fix(import): allow issue-only duplicate closes

[vincentkoc]

Summary

• stop requiring a code fix before closing duplicates in issue-only clusters
• preserve fix-first behavior for clusters containing pull requests
• keep issue-only clusters quarantined when any member has a security signal

Validation

• node --test test/import-gitcrawl-clusters.test.mjs (8/8)
• npm run validate (6,699 jobs)

[clawsweeper]

Codex review: needs changes before merge. Reviewed August 9, 2026, 2:01 PM ET / 18:01 UTC.

ClawSweeper review

What this changes

The PR changes Gitcrawl job generation so issue-only clusters can close duplicate issues without first requiring a code-fix action.

Merge readiness

⛔ Blocked by patch quality or review findings - 5 items remain

Keep open: the PR still disables the fix-first safeguard for issue-only superseded closes, and the duplicate-close behavior it seeks is already exempted by the current applicator.

Priority: P1
Reviewed head: 62039ae65b18eeff123b6781792d0745d11a47a9

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch has a concrete P1 automation-safety defect despite a focused scope.
Proof confidence	🌊 off-meta tidepool	Not applicable: This MEMBER-authored internal automation PR is exempt from the external contributor real-behavior-proof gate; its needed evidence is focused regression coverage.
Patch quality	🦪 silver shellfish (2/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This MEMBER-authored internal automation PR is exempt from the external contributor real-behavior-proof gate; its needed evidence is focused regression coverage.
Evidence reviewed	3 items	Unsafe branch condition: The proposed condition emits false for every non-security issue-only cluster, not only duplicate actions. Existing duplicate exemption: Current main already permits duplicate classifications while retaining the fix-first check for other close classifications, including superseded. Current-main comparison: Current main retains require_fix_before_close when either fix or merge is enabled; the PR change is not already present on main.
Findings	1 actionable finding	[P1] Keep superseded closures behind the fix-first guard
Security	None	None.

How this fits together

Gitcrawl cluster import turns related GitHub items into guarded Clownfish jobs, which the result applicator later uses to close eligible items. The generated fix-first setting protects non-duplicate close actions before they reach GitHub.

flowchart LR
A[Gitcrawl cluster data] --> B[Job generator]
B --> C[Fix-first safeguard]
C --> D[Result applicator]
D --> E[Duplicate close]
D --> F[Superseded close]

Loading

Before merge

• Keep superseded closures behind the fix-first guard (P1) - For an issue-only cluster, this emits require_fix_before_close: false for every close type. validateFixFirstClose only exempts duplicate; a close_superseded action therefore bypasses its required fix, merge, or candidate-fix evidence. Restore the generated guard and test the duplicate-specific exemption at the applicator boundary.
• Resolve merge risk (P1) - Merging this branch would let an issue-only cluster execute a superseded close without the existing fix, merge, or candidate-fix evidence.
• Complete next step (P2) - A narrow mechanical repair can preserve duplicate closes without weakening superseded-close safeguards.
• Improve patch quality - Restore the generated fix-first condition.
• Improve patch quality - Add a regression case proving duplicate closes bypass the guard while superseded closes do not.

Findings

• [P1] Keep superseded closures behind the fix-first guard — scripts/import-gitcrawl-clusters.mjs:277-282

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch size	83 added, 4 removed across 2 files	Most of the patch is test coverage, but its small production change alters autonomous close authorization.

Merge-risk options

Maintainer options:

1. Restore the action-specific guard (recommended)
   Keep generated jobs fix-first and prove that only duplicate classifications bypass that requirement.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Restore the generated fix-first guard and add coverage showing duplicate closes are exempt while superseded closes remain blocked without fix evidence.

Technical review

Best possible solution:

Retain the generated fix-first guard and rely on the existing duplicate-only exemption in the applicator; add regression coverage that distinguishes duplicate closes from superseded closes.

Do we have a high-confidence way to reproduce the issue?

Yes—source inspection provides a high-confidence path: generate an issue-only autonomous cluster with merge enabled, then submit a superseded close; the new false flag bypasses the applicator's fix-first checks.

Is this the best way to solve the issue?

No. Current main already exempts duplicate classifications in the applicator, so lowering the generated guard is broader than the requested behavior.

Full review comments:

• [P1] Keep superseded closures behind the fix-first guard — scripts/import-gitcrawl-clusters.mjs:277-282
  For an issue-only cluster, this emits require_fix_before_close: false for every close type. validateFixFirstClose only exempts duplicate; a close_superseded action therefore bypasses its required fix, merge, or candidate-fix evidence. Restore the generated guard and test the duplicate-specific exemption at the applicator boundary.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 947a2a10469d.

Labels

Label changes:

• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• remove rating: 🧂 unranked krab: Current PR rating is rating: 🦪 silver shellfish, so this older rating label is no longer current.

Label justifications:

• P1: The patch can bypass evidence required before autonomous superseded issue closures.
• merge-risk: 🚨 automation: The changed job flag directly controls whether the close applicator enforces its automation safeguard.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This MEMBER-authored internal automation PR is exempt from the external contributor real-behavior-proof gate; its needed evidence is focused regression coverage.

Evidence

Acceptance criteria:

• [P1] node --test test/import-gitcrawl-clusters.test.mjs test/apply-result.test.mjs.
• [P1] npm run validate.

What I checked:

• Unsafe branch condition: The proposed condition emits false for every non-security issue-only cluster, not only duplicate actions. (scripts/import-gitcrawl-clusters.mjs:277, 62039ae65b18)
• Existing duplicate exemption: Current main already permits duplicate classifications while retaining the fix-first check for other close classifications, including superseded. (scripts/apply-result.mjs:1155, 6f2a976ac1b0)
• Current-main comparison: Current main retains require_fix_before_close when either fix or merge is enabled; the PR change is not already present on main. (scripts/import-gitcrawl-clusters.mjs:277, 947a2a10469d)

Likely related people:

• github-actions[bot]: The current main snapshot attributes both the import guard and close-policy implementation to this routing commit; earlier ownership is unavailable in the local history. (role: recent source committer; confidence: low; commits: 6f2a976ac1b0; files: scripts/import-gitcrawl-clusters.mjs, scripts/apply-result.mjs)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (94 earlier review cycles; latest 8 shown)

• reviewed 2026-08-09T02:31:57.957Z sha 62039ae :: needs changes before merge. :: [P1] Keep superseded closes behind the fix-first guard
• reviewed 2026-08-09T03:57:52.356Z sha 62039ae :: needs changes before merge. :: [P1] Keep superseded closes behind the fix-first guard
• reviewed 2026-08-09T06:50:33.456Z sha 62039ae :: needs changes before merge. :: [P1] Keep superseded closes behind the fix-first guard
• reviewed 2026-08-09T08:26:23.620Z sha 62039ae :: needs changes before merge. :: [P1] Keep superseded closes behind the fix-first guard
• reviewed 2026-08-09T10:07:43.031Z sha 62039ae :: found issues before merge. :: [P1] Keep superseded closes behind the fix-first guard
• reviewed 2026-08-09T11:14:19.300Z sha 62039ae :: needs changes before merge. :: [P1] Preserve the fix-first guard for superseded closes
• reviewed 2026-08-09T13:59:28.330Z sha 62039ae :: needs changes before merge. :: [P1] Preserve the fix-first guard for superseded closes
• reviewed 2026-08-09T15:36:33.364Z sha 62039ae :: needs changes before merge. :: [P1] Preserve the fix-first guard for superseded closes