Add a smaller intent-drift check, grounded in a real Copilot session - #6367

🔒 PR Risk Scan Results

Scanned 2 changed file(s).

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access, including a maintainer with admin or maintain permission.

Automated checks

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s); an approval from a maintainer with admin or maintain permission
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

_{Updated for 0dd59a1 · gate run · This comment is maintained automatically — see submission gate docs.}

🔴 Contributor Reputation Check: HIGH risk

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

🔍 Vally Lint Results

✅ All checks passed

Summary

### Linting skills/intent-drift
✅ intent-drift (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

Pushed ea988b0a to address the five review points:

1. Full suite, not just the first failure — step 1 now defines acceptance as the full suite the request refers to, and step 5 re-runs that full suite after reverts.
2. Staged and untracked changes — step 2 now inspects git diff, git diff --cached, and reads untracked files from git status.
3. Mixed hunks — step 3 now splits each hunk into the smallest independently reviewable changes before applying the necessity test, and only judges a whole hunk when it truly cannot be split. The worked example now calls out that its single mixed hunk had to be split.
4. Uncorrected verdict — the verdict is now on track | drifted (uncorrected) | drifted (corrected); drifted (corrected) is only allowed after the reverts are complete and the acceptance check passes, and a revert that breaks the check means the change was required.
5. Test updates for requested behavior changes — the blanket test rule is replaced: weakening/skipping/deleting a test to make it pass is drift, but updating assertions that encode old behavior is required when the user asked to change that behavior.

Validation: npm run skill:validate passes, npm run build regenerated, line endings normalized.

Pushed 1e211bd4 for the third review:

1. Discount clamp (high) — the transcript stays verbatim, but a caveat now says max(0.0, min(discount, 1.0)) is input validation that prevents negative totals; the current procedure keeps it and flags it for human review instead of treating its removal as a successful correction.
2. Staged then working tree — step 5 now clears the index first (git restore --staged -p) and the working tree second (git restore -p), with an explanation that the reverse order only unstages a staged-only change and leaves the edit in the files.
3. Untracked files in the final check — the post-revert check now runs git status --short --untracked-files=all alongside both diffs, deletes out-of-scope new files created by the agent, and keeps user-authored untracked files. This also covers a newly added file that becomes untracked after unstaging.

Validation passes: npm run skill:validate, npm run build, line endings normalized.

Pushed 10348134: SKILL.md now has a Dependencies section that states the skill has none, and explicitly names the same-named intent-drift packages on PyPI and npm as separate, unrelated projects. It says not to run pip install intent-drift or npm install intent-drift to use the check. Nothing here imports or invokes them; the skill still uses only git and the target repo's existing test command.

Pushed 0dd59a14: the skill now runs both published packages on every invocation.

• PyPI intent-drift==0.1.3 via IntentAlignmentEngine and render_report.
• npm intent-drift@1.1.0 via npx intent-drift ... --auto-context --format json.
• Both versions are pinned; the report has a PYPI: line and an NPM: line with status, alignment, and confidence.
• If either engine reports drift, the verdict is drift; disagreement is reported and held as drift until reconciled.
• The npm CLI exits 1 below its 75% threshold and prints a warning before the JSON, so the skill says to treat that as a drift result and parse from the first {.

Both paths were exercised against a scratch repo (PyPI: Moderate_Drift 72%; npm: Moderate_Drift 70.3%, exit 1). PR body updated to describe the dependency change. npm run skill:validate passes.