Link rules, an optional coc field, and fail-loud branch sync

[JesperDramsch]

First PR of the desk stack. It holds the deterministic rules that every writer runs through, so no LLM is involved here.

Changes

• Bare-root sub-links are dropped (utils/tidy_conf/links.py). A cfp_link, sponsor or finaid that is only the root of the same site, or of a parent domain, is now removed. Example: https://pycon.de/ next to link: https://2027.pycon.de/. This is what the python-organizers import kept writing back onto PyCon Germany. The existing rule against a sub-link that equals link is unchanged. Nothing in the current data matches the new rule.
• Cross-site redirects stop counting as healthy (check_link_availability).
  • Before, a link that redirected to a different site and returned 200 was kept as fine. That is how pytennessee.org ended up serving a gambling site.
  • Now the original URL is kept unchanged, with no Wayback swap, and the redirect is logged and recorded.
  • When DESK_QUEUE_OUT names a file, each record is also appended there as one JSON line, ready for the queue a later PR adds.
  • "Same site" means:
    • the same host, ignoring www.;
    • a subdomain of the other host;
    • the same registrable domain, using a small list of two-level suffixes such as co.uk and org.il.
  • Short links that land on their expected target (forms.gle to Google Forms, lu.ma to luma.com) behave as before.
• Optional coc field for the conference's Code of Conduct URL. It is added to utils/schema.yml, the pydantic model, the key order (right after finaid), the README field table, CONTRIBUTING and the validation columns. Nothing sets it yet; the desk will fill it in on its visits.
• Branch sync fails loudly. enrich-tba-conferences.yml and canonical-source-update.yml used to fall back to git merge origin/main -X theirs on a conflict, which silently kept main's side and dropped the bot's edits. They now abort, print ::error title=Branch Sync Conflict::<files> and fail the job. check-conference-update.yml is left alone because a later PR rewrites it.

Needs your call

• pixi run links isn't scheduled in any workflow. Until a later PR in this stack adds a scheduled, report-only redirect scan, redirects are only found when someone runs it by hand.

Checks

• Pinned pytest (uv run --python 3.11 --with "pandas<2.3",..., as in REVIEW.md): 775 passed, 0 failed on this branch. On top of the whole stack: 1092 passed, 0 failed.
• uvx ruff@0.4.4 check utils tests: all checks passed.
• pre-commit on the changed files: every hook passed.
• python utils/sort_yaml.py --skip_links exits 0 and leaves _data/ unchanged.
• The new branch-sync block was run against a scratch repo with a deliberate conflict. It printed the error line, left a clean tree and exited 1.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QzyF2ciB5jhvcTVpj4ErMr

---

Generated by Claude Code

[JesperDramsch]

Routine review

1. Request

No issue is linked, so the request is the PR description. It asks for four things:

• Bare-root drop in drop_redundant_link_fields: a cfp_link, sponsor or finaid that is only the root of the same site or of a parent domain is removed.
• Cross-site redirects in check_link_availability: the URL is kept, there is no Wayback swap, and the redirect is recorded. Records also go to DESK_QUEUE_OUT when that is set. forms.gle and lu.ma are exempt.
• Optional coc field in utils/schema.yml, schema.py, validation.py, README and CONTRIBUTING.
• Fail-loud branch sync in enrich-tba-conferences.yml and canonical-source-update.yml. check-conference-update.yml is deliberately left out.

2. Checked against

• Date: Wed Oct 14 07:01:03 UTC 2026.
• unverified: git merge -X theirs resolves only conflicting hunks in favour of the merged-in branch (here origin/main) and keeps non-conflicting changes from both sides. git-scm.com did not resolve from the sandbox (getaddrinfo ENOTFOUND git-scm.com), and no local man page was available. If this is right, the old fallback lost the bot's edits only where they conflicted, not all of them. The PR description's wording ("dropped the bot's edits") overstates that a little. Failing loudly is still the right call.

3. Needs your decision

1. coc is only half-wired. It is in the schema, key order and docs. It is not in check_links (utils/sort_yaml.py:233, which only checks link/cfp_link/sponsor/finaid), REDUNDANT_LINK_FIELDS (utils/tidy_conf/links.py:21) or enrich_tba.URL_FIELDS (utils/enrich_tba.py:53). It is also not rendered anywhere under _layouts/ or _includes/. So once the desk fills it in, a dead or hijacked CoC link is never checked and never shown. Should those wirings land in this PR, or with the later desk PR that first writes coc? Recommendation: the later PR, since nothing sets the field yet. Add coc to the check_links tuple there at the latest.
2. The redirect scan is unscheduled. The PR description raises this itself: pixi run links runs in no workflow, so cross-site redirects are only found by hand until the follow-up adds a scheduled report-only scan. Recommendation: accept it for this PR. The new code changes nothing in the weekly sort, which runs --skip_links.

4. Findings

Important: None.

Nits:

• registrable_domain (utils/tidy_conf/links.py:145) uses a last-two-labels heuristic, so tenants of shared hosting suffixes count as the same site. Checked in this review: is_different_site('https://pyconx.github.io/2026/', 'https://squatter.github.io/') → False, and is_different_site('https://pycon.org.pl/', 'https://casino.org.pl/') → False. These are missed flags, not regressions: before this PR none of these redirects were flagged either. If it matters, add github.io, netlify.app, pages.dev and org.pl to TWO_LEVEL_PUBLIC_SUFFIXES, or note the gap in its comment.
• REDIRECT_RECORDS (utils/tidy_conf/links.py:72) is a module-level list that is appended to and never read outside tests in this PR. This is possible dead state until the queue PR consumes it.

5. Tests

Invariant coverage, per instance:

• Bare-root drop: tests/test_redundant_links.py::TestDropBareSiteRoot covers all three fields the request names (cfp_link, sponsor, finaid). It also covers the negative cases: a sub-page, an anchor, a query, a look-alike host, and the reverse subdomain direction.
• Cross-site redirect: tests/test_link_redirects.py covers keep-and-record for pythoncamp.de → barcamps.eu and for pytennessee.org → casino. It also checks that there is no Wayback lookup or save, that both short-link exemptions hold, that forms.gle to an unexpected site is recorded, the JSON-lines output and its append behaviour, and that check_links passes its context through.
• coc: tests/test_schema_validation.py checks that it is optional, that it accepts a URL and rejects non-URLs.
• Workflows: no automated test. The PR reports a manual run against a scratch repository.

Checks run on f0f561b, using the commands from REVIEW.md:

uv run --python 3.11 --with "pandas<2.3",pytest,... pytest tests/ -q -x -p no:cacheprovider
799 passed, 5 skipped, 3 xfailed, 2 xpassed, 153 warnings in 27.96s

uvx ruff@0.4.4 check utils tests
All checks passed!

uv run --python 3.11 ... python utils/sort_yaml.py --skip_links
exit 0; git diff --stat -- _data: (empty)

npm ci && npm test
Test Suites: 15 passed, 15 total
Tests:       423 passed, 423 total

The empty _data diff confirms the PR description's claim that no current entry matches the new bare-root rule.

6. Bounds

• Read in full: the diff of utils/tidy_conf/links.py, utils/sort_yaml.py, schema.py, validation.py, schema.yml, both workflow files, README and CONTRIBUTING; the body of check_link_availability and order_keywords on the head; tests/test_redundant_links.py::TestDropBareSiteRoot.
• Skimmed: tests/test_link_redirects.py (test names and structure) and the new tests in tests/test_schema_validation.py.
• Not done:
  • No live HTTP check against current conference sites, because check_links was not run.
  • The pre-commit set beyond ruff was not rerun. REVIEW.md says to quote the pre-commit.ci - pr status instead, and this review did not fetch it.
• Pre-existing: none noted.

---

Generated by Claude Code

[JesperDramsch]

Answers to the routine review:

• coc wiring: it lands in Run the canonical import daily and add lead importers for the desk #501, as recommended. check_links checks coc, so the redirect scan covers it, and REDUNDANT_LINK_FIELDS includes it, so a bare-root CoC link is dropped like the other sub-links. Showing it on the site is a separate change.
• Redirect scan: Queue work for the desk and retire the paid API jobs #500 schedules it weekly, in report-only mode, as redirect-scan.yml.
• Shared-hosting suffixes: correct. github.io, gitlab.io, netlify.app, pages.dev, vercel.app, readthedocs.io and org.pl go into TWO_LEVEL_PUBLIC_SUFFIXES in Run the canonical import daily and add lead importers for the desk #501, which touches links.py anyway. This PR stays as is.
• REDIRECT_RECORDS: it stays. It keeps the records in-process, while the JSON lines written to DESK_QUEUE_OUT are what the queue consumes in Queue work for the desk and retire the paid API jobs #500.
• -X theirs: right. It resolved only the conflicting hunks in favour of main, so the bot lost its edits in those hunks, not all of them. Failing loudly still applies.

---

Generated by Claude Code