fix(strix): fall back when NVIDIA NIM retires a hosted model - #768
fix(strix): fall back when NVIDIA NIM retires a hosted model#768seonghobae wants to merge 2 commits into
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughStrix의 NVIDIA NIM 기본 모델과 폴백 순서를 변경했습니다. NVIDIA NIM 모델 카탈로그 404를 provider 가용성 오류로 분류하고, 관련 회귀 테스트와 문서를 추가했습니다. CI 의존성과 해시도 갱신했습니다. ChangesStrix NVIDIA NIM 폴백
Strix CI 의존성 업데이트
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant StrixWorkflow
participant NvidiaNIM
participant StrixQuickGate
participant GitHubModels
StrixWorkflow->>NvidiaNIM: 기본 모델 요청
NvidiaNIM-->>StrixQuickGate: provider-scoped 404
StrixQuickGate->>StrixWorkflow: 교차 모델 폴백 판정
StrixWorkflow->>NvidiaNIM: 대체 모델 요청
NvidiaNIM-->>StrixWorkflow: 실패 또는 결과
StrixWorkflow->>GitHubModels: 후속 폴백 요청
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent @cwl-noema-review Please independently review exact current head |
|
@opencode-agent @cwl-noema-review Please independently review exact final production head |
|
@coderabbitai review Review exact current head @opencode-agent @cwl-noema-review Independently review this exact head. Direct CodeQL, Python Security, Security Scan, Semgrep, Secret Scan, OSV, Scorecard, and SBOM runs are successful; prior-head evidence must not be reused. |
|
|
|
@coderabbitai review Please review exact current head |
|
|
|
@coderabbitai review Please review exact current head @opencode-agent Please independently review this exact head. All eight direct security and supply-chain workflows are successful. Approve only after current-head coverage/test/docstring evidence and the complete workflow security boundary pass. @cwl-noema-review Please independently review exact head |
|
|
|
@cwl-noema-review Independently review exact current head |
|
Review-only exact-head dispatch for |
|
@opencode-agent @cwl-noema-review Please independently review exact current head |
Pull request was converted to draft
|
@coderabbitai review |
|
|
@coderabbitai review Please review exact current head |
|
|
|
@coderabbitai review Review exact current head |
|
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head9e952b49169f27a08d8af4c8f9e165fe60ae16d4. -
Head SHA:
9e952b49169f27a08d8af4c8f9e165fe60ae16d4 -
Workflow run: 30971004270
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (3 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (3 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-nvidia-nim-not-found-fallback.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-nvidia-nim-not-found-fallback.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_strix_nvidia_nim_not_found_fallback.py"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test: test_strix_nvidia_nim_not_found_fallback.py"]
R5 --> V5["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-nvidia-nim-not-found-fallback.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-nvidia-nim-not-found-fallback.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_strix_nvidia_nim_not_found_fallback.py"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test: test_strix_nvidia_nim_not_found_fallback.py"]
R5 --> V5["targeted test run"]
|
|
@opencode-agent @cwl-noema-review @coderabbitai review Independently review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='78c3e21c183fca47dfc3eeb95ce37001a8e4c115'
base='3f65dbee6672b78802e7d71d49c390f3817bb03b'
repo='ContextualWisdomLab/.github'
show_range() {
local object="$1" start="$2" end="$3"
git show "$object" | awk -v start="$start" -v end="$end" \
'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }'
}
echo '== Identity and scope =='
printf 'requested_head='; git rev-parse "$head"
printf 'requested_base='; git rev-parse "$base"
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
git diff --name-status "$base" "$head"
printf 'changed_file_count='
git diff --name-only "$base" "$head" | wc -l
git diff --check "$base" "$head"
echo '== Workflow inventory =='
git ls-tree -r --name-only "$head" -- .github/workflows
echo '-- disallowed temporary-workflow names --'
git ls-tree -r --name-only "$head" -- .github/workflows |
grep -Ei '(repair|finali[sz]er|temporary|publish)' || true
echo '== Exact production diff =='
git diff --no-ext-diff --unified=20 "$base" "$head" -- \
.github/workflows/strix.yml \
scripts/ci/strix_quick_gate.sh \
scripts/ci/strix_required_workflow_smoke.sh \
scripts/ci/test_strix_quick_gate.sh \
tests/test_strix_nvidia_nim_not_found_fallback.py \
requirements-strix-ci.txt \
requirements-strix-ci-hashes.txt \
CHANGELOG.md \
docs/doctoring/strix-nvidia-nim-not-found-fallback.md
echo '== Classifier, retry, and fail-closed decision code =='
git show "$head:scripts/ci/strix_quick_gate.sh" |
nl -ba |
grep -E -C 22 \
'is_nvidia_nim_not_found_error|is_infrastructure_error|is_model_retryable_error|same.model|vulnerab|incomplete.{0,20}scan|scan.{0,20}incomplete|NotFoundError|Nvidia_nimException' || true
echo '== Workflow selection and outer neutralization =='
git show "$head:.github/workflows/strix.yml" |
nl -ba |
grep -E -C 20 \
'NVIDIA_NIM_API_KEY|nvidia/nemotron|llama-3\.3-nemotron|github-models|backend_unavailable_signal|NotFoundError|Nvidia_nimException|vulnerab|incomplete' || true
echo '== Regression and smoke contracts =='
git show "$head:tests/test_strix_nvidia_nim_not_found_fallback.py" | nl -ba
git show "$head:scripts/ci/strix_required_workflow_smoke.sh" |
nl -ba | grep -E -i -C 14 'nvidia|litellm|404|fallback|NVIDIA_NIM_API_KEY|immutable|hash' || true
git show "$head:scripts/ci/test_strix_quick_gate.sh" |
nl -ba | grep -E -i -C 14 'nvidia|litellm|404|same.model|vulnerab|incomplete' || true
echo '== Lock constraints and documentation =='
git show "$head:requirements-strix-ci.txt" | nl -ba
git diff --no-ext-diff --unified=8 "$base" "$head" -- requirements-strix-ci-hashes.txt
git show "$head:docs/doctoring/strix-nvidia-nim-not-found-fallback.md" | nl -ba
git diff --no-ext-diff --unified=8 "$base" "$head" -- CHANGELOG.md
echo '== Exact-head GitHub checks =='
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // "null"), .html_url] | `@tsv`' | sort
echo '== Exact-head commit statuses =='
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/commits/${head}/status" \
--jq '.state, (.statuses[] | [.context, .state, .target_url] | `@tsv`)' || true
echo '== Branch protection required contexts =='
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/branches/main/protection/required_status_checks" \
--jq '{strict, contexts, checks}' || trueLength of output: 97439 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='78c3e21c183fca47dfc3eeb95ce37001a8e4c115'
base='3f65dbee6672b78802e7d71d49c390f3817bb03b'
repo='ContextualWisdomLab/.github'
numbered_grep() {
local object="$1"
local pattern="$2"
git show "$object" |
awk '{ printf "%6d %s\n", NR, $0 }' |
grep -E -i -C 20 "$pattern" || true
}
echo '== Exact classifier and retry call paths =='
numbered_grep "$head:scripts/ci/strix_quick_gate.sh" \
'is_nvidia_nim_not_found_error|is_transient_same_model_retry_error|is_model_retryable_error|has_detected_infrastructure_error'
echo '-- fallback loop and model exclusion --'
numbered_grep "$head:scripts/ci/strix_quick_gate.sh" \
'STRIX_FALLBACK_MODELS|fallback.models|attempted.models|attempted_models|same.model|model.*retry'
echo '== Outer neutralization and scan-state checks =='
numbered_grep "$head:.github/workflows/strix.yml" \
'backend_unavailable_signal|reported_vulnerability_signal|incomplete|strix_rc|Nvidia_nimException|NotFoundError'
echo '== Credential references: exact diff and exact head =='
git diff --no-ext-diff --unified=3 "$base" "$head" -- .github/workflows/strix.yml |
grep -E -C 3 'NVIDIA_NIM_API_KEY|STRIX_GITHUB_MODELS_TOKEN|OPENCODE_APPROVE_TOKEN|token|secret' || true
git grep -n -I -e 'NVIDIA_NIM_API_KEY' -e 'STRIX_NVIDIA_NIM_API_KEY' "$head" -- .github scripts tests || true
echo '== Requirement pins have matching hashed entries =='
git show "$head:requirements-strix-ci.txt"
echo '-- matching hash-lock headers --'
while IFS= read -r requirement; do
case "$requirement" in
''|\#*) continue ;;
esac
package="${requirement%%[<>=!~]*}"
printf '%s: ' "$package"
git show "$head:requirements-strix-ci-hashes.txt" |
grep -Eim1 "^${package}==" || echo 'MISSING'
done < <(git show "$head:requirements-strix-ci.txt")
echo '== Exact GitHub check runs =='
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs | sort_by(.name)[] | [.name, .status, (.conclusion // "null")] | `@tsv`'
echo '== Exact GitHub legacy statuses =='
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/commits/${head}/status" \
--jq '.state, (.statuses | sort_by(.context)[] | [.context, .state] | `@tsv`)'
echo '== Main branch required checks =='
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/branches/main/protection/required_status_checks" \
--jq '{strict, contexts, checks}' || true
echo '== Pull request mergeability and review state =='
gh pr view 768 --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup \
--jq '{headRefOid, baseRefOid, mergeStateStatus, reviewDecision, statusCheckRollup: [.statusCheckRollup[] | {name, status, conclusion}]}'Length of output: 69816 🏁 Script executed: #!/bin/bash
set -u
head='78c3e21c183fca47dfc3eeb95ce37001a8e4c115'
repo='ContextualWisdomLab/.github'
requirements_file="$(mktemp)"
lock_file="$(mktemp)"
trap 'rm -f "$requirements_file" "$lock_file"' EXIT
git show "$head:requirements-strix-ci.txt" > "$requirements_file"
git show "$head:requirements-strix-ci-hashes.txt" > "$lock_file"
echo '== Direct requirement entries in hashed lock =='
lock_result=0
while IFS= read -r requirement || [ -n "$requirement" ]; do
case "$requirement" in
''|\#*) continue ;;
esac
package="${requirement%%[<>=!~]*}"
if entry="$(grep -Eim1 "^${package}==" "$lock_file")"; then
printf 'LOCKED\t%s\t%s\n' "$requirement" "$entry"
else
printf 'MISSING\t%s\n' "$requirement"
lock_result=1
fi
done < "$requirements_file"
printf 'lock_alignment_exit=%s\n' "$lock_result"
echo '== GitHub CLI availability =='
command -v gh || true
if command -v gh >/dev/null 2>&1; then
echo '== Exact-head check runs =='
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs | sort_by(.name)[] | [.name, .status, (.conclusion // "null")] | `@tsv`' \
|| echo 'CHECK_RUN_QUERY_FAILED'
echo '== Exact-head combined status =='
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/commits/${head}/status" \
--jq '.state, (.statuses | sort_by(.context)[] | [.context, .state] | `@tsv`)' \
|| echo 'COMBINED_STATUS_QUERY_FAILED'
echo '== Main branch required status checks =='
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/branches/main/protection/required_status_checks" \
--jq '{strict, contexts, checks}' \
|| echo 'BRANCH_PROTECTION_QUERY_FAILED'
echo '== Pull request `#768` identity and status =='
gh pr view 768 --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup:[.statusCheckRollup[] | {name,status,conclusion}]}' \
|| echo 'PR_QUERY_FAILED'
else
echo 'GITHUB_CLI_UNAVAILABLE'
fiLength of output: 12960
The head matches PR The inner classifier requires LiteLLM The NVIDIA catalog-404 path is excluded from same-model retry. The fallback loop skips a candidate equal to the primary model. The workflow orders the second NVIDIA model before GitHub Models. The outer workflow blocks neutralization when it finds a vulnerability signal. The gate preserves fail-closed handling for provider signals and incomplete scans until a distinct fallback succeeds.
I cannot approve yet. The current exact-head Please request approval after the current You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head @opencode-agent Please review and, only after exact-head coverage plus every required current-head check succeeds, submit an independent APPROVE for @cwl-noema-review Please independently review the same exact head after current-head checks complete. Do not reuse superseded-head evidence. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='78c3e21c183fca47dfc3eeb95ce37001a8e4c115'
base='3f65dbee6672b78802e7d71d49c390f3817bb03b'
repo='ContextualWisdomLab/.github'
echo '== identity and scope =='
printf 'checked_out='; git rev-parse HEAD
printf 'requested_head='; git rev-parse "$head"
printf 'requested_base='; git rev-parse "$base"
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
git diff --name-status "$base" "$head"
printf 'changed_files='; git diff --name-only "$base" "$head" | wc -l
git diff --check "$base" "$head"
echo '== workflow inventory at exact head =='
git ls-tree -r --name-only "$head" -- .github/workflows
echo '== temporary workflow candidates =='
git ls-tree -r --name-only "$head" -- .github/workflows |
grep -Ei '(repair|finali[sz]er|temporary|publish)' || true
echo '== changed source outlines =='
for file in \
.github/workflows/strix.yml \
scripts/ci/strix_quick_gate.sh \
scripts/ci/strix_required_workflow_smoke.sh \
scripts/ci/test_strix_quick_gate.sh \
tests/test_strix_nvidia_nim_not_found_fallback.py
do
echo "--- ${file}"
git show "${head}:${file}" > "/tmp/$(basename "$file")"
ast-grep outline "/tmp/$(basename "$file")" --items all 2>&1 || true
done
echo '== classifier, retry, and outer gate contexts =='
git show "$head:scripts/ci/strix_quick_gate.sh" | nl -ba |
grep -Ei -C 22 \
'is_nvidia_nim_not_found_error|is_infrastructure_error|is_model_retryable_error|same.model|attempted.models|NotFoundError|Nvidia_nimException|vulnerab|incomplete.{0,20}scan' || true
git show "$head:.github/workflows/strix.yml" | nl -ba |
grep -Ei -C 22 \
'NVIDIA_NIM_API_KEY|nvidia/nemotron|llama-3\.3-nemotron|github-models|backend_unavailable_signal|NotFoundError|Nvidia_nimException|reported_vulnerability_signal|incomplete' || true
echo '== exact regression and smoke contracts =='
git show "$head:tests/test_strix_nvidia_nim_not_found_fallback.py" | nl -ba
git show "$head:scripts/ci/strix_required_workflow_smoke.sh" | nl -ba |
grep -Ei -C 12 'nvidia|litellm|404|fallback|NVIDIA_NIM_API_KEY|immutable|hash' || true
git show "$head:scripts/ci/test_strix_quick_gate.sh" | nl -ba |
grep -Ei -C 12 'nvidia|litellm|404|same.model|vulnerab|incomplete' || true
echo '== changed dependency constraints =='
git show "$head:requirements-strix-ci.txt"
echo '== direct constraint to lock-header alignment =='
requirements_file="$(mktemp)"
lock_file="$(mktemp)"
trap 'rm -f "$requirements_file" "$lock_file"' EXIT
git show "$head:requirements-strix-ci.txt" > "$requirements_file"
git show "$head:requirements-strix-ci-hashes.txt" > "$lock_file"
while IFS= read -r requirement || [ -n "$requirement" ]; do
case "$requirement" in ''|\#*) continue ;; esac
package="${requirement%%[<>=!~]*}"
grep -Eim1 "^${package}==" "$lock_file" >/dev/null &&
echo "locked=${requirement}" || echo "MISSING=${requirement}"
done < "$requirements_file"
echo '== exact GitHub check states and PR identity =='
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs | sort_by(.name)[] | [.name,.status,(.conclusion // "null")] | `@tsv`' || true
gh pr view 768 --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup:[.statusCheckRollup[]|{name,status,conclusion}]}' || trueLength of output: 7538 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='78c3e21c183fca47dfc3eeb95ce37001a8e4c115'
repo='ContextualWisdomLab/.github'
numbered() { awk '{ printf "%6d %s\n", NR, $0 }'; }
echo '== NVIDIA classifier definition =='
git show "$head:scripts/ci/strix_quick_gate.sh" |
awk '
/^is_nvidia_nim_not_found_error\(\)/ {emit=1}
emit {printf "%6d %s\n", NR, $0}
emit && /^}$/ {exit}
'
echo '== classifier call paths, retry exclusion, and fail-closed conditions =='
git show "$head:scripts/ci/strix_quick_gate.sh" | numbered |
grep -Ei -C 18 \
'is_nvidia_nim_not_found_error|is_infrastructure_error|is_model_retryable_error|is_transient_same_model_retry_error|attempted.models|same.model|vulnerab|incomplete.{0,20}scan|scan.{0,20}incomplete' || true
echo '== workflow model order and outer neutralization =='
git show "$head:.github/workflows/strix.yml" | numbered |
grep -Ei -C 18 \
'NVIDIA_NIM_API_KEY|nvidia/nemotron|llama-3\.3-nemotron|github-models|backend_unavailable_signal|NotFoundError|Nvidia_nimException|reported_vulnerability_signal|incomplete' || true
echo '== complete NVIDIA fallback regression test =='
git show "$head:tests/test_strix_nvidia_nim_not_found_fallback.py" | numbered
echo '== required-workflow smoke assertions =='
git show "$head:scripts/ci/strix_required_workflow_smoke.sh" | numbered |
grep -Ei -C 12 'nvidia|litellm|404|fallback|NVIDIA_NIM_API_KEY|immutable|hash' || true
echo '== existing Bash test assertions =='
git show "$head:scripts/ci/test_strix_quick_gate.sh" | numbered |
grep -Ei -C 12 'nvidia|litellm|404|same.model|vulnerab|incomplete' || true
echo '== credentials changed by the diff =='
git diff --no-ext-diff --unified=4 \
3f65dbee6672b78802e7d71d49c390f3817bb03b "$head" -- .github/workflows/strix.yml |
grep -Ei -C 4 'NVIDIA_NIM_API_KEY|token|secret|credential' || true
echo '== dependency lock alignment and changed package entries =='
git diff --no-ext-diff --unified=3 \
3f65dbee6672b78802e7d71d49c390f3817bb03b "$head" -- \
requirements-strix-ci.txt requirements-strix-ci-hashes.txt | head -n 500
requirements_file="$(mktemp)"
lock_file="$(mktemp)"
trap 'rm -f "$requirements_file" "$lock_file"' EXIT
git show "$head:requirements-strix-ci.txt" > "$requirements_file"
git show "$head:requirements-strix-ci-hashes.txt" > "$lock_file"
while IFS= read -r requirement || [ -n "$requirement" ]; do
case "$requirement" in ''|\#*) continue ;; esac
package="${requirement%%[<>=!~]*}"
if grep -Eim1 "^${package}==" "$lock_file" >/dev/null; then
printf 'LOCKED %s\n' "$requirement"
else
printf 'MISSING %s\n' "$requirement"
fi
done < "$requirements_file"
echo '== exact-head checks =='
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs | sort_by(.name)[] | [.name,.status,(.conclusion // "null")] | `@tsv`' || true
echo '== PR state =='
gh pr view 768 --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup:[.statusCheckRollup[]|{name,status,conclusion}]}' || trueLength of output: 133495 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='78c3e21c183fca47dfc3eeb95ce37001a8e4c115'
extract_function() {
local object="$1"
local function="$2"
git show "$object" | awk -v fn="$function" '
$0 ~ "^" fn "\\(\\)" {printing=1}
printing {printf "%6d %s\n", NR, $0}
printing && /^}$/ {exit}
'
}
echo '== exact classifier =='
extract_function "$head:scripts/ci/strix_quick_gate.sh" 'is_nvidia_nim_not_found_error'
echo '== classifier uses and fallback loop =='
git show "$head:scripts/ci/strix_quick_gate.sh" |
grep -n -E -C 14 \
'is_nvidia_nim_not_found_error|NVIDIA NIM model catalog|skip.*same.model|same.model.*skip|fallback_model|attempted_models|attempted-models' || true
echo '== exact workflow outer neutralization block =='
git show "$head:.github/workflows/strix.yml" |
awk '
/backend_unavailable_signal=/ {start=NR-10; end=NR+45}
NR>=start && NR<=end {printf "%6d %s\n", NR, $0}
'
echo '== exact workflow model-selection block =='
git show "$head:.github/workflows/strix.yml" |
grep -n -E -C 10 \
'nvidia/nemotron-3-super-120b-a12b|llama-3\.3-nemotron-super-49b-v1\.5|github-models|NVIDIA_NIM_API_KEY' || true
echo '== exact Python regression methods =='
git show "$head:tests/test_strix_nvidia_nim_not_found_fallback.py" |
awk '
/^ def test_/ {printing=1}
printing {printf "%6d %s\n", NR, $0}
printing && /^ def test_/ && seen++ { }
' | sed -n '1,400p'
echo '== smoke checks added by this diff =='
git diff --no-ext-diff --unified=8 \
3f65dbee6672b78802e7d71d49c390f3817bb03b "$head" -- \
scripts/ci/strix_required_workflow_smoke.sh \
docs/doctoring/strix-nvidia-nim-not-found-fallback.md \
CHANGELOG.mdLength of output: 41099
I found no current static code blocker.
I cannot approve yet. At the exact-head check query, the current Please request approval after the current exact-head You are interacting with an AI system. |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head78c3e21c183fca47dfc3eeb95ce37001a8e4c115. -
Head SHA:
78c3e21c183fca47dfc3eeb95ce37001a8e4c115 -
Workflow run: 30973619074
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (3 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (3 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-nvidia-nim-not-found-fallback.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-nvidia-nim-not-found-fallback.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_strix_nvidia_nim_not_found_fallback.py"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test: test_strix_nvidia_nim_not_found_fallback.py"]
R5 --> V5["targeted test run"]
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review stacked exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='0aa58225561cb2268dd92c35d13660d067aa9f29'
base='44f15bb0b466e073ead90cc6e106b15d7600f47d'
repo='ContextualWisdomLab/.github'
show_range() {
local object="$1"
local start="$2"
local end="$3"
git show "$object" | awk -v start="$start" -v end="$end" \
'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }'
}
echo '== Exact identity and stack scope =='
printf 'checked_out='; git rev-parse HEAD
printf 'head='; git rev-parse "$head"
printf 'base='; git rev-parse "$base"
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
git diff --name-status "$base" "$head"
printf 'changed_file_count='
git diff --name-only "$base" "$head" | wc -l
git diff --check "$base" "$head"
echo '== Complete changed-file diff summary =='
git diff --stat "$base" "$head"
git diff --no-ext-diff --unified=12 "$base" "$head" -- \
.github/workflows/strix.yml \
scripts/ci/strix_quick_gate.sh \
scripts/ci/strix_required_workflow_smoke.sh \
scripts/ci/test_strix_quick_gate.sh \
tests/test_strix_nvidia_nim_not_found_fallback.py \
requirements-strix-ci.txt \
requirements-strix-ci-hashes.txt \
CHANGELOG.md \
docs/doctoring/strix-nvidia-nim-not-found-fallback.md \
pyproject.toml \
uv.lock 2>/dev/null || true
echo '== Workflow inventory and temporary-workflow candidates =='
git ls-tree -r --name-only "$head" -- .github/workflows
git ls-tree -r --name-only "$head" -- .github/workflows |
grep -Ei '(repair|finali[sz]er|temporary|publish)' || true
echo '== NVIDIA classifier, retry paths, and fail-closed paths =='
git show "$head:scripts/ci/strix_quick_gate.sh" |
nl -ba |
grep -Ei -C 22 \
'is_nvidia_nim_not_found_error|is_infrastructure_error|is_model_retryable_error|is_transient_same_model_retry_error|attempted.models|same.model|NotFoundError|Nvidia_nimException|vulnerab|incomplete.{0,20}scan|scan.{0,20}incomplete' || true
echo '== Workflow selection and external neutralization =='
git show "$head:.github/workflows/strix.yml" |
nl -ba |
grep -Ei -C 22 \
'NVIDIA_NIM_API_KEY|nvidia/nemotron|llama-3\.3-nemotron|github-models|backend_unavailable_signal|NotFoundError|Nvidia_nimException|reported_vulnerability_signal|incomplete' || true
echo '== Regression, smoke, and doctoring contracts =='
git show "$head:tests/test_strix_nvidia_nim_not_found_fallback.py" | nl -ba
git show "$head:scripts/ci/strix_required_workflow_smoke.sh" |
nl -ba | grep -Ei -C 14 'nvidia|litellm|404|fallback|NVIDIA_NIM_API_KEY|immutable|hash' || true
git show "$head:scripts/ci/test_strix_quick_gate.sh" |
nl -ba | grep -Ei -C 14 'nvidia|litellm|404|same.model|vulnerab|incomplete' || true
git show "$head:docs/doctoring/strix-nvidia-nim-not-found-fallback.md" | nl -ba
echo '== uv materialization and CodeQL references in stack =='
git diff --no-ext-diff --unified=20 "$base" "$head" -- \
pyproject.toml uv.lock .github/workflows 2>/dev/null || true
git grep -n -I -i \
-e 'uv ' -e 'uv.lock' -e 'materializ' -e 'codeql' -e 'revision' \
"$head" -- .github pyproject.toml uv.lock scripts tests 2>/dev/null || true
echo '== Direct dependency constraints map to hash-lock entries =='
requirements_file="$(mktemp)"
lock_file="$(mktemp)"
trap 'rm -f "$requirements_file" "$lock_file"' EXIT
git show "$head:requirements-strix-ci.txt" > "$requirements_file"
git show "$head:requirements-strix-ci-hashes.txt" > "$lock_file"
while IFS= read -r requirement || [ -n "$requirement" ]; do
case "$requirement" in ''|\#*) continue ;; esac
package="${requirement%%[<>=!~]*}"
if grep -Eim1 "^${package}==" "$lock_file" >/dev/null; then
printf 'LOCKED %s\n' "$requirement"
else
printf 'MISSING %s\n' "$requirement"
fi
done < "$requirements_file"
echo '== Exact-head GitHub checks and PR merge-preview state =='
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs | sort_by(.name)[] | [.name, .status, (.conclusion // "null"), .head_sha] | `@tsv`'
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/commits/${head}/status" \
--jq '{state, statuses: [.statuses[] | {context, state}]}' || true
gh pr view 768 --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,mergeable,reviewDecision,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,mergeable,reviewDecision,statusCheckRollup:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}'Length of output: 53319 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='0aa58225561cb2268dd92c35d13660d067aa9f29'
base='44f15bb0b466e073ead90cc6e106b15d7600f47d'
repo='ContextualWisdomLab/.github'
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }'
}
echo '== Commit graph and scope =='
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true' || echo 'base_is_ancestor=false'
git merge-base --is-ancestor "$head" "$base" && echo 'head_is_ancestor=true' || echo 'head_is_ancestor=false'
printf 'merge_base='; git merge-base "$base" "$head"
echo '-- base to head files --'
git diff --name-status "$base" "$head"
echo '-- merge-base to head files --'
git diff --name-status "$(git merge-base "$base" "$head")" "$head"
echo '-- commits unique to each side --'
git rev-list --left-right --count "$base...$head"
echo '-- changed file count --'
git diff --name-only "$base" "$head" | wc -l
echo '== Exact NVIDIA classifier and all call sites =='
git show "$head:scripts/ci/strix_quick_gate.sh" | numbered |
grep -E -C 16 'is_nvidia_nim_not_found_error\(\)|is_nvidia_nim_not_found_error|is_transient_same_model_retry_error\(\)|is_model_retryable_error\(\)|has_detected_infrastructure_error\(\)' || true
echo '== Fallback loop and incomplete-scan handling =='
git show "$head:scripts/ci/strix_quick_gate.sh" | numbered |
grep -Ei -C 18 'STRIX_FALLBACK_MODELS|fallback_model|attempted_models|attempted.model|same.model|incomplete.{0,30}scan|scan.{0,30}incomplete|provider.{0,30}(warning|signal)|warning.{0,30}provider' || true
echo '== Outer workflow neutralization and fallback order =='
git show "$head:.github/workflows/strix.yml" | numbered |
grep -Ei -C 18 'STRIX_FALLBACK_MODELS|backend_unavailable_signal|reported_vulnerability_signal|NotFoundError|Nvidia_nimException|incomplete|Vulnerabilities|NVIDIA_NIM_API_KEY|nemotron|github_models' || true
echo '== UV materialization code and its tests =='
git diff --no-ext-diff --unified=30 "$base" "$head" -- \
pyproject.toml \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
.github/workflows/trusted-uv-materializer-quality-ci.yml \
docs/doctoring/trusted-uv-lock-materialization.md
git show "$base:pyproject.toml" | numbered || true
git show "$base:scripts/ci/materialize_base_python_requirements.py" | numbered | sed -n '1,360p' || true
git show "$head:scripts/ci/materialize_base_python_requirements.py" | numbered | sed -n '1,360p' || true
echo '== CodeQL workflow revision and changed workflow references =='
git show "$head:.github/workflows/codeql-pr.yml" | numbered |
grep -Ei -C 12 'codeql|checkout|ref:|sha|revision|python' || true
git diff --no-ext-diff --unified=12 "$base" "$head" -- .github/workflows/codeql-pr.yml .github/workflows/strix.yml
echo '== Exact-head check and merge-preview state =='
gh api -H 'Accept: application/vnd.github+json' \
"repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs | sort_by(.name)[] | [.name, .status, (.conclusion // "null"), .details_url] | `@tsv`' || true
gh pr view 768 --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,mergeable,reviewDecision,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,mergeable,reviewDecision,statusCheckRollup:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}' || trueLength of output: 204457
Blocking — the stack removes the trusted exact-base In Lines 142-158 then return The deleted trusted-uv quality workflow and regression contracts removed the 100% branch-coverage and docstring evidence for this boundary. Therefore, the current tree does not preserve the claimed inherited trusted-uv materialization evidence. Restore a pinned and verified The NVIDIA classifier is correctly scoped to one LiteLLM/NVIDIA/catalog-404 line. It does not enter same-model retry. The outer neutralization pattern has the corresponding boundary. Reported vulnerabilities remain blocking. I also verified that the requested base and head are divergent. Their merge base is Current CodeQL head and merge-preview checks succeeded. You are interacting with an AI system. |
0aa5822 to
44f15bb
Compare
|
자동 정리: base 대비 실제 변경(diff)이 0건이라 이 PR을 닫습니다. 변경을 추가한 뒤 reopen하세요. |
|
Integrated the exact reviewed seven-file Strix tree directly into prerequisite PR #743 at commit |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headb83eda81f8e94f2c8c9c3354249d5bebb8c48aa3. -
Head SHA:
b83eda81f8e94f2c8c9c3354249d5bebb8c48aa3 -
Workflow run: 30975360977
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-nvidia-nim-not-found-fallback.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-nvidia-nim-not-found-fallback.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_strix_nvidia_nim_not_found_fallback.py"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test: test_strix_nvidia_nim_not_found_fallback.py"]
R5 --> V5["targeted test run"]
|
Superseded by direct integration into prerequisite PR #743. The seven reviewed Strix files are now present on #743 current branch with their exact reviewed Git blob identities, including |
|
@opencode-agent Please re-review exact current head |
|
@opencode-agent review Please independently review the exact current head after the production NVIDIA NIM hosted-model fallback repair. Verify that provider-scoped model-catalog 404s enter cross-model fallback without same-model retry, ordinary application 404s remain non-retryable, reported vulnerabilities remain fail-closed, the current NVIDIA primary/fallback plan is documented, temporary source-mutating verifier workflows are absent, and all exact-head checks pass. Submit APPROVE only if no blocker remains; do not alter reviewer credentials or bypass repository protections. |
2 participants
Summary
Repair the organization-central Strix gate after an authenticated NVIDIA NIM hosted-model catalog
404 Not Foundwas incorrectly treated as a non-recoverable security failure.This PR is now a clean one-commit stack on trusted-uv prerequisite PR #743. The stack deliberately inherits #743's exact-base dependency materialization, Python 3.10 compatibility, 100% branch coverage, 100% production docstrings, secure Strix dependency floor, and one-version CodeQL workflow contract rather than duplicating or conflicting with them.
Production repair
nvidia/nemotron-3-super-120b-a12b;nvidia/llama-3.3-nemotron-super-49b-v1.5before existing GitHub Models candidates;NotFoundErrorline containing NVIDIA NIM provider context and model-catalog not-found evidence as retryable cross-model infrastructure evidence;Credential and authority boundary
NVIDIA_NIM_API_KEYremains the NVIDIA provider credential used by Strix;COPILOT_GITHUB_TOKENis introduced;Exact stack
fix/trusted-uv-lock-coverage-clean44f15bb0b466e073ead90cc6e106b15d7600f47de896149c9d3f19355189dd12c59b61260e1eb7721Exact seven-file scope
.github/workflows/strix.ymlCHANGELOG.mddocs/doctoring/strix-nvidia-nim-not-found-fallback.mdscripts/ci/strix_quick_gate.shscripts/ci/strix_required_workflow_smoke.shscripts/ci/test_strix_quick_gate.shtests/test_strix_nvidia_nim_not_found_fallback.pyThe stack reconstruction reused the exact reviewed Git blob identities from the previously verified Strix head while making #743 the sole parent.
git comparenow reports one commit ahead, zero behind, and no divergent history.Regression contract
The tests prove that:
Nvidia_nimExceptioncatalog 404 is recognized;Merge order and gate
mainand merge fix(coverage): materialize trusted uv lock dependencies #743 without bypass.No prior-head, rate-limited, skipped, cancelled, or absent result is completion evidence. Auto-merge may act only after every repository rule succeeds.