[dmccoystephenson]

Summary

Commands that harnesses refuse were prescribed, or left unmentioned, in two parts of the generated-skill template. Both are corrected in the template body of create-dev-loop.md.

• Phase 5 (Phase 5's read-only 'gh api .../pulls/<n>/comments --jq' is refused by the attribution hook as an unsigned post #135): the default snippet is changed to gh pr view <number> --comments plus gh pr view <number> --json reviews. What is left out by those two commands is stated: the text and path:line anchor of inline review comments. The gh api .../pulls/<number>/comments read is kept as an optional extra, with Body: removed from its --jq template as suggested in Phase 5's read-only 'gh api .../pulls/<n>/comments --jq' is refused by the attribution hook as an unsigned post #135. It is also stated that a refusal or an empty --comments result is never evidence that no review comments exist.
• Phase 3 (Phase 3: classifiers also reject shell-variable loops and $-anchored sed, not just $(...) #165): shell variable expansion and $-anchored sed/awk are added to the "Avoid command substitution" rule, and one gh ... --json <fields> -q '<jq filter>' call is prescribed in place of a per-item shell loop.

Closes #135
Closes #165

Deviations from #135, based on source checks made in this dispatch:

• It is said in the issue that gh pr view --comments "returns the same information" as the gh api call. That was not confirmed. When it was run against PR Make Steps 6 and 7 safe to re-run under overwrite mode #175, conversation comments and the Copilot review summary were shown, but no inline comment text was shown.
• It is implied in the issue that a --jq template without a literal Body: label is accepted. In this dispatch, gh api repos/Stephenson-Software/create-dev-loop/pulls/175/comments --jq '.[] | "\(.path):\(.line) — \(.body)"' was still refused with This command requires approval. The call is therefore written as optional, not as the fix.

gardener interface: Steps 3, 5, and 6 are untouched, so no breaking change is introduced for gardener.

Retrofit: the Phase 5 snippet and the Phase 3 rule are copied into every generated skill, so a retrofit pass is likely needed for every existing <slug>-dev-loop skill. Per #135, Phase 5 was already fixed locally in medieval-factions-dev-loop. The old snippet is still carried by create-dev-loop-dev-loop.

Research grounding

No RESEARCH.md finding applies. These corrections are based on refused commands that were observed, and no empirical claim is relied on, so no Implementations entry is added.

Doc sync check

• README.md's "What it does" Step list still matches create-dev-loop.md's Steps 1:1 (no Step was changed)
• Every {{placeholder}} added or changed has a corresponding Step 4 substitution-table row (none were added; GITHUB_OWNER and GITHUB_REPO are unchanged)

Test plan

• python3 scripts/check_docs.py: "Doc consistency check passed."
• python3 -m unittest discover -s tests: 42 tests were run, OK.
• gh pr view 175 --comments was run, and the claims made in Phase 5 were checked against its output.
• The gh api read was attempted in this dispatch and was refused, as warned in Phase 5. Its output format has therefore not been observed.
• The jq-filter pattern from Phase 3 was run: both PRs were returned by gh pr list --state merged --json number,mergedAt -q '.[]|select(.number|IN(174,175))'.
• UNVERIFIED (behavioral): no /create-dev-loop run was performed, because a GitHub repo is created in Step 6 and files outside the checkout are written in Steps 3 and 5, and neither is authorized in a headless dispatch ([self-audit] The repo's own validation anchor is structurally unrunnable in a headless dispatch, so template changes can never merge autonomously #109). None of the five CLAUDE.md checklist items was exercised, so this PR is left for a maintainer to merge.

The template body is not covered by anything automated, so no evidence about generated-skill behavior is given by a green doc-consistency job. The loop refusal named in #165 was not re-run here. It is taken from the observations recorded in #165 and from a later dispatch's notes.

Issues not picked this cycle

• CLAUDE.md still links gardener under the old dmccoystephenson owner #106 and the CLAUDE.md half of Step 4 and CLAUDE.md still place the version comments at the top of the generated skill #173: explicit authorization is required for CLAUDE.md edits.
• [self-audit] The repo's own validation anchor is structurally unrunnable in a headless dispatch, so template changes can never merge autonomously #109: the options listed there are left as a maintainer decision.
• Unverified: whether an in-checkout .worktrees/ survives gardener's refresh (git clean -fdx) #114: an observation of gardener's refresh is needed, which cannot be made in this dispatch.
• gh prose examples carry no attribution sign-off, and --body-file paths must be literal (a shell variable is invisible to the hook) #122 and grep is not on tend's allow-list, so generated validation checklists and verify-by-removal assertions cannot run headlessly #127: refused commands are also covered there, but a wider change is needed (a sign-off in every gh example, and grep replaced throughout generated checklists) than the two small edits made here.
• Phase 5: compress the review wait for a single autonomous run with no reviewer assigned or requested #150: Phase 5 is also touched there, but its skip condition is left unsettled by the empty reviewRequests evidence in its comments.
• All other open issues (Phase 4's rubric scores the diff only, so PR-description obligations like CLAUDE.md's retrofit note go unchecked #120, The >50-deleted-lines do-not-auto-merge heuristic misfires on extraction refactors, test migrations, and generated artifacts #124, An approval-gated CI run reads as 'no checks reported', which is neither the green nor the red Phases 1 and 4 branch on #129, A restricted fetch refspec also blocks checking out an existing remote branch, with an error that reads as 'branch does not exist' #130, Test the mechanism, not the stochastic outcome, when a mock cannot exercise an acceptance criterion #131, Phase 4 verifies backward 'Closes #N' references but not forward 'a follow-up issue has been filed' promises #133, Tests-fix has no path for a scope-blind anchor, only for an anchor that cannot run #140, Upstream COMMANDS.md is trusted as source, but it can disagree with the command class it documents #141, Stage A sweeps fix the instances named, not the class — and a prose grep is treated as a CI-strength anchor #143, Phase 1 triage never checks whether the default branch's own CI is green #144, A refused environment probe is not grounds for UNVERIFIED — the anchor has to be attempted first #145, Phase 2: bundle a small docstring/annotation fix with a co-located test or doc update as one PR #146, Phase 3: never pre-escape Edit-tool strings — verify the diff for literal backslash-quotes after inserting quoted text #147, Phase 1 repo resolution assumes the configured clone is clean; stale staged work in a shared cache clone blocks git pull #148, Tests-fix revert produces compile errors, not failures, when the new tests reference symbols the fix introduces #149, Dispatched runs can load an installed skill copy older than the rules merged in the skill's repo #158): deferred, unassessed in depth, so that this PR is kept to one theme.

This PR description was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

🤖 Generated with Claude Code

---

drafted by Claude on behalf of Daniel Stephenson

[dmccoystephenson]

Self-review rubric (head a682682). This comment is not an independent review; it was produced by the session in which the PR was authored.

Universal items:

• Scope: PASS — one file was changed, by 4 insertions and 3 deletions, and each hunk is mapped to Phase 5's read-only 'gh api .../pulls/<n>/comments --jq' is refused by the attribution hook as an unsigned post #135 or Phase 3: classifiers also reject shell-variable loops and $-anchored sed, not just $(...) #165.
• Tests-new: PASS (not applicable) — no function was added.
• Tests-fix: FAIL — the changed text is not reached by any test, and a CI revert would show nothing, since it is not executed by CI. The fallback rungs are unavailable, so the PR is handed to a human.
• Sibling structure: PASS (not applicable) — no new file was added.
• Sibling renames: PASS (not applicable) — the "Avoid command substitution" heading was kept, so the references to it in Phases 4 and 6 still hold.
• Docs: PASS — a Phase 7 pass was performed. The Phase 5 commands are not restated in README.md, CONTRIBUTING.md, SECURITY.md, the PR template, or the template-rule issue template, as confirmed by a search of those files. CLAUDE.md is unaffected.
• Issue resolution: PASS — the surfaces named in Phase 5's read-only 'gh api .../pulls/<n>/comments --jq' is refused by the attribution hook as an unsigned post #135 and Phase 3: classifiers also reject shell-variable loops and $-anchored sed, not just $(...) #165 were both changed. Two claims in Phase 5's read-only 'gh api .../pulls/<n>/comments --jq' is refused by the attribution hook as an unsigned post #135 were found to be inaccurate, and the source was followed. Both deviations are recorded in the PR body.
• CI: PASS, with no behavioral signal — doc-consistency passed on the head, but its scope excludes what the changed text does.

Repo-specific items:

• Placeholder parity: PASS — no placeholder was added, and check_docs.py passed. GITHUB_OWNER and GITHUB_REPO are still used, so their rows are not orphaned.
• README Step parity: PASS — no Step was added, removed, or renamed.
• Fence escaping: PASS — one line was changed inside an already-escaped fence, and no fence was added.
• Phase numbering: PASS — no phase was renumbered.
• Version comments: PASS (not applicable) — the header was not touched.
• Research grounding: PASS — it is stated in the PR body that no finding applies.
• No back-ported specifics: PASS — only {{GITHUB_OWNER}}/{{GITHUB_REPO}} and generic commands appear in the added text.
• gardener interface: PASS — Steps 3, 5, and 6 were not changed.
• Retrofit note: PASS — it is stated in the PR body that every existing generated skill likely needs a pass.
• Behavioral validation: FAIL — marked UNVERIFIED in the PR body, so no auto-merge.

Points for the maintainer's review, none of which were changed:

• create-dev-loop.md:424 — the --jq output format of the optional gh api read has not been observed, since the call was refused in this dispatch.
• create-dev-loop.md:424 — it is claimed that inline text is not shown by the two default commands. That was observed for --comments on PR Make Steps 6 and 7 safe to re-run under overwrite mode #175, while --json reviews was observed on that PR in an earlier dispatch.
• create-dev-loop.md:157 — the Phase 1 repo-resolution block uses shell variables and a for loop, which is the construct that is now warned against in Phase 3. It was not touched here, since its form is a separate decision, and it is tied to Phase 1 repo resolution assumes the configured clone is clean; stale staged work in a shared cache clone blocks git pull #148.

Summary: the change reads correctly and CI is green, but the two FAIL items hold it for a maintainer, so it is not being merged by this dispatch.

This comment was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

---

drafted by Claude on behalf of Daniel Stephenson

[Copilot]

🟡 Changes recommended

The review flow lacks a blocking fallback when review summaries are insufficient and inline comments are inaccessible, allowing progression toward merge without the findings Phase 6 needs.

1 open issue

• Block merge when review findings cannot be retrieved · New

What changed in this PR

This PR updates the generated dev-loop template to reduce command refusals in headless harnesses, addressing the command patterns reported in #135 and #165.

Changes:

• Expands Phase 3 guidance to avoid shell-variable loops and favor a single filtered gh call.
• Uses gh pr view commands as Phase 5 defaults, retaining the inline-comment API read as optional and documenting the defaults’ limitations.

File	Description
create-dev-loop.md	Revises Phase 3 command guidance and Phase 5 review retrieval instructions for restricted harnesses.

_{Review effort: Balanced}

[dmccoystephenson]

The Copilot finding on a682682 was assessed against the source and was found valid. It was read from the review summary, since the inline-comment read was refused in this dispatch, so its title was used and its line anchor was not seen.

• create-dev-loop.md:424 — "Block merge when review findings cannot be retrieved": fixed. Under the earlier text, a review whose findings could be read in neither its summary nor its inline comments could have been passed over on the way to merge. A hold and a hand-off are now required for that case.

The self-review rubric was not re-run, as Phase 4 caps it at one pass. python3 scripts/check_docs.py passed and 42 unit tests were run, OK, locally on the fix. The behavioral check remains UNVERIFIED, and the PR stays held for a maintainer.

This comment was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

---

drafted by Claude on behalf of Daniel Stephenson