[steipete]

Problem and behavior

ClawSweeper comments and item edits shared one GitHub Actions concurrency group. An overlapping edit could cancel an explicit review command; ignored bot-label runs could also displace useful work before the job filter ran.

Group runs by event type and comment identity, and isolate ignored bot labels. Edits to the same comment and superseding item metadata still cancel older runs as before. Adds 11 regression tests and a minimal, read-only pull-request/push CI workflow. Updates the pinned GitHub App token action from v3.2.0 to v3.3.0, which includes patched HTTP dependencies.

Validation

• The original workflow fails five new regression cases; the fixed workflow passes all 11.
• node --test --test-concurrency=2 tests/*.test.mjs
• actionlint -shellcheck= .github/workflows/*.yml
• Independent Codex P0–P2 review before landing.
• Existing hosted scheduler proof at the contributor's original head: comment succeeded, first edit cancelled, second edit cancelled, last edit succeeded. This demonstrates scheduling, not credential-dependent downstream dispatch.

Original concurrency fix by @SebTardif; maintainer completion adds tests, documentation, the changelog, and the action update.

Carries forward #2 on a maintainer-owned branch because the fork preview is blocked on external deployment authorization. Both original commits and contributor credit are preserved; no deployment authorization or repository security setting was changed. Supersedes #2 when merged.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawsweeper-bot	Ready	Preview	Oct 15, 2026 11:09pm UTC

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR separates comment and metadata scheduling, isolates ignored bot labels, adds regression coverage and CI, and updates the pinned token action.

Example: A review comment on fork pull request 1 overlaps with pull request body edits.

• Before: An edit can cancel the comment workflow because both share the item concurrency group.
• After: Comment run 37850978898 succeeds while superseded edit runs are cancelled and the final edit succeeds.

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	A focused repair supported by hosted scheduling evidence, meaningful regression coverage, and no actionable findings.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (linked_artifact): GitHub-hosted runs exercise the changed concurrency owner at the original fix commit: a comment run survives overlapping metadata events while superseded metadata runs are cancelled. The scheduling expression is identical at the reviewed head; credential-dependent downstream dispatch is explicitly outside this demonstration.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: An explicit review or automerge comment can lose its dispatcher when the item is edited or synchronized.
Reason: The focused repair preserves independent commands, and the feature-history owner has already selected this direction through the maintainer-authored continuation.

Merge readiness

✅ Ready for maintainer review

Keep open: this PR fixes a concurrency collision still present on main, with hosted scheduling evidence and no actionable correctness or security findings.

Priority: P2
Reviewed head: 56335aa0265bbf3ca1de35e3fa88836e8a1956bb

Before merge

None.

Findings

None.

Agent review details

How this fits together

The GitHub Actions dispatcher receives issue, pull request, and comment events, schedules and filters them, then forwards eligible events to ClawSweeper.

flowchart LR
  A[Item events] --> C[Workflow concurrency]
  B[Comment events] --> C
  C --> D[Event filtering]
  D --> E[Scoped app tokens]
  E --> F[ClawSweeper dispatch]

Loading

Technical review

Best possible solution:

Land the scheduler separation while preserving existing dispatch payloads, credential scopes, and same-stream supersession.

Do we have a high-confidence way to reproduce the issue?

Current-main source assigns comment and metadata events for the same item to one group and enables cancellation for edits, establishing the reported cancellation path without executing target code.

Is this the best way to solve the issue?

Changing the scheduling identity at the workflow owner addresses the collision directly; the added tests inspect the actual workflow expressions and cover the relevant separation and supersession cases.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against adca46792e86.

Provenance checked

• Workflow scheduling changes intended behavior with a stated reason (adca467: The original commit added event dispatching; its message and commit-to-PR lookup reveal no requirement that unrelated comments and metadata cancel each other.)
• Token action pin changes intended behavior with a stated reason (adca467: The original workflow pins its token provider; this PR explains the maintenance update and retains explicit token scopes.)
• Manifest documentation keeps the original intent (c614e56: The README inventories repository files; its manifest description is updated to include the new test script.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Introduced patch and current main: Main still groups comments and metadata by item number. The pinned introduced diff separates event types and comment identities, isolates ignored bot labels, and preserves cancellation conditions. (.github/workflows/clawsweeper-dispatch.yml:15, 56335aa0265b)
• Hosted scheduler evidence: https://github.com/SebTardif/clawsweeper.bot/actions/runs/37850978898 succeeded during overlapping metadata events; runs 37850980806 and 37850986692 were cancelled, and 37850991214 succeeded. The proof PR's base is the original fix commit, whose scheduling expression is unchanged in this PR. Token creation was skipped, so these artifacts establish scheduling rather than downstream dispatch. (.github/workflows/clawsweeper-dispatch.yml:15, 46a12f4cea98)
• Discussion and continuation: The body credits SebTardif and explicitly carries forward fix: keep comment commands out of the item concurrency group #2 for replacement after merge. The contributor's fix: keep comment commands out of the item concurrency group #2 (comment) identifies the hosted overlap proof; the Vercel comment documents the fork deployment authorization gate. (56335aa0265b)
• Feature history and intent: Scoped history and commit inspection establish that adca467 added the dispatcher. Its stated purpose is dispatching ClawSweeper events; the commit-to-PR lookup returned no separate rationale requiring cross-event cancellation. (.github/workflows/clawsweeper-dispatch.yml:16, adca46792e86)
• Executed dependency update: The workflow executes this action at both token-creation steps, making its contract relevant. The pin matches v3.3.0; the upstream comparison retains the permission inputs used here and includes HTTP dependency updates without changes to lib/main.js or the caller's explicit repository and permission scopes. No root AGENTS.md was found at the pinned revision. (action.yml, 64ab729a6294)
• Checks and inspection limits: Exact-head test and security checks passed. The cancelled dispatch job had no steps and therefore supplies no failing-code trace. Its log download was blocked by the network allowlist; this does not establish a patch defect. No target code or tests were run during this read-only review. (.github/workflows/ci.yml:18, 56335aa0265b)

Likely related people:

• Peter Steinberger: Raw commit adca467 adds .github/workflows/clawsweeper-dispatch.yml:16 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: adca46792e86; files: .github/workflows/clawsweeper-dispatch.yml)

Root-cause cluster

Relationship: canonical
Canonical: #3
Summary: This PR is the stated maintainer continuation of the original concurrency fix, and both open PRs currently carry the same head.

Members:

• same_root_cause: fix: keep comment commands out of the item concurrency group #2 - It contains the original scheduler repair and is explicitly intended to be superseded when this PR merges.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Labels

Label changes:

• add P2: Overlapping item updates can cancel an explicit command's dispatcher; this focused repair has limited scope.
• add proof: sufficient: Contributor real behavior proof is sufficient.
• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: Overlapping item updates can cancel an explicit command's dispatcher; this focused repair has limited scope.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• proof: sufficient: Contributor real behavior proof is sufficient.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 15, 2026, 7:22 PM ET / 23:22 UTC.

[steipete]

The identical reviewed head is landing through #2, preserving the original contributor PR. This temporary maintainer-branch PR supplied successful CI and a Vercel preview for that exact commit without changing deployment authorization or repository security settings. Closing as superseded by #2.