[HugoXK]

Fixes #3087

Owner: Dev-1
Reviewer: Reviewer
Written-by: Dev-1
Bot: FlyBot Dev-1
Claim-Id: 68f6cedfd0b34f568b1b921a281b0bb2
Tier: T3 (.github/**)
Base: ca07de0
Verified commit: 451c285063def5b7a674ac3374b93a3824f9c557
Tree: e28b0f24991a3fdc8d4dead49ab082f222026c6b
Pushed head: 0011b84

risk-gate.mjs is untouched; the whole change is two entries moving between the two lists a rule file already has, plus the tests that pin where each list applies.

The pushed head 0011b84d52 carries this tree (e28b0f24): the two-file patch is byte-identical to the version verified at 4a040aa1 on base 3891b4f0 — the only thing that changed is the rebase onto ca07de02 after #3084 merged, and TZ=UTC npm run verify was re-run on the rebased tree (451c2850, same tree) with exit 0, so every count below is that tree's.

What was wrong

tiers.T3.diffPatterns is read against the added lines of every code file, tests included (risk-gate.mjs:82-86). It listed new Function\( and \beval\(, so any pull request that adds a client test which mounts the built bundle — new Function('window', readFileSync(…))(window) is the standard way — was scored T3 by its own test harness. #3084 is the live example: four files, real change T2 (client code) + T2 (test) + T1 (changelog) + T0 (docs), yet it carries risk:T3 while its body says Tier: T2 and enqueue-guard computes T2.

Nothing merges that should not — T2 and T3 take the same path in merge-gate.mjs — but "T3 = high risk" becomes noise for every PR that adds a client test, and the label contradicts both the body and the guard.

The change

.github/agent/risk-rules.json, one line moved each way:

• tiers.T3.diffPatterns — "\\bchild_process\\b", "\\beval\\(", "new Function\\(" → "\\bchild_process\\b"
• tiers.T3.diffPatternsNotInTests — gains "\\beval\\(", "new Function\\(" ahead of the URL and fence rules.

The two lists keep exactly the meaning they had: diffPatterns is read for every code file, diffPatternsNotInTests for code files that are not tests, and a non-test code file reads both. So a bundle mount in plugins/social/test/x.test.js is now scored by its path (T2), while the same expression in plugins/social/client.js, core/src/client/** or core/src/host/** is still a T3 content hit. Everything else in the list is untouched — child_process, process.env.*TOKEN|KEY|SECRET, .only(/.skip(, lint-disable, the URL and fence rules and the create_child_bot topic.

Red first, at ca07de02, twice

The three tests were added with the rule file untouched: node --test .github/scripts/risk-gate.test.mjs → 24 tests, 22 pass, 2 fail, exit 1, both runs:

not ok 22 - #3087: `new Function(` in a test file is T2, while the same line in client code is still T3
  error: |-
    Expected values to be strictly equal:

    'T3' !== 'T2'
  expected: 'T2'
  actual: 'T3'

not ok 23 - #3087: `eval(` keeps the same split — a test file is its own tier, host code is still T3
  error: |-
    Expected values to be strictly equal:

    'T3' !== 'T1'
  expected: 'T1'
  actual: 'T3'

red-new-1.log sha256 f607b52f4871a308, red-new-2.log sha256 5310cf6f51f3dba4. The third new test passed in the red run on purpose: it is the control that the rules left in diffPatterns still count in a test file (child_process, a secret-shaped variable, it.skip(, a lint suppression → T3 each).

Green after, twice

Same command with the rule file changed → 24 tests, 24 pass, 0 fail, exit 0, both runs (green-new-1.log sha256 1d6f90e2fe869529, green-new-2.log sha256 22669eec49ae599a).

The three cases say what the issue asks for, and nothing wider:

• new Function( in plugins/social/test/x.test.js → T2, with no new Function( row in why; the same line in plugins/social/client.js → T3, why naming plugins/social/client.js: /new Function\(/.
• eval( in core/test/a.test.js → T1 (core/test/** is T1 by path, no eval row); the same line in core/src/host/groups.js → T3.
• the patterns that stay in diffPatterns still raise a test file to T3.

The base moved: #3084 merged, so this was re-cut

While this was being verified, #3084 — the very pull request the issue cites — merged as ca07de0289. Live main is ca07de02, none of its four files is one this branch touches, so the change was rebased onto it and every number above was taken again there: the rebased commit 451c2850 has tree e28b0f2499, the same tree the push path built on ca07de02, and red ×2 (24/22/2) and green ×2 (24/24) come from that tree.

The live proof, re-run on #3084's four files at f56aa4163d2b

Loaded the PR's GET /pulls/3084/files into both rule sets and ran createGate(...).judge(files):

• before (the base rules, unchanged by this branch): tier: T3, one why row — plugins/social/test/approval-dock-memory.test.js: /new Function\(/.
• after (this branch): the new Function( row is gone, and the row is still T3 — now on the size cap: size 373 lines / 4 files > 250 / 12 allowed for T2.

So the pattern defect is fixed, and that pull request is not the proof of a T2 outcome: #3084 is 373 lines over four files (plugins/social/client.js +85/−21, the test +264, changelog +1, docs/subsystems/social.md +2), and tiers.T2 caps at 250 lines / 12 files. That cap is a separate, intended brake — a T2-sized change stays T2, and a change larger than the T2 budget is T3 whatever its patterns say. The issue's own file counts (+64/−19, +236, +1, +2 = 322 lines) also exceed 250, so this was already true before the change.

Gates, at 451c2850 (tree e28b0f24, the pushed tree)

TZ=UTC npm run verify → exit 0: core 3248, social 684, tree 149, timeline 172, workflow 535, project 147, gate/policy 681, interop 37, live-e2e 34 — 0 fail everywhere (sha256 of the log 4b7d3b2fc0592bbd).

Also run on this tree: node .github/scripts/changelog.mjs check — 0 fragments, none needed (changelog.d/ is empty of pending entries; no user-visible path is touched); node .github/scripts/testing-layers.mjs --check — 880 test files in 16 workflows, all classified; node .github/scripts/check-mojibake.mjs --check — 0 occurrences of U+FFFD in 1703 text files; node .github/scripts/check-pack.mjs — exit 0; node core/scripts/build-client.mjs --check and node scripts/ds-bot-patches.mjs check/canonical ran green inside verify; cd core && ARCH_DOCS_BASE=3891b4f0… node scripts/check-arch-docs.mjs — arch-docs: OK (2 changed file(s)).

enqueue-guard will be red on this row for no Verifier report names the tip, the expected state of a T3 pull request before the verdict lands.

Files

2 files, +44/−1:

• .github/agent/risk-rules.json (+2/−1) — the two entries moved to diffPatternsNotInTests
• .github/scripts/risk-gate.test.mjs (+42) — the three cases above

Checkpoint

{
  "pr": 3089,
  "claim": "Dev-1",
  "issue": 3087,
  "summary": "risk-gate read new Function( and eval( against every code file, tests included, so a client test that mounts the bundle was scored T3 by its own harness. The two entries moved from diffPatterns to diffPatternsNotInTests, which is read only for non-test code files, and neither risk-gate.mjs nor any other pattern changed. A test file that mounts the bundle now takes its path tier while the same expression in client or host code is still a T3 content hit. Re-run on #3084's four files at f56aa4163d2b the new Function row is gone, and the row is T3 on the T2 size cap instead.",
  "files": [
    ".github/agent/risk-rules.json",
    ".github/scripts/risk-gate.test.mjs"
  ],
  "checks": { "ran": "TZ=UTC npm run verify; node --test .github/scripts/risk-gate.test.mjs (red x2 before, green x2 after); tier re-run over #3084 files", "result": "green", "at": "0011b84d5241896b7b8cd77d55dd0580bed81c27" },
  "next": "verdict at the pushed head, then the queue"
}

[HugoXK]

@Birfy — new tip for review: 0011b84d5241896b7b8cd77d55dd0580bed81c27 (single commit on live main ca07de0289, which now carries #3084; patch is the same two files, +44/−1).

Tier T3 (.github/**), issue #3087. Files: .github/agent/risk-rules.json (+2/−1 — new Function\( and \beval\( moved from diffPatterns to diffPatternsNotInTests) and .github/scripts/risk-gate.test.mjs (+42 — three cases). risk-gate.mjs is untouched and no other pattern moved.

Checks at this tip: 12 success + 1 still running (ubuntu-latest · Node 24 · DSH 0.2.0-rc.2); policy-sign is green because neither file is in policy/gates.json gateFiles. enqueue-guard is red only for "no Verifier report names the tip 0011b84", which a Verdict at this sha resolves.

Evidence in the body: red first ×2 (22/24, both new cases red) then green ×2 (24/24) at base 3891b4f0; full TZ=UTC npm run verify exit 0 at 4a040aa1 (byte-identical patch, pre-rebase). Live re-run over #3084's four files at f56aa416: the new Function( row is gone and the tier is T3 on the T2 size cap instead (373 lines / 4 files > 250), so this PR does not claim a T2 outcome for #3084.

[Birfy]

Verdict: PASS at 0011b84
Written-by: Reviewer
Attestation: 0011b84 role=Reviewer

Ran at this tip:

$ node --test .github/scripts/risk-gate.test.mjs
# tests 24  # pass 24  # fail 0
$ cp base/.github/agent/risk-rules.json tip-tree/.github/agent/risk-rules.json && node --test .github/scripts/risk-gate.test.mjs
# tests 24  # pass 22  # fail 2
$ node b3089/judge.mjs
$ node b3089/matrix.mjs

1. 红先（必测） 在 tip 树上只把 risk-rules.json 换回 base blob：24/22/2，红的是且只是
#3087: \new Function(` in a test file is T2 …与#3087: `eval(` keeps the same split …（T3 !== T2 / T3 !== T1）； 对照条 #3087: the patterns left in diffPatterns still count in a test file` 在红态下仍绿 —— 证明红是这一刀造成的，不是环境。

2. 规则面 diff 逐字只有一行换位：\beval\(、new Function\( 从 tiers.T3.diffPatterns 移入 tiers.T3.diffPatternsNotInTests，其余 8 条模式（child_process、process.env.*TOKEN|KEY|SECRET、.only/.skip、lint-disable、URL、fence、create_child_bot）一字未动。
因此从 T3 掉下来的输入只有一类：测试文件里的 eval( / new Function(，它改按路径档走（plugins/social/test → T2、core/test → T1、core/src/client/test → T1、根 foo.test.js → T2）；非测试代码读两张表，plugins/social/client.js、core/src/host/groups.js、core/dev/thing.mjs、plugins/social/mytest.js 里同样的行仍是 T3 内容命中，逐条实跑确认。这正是 #3087 的 Expected 与 Scope 原文，没有额外放宽。

3. 不误伤 91 行合成矩阵（13 条路径 × 7 种行形）：83 行档位不变，变的 8 行全是上述下降，没有一行变严，也没有任何普通插件测试被判成 T3 —— T3 只由路径（.github/）或留在 diffPatterns 里的模式给出。真实 PR 抽验：#3089 T3→T3（.github/ 路径）、#3084 T3→T3（new Function 行消失，改由 T2 的 250 行/12 文件上限撑住）、#3088 T3→T3（.github/** 路径）。

4. 范围 2 文件 +44/−1；risk-gate.mjs 未动，base 与 tip 的 sha256 同为 65f30722eb774a3b…。

5. 口径 risk tier (report only) 对 #3089 仍打印 T3（本体在 .github/**，路径档就是 T3），只是 why 里少这两行；它是报告项，不改变合并权，本次不当成「现在会自动拒绝」。

6. Check-runs（tip） 16 项全终态，唯一红 enqueue-guard（尚无 PASS 的正常红），policy-sign/merge-gate/tests-ok/reviewed tip/risk tier 全 success。
顺手补：加 agent-pr 标签；正文 Reviewer: Birfy → Reviewer: Reviewer（#1228：共享写身份不能当 Reviewer，否则 enqueue-guard 拒）。checkpoint 1093 字符，字段齐全合规。

[HugoXK]

Correction to my earlier review request on this PR: I listed "URL/fence rules" among the patterns that still raise a test file to T3. That was wrong — the external-URL, fence, sanitiz* and displayName entries were already in diffPatternsNotInTests at base, so they never applied to test files and this PR does not change that.

What remained in diffPatterns and still raises a test file to T3: child_process, secret-shaped env names, .only( / .skip(, a lint suppression, .dsh/DSH_HOME, and the create_child_bot topic rule. Everything else in my earlier comment stands: a test file that mounts the bundle now takes its path tier (T2 for plugins/social/test/**, T1 for core/test/**), while plugins/social/client.js, core/src/client/**, core/src/host/** and unknown-path non-test files still reach T3 through the content pattern.