[KatalKavya96]

Summary

• Fix missing vetted-ops caller permissions for the three security issue-import workflows by documenting their exact minimum grants in Setup configuration.
• Extend setup reconcile to detect missing callers or operations, propose a minimal policy diff, and require explicit confirmation before applying changes.
• Add a reconciliation evaluation fixture covering all three import callers, extend the evaluation output contract, and update case counts.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other: Setup skill instructions and reconciliation evaluation contract

Test plan

• prek run --all-files passes
• Workspace pytest, Ruff check, Ruff format, and mypy passed
• Groovy bridges — not changed
• Model-based step-reconcile evaluation: 4 passed, 0 failed
• New case-4-import-policy-grants regression fixture added

RFC-AI-0004 compliance

• HITL — policy edits require explicit confirmation
• Sandbox — no new unrestricted access
• Vendor neutrality — existing adopter policy conventions preserved
• Conversational + correctable — missing grants presented individually
• Write-access discipline — no automatic permission changes; existing grants preserved
• Privacy LLM — not affected

Linked issues

Closes #1731

Notes for reviewers

The current import workflows require only:

• security-issue-import: rollup-append
• security-issue-import-from-md: rollup-append
• security-issue-import-from-pr: pr-view-with-body, rollup-append

Although the issue mentions body-field-set, no import workflow currently invokes it, so this PR intentionally does not grant it.

The vetted-ops dispatcher and tracker procedures are unchanged. Policy updates remain subject to explicit user confirmation.

AI assistance was used for investigation, patch drafting, and review. Changes were applied and validated locally by the contributor.

[KatalKavya96]

Hi @potiuk ,

The fix for #1731 is ready for review.

What changed:

• Documented the minimum vetted-ops permissions for all three security issue-import callers.
• Extended setup reconcile to detect missing callers and operations in existing policies.
• Preserved explicit user confirmation before policy edits, existing permissions, and unrelated caller configurations.
• Added a regression fixture covering all three missing-grant scenarios.

Validation completed:

• prek run --all-files — all hooks passed.
• Model-based step-reconcile evaluation — 4/4 passed, 0 failed.

One clarification: although the issue mentions body-field-set, none of the current import workflows invokes it, so it was intentionally excluded to maintain least-privilege access.
Thanks!

[potiuk]

Making reconcile check the import callers' grants, with an item-by-item confirmation and no implicit policy creation, is the right shape for #1731; the one thing to change is where the required grants come from, since a second copy of them will drift as soon as #1750 lands.

Smaller observations

• See inline comments on plugins/magpie-setup/skills/setup/config.md:273, plugins/magpie-setup/skills/setup/reconcile.md:158.

---

This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. The findings
below are observations, not blockers; an Apache Magpie
maintainer — a real person — will take the next look at the
PR. If you think a finding is mis-applied, please reply on
the PR and a maintainer will weigh in.

More on how Apache Magpie handles maintainer review:
Contributing guide.

[potiuk]

@KatalKavya96 I rebased this branch onto the current main (now at 259ac688), and force-pushed it. I resolved the two conflicts in the setup eval counts: the setup suite is now 151 cases across 32 steps, in both tools/skill-evals/README.md and tools/skill-evals/evals/setup/README.md. Please pull (git pull --rebase or reset to the remote branch) before you push again, so the rebase isn't undone.

[potiuk]

A follow-up after a second read of the same commit: three more gaps in where and when the import-grant check runs, all minor. One correction to my earlier review as well: after the rebase, config.md does have ## Step 3a — Security tracker backend, and the grants block sits under it, so my comment on reconcile.md:158 saying the section does not exist was wrong; I have resolved it. Linking the anchor (config.md#step-3a--security-tracker-backend) would still help.

Smaller observations

• See inline comments on plugins/magpie-setup/skills/setup/config.md:274, plugins/magpie-setup/skills/setup/config.md:284, plugins/magpie-setup/skills/setup/reconcile.md:153.

---

This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. The findings
below are observations, not blockers; an Apache Magpie
maintainer — a real person — will take the next look at the
PR. If you think a finding is mis-applied, please reply on
the PR and a maintainer will weigh in.

More on how Apache Magpie handles maintainer review:
Contributing guide.

[potiuk]

Marking this as changes requested, so the PR's status matches where it stands: the points in my earlier review (#1749 (review)) are still open and need a change, or a reply on their threads. This review adds nothing new to them.

---

This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. After you've
addressed the points above and pushed an update, an Apache Magpie
maintainer — a real person — will take the next look
at the PR. The findings cite the project's review criteria;
if you think one of them is mis-applied, please reply on the
PR and a maintainer will weigh in.

More on how Apache Magpie handles maintainer review:
Contributing guide.

[potiuk]

Thanks for the fix, @KatalKavya96. The branch hasn't changed since my rebase on 2026-10-23 (it's still at 259ac688), so the inline threads from my earlier review are still open. The main one is still where the required grants come from. tools/vetted-ops/README.md already has these [callers] entries, and #1750 is about to change them. If config.md and reconcile.md point at that block instead of restating it, the copies can't drift. That also fixes the Jira / local-files gap for issue-import-from-md. The other two threads are about where the check runs: it currently only runs from Step 3a, and Step 3b still stamps the import skill when the grant diff is declined.

Two more things for the next push:

• main has since added a ### Personal tool configs subsection to config.md at the spot where this PR inserts its block, so please rebase onto current main first, and re-check the setup case counts.
• The case-4-import-policy-grants fixture tells the model what to return: report.md lists each caller's required operations and ends with "Do not modify the policy or write a clean reconciliation stamp. Return the missing caller/grant proposals only." With that in the input, the case passes no matter what reconcile.md says. Please remove those instruction lines. Ideally, give the README [callers] excerpt as context and let the model work out the missing grants, and add a case where the user declines to check that no clean stamp is written.

Separately: reconcile now writes the vetted-ops policy itself. Elsewhere it hands config gaps to setup config, and config.md now says the user saves the policy from a draft. Handing off to setup config <skill>, or showing the diff for the user to save, would keep that consistent.

[potiuk]

@KatalKavya96, checking in: the head is still the rebase from 2026-10-23, and five review threads are open. The one to settle first is where the grants live. The [callers] example in tools/vetted-ops/README.md already lists them, and #1750 edits that same example, so a second copy in config.md goes stale as soon as either PR merges. Please keep one source (the README example, linked from config.md and reconcile.md) and line this PR up with #1750 on it.

The other threads still apply too: the check sitting inside Step 3a, the clean stamp after a declined grant diff, the fixed map missing issue-import-from-md's own Jira / local-files operations, and the eval case that states its expected result. Please push fixes or reply on each thread, and I'll take another look once the head moves.

---

This comment was drafted by an AI-assisted tool and confirmed by an Apache Magpie maintainer.

[potiuk]

@KatalKavya96, I merged main into this branch (7162ae8). The conflicts were in plugins/magpie-setup/skills/setup/config.md, where I kept your import-grant section and main's new personal-tool-configs section, and in the eval counts: setup is now 153 cases across 33 steps. Please pull before pushing again. The five review threads are still open.

---

This comment was drafted by an AI-assisted tool and confirmed by an Apache Magpie maintainer.

[KatalKavya96]

@potiuk I've pushed 3b13bfd33 addressing all five review findings.

• Single source of truth: Setup config and reconcile now reference the canonical vetted-ops README for caller grants, including fix(security): deduplicate imports using authorized tracker body index #1750's issue-list-with-bodies.
• Grant checks: Run independently of Step 3a, even when the tracker is already configured.
• Reconciliation stamps: Declined or unresolved grants no longer allow the affected skill to be stamped clean.
• Backend permissions: Added Jira and local-files grant requirements for all three import callers, replacing the incomplete fixed mapping.
• Evaluations: Removed expected-answer instructions from Case 4 and added Case 5 to test declined grants.

Validation: All repository hooks passed, and all 5 step-reconcile model evaluations passed (5/5).

Thanks for the detailed reviews!

[potiuk]

Thanks for the update. The pointer to the canonical [callers] block, the fixed Step 3a anchor and the stamp rule in config are the right direction, but the change now loses grants main gives today, so it needs another round (inline below).

Three more, on the evals and merge order:

• Case 4 (step-reconcile) now quotes a README excerpt that no longer matches this PR's README: it shows "security-issue-import" = ["rollup-append"] and expects "propose rollup-append only", while the README now lists issue-list-with-bodies too.
• Case 5 does not test the decline. Its expected output is the same as a plain missing-grant case, and the extracted section (reconcile.md § The sweep) stops before the Step 2 decline handling, so a model that ignores the decline still passes. It needs Step 2 in the extraction, or an output field that records the decline.
• The step-reconcile row in tools/skill-evals/evals/setup/README.md has a stray cell (…) |, and a declined…).
• Merge order: the README grants issue-list-with-bodies, which only exists once #1750 lands; please keep this PR behind #1750, and note in the Jira / local-files lines that it is GitHub-only.

The threads were resolved without a reply on each; please answer on the thread when you push, so the review history shows what changed where.

the backend grants for the other security callers are gone (plugins/magpie-setup/skills/setup/config.md:328)

Grant the security callers issue-create, issue-search, issue-list-label, issue-reopen, issue-body, issue-attach, tracker-doctor, tracker-pending and tracker-publish in the same diff.

For caller permissions, use the canonical [vetted-ops `[callers]` example](../../../../tools/vetted-ops/README.md#configuration), including only the operations applicable to the selected backend.

This replaces main's instruction to grant the security callers their backend operations, but the README block it points at only lists additions for the three import callers. On Jira or local-files, setup config no longer tells the user to grant sync, fix, cve-allocate, deduplicate and the rest tracker-doctor, issue-body, issue-attach or tracker-publish, and those skills stop mid-run with "operation not permitted". Please keep the guidance for every security caller, either here or in the README block.

the import callers' backend list is incomplete (tools/vetted-ops/README.md:226)

Backend-specific additions for EACH of the three security-issue-import

callers above (keep all operations already listed for that caller):

#   jira:        tracker-doctor, issue-body, issue-attach

On a non-GitHub backend every tracker command the import skills run is a vetted operation, gated per caller. Besides these three, the import callers create trackers (issue-create, issue-import/apply.md, issue-import-from-md) and search for duplicates (issue-search, issue-list / issue-list-label, issue-comments, issue-view). A policy reconciled from this list cannot create a tracker on Jira or local-files. Please list the operations the three skills actually call on each backend.

Smaller observations

• See inline comments on plugins/magpie-setup/skills/setup/config.md:347, plugins/magpie-setup/skills/setup/reconcile.md:235.

---

This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. After you've
addressed the points above and pushed an update, an Apache Magpie
maintainer — a real person — will take the next look
at the PR. The findings cite the project's review criteria;
if you think one of them is mis-applied, please reply on the
PR and a maintainer will weigh in.

More on how Apache Magpie handles maintainer review:
Contributing guide.

[KatalKavya96]

Hi @potiuk, thanks for the detailed review!

I've pushed another round of fixes in 5ae6ddeea addressing the latest feedback:

• Restored backend permission guidance for all security callers, with per-caller, least-privilege grants.
• Expanded the canonical vetted-ops README with Jira/local-files operations required by the three import workflows.
• Promoted the import-grant check to an independent ## section, so it runs even when the tracker is already configured.
• Updated reconciliation to verify the saved policy before writing a clean stamp.
• Updated the evaluation fixtures and added three confirmation cases covering declined, confirmed-but-unsaved, and verified policies.

Validation: All 8 reconciliation evaluations pass. Documentation, lint, formatting, and type-check hooks pass. The remaining local workspace pytest failures are unrelated macOS Unix-socket path limitations and an existing upstream template-drift mismatch; the affected socket tests pass with a shorter pytest base path.

I've also kept the issue-list-with-bodies GitHub-only limitation explicit.

The changes are ready for another review. Thanks again!

[potiuk]

Thanks for working through every point, @KatalKavya96 — this round settles them all: the grants now come from the one [callers] example, every security caller keeps its backend guidance, the decline and the saved-policy check have their own eval suite, and the replies on each thread make the history easy to follow.

One small gap was left, and I fixed it on your branch rather than ask for another round (8dd0216):

• tools/vetted-ops/README.md and plugins/magpie-vetted-ops/tools/vetted-ops/README.md: added issue-view to the Jira lists for security-issue-import-from-md and security-issue-import-from-pr. Both skills read the issue's labels with issue-view before regenerating the CVE JSON on a non-GitHub tracker (issue-import-from-md/SKILL.md:170, issue-import-from-pr/SKILL.md:162), so without it a policy reconciled from this list stopped at that step with "operation not permitted". security-issue-import already had it.

Please pull before pushing again.

---

This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. The maintainer
approving this PR has read the findings and signed off. If
something feels off, please reply on the PR and a maintainer
will follow up.

More on how Apache Magpie handles maintainer review:
Contributing guide.