What happened
On PR #29, the review agent posted CHANGES_REQUESTED 3 times driven by a high-severity protected-path finding on .github/workflows/fullsend.yaml. The file contains an explicit managed-file header ('This file is managed by fullsend. Do not edit it directly.') and the PR author is fullsend-ai-fullsend[bot]. The review agent's own info-level authorization finding correctly stated 'automated bot performing template synchronization' and 'change is mechanical', but the protected-path finding ignored that signal. Human reviewer approved on Jul 6 without addressing any findings, confirming them as false positives. The CHANGES_REQUESTED verdict contributed to a 27-day merge delay for a 5-line change.
What could go better
The review agent should consume its own authorization-inference signal when calibrating protected-path severity. When the platform bot modifies a file that declares itself as managed by fullsend, the protected-path finding should be informational, not blocking. This is distinct from #2588 (dep bots like Renovate/Dependabot) and #3061 (Dockerfile digest rotations) — the platform bot updating its own managed infrastructure is the strongest possible authorization case. Confidence is high: the review agent's own findings demonstrate the contradiction, and the human override confirms the blocking verdict was unnecessary.
Proposed change
Extend the review agent's protected-path severity calibration to recognize when fullsend-ai-fullsend[bot] modifies files containing managed-file headers. When both conditions are met, downgrade the protected-path finding from high to info severity, changing the verdict from CHANGES_REQUESTED to COMMENT. The detection signal already exists in the authorization-inference finding; the severity assignment just needs to consume it.
Validation criteria
Next 5 PRs from fullsend-ai-fullsend[bot] modifying files with managed-file headers should receive COMMENT verdicts (not CHANGES_REQUESTED) when the only blocking finding is protected-path. Non-managed files modified by the same bot should retain standard severity.
Generated by retro agent from fullsend-ai/experiments#29
What happened
On PR #29, the review agent posted CHANGES_REQUESTED 3 times driven by a high-severity protected-path finding on .github/workflows/fullsend.yaml. The file contains an explicit managed-file header ('This file is managed by fullsend. Do not edit it directly.') and the PR author is fullsend-ai-fullsend[bot]. The review agent's own info-level authorization finding correctly stated 'automated bot performing template synchronization' and 'change is mechanical', but the protected-path finding ignored that signal. Human reviewer approved on Jul 6 without addressing any findings, confirming them as false positives. The CHANGES_REQUESTED verdict contributed to a 27-day merge delay for a 5-line change.
What could go better
The review agent should consume its own authorization-inference signal when calibrating protected-path severity. When the platform bot modifies a file that declares itself as managed by fullsend, the protected-path finding should be informational, not blocking. This is distinct from #2588 (dep bots like Renovate/Dependabot) and #3061 (Dockerfile digest rotations) — the platform bot updating its own managed infrastructure is the strongest possible authorization case. Confidence is high: the review agent's own findings demonstrate the contradiction, and the human override confirms the blocking verdict was unnecessary.
Proposed change
Extend the review agent's protected-path severity calibration to recognize when fullsend-ai-fullsend[bot] modifies files containing managed-file headers. When both conditions are met, downgrade the protected-path finding from high to info severity, changing the verdict from CHANGES_REQUESTED to COMMENT. The detection signal already exists in the authorization-inference finding; the severity assignment just needs to consume it.
Validation criteria
Next 5 PRs from fullsend-ai-fullsend[bot] modifying files with managed-file headers should receive COMMENT verdicts (not CHANGES_REQUESTED) when the only blocking finding is protected-path. Non-managed files modified by the same bot should retain standard severity.
Generated by retro agent from fullsend-ai/experiments#29