fix(ci): reap fatal OpenCode process groups - #813
Conversation
|
Warning Review limit reached
Next review available in: 19 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughOpenCode를 별도 프로세스 그룹에서 실행합니다. 치명적 provider 오류가 발생하면 그룹 전체에 ChangesOpenCode 프로세스 그룹 종료
Dependency review 실패 종료 계약
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant run_one_model_attempt
participant OpenCodeProcessGroup
participant WorkflowPipe
run_one_model_attempt->>OpenCodeProcessGroup: setsid로 OpenCode 실행
OpenCodeProcessGroup->>WorkflowPipe: 출력 파이프 유지
run_one_model_attempt->>OpenCodeProcessGroup: 치명적 provider 오류 후 TERM 전송
run_one_model_attempt->>OpenCodeProcessGroup: 최대 30초 후 KILL 전송
OpenCodeProcessGroup-->>WorkflowPipe: 하위 프로세스 종료 및 파이프 해제
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent Please review the exact current head only. Confirm the five-file process-group repair, deterministic timeout regression, complete 100% coverage/docstring evidence, unresolved threads, and current required Checks. Do not update the branch or merge. |
|
@coderabbitai review Review only exact current head |
|
@opencode-agent Perform a read-only exact-head review of PR #813 at Independently verify the process-tree and evidence boundary: |
|
@cwl-noema-review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='d0a36e988cf052221472c2a85ffa87185fa20098'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
repo='ContextualWisdomLab/.github'
pr='813'
echo '== Commit identity and merge base =='
git rev-parse HEAD
git cat-file -t "$head_sha"
git cat-file -t "$base_sha"
git merge-base "$base_sha" "$head_sha"
echo
echo '== Changed files =='
git diff --name-status "$base_sha" "$head_sha"
echo
echo '== Diff check =='
git diff --check "$base_sha" "$head_sha" || true
echo
echo '== Targeted diff =='
git diff --unified=80 "$base_sha" "$head_sha" -- \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_required_workflow_queue_contract.py \
tests/test_sandboxed_verify.py \
docs/doctoring/opencode-process-group-termination.md \
CHANGELOG.md
echo
echo '== Shell script outline and relevant process controls =='
ast-grep outline scripts/ci/run_opencode_review_model_pool.sh --items all 2>/dev/null || true
rg -n -C 10 --glob 'run_opencode_review_model_pool.sh' \
'setsid|timeout|kill|pgid|process group|fatal|provider|opencode run' scripts/ci
echo
echo '== Python test outlines and relevant assertions =='
ast-grep outline tests/test_required_workflow_queue_contract.py --items all 2>/dev/null || true
ast-grep outline tests/test_sandboxed_verify.py --items all 2>/dev/null || true
rg -n -C 10 --glob 'test_required_workflow_queue_contract.py' --glob 'test_sandboxed_verify.py' \
'TimeoutExpired|timeout|fatal|provider|setsid|kill|process group|HTTP|status_code|dependency' tests
echo
echo '== Doctoring and changelog =='
cat -n docs/doctoring/opencode-process-group-termination.md
cat -n CHANGELOG.md | sed -n '1,160p'
echo
echo '== GitHub PR metadata and checks =='
gh pr view "$pr" --repo "$repo" --json number,url,headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
echo
echo '== GitHub review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 20) {
nodes { author { login } body url createdAt }
}
}
}
}
}
}' || trueLength of output: 152173 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='813'
head_sha='d0a36e988cf052221472c2a85ffa87185fa20098'
echo '== Exact-head workflow runs and jobs =='
gh api "repos/$repo/actions/runs?head_sha=$head_sha&event=pull_request&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.head_sha,.status,.conclusion,.html_url] | `@tsv`' || true
echo
echo '== Required OpenCode Review run jobs and logs =='
for run_id in 31153273013; do
gh run view "$run_id" --repo "$repo" --json headSha,status,conclusion,jobs,url
echo "-- failed or complete job log output for run $run_id --"
gh run view "$run_id" --repo "$repo" --log 2>&1 | \
rg -n -i -C 3 \
'900 tests passed|6576/6576|2622/2622|100%|docstrings|bash syntax|diff --check|coverage|fatal-provider|process.group|opencode-review' \
|| true
done
echo
echo '== Security Scan and Strix run status =='
for run_id in 31153272949 31153273020; do
gh run view "$run_id" --repo "$repo" --json headSha,status,conclusion,jobs,url || true
done
echo
echo '== Existing fatal-provider regression and sandbox helper context =='
rg -n -C 18 \
'test_fatal_provider_error_kills_hung_opencode_run_early|fatal_provider_error|run_command|def main\(' \
tests scripts/ci | head -n 420
echo
echo '== Pull-request reviews and branch protection =='
gh pr view "$pr" --repo "$repo" --json reviews,latestReviews,reviewDecision,mergeStateStatus,isDraft,headRefOid,baseRefOid
gh api "repos/$repo/branches/main/protection" || true
echo
echo '== Open review comments, issue comments, and review requests =='
gh api "repos/$repo/pulls/$pr/comments?per_page=100" --jq \
'.[] | [.user.login,.path,(.line // .original_line // 0),.body,.html_url] | `@tsv`' || true
gh api "repos/$repo/issues/$pr/comments?per_page=100" --jq \
'.[] | [.user.login,.body,.html_url] | `@tsv`' || true
gh api "repos/$repo/pulls/$pr/requested_reviewers" || trueLength of output: 73548
Static code result: no actionable defect found.
Current GitHub state: not ready to approve.
I could not verify the claimed central No files, refs, PR settings, or merge state were modified. You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='813'
head_sha='d0a36e988cf052221472c2a85ffa87185fa20098'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
echo '== Commit identity, ancestry, and changed paths =='
printf 'checked_out='
git rev-parse HEAD
printf 'head_type='
git cat-file -t "$head_sha"
printf 'base_type='
git cat-file -t "$base_sha"
printf 'merge_base='
git merge-base "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
echo '== Diff whitespace check =='
git diff --check "$base_sha" "$head_sha"
echo '== Changed-file outlines =='
ast-grep outline scripts/ci/run_opencode_review_model_pool.sh --items all || true
ast-grep outline tests/test_required_workflow_queue_contract.py --items all || true
ast-grep outline tests/test_sandboxed_verify.py --items all || true
echo '== Process-group implementation and regression context =='
rg -n -C 18 --glob 'run_opencode_review_model_pool.sh' \
'setsid|timeout|kill|process group|opencode_pid|fatal|provider|wait' scripts/ci
rg -n -C 18 --glob 'test_sandboxed_verify.py' \
'TimeoutExpired|fatal.provider|fatal_provider|setsid|process.group|kill|timeout' tests
rg -n -C 12 --glob 'test_required_workflow_queue_contract.py' \
'dependency|status_code|HTTP|200|fail.closed|queue' tests
echo '== Full five-file patch =='
git diff --unified=50 "$base_sha" "$head_sha" -- \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_required_workflow_queue_contract.py \
tests/test_sandboxed_verify.py \
docs/doctoring/opencode-process-group-termination.md \
CHANGELOG.md
echo '== Shell syntax =='
bash -n scripts/ci/run_opencode_review_model_pool.sh
echo '== Exact-head PR state, checks, reviews, and threads =='
gh pr view "$pr" --repo "$repo" \
--json url,headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
gh api "repos/$repo/actions/runs?head_sha=$head_sha&per_page=100" --jq \
'.workflow_runs[] | [.id,.name,.event,.head_sha,.status,.conclusion,.html_url] | `@tsv`'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) { nodes { author { login } body url } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes'Length of output: 172692 🏁 Script executed: #!/bin/bash
set -euo pipefail
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
head_sha='d0a36e988cf052221472c2a85ffa87185fa20098'
echo '== Locate fatal-provider regression =='
rg -n -C 20 \
'test_fatal_provider_error_kills_hung_opencode_run_early|fatal structured|fatal provider|ContextOverflowError|holds? .*pipe|sleep\(120|sleep 120' \
tests scripts
echo '== Added patch lines that could affect writers or credentials =='
git diff --unified=0 "$base_sha" "$head_sha" -- \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_required_workflow_queue_contract.py \
tests/test_sandboxed_verify.py \
docs/doctoring/opencode-process-group-termination.md \
CHANGELOG.md \
| rg -n '^\+[^+].*(GITHUB_TOKEN|TOKEN|SECRET|credential|password|curl|gh |git push|git commit|git update-ref|write|upload|publish|merge|setsid|kill|timeout|TimeoutExpired)' \
|| true
echo '== Exact changed-file list and added-line count by file =='
git diff --numstat "$base_sha" "$head_sha"Length of output: 41102 🤖 web_search executed:
Length of output: 5746
I found one actionable documentation issue.
All other requested static checks passed.
The central 900-test, full statement and branch coverage, and production-docstring evidence has successful exact-head workflow checks. I did not execute repository tests in this read-only sandbox. The current live GitHub state is not ready for approval or merge.
No files, refs, pull request settings, or merge state were modified. You are interacting with an AI system. |
|
Review the exact current head |
|
@coderabbitai review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='813'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
head_sha='b968b396039b3cc71e2f68dd7258fd74b7895dcf'
echo '== Exact commit identity and change boundary =='
printf 'checked_out='; git rev-parse HEAD
printf 'head_type='; git cat-file -t "$head_sha"
printf 'base_type='; git cat-file -t "$base_sha"
printf 'merge_base='; git merge-base "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
git diff --check "$base_sha" "$head_sha"
echo '== Changed-file structure =='
ast-grep outline scripts/ci/run_opencode_review_model_pool.sh --items all || true
ast-grep outline tests/test_sandboxed_verify.py --items all || true
ast-grep outline tests/test_required_workflow_queue_contract.py --items all || true
echo '== Full target diff =='
git diff --unified=55 "$base_sha" "$head_sha" -- \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_required_workflow_queue_contract.py \
tests/test_sandboxed_verify.py \
docs/doctoring/opencode-process-group-termination.md \
CHANGELOG.md
echo '== Process-group and acceptance-boundary evidence =='
rg -n -C 14 --glob 'run_opencode_review_model_pool.sh' \
'setsid|timeout|kill|opencode_pid|fatal|provider|wait|type|error|output' scripts/ci
rg -n -C 14 --glob 'test_sandboxed_verify.py' \
'Linux man-pages|2026-02-08|Kerrisk|TimeoutExpired|fatal.provider|process.group|setsid|SIGTERM|SIGKILL|timeout' tests
rg -n -C 12 --glob 'test_required_workflow_queue_contract.py' \
'dependency|status_code|HTTP|200|fail.closed|queue' tests
echo '== Shell parse check =='
bash -n scripts/ci/run_opencode_review_model_pool.sh
echo '== Exact-head PR metadata, checks, reviews, and threads =='
gh pr view "$pr" --repo "$repo" \
--json url,headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
gh api "repos/$repo/actions/runs?head_sha=$head_sha&per_page=100" --jq \
'.workflow_runs[] | [.id,.name,.event,.head_sha,.status,.conclusion,.html_url] | `@tsv`'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) {
nodes { author { login } body url }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes'Length of output: 177051 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head_sha='b968b396039b3cc71e2f68dd7258fd74b7895dcf'
echo '== Required OpenCode Review jobs and evidence log =='
gh run view 31154452580 --repo "$repo" --json headSha,status,conclusion,jobs,url
gh run view 31154452580 --repo "$repo" --log 2>&1 | rg -n -i -C 3 \
'head_sha|b968b396039b3cc71e2f68dd7258fd74b7895dcf|900 tests passed|6576/6576|2622/2622|100%|docstrings|bash -n|diff --check|coverage|process.group|fatal.provider|opencode-review' \
|| true
echo '== Existing fatal-provider regression location and assertions =='
rg -n -C 18 \
'test_fatal_provider_error_kills_hung_opencode_run_early|fatal_provider_error_kills|holds? .*pipe|sleep\(120|sleep 120|type.*error|type.*text' \
tests scripts
echo '== Current exact-head workflow completion state =='
gh api "repos/$repo/actions/runs?head_sha=$head_sha&per_page=100" --jq \
'.workflow_runs[] | select(.name == "CodeQL PR" or .name == "Python Security" or .name == "Strix Security Scan" or .name == "SAST Semgrep") | [.id,.name,.status,.conclusion,.html_url] | `@tsv`'Length of output: 122418
Static result: no actionable finding. The diff contains exactly the required five files. The prior APA 7 finding is corrected.
The process-group repair remains within the requested boundary.
The changed sandbox timeout test is deterministic. It injects The dependency-review contract remains fail-closed. Only HTTP 200 enables dependency review. The contract test rejects HTTP 403 and HTTP 404 enablement. The diff adds no credential, token, secret, writer, ref update, merge action, or publishing action. Exact-head evidence status
No files, refs, credentials, PR settings, or merge state were modified.
|
|
@coderabbitai review Review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='813'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
head_sha='b968b396039b3cc71e2f68dd7258fd74b7895dcf'
echo '== Exact commit boundary =='
printf 'checked_out='; git rev-parse HEAD
printf 'head='; git rev-parse "$head_sha"
printf 'merge_base='; git merge-base "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
git diff --check "$base_sha" "$head_sha"
echo '== Changed-file outlines =='
ast-grep outline scripts/ci/run_opencode_review_model_pool.sh --items all || true
ast-grep outline tests/test_sandboxed_verify.py --items all || true
ast-grep outline tests/test_required_workflow_queue_contract.py --items all || true
echo '== Full five-file diff =='
git diff --unified=55 "$base_sha" "$head_sha" -- \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_required_workflow_queue_contract.py \
tests/test_sandboxed_verify.py \
docs/doctoring/opencode-process-group-termination.md \
CHANGELOG.md
echo '== Process and contract evidence =='
rg -n -C 16 --glob 'run_opencode_review_model_pool.sh' \
'setsid|timeout|kill|opencode_pid|fatal|provider|wait|type|error|output' scripts/ci
rg -n -C 16 --glob 'test_sandboxed_verify.py' \
'TimeoutExpired|fatal.provider|process.group|setsid|SIGTERM|SIGKILL|timeout|Linux man-pages|2026-02-08|Kerrisk' tests
rg -n -C 12 --glob 'test_required_workflow_queue_contract.py' \
'dependency|status_code|HTTP|200|fail.closed|queue' tests
echo '== Shell syntax =='
bash -n scripts/ci/run_opencode_review_model_pool.sh
echo '== Current PR checks, reviews, and threads =='
gh pr view "$pr" --repo "$repo" \
--json url,headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
gh api "repos/$repo/actions/runs?head_sha=$head_sha&per_page=100" --jq \
'.workflow_runs[] | [.id,.name,.event,.head_sha,.status,.conclusion,.html_url] | `@tsv`'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) {
nodes { author { login } body url }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes'Length of output: 179542
Result: no path-specific actionable finding.
The process-group boundary is correct.
Ordinary behavior remains unchanged.
The regression and dependency-review contracts are correct.
The APA 7 source record corrects the prior issue.
Current exact-head GitHub state
I did not modify files, refs, pull request settings, merge state, reviewer credentials, or branch protection. ✅ Action performedReview finished.
|
|
@opencode-agent @cwl-noema-review Perform a read-only formal review of exact current head |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/test_required_workflow_queue_contract.py`:
- Around line 836-845: Update the security-scan workflow’s HTTP support-check
implementation to satisfy the contract asserted by the test: use curl connect
and maximum timeouts of 10 and 30 seconds, discard the response body with -o
/dev/null, treat every non-200 status as fail-closed by printing “Failing
closed” and exiting 1, and remove the 403/404 supported=false success path.
Preserve the required supported=true output for HTTP 200, then run the full test
suite.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: faf307f9-239f-4e2a-b5a2-8325d6d6540c
📒 Files selected for processing (5)
CHANGELOG.mddocs/doctoring/opencode-process-group-termination.mdscripts/ci/run_opencode_review_model_pool.shtests/test_required_workflow_queue_contract.pytests/test_sandboxed_verify.py
|
@opencode-agent address The new CodeRabbit finding is valid as a branch-composition defect, but PR #813 must not absorb the separate scanner policy from PR #799. At exact head Fix the scope rather than weakening the test or expanding production policy:
Do not merge #799 into this branch, weaken fail-closed policy, add a temporary writer, or claim predecessor test evidence. |
|
@coderabbitai review Review exact current head |
|
@opencode-agent @cwl-noema-review Perform a read-only formal review of exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='813'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
head_sha='6748ef1599c07ab717977142d17b67dda2c9d880'
echo '== Exact commit identity and ancestry =='
printf 'checked_out='; git rev-parse HEAD
printf 'head='; git rev-parse "$head_sha"
printf 'base='; git rev-parse "$base_sha"
printf 'merge_base='; git merge-base "$base_sha" "$head_sha"
echo '== Changed paths and whitespace =='
git diff --name-status "$base_sha" "$head_sha"
git diff --stat "$base_sha" "$head_sha"
git diff --check "$base_sha" "$head_sha"
echo '== Changed-file structure =='
for file in \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_required_workflow_queue_contract.py \
tests/test_sandboxed_verify.py \
docs/doctoring/opencode-process-group-termination.md \
CHANGELOG.md
do
if test -f "$file"; then
echo "-- $file --"
ast-grep outline "$file" --items all 2>/dev/null || true
fi
done
echo '== Full exact-head patch =='
git diff --unified=70 "$base_sha" "$head_sha"
echo '== Process-group implementation and test evidence =='
rg -n -C 18 --glob 'run_opencode_review_model_pool.sh' \
'setsid|timeout|kill|opencode_pid|fatal|provider|wait|type|error|output' scripts/ci
rg -n -C 18 --glob 'test_sandboxed_verify.py' \
'TimeoutExpired|fatal.provider|process.group|setsid|SIGTERM|SIGKILL|Linux man-pages|2026-02-08|Kerrisk' tests
rg -n -C 18 --glob 'test_required_workflow_queue_contract.py' \
'dependency|status_code|HTTP|200|fail.closed|queue|curl|connect-timeout|max-time' tests
echo '== Workflow support-probe implementation =='
rg -n -C 24 \
'dependency.review|dependency-review|supported=false|supported=true|connect-timeout|max-time|status_code|HTTP' \
.github 2>/dev/null || true
echo '== Shell syntax =='
bash -n scripts/ci/run_opencode_review_model_pool.sh
echo '== Added sensitive or writer-like lines =='
git diff --unified=0 "$base_sha" "$head_sha" | \
rg -n '^\+[^+].*(GITHUB_TOKEN|TOKEN|SECRET|credential|password|git push|git commit|git update-ref|gh |curl|upload|publish|merge|write)' \
|| true
echo '== Exact-head PR state, checks, reviews, and threads =='
gh pr view "$pr" --repo "$repo" \
--json url,headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
gh api "repos/$repo/actions/runs?head_sha=$head_sha&per_page=100" --jq \
'.workflow_runs[] | [.id,.name,.event,.head_sha,.status,.conclusion,.html_url] | `@tsv`'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) { nodes { author { login } body url } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes'Length of output: 202962
Result: no path-specific actionable finding. The prior dependency-review finding is fixed in
The process-group repair remains correct.
The process-group repair still spans the original five files. The complete PR boundary now includes a sixth file, Current GitHub state
No files, refs, PR settings, credentials, or merge state were modified. You are interacting with an AI system. |
|
@coderabbitai review Review exact current head |
|
@opencode-agent Perform a read-only exact-head review of |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='813'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
head_sha='6748ef1599c07ab717977142d17b67dda2c9d880'
echo '== Exact commit identity and ancestry =='
printf 'checked_out='; git rev-parse HEAD
printf 'head='; git rev-parse "$head_sha"
printf 'base='; git rev-parse "$base_sha"
printf 'merge_base='; git merge-base "$base_sha" "$head_sha"
echo '== Changed paths and whitespace =='
git diff --name-status "$base_sha" "$head_sha"
git diff --check "$base_sha" "$head_sha"
echo '== Target file outlines =='
ast-grep outline scripts/ci/run_opencode_review_model_pool.sh --items all 2>/dev/null || true
ast-grep outline tests/test_sandboxed_verify.py --items all 2>/dev/null || true
ast-grep outline tests/test_required_workflow_queue_contract.py --items all 2>/dev/null || true
echo '== Exact-head patch for review scope =='
git diff --unified=60 "$base_sha" "$head_sha" -- \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_sandboxed_verify.py \
tests/test_required_workflow_queue_contract.py \
.github/workflows/security-scan.yml \
docs/doctoring/opencode-process-group-termination.md \
CHANGELOG.md
echo '== Process-group implementation and test context =='
rg -n -C 18 --glob 'run_opencode_review_model_pool.sh' \
'setsid|timeout|kill|opencode_pid|fatal|provider|wait|type|error|output' scripts/ci
rg -n -C 18 --glob 'test_sandboxed_verify.py' \
'TimeoutExpired|fatal.provider|fatal_provider|process.group|setsid|SIGTERM|SIGKILL|timeout' tests
echo '== Dependency-review workflow and contract-test context =='
rg -n -C 24 \
'dependency.review|dependency-review|supported=false|supported=true|connect-timeout|max-time|status_code|HTTP|curl' \
.github/workflows/security-scan.yml tests/test_required_workflow_queue_contract.py
echo '== Non-executing shell parse check =='
bash -n scripts/ci/run_opencode_review_model_pool.sh
echo '== Added sensitive or writer-like lines =='
git diff --unified=0 "$base_sha" "$head_sha" | \
rg -n '^\+[^+].*(GITHUB_TOKEN|TOKEN|SECRET|credential|password|git push|git commit|git update-ref|gh |upload|publish|merge)' \
|| true
echo '== Exact-head PR metadata, checks, reviews =='
gh pr view "$pr" --repo "$repo" \
--json url,headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
echo '== Exact-head workflow runs =='
gh api "repos/$repo/actions/runs?head_sha=$head_sha&per_page=100" --jq \
'.workflow_runs[] | [.id,.name,.event,.head_sha,.status,.conclusion,.html_url] | `@tsv`'
echo '== Review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) { nodes { author { login } body url } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes'Length of output: 187949
Result: no path-specific actionable finding. The checked-out commit matches the requested head. The merge base matches the requested protected base. The diff changes six files. The sixth file is
The process-group repair is correct.
The timeout regression is deterministic.
The dependency-review support probe now matches its contract.
The resolved CodeRabbit thread identifies this exact workflow-contract correction as addressed in commit The patch does not add credential permissions, writer actions, ref updates, merge actions, or publishing actions. At inspection time, all exact-head workflow runs were queued. Therefore, exact-head CI, security, supply-chain, and quality results are not yet available. GitHub reported No files, refs, pull request settings, credentials, or merge state were modified.
|
|
@cwl-noema-review Review exact current head |
|
@opencode-agent @cwl-noema-review Review exact current head @coderabbitai review |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='813'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
head_sha='1779da411ef2f4c2f20e05a3035f0ff1c43600e8'
echo '== Exact commit identity and boundary =='
printf 'checked_out='; git rev-parse HEAD
printf 'requested_head='; git rev-parse "$head_sha"
printf 'requested_base='; git rev-parse "$base_sha"
printf 'merge_base='; git merge-base "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
git diff --stat "$base_sha" "$head_sha"
git diff --check "$base_sha" "$head_sha"
echo '== Changed-file outlines =='
for file in \
.github/workflows/security-scan.yml \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_required_workflow_queue_contract.py \
tests/test_sandboxed_verify.py \
docs/doctoring/opencode-process-group-termination.md \
CHANGELOG.md
do
if test -f "$file"; then
echo "-- $file --"
ast-grep outline "$file" --items all 2>/dev/null || true
fi
done
echo '== Complete exact-head patch =='
git diff --unified=65 "$base_sha" "$head_sha"
echo '== Process-group implementation and regression context =='
rg -n -C 22 --glob 'run_opencode_review_model_pool.sh' \
'setsid|timeout|kill|opencode_pid|process group|fatal|provider|wait|type|error|output|pipe' scripts/ci
rg -n -C 22 --glob 'test_sandboxed_verify.py' \
'TimeoutExpired|fatal.provider|fatal_provider|process.group|setsid|SIGTERM|SIGKILL|timeout|partial.transfer|partial_transfer|Linux man-pages' tests
echo '== Dependency-review implementation and contract-test context =='
rg -n -C 28 \
'dependency.review|dependency-review|supported=false|supported=true|connect-timeout|max-time|status_code|HTTP|curl|Failing closed|/dev/null|partial' \
.github/workflows/security-scan.yml tests/test_required_workflow_queue_contract.py
echo '== Overlap/order documentation context =='
rg -n -C 18 \
'799|overlap|order|merge|dependency.review|dependency-review|partial.transfer|partial_transfer' \
CHANGELOG.md docs tests .github 2>/dev/null || true
echo '== Shell parse check =='
bash -n scripts/ci/run_opencode_review_model_pool.sh
echo '== Added sensitive, permission, writer, or publishing operations =='
git diff --unified=0 "$base_sha" "$head_sha" | \
rg -n '^\+[^+].*(GITHUB_TOKEN|TOKEN|SECRET|credential|password|permissions:|git push|git commit|git update-ref|gh |upload|publish|merge|release|write)' \
|| true
echo '== Exact-head PR state, reviews, and checks =='
gh pr view "$pr" --repo "$repo" \
--json url,headRefOid,baseRefOid,state,isDraft,mergeStateStatus,mergeable,reviewDecision,statusCheckRollup,reviews
echo '== Exact-head workflow runs =='
gh api "repos/$repo/actions/runs?head_sha=$head_sha&per_page=100" --jq \
'.workflow_runs[] | [.id,.name,.event,.head_sha,.status,.conclusion,.html_url] | `@tsv`'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) {
nodes { author { login } body url createdAt }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes | map(select(.isResolved == false))'Length of output: 204066 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='813'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
head_sha='1779da411ef2f4c2f20e05a3035f0ff1c43600e8'
echo '== Exact changed paths =='
git diff --name-status "$base_sha" "$head_sha"
echo '== Exact changed line counts =='
git diff --numstat "$base_sha" "$head_sha"
echo '== Whitespace and shell syntax =='
git diff --check "$base_sha" "$head_sha"
bash -n scripts/ci/run_opencode_review_model_pool.sh
echo 'passed'
echo '== Process-group implementation =='
rg -n -C 14 --glob 'run_opencode_review_model_pool.sh' \
'setsid|opencode_pid|kill -TERM|kill -KILL|has_fatal_provider_error_event|timeout --kill-after|wait' \
scripts/ci/run_opencode_review_model_pool.sh
echo '== Deterministic timeout and process-group regression tests =='
rg -n -C 12 --glob 'test_sandboxed_verify.py' \
'TimeoutExpired|test_fatal_provider_error_kills_hung_opencode_run_early|fatal_provider|type.*text|setsid|SIGTERM|SIGKILL' \
tests/test_sandboxed_verify.py
echo '== Dependency-review support probe =='
rg -n -C 18 --glob 'security-scan.yml' \
'dependency-review|curl|connect-timeout|max-time|http_code|curl_status|supported=true|Failing closed|/dev/null' \
.github/workflows/security-scan.yml
echo '== Dependency-review contract and partial-transfer regression =='
rg -n -C 14 \
'partial.transfer|partial_transfer|exit 18|supported=true|Failing closed|dependency.review|dependency-review' \
tests/test_required_workflow_queue_contract.py tests/test_dependency_review_support_probe.py
echo '== `#799` overlap/order documentation =='
rg -n -C 12 '799|overlap|order|merge' \
CHANGELOG.md docs/doctoring/opencode-process-group-termination.md
echo '== Exact-head quality workflow evidence =='
gh run view 31163524707 --repo "$repo" --json headSha,status,conclusion,jobs,url
gh run view 31163524707 --repo "$repo" --log 2>&1 | \
rg -n -i -C 2 \
'900 tests|6576/6576|2622/2622|100%|docstrings|coverage|bash -n|diff --check|passed|failed' \
|| true
echo '== Current exact-head workflow conclusions =='
gh api "repos/$repo/actions/runs?head_sha=$head_sha&per_page=100" --jq \
'.workflow_runs[] | [.id,.name,.event,.status,.conclusion] | `@tsv`'
echo '== Current unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 5) { nodes { author { login } body url } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes | map(select(.isResolved == false))'
echo '== Current PR merge and review state =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision,reviewsLength of output: 61676
Static result: no path-specific actionable finding. The diff changes eight paths:
The OpenCode cleanup boundary is correctly scoped.
The timeout fixture is deterministic.
The dependency-review support probe fails closed.
The incident documentation identifies The patch adds no credential permission, temporary writer, ref update, merge action, release action, or publishing action. Exact-head evidence status at inspection time
No files, refs, credentials, settings, protections, approvals, or merge state were modified.
|
|
@opencode-agent review Exact-current-head read-only review request for |
|
@opencode-agent @cwl-noema-review Retry the formal read-only review for exact current head |
|
@coderabbitai review |
|
|
@opencode-agent Review exact current head |
|
@opencode-agent Review exact current head |
|
@cwl-noema-review Review exact current head |
|
@opencode-agent Review-only request for exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='813'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
head_sha='1779da411ef2f4c2f20e05a3035f0ff1c43600e8'
echo '== Commit identity and boundary =='
printf 'checked_out='; git rev-parse HEAD
printf 'requested_head='; git rev-parse "$head_sha"
printf 'requested_base='; git rev-parse "$base_sha"
printf 'merge_base='; git merge-base "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
git diff --check "$base_sha" "$head_sha"
echo '== Exact patch =='
git diff --unified=55 "$base_sha" "$head_sha" -- \
.github/workflows/security-scan.yml \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_dependency_review_support_probe.py \
tests/test_required_workflow_queue_contract.py \
tests/test_sandboxed_verify.py \
docs/doctoring/dependency-review-support-probe.md \
docs/doctoring/opencode-process-group-termination.md \
CHANGELOG.md
echo '== Process-group implementation and regression context =='
rg -n -C 20 --glob 'run_opencode_review_model_pool.sh' \
'setsid|timeout --kill-after|opencode_pid|kill -TERM|kill -KILL|has_fatal_provider_error_event|wait|fatal|provider|type.*error' \
scripts/ci/run_opencode_review_model_pool.sh
rg -n -C 18 --glob 'test_sandboxed_verify.py' \
'TimeoutExpired|fatal_provider|process.group|setsid|SIGTERM|SIGKILL|timeout' \
tests/test_sandboxed_verify.py
echo '== Dependency-review probe and executable contract-test context =='
rg -n -C 24 \
'curl|curl_status|http_code|connect-timeout|max-time|/dev/null|supported=true|Failing closed|partial.transfer|partial_transfer|exit 18' \
.github/workflows/security-scan.yml \
tests/test_dependency_review_support_probe.py \
tests/test_required_workflow_queue_contract.py
echo '== Documentation scope/order context =='
rg -n -C 12 '799|overlap|order|partial.transfer|process.group|Linux man-pages' \
CHANGELOG.md \
docs/doctoring/dependency-review-support-probe.md \
docs/doctoring/opencode-process-group-termination.md
echo '== Static shell syntax =='
bash -n scripts/ci/run_opencode_review_model_pool.sh
echo '== Added sensitive, permission, reviewer, or writer-like operations =='
git diff --unified=0 "$base_sha" "$head_sha" | \
rg -n '^\+[^+].*(GITHUB_TOKEN|TOKEN|SECRET|credential|password|permissions:|reviewer|approval|git push|git commit|git update-ref|gh |upload|publish|merge|release|write)' \
|| true
echo '== Exact-head PR metadata and checks =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision,reviews,statusCheckRollup
echo '== Exact-head workflow runs =='
gh api "repos/$repo/actions/runs?head_sha=$head_sha&per_page=100" --jq \
'.workflow_runs[] | [.id,.name,.event,.status,.conclusion,.html_url] | `@tsv`'
echo '== Exact-head required-review log evidence =='
gh api "repos/$repo/actions/runs?head_sha=$head_sha&per_page=100" --jq \
'.workflow_runs[] | select(.name == "Required OpenCode Review" or .name == "Required Noema Review") | .id' |
while IFS= read -r run_id; do
test -n "$run_id" || continue
echo "-- run ${run_id} --"
gh run view "$run_id" --repo "$repo" --log 2>&1 | \
rg -n -i -C 2 '900 tests|coverage|6576/6576|2622/2622|docstrings|bash -n|diff --check|passed|failed' \
|| true
done
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 5) { nodes { author { login } body url } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes | map(select(.isResolved == false))'Length of output: 139175
Result: no path-specific actionable finding. The checked-out commit matches the requested head. The merge base matches the requested base. The diff changes eight paths.
The process-group boundary is correct.
The dependency-review support probe fails closed.
The deterministic timeout fixture remains sound. It injects The patch adds no credential expansion, permission change, temporary writer, ref update, reviewer change, approval change, merge action, release action, or publishing action. All exposed exact-head workflows completed successfully. This includes Security Scan, CodeQL PR, Python Security, SAST Semgrep, Secret Scan, OSV-Scanner PR, Scorecard PR, SBOM Generation, Strix Security Scan, Required OpenCode Review, and Required Noema Review. The exact-head No unresolved review thread exists. The accessible required-workflow logs did not contain the claimed numeric test count or explicit 100% statement coverage, branch coverage, and docstring percentages. Those numeric claims are therefore not independently confirmed from the accessible same-head logs. GitHub reports No files, refs, settings, credentials, approvals, or merge state were modified.
|
|
@cwl-noema-review @opencode-agent Review only the exact live head |
|
@opencode-agent review Final read-only exact-head review for |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='813'
head_sha='1779da411ef2f4c2f20e05a3035f0ff1c43600e8'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
echo '== Exact commit boundary =='
printf 'checked_out='; git rev-parse HEAD
printf 'requested_head='; git rev-parse "$head_sha"
printf 'requested_base='; git rev-parse "$base_sha"
printf 'merge_base='; git merge-base "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
git diff --check "$base_sha" "$head_sha"
echo '== Changed-file outlines =='
for file in \
.github/workflows/security-scan.yml \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_dependency_review_support_probe.py \
tests/test_required_workflow_queue_contract.py \
tests/test_sandboxed_verify.py \
docs/doctoring/dependency-review-support-probe.md \
docs/doctoring/opencode-process-group-termination.md \
CHANGELOG.md
do
echo "-- $file --"
ast-grep outline "$file" --items all 2>/dev/null || true
done
echo '== Complete exact-head patch =='
git diff --unified=65 "$base_sha" "$head_sha" -- \
.github/workflows/security-scan.yml \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_dependency_review_support_probe.py \
tests/test_required_workflow_queue_contract.py \
tests/test_sandboxed_verify.py \
docs/doctoring/dependency-review-support-probe.md \
docs/doctoring/opencode-process-group-termination.md \
CHANGELOG.md
echo '== Process-group source and test context =='
rg -n -C 22 --glob 'run_opencode_review_model_pool.sh' \
'setsid|timeout --kill-after|opencode_pid|kill -TERM|kill -KILL|has_fatal_provider_error_event|wait|fatal|provider|type.*error|pipe' \
scripts/ci/run_opencode_review_model_pool.sh
rg -n -C 18 --glob 'test_sandboxed_verify.py' \
'TimeoutExpired|fatal_provider|process.group|setsid|SIGTERM|SIGKILL|timeout' \
tests/test_sandboxed_verify.py
echo '== Dependency-review probe and regression context =='
rg -n -C 28 \
'curl|curl_status|http_code|connect-timeout|max-time|/dev/null|supported=true|Failing closed|partial.transfer|partial_transfer|exit 18' \
.github/workflows/security-scan.yml \
tests/test_dependency_review_support_probe.py \
tests/test_required_workflow_queue_contract.py
echo '== Documentation and permanent scope context =='
rg -n -C 16 '799|overlap|order|partial.transfer|process.group|Linux man-pages|rollback' \
CHANGELOG.md \
docs/doctoring/dependency-review-support-probe.md \
docs/doctoring/opencode-process-group-termination.md
echo '== Static shell syntax =='
bash -n scripts/ci/run_opencode_review_model_pool.sh
echo '== Added credential, reviewer, permission, writer, or release operations =='
git diff --unified=0 "$base_sha" "$head_sha" | \
rg -n '^\+[^+].*(GITHUB_TOKEN|TOKEN|SECRET|credential|password|permissions:|reviewer|approval|git push|git commit|git update-ref|gh |upload|publish|merge|release|write)' \
|| true
echo '== Exact-head PR state and checks =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision,reviews,statusCheckRollup
echo '== Exact-head workflow runs =='
gh api "repos/$repo/actions/runs?head_sha=$head_sha&per_page=100" --jq \
'.workflow_runs[] | [.id,.name,.event,.status,.conclusion,.html_url] | `@tsv`'
echo '== Exact-head quality check details =='
gh api "repos/$repo/commits/$head_sha/check-runs?per_page=100" --jq \
'.check_runs[] | select(.name | test("coverage|docstring|Required OpenCode Review|Required Noema Review"; "i")) | [.name,.status,.conclusion,.details_url,.output.title,.output.summary] | `@json`' \
|| true
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 5) {
nodes { author { login } body url }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes | map(select(.isResolved == false))'Length of output: 152470 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='813'
head_sha='1779da411ef2f4c2f20e05a3035f0ff1c43600e8'
quality_run='31163524707'
echo '== Exact-head workflow runs =='
gh api "repos/$repo/actions/runs?head_sha=$head_sha&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.event,.status,.conclusion,.html_url] | `@tsv`'
echo '== Exact-head quality checks =='
gh api "repos/$repo/commits/$head_sha/check-runs?per_page=100" \
--jq '.check_runs[] | select(.name | test("coverage|docstring|Required OpenCode Review|Required Noema Review"; "i")) | {name,status,conclusion,details_url,output}'
echo '== Required OpenCode Review jobs =='
gh run view "$quality_run" --repo "$repo" --json headSha,status,conclusion,url,jobs
echo '== Required OpenCode Review quality log excerpts =='
gh run view "$quality_run" --repo "$repo" --log 2>&1 | \
rg -n -i -C 3 \
'tests? passed|collected .* items|coverage|statement|branch|docstrings?|interrogate|100%|bash -n|diff --check|failed|error' \
|| true
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 5) {
nodes { author { login } body url }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes | map(select(.isResolved == false))'
echo '== Current PR head and review governance =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision,reviewsLength of output: 20680
Result: no path-specific actionable finding. The diff changes these eight paths:
The OpenCode process-group boundary is correct.
The dependency-review support probe fails closed.
The timeout fixture is deterministic. It injects All exposed exact-head security and supply-chain workflows completed successfully. This includes Security Scan, CodeQL PR, Python Security, SAST Semgrep, Secret Scan, OSV-Scanner PR, Scorecard PR, SBOM Generation, and Strix Security Scan. No unresolved review thread exists. The current GitHub reports No files, refs, settings, credentials, approvals, or merge state were modified.
|
|
@opencode-agent @cwl-noema-review Perform a fresh read-only formal review of exact current head @coderabbitai review |
|
@opencode-agent Review-only exact-head request for |
|
|
|
@opencode-agent @cwl-noema-review Read-only exact-current-head review request for |
|
/oc review Review exact current head |
|
@coderabbitai review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='813'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
head_sha='1779da411ef2f4c2f20e05a3035f0ff1c43600e8'
echo '== Exact commit and PR identity =='
printf 'checked_out='; git rev-parse HEAD
printf 'requested_head='; git rev-parse "$head_sha"
printf 'requested_base='; git rev-parse "$base_sha"
printf 'merge_base='; git merge-base "$base_sha" "$head_sha"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeable,mergeStateStatus,reviewDecision
echo '== Changed paths, whitespace, and scope =='
git diff --name-status "$base_sha" "$head_sha"
git diff --check "$base_sha" "$head_sha"
git diff --stat "$base_sha" "$head_sha"
echo '== Exact patch =='
git diff --unified=65 "$base_sha" "$head_sha" -- \
.github/workflows/security-scan.yml \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_dependency_review_support_probe.py \
tests/test_required_workflow_queue_contract.py \
tests/test_sandboxed_verify.py \
docs/doctoring/dependency-review-support-probe.md \
docs/doctoring/opencode-process-group-termination.md \
CHANGELOG.md
echo '== Process-group implementation =='
rg -n -C 24 --glob 'run_opencode_review_model_pool.sh' \
'setsid|timeout --kill-after|opencode_pid|kill -TERM|kill -KILL|has_fatal_provider_error_event|wait|fatal|provider|type.*error|pipe' \
scripts/ci/run_opencode_review_model_pool.sh
echo '== Regression test contexts =='
ast-grep outline tests/test_sandboxed_verify.py --items all 2>/dev/null || true
ast-grep outline tests/test_dependency_review_support_probe.py --items all 2>/dev/null || true
rg -n -C 20 \
'TimeoutExpired|fatal_provider|process.group|setsid|SIGTERM|SIGKILL|partial.transfer|partial_transfer|exit 18|supported=true|Failing closed' \
tests/test_sandboxed_verify.py \
tests/test_dependency_review_support_probe.py \
tests/test_required_workflow_queue_contract.py
echo '== Dependency-review workflow =='
rg -n -C 28 --glob 'security-scan.yml' \
'curl|curl_status|http_code|connect-timeout|max-time|/dev/null|supported=true|Failing closed|dependency-review' \
.github/workflows/security-scan.yml
echo '== Doctoring and changelog facts =='
rg -n -C 16 \
'Linux man-pages|2026|February|6\.18|Kerrisk|rollback|799|overlap|order|partial.transfer|process.group' \
CHANGELOG.md \
docs/doctoring/dependency-review-support-probe.md \
docs/doctoring/opencode-process-group-termination.md
echo '== Static shell syntax =='
bash -n scripts/ci/run_opencode_review_model_pool.sh
echo '== Added credentials, protections, reviews, writers, or publishing =='
git diff --unified=0 "$base_sha" "$head_sha" | \
rg -n '^\+[^+].*(GITHUB_TOKEN|TOKEN|SECRET|credential|password|permissions:|reviewer|approval|branch.protection|git push|git commit|git update-ref|gh |upload|publish|merge|release|write)' \
|| true
echo '== Exact-head workflow and check conclusions =='
gh api "repos/$repo/actions/runs?head_sha=$head_sha&per_page=100" --jq \
'.workflow_runs[] | [.id,.name,.event,.status,.conclusion,.head_sha,.html_url] | `@tsv`'
gh api "repos/$repo/commits/$head_sha/check-runs?per_page=100" --jq \
'.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`'
echo '== Exact-head quality check output metadata =='
gh api "repos/$repo/commits/$head_sha/check-runs?per_page=100" --jq \
'.check_runs[] | select(.name | test("coverage|docstring"; "i")) |
{name,status,conclusion,output:{title:.output.title,summary:.output.summary,text:.output.text}}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) {
nodes { author { login } body url }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes | map(select(.isResolved == false))'Length of output: 137699
Result: no path-specific actionable finding. The checked-out commit, PR head, and merge base match the requested commit boundary. The diff changes these eight paths:
The OpenCode cleanup uses a dedicated session for each attempt:
The deterministic timeout regression injects The dependency-review support probe fails closed:
The doctoring records describe the failure boundary, rollback constraints, and the partial-transfer condition. The The patch does not add reviewer changes, provider credential changes, branch-protection changes, ref writers, merge actions, publishing actions, or release actions. All exposed exact-head workflows completed successfully. This includes Security Scan, CodeQL PR, Python Security, SAST Semgrep, Secret Scan, OSV-Scanner PR, Scorecard PR, SBOM Generation, Strix Security Scan, Required OpenCode Review, and Required Noema Review. No unresolved review thread exists. The GitHub reports No files, refs, settings, credentials, reviews, or merge state were modified. You are interacting with an AI system. |
|
@coderabbitai review |
Rate Limit Exceeded
|
|
/oc Review exact current head |
|
@opencode-agent @cwl-noema-review Please independently review exact current head |
|
@opencode-agent review Formal read-only review of exact live head |
1 participant
Incident and buyer-visible impact
Central exact-head coverage for
.github#799reached the repository suite but stalled inside the bounded evidence step. The required review could not complete, leaving a security repair with otherwise successful exact-head scanners unapprovable.Exact current head
1779da411ef2f4c2f20e05a3035f0ff1c43600e8;e71fdab2ab088001f218765ecb5e3b7fabfee11a;Root causes and bounded repairs
Fatal-provider descendant leak
run_opencode_review_model_pool.shdetected a structured fatal provider event and killed only thetimeoutwrapper PID. A descendantopencodeprocess could survive with inherited stdout/stderr descriptors, leaving a captured-output caller waiting for EOF after the launcher returned.timeout … opencode runattempt in a dedicated session withsetsid.SIGTERM, wait for bounded disappearance, then useSIGKILLon the same group when required.timeout --kill-after=30sbehavior and every provider, egress, output, and evidence acceptance boundary.TimeoutExpiredcontract.Dependency-review contract drift
A fail-closed regression contract was already present in the branch, but the inherited workflow still converted unavailable responses into a successful support skip. Exact review then exposed a second boundary: suppressing curl's exit status could accept a failed partial transfer that still printed HTTP
200.200to emitsupported=true.000, malformed, empty, and every other non-200 result as a hard failure.curlexit18cannot be reclassified as support success.This fail-closed subset overlaps the broader exact-head scanner repair in #799. Merge this process-group prerequisite first; then refresh #799 against protected main, discard base-identical overlap from its effective diff, and rerun every exact-head quality, security, review, and approval gate. No evidence transfers across that base change.
Verification
The complete central source tree on the last independently reported exact implementation head recorded:
git diff --check: success.Those historical quality numbers are not treated as current-head acceptance by themselves. On exact current head
1779da411ef2f4c2f20e05a3035f0ff1c43600e8, the exposed GitHub pull-request gates succeeded:The branch-protection placeholder
Required OpenCode Reviewjobs only preserve stable required-check contexts and delegate authenticated source-tree/coverage/review execution; their green conclusions are not counted as proof of the current-head 900-test/100%-coverage/docstring claims. A formal exact-current-head OpenCode/Noema review with qualifying independent non-authorAPPROVEDevidence remains required. Predecessor-head, queued, cancelled, skipped-required, status-only, author-only, local-only, synthetic, or deterministic-fallback evidence is not accepted.Permanent scope
Exactly eight files:
.github/workflows/security-scan.yml;CHANGELOG.md;docs/doctoring/dependency-review-support-probe.md;docs/doctoring/opencode-process-group-termination.md;scripts/ci/run_opencode_review_model_pool.sh;tests/test_dependency_review_support_probe.py;tests/test_required_workflow_queue_contract.py;tests/test_sandboxed_verify.py.Merge and activation boundary
Keep this PR behind normal branch protection and exact-head independent review. After protected merge: