CANARY (do not merge): META-322 Greptile calibration positive control

[qmarcelle]

Disposable canary for META-322. This PR will be closed without merging.

It carries the repo-owned policy from #10 plus one deliberate, reversible semantic defect, to measure whether Greptile Review actually catches the Integrations failure class it was configured to catch — before anyone considers making it a required merge gate.

The positive control

extension/src/pathMatch.ts reintroduces a symmetric suffix fallback into pathsMatch, dressed up as a plausible bug fix.

This is the one defect class this repository has already suffered and fixed:

• META-291 / PR fix(path-identity): resolve absolute queries against a proven root, drop suffix fallback #8 removed exactly this fallback from the server matcher, where a stored src/a.ts matched /elsewhere/unrelated-repo/src/a.ts — a fragility assertion landing on a file in a different repository.
• src/path-match.ts records that a second matcher is how a deny silently became a warn: the enforcement layer drifted to a symmetric fuzzy suffix match while the read layer was tightened.

It violates two branch-local custom rules at once:

Rule id	Why
proven-root-path-identity	ADR-006 §4/§8 — no suffix matching, no endsWith comparison, no symmetric fuzzy matching; no-match is a refusal, not a nearest guess
ported-copies-must-not-diverge	extension/src/pathMatch.ts is a hand-synced port of src/path-match.ts; changing one copy's semantics without the other is the divergence defect itself

A finding that names either rule is evidence that branch-local .greptile/ configuration was read, rather than that a generic reviewer noticed loose code.

It is invisible to every deterministic gate — on purpose

CI is expected to stay green while the defect is present:

• tsconfig.json sets "include": ["src/**/*"] — typecheck and build never see extension/src/.
• npm run test is vitest over tests/**; .check.ts files do not match its patterns.
• CI never runs npm --prefix extension run test. The only job touching the extension is standard-candidate-consumption via npm run build:extension, which compiles and packages — a suffix fallback is type-valid.
• No test covers extension/src/pathMatch.ts anywhere.

If CI stays green and the reviewer catches it, semantic review is adding detection CI cannot provide. If CI stays green and the reviewer misses it, that is the reportable outcome and it argues against making the check required.

Sequence

1. This head (e22d6f5) carries the defect — record caught / not-caught and the rule id cited.
2. A follow-up commit reverts it — record whether the finding repeats on the clean head and whether the push retriggers review.
3. Findings reconciled individually, thread receipts preserved.
4. Closed without merging.

Full protocol and results: docs/review/calibration-2026-08.md.

Summary by Sourcery

Introduce semantic review configuration and documentation for Greptile and Sourcery, along with a temporary path-matching change used as a calibration canary.

New Features:

• Add repo-owned Greptile configuration, rules, and orientation files to govern semantic review behavior.
• Document review and merge policy, including reviewer roles, required checks, and calibration protocol for Greptile on this repository.
• Record a calibration evidence log for Greptile review behavior over time.

Enhancements:

• Configure Sourcery to ignore build output and vendored directories while explicitly constraining its role to non-authoritative defense in depth.

Documentation:

• Add detailed reviewer and merge-policy documentation describing current branch protection, CI behavior, and how automated reviewers interact with human review.
• Add a calibration document capturing planned and observed behavior of Greptile Review as a potential required merge gate.

Tests:

• Introduce a disposable semantic defect in extension path matching as a positive-control canary for reviewer calibration, without impacting existing deterministic CI gates.

Chores:

• Establish repository-level governance for automated reviewers through new configuration and policy files under .greptile/ and docs/review/.

[sourcery-ai]

Reviewer's Guide

This PR introduces a deliberate semantic defect in the extension path matcher as a calibration canary for Greptile Review, and adds repository-owned reviewer policy and configuration files (.greptile/, Sourcery scope, and review docs) needed to measure whether Greptile can detect the defect and respect the repo’s rules.

File-Level Changes

Change	Details	Files
Reintroduce a symmetric suffix-based path matching fallback in the VS Code extension matcher to create a controlled, reversible semantic defect.	Refactor pathsMatch to normalize both query and storedKey into local variables before comparison. Add a guard returning true on exact equality of normalized paths. Add symmetric suffix matching using endsWith on both query and storedKey so that longer-leading-segment paths can still match.	extension/src/pathMatch.ts
Add detailed Greptile review rules and reasoning, defining repository-specific failure classes and constraints for path identity, normalization, duplication, host behavior, and packaging.	Define ecosystem-wide rules around evidence, absence, measurements, vacuous checks, clean-room boundaries, and daemon assumptions. Define integrations-specific rules including proven-root path identity, non-divergent ported copies, reader tolerance vs repair, host adaptation posture, packaged artifact measurement, non-destructive probes, and watched host contracts. Document which rules from other repositories are deliberately not carried over and why. Specify scopes for each rule so Greptile can target the correct files.	.greptile/rules.md
Document the repository’s review and merge policy, including measured GitHub branch protection state and the intended role and authority of Greptile Review vs Sourcery and CI.	Record current required status checks, branch protection flags, and conversation resolution requirements as measured from GitHub. Clarify that Sourcery is defense in depth without semantic authority and that Greptile’s semantic rules are repo-owned via .greptile/. Define the calibration requirements and protocol before Greptile can be made a required merge gate, including behavior on positive-control defects and per-head SHA association. Clarify what different check states (absent, completed, on older heads) do and do not imply for semantic approval.	docs/review/merge-policy.md
Add a calibration evidence record for August 2026 to track how Greptile Review behaves on this repository and whether it is eligible to be a required gate.	Capture pre-policy baseline state for reviewer apps, check runs, required contexts, and local gates. Describe the rationale for the chosen canary defect (symmetric suffix path fallback) and its invisibility to deterministic CI gates. Lay out the stepwise protocol for running the canary, measuring Greptile’s behavior, and deciding branch protection changes. Reserve a results section to be filled from actual observations, explicitly distinguishing not-measured from pass.	docs/review/calibration-2026-08.md
Configure Sourcery as a scoped, non-authoritative reviewer by defining ignore paths for build output and vendored trees without granting semantic rule power.	Add a .sourcery.yaml file specifying versioned configuration. Ignore node_modules, dist, vsix, and .parity-ci to keep Sourcery focused on source surfaces. Document that Sourcery is defense in depth and that semantic review rules live in .greptile/ rather than in Sourcery config.	.sourcery.yaml
Introduce Greptile configuration stubs for rules and orientation files to wire the new policy docs into the reviewer pipeline.	Add .greptile/config.json to hold structured rule definitions, scopes, severities, and trigger behavior (content not shown in diff). Add .greptile/files.json to point Greptile at orientation and policy documents (content not shown in diff).	.greptile/config.json .greptile/files.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sourcery-ai]

Hey - I've left some high level feedback:

• The new symmetric suffix matching in extension/src/pathMatch.ts reintroduces the previously-removed loose path identity behavior; pathsMatch should stay strict and align with src/path-match.ts to avoid cross-repo false matches.
• To prevent future drift between the extension and server, consider sharing a single path-matching implementation (or a generated copy) rather than hand-porting pathsMatch in two places.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The new symmetric suffix matching in `extension/src/pathMatch.ts` reintroduces the previously-removed loose path identity behavior; `pathsMatch` should stay strict and align with `src/path-match.ts` to avoid cross-repo false matches.
- To prevent future drift between the extension and server, consider sharing a single path-matching implementation (or a generated copy) rather than hand-porting `pathsMatch` in two places.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[greptile-apps]

Greptile Summary

This PR establishes repository-owned semantic-review policy and records the disposable META-322 calibration protocol.

• Adds scoped Greptile rules and orientation metadata for repository-specific failure classes.
• Documents measured merge eligibility, reviewer authority, and the positive-control calibration procedure.
• Adds Sourcery scope configuration and updates the repository-structure allowlist.
• The previously reported suffix-matching canary has been reverted on the current head.

Confidence Score: 5/5

The current head appears safe to merge because the previously reported path-identity defect has been removed and no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
.greptile/config.json	Adds trigger behavior, review presentation settings, repository context, and structured semantic rules.
.greptile/rules.md	Documents the repository-specific failure classes, scopes, and rationale represented by the structured rules.
.greptile/files.json	Adds orientation metadata directing semantic review toward key contracts and runtime boundaries.
docs/review/calibration-2026-08.md	Records the positive-control calibration protocol and preserves unmeasured results as unmeasured.
docs/review/merge-policy.md	Documents measured branch protection, reviewer roles, and the evidence required before making semantic review mandatory.
.sourcery.yaml	Restricts Sourcery exclusions to generated and vendored surfaces without granting it semantic authority.
config/repository-structure.json	Allows the newly introduced review configuration files and directory in the repository structure check.

_{Reviews (2): Last reviewed commit: "Revert "fix(extension): match nested-fol..." | Re-trigger Greptile}

[qmarcelle]

Canary complete — closing without merging

Calibration receipt for META-322. Nothing here merges; the branch is deleted with the PR.

#	Criterion	Result
1	Branch-local .greptile/ read	pass — finding cited Rule Used: …ADR-006 §4/§8…, source: .greptile
2	Current-head association	pass — distinct check runs on aa456b4, e22d6f5, 447a318; comment commit_id=e22d6f5
3	Positive control caught	pass — 1 of 1 (P1, 8 files reviewed, 1 comments added)
4	Clean head does not repeat	pass — 0 of 0 (7 files reviewed, 0 comments added)
5	Push retriggers	pass — new run on 447a318
6	Individual reconciliation	pass, with caveat — see below
7	Merge eligibility as claimed	pass — #10 BLOCKED on one unresolved thread; this PR CLEAN once resolved

Canary SHAs: defect e22d6f5620ab6fce2bb06d5cefc20dbcfdc966b1, revert 447a318ff5dcd40e12c561b40d4602377e9171fe (diff vs policy head aa456b4: empty).

Two caveats recorded in docs/review/calibration-2026-08.md rather than smoothed over:

1. The Greptile check concluded success on the head carrying the P1. Requiring the context enforces review completed on this head, not no findings.
2. This PR's thread auto-resolved when the revert removed its lines (isOutdated=true, isResolved=true), with nobody answering it. required_conversation_resolution is real — it held chore(review): repo-owned Greptile policy and merge-policy documentation for integrations #10 at BLOCKED — but "resolved" alone is not proof of engagement.

Sourcery independently named the same defect in its review body while its check reported success. It stays defense-in-depth; the prior conclusion is not falsified, and its check state is confirmed non-authoritative.

Decision: Greptile Review is eligible as a required current-head gate. The required-contexts mutation is deliberately not applied by META-322 — PR #6 is BEHIND and predates the policy, so the change would cost a PR this issue does not own.

Incidental find, tracked as META-329, not repaired here: extension/test/intelligence.check.ts still asserts pre-META-291 path semantics, so the extension suite is red on main (81 pass / 1 fail) and no gate runs it.

[qmarcelle]

Closing unmerged as designed — disposable calibration canary for META-322. Receipt in the comment above.