Tracking issue for docs/problems/open/477-upstream-pull-request-diff-is-unscored-no-risk-surface-reads-it.md. The problem ticket is the backlog record; this issue exists so the pull request implementing ADR-102 can link the gap it deliberately leaves open.
What is missing
ADR-102 makes a pull request the preferred outbound artefact for /wr-itil:report-upstream when the upstream accepts pull requests. A pull request carries two outbound surfaces where an issue carries one: the prose, and the diff.
The prose is covered and needs no work. The external-comms gate arms on gh pr create, gh pr comment and gh pr edit, so both the risk and voice-tone evaluators fire on a pull request title and body exactly as they do on an issue body.
The diff is not covered:
- The external-comms gate reads prose only.
- The pipeline risk scorer does read diffs, but against our own
RISK-POLICY.md and docs/risks/. It has no notion of an upstream's policy or contribution standards.
- Its action taxonomy is fixed as commit, push and release. There is no action for "open a pull request against a repository we do not own".
So the gap sits across the assessment-skill action taxonomy and RISK-POLICY.md, not in any single decision that owns it.
Why this is open on purpose
ADR-102 says it plainly: naming this surface is part of that decision, and closing it is not. Closing it needs its own work, informed by what a first real pull request actually hits, and it must not be smuggled into the skill change.
What holds in the meantime
- Under AFK there is no exposure. The pull-request branch degrades to the issue branch and queues the drafted pull request, so no unattended session opens one.
- On the interactive path a human is present. Step 5b prints the full patch to the session before
gh pr create, and requires the drafted body to name which of the upstream's own convention files it read and complied with, or to say it read none.
Neither is a substitute for scoring the diff. They are the cheapest controls available until this closes.
What closing it needs
- Decide whether this warrants a new scorer action or an upstream-policy mode on the existing pipeline scorer.
- Work out what an upstream's contribution standards look like as a machine-readable input, and whether any of it is reliably discoverable.
- Decide what "within appetite" means for a repository we do not own. Our impact levels are expressed in terms of our own packages and adopters; neither applies.
- Wait for evidence from a first real pull request before designing.
Tracking issue for
docs/problems/open/477-upstream-pull-request-diff-is-unscored-no-risk-surface-reads-it.md. The problem ticket is the backlog record; this issue exists so the pull request implementing ADR-102 can link the gap it deliberately leaves open.What is missing
ADR-102 makes a pull request the preferred outbound artefact for
/wr-itil:report-upstreamwhen the upstream accepts pull requests. A pull request carries two outbound surfaces where an issue carries one: the prose, and the diff.The prose is covered and needs no work. The external-comms gate arms on
gh pr create,gh pr commentandgh pr edit, so both the risk and voice-tone evaluators fire on a pull request title and body exactly as they do on an issue body.The diff is not covered:
RISK-POLICY.mdanddocs/risks/. It has no notion of an upstream's policy or contribution standards.So the gap sits across the assessment-skill action taxonomy and
RISK-POLICY.md, not in any single decision that owns it.Why this is open on purpose
ADR-102 says it plainly: naming this surface is part of that decision, and closing it is not. Closing it needs its own work, informed by what a first real pull request actually hits, and it must not be smuggled into the skill change.
What holds in the meantime
gh pr create, and requires the drafted body to name which of the upstream's own convention files it read and complied with, or to say it read none.Neither is a substitute for scoring the diff. They are the cheapest controls available until this closes.
What closing it needs