fix: guardrail against inventing an async trigger; route to work-story (#82) - #83
Merged
Merged
Conversation
#82) A user with a freshly-created GitHub backlog asked the kit to build it; the agent invented an async mechanism the kit doesn't have — /builder issue comments, self-assignment, and a non-existent codex-builder.yml GitHub Actions workflow it then reported as "missing". None of that exists in the kit. Add a "how work is triggered" guardrail to coding-agent, the portable work-story playbook, and the plan-backlog / backlog-planner handoffs: - The kit works stories interactively via work-story (one session per story; launch-story to parallelize) — the only trigger it provides. - No CI/comment/label/assignment trigger and no workflow runner; never invent or scaffold one (/builder, codex-builder.yml, etc.). - If the repo genuinely has its own async coding agent (a real .github/workflows file, or GitHub Copilot's coding agent), point to its real trigger only after verifying it exists — never a fabricated one. A real opt-in async delegation is tracked as a separate follow-up. Bundle rebuilt; validator + 35 tests pass. Kit → 0.19.13. Note: #79 (plan-definition) also carries a 0.19.13 bump on its branch; if this lands first, #79 re-bumps to 0.19.14 before merging. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
This was referenced Sep 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #82.
The report
A colleague plugged the kit into their project (on Codex), used
plan-backlogto create a GitHub backlog, then asked the agent to build it. Instead of routing towork-story, the agent fabricated an async, Actions-driven mechanism the kit doesn't have:/builderissue comments, self-assignment on #2/#8/#10, and a non-existentcodex-builder.ymlit then reported as "missing" (recommending anOPENAI_API_KEYsecret + a workflow).grepacross the repo confirms none of/builder/codex-builder.yml/ issue-comment triggers exist in the kit — pure hallucination, pattern-matched from other products.The fix — guardrail that routes, not just forbids
A "how work is triggered" section added to:
agents/coding-agent.mdcodex/skills/work-story/SKILL.md(portable)skills/plan-backlog/SKILL.md§7 handoffagents/backlog-planner.mdhandoffIt says: the kit works stories interactively via
work-story(one session per story;launch-storyto parallelize) — the only trigger it provides; no CI/comment/label/assignment trigger, no workflow runner; never invent or scaffold one (/builder,codex-builder.yml). And crucially it routes: if the repo genuinely has its own async coding agent (a real.github/workflowsfile, or Copilot's coding agent), point the user to its actual trigger — but only after verifying it exists by reading the repo, never a fabricated one. That async path is the user's own tool, separate from the kit.Same doctrine the kit already applies elsewhere (don't scaffold silently, verify by reading, no fabricated infrastructure).
Not in this PR
A real opt-in async delegation (hand created issues to a genuine async agent as an alternative to interactive
work-story) — bigger, host-specific; separate follow-up.Verification
node --test35/35, rebuild a no-op, source/bundle byte-identical.🤖 Generated with Claude Code