with a warning (never block on infra).

Failing open is correct — a network blip must not trap a session. But it means "I could not look" resolves to "proceed", and the only trace is a WARN on a subprocess's stderr, which is the same destination as console.error.

Nobody can currently answer how many green stops were actually unverified. Not asking for fail-closed — asking for the warning to land somewhere countable.

Proposed

• Ship the command + hook from the plugin, so there is one copy and porting is installation, not duplication
• Resolve the current repo without a hardcoded fallback, or make the fallback an install-time value rather than a source edit
• Move the state file to the session scratch directory, keyed by session
• Emit the gh-failure warning somewhere countable, so fail-open stays honest
• Migration path for the 3 divergent freedom-academy copies — they will not self-heal

Context

Found while porting the command to dojo-infra-gitops during the 2026-07-31 alerts observability audit. The audit's recurring finding was controls that detect correctly and report nowhere; this one is the inverse and worth keeping — it is the only hard gate the audit found. Which is exactly why its distribution should not be manual.

Created by Claude Code on behalf of @andres

[lapc506]

Corrección — el defecto 2 ya está en vuelo, y eso refuerza el defecto 1

Este issue filó el estado-de-sesión-en-el-working-tree como si fuera nuevo. No lo es. dojo-os#4061 (DOJ-6255) está abierto desde 2026-07-29 y lo aborda, con una observación medida que es mejor que la mía:

".claude/.implement-prs sits at one path in the repo root with no notion of who wrote it. Observed 2026-07-28 with 12 PRs in one file across two terminals: the session that had opened none of them was held open by all of them. It read the list, correctly identified the PRs as another session's, correctly refused to touch them — and was left with no move at all."

Y nombra la consecuencia que yo no vi: la única salida que deja es vaciar el archivo, y eso lo desarma para todos — incluida la sesión cuyos PRs sí están sin revisar.

Por qué esto no invalida el issue, lo agrava

El arreglo se está haciendo en .claude/hooks/stop-prs-green.sh de dojo-os. Es una de siete copias.

Las tres de freedom-academy corren una versión de 115 líneas, 106 más corta, anterior incluso al manejo cross-repo. Nunca van a recibir DOJ-6255. Y dojo-infra-gitops acaba de recibir una copia de la versión de 221 líneas —sin el arreglo, porque aún no está mergeado— con una línea más cambiada a mano.

O sea: mientras este issue estuvo abierto unas horas, la divergencia creció. La secuencia real es

1. dojo-os observa un fallo (12 PRs, dos terminales)
2. dojo-os lo arregla en su copia
3. Las otras seis copias no se enteran
4. La séptima copia se crea desde la versión pre-arreglo

Eso no es un bug que se arregle arreglándolo. Es la forma de distribución.

Alcance revisado

• Mover el state file al scratch de sesión → cubierto por DOJ-6255 / dojo-os#4061. No duplicar; lo que falta es que ese arreglo llegue a las otras seis copias, que es precisamente lo que este issue pide.
• Ship del comando + hook desde el plugin — sin cambios, y ahora con un caso concreto: DOJ-6255 es exactamente el tipo de mejora que hoy no se propaga.
• Resolver el repo actual sin fallback hardcodeado — sin cambios.
• Emitir el warning de fallo de gh a algún lado contable — sin cambios.
• Migración de las 3 copias divergentes de freedom-academy — sin cambios, y más urgente: van a quedar dos generaciones atrás.

Nota de método: encontré #4061 barriendo PRs abiertos después de filar este issue. Debí barrer antes. El mismo error que este issue documenta en otra capa — actuar sobre lo que se cree del sistema en vez de sobre lo que el sistema dice.