fix(import): allow issue-only duplicate closes

[vincentkoc]

Summary

• stop requiring a code fix before closing duplicates in issue-only clusters
• preserve fix-first behavior for clusters containing pull requests
• keep issue-only clusters quarantined when any member has a security signal

Validation

• node --test test/import-gitcrawl-clusters.test.mjs (8/8)
• npm run validate (6,699 jobs)

[clawsweeper]

Codex review: needs changes before merge. Reviewed August 6, 2026, 5:15 AM ET / 09:15 UTC.

ClawSweeper review

What this changes

The PR changes Gitcrawl cluster-job generation so non-security clusters containing only issues do not require a repair or merge before automated duplicate closure.

Merge readiness

⛔ Blocked by patch quality or review findings - 5 items remain

Keep this member-authored draft open, but it has a P1 automation-safety defect: it disables the fix-first gate for every non-security issue-only cluster, allowing superseded closures without a repair or merged fix. Duplicate closures already bypass that gate on current main.

Likely related people: github-actions[bot] (low confidence; the locally available current-main history attributes the relevant guard to this account).

Priority: P1
Reviewed head: 62039ae65b18eeff123b6781792d0745d11a47a9

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch is small and has passing reported checks, but it leaves a confirmed P1 closure-policy regression.
Proof confidence	🌊 off-meta tidepool	Not applicable: This member-authored internal automation PR is exempt from the external-contributor real-behavior-proof gate; focused applicator coverage is still needed for merge confidence.
Patch quality	🦪 silver shellfish (2/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This member-authored internal automation PR is exempt from the external-contributor real-behavior-proof gate; focused applicator coverage is still needed for merge confidence.
Evidence reviewed	4 items	Current duplicate behavior: The current applicator explicitly exempts the duplicate classification from the fix-first requirement, so issue-only duplicate closeouts already work while the broader guard remains enabled. Branch broadens the gate: The proposed condition emits false for any issue-only cluster without a security signal, rather than retaining the existing allow-fix/allow-merge condition; the applicator then returns before checking whether the closure is superseded. Current guard provenance: Blame attributes the duplicate exemption and the surrounding fix-first guard to the current locally available source-history commit.
Findings	1 actionable finding	[P1] Preserve the fix-first guard for superseded closes
Security	None	None.

How this fits together

Gitcrawl cluster import converts related GitHub issues and pull requests into guarded Clownfish jobs. Those job flags feed the result applicator, which decides whether a duplicate or superseded item may be closed automatically.

flowchart LR
  A[Gitcrawl cluster data] --> B[Cluster job generator]
  B --> C[Fix-first policy flag]
  C --> D[Result applicator]
  D --> E[Duplicate closure]
  D --> F[Superseded closure]

Loading

Before merge

• Preserve the fix-first guard for superseded closes (P1) - The issue-only condition sets require_fix_before_close to false before the applicator receives the job. Current apply-result already exempts only duplicate while this flag is true; turning it off also admits superseded closures without a repair or merged candidate. Keep the flag enabled and cover both classifications at the applicator boundary.
• Resolve merge risk (P1) - Merging this change can permit an issue-only cluster to execute a close_superseded action without a repair PR, merged candidate, or prior merge whenever other instant-close gates allow it.
• Complete next step (P2) - A narrow mechanical repair can preserve the already-supported duplicate behavior without weakening protections for superseded closures.
• Improve patch quality - Keep the fix-first guard enabled for issue-only clusters.
• Improve patch quality - Add an applicator-boundary regression test for duplicate and superseded classifications.

Findings

• [P1] Preserve the fix-first guard for superseded closes — scripts/import-gitcrawl-clusters.mjs:277-282

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production versus test delta	production +6/-1, tests +77/-3	A one-line policy change affects automated GitHub closures, while the added tests inspect generated frontmatter rather than the final closure boundary.

Merge-risk options

Maintainer options:

1. Preserve fix-first for superseded closes (recommended)
   Keep the existing flag behavior and add an applicator-boundary test for duplicate-versus-superseded closure classification before merge.
2. Pause the policy change
   Do not merge this branch because the requested duplicate path is already supported by the current applicator without disabling protection for other closure classes.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Retain require_fix_before_close when fix or merge is enabled, and add focused applicator tests proving duplicates remain exempt while superseded closes remain blocked without a fix or prior merge.

Technical review

Best possible solution:

Retain the generator's existing fix-first flag and add applicator-boundary coverage proving that duplicates may close without a fix while superseded items remain blocked.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection gives a high-confidence path: generate a non-security issue-only autonomous cluster with merge enabled, then submit a superseded closure; the branch emits a false guard and the applicator skips fix-first validation.

Is this the best way to solve the issue?

No. The supported duplicate path is already exempted at the applicator boundary; preserving the broader guard and testing both classifications is narrower and safer.

Full review comments:

• [P1] Preserve the fix-first guard for superseded closes — scripts/import-gitcrawl-clusters.mjs:277-282
  The issue-only condition sets require_fix_before_close to false before the applicator receives the job. Current apply-result already exempts only duplicate while this flag is true; turning it off also admits superseded closures without a repair or merged candidate. Keep the flag enabled and cover both classifications at the applicator boundary.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against db7fe033a14b.

Labels

Label justifications:

• P1: The patch can allow premature automated closure of superseded issue reports in active cluster jobs.
• merge-risk: 🚨 automation: The changed job flag directly alters which automated GitHub close actions the applicator permits.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This member-authored internal automation PR is exempt from the external-contributor real-behavior-proof gate; focused applicator coverage is still needed for merge confidence.

Evidence

Acceptance criteria:

• [P1] node --test test/import-gitcrawl-clusters.test.mjs test/apply-result.test.mjs.
• [P1] npm run validate.

What I checked:

• Current duplicate behavior: The current applicator explicitly exempts the duplicate classification from the fix-first requirement, so issue-only duplicate closeouts already work while the broader guard remains enabled. (scripts/apply-result.mjs:1158, db7fe033a14b)
• Branch broadens the gate: The proposed condition emits false for any issue-only cluster without a security signal, rather than retaining the existing allow-fix/allow-merge condition; the applicator then returns before checking whether the closure is superseded. (scripts/import-gitcrawl-clusters.mjs:277, 62039ae65b18)
• Current guard provenance: Blame attributes the duplicate exemption and the surrounding fix-first guard to the current locally available source-history commit. (scripts/apply-result.mjs:1158, f0299e5cc452)
• Prior blocker remains unresolved: The PR head is unchanged from the previous completed review cycle, whose P1 finding required preserving the guard for superseded closes. (scripts/import-gitcrawl-clusters.mjs:277, 62039ae65b18)

Likely related people:

• github-actions[bot]: The locally available blame and history attribute the active fix-first guard to this account; deeper human ownership is unavailable in the checked-out history. (role: current-main provenance recorder; confidence: low; commits: f0299e5cc452; files: scripts/apply-result.mjs, scripts/import-gitcrawl-clusters.mjs)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (56 earlier review cycles; latest 8 shown)

• reviewed 2026-08-05T16:03:46.373Z sha 62039ae :: found issues before merge. :: [P1] Keep superseded closes behind the fix-first guard
• reviewed 2026-08-05T17:11:46.475Z sha 62039ae :: needs changes before merge. :: [P1] Keep superseded closures behind the fix-first guard
• reviewed 2026-08-05T19:01:42.668Z sha 62039ae :: found issues before merge. :: [P1] Keep superseded closures behind the fix-first guard
• reviewed 2026-08-05T20:16:01.253Z sha 62039ae :: needs changes before merge. :: [P1] Keep superseded closures behind the fix-first guard
• reviewed 2026-08-05T21:19:12.093Z sha 62039ae :: needs changes before merge. :: [P1] Keep superseded closures behind the fix-first guard
• reviewed 2026-08-06T01:57:05.150Z sha 62039ae :: found issues before merge. :: [P1] Keep superseded closures behind the fix-first guard
• reviewed 2026-08-06T04:08:05.866Z sha 62039ae :: needs changes before merge. :: [P1] Preserve the fix-first guard for superseded closes
• reviewed 2026-08-06T06:17:12.675Z sha 62039ae :: needs changes before merge. :: [P1] Preserve the fix-first guard for superseded closes