gh-stack skill: checkout recovery uses an ambiguous bare PR number (upstream fix needed)

[devantler]

🤖 Generated by the Agentic Engineer (Codex).

Disposition — 2026-09-08

The earlier diagnosis was not supported by the implementation. This issue proposed replacing a bare PR number with a PR URL to avoid checking out a same-number stack. Both forms enter the same resolver, so that substitution would not change the claimed behavior.

At upstream commit 2bd699a544a09cb5c45a013d03416e0894b0454e:

• PR URLs and bare numbers both call resolveNumericTarget.
• The resolver deliberately tries stack numbers first. Its explanation says stacks, PRs and issues share one repository-scoped number space. PR178 introduced this design on July 15, before this issue was opened. No reproducer establishes the alleged collision.
• The older, separate recovery defects are already corrected: the current skill says checkout has no --remote flag and uses unstack --local to preserve the remote stack.

The current bundled skill still declares github/gh-stack, refs/tags/v0.1.1, and skills/gh-stack. That tag resolves to the same inspected commit. No bundled or installed copy was edited.

Authorization and contribution review

The maintainer explicitly cleared the professional-work boundary and authorized thoroughly verified upstream contributions in the current September 8 conversation. That personal blocker is resolved.

Current upstream contribution instructions, agent instructions, Code of Conduct, organization defaults and existing PRs were checked. The project supports coding-agent contributions. No mandatory CLA, DCO, special AI disclosure or submission template was found.

Resolution of the original request

The proposed URL-only patch is withdrawn because it cannot fix the claimed behavior. No upstream issue, PR or branch was created, and no skill regeneration is required for an unsubstantiated change. Closing as not planned records this correction; it does not claim the proposed patch was implemented or merged.

The earlier comments are retained as history. Their claims that the analysis was complete and that no autonomous investigation was available are superseded by this source review.

[coderabbitai]

🔗 Related PRs

#34 - docs: describe the live multi-upstream skill-sourcing model [merged]
#36 - feat: bundle in-house agent-skills into category plugins [merged]
#41 - ci: guard that every bundled SKILL.md carries upstream provenance [merged]
#58 - docs(adr): design the Vibe Coding plugin (shape, skill family, stack guardrail, voice) [merged]
#63 - feat: add the automated-ai-engineer plugin (agents+skills bundle per ADR-0002) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Agentic Engineer

Precision: the defect is pre-existing, not introduced by #106

Checked the diff rather than assuming. Both sides of the patch carry the bare <pr-number>:

-  … use `gh stack unstack` first to remove the local stack, then retry the checkout
+  … use `gh stack unstack --local` first to remove the local tracking state
+    (this keeps the stack on GitHub intact), then retry the checkout

So #106 improves this guidance — it adds --local, which preserves the stack on GitHub — while leaving the bare-number ambiguity untouched. The ambiguity predates the sync and survives it.

That is why #106 was merged (ee52d02f) rather than held: blocking a whole skills sync on a pre-existing third-party doc ambiguity we cannot fix in this repository would have cost the improvement and fixed nothing. This issue tracks the remaining upstream gap.

[devantler]

You should propose this change upstream via a PR.

[devantler]

🤖 Generated by the Agentic Engineer

Direction received — change prepared, but I should not open it from this run

Understood, and I agree it belongs upstream. I have prepared the exact patch so it is ready to submit, but I am not opening the PR myself, for a reason I want to state plainly rather than quietly skip.

github/gh-stack is a third-party repository. My operating contract requires three things before an unattended run touches one, and this run has none of them:

1. The repository boundary cleared — confirmation, in a live session, that the repo is unrelated to professional work.
2. Explicit per-artifact approval to create an upstream issue or PR, given through the interactive ask channel.
3. That project's AI-contribution policy checked first — some upstreams refuse AI-authored PRs, and github/gh-stack has not been checked.

A GitHub comment is deliberately not an authorization channel for creating an artifact in someone else's repository, so I am treating your note as direction on what to do rather than as the approval to do it unattended. If I am being over-careful here, say so in a session and I will open it immediately.

The exact change, ready to submit

Two sites in skills/gh-stack/SKILL.md. Both currently end in a bare <pr-number>, which line 821 of that same file says resolves as a stack number first.

Site 1 — agent guardrail bullet (line 72):

-  … use `gh stack unstack --local` first to remove the local tracking state
-  (this keeps the stack on GitHub intact), then retry the checkout
+  … use `gh stack unstack --local` first to remove the local tracking state
+  (this keeps the stack on GitHub intact), then retry with the PR URL —
+  `gh stack checkout <pr-url>` — because a bare number resolves as a stack
+  number before it is tried as a PR number

Site 2 — ⚠️ Agent warning in the gh stack checkout reference (line 823):

-  … then retry `gh stack checkout <pr-number>`.
+  … then retry `gh stack checkout <pr-url>`.

Both use an invocation the file already documents at line 804 (<stack-number | pr-number | pr-url | branch>) and demonstrates at line 815, so this needs no new capability — it just stops the recovery path from depending on the ambiguous form.

Whoever submits it: the bundled copy here must not be hand-edited. Once upstream merges, update-agent-skills.yaml re-pulls it.

[devantler]

🤖 Generated by the Agentic Engineer

Recording why this has not moved since 2026-08-03, so it stops reading as ordinary actionable work.

The maintainer's direction on this issue is to propose the fix upstream via a PR. gh-stack is a third-party bundled skill — its SKILL.md declares metadata.github-repo: https://github.com/github/awesome-copilot, so editing the copy in this repo is reverted by the sync workflow, and the fix genuinely belongs upstream.

Blocker: missing authority (upstream contribution) | last-verified 2026-08-20: unchanged

An upstream artifact needs three things an unattended run structurally cannot obtain, per the engineering contract:

1. explicit confirmation that the target repository is unrelated to professional work (the professional-work repository boundary);
2. a separate, explicit per-artifact approval to create an issue or PR outside devantler-tech;
3. a check of that project's stated policy on AI-assisted contributions — and if it prohibits or is unclear, the work is prepared locally and submitted by the maintainer under his own name.

So this is missing authority, not an external dependency and not a decision to be made here — it needs one interactive session, not another autonomous attempt. The analysis itself is already complete in the issue body; what remains is authorization plus the upstream submission.

No autonomous action taken, and none is available. Left open and unclaimed.