[PR Triage Report] PR Triage Report — 2026-04-07

[github-actions]

Automated triage of 14 open PRs as of 2026-04-07. Run: 24097591177

Summary

Metric	Count
Total open PRs	14
Draft	1
High-priority	5
Security-flagged	3
External contributor	3
Claimed merge-ready	3

---

Triage Table

PR	Title	Risk	Priority	Action
#4272	Daily docs update 2026-04-07 (draft)	Low	Low	Undraft + merge before Apr 8 expiry
#4245	fix(recipes): replace heredocs with env-var assignment	Medium	High	Security fix — review and merge
#4236	fix(recipes): step-03 quoting + PR URL resolution	Medium	High	Likely superseded by #4245; confirm and close if redundant
#4234	Fix: Issue #4233 (external)	Low	Low	Minimal description; review diff before merging
#4228	fix: repair shell quoting step-03 (#4221)	Medium	High	Likely superseded by #4236/#4245; confirm and close if redundant
#4216	feat: ANTHROPIC_DISABLED flag	Medium	Medium	41 tests pass; ready for review
#4207	fix: SEARCH_TITLE quoting + unsafe conditions	Low	High	Self-reports merge-ready with green CI; review and merge
#4203	fix(#4169): smart-orchestrator teardown hardening	Medium	High	Self-reports merge-ready with green CI; review and merge
#4199	fix: auto-update rust runner on version mismatch	Low	Low	Simple targeted fix; ready for review
#4198	fix: guard --dangerously-skip-permissions for copilot	Low	Low	Simple guard; ready for review
#4190	fix(cli): preserve entrypoint and patch surfaces	Medium	Medium	Merge-ready; gadugi + pyright pass
#4186	docs(multitask): TIMEOUT_LIFECYCLE.md	Low	Low	Documentation only; 19 tests pass
#4112	docs: clarify required vs optional API keys (external)	Low	Low	Overlaps #3984; pick one and close the other
#3984	docs: clarify API keys in CONTRIBUTING.md (external)	Low	Low	Overlaps #4112; pick one and close the other

---

Critical Findings

1. Overlapping Shell-Quoting Fixes (PRs #4228, #4236, #4245)

Three PRs address the same heredoc/shell-injection vulnerability in step-03, each more comprehensive than the last:

• fix: repair shell quoting in step-03 issue creation (#4221) #4228 (Apr 4): Quoted heredoc delimiters — defense-in-depth
• fix(recipes): step-03 shell quoting + PR URL resolution (#4221, #4233) #4236 (Apr 4): Extends fix: repair shell quoting in step-03 issue creation (#4221) #4228 + fixes PR URL resolution
• fix(recipes): replace quoted heredocs with direct env-var assignment (skwaq#469) #4245 (Apr 5): Root fix — eliminates heredocs entirely via direct env-var assignment, resolving skwaq#469

Action: #4245 is the most complete and architecturally correct fix. Review #4228 and #4236 for any non-overlapping content, then close the superseded PRs to avoid merge conflicts.

2. Expiring Draft PR #4272

The daily documentation update draft expires Apr 8, 2026 at 06:32 UTC. It documents the Python package staging fix from PR #4265. Low risk, documentation-only.

Action: Undraft and merge before expiry, or the documentation gap will persist.

3. Duplicate External Contributor Doc PRs (#3984, #4112)

Both PRs clarify API key requirements in CONTRIBUTING.md. They were opened by different contributors 3 days apart.

Action: Review both diffs, merge the more complete one, and close the other with a thank-you note to the contributor.

---

Recommended Merge Order

1. [docs] docs: daily documentation update — Python package staging fix (2026-04-07) #4272 — Undraft + merge (expires Apr 8)
2. fix: correct SEARCH_TITLE quoting and unsafe conditions in default-workflow #4207 — Low risk, high priority, self-reported merge-ready
3. fix(#4169): smart-orchestrator teardown hardening + atlas refresh #4203 — Medium risk, high priority, self-reported merge-ready
4. fix(recipes): replace quoted heredocs with direct env-var assignment (skwaq#469) #4245 — Security fix for heredoc injection (close fix: repair shell quoting in step-03 issue creation (#4221) #4228, fix(recipes): step-03 shell quoting + PR URL resolution (#4221, #4233) #4236 after)
5. fix(knowledge_builder): guard --dangerously-skip-permissions against copilot binary (#4188) #4198, fix(recipe-runner): auto-update rust runner binary on version mismatch (#4189) #4199 — Simple targeted fixes
6. fix(cli): preserve entrypoint and patch surfaces #4190 — CLI entrypoint fix
7. feat: safe Anthropic disablement via ANTHROPIC_DISABLED flag #4216 — Feature: ANTHROPIC_DISABLED flag
8. docs(multitask): add TIMEOUT_LIFECYCLE.md and update reference docs #4186 — Documentation only
9. One of docs: clarify required vs optional API keys in .env setup (#3844) #4112 / docs: clarify API keys required vs optional in CONTRIBUTING.md #3984 — External contributor doc fix

Generated by PR Triage Agent · ◷

• expires on Apr 8, 2026, 6:29 PM UTC

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #4278

View newer issue

---

This action was performed automatically by the PR Triage Agent workflow.