Skip to main content
← Back to list
01Issue
BugOpenSwamp CLIPublic
AssigneesNone

Relationships

#2289 verification: adversarial review guard omits extensions/, so bundled extension changes skip review

Opened by skunk-ape · 9/18/2026

Found while verifying swamp-club#2279, whose diff lives entirely under extensions/models/.

What happened

verify-reviews skipped the adversarial review for the whole change. The guard at verification/workflow-verify-reviews.yaml line 149 filters the diff to these prefixes only:

src/cli/
src/domain/
src/infrastructure/
src/libswamp/
src/serve/
src/worker/

extensions/ is absent, so a diff confined to extensions/ yields an empty filter result and the review is guarded out. The run reports skipped (guarded) and the workflow still succeeds.

Why it matters

Bundled extension models are not peripheral — they are compiled into the released binary, and @swamp/issue-lifecycle is the model that gates triage, approval and attestation for every other change. A change to it currently ships with no adversarial review at all.

AGENTS.md states the CI merge gate requires claude-adversarial-review on core source changes and that PRs auto-merge once the gates pass. If the CI job uses the same prefix list, a PR touching only extensions/ satisfies that gate without the review ever running.

This is the same shape as swamp-club#2265: a check that legitimately does not run is indistinguishable, downstream, from a check that ran and passed.

Suggested fix

  • Add extensions/ to the adversarial guard prefix list.
  • Consider whether packages/ deserves the same treatment.
  • Consider inverting the guard: review everything except an explicit exclusion list (docs, fixtures), so a new top-level source directory is covered by default rather than silently uncovered.
  • Check the CI job that provides claude-adversarial-review for the same prefix list and keep the two in sync.

Reproduction

Run verify-reviews on a branch whose diff touches only files under extensions/. The adversarial review step reports skipped (guarded) and the workflow succeeds.

02Bog Flow
OPENTRIAGEDIN PROGRESSSHIPPED

Open

9/18/2026, 8:20:20 PM

No activity in this phase yet.

03Sludge Pulse

Sign in to post a ripple.