feat: implement issue #509 — [Phase 3] Document the PR-limits standard + exemption rationale - #572
Conversation
…d + exemption rationale
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 51 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR adds documentation for a new PR-limits standard. AGENTS.md gains a reference in the Organization Standards table and a new "Pull Request Limits" section. A new standards/pr-limits.md file documents scope, source of truth, enforcement mechanics, exemptions, Dependabot reconciliation, and an operator runbook. ChangesPR-limits documentation
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds documentation for the organization's soft ceiling on concurrent open automation pull requests. Specifically, it updates AGENTS.md and introduces standards/pr-limits.md to detail the policy, enforcement via a source-side gate script, exempt actors, and an operator runbook. There are no review comments, and I have no feedback to provide.
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
There was a problem hiding this comment.
Pull request overview
Documents the org-wide “automation open-PR cap” (PR-limits) policy, including the single source-of-truth configuration, exempt-actor rationale, and an operator runbook, so audits treat the exemptions as sanctioned policy rather than drift.
Changes:
- Added a new standard document describing what is limited, where the configured value lives, the enforcement/apply path, exempt actors, and an operator runbook.
- Updated
AGENTS.mdto link the PR-limits standard from the standards index and to add a dedicated PR-limits section aligned with the issue acceptance criteria.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| standards/pr-limits.md | New PR-limits standard + runbook + exemption rationale, with links to ADR/config/apply path. |
| AGENTS.md | Adds PR-limits to the standards table and documents the policy/exemptions with cross-links to the standard/ADR/config/apply path. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: e72d2846c3a3a9e03444f1e2e25b32f12780d756
Review mode: triage-approved (single reviewer)
Summary
Docs-only PR (+216/-0, 2 files): adds standards/pr-limits.md and a PR-limits section to AGENTS.md documenting the org-wide soft cap on concurrent open automation PRs, its single source of truth (standards/pr-limits.json), the source-side apply path (scripts/lib/pr-limit-gate.sh), the sanctioned exempt-actor rationale, and an operator runbook. No code, settings, or workflow behavior changes.
Linked issue analysis
Closes #509. All four acceptance criteria are substantively met: (1) the standard documents what is limited, the source-of-truth location, and where it is applied; (2) the exempt-actor rationale is recorded in the same voice as the existing ruleset-bypass exception note, so audits read it as policy not drift; (3) an operator runbook covers changing the cap and adding/removing exempt actors; (4) it cross-links the Story 1 ADR (#506) and the Story 3 apply path (#508). It also correctly follows the Dev Note to keep the changeable cap value out of prose and point at pr-limits.json instead.
Findings
No blocking issues. Confirmed all load-bearing cross-references resolve at the head SHA: pr-limits.json, pr-limit-gate.sh, the ADR, dependabot-policy.md, ruleset-remediation-runbook.md, the bats config test, and pr-limits-tests.yml all exist.
Minor (non-blocking): the doc links '.dev-lead/scripts/list-prs.sh' twice as an illustrative 'enumeration idiom the gate reuses', but that path is not committed to the repo (no '.dev-lead/' entries in the tree at this SHA), so those two relative links render broken on GitHub. This is not one of the four required cross-links and does not affect the policy content — worth fixing in a follow-up but not grounds to hold the PR.
CI status
Green on all required checks: Lint, ShellCheck, CodeQL, SonarCloud (Quality Gate passed, 0 new issues), Secret scan (gitleaks), Agent Security Scan, npm audit. Advisory reviewers (gemini-code-assist, copilot) had no substantive findings; coderabbit/codex were rate-limited (not failures). The CANCELLED dev-lead dispatch/ci-relay checks are superseded runs of the authoring agent's own workflow, not required gates. mergeStateStatus=BLOCKED / reviewDecision=REVIEW_REQUIRED reflects the required @petry-projects/org-leads human review, which is the expected downstream gate.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Address Copilot review on #572: the doc linked to ../.dev-lead/scripts/list-prs.sh, which does not exist in this repo (that path is injected at dev-lead runtime from .github-private). The gate library scripts/lib/pr-limit-gate.sh does its own `gh search prs` enumeration, so point at that instead and drop the broken References bullet. Also refresh the gate bullet to note the live wiring landed in petry-projects/.github-private. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HUhVsBbihbTjVvbcVf1WuU
Pull Request is not mergeable
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #572 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
|
@donpetry-bot review |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@standards/pr-limits.md`:
- Around line 89-93: The rollout-status wording in the pr-limits docs is
inconsistent: it says the gate is “not yet on the live path” even though the
references indicate it is already wired into petry-projects/.github-private.
Update the status sentence in the wiring-status section to reflect the current
rollout state, and make sure the wording is consistent with the existing
references and the Story 3 / `#508` rollout scope note.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 5cb8474a-87c2-47b9-9888-bb30caf671b6
📒 Files selected for processing (2)
AGENTS.mdstandards/pr-limits.md
Address CodeRabbit on #572: the Wiring-status note said the gate was 'not yet on the live path' while the References section says it's wired into .github-private. Both reconciled: the gate is now wired (Story 3 landed), and enforcement activates as it promotes through the dev-lead channels (canary soak) — so it's wired but not yet enforcing on the running channel. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HUhVsBbihbTjVvbcVf1WuU
|
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 755efba53e3913e1c591ef8cac6317f3a45e1f7c
Review mode: triage-approved (single reviewer)
Summary
Docs-only PR (+216/-0 across AGENTS.md and new standards/pr-limits.md) documenting the org-wide automation open-PR cap: what is limited, the single source of truth (standards/pr-limits.json), the source-side apply path (scripts/lib/pr-limit-gate.sh), exempt-actor rationale, and an operator runbook. Confirms the triage assessment: low-risk documentation with no code or settings changes.
Linked issue analysis
Closes #509 ([Phase 3] Document the PR-limits standard + exemption rationale). All four acceptance criteria are substantively addressed: (1) the standard documents what is limited, the source-of-truth location, and the apply path (§1–§3); (2) exempt-actor rationale is recorded in the sanctioned-policy style mirroring the ruleset-bypass precedent (§4, plus the AGENTS.md callout); (3) an operator runbook covers changing the limit and adding/removing exemptions (§6); (4) the Story 1 ADR and Story 3 apply path are cross-linked throughout.
Findings
No blocking findings.
- All 7 cross-referenced files (pr-limits.json, pr-limit-gate.sh, the ADR, the bats test, the CI workflow, dependabot-policy.md, ruleset-remediation-runbook.md) verified to exist at the head SHA — the broken-link issue from the prior review is fixed.
- All 3 review threads (2 Copilot broken-link findings, 1 CodeRabbit wiring-status wording inconsistency) are resolved; the two commits since the prior review (e72d284..755efba, standards/pr-limits.md only, +9/-9) address exactly those findings. CodeRabbit subsequently approved.
- Per issue guidance, the changeable cap value is kept out of prose and pointed at the JSON source of truth.
- Secret scan: run_secret_scanning MCP tool not available in this environment; gitleaks CI check passed and the docs-only diff contains no secret-like content.
CI status
All required checks pass: Agent Security Scan, CodeQL, Detect ecosystems, Lint, ShellCheck, SonarCloud (x2), agent-shield. Secret scan (gitleaks), npm audit, and CodeRabbit also green. The CANCELLED dev-lead dispatch/ci-relay entries are non-required automation relay jobs superseded by newer runs. mergeStateStatus BLOCKED reflects only the pending review requirement.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
…d + exemption rationale (#572) * feat: implement issue #509 — [Phase 3] Document the PR-limits standard + exemption rationale * docs(pr-limits): fix broken .dev-lead/list-prs.sh links Address Copilot review on #572: the doc linked to ../.dev-lead/scripts/list-prs.sh, which does not exist in this repo (that path is injected at dev-lead runtime from .github-private). The gate library scripts/lib/pr-limit-gate.sh does its own `gh search prs` enumeration, so point at that instead and drop the broken References bullet. Also refresh the gate bullet to note the live wiring landed in petry-projects/.github-private. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HUhVsBbihbTjVvbcVf1WuU * docs(pr-limits): align wiring-status wording with the merged apply path Address CodeRabbit on #572: the Wiring-status note said the gate was 'not yet on the live path' while the References section says it's wired into .github-private. Both reconciled: the gate is now wired (Story 3 landed), and enforcement activates as it promotes through the dev-lead channels (canary soak) — so it's wired but not yet enforcing on the running channel. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HUhVsBbihbTjVvbcVf1WuU --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…d + exemption rationale (#572) * feat: implement issue #509 — [Phase 3] Document the PR-limits standard + exemption rationale * docs(pr-limits): fix broken .dev-lead/list-prs.sh links Address Copilot review on #572: the doc linked to ../.dev-lead/scripts/list-prs.sh, which does not exist in this repo (that path is injected at dev-lead runtime from .github-private). The gate library scripts/lib/pr-limit-gate.sh does its own `gh search prs` enumeration, so point at that instead and drop the broken References bullet. Also refresh the gate bullet to note the live wiring landed in petry-projects/.github-private. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HUhVsBbihbTjVvbcVf1WuU * docs(pr-limits): align wiring-status wording with the merged apply path Address CodeRabbit on #572: the Wiring-status note said the gate was 'not yet on the live path' while the References section says it's wired into .github-private. Both reconciled: the gate is now wired (Story 3 landed), and enforcement activates as it promotes through the dev-lead channels (canary soak) — so it's wired but not yet enforcing on the running channel. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HUhVsBbihbTjVvbcVf1WuU --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Closes #509
Implemented by dev-lead agent. Please review.
Summary by CodeRabbit