docs: workspace admin roles (workspace-admin-roles) [auto-draft] - #414
Draft
rachaelrenk wants to merge 1 commit into
Draft
docs: workspace admin roles (workspace-admin-roles) [auto-draft]#414rachaelrenk wants to merge 1 commit into
rachaelrenk wants to merge 1 commit into
Conversation
Auto-drafted from warp-server spec workspace-admin-roles (PRODUCT.md only). Co-Authored-By: Oz <oz-agent@warp.dev>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
rachaelrenk
added a commit
that referenced
this pull request
Aug 25, 2026
… footguns (#619) * docs: request reviewers for real and lead ambient PRs with a feature summary Two fixes to the ambient new-feature docs pipeline (GROW-6093). 1. Actually request reviewers. The drafted PR only named reviewers in prose, which puts nothing in GitHub's review queue: docs #414, #415, #416 and #417 all named reviewers in the body and received zero reviews, three with an empty requested-reviewers list. Wire a required `gh pr edit --add-reviewer` step into missing_docs drift-watch step 7 and into the create_pr skill, with the `dannyneira` fallback that release-docs-update.yml already uses, plus a verification read-back so a silently skipped assignment is caught. The prose /cc mention stays. suggest_reviewers.py gains `--reviewers-only` so the step can consume the resolved set without scraping the human-readable table. 2. Lead the PR body with a feature summary. Drafting PRs must open with `## What this feature does`: plain language, what the feature does for the user, ending with the shipped-in version and date read from check_new_release.py --json. Budget 75 words. check_pr_body.py gains `--require-lead-section`, asserting the heading is present once, is the first heading, is non-empty, and is within budget. Co-Authored-By: Warp <agent@warp.dev> * docs: address review — per-reviewer requests, first-content check, CI wiring Blocking fix. The reviewer verification was emptiness-only, so the owning engineer could be dropped silently — the exact bug this PR exists to fix. `gh pr edit --add-reviewer a,b,c` is one atomic mutation, so a single unassignable entry rejected the whole list and the `||` then replaced every resolved owner with the fallback; a non-empty readback still passed. This is live: `warpdotdev/oss-maintainers` is the root-rule owner in the warp client repo and appears in most resolutions, but `/repos/warpdotdev/docs/teams` is empty, so it cannot be requested here. Now each reviewer is requested in its own call and the readback is compared against the resolved set, with partial results reported. Also fixed the readback jq: the old `[.reviewRequests[].login // .reviewRequests[].name]` silently drops teams from a mixed list (verified). Also: - check_lead_section now asserts the summary is the first *content*, not just the first heading. A body opening with unheaded spec/workflow/run-ID preamble previously exited 0, which is the shape the check exists to stop. - _iter_non_code_lines skips HTML comments, so a `##` inside a multi-line comment no longer displaces the lead section — same class already handled for code fences. - Wired test_check_new_release.py into CI. The earlier deferral was wrong: #586 does not touch ci.yml and this PR already edits it, while missing_docs/SKILL.md advertises the test as covered. - suggest_reviewers.py routes resolution diagnostics to stderr under --reviewers-only, so a fallback leaves a trace without polluting stdout. - Removed the duplicated reviewer snippet from missing_docs; create_pr holds the canonical copy. The copies had already diverged, and the missing_docs one used `[[ -z ... ]] && ...`, which returns 1 and would abort a `set -e` scheduled run. - Backticked the date in the worked example; marked the drafting-only lines in the copy-paste heredoc. - Tests locking in first-content, HTML-comment banners, multi-line comments, CRLF bodies, and the stderr diagnostics. Co-Authored-By: Warp <agent@warp.dev> * create_pr: stop the fallback reviewer from masking a dropped owner Review catch on #619. Step 4 appended FALLBACK_REVIEWER to GOT, but GOT answers "which resolved owners did I actually request". Counting the fallback there let the verification pass on a run where every real owner was rejected -- the exact silent failure the section exists to prevent, two paragraphs after it says "verify against the resolved set, not against emptiness". Traced against the documented snippet with a stubbed gh. Resolved owners alice and bob, both rejected, fallback accepted: before: warning: requested 1/2 resolved reviewers Requested reviewers: dannyneira exit 0 after: ERROR: none of the 2 resolved owners could be requested (wanted: alice bob); only the fallback is assigned. exit 1 The fallback now stays out of GOT, and the outcomes are reported as four distinct states rather than one count: all owners requested, a partial result naming who is missing, owners resolved but none requested (an error, because the PR has the wrong reviewer), and nothing resolved at all (a note, because the fallback is the intended pall there). Not even the fallback landing remains a hard failure. Verified by extracting the snippet from SKILL.md and executing it against a stubbed gh across all five cases, so the documented text is what was tested rather than a paraphrase of it. Co-Authored-By: Warp <agent@warp.dev> * create_pr: trust the read-back, and fix comment/fence ordering Two review catches on #619. 1. Reviewer verification trusted gh's exit status The section warns that `gh pr edit` can exit 0 while quietly skipping a reviewer, then verified against GOT -- which is built from those exit statuses. A silently skipped owner passed. Verification now compares the read-back against WANT. Step 4's fallback also keys off the read-back rather than GOT, because when gh exits 0 for every owner and requests none of them, a GOT-based check skips the fallback entirely and leaves the PR with no reviewer at all. Match on the last path segment, lowercased: a team resolves as org/team but reads back as its bare slug, so a naive compare reported every team as missing. Verified by extracting the snippet from SKILL.md and running it against a stubbed gh across nine cases, including a stub that exits 0 without recording the reviewer: bob silently skipped -> warning names bob (previously silent) all silently skipped -> fall all silently skipped -> fall all silently skipped -> fall es its bare slug, no false "missing" 2. Fence detection ran before comment stripping A ``` line inside an HTML comment opened a phantom code block that ate the closing --> and every line after it, including the lead heading. A valid body failed with "missing required lead section", which reads as an authoring mistake rather than a parser bug. Precisely: only an *odd* number of fence lines inside a comment breaks it. A balanced pair opens and closes a phantom block that happens to end before the -->, so it passed by luck. The tests say which case is the real regression rather than implying all of them were. The fix honors fence state first, then strips comments, then looks for a fence in the visible text. Simply reordering the two would break the mirror case:mirror case:mirror case:mirror case:mirror case:mirror case:mirror cs a comment would swallow tmirror case:mirror case:mirror cver both directions plus a guard tmirror case:mirror case:mirror case:mirror case:mirror case:mirror case:mirror cs a comment would swallow tmirror caseent@warp.dev> * create_pr: verify the fallback reviewer by name, not by read-back emptiness Review catch on #619 (QUALITY-1875 rework). When owner resolution came back empty and the PR already carried an unrelated reviewer, the prior "is $REQUESTED non-empty" check treated that unrelated reviewer as proof the dannyneira fallback had landed, so it skipped verifying/re-requesting the fallback by name -- and the script still printed "fallback requested" and exited 0 even when dannyneira was never assigned. Added a has_reviewer helper that checks the read-back for a specific reviewer, used it to gate the fallback request/verification when resolution was empty, and split the final error check so a fallback that truly can't be assigned is reported as a failure instead of masked by an unrelated reviewer already on the PR. Added test_request_reviewers.py, which extracts the documented snippet from SKILL.md and runs it against a stubbed gh/suggest_reviewers.py across the normal-resolution, empty-resolution, and pre-existing-unrelated-reviewer cases. test_unrelated_reviewer_does_not_mask_fallback_failure fails against the pre-fix snippet and passes after the fix. Wired into ci.yml. Co-Authored-By: Warp <agent@warp.dev> * missing_docs: fix the three sandbox footguns validation run #2 hit The second drift-watch validation run surfaced three ways the skill misleads an unattended agent. All three are documentation gaps in the skill, not code bugs. 1. Working directory. Every path in the skill is relative to the docs repo root, but the skill never says so, and a sandbox commonly starts one level up. The failure mode is the problem: python3 exits 2 with "can't open file", which is the same exit code audit_docs.py uses to fail loud on a broken environment. An agent that reads the code and not the message concludes a sanity guard tripped and stops. State the cwd requirement up front, name the collision, and repeat it at the release-gate step and in the scheduled-agent prompt -- the prompt is the only one of the three a cron run is guaranteed to read. 2. npm install. `npm run build` is the only validation this repo has and it needs node_modules, which a fresh sandbox does not have. Add `npm ci` as a stated precondition in Requirements and at both build sites. 3. Surface-map key edits. A rename sweep run across feature_surface_map.md corrupted an corrupted an corrupted an corrupted an corrupted an corrupted aon corrupted an corrupted an corrupted an corrupted an corrupted an map entry is a literal code identifier that only matches because it matches ex because it matches ex because it matches ex beCo-Authored-By: Warp <agent@warp.dev> --------- Co-authored-by: Warp <agent@warp.dev> Co-authored-by: warp-agent-staging[bot] <240773466+warp-agent-staging[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Auto-drafted documentation for Workspace admin roles (spec
workspace-admin-roles).This page introduces the workspace-level role model (User / Admin / Owner), describing what a workspace admin can and cannot do across membership, billing, settings, Oz agent run visibility, and team-level management. It was generated in ambient mode by the
scan-new-specs→write-feature-docsworkflow from the mergedPRODUCT.mdonly. No content was derived fromTECH.md, and no internal DB schema or permission function names are exposed.warpdotdev/warp-server→specs/workspace-admin-roles/PRODUCT.mdsrc/content/docs/enterprise/team-management/workspace-admin-roles.mdxsrc/sidebar.ts(marked// [TODO: docs reviewer — confirm placement])Docs outline (auto-generated)
The following outline was generated from the spec. @IsaiahWitzke: please review and check off each item, or leave a comment with corrections.
Content structure
Workspace admin rolesUser,Admin,Ownerdefinitions and the "admin-level" term.Items needing engineer verification⚠️
[TODO]placeholder — confirm the surface and path once shipped.Verified from codebase ✅
USER/ADMIN/OWNER) and workspace-level admin permissions confirmed inwarpdotdev/warp-server(logic/permissions/permissions.go,logic/workspace_teams.go).roles-and-permissions.mdx,teams.mdx,admin-panel.mdx) confirmed viasrc/sidebar.ts.Outstanding
[UNVERIFIED]/[TODO]items in the draft[TODO: engineer to verify which capabilities are available in the current release.](caution callout)[TODO: engineer to verify — invite links, email invites, and domain restrictions ... confirm availability.][TODO: engineer to verify availability.](invite link management)[TODO: engineer to verify availability.](domain restrictions)[TODO: engineer to verify — workspace-level spend limits are follow-up work ...][TODO: docs reviewer — add the step-by-step procedure and settings path ...]+UNVERIFIED: exact Settings menu path[TODO: docs reviewer — screenshot needed: workspace member management surface showing roles.]Reviewers
/cc @IsaiahWitzke
Requesting review from @rachaelrenk and @hongyi-chen.
Conversation: https://app.warp.dev/conversation/7abbf494-93ec-4cf3-b692-738012aea1f5
Run: https://oz.warp.dev/runs/019fae9f-b508-7cf4-aa29-090a32193523
This PR was generated with Oz.