heliohq/ship/handoff

Ship: Handoff

Do not stop when the PR is created. Do not stop while any GitHub check is pending. If any GitHub check fails, fix the problem, push again, and wait again. If the PR is not merge-ready, sync with base or resolve conflicts inside the same fix loop.

This is a goal-directed loop, not a counted one. Keep looping while each round makes progress toward the completion conditions; escalate on evidence, never on a round counter — the specific evidence classes are in Loop Governance. Done means every condition in Completion is satisfied.

Process Flow

Phase index — the phases below own the detail:

1. Pre-flight (resolve branch, base, and scope)
2. Verify locally
3. Update changelog / directly affected docs
4. Push and create/update the PR
5. Wait for GitHub checks
6. Fix loop — governed by the round ledger, not a counter

Red Flag

Never:

• Stop when the PR is created — #1 failure mode
• Push code changes without re-running relevant local verification
• Force push without --force-with-lease
• Rewrite an already-pushed PR branch when there are human review,

approval, or shared-branch signals

• Treat pending checks as "good enough"
• Treat green checks as sufficient when mergeStateStatus is still blocked
• Create the PR before local verification runs
• Use git add -A when unrelated local changes are present
• Forget to stage and commit changelog or doc edits before the first push
• Mark a thread or comment as resolved before the fix is actually pushed
• Resolve comments that still need product, security, or architecture judgment
• Silently ignore a comment — a decline is a visible reply with a reason
• Apply "further fixes add no value" to CI or merge-readiness — that

judgment exists only for the comment decline classes

• Fix failures without reading the actual check logs or review comments
• Sync with base preemptively — only when drift, conflicts, or repo policy require it
• Re-attempt a fix for a failure signature that already survived a fix

aimed at it — the second identical outcome is evidence the approach is wrong; escalate with the ledger instead of iterating on hope

• Count rounds as a stopping condition — progress, judgment, and external

blockers are the only reasons to stop looping

• Leave doc debt implicit — carry it into the PR

Loop Governance

Modern harnesses run goal-directed loops natively — a fixed retry cap abandons hard-but-progressing PRs while adding no safety that progress detection doesn't provide better. The loop is governed by three things:

1. Progress detection (the round ledger). Every fix round appends one block to <task_dir>/handoff.md (or tracks inline when no task dir):

Round <i>: trigger=<check name + error class, or "conflict"/"review">
  action=<what was changed, one line>
  result=<next terminal state: new signature | same signature | green>

Before starting a round, compare the current failure to the ledger:

• New failure signature (different check, or same check failing

differently) → progress; loop.

• Same signature after a fix aimed at it → the approach is wrong.

Escalate with the ledger as evidence — do not iterate on hope.

• The ledger survives context compaction; after a compaction, trust it

over recollection.

2. Judgment boundaries. Product/security/architecture review comments, conflicts you cannot resolve confidently, and rebase-policy dead ends escalate immediately regardless of progress. A fix that would change the shipped behavior (not just repair its delivery) is scope drift — escalate; the fix loop repairs delivery, it does not redesign.

3. The harness's own goal net. Under /ship:auto, the stop gate already blocks session exit until the PR is merge-ready. In a standalone run on a harness with a native goal condition (e.g. Claude Code's /goal), suggest the user arm one at the start — PR checks green and merge-ready, or stop after 25 turns — as the outer bound; the harness's turn bound replaces any hand-rolled cap.

Progress Tracking

Track your progress with the harness's task/todo list. Create the items at the start based on what the repo actually needs. Not every repo has a CHANGELOG, CI, or docs to update — only include items for work that will actually happen.

Principle: one item per phase the user would wait on. Fix rounds are dynamic — add them only when a check fails.

Phase 1: Pre-flight

Resolve only the context needed to ship the PR:

1. Determine the current branch.

• If HEAD is detached, create a feature branch before continuing.

1. Determine the base branch:

• use the existing PR base if a PR already exists
• otherwise use the repo default branch

1. If the current branch is the base branch, create a feature branch before continuing.
2. Inspect the current scope with git status --short, git diff <base>...HEAD --stat, git diff --cached --stat, and git diff --stat.
3. Decide which local changes belong to this handoff.
4. Do not use git add -A unless every dirty file belongs to this handoff.
5. If unrelated local changes cannot be separated safely, stop and escalate instead of guessing.
6. If the caller already provides task_dir, use it. Otherwise do not guess one here; resolve it only if a later phase needs to write artifacts.

Output a short start summary with the branch, base branch, and scope being shipped.

Phase 2: Verify Before PR

Before the first push in handoff, run the most relevant local verification available for this repo.

• Prefer the same commands the repo or CI already uses.
• Run only the checks that are relevant to the changed area: tests, lint,

typecheck, build, or targeted smoke checks as applicable.

• If code changes during handoff, run the relevant verification again before

the next push.

• If a task directory already exists, do not invent extra artifacts just for handoff.
• If verification fails, fix the issue before pushing.

Output a short summary of what was run and whether it passed.

Phase 3: Update CHANGELOG and Docs

Step A: CHANGELOG (auto-generate)

[ -f CHANGELOG.md ] || echo 'NO_CHANGELOG'

• No CHANGELOG.md → skip silently.

If CHANGELOG.md exists:

1. Read header to learn the format
2. Generate entry from: git log <base>..HEAD --oneline
3. Categorize: Added / Changed / Fixed / Removed
4. Insert after header, dated today
5. Commit: git add CHANGELOG.md && git commit -m "docs: update CHANGELOG"

After changelog handling, check whether the shipped changes also changed any user-facing or repo-facing documentation truths before the first push.

Use references/documentation.md for the documentation decision tree and ownership rules.

• Only inspect docs that directly describe the changed commands, config,

file paths, workflow, or behavior.

• Do not scan every markdown file in the repo.
• Route each changed truth to the narrowest correct document instead of

defaulting to top-level docs.

• If a doc is mechanically stale, fix it in the same handoff loop.
• If the doc issue is semantic and you are not confident about the right

wording, carry that note into the PR instead of inventing an explanation.

• Before moving on, explicitly record one of:
• docs updated
• docs checked, no update needed
• doc debt to note in the PR

Phase 4: Push and Create PR

When opening or updating the PR, keep the title and body concise.

Include only:

• what changed
• what local verification ran
• any known follow-up, risk, or skipped check

Do not invent a long template if the change is simple.

Push and create:

1. Review the final diff, then stage all related changes that should ship now, including any changelog or doc edits made in this handoff.
2. Commit the staged changes if anything new was staged in this phase.
3. git push -u origin HEAD
4. Create the PR if it does not exist.
5. If the PR already exists, update the body or add a short comment with the latest verification summary.
6. If task_dir exists, write or update <task_dir>/handoff.md with:

PR URL, branch, base, verification commands/results, docs outcome, current check summary, current mergeStateStatus, and the round ledger (Loop Governance format — one block per fix round). This file is the handoff evidence consumed by the stop gate, and the ledger is what makes progress detection survive context compaction.

Output: [Handoff] PR created: <url>

Phase 5: Wait for GitHub Checks

Inspect .github/workflows, branch protection signals, and the current PR checks once so you understand what this repo expects to run. A repo can have required checks from GitHub Apps even when it has no local workflow files, so never skip this phase based on .github/workflows alone.

Let the harness wait — never agent-side sleep polling. gh pr checks --watch blocks locally and polls GitHub itself every ~10s; your job is to park on it with whatever waiting primitive your harness has, so idle waiting costs nothing. The watch command in every case below is timeout 3600 gh pr checks --watch:

• Monitor available (Claude Code): arm one watch per wait cycle. A

Monitor is single-use — it wakes you when output arrives and is re-armed fresh after each fix push. Use an explicit timeout, NOT persistent: true (persistent overrides timeout_ms entirely and needs a manual TaskStop; it is meant for dev servers, not bounded waits):

Monitor( command: 'timeout 3600 gh pr checks --watch; echo "TERMINAL exit=$?"', description: "PR <number> checks settling", timeout_ms: 3600000 )

Before arming, check whether a Monitor for this PR is already running — on resume the prior watch may still be alive. If so, wait for its event; do not arm a duplicate.

• Background command support, no Monitor: run the watch command as a

background command — the completion notification wakes you with the exit code.

• Neither (e.g. Codex today): run the watch command as a plain

blocking command; the harness waits on the process. If the harness offers a scheduled-wakeup loop instead, poll gh pr checks on a few-minute interval.

When the watch terminates (TERMINAL exit=<code> event, background completion, or command return), pull the authoritative state once:

# Full snapshot for interpretation
gh pr view --json state,statusCheckRollup,reviews,reviewDecision,mergeable,mergeStateStatus,comments
 
# Machine-readable check summary
gh pr checks --json name,state,bucket,link,workflow
 
# Read failing check logs if any. Prefer the failed run URL/check URL from
# the snapshot; use gh run view only after identifying the run id.
gh run view <run-id> --log-failed

Also inspect unresolved review threads when review comments may be actionable. gh pr view --json comments,reviews is not enough because it does not reliably expose thread resolution state.

OWNER=$(gh repo view --json owner --jq '.owner.login')
REPO=$(gh repo view --json name --jq '.name')
PR_NUMBER=$(gh pr view --json number --jq '.number')
gh api graphql -f owner="$OWNER" -f repo="$REPO" -F number="$PR_NUMBER" -f query='
query($owner: String!, $repo: String!, $number: Int!) {
  repository(owner: $owner, name: $repo) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          id
          isResolved
          comments(first: 20) {
            nodes {
              id
              author { login }
              body
              path
              line
              outdated
              url
            }
          }
        }
      }
    }
  }
}'

Interpret the snapshot: