Repository navigation
Publication review for publication requests (epic #1726) - #1782
Merged
Merged
Conversation
* docs: add ADR 0100 on the publication review Record the design of epic #1726 as a proposed ADR: one derived verdict per publication request, bound to the request, the screened commit and the anonymous flag; the model review runs only after the identifier screen reports for that commit and only on bytes the shared mechanical rules pass just before sending, because the screen does not read the README, CHANGES, LICENSE, dataset_description.json or participants.json; closed reasons that each say what clears them; the Worker enforces the gate in /approve and approve-dispatch; the advisory pre-screen retires. Refs #1727. Tested: adr-index.unit.test.ts passes. * docs: add the publication review design note The analysis behind ADR 0100: what was read, the facts checked against the code, the pull-request review compared with the publication review, the data flow, the screen-first options weighed, the cost arithmetic, the refined phase plan for Phases 1 to 5 and the risks. Listed in the .context index as analysis, not a ruling. Refs #1727. Tested: adr-index.unit.test.ts and docs-links pass. * docs: revise ADR 0100 after review Apply the independent review of #1735 and the maintainer's amendments recorded on #1726: the pre-screen is live in production and is handed over when the review is switched on (its callback secret stays, since the screen and the pull-request review use it); the pre-send check is stated as a consistency control, with #1737 a prerequisite; no .tsv file reaches the model; reasons gain a class; a failed minimum re-blocks the request; call 4 and call 11 as amended; override bound to the reasons shown; the Worker is the gate for the executor; a per-claim dispatch token for Phase 3; release dark before the soak. Refs #1727. Tested: adr-index, changelog-format, docs-links pass. * docs: revise the publication review note Correct the facts the review found (the live pre-screen, the first-match rule, the request route's 409, createTag on an existing tag), add the offline calibration plan with prices checked on the live pricing page, move the initial vocabularies here from the ADR, and refine the phases: #1737 first, the epic finalized into dev after Phase 3, and Phase 5 as release dark, soak against the dev Worker, then switch on. Refs #1727. Tested: adr-index, changelog-format, docs-links pass. * docs: README forms, provenance and agent option Renumber the remaining ADR 0100 references to 0101. Accept README.md, README, README.rst and README.txt, name provenance and the ethics statement in the questions, and record the tool-using reviewer as considered and recommended against.
…c-publication-review
Phase 1 (#1728) of epic #1726: the publication review's store, contract, write path, read path, admin mail, job and workflow source, administrator start route, and calibration tooling, with ADR 0102 and the design note. Production stays dark: the flag is set only in the dev variables, nothing gates an approval yet, and the workflow is source only until it is deployed to the central repository. Reviewed by four adversarial passes and a five-reviewer whole-PR review; every finding was fixed with a failing test first or recorded in the ADR. Full suite on the final head: 14593 pass, with only the five known bash-completion failures.
Phase 2 (#1729) of epic #1726: the Worker's approval gate and the administrator's commands for the publication review (ADR 0102). A publication request already has one derived verdict (Phase 1, #1762). Approving a request whose review is not a pass now needs the administrator's recorded override, which names the review in force and every override-class reason standing and is recorded by one statement that pins the review row as it was read. A reason nothing clears refuses whatever the body says, and every read or write failure after the request was read refuses; nothing fails open. `nemar admin publish list | show | start | next | approve` and the administrator's comment to the depositor show and use the review in the same words; approval stays the administrator's own act. Every failure of the publish group exits non-zero (#1581 for this group). Production stays dark: the gate reads nothing with the flag off. ADR 0102 is amended; production must not be lit before #1604 (Phase 3) is fixed.
Approval robustness for the publication review (#1730, epic #1726, ADR 0103). A web approval is attributed by a per-claim dispatch token (#1604): the clicker is the approver only for a call that carries a valid token, every other caller is recorded as themselves, and a terminal approval takes the claim over once it passes the gates. A call that carries a token may carry no decision of its own (override, screen acknowledgment or skipped CI check). Also: a request_id precondition on approve, approve-dispatch and deny (#1579); dataset-id validation before the claim (#1583); a token-authenticated release endpoint and a recorded last_error on every pre-loop exit (#1582); one router-wide cookie Origin guard (#1603, #1584); a lease-gated conditional deny that never denies a request whose publication started, and a status-guarded final write; and an all-steps-done branch that refuses a closed request before its tail jobs and records one dataset_published row per publication. #1580 is deferred. Tested: full suite on the head (15669 pass; the 5 known bash-completion failures and one load flake of a mail test that passes alone), a 29-row mutation battery red, CI green. Reviewed by an Opus review and two rounds of Sonnet agents; every finding fixed or recorded in ADR 0103.
The API half of Phase 4 of epic #1726 (the web approval page). Splits each reason's cure into a neutral sentence and a CLI-only command (terminal text unchanged, golden pinned), adds the detail fields start_offered, screen_gate and the findings' label and document_label, a statement and command on each reason, the 22-key page-owned copy table with a parity test, the web-safety pin, and the ADR 0102 Phase 4 amendment. Reviewed by one Opus review and a two-round Sonnet panel; every finding addressed. Part of #1731.
…c-publication-review # Conflicts: # .context/decisions/0102-a-publication-request-gets-a-derived-verdict-and-approving-a-non-pass-is-the-administrators-recorded-act.md # .context/decisions/README.md # README.md # backend/src/routes/admin/publish.ts # backend/src/services/publication-orchestrator.ts # scripts/ci/pr-review-prompt.ts # src/commands/admin.ts # test/admin-route-inventory.unit.test.ts
📦 Package PreviewYour package is ready to test! bun install -g nemar-cli@PR1782Version: 🤖 Updated on each push. |
…c-publication-review
This was referenced Oct 15, 2026
Merged
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A publication request now gets one derived verdict, in the same shape as the pull-request review (ADR 0092, ADR 0093): the Worker builds it from the mechanical gates (submission minimums, BIDS check, identifier screen) plus a no-tools model review of the submission, ties it to a commit and version, and gates approval on it. Anything that is not a clear pass is
action_requiredand needs--forceor an explicityinnemar admin publish next; nothing is auto-denied and unknown is never green. The identifier screen stays mechanical and the model never receives header values, identifier findings or data content. The design is ADR 0102 (with amendments for Phases 2 to 4) and ADR 0105 (the per-claim dispatch token that attributes a web approval correctly).Closes #1726
Phases completed
publication_reviewsstore (migration 0098), derived verdict, central workflowrun-publication-review.ymlsource with dispatch, one-shot claim, closed-vocabulary report, watchdog, caps, admin mail section, start route.nemar admin publish listshows the verdict, plusshow,next,start, and the--forcegate; approval stays the administrator's own act.Dev moved while the epic was being built (#1769, #1770, #1777, #1778), so this branch carries a merge of dev with two renumberings: the dispatch-token ADR is now 0105 (dev took 0103 and 0104) and the publication-reviews migration is now 0098 (dev took 0096 and 0097).
publish listmoved tosrc/commands/admin-publish.tsin this epic, so the new default scope, the state flags,--searchand the withdrawn label from #1777 and #1778 were ported there. A lost write between approve and withdraw answers 409request_changed(the epic's word) where dev answeredrequest_ended.Behavior changes at the next release
nemar admin publish listdefaults to active requests;--allshows history.dataset_publishedfields, new 409 codes and the optionalNEMAR_APPROVE_RETRY_DELAY_MSsetting.Deployment order
main; it is a no-op for a backend that sends no token.Test plan
bun run lint, the ADR index test and migration checks on the merged head