feat(sandbox): add quarantined patch validation - #65
Conversation
|
Warning Review limit reached
Next review available in: 9 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (27)
Comment |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
|
@coderabbitai review Please review exact current head |
|
I will treat findings on earlier heads as stale. I will focus on the specified security boundaries, validation logic, evidence limits, tests, documentation, and standards claims.
|
|
@opencode-agent @cwl-noema-review Independent exact-head review requested for |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Implement the valid exact-head CI finding on current head
|
|
@opencode-agent address Repair exact current head |
|
@coderabbitai review Please perform a substantive review of exact current head @opencode-agent @cwl-noema-review Independent exact-head review is requested for |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/noema"
pr="65"
base="9adb784902cae19a150146a8fadd6a0491f67814"
head="d29abd455759c1b8f3c4a5b04316395b4daff03f"
live_before="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
checked_out="$(git rev-parse HEAD)"
resolved_base="$(git rev-parse "${base}^{commit}")"
resolved_head="$(git rev-parse "${head}^{commit}")"
printf 'REVISION_BEFORE checked_out=%s resolved_base=%s resolved_head=%s live=%s\n' \
"$checked_out" "$resolved_base" "$resolved_head" "$live_before"
printf '\n== Changed files ==\n'
git diff --name-status "$resolved_base" "$resolved_head"
git diff --stat "$resolved_base" "$resolved_head"
printf '\n== Production structure ==\n'
ast-grep outline reviewer/noema_reviewer/patch_validation.py --items all --view signatures
printf '\n== Security-relevant symbols and call paths ==\n'
rg -n -C 5 \
'^(def (_validated_exact_tree_record|_stream_exact_tree|_verify|_materialize|_extract|_read|_run|_preflight|inspect_patch_bytes|validate)|class )|alternates|http-alternates|ls-tree|git archive|git status|O_NOFOLLOW|fstat|lstat|openat|Popen|PIPE|MAX_|MODE_METADATA_PATTERN|fullmatch|sha1|sha256|blob |--network|--read-only|--user=|cap-drop|no-new-privileges|--pull=never|result\.json|DEVNULL|GIT_NO_' \
reviewer/noema_reviewer/patch_validation.py
printf '\n== Exact-tree, archive, extraction, and object identity code ==\n'
rg -n -C 12 \
'(_validated_exact_tree_record|inventory|archive|extract|object_id|blob |hashlib|sha1|sha256|TarFile|tarfile|O_NOFOLLOW|fstat|lstat)' \
reviewer/noema_reviewer/patch_validation.py
printf '\n== Patch grammar and mode metadata code ==\n'
rg -n -C 10 \
'(inspect_patch_bytes|MODE_METADATA_PATTERN|diff --git|old mode|new mode|new file mode|deleted file mode|fullmatch|hunk|@@ |rename from|rename to|copy from|copy to)' \
reviewer/noema_reviewer/patch_validation.py
printf '\n== Docker and result-channel code ==\n'
rg -n -C 10 \
'(result\.json|docker|--network|--read-only|--user=|cap-drop|no-new-privileges|--pull=never|DEVNULL|timeout|Popen)' \
reviewer/noema_reviewer/patch_validation.py
printf '\n== Relevant test files ==\n'
fd -t f -a . reviewer/tests | rg 'patch_validation' | sort
rg -n -C 3 \
'def test_.*(alternate|tree|archive|extract|blob|sha|descriptor|result|docker|mode|path|hunk|bound|timeout|worktree)' \
reviewer/tests
printf '\n== Documentation and changelog claims ==\n'
rg -n -C 4 \
'(patch validation|exact tree|alternates|http-alternates|ls-tree|archive|Git blob|SHA-1|SHA-256|Docker|result\.json|APA|100%)' \
CHANGELOG.md docs README.md 2>/dev/null || true
printf '\n== Workflow privilege scan ==\n'
git diff --name-status "$resolved_base" "$resolved_head" -- .github/workflows
rg -n -i -C 3 \
'(contents:\s*write|permissions:.*write|repair[-_ ]?pr|self[-_ ]?modif|git push|gh pr|COPILOT_GITHUB_TOKEN)' \
.github 2>/dev/null || true
printf '\n== Check and review state ==\n'
gh pr view "$pr" --repo "$repo" --json reviewDecision,statusCheckRollup \
--jq '{reviewDecision, checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}'
printf '\n== Unresolved review threads ==\n'
gh api graphql -F owner='ContextualWisdomLab' -F name='noema' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)' || true
live_after="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
printf '\nREVISION_AFTER live=%s checked_out=%s\n' "$live_after" "$(git rev-parse HEAD)"
if [ "$checked_out" != "$resolved_head" ] ||
[ "$live_before" != "$resolved_base $resolved_head" ] ||
[ "$live_after" != "$resolved_base $resolved_head" ]; then
echo 'EXACT_REVISION_MISMATCH_OR_CHANGED' >&2
exit 2
fiLength of output: 196223 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/noema"
pr="65"
base="9adb784902cae19a150146a8fadd6a0491f67814"
head="d29abd455759c1b8f3c4a5b04316395b4daff03f"
before="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
test "$(git rev-parse HEAD)" = "$head"
test "$before" = "$base $head"
printf '%s\n' '== Production symbols =='
rg -n \
'^(def (_source_object_directory|_validated_exact_tree_record|_stream_exact_tree|_materialize|_verify_git_blob_identity|_read_regular|_run_git|inspect_patch_bytes|validate)|class (ExactTree|DockerPatch|PatchValidation))' \
reviewer/noema_reviewer/patch_validation.py
show_function() {
local symbol="$1"
local start
start="$(rg -n "^def ${symbol}\b" reviewer/noema_reviewer/patch_validation.py | head -1 | cut -d: -f1)"
if [ -n "$start" ]; then
sed -n "$((start-12)),$((start+240))p" reviewer/noema_reviewer/patch_validation.py
fi
}
printf '%s\n' '== Source object directory and alternates boundary =='
show_function "_source_object_directory"
printf '%s\n' '== Exact-tree record parser and streaming inventory =='
show_function "_validated_exact_tree_record"
show_function "_stream_exact_tree"
printf '%s\n' '== Archive materialization and extracted snapshot verification =='
show_function "_materialize"
show_function "_verify_git_blob_identity"
printf '%s\n' '== Patch parser =='
show_function "inspect_patch_bytes"
printf '%s\n' '== Validation orchestrator and Docker launch =='
show_function "validate"
printf '%s\n' '== Exact-tree/archive binding regressions =='
cat -n reviewer/tests/test_patch_validation_exact_tree_archive_binding.py
printf '%s\n' '== Alternate-object-database regressions =='
cat -n reviewer/tests/test_patch_validation_object_alternates_boundary.py
printf '%s\n' '== Blob identity edge regressions =='
cat -n reviewer/tests/test_patch_validation_blob_identity_edges.py
printf '%s\n' '== Mode metadata regressions =='
cat -n reviewer/tests/test_patch_validation_mode_boundaries.py
printf '%s\n' '== Result and Docker regressions =='
cat -n reviewer/tests/test_patch_validation_exact_tree_and_output.py
printf '%s\n' '== Public documentation: materialization and result sections =='
sed -n '24,130p' docs/quarantined-patch-validation.md
printf '%s\n' '== Doctoring: materialization and metadata sections =='
sed -n '41,160p' docs/doctoring/quarantined-patch-validation.md
after="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
printf 'REVISION_AFTER live=%s checked_out=%s\n' "$after" "$(git rev-parse HEAD)"
test "$after" = "$base $head"Length of output: 22995 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/noema"
pr="65"
base="9adb784902cae19a150146a8fadd6a0491f67814"
head="d29abd455759c1b8f3c4a5b04316395b4daff03f"
before="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
test "$(git rev-parse HEAD)" = "$head"
test "$before" = "$base $head"
printf '%s\n' '== Archive, extraction, and blob verification implementation =='
sed -n '1060,1417p' reviewer/noema_reviewer/patch_validation.py
printf '%s\n' '== Runner orchestration and Docker isolation implementation =='
sed -n '1418,1740p' reviewer/noema_reviewer/patch_validation.py
printf '%s\n' '== Exact-tree/archive binding regression assertions =='
sed -n '1,320p' reviewer/tests/test_patch_validation_exact_tree_archive_binding.py
printf '%s\n' '== Alternate-object-database regression assertions =='
sed -n '1,160p' reviewer/tests/test_patch_validation_object_alternates_boundary.py
printf '%s\n' '== Blob identity regression assertions =='
sed -n '1,380p' reviewer/tests/test_patch_validation_blob_identity_edges.py
printf '%s\n' '== Mode metadata regression assertions =='
sed -n '1,180p' reviewer/tests/test_patch_validation_mode_boundaries.py
printf '%s\n' '== Changed patch-validation files in the exact PR diff =='
git diff --unified=35 "$base" "$head" -- \
reviewer/noema_reviewer/patch_validation.py \
reviewer/tests/test_patch_validation_exact_tree_archive_binding.py \
reviewer/tests/test_patch_validation_object_alternates_boundary.py \
reviewer/tests/test_patch_validation_blob_identity_edges.py \
docs/quarantined-patch-validation.md \
docs/doctoring/quarantined-patch-validation.md \
CHANGELOG.md
printf '%s\n' '== Public documentation statements for inventory and blob identity =='
rg -n -C 3 \
'(inventory|exact Git tree|exact-tree|object ID|object identity|blob rehash|rehash|SHA-1|SHA-256|archive|extraction)' \
docs/quarantined-patch-validation.md docs/doctoring/quarantined-patch-validation.md CHANGELOG.md
after="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
printf 'REVISION_AFTER live=%s checked_out=%s\n' "$after" "$(git rev-parse HEAD)"
test "$after" = "$base $head"Length of output: 224205
I found one actionable documentation issue. I do not approve this PR. P2 — Document the exact-tree identity and alternate-object boundaries
However,
This omission is material because these controls close the source-substitution cases that the PR adds. Update both documents and the The requested base and head remained unchanged during inspection. The check rollup is successful for the primary CI, reviewer, and security jobs. That evidence does not replace an eligible independent approval or enforceable branch-protection evidence. You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/noema"
pr="65"
base="9adb784902cae19a150146a8fadd6a0491f67814"
head="d29abd455759c1b8f3c4a5b04316395b4daff03f"
live_before="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
checked_out="$(git rev-parse HEAD)"
resolved_base="$(git rev-parse "${base}^{commit}")"
resolved_head="$(git rev-parse "${head}^{commit}")"
printf 'REVISION_BEFORE checked_out=%s requested_base=%s requested_head=%s live=%s\n' \
"$checked_out" "$resolved_base" "$resolved_head" "$live_before"
printf '\n== Changed files ==\n'
git diff --name-status "$resolved_base" "$resolved_head"
printf '\n== Implementation outline ==\n'
ast-grep outline reviewer/noema_reviewer/patch_validation.py --items all --view signatures
printf '\n== Security-relevant implementation ==\n'
rg -n -C 5 \
'^(def (_source_object_directory|_validated_exact_tree_record|_consume_exact_tree_stream|_validated_source_archive_members|_verify_git_blob_identity|_materialize|_read|_run|inspect_patch_bytes|validate)|class )|alternates|http-alternates|ls-tree|git archive|git status|O_NOFOLLOW|fstat|lstat|MAX_|MODE_METADATA_PATTERN|fullmatch|sha1|sha256|blob |--network|--read-only|--user=|cap-drop|no-new-privileges|--pull=never|result\.json|DEVNULL|GIT_NO_' \
reviewer/noema_reviewer/patch_validation.py
printf '\n== Targeted implementation sections ==\n'
for symbol in _source_object_directory _validated_exact_tree_record _consume_exact_tree_stream _validated_source_archive_members _verify_git_blob_identity inspect_patch_bytes validate; do
line="$(rg -n "^def ${symbol}\b" reviewer/noema_reviewer/patch_validation.py | head -1 | cut -d: -f1 || true)"
if [ -n "$line" ]; then
start=$((line > 15 ? line - 15 : 1))
end=$((line + 210))
printf '\n== %s, Lines %s-%s ==\n' "$symbol" "$start" "$end"
sed -n "${start},${end}p" reviewer/noema_reviewer/patch_validation.py
fi
done
printf '\n== Boundary regression tests ==\n'
for file in \
reviewer/tests/test_patch_validation_exact_tree_archive_binding.py \
reviewer/tests/test_patch_validation_object_alternates_boundary.py \
reviewer/tests/test_patch_validation_blob_identity_edges.py \
reviewer/tests/test_patch_validation_mode_boundaries.py \
reviewer/tests/test_patch_validation_exact_tree_and_output.py; do
if [ -f "$file" ]; then
printf '\n== %s ==\n' "$file"
cat -n "$file"
fi
done
printf '\n== Documentation and CHANGELOG contract ==\n'
rg -n -C 5 \
'(alternate object|alternates|http-alternates|exact-tree|exact tree|inventory|archive|Git blob|blob identity|SHA-1|SHA-256|rehash|object ID|object-id)' \
docs/quarantined-patch-validation.md \
docs/doctoring/quarantined-patch-validation.md \
CHANGELOG.md
printf '\n== Workflow diff and privilege scan ==\n'
git diff --name-status "$resolved_base" "$resolved_head" -- .github/workflows
git diff -- "$resolved_base" "$resolved_head" -- .github/workflows
rg -n -i -C 2 \
'(contents:\s*write|permissions:.*write|repair[-_ ]?pr|self[-_ ]?modif|git push|gh pr|COPILOT_GITHUB_TOKEN)' \
.github 2>/dev/null || true
printf '\n== Check and thread state ==\n'
gh pr view "$pr" --repo "$repo" --json reviewDecision,statusCheckRollup \
--jq '{reviewDecision, checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}'
gh api graphql -F owner='ContextualWisdomLab' -F name='noema' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)' || true
live_after="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
printf '\nREVISION_AFTER checked_out=%s live=%s\n' "$(git rev-parse HEAD)" "$live_after"
if [ "$checked_out" != "$resolved_head" ] ||
[ "$live_before" != "$resolved_base $resolved_head" ] ||
[ "$live_after" != "$resolved_base $resolved_head" ]; then
echo 'EXACT_REVISION_MISMATCH_OR_CHANGED' >&2
exit 2
fiLength of output: 194965
I found one current actionable issue. I do not approve this PR. P2 — Document the exact-tree authentication controls
However, Update both documents and the The requested base and head remained unchanged during inspection. The relevant CI, reviewer, and security checks completed successfully. The skipped You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review exact current head Verify exact repository/base/head/patch binding, canonical UTF-8 patch metadata and hunk validation, governance-path refusal, descriptor-safe no-follow reads and inode stability, constant-space bounded Git status/tree output, alternate-object-database rejection, exact-tree/archive equality, Git blob rehashing for SHA-1/SHA-256, private staging, no-network/read-only/non-root Docker isolation, bounded result evidence, and complete credential separation. Submit actionable current-head findings or a substantive verdict. Do not infer branch-protection readiness or counted approval from status checks. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/noema"
pr="65"
base="9adb784902cae19a150146a8fadd6a0491f67814"
head="d29abd455759c1b8f3c4a5b04316395b4daff03f"
live_before="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
checked_out="$(git rev-parse HEAD)"
resolved_base="$(git rev-parse "${base}^{commit}")"
resolved_head="$(git rev-parse "${head}^{commit}")"
printf 'REVISION_BEFORE checked_out=%s resolved_base=%s resolved_head=%s live=%s\n' \
"$checked_out" "$resolved_base" "$resolved_head" "$live_before"
printf '\n== Changed files ==\n'
git diff --name-status "$resolved_base" "$resolved_head"
printf '\n== Production structure ==\n'
ast-grep outline reviewer/noema_reviewer/patch_validation.py --items all --view signatures
printf '\n== Security-relevant definitions and contexts ==\n'
rg -n -C 6 \
'^(def (_source_object_directory|_validated_exact_tree_record|_consume_exact_tree_stream|_validated_source_archive_members|_verify_git_blob_identity|_read|_run|inspect_patch_bytes|validate)|class )|alternates|http-alternates|git (status|ls-tree|archive)|O_NOFOLLOW|fstat|lstat|MAX_|MODE_METADATA_PATTERN|fullmatch|sha(1|256)|blob |--network|--read-only|--user=|cap-drop|no-new-privileges|--pull=never|result\.json|GIT_NO_' \
reviewer/noema_reviewer/patch_validation.py
printf '\n== Exact tree, archive, blob, patch, result, and Docker sections ==\n'
for symbol in \
_source_object_directory \
_validated_exact_tree_record \
_consume_exact_tree_stream \
_validated_source_archive_members \
_verify_git_blob_identity \
inspect_patch_bytes \
validate; do
line="$(rg -n "^def ${symbol}\b" reviewer/noema_reviewer/patch_validation.py | head -1 | cut -d: -f1 || true)"
if [ -n "$line" ]; then
start=$((line > 12 ? line - 12 : 1))
end=$((line + 230))
printf '\n== %s: Lines %s-%s ==\n' "$symbol" "$start" "$end"
sed -n "${start},${end}p" reviewer/noema_reviewer/patch_validation.py
fi
done
printf '\n== Boundary tests ==\n'
for file in \
reviewer/tests/test_patch_validation_exact_tree_archive_binding.py \
reviewer/tests/test_patch_validation_object_alternates_boundary.py \
reviewer/tests/test_patch_validation_blob_identity_edges.py \
reviewer/tests/test_patch_validation_mode_boundaries.py \
reviewer/tests/test_patch_validation_exact_tree_and_output.py; do
if [ -f "$file" ]; then
printf '\n== %s ==\n' "$file"
cat -n "$file"
fi
done
printf '\n== Public contract and workflow changes ==\n'
rg -n -C 5 \
'(alternate object|alternates|http-alternates|exact.tree|exact tree|inventory|archive|Git blob|blob identity|SHA-1|SHA-256|rehash|object ID|object-id|Docker|result)' \
docs/quarantined-patch-validation.md \
docs/doctoring/quarantined-patch-validation.md \
CHANGELOG.md
git diff --name-status "$resolved_base" "$resolved_head" -- .github/workflows
git diff -- "$resolved_base" "$resolved_head" -- .github/workflows
rg -n -i -C 2 \
'(contents:\s*write|permissions:.*write|repair[-_ ]?pr|self[-_ ]?modif|git push|gh pr|COPILOT_GITHUB_TOKEN)' \
.github 2>/dev/null || true
printf '\n== Checks and unresolved threads ==\n'
gh pr view "$pr" --repo "$repo" --json reviewDecision,statusCheckRollup \
--jq '{reviewDecision, checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}'
gh api graphql -F owner='ContextualWisdomLab' -F name='noema' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)' || true
live_after="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
printf '\nREVISION_AFTER checked_out=%s live=%s\n' "$(git rev-parse HEAD)" "$live_after"
if [ "$checked_out" != "$resolved_head" ] ||
[ "$live_before" != "$resolved_base $resolved_head" ] ||
[ "$live_after" != "$resolved_base $resolved_head" ]; then
echo 'EXACT_REVISION_MISMATCH_OR_CHANGED' >&2
exit 2
fiLength of output: 209957
The base and head remained unchanged during the review. I found one current actionable issue. I do not approve this PR. P2 — Document the full exact-tree authentication boundary
However, Update both documents and the
The CI, reviewer, and security checks completed successfully. The skipped You are interacting with an AI system. |
|
@coderabbitai review Please perform a substantive review of exact current head @opencode-agent @cwl-noema-review Independent exact-head review is also requested for |
|
Your plan includes PR reviews subject to rate limits. More reviews will be available in 7 minutes. |
|
Implement the valid exact-head CodeRabbit P2 documentation finding on current head Update
Keep the distinction among exact-tree authentication, archive allowlisting, post-extraction manifest equality, and Git blob identity verification precise. Do not claim the source object database itself is trusted beyond the explicitly documented residual-risk boundary. Preserve APA 7th citations, beginner-readable language, standalone/MSA compatibility, and the existing review-agent key contract. Do not add or restore any repair workflow, self-modifying Action, or workflow with branch-writing Run the documentation/format/link checks plus the full reviewer test, 100% production statement/branch coverage, and 100% public-docstring gates. After the new exact head exists, report the exact SHA and evidence; do not merge, enable auto-merge, resolve unrelated threads, or treat pending/queued checks as success. |
|
@coderabbitai review Please perform a substantive review of exact current head @opencode-agent @cwl-noema-review Independent review is requested for exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/noema"
pr="65"
base="9adb784902cae19a150146a8fadd6a0491f67814"
head="5c2e6762d07598094e5301c491d15ba83dcdcd51"
live_before="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
checked_out="$(git rev-parse HEAD)"
resolved_base="$(git rev-parse "${base}^{commit}")"
resolved_head="$(git rev-parse "${head}^{commit}")"
printf 'REVISION_BEFORE checked_out=%s base=%s head=%s live=%s\n' \
"$checked_out" "$resolved_base" "$resolved_head" "$live_before"
printf '\n== Changed files ==\n'
git diff --name-status "$resolved_base" "$resolved_head"
git diff --stat "$resolved_base" "$resolved_head"
printf '\n== Production structure ==\n'
ast-grep outline reviewer/noema_reviewer/patch_validation.py --items all --view signatures
printf '\n== Security-relevant definitions and contexts ==\n'
rg -n -C 6 \
'^(def (_source_object_directory|_validated_exact_tree_record|_consume_exact_tree_stream|_validated_source_archive_members|_verify_git_blob_identity|_read|_run|inspect_patch_bytes|validate)|class )|alternates|http-alternates|git (status|ls-tree|archive)|O_NOFOLLOW|fstat|lstat|MAX_|MODE_METADATA_PATTERN|fullmatch|sha(1|256)|blob |--network|--read-only|--user=|cap-drop|no-new-privileges|--pull=never|result\.json|GIT_NO_' \
reviewer/noema_reviewer/patch_validation.py
show_symbol() {
local symbol="$1"
local line
line="$(rg -n "^def ${symbol}\b" reviewer/noema_reviewer/patch_validation.py | head -1 | cut -d: -f1 || true)"
if [ -n "$line" ]; then
local start=$((line > 15 ? line - 15 : 1))
local end=$((line + 260))
printf '\n== %s: Lines %s-%s ==\n' "$symbol" "$start" "$end"
sed -n "${start},${end}p" reviewer/noema_reviewer/patch_validation.py
fi
}
for symbol in \
_source_object_directory \
_validated_exact_tree_record \
_consume_exact_tree_stream \
_validated_source_archive_members \
_verify_git_blob_identity \
inspect_patch_bytes \
validate; do
show_symbol "$symbol"
done
printf '\n== Boundary regression tests ==\n'
for file in \
reviewer/tests/test_patch_validation_exact_tree_archive_binding.py \
reviewer/tests/test_patch_validation_object_alternates_boundary.py \
reviewer/tests/test_patch_validation_blob_identity_edges.py \
reviewer/tests/test_patch_validation_mode_boundaries.py \
reviewer/tests/test_patch_validation_exact_tree_canonical_metadata.py \
reviewer/tests/test_patch_validation_exact_tree_and_output.py; do
if [ -f "$file" ]; then
printf '\n== %s ==\n' "$file"
cat -n "$file"
fi
done
printf '\n== Exact diff for implementation, tests, and contract documents ==\n'
git diff --unified=30 "$resolved_base" "$resolved_head" -- \
reviewer/noema_reviewer/patch_validation.py \
reviewer/tests \
docs/quarantined-patch-validation.md \
docs/doctoring/quarantined-patch-validation.md \
CHANGELOG.md
printf '\n== Documentation contract ==\n'
rg -n -C 5 \
'(alternate object|alternates|http-alternates|exact.tree|exact tree|inventory|archive|Git blob|blob identity|SHA-1|SHA-256|rehash|object ID|object-id|Docker|result)' \
docs/quarantined-patch-validation.md \
docs/doctoring/quarantined-patch-validation.md \
CHANGELOG.md
printf '\n== Workflow diff and privilege scan ==\n'
git diff --name-status "$resolved_base" "$resolved_head" -- .github/workflows
git diff -- "$resolved_base" "$resolved_head" -- .github/workflows
rg -n -i -C 2 \
'(contents:\s*write|permissions:.*write|repair[-_ ]?pr|self[-_ ]?modif|git push|gh pr|COPILOT_GITHUB_TOKEN)' \
.github 2>/dev/null || true
printf '\n== Checks, review decision, and unresolved threads ==\n'
gh pr view "$pr" --repo "$repo" --json reviewDecision,statusCheckRollup \
--jq '{reviewDecision,checks:[.statusCheckRollup[]|{name,status,conclusion,detailsUrl}]}'
gh api graphql -F owner='ContextualWisdomLab' -F name='noema' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)' || true
live_after="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
printf '\nREVISION_AFTER checked_out=%s live=%s\n' "$(git rev-parse HEAD)" "$live_after"
if [ "$checked_out" != "$resolved_head" ] ||
[ "$live_before" != "$resolved_base $resolved_head" ] ||
[ "$live_after" != "$resolved_base $resolved_head" ]; then
echo 'EXACT_REVISION_MISMATCH_OR_CHANGED' >&2
exit 2
fiLength of output: 144563 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/noema"
pr="65"
base="9adb784902cae19a150146a8fadd6a0491f67814"
head="5c2e6762d07598094e5301c491d15ba83dcdcd51"
before="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
test "$(git rev-parse HEAD)" = "$head"
test "$before" = "$base $head"
file="reviewer/noema_reviewer/patch_validation.py"
show_function() {
local symbol="$1"
local line
line="$(rg -n "^def ${symbol}\b" "$file" | head -1 | cut -d: -f1)"
printf '\n== %s (Line %s) ==\n' "$symbol" "$line"
nl -ba "$file" | sed -n "$((line > 10 ? line - 10 : 1)),$((line + 300))p"
}
printf '== Relevant constants, models, and helper definitions ==\n'
rg -n -C 4 \
'^(MAX_|TRUSTED_|PATCH_SANDBOX_|class (PatchValidation|ExactTree)|def (_read_regular|_read_result_payload|_verify_source_head|_verify_exact_tree_limits|_materialize_committed_source|_extract|_validated_source_archive_members|_verify_git_blob_identity|_docker|_source_object_directory))' \
"$file"
for symbol in \
_source_object_directory \
_verify_source_head \
_validated_exact_tree_record \
_consume_exact_tree_stream \
_materialize_committed_source \
_validated_source_archive_members \
_verify_git_blob_identity \
_read_result_payload \
validate; do
show_function "$symbol"
done
printf '\n== Exact-tree/archive/blob regression test names and assertions ==\n'
for file in \
reviewer/tests/test_patch_validation_exact_tree_archive_binding.py \
reviewer/tests/test_patch_validation_blob_identity_edges.py \
reviewer/tests/test_patch_validation_object_alternates_boundary.py; do
printf '\n== %s ==\n' "$file"
rg -n -C 4 '^def test_|assert |pytest\.raises' "$file"
done
printf '\n== Workflow changes introduced by this PR ==\n'
git diff --name-status "$base" "$head" -- .github/workflows
git diff --unified=5 "$base" "$head" -- .github/workflows
after="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
printf '\nREVISION_AFTER checked_out=%s live=%s\n' "$(git rev-parse HEAD)" "$after"
test "$(git rev-parse HEAD)" = "$head"
test "$after" = "$base $head"Length of output: 7547 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/noema"
pr="65"
base="9adb784902cae19a150146a8fadd6a0491f67814"
head="5c2e6762d07598094e5301c491d15ba83dcdcd51"
before="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
test "$(git rev-parse HEAD)" = "$head"
test "$before" = "$base $head"
file="reviewer/noema_reviewer/patch_validation.py"
show_function() {
local symbol="$1"
local line
line="$(rg -n "^def ${symbol}\b" "$file" | head -1 | cut -d: -f1)"
printf '\n== %s (Line %s) ==\n' "$symbol" "$line"
cat -n "$file" | sed -n "$((line > 10 ? line - 10 : 1)),$((line + 260))p"
}
for symbol in \
_source_object_directory \
_verify_source_head \
_validated_exact_tree_record \
_consume_exact_tree_stream \
_materialize_committed_source \
_validated_source_archive_members \
_verify_git_blob_identity \
_read_result_payload \
validate; do
show_function "$symbol"
done
printf '\n== Exact-tree/archive/blob regression assertions ==\n'
for test_file in \
reviewer/tests/test_patch_validation_exact_tree_archive_binding.py \
reviewer/tests/test_patch_validation_blob_identity_edges.py \
reviewer/tests/test_patch_validation_object_alternates_boundary.py; do
printf '\n== %s ==\n' "$test_file"
rg -n -C 4 '^def test_|assert |pytest\.raises' "$test_file"
done
printf '\n== Workflow files changed by this PR ==\n'
git diff --name-status "$base" "$head" -- .github/workflows
after="$(gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid --jq '.baseRefOid + " " + .headRefOid')"
printf '\nREVISION_AFTER checked_out=%s live=%s\n' "$(git rev-parse HEAD)" "$after"
test "$(git rev-parse HEAD)" = "$head"
test "$after" = "$base $head"Length of output: 99288 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/noema"
pr="65"
base="9adb784902cae19a150146a8fadd6a0491f67814"
head="5c2e6762d07598094e5301c491d15ba83dcdcd51"
printf 'checked_out=%s\n' "$(git rev-parse HEAD)"
gh pr view "$pr" --repo "$repo" --json baseRefOid,headRefOid \
--jq '{baseRefOid,headRefOid}'
test "$(git rev-parse HEAD)" = "$head"
test "$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')" = "$base"
test "$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')" = "$head"Length of output: 838
The base and head remained unchanged during the review. I found no actionable current-head issue in the requested scope. The previous P2 documentation finding is addressed. The public document, doctoring record, and
The reviewed implementation matches that contract. It also retains bounded Git output handling, strict patch metadata and path checks, single-file result evidence, exact request/result binding, private patch staging, and no-network, read-only, non-root Docker restrictions. The successful CI, reviewer, and security checks are supporting evidence. The skipped I do not issue formal approval. The available review evidence does not establish enforceable branch protection or an eligible independent approval. You are interacting with an AI system. |
|
Superseded by #93 after protected integration of #76. Fresh replacement head |
2 participants
Summary
Adds a credential-free, allowlisted patch-validation boundary for exact-head review evidence. Untrusted source, patch content, repository scripts, Git status and exact-tree output, archive metadata, extracted filesystem objects, and validator output remain outside GitHub App, reviewer-model, NVIDIA NIM, Cloudflare, OIDC, publication, deployment, and Docker-socket credentials.
Buyer-visible gap addressed
Noema could quarantine source for graph inspection but lacked a bounded contract for validating a proposed patch against an authenticated exact Git revision without crossing a credential boundary. This PR supplies that evidence plane while preserving separation among check runs, commit statuses, review evidence, model judgement, protected-branch approval, build provenance, release acceptance, and deployment authority.
Implemented boundary
--pull=never;blob <size>\0<bytes>with SHA-1/SHA-256 identity verification before Docker starts;CHANGELOG.md, and APA 7th standards doctoring.Exact-head acceptance evidence
Current exact head:
5c2e6762d07598094e5301c491d15ba83dcdcd51cirun31083752256: failure. The current run reaches the repository-wide dependency audit and fails on transitivenanoid@3.3.16under GHSA-2v37-7h3g-55p8 / CVE-2026-67213; remediation is tracked in fix(security): update transitive nanoid for CVE-2026-67213 #75. The earlier test and 100% coverage results remain useful diagnostic evidence but do not turn this CI run green;Security Scanrun31083752101: success;reviewer-cirun31083751990: success;CHANGELOG.md;9adb784902cae19a150146a8fadd6a0491f67814and exact head5c2e6762d07598094e5301c491d15ba83dcdcd51, confirmed the head remained unchanged, and reported no actionable current-head issue in the requested scope;CodeRabbitcommit status is retained as status evidence only; neither the status nor the review comment is a GitHubAPPROVE.Review and merge state
APPROVEcurrently exists.opencode-agentandcwl-noema-reviewwas rejected with HTTP 422 because one or both identities are not repository collaborators; mentions and model comments do not substitute for approval. Operational provisioning remains tracked by chore(operations): provision and activate hourly maintainer App #29.mainstill lacks acceptance evidence for an enforceable ruleset, current-head required checks and approval, direct-push rejection, and reviewed break-glass controls.Scope boundary
This PR adds a library and evidence contract. It does not yet publish or activate the dedicated patch-validator image in the reviewer decision flow. Image build, signature, SBOM, provenance, scan, runtime verification, and activation remain tracked separately by #66. No version bump or release is claimed.
Merge policy
Do not merge unless the live exact head remains current, every required check and security gate succeeds, all current findings are addressed, all threads are resolved, substantive exact-head review is complete, an eligible independent reviewer submits
APPROVE, and enforceable branch protection is evidenced. Queued, pending, unexpectedly skipped, cancelled, rate-limited, status-only, stale-head, or intentionally RED signals are not success, and no protection may be bypassed or weakened.Related: #9, #27, #29, #66, #75