Skip to content

feat(integration): add versioned naruon rehearsal handoff - #737

Open
seonghobae wants to merge 59 commits into
developfrom
feat/naruon-rehearsal-handoff-v1
Open

feat(integration): add versioned naruon rehearsal handoff#737
seonghobae wants to merge 59 commits into
developfrom
feat/naruon-rehearsal-handoff-v1

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 3, 2026

Copy link
Copy Markdown
Collaborator

What

Add a dependency-free, fail-closed BandScope → naruon rehearsal handoff contract under @bandscope/shared-types/naruon.

The versioned artifact contributes:

  • a Band norm-group identity;
  • a rehearsal Event with RFC 3339 bounds and IANA time zone;
  • confirmed | tentative | desired commitment strength;
  • organizer/attendee RSVP direction;
  • calibrated confidence and field-level provenance receipts.

It includes canonical builders/parsers, deterministic JSON serialization, a public Draft 2020-12 JSON Schema, security/privacy integration guidance, and regression coverage.

Why

BandScope must remain a useful standalone local-first desktop app while also becoming a first-class vertical on naruon. A narrow, network-agnostic export contract closes the BandScope-owned producer side of #610 without granting naruon ambient filesystem, calendar, mail, database, model, or network authority.

Security notes

The parser rejects unknown keys, numeric-only IDs, malformed/invalid timestamps, invalid time zones, inconsistent band identities, unsupported commitment axes, non-finite confidence, sparse/oversized evidence, control characters, and oversized fields. It returns newly allocated nested values. Transport authentication, detached signatures, consent, context bridging, and writeback remain outside this data-only package.

Verification

  • TypeScript strict typecheck through the existing workspace lane
  • Vitest contract, boundary, canonicalization, serialization, and schema tests
  • Changed-file coverage and docstring gates
  • No new runtime dependency or network path

Advances #610. The remaining naruon-side importer and connector authorization path stay explicitly tracked there.

Summary by CodeRabbit

  • 새 기능

    • BandScope와 naruon 간 rehearsal handoff를 위한 버전 관리형 JSON 계약을 추가했습니다.
    • Band 정보, rehearsal 일정, commitment·RSVP 상태, 출처 및 증거 데이터를 일관된 형식으로 교환할 수 있습니다.
    • 데이터 생성, 검증, 정규화, 직렬화 및 역직렬화를 지원합니다.
    • 공개 JSON Schema와 엄격한 형식·날짜·시간대·크기 검증을 제공합니다.
  • 문서

    • 연동 규격, 호환성 규칙, 보안 및 권한 책임을 문서화했습니다.
    • BandScope의 독립적인 local-first 동작은 그대로 유지됩니다.

@coderabbitai

coderabbitai Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 48 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 83349d71-e63b-449e-9d62-de3415b19396

📥 Commits

Reviewing files that changed from the base of the PR and between 8813adc and 8014775.

📒 Files selected for processing (5)
  • docs/integrations/naruon.md
  • packages/shared-types/src/naruon.ts
  • packages/shared-types/test/naruon-hardening.test.ts
  • packages/shared-types/test/naruon-schema.test.ts
  • packages/shared-types/test/naruon.test.ts
📝 Walkthrough

Walkthrough

BandScope에 naruon rehearsal handoff v1 계약을 추가했습니다. 공개 타입, 엄격한 검증, canonical JSON 직렬화·역직렬화 API, JSON Schema, 문서 및 경계 조건 테스트를 포함합니다.

Changes

naruon rehearsal handoff

Layer / File(s) Summary
계약 및 공개 스키마
CHANGELOG.md, docs/integrations/naruon.md, docs/integrations/naruon-rehearsal-handoff-v1.schema.json
아티팩트 식별자, Band norm group, rehearsal Event, commitment, provenance 및 evidence 계약을 정의했습니다. JSON Schema와 호환성 규칙을 추가했습니다.
타입 및 입력 검증
packages/shared-types/src/naruon.ts, packages/shared-types/package.json, scripts/ci/bootstrap_naruon_boundary_hardening.py
공개 타입과 naruon 하위 export를 추가했습니다. 구조적 snapshot, 허용 키, 식별자, 문자열, RFC 3339 시간, IANA 시간대, 이벤트 순서, commitment, confidence 및 evidence를 검증합니다.
생성 및 직렬화 흐름
packages/shared-types/src/naruon.ts
입력을 canonical handoff로 변환합니다. 결정적 newline-terminated JSON을 생성하고 UTF-8 256 KiB 제한과 역직렬화 검증을 적용합니다.
계약 검증 테스트
packages/shared-types/test/naruon*.test.ts, packages/shared-types/vitest.config.ts
생성, 검증, 날짜·시간대, Proxy 입력, 배열·문자열·직렬화 크기, JSON Schema 및 100% coverage 조건을 테스트합니다.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant BandScope
  participant SharedTypes
  participant NaruonConnector
  BandScope->>SharedTypes: createNaruonRehearsalHandoff(input)
  SharedTypes-->>BandScope: canonical handoff
  BandScope->>SharedTypes: serializeNaruonRehearsalHandoff(handoff)
  SharedTypes-->>BandScope: JSON artifact
  BandScope->>NaruonConnector: handoff 전달
  NaruonConnector->>SharedTypes: deserializeNaruonRehearsalHandoff(JSON)
  SharedTypes-->>NaruonConnector: 검증된 handoff
Loading

Possibly related PRs

  • ContextualWisdomLab/bandscope#724: vitest.config.ts의 coverage threshold를 변경했으며, 본 PR은 src/naruon.ts에 파일별 100% coverage 조건을 추가합니다.

Suggested labels: codex, aardvark

Suggested reviewers: opencode-agent

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed 제목은 버전이 지정된 naruon rehearsal handoff 계약 추가라는 PR의 주요 변경 사항을 명확하고 간결하게 설명합니다.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/naruon-rehearsal-handoff-v1

Comment @coderabbitai help to get the list of available commands.

@seonghobae
seonghobae enabled auto-merge (squash) August 3, 2026 03:10

Copy link
Copy Markdown
Collaborator Author

Maintainer hardening pass applied on the current branch:

  • snapshots parser inputs before validation/canonicalization to close accessor/proxy TOCTOU;
  • rejects UTF-8 JSON payloads above 256 KiB before parsing;
  • bounds evidence arrays before index traversal;
  • rejects numeric offsets inconsistent with the required IANA zone at the represented instant, while retaining RFC 9557 Z/-00:00 unknown-local-offset semantics;
  • adds DST, hostile-object, oversized-input, calendar-boundary, and branch-completeness regressions;
  • enforces 100% line/function/branch/statement coverage for src/naruon.ts.

Independent local verification on Node 22 / TypeScript strict ES2022: 73 contract tests passed; src/naruon.ts reached 100% lines, branches, and functions; documentation audit found 36/36 declarations documented. @coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

@seonghobae I will review the current branch, including the parser hardening, time-zone offset handling, size limits, and regression coverage.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (4)
docs/integrations/naruon.md (1)

104-110: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

TypeScript 파서가 권위를 가지는 항목에 공백 정규화(trim) 규칙을 추가하세요.

isDisplayTextvalue === value.trim()을 요구합니다. 공개 JSON Schema의 displayTextopaqueIdentifier 패턴은 이 규칙을 표현하지 않습니다. 따라서 스키마만 사용하는 커넥터는 " Studio A "를 통과시키고, BandScope 파서는 같은 값을 거부합니다. 이 차이를 line 110 목록에 명시하세요.

📝 제안 수정
-- The JSON Schema companion is `naruon-rehearsal-handoff-v1.schema.json`; the TypeScript parser remains authoritative for payload-size, snapshot, cross-field, RFC 9557 offset/time-zone consistency, and IANA time-zone checks.
+- The JSON Schema companion is `naruon-rehearsal-handoff-v1.schema.json`; the TypeScript parser remains authoritative for payload-size, snapshot, cross-field, leading/trailing whitespace, RFC 9557 offset/time-zone consistency, and IANA time-zone checks.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/integrations/naruon.md` around lines 104 - 110, Update the compatibility
statement’s TypeScript-authoritative validation list to explicitly include
whitespace normalization/trim rules enforced by isDisplayText, covering
displayText and opaqueIdentifier values that must equal their trimmed form.
packages/shared-types/test/naruon-schema.test.ts (1)

40-40: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

리터럴 64 대신 MAX_NARUON_EVIDENCE_RECEIPTS를 사용하세요.

이 테스트의 목적은 스키마와 런타임 상수의 정합성 확인입니다. artifactKindartifactVersion은 상수와 비교하지만, maxItems만 리터럴과 비교합니다. 상수가 바뀌면 이 검사는 드리프트를 잡지 못합니다.

♻️ 제안 수정
-    expect(schema.properties.provenance.properties.evidence.maxItems).toBe(64);
+    expect(schema.properties.provenance.properties.evidence.maxItems).toBe(
+      MAX_NARUON_EVIDENCE_RECEIPTS
+    );

임포트도 함께 수정하세요.

 import {
+  MAX_NARUON_EVIDENCE_RECEIPTS,
   NARUON_REHEARSAL_HANDOFF_KIND,
   NARUON_REHEARSAL_HANDOFF_VERSION
 } from "../src/naruon";
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/shared-types/test/naruon-schema.test.ts` at line 40, Update the
maxItems assertion in the schema test to compare against
MAX_NARUON_EVIDENCE_RECEIPTS instead of the literal 64, and add or adjust the
import for that runtime constant. Preserve the test’s existing schema path and
assertion behavior.
packages/shared-types/src/naruon.ts (1)

160-162: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

isOneOftypeof 검사는 도달 불가능한 분기를 만듭니다.

values.includes(value as T)는 이미 엄격 비교를 수행합니다. 따라서 typeof value === "string" 검사는 결과를 바꾸지 않습니다. 현재 테스트는 commitment.statuscommitment.rsvpDirection에 문자열 값만 주입하므로, 이 검사의 false 경로는 실행되지 않습니다. packages/shared-types/vitest.config.ts는 이 파일에 branches 100% 임계값을 설정합니다. 같은 문제가 line 119의 length < 0 조건에도 있습니다. 배열 길이는 음수가 될 수 없고, proxy 테스트는 Number.MAX_SAFE_INTEGER + 1만 위조합니다.

중복 검사를 제거하거나, 비문자열 status와 음수 length에 대한 테스트를 추가하세요.

♻️ 제안 수정
 function isOneOf<T extends string>(values: readonly T[], value: unknown): value is T {
-  return typeof value === "string" && values.includes(value as T);
+  return values.includes(value as T);
 }

커버리지 게이트가 실제로 통과하는지 CI 로그에서 확인하세요.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/shared-types/src/naruon.ts` around lines 160 - 162, Update isOneOf
to remove the redundant typeof value check and rely on values.includes for
membership validation. Also address the unreachable length < 0 branch near line
119 by removing it or adding coverage for the intended behavior, then verify the
shared-types coverage gate passes in CI.
docs/integrations/naruon-rehearsal-handoff-v1.schema.json (1)

139-144: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

공개 스키마의 숫자 전용 ID 제약을 명확히 문서화하세요.

JSON Schema의 pattern은 정규식 플래그를 정의하지 않습니다. 따라서 \p{Nd}를 지원하지 않거나 u 플래그 없이 컴파일하는 검증기는 이 패턴을 거부하거나 숫자 전용 값을 허용할 수 있습니다. docs/integrations/naruon.md에 유니코드 정규식 지원과 TypeScript parser 검증 의무를 명시하거나, 이 검사를 parser 전용 규칙으로 분리하세요.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/integrations/naruon-rehearsal-handoff-v1.schema.json` around lines 139 -
144, 문서화된 공개 스키마의 opaqueIdentifier 숫자 전용 제한이 검증기별로 다르게 동작할 수 있으므로,
docs/integrations/naruon.md에 \p{Nd} 지원 및 TypeScript parser 검증 의무를 명시하세요. 또는
schema의 pattern에서 해당 검사를 제거하고 parser 전용 규칙으로 분리하되, 숫자로만 구성된 유니코드 ID가 거부되는 동작은
유지하세요.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/shared-types/src/naruon.ts`:
- Around line 384-412: Update canonicalizeSnapshot to construct source,
normGroup, event, commitment, provenance, and each evidence object with explicit
canonical field order instead of spreading caller-provided objects; preserve the
existing omission of event.venue when undefined. Ensure
serializeNaruonRehearsalHandoff produces identical JSON bytes for inputs whose
keys differ only in insertion order, and add a naruon.test.ts case covering
reversed key order.

---

Nitpick comments:
In `@docs/integrations/naruon-rehearsal-handoff-v1.schema.json`:
- Around line 139-144: 문서화된 공개 스키마의 opaqueIdentifier 숫자 전용 제한이 검증기별로 다르게 동작할 수
있으므로, docs/integrations/naruon.md에 \p{Nd} 지원 및 TypeScript parser 검증 의무를 명시하세요.
또는 schema의 pattern에서 해당 검사를 제거하고 parser 전용 규칙으로 분리하되, 숫자로만 구성된 유니코드 ID가 거부되는 동작은
유지하세요.

In `@docs/integrations/naruon.md`:
- Around line 104-110: Update the compatibility statement’s
TypeScript-authoritative validation list to explicitly include whitespace
normalization/trim rules enforced by isDisplayText, covering displayText and
opaqueIdentifier values that must equal their trimmed form.

In `@packages/shared-types/src/naruon.ts`:
- Around line 160-162: Update isOneOf to remove the redundant typeof value check
and rely on values.includes for membership validation. Also address the
unreachable length < 0 branch near line 119 by removing it or adding coverage
for the intended behavior, then verify the shared-types coverage gate passes in
CI.

In `@packages/shared-types/test/naruon-schema.test.ts`:
- Line 40: Update the maxItems assertion in the schema test to compare against
MAX_NARUON_EVIDENCE_RECEIPTS instead of the literal 64, and add or adjust the
import for that runtime constant. Preserve the test’s existing schema path and
assertion behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f81bb23e-0f22-49a8-bb0d-b39ecd7b24af

📥 Commits

Reviewing files that changed from the base of the PR and between acdbea6 and d8e12d3.

📒 Files selected for processing (10)
  • CHANGELOG.md
  • docs/integrations/naruon-rehearsal-handoff-v1.schema.json
  • docs/integrations/naruon.md
  • packages/shared-types/package.json
  • packages/shared-types/src/naruon.ts
  • packages/shared-types/test/naruon-calendar.test.ts
  • packages/shared-types/test/naruon-hardening.test.ts
  • packages/shared-types/test/naruon-schema.test.ts
  • packages/shared-types/test/naruon.test.ts
  • packages/shared-types/vitest.config.ts

Comment thread packages/shared-types/src/naruon.ts

Copy link
Copy Markdown
Collaborator Author

@coderabbitai autofix

@coderabbitai

coderabbitai Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Fixes Applied Successfully

Fixed 2 file(s) based on 1 unresolved review comment.

Files modified:

  • packages/shared-types/src/naruon.ts
  • packages/shared-types/test/naruon.test.ts

Commit: fd4ea22bd4d13efb35e887381a4f518f4b8942ea

The changes have been pushed to the feat/naruon-rehearsal-handoff-v1 branch.

Time taken: 3m 15s

coderabbitai Bot and others added 2 commits August 3, 2026 04:10
Fixed 2 file(s) based on 1 unresolved review comment.

Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 80147750f5d9c2a40c866f3f32ce5cb54b8b6472.

  • Head SHA: 80147750f5d9c2a40c866f3f32ce5cb54b8b6472

  • Workflow run: 30841712934

  • Workflow attempt: 1

Coverage evidence

Coverage Decision

  • Result: FAIL
  • Test evidence: not proven passing
  • Docstring evidence: not proven passing when configured
  • Failure count: 3

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (8 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (8 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (2 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (2 files)"]
  R2 --> V2["docs review"]
Loading

@opencode-agent

opencode-agent Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

OpenCode Review Overview

  • Head SHA: 80147750f5d9c2a40c866f3f32ce5cb54b8b6472
  • Workflow run: 30946269175
  • Workflow attempt: 1
  • Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 80147750f5d9c2a40c866f3f32ce5cb54b8b6472.

  • Head SHA: 80147750f5d9c2a40c866f3f32ce5cb54b8b6472

  • Workflow run: 30946269175

  • Workflow attempt: 1

Coverage evidence

Coverage Decision

  • Result: FAIL
  • Test evidence: not proven passing
  • Docstring evidence: not proven passing when configured
  • Failure count: 3

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (8 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (8 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (2 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (2 files)"]
  R2 --> V2["docs review"]
Loading

@opencode-agent
opencode-agent Bot disabled auto-merge August 3, 2026 20:14
@seonghobae
seonghobae enabled auto-merge (squash) August 4, 2026 03:32
@opencode-agent
opencode-agent Bot disabled auto-merge August 4, 2026 04:38
@seonghobae
seonghobae enabled auto-merge (squash) August 4, 2026 06:16
@opencode-agent
opencode-agent Bot disabled auto-merge August 4, 2026 07:20
@seonghobae
seonghobae dismissed opencode-agent[bot]’s stale review August 4, 2026 11:01

Dismissed because the only blocker was the superseded central coverage environment. All repository-owned checks succeeded on this exact head and no review threads remain unresolved; a new independent exact-head approval is still required.

@seonghobae
seonghobae enabled auto-merge (squash) August 4, 2026 11:02

Copy link
Copy Markdown
Collaborator Author

@cwl-noema-review @opencode-agent Please independently review exact head 80147750f5d9c2a40c866f3f32ce5cb54b8b6472. Exact-head repository checks succeeded and no review thread remains unresolved. Verify deterministic canonical serialization, snapshot/fail-closed hostile-input handling, RFC 9557 time-zone consistency, schema/runtime boundaries, 100% shared-types coverage, and narrow naruon authority; approve only if no blocker remains.

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 10 minutes and 23 seconds before sending another message.

Copy link
Copy Markdown
Collaborator Author

@opencode-agent @cwl-noema-review Please independently review exact current head 80147750f5d9c2a40c866f3f32ce5cb54b8b6472. All nine repository-local workflows succeed and every inline thread is resolved. Verify the dependency-free BandScope→naruon v1 contract, explicit canonical nested field ordering and byte-deterministic serialization, strict unknown-key/control/trim/Unicode numeric-only-ID boundaries, hostile accessor/proxy snapshot handling, redacted JSON errors, RFC 3339/RFC 9557 and IANA-zone consistency, confidence/evidence bounds, fresh nested allocations, public Draft 2020-12 schema parity and documented parser-authoritative gaps, 100% shared-types statement/branch coverage, and absence of transport/filesystem/network/model authority. Submit APPROVE only if no blocker remains.

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

expected='80147750f5d9c2a40c866f3f32ce5cb54b8b6472'
actual="$(git rev-parse HEAD)"
printf 'HEAD=%s\nEXPECTED=%s\n' "$actual" "$expected"
git status --short
git diff-tree --no-commit-id --name-status -r "$expected"

printf '\n== naruon source outline ==\n'
ast-grep outline packages/shared-types/src/naruon.ts --items all --view expanded
printf '\n== naruon source, 1-560 ==\n'
sed -n '1,560p' packages/shared-types/src/naruon.ts

printf '\n== package export and coverage configuration ==\n'
cat packages/shared-types/package.json
printf '\n-- vitest --\n'
cat packages/shared-types/vitest.config.ts

printf '\n== schema ==\n'
cat docs/integrations/naruon-rehearsal-handoff-v1.schema.json
printf '\n== integration documentation ==\n'
cat docs/integrations/naruon.md

printf '\n== test outlines ==\n'
ast-grep outline packages/shared-types/test/naruon.test.ts --items all --view expanded
ast-grep outline packages/shared-types/test/naruon-hardening.test.ts --items all --view expanded
ast-grep outline packages/shared-types/test/naruon-schema.test.ts --items all --view expanded
ast-grep outline packages/shared-types/test/naruon-calendar.test.ts --items all --view expanded

printf '\n== authority-bearing imports/usages in changed implementation/docs/scripts ==\n'
rg -n -i -C2 '\b(fetch|axios|http|https|net|tls|dns|child_process|spawn|exec|fs|node:fs|database|sqlite|postgres|openai|anthropic)\b' \
  packages/shared-types/src/naruon.ts packages/shared-types/package.json docs/integrations/naruon.md \
  scripts/ci/bootstrap_naruon_boundary_hardening.py || true

printf '\n== workflow and package scripts references ==\n'
rg -n -C2 'naruon|shared-types|coverage|vitest|typecheck' \
  .github packages/shared-types/package.json package.json 2>/dev/null || true

Length of output: 39186


🏁 Script executed:

#!/bin/bash
set -euo pipefail

commit='80147750f5d9c2a40c866f3f32ce5cb54b8b6472'

printf '%s\n' '== exact commit metadata and patch =='
git show --no-ext-diff --format=fuller --stat "$commit"
git diff --no-ext-diff "${commit}^" "$commit" -- \
  packages/shared-types/src/naruon.ts \
  packages/shared-types/test/naruon.test.ts \
  packages/shared-types/test/naruon-hardening.test.ts \
  packages/shared-types/test/naruon-schema.test.ts \
  packages/shared-types/test/naruon-calendar.test.ts \
  packages/shared-types/vitest.config.ts \
  packages/shared-types/package.json \
  docs/integrations/naruon-rehearsal-handoff-v1.schema.json \
  docs/integrations/naruon.md

printf '%s\n' '== uncommitted documentation delta =='
git diff --no-ext-diff -- docs/integrations/naruon.md

printf '%s\n' '== complete contract tests =='
for f in \
  packages/shared-types/test/naruon.test.ts \
  packages/shared-types/test/naruon-hardening.test.ts \
  packages/shared-types/test/naruon-schema.test.ts \
  packages/shared-types/test/naruon-calendar.test.ts
do
  printf '\n--- %s ---\n' "$f"
  cat "$f"
done

printf '%s\n' '== test case inventory =='
rg -n -C1 '\b(it|test|describe)\s*\(' \
  packages/shared-types/test/naruon.test.ts \
  packages/shared-types/test/naruon-hardening.test.ts \
  packages/shared-types/test/naruon-schema.test.ts \
  packages/shared-types/test/naruon-calendar.test.ts

printf '%s\n' '== workflow files and relevant configuration =='
fd -t f .github 2>/dev/null | sort
rg -n -i -C2 'shared-types|vitest|coverage|typecheck|naruon' .github package.json \
  --glob '*.yml' --glob '*.yaml' --glob '*.json' 2>/dev/null || true

printf '%s\n' '== implementation imports and direct authority APIs =='
ast-grep run --pattern 'import $$$ from $SOURCE' --lang typescript packages/shared-types/src/naruon.ts
rg -n -P '\b(?:fetch|WebSocket|XMLHttpRequest|Deno\.|Bun\.|process\.|require\s*\(|import\s*\(|readFile|writeFile|connect|listen|spawn|exec)\b' \
  packages/shared-types/src/naruon.ts || true

Length of output: 43031


🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='80147750f5d9c2a40c866f3f32ce5cb54b8b6472'
base="$(git merge-base "$head" origin/main 2>/dev/null || git merge-base "$head" main 2>/dev/null || true)"

printf 'HEAD=%s\nMERGE_BASE=%s\n' "$head" "$base"
printf '\n== staged worktree delta ==\n'
git diff --cached --no-ext-diff -- docs/integrations/naruon.md
printf '\n== complete worktree status ==\n'
git status --short

if [ -n "$base" ]; then
  printf '\n== cumulative PR changed files ==\n'
  git diff --name-status "$base" "$head"
  printf '\n== shared-types dependency changes ==\n'
  git diff --no-ext-diff "$base" "$head" -- packages/shared-types/package.json
  printf '\n== authority indicators across cumulative TypeScript implementation ==\n'
  rg -n -i -C1 '\b(fetch|axios|http|https|websocket|net|tls|dns|node:fs|node:child_process|readfile|writefile|spawn|exec|sqlite|postgres|openai|anthropic)\b' \
    packages/shared-types/src packages/shared-types/package.json || true
  printf '\n== public package surface ==\n'
  git diff --no-ext-diff "$base" "$head" -- packages/shared-types/package.json packages/shared-types/src/index.ts
fi

printf '\n== test configuration assertions ==\n'
rg -n -C2 '"src/naruon.ts"|thresholds|include' packages/shared-types/vitest.config.ts
printf '\n== documentation of parser-authoritative schema gaps ==\n'
rg -n -C2 'authoritative|payload-size|snapshot|cross-field|RFC 9557|IANA' docs/integrations/naruon.md

Length of output: 3982


@seonghobae Approved.

I verified the requested 80147750f5d9c2a40c866f3f32ce5cb54b8b6472 head during review. I found no blocker.

  • Canonical construction fixes root and nested property order. Serialization is byte-deterministic for equivalent valid inputs.
  • The parser snapshots input before validation and canonicalization. It fails closed for uncloneable proxy inputs. Canonical output uses newly allocated nested objects and evidence receipts.
  • Validation rejects unknown keys, control characters, padded or numeric-only identifiers, invalid timestamps, invalid IANA zones, inconsistent numeric offsets, invalid commitment values, invalid confidence, and invalid evidence arrays.
  • Deserialization applies the 256 KiB UTF-8 limit before JSON.parse. Malformed JSON errors do not include untrusted payload fragments.
  • The Draft 2020-12 schema matches the public structural boundary. The documentation identifies runtime-only checks as parser-authoritative.
  • packages/shared-types/src/naruon.ts has no static filesystem, network, database, transport, child-process, or model authority surface.
  • The coverage configuration requires 100% statement, branch, function, and line coverage for src/naruon.ts.

I could not execute repository workflows in this sandbox. The inspected test suite and coverage gate are consistent with the reported successful verification.

[approve]

You are interacting with an AI system.

@seonghobae
seonghobae marked this pull request as draft August 4, 2026 12:45
auto-merge was automatically disabled August 4, 2026 12:45

Pull request was converted to draft

@seonghobae
seonghobae marked this pull request as ready for review August 4, 2026 12:45

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 80147750f5d9c2a40c866f3f32ce5cb54b8b6472.

  • Head SHA: 80147750f5d9c2a40c866f3f32ce5cb54b8b6472

  • Workflow run: 30946269175

  • Workflow attempt: 1

Coverage evidence

Coverage Decision

  • Result: FAIL
  • Test evidence: not proven passing
  • Docstring evidence: not proven passing when configured
  • Failure count: 3

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (8 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (8 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (2 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (2 files)"]
  R2 --> V2["docs review"]
Loading

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

Please review exact current head 80147750f5d9c2a40c866f3f32ce5cb54b8b6472. All repository workflows succeeded and the earlier inline findings are resolved. Focus on deterministic canonical serialization, safe snapshot validation, bounded parser diagnostics, identifier and text constraints, timestamp/time-zone consistency, nested JSON Schema closure, and the absence of temporary repair automation.

@opencode-agent Please rerun exact-head review after the central npm-workspace coverage materializer is integrated; do not reuse prior incomplete coverage evidence.

@cwl-noema-review Please independently review this exact head and the standalone/local-first versus naruon-module authority boundary. Merge remains subject to protected current-head checks and qualifying non-author approval.

@seonghobae
seonghobae enabled auto-merge (squash) August 5, 2026 12:05
@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

expected='80147750f5d9c2a40c866f3f32ce5cb54b8b6472'
actual="$(git rev-parse HEAD)"
printf 'HEAD=%s\nEXPECTED=%s\n' "$actual" "$expected"
git status --short
git diff --check "${expected}^" "$expected"
printf '\n== cumulative changed files ==\n'
base="$(git merge-base "$expected" origin/main 2>/dev/null || git merge-base "$expected" main 2>/dev/null || true)"
if [ -n "$base" ]; then
  git diff --name-status "$base" "$expected"
fi

printf '\n== source outline ==\n'
ast-grep outline packages/shared-types/src/naruon.ts --items all --view expanded
printf '\n== source ==\n'
cat -n packages/shared-types/src/naruon.ts

printf '\n== package and coverage configuration ==\n'
cat -n packages/shared-types/package.json
cat -n packages/shared-types/vitest.config.ts

printf '\n== schema and documentation ==\n'
cat -n docs/integrations/naruon-rehearsal-handoff-v1.schema.json
cat -n docs/integrations/naruon.md

printf '\n== Naruon test inventories ==\n'
for f in \
  packages/shared-types/test/naruon.test.ts \
  packages/shared-types/test/naruon-hardening.test.ts \
  packages/shared-types/test/naruon-schema.test.ts \
  packages/shared-types/test/naruon-calendar.test.ts
do
  printf '\n--- %s ---\n' "$f"
  rg -n -C2 '\b(?:describe|it|test)\s*\(' "$f" || true
done

printf '\n== temporary automation and authority indicators in cumulative change ==\n'
if [ -n "$base" ]; then
  git diff --name-only "$base" "$expected" | rg -n '(bootstrap|repair|autofix|temporary|\.py$)' || true
fi
rg -n -i -C2 '\b(fetch|axios|http|https|websocket|node:fs|node:child_process|readFile|writeFile|spawn|exec|connect|listen|sqlite|postgres|openai|anthropic)\b' \
  packages/shared-types/src/naruon.ts packages/shared-types/package.json docs/integrations/naruon.md || true

printf '\n== current PR checks and review state ==\n'
gh pr view 737 --repo ContextualWisdomLab/bandscope \
  --json headRefOid,statusCheckRollup,reviews,reviewThreads \
  --jq '{headRefOid, checks: [.statusCheckRollup[] | {name, conclusion, status}], reviews: [.reviews[] | {author: .author.login, state}], unresolvedThreads: ([.reviewThreads[] | select(.isResolved == false)] | length)}'

Length of output: 48593


🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='80147750f5d9c2a40c866f3f32ce5cb54b8b6472'
repo='ContextualWisdomLab/bandscope'

printf '%s\n' '== commit parents and cumulative file list =='
git show --no-patch --format='commit=%H%nparents=%P%nsubject=%s' "$head"
base="$(git merge-base "$head" origin/main 2>/dev/null || git merge-base "$head" main 2>/dev/null || true)"
printf 'merge_base=%s\n' "$base"
if [ -n "$base" ]; then
  git diff --name-status "$base" "$head"
else
  git show --format='' --name-status "$head"
fi

printf '%s\n' '== temporary repair automation at exact head =='
git ls-tree -r --name-only "$head" | rg -i '(bootstrap.*naruon|naruon.*bootstrap|repair|autofix|temporary)' || true
git show --format='' --name-only "$head" | rg -i '\.py$|bootstrap|repair|autofix|temporary' || true

printf '%s\n' '== complete hardening tests =='
cat -n packages/shared-types/test/naruon-hardening.test.ts
printf '%s\n' '== serialization and parser tests =='
sed -n '60,150p' packages/shared-types/test/naruon.test.ts | cat -n
printf '%s\n' '== schema test loader and closure assertions =='
sed -n '1,130p' packages/shared-types/test/naruon-schema.test.ts | cat -n

printf '%s\n' '== GitHub checks and review decision =='
gh pr view 737 --repo "$repo" \
  --json headRefOid,reviewDecision,reviews,statusCheckRollup \
  --jq '{headRefOid, reviewDecision, checks: [.statusCheckRollup[] | {name, conclusion, status}], reviews: [.reviews[] | {author: .author.login, state}]}'

printf '%s\n' '== unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='bandscope' -F number=737 -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          isResolved
          isOutdated
          comments(first: 1) { nodes { author { login } body path line } }
        }
      }
    }
  }
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {isOutdated, comment: .comments.nodes[0]}]'

Length of output: 25057


@seonghobae Approved for commit 80147750f5d9c2a40c866f3f32ce5cb54b8b6472. I found no blocker.

  • Canonical construction uses explicit root and nested key order. Serialization is deterministic for equivalent inputs.
  • The parser snapshots input before validation and canonicalization. It fails closed when the input cannot be cloned. Canonical output has fresh nested objects and evidence receipts.
  • The parser rejects oversized serialized input before JSON.parse. Malformed JSON errors do not include untrusted content.
  • Runtime validation enforces closed keys, text and identifier constraints, RFC 3339 calendar validity, IANA zone validity, numeric offset consistency, confidence bounds, and dense bounded evidence.
  • The Draft 2020-12 schema closes all object levels. The documentation identifies the runtime-only parser checks.
  • No temporary repair or bootstrap automation remains at the reviewed head.
  • The Naruon module has no static transport, filesystem, database, child-process, or model authority.
  • The coverage configuration requires 100% statement, branch, function, and line coverage for packages/shared-types/src/naruon.ts.
  • The reported GitHub checks succeeded for this exact head. There are no unresolved review threads.

[approve]

You are interacting with an AI system.

@opencode-agent
opencode-agent Bot disabled auto-merge August 5, 2026 13:24

Copy link
Copy Markdown
Collaborator Author

@opencode-agent @cwl-noema-review Please independently re-review exact current head 80147750f5d9c2a40c866f3f32ce5cb54b8b6472. All repository-local CI, build, release, npm/Python/Rust security audit, Bandit, Semgrep, Security Scan, secret scan, and SBOM workflows succeeded on this SHA; all inline findings are resolved or outdated. The remaining central coverage failure is the npm-workspace lock-owner prerequisite tracked in ContextualWisdomLab/.github#748.

@seonghobae
seonghobae enabled auto-merge (squash) August 6, 2026 08:53
@opencode-agent
opencode-agent Bot disabled auto-merge August 6, 2026 10:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant