[mrizzi]

Summary

Follow-up to #346 (TC-6979). This PR re-pins .fullsend/harness/verify-pr.yaml base: from 80de88af to c32f1c40, which is #346's commit on main, and re-locks with fullsend lock verify-pr --fullsend-dir .fullsend (fullsend v0.43.0). Without this, fullsend runs keep serving the pre-#346 pre-verify-pr.sh, schema and correctness.md, so CI Status still ignores commit statuses.

• The base harness sha256 is unchanged (3c9dc221…). Only the commit SHA moves.
• Locked hashes match main for pre-verify-pr.sh, verify-pr-input.schema.json and correctness.md.
• triage-security pins (c4891346) are untouched.
• Guard rule: the only verify-pr content in 80de88af..c32f1c40 is fix(verify-pr): wait on and report commit statuses in dispatch gate and CI Status #346. The GitHub fullsend pins (v0.43.0 / d5f36921) are not changed.
• python3 -m pytest plugins/sdlc-workflow/scripts/ -q: 717 passed.

⚠️ Merge with a merge commit (fullsend.md §Constraints and gotchas).

Implements TC-6979 · completes TC-6978

🤖 Generated with Claude Code

Summary by Sourcery

Re-pin and re-lock the verify-pr Fullsend harness to the main commit containing the latest CI status handling.

Bug Fixes:

• Update the verify-pr Fullsend harness to consume the post-fix(verify-pr): wait on and report commit statuses in dispatch gate and CI Status #346 implementation so CI status checks correctly account for commit statuses.

Enhancements:

• Re-pin the verify-pr harness to commit c32f1c4 while preserving the existing base integrity hash and unaffected security pins.

Chores:

• Regenerate the Fullsend lockfile and dependency checksums for the updated verify-pr harness.

[sourcery-ai]

Reviewer's Guide

Re-pins verify-pr to main commit c32f1c4 and regenerates its Fullsend v0.43.0 lock entries, ensuring CI uses the #346 versions of the script, schema, and correctness guidance while preserving the base integrity hash and unrelated pins.

File-Level Changes

Change	Details	Files
Re-pins the verify-pr harness to the commit containing #346 while preserving the existing base file integrity hash.	Updates the base reference from 80de88a to c32f1c4. Keeps the base harness SHA-256 unchanged and leaves triage-security and GitHub Fullsend pins intact.	.fullsend/harness/verify-pr.yaml
Regenerates the Fullsend lock data so verify-pr resolves all resources from the new main commit.	Updates locked dependency URLs and hashes for verify-pr scripts, schema, skills, documentation, and plugin contents. Refreshes harness and resource resolution timestamps while retaining unchanged hashes where content did not change.	.fullsend/lock.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path=".fullsend/harness/verify-pr.yaml" line_range="31" />
<code_context>
 # commit + the sha256 to `shasum -a 256 harness/verify-pr.yaml`, `fullsend lock`.
-base: https://raw.githubusercontent.com/RHEcosystemAppEng/sdlc-plugins/80de88affe47f2086d5f7bc2a2015092c33b478e/harness/verify-pr.yaml#sha256=3c9dc221e2a37e7aa7ff294381b6b5b1580771ba70432c42924fc3a85f078e63
+base: https://raw.githubusercontent.com/RHEcosystemAppEng/sdlc-plugins/c32f1c408f4da393b90c15b13a7d693946e0e232/harness/verify-pr.yaml#sha256=3c9dc221e2a37e7aa7ff294381b6b5b1580771ba70432c42924fc3a85f078e63

 # CEL trigger (ADR 0061) — MUST be declared here, on the composing child, not
 # only on the base. `fullsend dispatch` registers this child (config.base.yaml
</code_context>
<issue_to_address>
**Commit status text can steer reviews**

When a status publisher able to set a PR head's commit status supplies a context or description containing instructions aimed at the review agent, the Correctness sub-agent receives the status context and description as prompt content and can follow embedded directives to disregard CI results or alter its review. The caller then sees a manipulated verification report.

Delimit status fields as untrusted data and explicitly instruct the sub-agent to ignore any instructions contained in them.
</issue_to_address>

Sourcery assessment

Approval pending. 1 finding to address first.

Blocking findings: .fullsend/harness/verify-pr.yaml:31

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[sourcery-ai]

🟡 Medium · Commit status text can steer reviews

When a status publisher able to set a PR head's commit status supplies a context or description containing instructions aimed at the review agent, the Correctness sub-agent receives the status context and description as prompt content and can follow embedded directives to disregard CI results or alter its review. The caller then sees a manipulated verification report.

Delimit status fields as untrusted data and explicitly instruct the sub-agent to ignore any instructions contained in them.

Prompt for AI agents

In `.fullsend/harness/verify-pr.yaml` at line 31:

**Commit status text can steer reviews**

When a status publisher able to set a PR head's commit status supplies a context or description containing instructions aimed at the review agent, the Correctness sub-agent receives the status context and description as prompt content and can follow embedded directives to disregard CI results or alter its review. The caller then sees a manipulated verification report.

Delimit status fields as untrusted data and explicitly instruct the sub-agent to ignore any instructions contained in them.

[fullsend-ai-review]

🤖 Finished Verify Pr · ⏭️ Skipped (no Jira issue links PR #347 in its Git Pull Request field) · Started 2:22 PM UTC · Completed 2:22 PM UTC

Commit: be6ec2c · View workflow run →

Effort: high