Repository navigation
perf(security-issue-sync): read conditional Step 1 sub-steps only when they apply - #1998
Merged
Merged
Conversation
…n they apply Sub-steps 1e, 1g and 1h of gather.md each have one clear condition, yet every sync loaded them. Move their bodies byte-for-byte to sibling files. The headings stay, each with a pointer that states the condition, so anchors and surface hashes do not change. An open tracker with no CVE reads about 6k fewer tokens, and one with a CVE about 2.3k. Add a pointer-routing-gather eval step: no existing eval reads the moved sub-steps, so it is what fails if a pointer stops working. Generated-by: Claude Opus 5
potiuk
enabled auto-merge (squash)
November 5, 2026 00:54
github-actions
Bot
added
family:tools
This was referenced Nov 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
security-issue-syncout ofgather.mdinto siblings, byte for byte.gather.mddrops from about 19k to about 13k tokens (estimates, characters ÷ 4).pointer-routing-gathereval step.1eCVE record reviewer commentscve-record-comments.md1gclosed-tracker publication checkclosed-tracker-check.mdannounced1hrelease-vote detectionrelease-vote-detection.mdrelease_vote_gatingistrueAn open tracker with no CVE saves about 6k tokens, and one with a CVE about 2.3k.
A closed
announcedtracker has a CVE too, so it only skips1h.1d, the 8k signal table, stays: it is a judgement-heavy lookup with seven eval cases.Type of change
.claude/skills/<name>/) — eval fixtures updated belowTest plan
prek run --all-files --skip workspace-pytestpasses, includinglycheeworkspace-pytestpasses for the changed filessurface_hashor heading changedpointer-routing-gatherstep: 7/7 on the real skill; with the pointers deleted, all 5 cases that need a file fail and the 2 that need none passsecurity-issue-syncsuite on the rebased tree: 59/60, see belowThe one failure.
step-1d-signals/case-4-title-strip-too-shortfailed once on its prosenotesfield: the judge said the agent reached the same conclusion but stated the rule differently.The
1dsection and that step's fixtures are byte-identical to the last all-green run, and the case then passed 3/3 on repeat, so this reads as nondeterminism rather than a regression.RFC-AI-0004 compliance
check-placeholdershook passesNo new mutation, host access, outbound message or LLM routing.
Linked issues
None.
Notes for reviewers
pointer-routing-gathershows an agent would reach these files, not how it acts once there. The byte-identical move is what protects the content.pointer-routing-gatherrecords a stated decision. The agent says which files it would open; it does not run with file tools.tools/spec-loop/.last-syncis not bumped. The lifecycle spec is updated by hand here.🤖 Generated with Claude Code