ci(automation): schedule NVIDIA NIM OpenCode development - #64
Conversation
|
Warning Review limit reached
Next review available in: 34 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (11)
📝 WalkthroughWalkthrough시간별 NVIDIA NIM OpenCode 워크플로를 추가했다. 워크플로는 열린 PR과 자격 증명을 확인하고 제한된 변경을 생성한다. 별도 러너가 아티팩트를 검증한다. 게시 단계는 전용 GitHub App 토큰으로 하나의 PR을 생성한다. PR 메시지 파서, repair bundle workflow, 테스트와 운영 문서도 추가했다. Changes시간별 NVIDIA NIM 제품 개발
Estimated code review effort: 5 (Critical) | ~100 minutes Possibly related issues
Sequence Diagram(s)sequenceDiagram
participant Scheduler
participant propose_product_increment
participant package_product_increment
participant publish_product_increment
participant GitHub
participant MaintainerApp
Scheduler->>propose_product_increment: 매시간 실행 또는 dry-run 요청
propose_product_increment->>GitHub: 열린 PR과 NIM 자격 증명 확인
propose_product_increment->>propose_product_increment: 제한된 OpenCode 제안 생성
propose_product_increment->>package_product_increment: immutable artifact 업로드
package_product_increment->>package_product_increment: base SHA, digest와 release 검증
package_product_increment->>publish_product_increment: 검증 성공 전달
publish_product_increment->>GitHub: default branch와 열린 PR 재검증
publish_product_increment->>MaintainerApp: 전용 App token 발급
publish_product_increment->>GitHub: branch push 및 PR 하나 생성
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@coderabbitai review Please perform a full substantive review of exact current head @opencode-agent Please independently review exact current head @cwl-noema-review Please independently review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='3f53e1e748045049f2ee0d957a1b1c4470e47448'
printf '%s\n' '== Checked-out commit =='
git rev-parse HEAD
git status --short
printf '%s\n' '== Expected commit present =='
git cat-file -e "${expected}^{commit}"
printf '%s\n' '== PR metadata =='
gh pr view 64 --repo ContextualWisdomLab/noema --json number,title,headRefOid,baseRefName,changedFiles,files,statusCheckRollup
printf '%s\n' '== Changed paths from merge base =='
base="$(git merge-base HEAD origin/main)"
git diff --name-status "$base" HEAD
printf '%s\n' '== Workflow files =='
fd -t f -e yml -e yaml .github || true
printf '%s\n' '== Workflow structure =='
for f in $(fd -t f -e yml -e yaml .github); do
echo "--- $f"
ast-grep outline "$f" --items all 2>/dev/null || sed -n '1,260p' "$f"
done
printf '%s\n' '== Exact-head checks =='
gh api "repos/ContextualWisdomLab/noema/commits/${expected}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`'Length of output: 8805
The requested commit has a failed I did not perform the substantive review because it would violate the exact-head requirement. Please provide the intended commit SHA, or confirm that I should review You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent review exact head @cwl-noema-review review exact head Please evaluate the late-bound Maintainer App publication boundary, read-only job-level |
|
@coderabbitai review Please perform a full substantive review of exact current head @opencode-agent Please independently review exact head @cwl-noema-review Please independently review the same exact head and submit |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (6)
.github/workflows/export-final-candidate-repair-bundle.yml (2)
98-106: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win계약 검증 grep을 실패 메시지와 함께 실행하라.
다섯 개의
grep -Fq는 실패 시 출력이 없다.set -e가 작업을 중단하지만, 로그에는 어떤 계약이 깨졌는지 나타나지 않는다. 각 검사에::error::메시지를 붙이면 운영자가 원인을 즉시 확인한다.♻️ 제안 변경
- grep -Fq 'read -r -a model_candidates <<<"$OPENCODE_MODEL_CANDIDATES"' \ - .github/workflows/hourly-product-development.yml + assert_contains() { + grep -Fq "$1" "$2" || { + echo "::error::Missing contract '$1' in $2." + exit 1 + } + } + assert_contains 'read -r -a model_candidates <<<"$OPENCODE_MODEL_CANDIDATES"' \ + .github/workflows/hourly-product-development.yml나머지 네 개 검사도 같은 형태로 바꿔라.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/export-final-candidate-repair-bundle.yml around lines 98 - 106, Update all five contract-validation grep checks in the workflow step to emit a distinct ::error:: message identifying the failed contract before exiting, while preserving the existing fixed-string checks and set -e behavior.
33-52: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value하드코딩된 run/artifact ID는 유효 기간이 지나면 워크플로를 영구 실패시킨다.
artifact-ids: 8919044599와run-id: 30978064579는 단일 실행에 고정된 값이다. 아티팩트 보존 기간이 끝나면actions/download-artifact단계가 항상 실패한다. 그 뒤에는 이 파일을 수정할 때마다 실패한 실행이 기록된다.이 워크플로가 일회성 복구 수단이면, 번들 내보내기를 완료한 뒤 파일을 삭제할 계획을 문서에 남겨라. 재사용할 계획이면 ID와 digest를
workflow_dispatch입력으로 옮겨라.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/export-final-candidate-repair-bundle.yml around lines 33 - 52, Remove the hardcoded artifact and run identifiers from the reusable workflow path by exposing the artifact ID, source run ID, artifact name, and expected digests as workflow_dispatch inputs, then reference those inputs in the download step and the “Verify, apply, and package final file contents” shell block. If this workflow is intentionally one-time, instead document its planned deletion after bundle export and preserve that lifecycle behavior explicitly.scripts/prepare-agent-pr-message.mjs (1)
269-269: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low value
process.argv[1]이 없는 실행 경로를 방어하라.
resolve(process.argv[1])는 모듈 로드 시점에 실행된다.node --eval또는node --input-type=module처럼process.argv[1]이undefined인 실행 환경에서 이 모듈을 import하면resolve가TypeError를 던진다. 그 결과 export된 순수 함수도 사용할 수 없다. 기본값을 넣어 엔트리포인트 판별만 실패하도록 제한하라.♻️ 제안 변경
-const invokedPath = pathToFileURL(resolve(process.argv[1])).href; +const entryPath = process.argv[1]; +const invokedPath = entryPath === undefined + ? "" + : pathToFileURL(resolve(entryPath)).href;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/prepare-agent-pr-message.mjs` at line 269, Update the module-level invokedPath initialization around process.argv[1] so missing argv[1] cannot be passed to resolve and throw during import. Provide a safe fallback that only causes entrypoint detection to evaluate as false, while preserving normal behavior when argv[1] is present and leaving the exported pure functions usable.test/hourly-product-development-final-candidate-cleanup.test.ts (1)
14-39: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win정규식 불일치가
NaN비교로 나타난다.
Number(match?.[1])는 패턴이 없으면NaN을 만든다. 워크플로에서 env 이름이 바뀌면 35~39행이 "expected NaN to be less than or equal to NaN" 형태로 실패한다. 원인 파악이 어렵다. 형제 파일test/hourly-product-development-workflow.test.ts는expect(match).not.toBeNull()을 먼저 실행한다. 같은 방식을 적용하라.26~28행의
/propose_product_increment:[\s\S]*?timeout-minutes: (\d+)/도 취약하다. 이 정규식은 문서에서propose_product_increment문자열이 처음 나오는 위치부터 탐색한다.needs:목록 등 다른 위치가 먼저 나오면 다른 job의timeout-minutes를 잡는다. job 슬라이스를 잘라 그 안에서 검색하라.♻️ 제안 변경
+ const candidateTimeoutMatch = workflow.match( + /OPENCODE_RUN_TIMEOUT_SECONDS: "(\d+)"/, + ); + expect(candidateTimeoutMatch).not.toBeNull(); + const candidateTimeout = Number(candidateTimeoutMatch?.[1]);나머지 네 개 값에도 같은 검사를 적용하라.
jobMinutes는propose_product_increment:시작 위치부터 다음 job 시작 위치까지의 슬라이스에서 추출하라.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/hourly-product-development-final-candidate-cleanup.test.ts` around lines 14 - 39, In the test around candidateTimeout, candidateGrace, reinstallTimeout, reinstallGrace, and jobMinutes, assert each regex match is not null before converting its capture to Number, following the pattern in hourly-product-development-workflow.test.ts. Extract the propose_product_increment job section from its job start through the next job boundary, then search that slice for timeout-minutes instead of scanning the full workflow.test/agent-pr-message-internals.test.ts (1)
180-191: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value비배열
argv케이스를 추가하라.
runAgentPrMessageCli는!Array.isArray(argv)도 거부한다. 현재 표는 배열 길이만 검증한다.undefined와 비배열 값을 추가하면 해당 분기까지 검증한다.♻️ 제안 변경
it.each([ + { args: undefined }, + { args: "source title body" }, { args: [] }, { args: ["source"] }, { args: ["source", "title"] }, { args: ["source", "title", "body", "extra"] }, - ])("rejects invalid CLI arguments $args", ({ args }) => { + ] as Array<{ args: unknown }>)("rejects invalid CLI arguments $args", ({ args }) => { const fs = fileSystem(); - expect(() => runAgentPrMessageCli(args, {}, fs)).toThrow( + expect(() => runAgentPrMessageCli(args as string[], {}, fs)).toThrow(🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/agent-pr-message-internals.test.ts` around lines 180 - 191, Extend the invalid-argument cases in the runAgentPrMessageCli parameterized test to include undefined and representative non-array argv values, while preserving the existing usage-error assertion for every case.test/hourly-product-development-workflow.test.ts (1)
227-261: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value워크플로 예산과 순서 단정이 두 테스트 파일에 중복된다. 근본 원인은 공용 헬퍼의 부재다. 같은 정규식, 같은 예약 상수
300, 같은 인덱스 순서 단정이test/hourly-product-development-workflow.test.ts와test/hourly-product-development-final-candidate-cleanup.test.ts에 각각 존재한다. 워크플로의 env 이름이나 셸 문자열이 바뀌면 두 파일을 모두 고쳐야 한다.
test/hourly-product-development-workflow.test.ts#L227-L261: 예산 계산을 공용 헬퍼(예:test/helpers/hourly-workflow.ts의readCandidateBudget)로 추출하고 이 위치에서는 헬퍼 결과만 단정하라.test/hourly-product-development-workflow.test.ts#L270-L298:proposer슬라이스 기반 순서 단정을 같은 헬퍼로 옮기고,test/hourly-product-development-final-candidate-cleanup.test.ts가 전체 문서 대신 그 헬퍼를 사용하게 하라.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/hourly-product-development-workflow.test.ts` around lines 227 - 261, Extract the duplicated budget parsing, 300-second reserve, candidate-count calculations, and proposer ordering assertions into a shared helper such as readCandidateBudget in test/helpers/hourly-workflow.ts. Update test/hourly-product-development-workflow.test.ts lines 227-261 and 270-298 to use only the helper results, and update test/hourly-product-development-final-candidate-cleanup.test.ts (line range not provided) to use the same helper instead of parsing the full document independently.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/hourly-product-development-git-mode-boundary.test.ts`:
- Around line 92-100: Update modeGateRejects to explicitly throw when spawnSync
reports a failed process execution: handle result.status being null or
result.signal being non-null before interpreting the exit status. Preserve the
existing result.error handling and continue treating status 0 as rejection.
---
Nitpick comments:
In @.github/workflows/export-final-candidate-repair-bundle.yml:
- Around line 98-106: Update all five contract-validation grep checks in the
workflow step to emit a distinct ::error:: message identifying the failed
contract before exiting, while preserving the existing fixed-string checks and
set -e behavior.
- Around line 33-52: Remove the hardcoded artifact and run identifiers from the
reusable workflow path by exposing the artifact ID, source run ID, artifact
name, and expected digests as workflow_dispatch inputs, then reference those
inputs in the download step and the “Verify, apply, and package final file
contents” shell block. If this workflow is intentionally one-time, instead
document its planned deletion after bundle export and preserve that lifecycle
behavior explicitly.
In `@scripts/prepare-agent-pr-message.mjs`:
- Line 269: Update the module-level invokedPath initialization around
process.argv[1] so missing argv[1] cannot be passed to resolve and throw during
import. Provide a safe fallback that only causes entrypoint detection to
evaluate as false, while preserving normal behavior when argv[1] is present and
leaving the exported pure functions usable.
In `@test/agent-pr-message-internals.test.ts`:
- Around line 180-191: Extend the invalid-argument cases in the
runAgentPrMessageCli parameterized test to include undefined and representative
non-array argv values, while preserving the existing usage-error assertion for
every case.
In `@test/hourly-product-development-final-candidate-cleanup.test.ts`:
- Around line 14-39: In the test around candidateTimeout, candidateGrace,
reinstallTimeout, reinstallGrace, and jobMinutes, assert each regex match is not
null before converting its capture to Number, following the pattern in
hourly-product-development-workflow.test.ts. Extract the
propose_product_increment job section from its job start through the next job
boundary, then search that slice for timeout-minutes instead of scanning the
full workflow.
In `@test/hourly-product-development-workflow.test.ts`:
- Around line 227-261: Extract the duplicated budget parsing, 300-second
reserve, candidate-count calculations, and proposer ordering assertions into a
shared helper such as readCandidateBudget in test/helpers/hourly-workflow.ts.
Update test/hourly-product-development-workflow.test.ts lines 227-261 and
270-298 to use only the helper results, and update
test/hourly-product-development-final-candidate-cleanup.test.ts (line range not
provided) to use the same helper instead of parsing the full document
independently.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: df574015-fd26-4213-a71e-ef2293a5c4c3
📒 Files selected for processing (12)
.github/workflows/export-final-candidate-repair-bundle.yml.github/workflows/hourly-product-development.ymlCHANGELOG.mddocs/doctoring/hourly-nim-opencode-development.mddocs/operations/hourly-product-development.mddocs/superpowers/plans/2026-08-05-hourly-nim-opencode-development.mddocs/superpowers/specs/2026-08-05-hourly-nim-opencode-development-design.mdscripts/prepare-agent-pr-message.mjstest/agent-pr-message-internals.test.tstest/hourly-product-development-final-candidate-cleanup.test.tstest/hourly-product-development-git-mode-boundary.test.tstest/hourly-product-development-workflow.test.ts
🚧 Files skipped from review as they are similar to previous changes (6)
- CHANGELOG.md
- docs/doctoring/hourly-nim-opencode-development.md
- docs/operations/hourly-product-development.md
- .github/workflows/hourly-product-development.yml
- docs/superpowers/specs/2026-08-05-hourly-nim-opencode-development-design.md
- docs/superpowers/plans/2026-08-05-hourly-nim-opencode-development.md
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/noema'
pr='64'
sha='13c6f5ec32ff3b2c5ccb17f7ab0c6740075c78b3'
implementation_sha='85b46e13e0032bcac971afa5cad58f2c4339da11'
echo '== Exact commit and PR head =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${sha}^{commit}"
git cat-file -e "${implementation_sha}^{commit}"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefName,baseRefOid,statusCheckRollup \
--jq '{headRefOid,baseRefName,baseRefOid,checks:[.statusCheckRollup[]|{name,status,conclusion,detailsUrl}]}'
echo '== Exact-head check runs =='
gh api "repos/${repo}/commits/${sha}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`'
echo '== Compare claimed metadata-only range =='
gh api "repos/${repo}/compare/${implementation_sha}...${sha}" \
--jq '{status,ahead_by,behind_by,total_commits,files:[.files[]|{filename,status,additions,deletions,changes}]}'
echo '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='noema' -F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { path line body author { login } } }
}
}
}
}
}' --jq '{
head: .data.repository.pullRequest.headRefOid,
unresolved: [
.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved | not)
| {outdated:.isOutdated,author:.comments.nodes[0].author.login,
path:.comments.nodes[0].path,line:.comments.nodes[0].line,
body:.comments.nodes[0].body}
]
}'
show() {
file="$1"; start="$2"; end="$3"
echo "--- ${file}:${start}-${end}"
git show "${sha}:${file}" |
awk -v s="$start" -v e="$end" 'NR >= s && NR <= e { printf "%6d %s\n", NR, $0 }'
}
echo '== Workflow =='
show .github/workflows/hourly-product-development.yml 1 920
echo '== Contract and behavioral tests =='
show test/hourly-product-development-workflow.test.ts 1 820
show test/hourly-product-development-runner-isolation.test.ts 1 620
show test/hourly-product-development-git-mode-boundary.test.ts 1 620
echo '== Metadata parser and tests =='
show scripts/prepare-agent-pr-message.mjs 1 320
show test/agent-pr-message.test.ts 1 520
echo '== Budget and trust-boundary documentation =='
for file in \
docs/operations/hourly-product-development.md \
docs/doctoring/hourly-nim-opencode-development.md \
docs/superpowers/plans/2026-08-05-hourly-nim-opencode-development.md \
docs/superpowers/specs/2026-08-05-hourly-nim-opencode-development-design.md \
CHANGELOG.md
do
echo "--- ${file}"
git show "${sha}:${file}" | rg -n -i -C 3 \
'(900|60|30|10|initial|cleanup|reinstall|candidate|3300|runner|artifact|digest|token|NVIDIA|symlink|gitlink|merge|release|deploy)' || true
done
echo '== Credential changes outside the added workflow =='
base="$(git merge-base "$sha" origin/main)"
git diff --name-status "$base" "$sha" -- .github \
| grep -v '^.github/workflows/hourly-product-development.yml$' || trueLength of output: 165562 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/noema'
sha='13c6f5ec32ff3b2c5ccb17f7ab0c6740075c78b3'
echo '== Exact-head verify and reviewer evidence =='
gh api "repos/${repo}/commits/${sha}/check-runs?per_page=100" \
--jq '.check_runs[]
| select(.name == "verify" or .name == "reviewer")
| [.name,.details_url] | `@tsv`' \
| while IFS=$'\t' read -r name url; do
printf '%s\n' "--- ${name}: ${url}"
run_id="$(printf '%s\n' "$url" | sed -nE 's#.*/actions/runs/([0-9]+)(/job/[0-9]+)?#\1#p')"
if [ -n "$run_id" ]; then
gh run view "$run_id" --repo "$repo" --log \
| rg -n -i -C 2 \
'(test files|tests? passed|statements|branches|functions|lines|coverage|docstring|npm audit|release:verify)' \
| sed -n '1,360p' || true
fi
done
echo '== Initial-install and budget source locations =='
git show "${sha}:.github/workflows/hourly-product-development.yml" \
| nl -ba | sed -n '200,220p;320,378p'
git show "${sha}:test/hourly-product-development-workflow.test.ts" \
| nl -ba | sed -n '217,300p'Length of output: 20494
I found one blocking issue. I cannot approve this head.
Add a separate initial-install timeout and kill grace. Stop with a stable diagnostic if it fails or times out. Derive the complete 55-minute arithmetic from the configured initial-install, candidate, and inter-candidate cleanup limits. Update the workflow contract and the related operations, design, plan, doctoring, and changelog text. I verified these exact-head facts:
|
|
@coderabbitai review Please perform a full substantive review of exact current head @opencode-agent Please independently review exact current head @cwl-noema-review Please independently review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/noema'
pr='64'
sha='900c57e74d8be4b02fdcf7a59bd7214e55a17704'
echo '== Exact commit and PR state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${sha}^{commit}"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefName,baseRefOid,statusCheckRollup \
--jq '{headRefOid,baseRefName,baseRefOid,checks:[.statusCheckRollup[]|{name,status,conclusion,detailsUrl}]}'
echo '== Exact-head check runs =='
gh api "repos/${repo}/commits/${sha}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`'
echo '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='noema' -F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { path line body author { login } } }
}
}
}
}
}' --jq '{
head: .data.repository.pullRequest.headRefOid,
unresolved: [
.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved | not)
| {outdated:.isOutdated, author:.comments.nodes[0].author.login,
path:.comments.nodes[0].path, line:.comments.nodes[0].line,
body:.comments.nodes[0].body}
]
}'
show() {
file="$1"; start="$2"; end="$3"
echo "--- ${file}:${start}-${end}"
git show "${sha}:${file}" |
awk -v start="$start" -v end="$end" \
'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }'
}
echo '== Workflow declaration and pre-inference gate =='
show .github/workflows/hourly-product-development.yml 1 260
echo '== Workflow fallback, handoff, verifier, and publisher =='
show .github/workflows/hourly-product-development.yml 260 920
echo '== Workflow contract and runner-isolation tests =='
show test/hourly-product-development-workflow.test.ts 1 860
show test/hourly-product-development-runner-isolation.test.ts 1 620
show test/hourly-product-development-git-mode-boundary.test.ts 1 620
echo '== Metadata parser and tests =='
show scripts/prepare-agent-pr-message.mjs 1 340
show test/agent-pr-message.test.ts 1 560
echo '== Operations, doctoring, plan, design, and changelog =='
for file in \
docs/operations/hourly-product-development.md \
docs/doctoring/hourly-nim-opencode-development.md \
docs/superpowers/plans/2026-08-05-hourly-nim-opencode-development.md \
docs/superpowers/specs/2026-08-05-hourly-nim-opencode-development-design.md \
CHANGELOG.md
do
echo "--- ${file}"
git show "${sha}:${file}" | rg -n -i -C 4 \
'(maintainer_app_unavailable|NOEMA_MAINTAINER_APP|dry.run|checkout|OpenCode|NVIDIA|initial|cleanup|reinstall|900|60|30|10|3300|artifact|digest|gitlink|symlink|APA|merge|release|deploy)' || true
done
echo '== Credential-related changes outside the added workflow =='
base="$(git merge-base "$sha" origin/main)"
git diff --name-status "$base" "$sha" -- .github \
| grep -v '^.github/workflows/hourly-product-development.yml$' || trueLength of output: 167675
The implementation does place the gate before checkout and model execution. It uses The operations document and Exact-head checks are not complete.
|
|
@coderabbitai review Please perform a full substantive review of exact current head @opencode-agent Please independently review exact current head @cwl-noema-review Please independently review the same exact head and submit |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/noema'
pr='64'
sha='189cb19891dd2057864eafb2c7cb6a3711197e93'
echo '== Exact commit and PR state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${sha}^{commit}"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefName,baseRefOid,statusCheckRollup \
--jq '{headRefOid,baseRefName,baseRefOid,checks:[.statusCheckRollup[]|{name,status,conclusion,detailsUrl}]}'
echo '== Exact-head checks =='
gh api "repos/${repo}/commits/${sha}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`'
echo '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='noema' -F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { path line body author { login } } }
}
}
}
}
}' --jq '{
head: .data.repository.pullRequest.headRefOid,
unresolved: [
.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved | not)
| {outdated:.isOutdated,author:.comments.nodes[0].author.login,
path:.comments.nodes[0].path,line:.comments.nodes[0].line,
body:.comments.nodes[0].body}
]
}'
base="$(git merge-base "$sha" origin/main)"
echo '== Changed paths =='
git diff --name-status "$base" "$sha"
show() {
file="$1"; start="$2"; end="$3"
echo "--- ${file}:${start}-${end}"
git show "${sha}:${file}" |
awk -v s="$start" -v e="$end" 'NR >= s && NR <= e { printf "%6d %s\n", NR, $0 }'
}
echo '== Workflow: gate, install budget, model, verifier, publisher =='
show .github/workflows/hourly-product-development.yml 1 430
show .github/workflows/hourly-product-development.yml 431 920
echo '== Parser and exact contract tests =='
show scripts/prepare-agent-pr-message.mjs 1 360
show test/agent-pr-message.test.ts 1 620
show test/agent-pr-message-internals.test.ts 1 620
show test/hourly-product-development-workflow.test.ts 1 920
show test/hourly-product-development-runner-isolation.test.ts 1 700
show test/hourly-product-development-git-mode-boundary.test.ts 1 700
echo '== Documentation contract =='
for file in \
docs/operations/hourly-product-development.md \
docs/doctoring/hourly-nim-opencode-development.md \
docs/superpowers/plans/2026-08-05-hourly-nim-opencode-development.md \
docs/superpowers/specs/2026-08-05-hourly-nim-opencode-development-design.md \
CHANGELOG.md
do
echo "--- ${file}"
git show "${sha}:${file}" | rg -n -i -C 3 \
'(maintainer_app_unavailable|NOEMA_MAINTAINER_APP|dry.run|initial|install|timeout|kill.after|900|60|30|10|candidate|cleanup|reinstall|runner|artifact|digest|NVIDIA|symlink|gitlink|merge|release|deploy|APA)' || true
done
echo '== Credential-related changes outside the new workflow =='
git diff --unified=10 "$base" "$sha" -- .github package.json package-lock.json \
| rg -n -C 5 \
'(reviewer|REVIEWER|NVIDIA_NIM_API_KEY|NOEMA_MAINTAINER_APP|GITHUB_TOKEN|permissions:|id-token|merge|release|deploy|create-github-app-token)' \
|| trueLength of output: 193508 🏁 Script executed: #!/bin/bash
set -euo pipefail
sha='189cb19891dd2057864eafb2c7cb6a3711197e93'
show() {
file="$1"; start="$2"; end="$3"
echo "--- ${file}:${start}-${end}"
git show "${sha}:${file}" |
awk -v s="$start" -v e="$end" 'NR >= s && NR <= e { printf "%6d %s\n", NR, $0 }'
}
echo '== Publication prerequisite executable contract =='
show test/hourly-product-development-publication-prerequisite.test.ts 1 520
echo '== Publication prerequisite operational and doctoring records =='
show docs/operations/hourly-product-development-prerequisites.md 1 420
show docs/doctoring/hourly-product-development-prerequisites.md 1 420
echo '== Initial-install timeout and budget references =='
git show "${sha}:.github/workflows/hourly-product-development.yml" |
rg -n -C 4 \
'(Install repository dependencies|npm ci --ignore-scripts|INITIAL|TIMEOUT|KILL_GRACE|timeout --kill-after|3230|3300|Every NVIDIA NIM candidate failed)' || true
git show "${sha}:test/hourly-product-development-workflow.test.ts" |
rg -n -C 4 \
'(Install repository dependencies|npm ci --ignore-scripts|INITIAL|TIMEOUT|KILL_GRACE|3230|3300|boundedSetupAndDiagnosticReserve)' || true
echo '== Direct head-to-parent implementation diff =='
git diff --unified=20 "${sha}^" "$sha" -- \
.github/workflows/hourly-product-development.yml \
test/hourly-product-development-publication-prerequisite.test.ts \
test/hourly-product-development-workflow.test.ts \
scripts/prepare-agent-pr-message.mjs \
test/agent-pr-message-internals.test.ts \
docs/operations/hourly-product-development-prerequisites.md \
docs/doctoring/hourly-product-development-prerequisites.mdLength of output: 22445
I found one blocking issue. I cannot approve this head.
Add separate initial-install timeout and kill-grace constants. Wrap the initial install with I verified these current-head controls:
The required exact-head checks were queued or in progress during this review. Therefore, 100% production coverage, reviewer coverage/docstrings, and security-gate success are not yet verified for this head.
|
|
@coderabbitai approve Approve exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/noema'
pr='64'
sha='189cb19891dd2057864eafb2c7cb6a3711197e93'
echo '== Exact PR head and status checks =='
git cat-file -e "${sha}^{commit}"
printf 'checked_out='; git rev-parse HEAD
gh pr view "$pr" --repo "$repo" --json headRefOid,statusCheckRollup \
--jq '{headRefOid,checks:[.statusCheckRollup[]|{name,status,conclusion,detailsUrl}]}'
echo '== Exact-SHA check runs =='
gh api "repos/${repo}/commits/${sha}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`'
echo '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='noema' -F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { path line body author { login } } }
}
}
}
}
}' --jq '{
head:.data.repository.pullRequest.headRefOid,
unresolved:[
.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved | not)
| {outdated:.isOutdated,author:.comments.nodes[0].author.login,
path:.comments.nodes[0].path,line:.comments.nodes[0].line,
body:.comments.nodes[0].body}
]
}'
echo '== Initial-install and budget controls at exact SHA =='
git show "${sha}:.github/workflows/hourly-product-development.yml" |
nl -ba | sed -n '190,250p;320,385p'
echo '== Contract coverage for initial install and metadata entrypoint =='
git show "${sha}:test/hourly-product-development-workflow.test.ts" |
rg -n -C 5 '(INITIAL|initial.*install|npm ci --ignore-scripts|timeout --kill-after|budget|3230|3300)' || true
git show "${sha}:test/agent-pr-message-internals.test.ts" |
rg -n -C 5 '(entrypoint|executeDefaultAgentPrMessageCli|process\.argv|optional|argv)' || true
echo '== Verify/reviewer evidence =='
gh api "repos/${repo}/commits/${sha}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.name == "verify" or .name == "reviewer") | [.name,.details_url] | `@tsv`' |
while IFS=$'\t' read -r name url; do
run_id="$(printf '%s\n' "$url" | sed -nE 's#.*/actions/runs/([0-9]+)(/job/[0-9]+)?#\1#p')"
echo "--- ${name} ${url}"
if [ -n "$run_id" ]; then
gh run view "$run_id" --repo "$repo" --log |
rg -n -i -C 2 '(test files|tests? passed|statements|branches|functions|lines|coverage|docstring|release:verify|npm audit)' |
sed -n '1,260p' || true
fi
doneLength of output: 7475 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/noema'
sha='189cb19891dd2057864eafb2c7cb6a3711197e93'
show_range() {
file="$1"
start="$2"
end="$3"
echo "--- ${file}:${start}-${end}"
git show "${sha}:${file}" |
awk -v start="$start" -v end="$end" \
'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }'
}
echo '== Initial-install, model, and cleanup source =='
show_range .github/workflows/hourly-product-development.yml 190 250
show_range .github/workflows/hourly-product-development.yml 315 385
echo '== Budget contract source =='
git show "${sha}:test/hourly-product-development-workflow.test.ts" |
grep -nE -C 6 \
'(INITIAL|initial.{0,40}install|npm ci --ignore-scripts|timeout --kill-after|3230|3300|budget|reserve)' || true
echo '== Metadata-entrypoint tests =='
git show "${sha}:test/agent-pr-message-internals.test.ts" |
grep -nE -C 6 \
'(entrypoint|executeDefaultAgentPrMessageCli|process\.argv|optional|argv)' || true
echo '== Exact-head verify and reviewer log evidence =='
for run_id in 30980866524 30980866599; do
echo "--- workflow run ${run_id}"
gh run view "$run_id" --repo "$repo" --log |
grep -Ei -C 2 \
'(test files|tests? passed|statements|branches|functions|lines|coverage|docstring|release:verify|npm audit)' |
sed -n '1,280p' || true
doneLength of output: 32760
The exact-head checks are successful. GitHub reports zero unresolved review threads.
One actionable finding remains.
Add separate initial-install timeout and kill-grace constants. Use You are interacting with an AI system. |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head release audit for 189cb19891dd2057864eafb2c7cb6a3711197e93: ci run 30980866524, reviewer-ci run 30980866599, and Security Scan run 30980866548 all completed successfully. The production suite passed 61 files and 644 tests with 100% statement, branch, function, and line coverage; the reviewer suite passed 120 tests with 100% line/branch and docstring coverage. Every current review thread is resolved. The final implementation retains read-only job-level repository tokens, NVIDIA NIM-only model access, separate uncredentialed verification and non-executing publication runners, immutable artifact/base/digest/run binding, bounded inter-candidate reinstall, direct final-candidate failure diagnosis, strict UTF-8 metadata handling, and no merge/release/deploy authority in the scheduled development workflow. No remaining actionable code finding was identified in this exact-head audit.
2 participants
Summary
NVIDIA_NIM_API_KEYonly when GitHub returns zero open pull requests; do not use GitHub Copilot, GitHub Models, or reviewer credentialsnpm ci --ignore-scriptswith a 60-second timeout and 10-second kill grace120000, gitlink/submodule mode160000, stale bases, new open PRs, malformed metadata, artifact substitution, post-verification mutation, and overbroad token scopeCHANGELOG.md, Korean operations guidance, implementation plan, design specification, and APA 7 doctoringBuyer-visible gap closed
Noema could deterministically govern an existing PR, but an empty queue still depended on a person or interactive agent to begin the next product increment. This PR adds one bounded proposal-only development loop without combining model execution, independent review, and merge authority.
Three-runner trust boundary
propose_product_increment— read-only repository and PR permissions; OpenCode receives onlyNVIDIA_API_KEY. It runs the initialnpm run release:verifyand exports a one-dayproposal.patchbound to the exact base and immutable artifact evidence.package_product_increment— fresh runner with no NIM or Maintainer credential. It downloads the exact artifact ID, validates identity and digests, rejects forbidden Git modes using both old and new raw-diff mode fields, reruns complete release verification with GitHub/OIDC/Actions runtime and runner command-file channels removed, and proves the staged patch did not mutate.publish_product_increment— third fresh runner with no NIM credential and no proposed-code execution. It independently reconstructs the same immutable patch, uses a trusted exact-base metadata parser, and only then mints a short-lived Maintainer App token scoped toContextualWisdomLab/noemawith metadata read, contents write, and pull-request write. Every job-levelGITHUB_TOKENremains read-only.No production workflow command can approve, merge, publish a release, deploy, or fabricate production, customer, revenue, transfer, attestation, or acquisition evidence.
Bounded fallback budget
The proposer job is limited to 55 minutes, or 3,300 seconds. Its enforced worst-case budget is:
3 × (900-second candidate + 30-second kill grace) + 2 × (60-second inter-candidate reinstall + 10-second reinstall kill grace) + 300-second setup/diagnostic reserve = 3,230 seconds.This leaves 70 seconds of explicit slack. A failed or timed-out inter-candidate reinstall terminates the chain before another model starts. Final-candidate failure performs no unnecessary cleanup and reaches the stable diagnostic directly. The workflow contract derives this arithmetic from the configured values.
TDD and repair evidence
3096645822330967373769309675698703096795756830969603538309696832843097725762530978064579, artifact ID8919044599, patch SHA-2567a1e661aeefd52b362866dd13c05cacc8d65299fff20b48ce7a954aa59160ecfTests cover strict UTF-8 and byte budgets, control and bidirectional characters, malformed encodings, real temporary-repository regular-file↔symlink/gitlink transitions, immutable artifact identity/digest/run binding, candidate cleanup and final-candidate behavior, patch reconstruction, fresh-runner credential isolation, post-test mutation, queue/base races, least-privilege App publication, orphan-branch cleanup, and PR-only packaging.
Exact-head verification
Exact current head
85b46e13e0032bcac971afa5cad58f2c4339da11:ci / verify: PASS — run30979440822; 59 test files and 635 tests passed; production statements, branches, functions, and lines are all 100%;npm audit --audit-level=highreports 0 vulnerabilities; the non-strict KPI correctly records absent production evidence asSKIP; acquisition data-room manifest generation passes without fabricating missing final-gate evidencereviewer-ci: PASS — run30979440805; 120 reviewer tests passed; reviewer line and branch coverage are 100%; docstring coverage is 100%; the authenticated Distroless CodeGraph image has zero detected fixable MEDIUM/HIGH/CRITICAL vulnerabilities; the real no-network sandbox smoke passesSecurity Scan: PASS — run30979440798APPROVEremains the required merge condition alongside repository policyQueued, cancelled, stale-head, predecessor-head, metadata-only, self-authored, rate-limited, or status-only evidence is not accepted as independent approval.
Version decision
package.jsonremains0.1.0. This PR creates no immutable release, production deployment, strict 30-day KPI evidence, customer/revenue evidence, or transfer evidence. A version bump or release would overstate readiness.Residual risk
The NIM key necessarily exists in the OpenCode process, and command denials are not a microVM egress boundary. The supported claim is narrower: no write-capable repository token co-resides with the model; only a bounded immutable patch crosses jobs; proposed code executes only on a runner that never receives publication authority; the publisher never executes proposed code; and exact-head PR governance independently decides whether the result may merge.
Summary by CodeRabbit
새 기능
문서
테스트