test(docs): prevent request-signing code drift - #6340
Conversation
![aao-secretariat[bot]](https://avatars.githubusercontent.com/u/221690821?s=60&v=4){kind=small}
There was a problem hiding this comment.
Ladon verdict: Escalate to human review
Escalate — gated path requires human/CODEOWNERS review.
This PR modifies .github/workflows/build-check.yml, which matches the .github/workflows/** gated-path glob (gated_paths: true), and review_decision is REVIEW_REQUIRED — not APPROVED. Per decision-table row 2, the hard approval gate is not satisfied, so the outcome must be escalate.
The change itself looks clean: it adds a fail-closed lint (scripts/lint-doc-compliance-drift.cjs) that pins the request-signing guide's error-code claims to the request_signing negative conformance vectors, with a thorough test suite and CI wiring. No protocol surface is touched, so the absent changeset is correct. Only two low findings were surfaced (unguarded build-check step; section terminator matching # inside code fences), neither of which blocks.
Escalation reasons
.github/workflows/build-check.yml(modified) matches gated path.github/workflows/**; requires human/CODEOWNERS approval (review_decisionisREVIEW_REQUIRED, notAPPROVED).
No blocking (critical/high) findings.
Why human review
- Modifies gated path .github/workflows/build-check.yml (matches .github/workflows/**); review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS review required.
- This PR touches a path under a hard, non-overridable approval gate (.github/workflows/build-check.yml (modified) matches
.github/workflows/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.
aao-secretariat
Bot
added
the
ladon/needs-human-review
ad1a2e7 to
20e8862
Compare
There was a problem hiding this comment.
Ladon verdict: Escalate to human review
Escalate — gated path requires human/CODEOWNERS review.
This PR modifies .github/workflows/build-check.yml, which matches the gated glob .github/workflows/** (gated_paths: true). The current review_decision is REVIEW_REQUIRED, not APPROVED, so the hard approval gate (decision rule row 2) is not satisfied and the PR cannot be auto-approved.
The change itself is clean: a test/CI-only PR adding a doc-compliance drift lint (scripts/lint-doc-compliance-drift.cjs) that keeps request-signing.mdx's concrete error-code claims aligned with the negative conformance vectors, plus its test (7/7) and package.json/build-check.yml wiring. Verified against the live repo — all 29 negative vectors carry valid request_signature_* codes, the guide's Error codes section holds only family wildcards the pattern correctly excludes, and the section fails closed if renamed/removed. No protocol/wire/dist surface touched, so no changeset is required. The reviewer surfaced no critical/high/medium findings.
Escalation reasons
- Modifies gated path
.github/workflows/build-check.yml(matches.github/workflows/**);review_decisionisREVIEW_REQUIRED, notAPPROVED— human/CODEOWNERS review required before merge.
No blocking findings exist in the diff itself; the gate lifts automatically once a human/CODEOWNERS approval is recorded.
Why human review
- Modifies gated path .github/workflows/build-check.yml (matches .github/workflows/**); review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS review required.
- This PR touches a path under a hard, non-overridable approval gate (.github/workflows/build-check.yml (modified) matches
.github/workflows/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.
1 participant
Closes #6075
Follow-up design work: #6339
Summary
Scope
The checker intentionally validates claims, not taxonomy completeness. Discovery/runtime codes live in the broader security taxonomy and are outside the graded vector-code section. Generated snippets and symbol autolinking are split to #6339 pending their Mintlify and description-authority decisions.
Validation
npm run test:doc-compliance-drift(6/6)No changeset: CI/test-only guard with no protocol release surface changes.