feat(operations): separate liveness and readiness probes - #265
feat(operations): separate liveness and readiness probes#265seonghobae wants to merge 2 commits into
Conversation
📝 WalkthroughWalkthrough
Changes가용성 프로브 계약과 구현
Maven verify 품질 게이트
경계 조건 회귀 테스트
공개 API 문서와 기본 생성자
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant ProbeClient
participant HealthController
participant ApplicationAvailability
ProbeClient->>HealthController: GET /healthz 또는 /readyz
HealthController->>ApplicationAvailability: 가용성 상태 조회
ApplicationAvailability-->>HealthController: LivenessState 또는 ReadinessState
HealthController-->>ProbeClient: 200/503 응답과 no-store 캐시 정책
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent @cwl-noema-review Please independently inspect exact current head |
|
@coderabbitai review Review exact current head |
|
I will treat CI, Security Scan, SAST, and all three fuzz jobs as required evidence. I will report unresolved blockers. I will not approve or recommend merge unless every required exact-head check succeeds.
|
|
@opencode-agent Implement the remaining warning-free public Javadoc slice on exact current head |
|
@opencode-agent Exact current head is |
|
@opencode-agent Exact head advanced to |
|
@coderabbitai review Review exact current head |
|
@opencode-agent @cwl-noema-review Independently review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='e35092718af8e5ae7c8657ea037683b87b379315'
echo '== Checked-out commit =='
git rev-parse HEAD
echo "Expected: $expected"
git status --short
echo '== PR metadata and exact-head checks =='
gh pr view 265 --repo ContextualWisdomLab/clearfolio --json number,headRefOid,isDraft,reviewDecision,statusCheckRollup,comments,reviews \
--jq '{number,isDraft,headRefOid,reviewDecision,statusCheckRollup:[.statusCheckRollup[]|{name,conclusion,status,detailsUrl}],reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],comments:[.comments[]|{author:.author.login,body,url}]}'
echo '== Files likely to implement or document the contract =='
fd -t f . | rg '(^|/)(HealthController|.*Availability.*|.*Health.*Test|.*Read.*Test|pom\.xml|README\.md|CHANGELOG\.md|.*ADR.*|.*adr.*|.*architecture.*)\.(java|md|xml)$|(^|/)pom\.xml$' || true
echo '== Java outlines =='
fd -t f -e java . | xargs -r ast-grep outline --items all --type class,interface,enum,method --match 'Health|Readiness|Liveness|Availability' || true
echo '== Availability implementation and test references =='
rg -n -C 4 --glob '*.java' '(ApplicationAvailability|LivenessState|ReadinessState|healthz|readyz|Cache-Control|no-store)' .
echo '== Maven verification and Javadoc/JaCoCo configuration =='
rg -n -C 5 --glob 'pom.xml' '(jacoco|javadoc|doclint|failOnWarnings|verify|check)' .
echo '== Documentation references =='
rg -n -C 3 --glob '*.md' '(healthz|readyz|startupProbe|livenessProbe|readinessProbe|ApplicationAvailability|Spring Boot 3\.5\.16|APA|Kubernetes)' .Length of output: 80230 🤖 web_search executed:
Length of output: 5937 🤖 web_search executed:
Length of output: 15219 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Probe controller, tests, and authorization rules =='
sed -n '1,130p' src/main/java/com/clearfolio/viewer/controller/HealthController.java
sed -n '1,125p' src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java
rg -n -C 6 --glob '*.java' '(pathMatchers|authorizeExchange|healthz|readyz|SecurityWebFilterChain|permitAll|authenticated)' src/main/java src/test/java
echo '== Complete JaCoCo and Javadoc verification configuration =='
sed -n '190,270p' pom.xml
rg -n -C 5 --glob '*.{yml,yaml}' '(mvn .*verify|Maven verify|jacoco|javadoc|fuzz|Semgrep|Security|CodeQL|strix)' .github . 2>/dev/null || true
echo '== ADR decision, Kubernetes configuration, and references =='
sed -n '1,155p' docs/operations/2026-08-05-availability-probes.md
echo '== Stale security documentation context =='
sed -n '24,42p' docs/security/2026-07-02-threat-model-data-handling.md
echo '== Changed files relative to main =='
git diff --name-status origin/main...HEAD
echo '== Exact-head check refresh =='
gh pr view 265 --repo ContextualWisdomLab/clearfolio --json headRefOid,statusCheckRollup,reviews \
--jq '{headRefOid, reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}], checks:[.statusCheckRollup[]|select(.name != null)|{name,status,conclusion,detailsUrl}]}'
echo '== Required branch protection rules =='
gh api repos/ContextualWisdomLab/clearfolio/branches/main/protection --jq '{required_status_checks,required_pull_request_reviews,required_conversation_resolution}' 2>&1 || trueLength of output: 46287
The controller implementation, executable state coverage, controlled response labels, You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
expected="e35092718af8e5ae7c8657ea037683b87b379315"
echo "== Revision identity =="
printf 'checked_out='; git rev-parse HEAD
printf 'expected='; printf '%s\n' "$expected"
git status --short
echo
echo "== Pull request exact-head metadata and check results =="
gh pr view 265 --repo "$repo" \
--json number,headRefOid,isDraft,reviewDecision,statusCheckRollup,reviews \
--jq '{
number, isDraft, headRefOid, reviewDecision,
checks: [.statusCheckRollup[] | {name, status, conclusion, detailsUrl}],
reviews: [.reviews[] | {author: .author.login, state, commit: .commit.oid}]
}'
echo
echo "== Availability controller and executable tests =="
controller=$(fd -t f -e java 'HealthController.java' src | head -n1)
testfile=$(fd -t f -e java 'HealthControllerTest.java' src | head -n1)
printf 'controller=%s\ntest=%s\n' "$controller" "$testfile"
sed -n '1,220p' "$controller"
sed -n '1,280p' "$testfile"
echo
echo "== Authorization rule context =="
rg -n -C 6 --glob '*.java' '(healthz|readyz|pathMatchers|authorizeExchange|permitAll)' src/main/java
echo
echo "== Maven quality-gate configuration =="
rg -n -C 6 --glob 'pom.xml' '(jacoco|javadoc|doclint|failOnWarnings|maven-javadoc-plugin|maven-checkstyle|verify)' pom.xml
echo
echo "== Operational documentation and potential stale healthz statement =="
adr=$(fd -t f -e md . docs | rg 'availability-probes\.md$' | head -n1)
threat=$(fd -t f -e md . docs | rg 'threat-model-data-handling\.md$' | head -n1)
printf 'adr=%s\nthreat_model=%s\n' "$adr" "$threat"
sed -n '1,260p' "$adr"
sed -n '1,120p' "$threat"
echo
echo "== Changed files relative to main =="
git diff --name-status origin/main...HEADLength of output: 40696
The executable probe contract is correct. This automated review is advisory. It is not an independent write-authorized approval. You are interacting with an AI system. |
|
@opencode-agent Fix the exact current head |
|
@coderabbitai review Re-review exact current head |
|
@opencode-agent @cwl-noema-review Independently review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
expected="1c34120e6320c932565aacbdb3878e5d039f7095"
echo "== Revision identity =="
printf 'checked_out='; git rev-parse HEAD
printf 'expected='; printf '%s\n' "$expected"
git status --short
echo "== Exact-head pull request checks and reviews =="
gh pr view 265 --repo "$repo" \
--json number,headRefOid,isDraft,reviewDecision,statusCheckRollup,reviews \
--jq '{
number, headRefOid, isDraft, reviewDecision,
checks: [.statusCheckRollup[] | {name,status,conclusion,detailsUrl}],
reviews: [.reviews[] | {author:.author.login,state,commit:.commit.oid}]
}'
echo "== Candidate files =="
fd -t f . | rg '(^|/)(HealthController|HealthControllerTest|SecurityConfig|.*Security.*Config|test_documentation_contracts|pom|README|CHANGELOG|.*availability-probes|.*threat-model.*)\.(java|py|xml|md)$|(^|/)pom\.xml$' || true
echo "== Availability controller and tests =="
controller="$(fd -t f -e java 'HealthController.java' src | head -n1)"
testfile="$(fd -t f -e java 'HealthControllerTest.java' src | head -n1)"
printf 'controller=%s\ntest=%s\n' "$controller" "$testfile"
test -n "$controller" && sed -n '1,260p' "$controller"
test -n "$testfile" && sed -n '1,360p' "$testfile"
echo "== Probe authorization rules =="
rg -n -C 5 --glob '*.java' '(pathMatchers|authorizeExchange|permitAll|healthz|readyz)' src/main/java
echo "== Maven acceptance gates =="
sed -n '1,360p' pom.xml | rg -n -C 5 '(jacoco|javadoc|doclint|failOnWarnings|verify|check)'
echo "== Operations and security documentation =="
for file in \
"$(fd -t f -e md . docs | rg 'availability-probes\.md$' | head -n1)" \
"$(fd -t f -e md . docs | rg 'threat-model-data-handling\.md$' | head -n1)" \
"$(fd -t f -e py 'test_documentation_contracts.py' scripts | head -n1)"
do
if test -n "$file"; then
echo "--- $file ---"
sed -n '1,340p' "$file"
fi
done
echo "== PR change scope =="
git diff --name-status origin/main...HEADLength of output: 53437
Do not approve or merge until the response-body regression coverage is complete and every required exact-head check succeeds. This automated review is advisory and is not an independent write-authorized approval.
|
|
@opencode-agent @cwl-noema-review @coderabbitai Please review exact current head |
Pull request was converted to draft
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
expected="1c34120e6320c932565aacbdb3878e5d039f7095"
echo "== Revision identity =="
printf 'checked_out='; git rev-parse HEAD
printf 'expected='; printf '%s\n' "$expected"
git status --short
echo "== Exact-head PR checks and unresolved review state =="
gh pr view 265 --repo "$repo" \
--json headRefOid,isDraft,reviewDecision,statusCheckRollup,reviews \
--jq '{
headRefOid, isDraft, reviewDecision,
checks: [.statusCheckRollup[] | {name,status,conclusion,detailsUrl}],
reviews: [.reviews[] | {author:.author.login,state,commit:.commit.oid}]
}'
echo "== Target source/test/documentation files =="
fd -t f -e java 'HealthController.java' src
fd -t f -e java 'HealthControllerTest.java' src
fd -t f -e java . src/main | xargs -r ast-grep outline --items all --type class,method --match 'HealthController|Security|Availability' || true
fd -t f -e md . docs | rg '(availability-probes|threat-model-data-handling)\.md$'
fd -t f -e py 'test_documentation_contracts.py' scripts
echo "== Probe implementation and tests =="
for f in \
"$(fd -t f -e java 'HealthController.java' src | head -n1)" \
"$(fd -t f -e java 'HealthControllerTest.java' src | head -n1)"
do
test -z "$f" || { echo "--- $f ---"; sed -n '1,340p' "$f"; }
done
echo "== Probe authorization configuration =="
rg -n -C 5 --glob '*.java' '(pathMatchers|authorizeExchange|permitAll|healthz|readyz)' src/main/java
echo "== Verify, JaCoCo, and Javadoc gates =="
rg -n -C 8 --glob 'pom.xml' '(jacoco|javadoc|doclint|failOnWarnings|<phase>verify</phase>|<goal>check</goal>)' pom.xml
echo "== Operations, threat-model, and documentation contract =="
for f in \
"$(fd -t f -e md . docs | rg 'availability-probes\.md$' | head -n1)" \
"$(fd -t f -e md . docs | rg 'threat-model-data-handling\.md$' | head -n1)" \
"$(fd -t f -e py 'test_documentation_contracts.py' scripts | head -n1)"
do
test -z "$f" || { echo "--- $f ---"; sed -n '1,360p' "$f"; }
done
echo "== Availability terminology in changed Markdown =="
git diff --name-only origin/main...HEAD -- '*.md' | while IFS= read -r f; do
rg -n -i -C 2 '(healthz|readyz|liveness|readiness|startupProbe|Spring Boot 3\.5\.16|APA)' "$f" || true
doneLength of output: 72140 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
requested="1c34120e6320c932565aacbdb3878e5d039f7095"
current="1645ba381dfa41f5793e0af8d97923f805662bd7"
echo "== Requested commit identity =="
git show -s --format='commit=%H%nparents=%P%nsubject=%s%ncommitter=%cI' "$requested"
echo "== Requested-commit check runs =="
gh api "repos/$repo/commits/$requested/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,details_url,started_at,completed_at}]'
echo "== Requested-commit combined status =="
gh api "repos/$repo/commits/$requested/status" \
--jq '{state, statuses:[.statuses[] | {context,state,target_url,updated_at}]}'
echo "== Relevant files at requested commit =="
for path in \
src/main/java/com/clearfolio/viewer/controller/HealthController.java \
src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java \
docs/operations/2026-08-05-availability-probes.md \
docs/security/2026-07-02-threat-model-data-handling.md \
scripts/test_documentation_contracts.py \
pom.xml
do
echo "--- $path @ $requested ---"
git show "$requested:$path" | sed -n '1,360p'
done
echo "== Change from requested commit to current PR head =="
git diff --stat "$requested..$current"
git diff --name-status "$requested..$current"
git diff -- "$requested..$current" \
src/main/java/com/clearfolio/viewer/controller/HealthController.java \
src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java \
docs/operations/2026-08-05-availability-probes.md \
docs/security/2026-07-02-threat-model-data-handling.md \
scripts/test_documentation_contracts.py \
pom.xml || trueLength of output: 54014
The remaining requested contract is correct at this commit:
The PR has since advanced to You are interacting with an AI system. |
|
@coderabbitai review Re-review exact current head |
|
@opencode-agent @cwl-noema-review Independently review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
expected="1645ba381dfa41f5793e0af8d97923f805662bd7"
echo "== Commit identity =="
printf 'checked_out='; git rev-parse HEAD
printf 'expected='; printf '%s\n' "$expected"
git show -s --format='subject=%s%ncommitted=%cI' "$expected"
git status --short
echo "== Exact-commit checks and combined statuses =="
gh api "repos/$repo/commits/$expected/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,details_url,completed_at}]'
gh api "repos/$repo/commits/$expected/status" \
--jq '{state,statuses:[.statuses[] | {context,state,target_url,updated_at}]}'
echo "== Pull request head and unresolved review threads =="
gh pr view 265 --repo "$repo" \
--json headRefOid,isDraft,reviewDecision,statusCheckRollup,reviews \
--jq '{headRefOid,isDraft,reviewDecision,checks:[.statusCheckRollup[] | {name,status,conclusion}],reviews:[.reviews[] | {author:.author.login,state,commit:.commit.oid}]}'
gh api graphql -F owner="ContextualWisdomLab" -F name="clearfolio" -F number=265 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved comments(first: 1) { nodes { author { login } body path line } } }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'
echo "== Implementation, tests, and access control at exact commit =="
for path in \
src/main/java/com/clearfolio/viewer/controller/HealthController.java \
src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java \
pom.xml \
docs/operations/2026-08-05-availability-probes.md \
docs/security/2026-07-02-threat-model-data-handling.md \
scripts/test_documentation_contracts.py
do
echo "--- $path ---"
git show "$expected:$path" | sed -n '1,380p'
done
echo "== Authorization rules =="
git grep -n -C 5 -E '(healthz|readyz|pathMatchers|authorizeExchange|permitAll)' "$expected" -- 'src/main/java/**/*.java' || true
echo "== Changed paths at exact commit =="
git diff-tree --no-commit-id --name-status -r "$expected"Length of output: 62612
The prior test-coverage blocker is addressed. The current implementation is otherwise consistent with the requested contract:
This review is advisory. It is not an independent write-authorized approval.
|
Pull request was converted to draft
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
ARCHITECTURE.md (1)
67-72: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win운영 게이트를
verify계약과 일치시키십시오.이 목록은
mvn test와 독립 Javadoc 명령을 게이트로 제시합니다. 그러나 현재 수용 기준은mvn -B --no-transfer-progress verify만 완전한 병합 증거로 허용합니다. 이 목록을verify명령과 그 안의 JaCoCo 및 Javadoc 게이트로 변경하십시오.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ARCHITECTURE.md` around lines 67 - 72, Update the build and test gates section in ARCHITECTURE.md to identify `mvn -B --no-transfer-progress verify` as the single complete merge-evidence command, and describe the JaCoCo and JavaDoc gates as checks executed within that verify lifecycle. Remove the standalone `mvn test` and independent Javadoc command entries while retaining the Markdown lint requirement for changed documentation.
🧹 Nitpick comments (1)
src/test/java/com/clearfolio/viewer/controller/ApiExceptionHandlerCoverageTest.java (1)
14-23: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win차단 범위 안쪽 문자에 대한 검증도 추가하십시오.
현재 테스트는 U+202F가 보존되는 것만 확인합니다. 이 단방향 경계 검증은
sanitizeForLog가 전혀 치환하지 않도록 회귀해도 통과합니다. 보안 정제 경로에는 차단 범위 안쪽 문자가 실제로 치환되는지도 확인해야 합니다.DefaultDocumentValidationCoverageTest의 line 86과 동일한 양방향 검증 방식을 적용하십시오.♻️ 제안 변경
- String sanitized = (String) method.invoke(handler, "\u202F"); - - assertEquals("\u202F", sanitized); + assertEquals("\u202F", (String) method.invoke(handler, "\u202F")); + assertEquals("_", (String) method.invoke(handler, "\u202E")); + assertEquals("__", (String) method.invoke(handler, "\r\n"));위 기대값은
ApiExceptionHandler.sanitizeForLog의 치환 문자에 맞추어 조정하십시오.As per coding guidelines: "Tests must exercise real behavior, including failure, security, concurrency, and recovery paths; coverage-only assertions must represent a valid contract."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/test/java/com/clearfolio/viewer/controller/ApiExceptionHandlerCoverageTest.java` around lines 14 - 23, Extend logSanitizationPreservesTheCodePointImmediatelyAfterTheBlockedRange to also pass a code point inside sanitizeForLog’s blocked range and assert that it is replaced with the sanitizer’s configured replacement character, while retaining the existing U+202F preservation assertion. Mirror the two-sided validation used by DefaultDocumentValidationCoverageTest.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/main/java/com/clearfolio/viewer/api/ApiErrorResponse.java`:
- Around line 10-14: Update ApiExceptionHandler.handleTypeMismatch so failed
UUID and Boolean conversion inputs are not copied directly into
details["value"]; redact them or include them only through an appropriate
allowlist, preserving ApiErrorResponse’s contract that details contain no secret
values.
In
`@src/main/java/com/clearfolio/viewer/exception/UnsupportedDocumentFormatException.java`:
- Line 10: Update the Javadoc for the extension field in
UnsupportedDocumentFormatException to describe it as the blocked extension
supplied to the constructor, replacing the inaccurate “Normalized extension”
wording. Keep the constructor’s behavior of storing the input unchanged.
In
`@src/test/java/com/clearfolio/viewer/service/DefaultDocumentValidationCoverageTest.java`:
- Around line 89-118: Replace the class-private SECURITY_PROVIDERS_LOCK in
src/test/java/com/clearfolio/viewer/service/DefaultDocumentValidationCoverageTest.java:89-118
with the shared test lock, and add
`@ResourceLock`("java.security.Security.providers") to serialize access. Apply the
same shared lock and resource annotation in
src/test/java/com/clearfolio/viewer/controller/ConversionControllerCoverageTest.java:57-92,
extracting the duplicated sha256ProviderPositions and ProviderPosition helpers
into the shared test utility.
- Around line 33-38: Update
rejectsANullPolicySecretSuppliedByAnExternalConfigurationSource and its
JavaDoc/name to reflect the actual ConversionProperties contract, since
getPolicyOverrideSecret() normalizes null to "". Remove the mock-based null
getter scenario or change the test to verify the supported default/normalization
behavior; only add a production configuration path if null is genuinely valid
there.
---
Outside diff comments:
In `@ARCHITECTURE.md`:
- Around line 67-72: Update the build and test gates section in ARCHITECTURE.md
to identify `mvn -B --no-transfer-progress verify` as the single complete
merge-evidence command, and describe the JaCoCo and JavaDoc gates as checks
executed within that verify lifecycle. Remove the standalone `mvn test` and
independent Javadoc command entries while retaining the Markdown lint
requirement for changed documentation.
---
Nitpick comments:
In
`@src/test/java/com/clearfolio/viewer/controller/ApiExceptionHandlerCoverageTest.java`:
- Around line 14-23: Extend
logSanitizationPreservesTheCodePointImmediatelyAfterTheBlockedRange to also pass
a code point inside sanitizeForLog’s blocked range and assert that it is
replaced with the sanitizer’s configured replacement character, while retaining
the existing U+202F preservation assertion. Mirror the two-sided validation used
by DefaultDocumentValidationCoverageTest.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: bcc1d0d4-ad1c-497c-8840-34cc9759a24a
📒 Files selected for processing (44)
.github/workflows/ci.ymlARCHITECTURE.mdCHANGELOG.mdCLAUDE.mdREADME.mddocs/architecture.mddocs/engineering/acceptance-criteria.mddocs/operations/2026-08-05-availability-probes.mddocs/security/2026-07-02-threat-model-data-handling.mdpom.xmlscripts/test_documentation_contracts.pysrc/main/java/com/clearfolio/viewer/ClearfolioViewerApplication.javasrc/main/java/com/clearfolio/viewer/api/AdminJobListResponse.javasrc/main/java/com/clearfolio/viewer/api/ApiErrorResponse.javasrc/main/java/com/clearfolio/viewer/api/ConversionJobStatusResponse.javasrc/main/java/com/clearfolio/viewer/api/SubmitConversionResponse.javasrc/main/java/com/clearfolio/viewer/api/ViewerBootstrapResponse.javasrc/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.javasrc/main/java/com/clearfolio/viewer/artifact/ArtifactTokenException.javasrc/main/java/com/clearfolio/viewer/artifact/InMemoryArtifactStore.javasrc/main/java/com/clearfolio/viewer/auth/TenantContext.javasrc/main/java/com/clearfolio/viewer/config/ArtifactStoreConfig.javasrc/main/java/com/clearfolio/viewer/config/ArtifactStoreProperties.javasrc/main/java/com/clearfolio/viewer/config/ConversionExecutorConfig.javasrc/main/java/com/clearfolio/viewer/config/ConversionProperties.javasrc/main/java/com/clearfolio/viewer/config/ViewerSecurityHeadersWebFilter.javasrc/main/java/com/clearfolio/viewer/controller/ApiExceptionHandler.javasrc/main/java/com/clearfolio/viewer/controller/ConversionController.javasrc/main/java/com/clearfolio/viewer/controller/HealthController.javasrc/main/java/com/clearfolio/viewer/controller/ViewerUiController.javasrc/main/java/com/clearfolio/viewer/exception/UnsupportedDocumentFormatException.javasrc/main/java/com/clearfolio/viewer/model/ConversionJobStatus.javasrc/main/java/com/clearfolio/viewer/repository/InMemoryConversionJobRepository.javasrc/main/java/com/clearfolio/viewer/service/DefaultConversionWorker.javasrc/main/java/com/clearfolio/viewer/service/DefaultDocumentConversionService.javasrc/test/java/com/clearfolio/viewer/artifact/FileSystemArtifactStoreCoverageTest.javasrc/test/java/com/clearfolio/viewer/config/ConversionPropertiesCoverageTest.javasrc/test/java/com/clearfolio/viewer/controller/ApiExceptionHandlerCoverageTest.javasrc/test/java/com/clearfolio/viewer/controller/ConversionControllerCoverageTest.javasrc/test/java/com/clearfolio/viewer/controller/HealthControllerTest.javasrc/test/java/com/clearfolio/viewer/repository/InMemoryConversionJobRepositoryCoverageTest.javasrc/test/java/com/clearfolio/viewer/service/DefaultDocumentConversionServiceCoverageTest.javasrc/test/java/com/clearfolio/viewer/service/DefaultDocumentValidationCoverageTest.javasrc/test/java/com/clearfolio/viewer/service/DocumentConversionServiceCoverageTest.java
|
@opencode-agent Rebuild this bounded availability slice cleanly on authoritative parent #270 exact head |
8d7c55d to
0d4f43f
Compare
|
@coderabbitai review @opencode-agent @cwl-noema-review Please review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
head="592fa1799fd1d83ab80b6532fb7ba49ba4d61f9d"
parent="26563218ae42eaa876c784fcf56b27f8cb810080"
echo "== Revision identity and ancestry =="
printf 'checked_out='; git rev-parse HEAD
printf 'requested_head=%s\nparent=%s\n' "$head" "$parent"
git merge-base --is-ancestor "$parent" "$head" && echo "parent_is_ancestor=true"
printf 'commits_ahead='; git rev-list --count "$parent..$head"
printf 'commits_behind='; git rev-list --count "$head..$parent"
git log --format='%H %s' "$parent..$head"
echo
echo "== Exact-head check runs =="
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,details_url,completed_at}]'
echo "== Exact-head legacy statuses =="
gh api "repos/$repo/commits/$head/status" \
--jq '{state,statuses:[.statuses[] | {context,state,target_url,updated_at}]}'
echo
echo "== Pull request state and unresolved threads =="
gh pr view 265 --repo "$repo" --json headRefOid,isDraft,reviewDecision,statusCheckRollup,reviews \
--jq '{headRefOid,isDraft,reviewDecision,checks:[.statusCheckRollup[]|{name,status,conclusion}],reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}]}'
gh api graphql -F owner="ContextualWisdomLab" -F name="clearfolio" -F number=265 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'
echo
echo "== Exact change scope =="
git diff --name-status "$parent..$head"
git diff --stat "$parent..$head"
echo
echo "== Changed Java outlines =="
git diff --name-only "$parent..$head" -- '*.java' | while IFS= read -r file; do
echo "--- $file ---"
ast-grep outline "$file" --items all --type class,interface,enum,method || true
done
echo
echo "== Availability implementation, tests, and security rules at head =="
for file in \
src/main/java/com/clearfolio/viewer/controller/HealthController.java \
src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java \
pom.xml \
scripts/test_documentation_contracts.py \
docs/operations/2026-08-05-availability-probes.md \
docs/security/2026-07-02-threat-model-data-handling.md \
README.md \
CHANGELOG.md \
.github/workflows/ci.yml
do
if git cat-file -e "$head:$file" 2>/dev/null; then
echo "--- $file @ $head ---"
git show "$head:$file" | sed -n '1,380p'
fi
done
echo "== Probe authorization references at head =="
git grep -n -C 5 -E '(healthz|readyz|pathMatchers|authorizeExchange|permitAll)' "$head" -- 'src/main/java/**/*.java' || trueLength of output: 86438 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
head="592fa1799fd1d83ab80b6532fb7ba49ba4d61f9d"
parent="26563218ae42eaa876c784fcf56b27f8cb810080"
echo "== Full bounded patch, parent to exact head =="
git diff --find-renames --unified=40 "$parent..$head" -- \
ARCHITECTURE.md \
CHANGELOG.md \
CLAUDE.md \
README.md \
docs/architecture.md \
docs/engineering/acceptance-criteria.md \
docs/operations/2026-08-05-availability-probes.md \
docs/security/2026-07-02-threat-model-data-handling.md \
scripts/test_documentation_contracts.py \
src/main/java/com/clearfolio/viewer/controller/HealthController.java \
src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java
echo
echo "== Refresh exact-head strix result =="
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | select(.name == "strix") | {name,status,conclusion,details_url,started_at,completed_at}]'
echo
echo "== Required branch protection =="
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks:.required_status_checks.contexts,strict:.required_status_checks.strict,required_approvals:.required_pull_request_reviews.required_approving_review_count,require_code_owner:.required_pull_request_reviews.require_code_owner_reviews,require_last_push_approval:.required_pull_request_reviews.require_last_push_approval,require_conversation_resolution:.required_conversation_resolution.enabled}' \
2>&1 || true
echo
echo "== Probe routes and security-chain definitions at exact head =="
git grep -n -E 'SecurityWebFilterChain|ServerHttpSecurity|`@EnableWebFluxSecurity`|authorizeExchange|pathMatchers|`@GetMapping`\("/(healthz|readyz)"\)' \
"$head" -- 'src/main/java/**/*.java' || trueLength of output: 79466
I found no actionable defect in the availability-probe change.
GitHub denied access to the branch-protection API with HTTP 403. I could not verify the protected-branch rule configuration. Parent integration and independent approval remain separate merge gates. This automated review is advisory and is not an independent write-authorized approval.
|
|
Exact stack refresh: authoritative parent #270 is now |
592fa17 to
6937386
Compare
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head Check the bounded availability implementation and evidence: Report exact-head findings or a no-blocker advisory conclusion after independent inspection. Keep Draft and do not infer counted independent approval. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
head="69373862a646598a73a5ce1992342d78419aa171"
parent="2ff43fc1b280f6de2ca903695e5cbeef5c0b3c17"
echo "== Revision and ancestry =="
printf 'checked_out='; git rev-parse HEAD
printf 'requested_head=%s\nparent_head=%s\n' "$head" "$parent"
git merge-base --is-ancestor "$parent" "$head" && echo "parent_is_ancestor=true" || echo "parent_is_ancestor=false"
printf 'merge_base='; git merge-base "$parent" "$head"
printf 'ahead='; git rev-list --count "$parent..$head"
printf 'behind='; git rev-list --count "$head..$parent"
git log --format='%H %s' "$parent..$head"
echo "== Exact-head checks =="
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,details_url,started_at,completed_at}]'
gh api "repos/$repo/commits/$head/status" \
--jq '{state,statuses:[.statuses[]|{context,state,target_url,updated_at}]}'
echo "== PR state and unresolved threads =="
gh pr view 265 --repo "$repo" --json headRefOid,isDraft,reviewDecision,statusCheckRollup,reviews \
--jq '{headRefOid,isDraft,reviewDecision,checks:[.statusCheckRollup[]|{name,status,conclusion}],reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}]}'
gh api graphql -F owner="ContextualWisdomLab" -F name="clearfolio" -F number=265 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'
echo "== Parent-to-head file scope =="
git diff --name-status "$parent..$head"
git diff --stat "$parent..$head"
echo "== Candidate source and test outlines =="
for file in \
src/main/java/com/clearfolio/viewer/controller/HealthController.java \
src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java
do
if git cat-file -e "$head:$file" 2>/dev/null; then
echo "--- $file ---"
git show "$head:$file" > "/tmp/$(basename "$file")"
ast-grep outline "/tmp/$(basename "$file")" --items all --type class,method,constructor || true
fi
done
echo "== Probe implementation, tests, security references, and gates =="
for file in \
src/main/java/com/clearfolio/viewer/controller/HealthController.java \
src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java \
pom.xml \
scripts/test_documentation_contracts.py \
docs/operations/2026-08-05-availability-probes.md \
docs/security/2026-07-02-threat-model-data-handling.md \
README.md \
ARCHITECTURE.md \
docs/architecture.md \
docs/engineering/acceptance-criteria.md \
CHANGELOG.md \
.github/workflows/ci.yml
do
if git cat-file -e "$head:$file" 2>/dev/null; then
echo "--- $file @ head ---"
git show "$head:$file" | sed -n '1,420p'
fi
done
echo "== Route authorization and shared-service coupling references at head =="
git grep -n -C 5 -E '(healthz|readyz|ApplicationAvailability|LivenessState|ReadinessState|SecurityWebFilterChain|ServerHttpSecurity|authorizeExchange|pathMatchers|permitAll|WebClient|Repository|ArtifactStore)' \
"$head" -- 'src/main/java/**/*.java' || trueLength of output: 204381 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
head="69373862a646598a73a5ce1992342d78419aa171"
parent="2ff43fc1b280f6de2ca903695e5cbeef5c0b3c17"
echo "== Workflow runs for exact head =="
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '[.workflow_runs[] | {name,event,status,conclusion,head_sha,html_url,created_at,updated_at}]'
echo "== Check suites and all associated check runs for exact head =="
gh api "repos/$repo/commits/$head/check-suites?per_page=100" \
--jq '[.check_suites[] | {id,status,conclusion,app:.app.slug,head_sha,url}]'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,details_url}]'
echo "== Exact-head commit statuses without projection =="
gh api "repos/$repo/commits/$head/status" \
--jq '.statuses | map({context,state,description,target_url,creator:.creator.login})'
echo "== Parent-sensitive paths changed by availability slice =="
git diff --name-status "$parent..$head" -- \
pom.xml \
.github \
scripts/verify_maven_test_reports.py \
scripts \
docs/security \
docs/qa \
src/main/java/com/clearfolio/viewer/auth \
src/main/java/com/clearfolio/viewer/controller/ArtifactController.java \
src/main/java/com/clearfolio/viewer/controller/ConversionController.java \
src/test \
AGENTS.md \
CLAUDE.md
echo "== Full bounded patch for code, test, build, workflow, and documentation contract =="
git diff --find-renames --unified=25 "$parent..$head" -- \
src/main/java/com/clearfolio/viewer/controller/HealthController.java \
src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java \
scripts/test_documentation_contracts.py \
pom.xml \
.github/workflows/ci.yml \
.github \
docs/operations/2026-08-05-availability-probes.md \
docs/security/2026-07-02-threat-model-data-handling.md \
docs/engineering/acceptance-criteria.md \
ARCHITECTURE.md \
docs/architecture.md \
README.md \
CHANGELOG.md \
CLAUDE.md
echo "== Parent security/dependency/SBOM/reporting file identity =="
for file in \
pom.xml \
.github/workflows/ci.yml \
scripts/verify_maven_test_reports.py \
src/main/java/com/clearfolio/viewer/controller/ArtifactController.java \
src/main/java/com/clearfolio/viewer/controller/ConversionController.java
do
if git cat-file -e "$parent:$file" 2>/dev/null && git cat-file -e "$head:$file" 2>/dev/null; then
printf '%s parent=' "$file"
git rev-parse "$parent:$file"
printf '%s head=' "$file"
git rev-parse "$head:$file"
fi
done
echo "== Availability tests and docs: recovery terminology =="
git grep -n -i -C 3 -E '(recovery|recover|BROKEN|REFUSING_TRAFFIC|ACCEPTING_TRAFFIC|CORRECT)' \
"$head" -- \
'src/test/**/*.java' \
'docs/**/*.md' \
'scripts/*.py' || trueLength of output: 218190
I found no actionable implementation defect in the bounded availability slice.
This review is advisory. It is not a counted independent write-authorized approval.
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head Verify the bounded availability contract: Exact-head CI |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
head="d67947e3d405a47c155ea5078aeddb7e110f76de"
parent="c1239e20b048a582b19cb9eeb90f2c29f7c8f814"
echo "== Exact revision identity and ancestry =="
printf 'checked_out='; git rev-parse HEAD
printf 'requested_head=%s\nparent=%s\n' "$head" "$parent"
git show -s --format='head_subject=%s%nhead_committed=%cI' "$head"
git show -s --format='parent_subject=%s%nparent_committed=%cI' "$parent"
git merge-base --is-ancestor "$parent" "$head" && echo "parent_is_ancestor=true" || echo "parent_is_ancestor=false"
printf 'merge_base='; git merge-base "$parent" "$head"
printf 'ahead='; git rev-list --count "$parent..$head"
printf 'behind='; git rev-list --count "$head..$parent"
echo "== Exact bounded change scope =="
git diff --name-status "$parent..$head"
git diff --stat "$parent..$head"
echo "== Exact-head check runs, workflow runs, and commit statuses =="
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,details_url,started_at,completed_at}]'
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '[.workflow_runs[] | {name,status,conclusion,event,head_sha,html_url,created_at,updated_at}]'
gh api "repos/$repo/commits/$head/status" \
--jq '{state,statuses:[.statuses[] | {context,state,description,target_url,updated_at}]}'
echo "== Pull request state, reviews, and unresolved threads =="
gh pr view 265 --repo "$repo" --json headRefOid,isDraft,reviewDecision,statusCheckRollup,reviews \
--jq '{headRefOid,isDraft,reviewDecision,checks:[.statusCheckRollup[] | {name,status,conclusion}],reviews:[.reviews[] | {author:.author.login,state,commit:.commit.oid}]}'
gh api graphql -F owner="ContextualWisdomLab" -F name="clearfolio" -F number=265 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'
echo "== Availability controller and executable coverage at exact head =="
for file in \
src/main/java/com/clearfolio/viewer/controller/HealthController.java \
src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java \
scripts/test_documentation_contracts.py \
docs/operations/2026-08-05-availability-probes.md \
docs/security/2026-07-02-threat-model-data-handling.md \
README.md \
ARCHITECTURE.md \
docs/architecture.md \
docs/engineering/acceptance-criteria.md \
pom.xml \
.github/workflows/ci.yml
do
if git cat-file -e "$head:$file" 2>/dev/null; then
echo "--- $file @ $head ---"
git show "$head:$file" | sed -n '1,420p'
fi
done
echo "== Availability dependencies and route authorization at exact head =="
git grep -n -C 5 -E '(ApplicationAvailability|LivenessState|ReadinessState|healthz|readyz|SecurityWebFilterChain|ServerHttpSecurity|authorizeExchange|pathMatchers|permitAll|Repository|ArtifactStore|WebClient)' \
"$head" -- 'src/main/java/**/*.java' || true
echo "== Full bounded patch for availability-owned paths =="
git diff --find-renames --unified=30 "$parent..$head" -- \
src/main/java/com/clearfolio/viewer/controller/HealthController.java \
src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java \
scripts/test_documentation_contracts.py \
docs/operations/2026-08-05-availability-probes.md \
docs/security/2026-07-02-threat-model-data-handling.md \
README.md \
ARCHITECTURE.md \
docs/architecture.md \
docs/engineering/acceptance-criteria.md \
CHANGELOG.mdLength of output: 200382 🏁 Script executed: #!/bin/bash
set -euo pipefail
log="/tmp/coderabbit-shell-logs/shell-output-OJXfw2"
head="d67947e3d405a47c155ea5078aeddb7e110f76de"
parent="c1239e20b048a582b19cb9eeb90f2c29f7c8f814"
echo "== Captured revision, scope, and GitHub evidence =="
for label in \
"== Exact revision identity and ancestry ==" \
"== Exact bounded change scope ==" \
"== Exact-head check runs, workflow runs, and commit statuses ==" \
"== Pull request state, reviews, and unresolved threads =="
do
line=$(rg -nF "$label" "$log" | head -n1 | cut -d: -f1 || true)
if [ -n "$line" ]; then
printf '\n--- %s ---\n' "$label"
sed -n "${line},$((line + 180))p" "$log"
fi
done
echo "== Focused exact-head implementation and test =="
git show "$head:src/main/java/com/clearfolio/viewer/controller/HealthController.java" | cat -n
git show "$head:src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java" | cat -n
echo "== Probe-specific construction and request dependencies =="
git grep -n -C 3 -E 'class HealthController|ApplicationAvailability|new HealthController|healthz|readyz' \
"$head" -- 'src/main/java/**/*.java' 'src/test/**/*.java'
echo "== Availability documentation and citations =="
git show "$head:docs/operations/2026-08-05-availability-probes.md" | cat -n
git show "$head:docs/security/2026-07-02-threat-model-data-handling.md" | sed -n '20,50p' | cat -n
echo "== Parent reconciliation: files that differ =="
git diff --name-only "$parent..$head"Length of output: 77878
The requested parent
Keep the PR in Draft. Reconcile or merge the availability slice onto the requested parent. Then rerun exact-head and synthetic-merge checks. I found no code-level defect in the availability slice.
Security Scan, SAST Semgrep, Strix, formal exact-head review, and counted independent write-authorized approval remain absent. I do not infer them from the successful checks. You are interacting with an AI system. |
1 participant
Buyer-visible operational gap
Separate process liveness from traffic readiness so an orchestrator does not route requests to a live-but-unready instance.
Exact current stack
d67947e3d405a47c155ea5078aeddb7e110f76deed3863209109cd24a3cf1f1d6bdcd51db16fbef12ff43fc1b280f6de2ca903695e5cbeef5c0b3c17The branch is not yet based on the declared parent. PR #286 restores the full parent, including the corrected standard-library-discoverable stacked-PR CI regression, while retaining this bounded availability slice. No predecessor-head result transfers.
Availability contract
GET /healthzmaps Spring Boot liveness to controlled200 {"status":"ok"}or503 {"status":"broken"}responses.GET /readyzreturns200 {"status":"ready"}only while accepting traffic, otherwise503 {"status":"not_ready"}.Cache-Control: no-store, expose no tenant or dependency detail, and keep liveness independent of shared external services.Evidence boundary
CI run
31105439528and fuzz run31105439127succeeded for predecessor headd67947e3d405a47c155ea5078aeddb7e110f76de, but do not establish compatibility with current parented3863209109cd24a3cf1f1d6bdcd51db16fbef1. Merge order remains #286 reconciliation, reinspection of the resulting exact head, then every required exact-head/base-sensitive CI, fuzz, security, review, approval, and repository-policy gate. Keep this PR Draft and do not infer approval from predecessor or status-only evidence.