fix(strix): bootstrap complete runtime evidence for #952 - #1133
fix(strix): bootstrap complete runtime evidence for #952#1133seonghobae wants to merge 13 commits into
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent Execute the bounded prerequisite described in this PR on its current branch. The temporary |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| cancel-in-progress: false | ||
|
|
||
| permissions: | ||
| contents: write |
| && github.ref == 'refs/heads/fix/strix-base-runtime-contract-952') | ||
| ) | ||
| permissions: | ||
| contents: write |
* test(ci): reproduce unreviewed merge-conflict dispatch gap * fix(ci): dispatch bounded OpenCode conflict repair before review * ci: enable bounded unreviewed conflict dispatch * ci: scan central pull requests for OpenCode repair hourly * test(ci): cover central hourly conflict repair contracts * docs(ci): record unreviewed conflict-repair safety decision * fix(ci): preserve legacy scheduler callers and diagnostics * fix(ci): make self-target validation safe under unset variables * test(ci): cover unset-safe self-target authorization * test(ci): allow conflict-policy keyword in scheduler branch stub * test(ci): prove queue reaches bounded conflict worker --------- Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current heade6aadff4ea1ceefe2cc90fad45b66d1bf06b2d04. -
Head SHA:
e6aadff4ea1ceefe2cc90fad45b66d1bf06b2d04 -
Workflow run: 32204527513
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["CI script (4 files)"]
S2 --> I2["review and security gate shell path"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test: test_strix_952_runtime_contract.py"]
S3 --> I3["regression suite"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage evidence job did not run or did not publish coverage evidence. Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["CI script (4 files)"]
S2 --> I2["review and security gate shell path"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test: test_strix_952_runtime_contract.py"]
S3 --> I3["regression suite"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["targeted test run"]
Merge Conflict Guidance
gh pr checkout 1133 --repo ContextualWisdomLab/.github
git fetch origin bootstrap/strix-952-branch-repair
git merge --no-ff origin/bootstrap/strix-952-branch-repair # or: git rebase origin/bootstrap/strix-952-branch-repair
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/strix-base-runtime-contract-952
# rebase path only: git push --force-with-lease origin HEAD:fix/strix-base-runtime-contract-952 |
* feat(automation): run nonnest2 hourly NVIDIA NIM review repair Add a thin minute-16 caller for ContextualWisdomLab/nonnest2 on protected master. The caller maps only established scheduler credentials, grants job-scoped OIDC, and leaves NVIDIA_NIM_API_KEY on the reusable worker. * fix(ci): resolve nonnest2 caller conflict with current main * fix(ci): preserve current architecture while adding nonnest2 caller * fix(ci): merge nonnest2 quality paths with current main * chore(ci): reconcile changelog with current main * chore(ci): reconcile agent guidance with current main
…y<49 pin (#1121) Admin-merged. The 'strix' check failure on this PR is a structural bootstrapping limitation, not a real problem with the fix: strix.yml is itself the trusted required workflow this PR is fixing, and pull_request_target-triggered required workflows run the BASE branch's version against a PR (documented in this repo's own CLAUDE.md), so a PR editing strix.yml can never show green for its own strix check until merged -- the fix only takes effect for future PRs afterward. The stale CHANGES_REQUESTED review (targeting an old head SHA, predating the pip-audit and strix.yml fixes) was dismissed after confirming it doesn't apply to the current head. Verified locally before every push: pip install --dry-run succeeds for the real strix-agent install, and this repo's full test suite (1208 tests) is green. Bypassing enforce_admins (disabled on this branch this iteration, same authorization already used for contextual-orchestrator) since it's the same structural blocker.
e6aadff to
c77aa55
Compare
|
Current-head repair (2026-08-19) Rebased onto current main and pushed c77aa55. Root cause was stale trusted Strix source plus a fail-open outer wrapper. The repair directly applies runtime compatibility/report-authority checks, keeps provider-specific fallback in the trusted gate, makes incomplete provider evidence fail closed, updates contracts, and removes transient branch-writer bootstrap workflows/helpers. Evidence: full pytest 1219 passed, 16 subtests; focused Strix 30 passed, 16 subtests; required smoke passed; actionlint on .github/workflows/strix.yml passed; shell syntax and diff check passed. Please review exact head and rerun protected checks. |
|
@opencode-agent @cwl-noema-review Please perform a fresh read-only review of exact current head |
|
Current-head evidence for PR #1133: c77aa55. REST check-runs for this exact SHA report 16 completed checks with no failure/cancellation, including coverage-evidence, coverage-source-tree, OpenCode review, Noema review, Strix, and required-workflow-bootstrap. The remaining protected gate is review state: the visible OpenCode CHANGES_REQUESTED review is for predecessor e6aadff, and no qualifying independent approval is visible for c77aa55. A fresh exact-head independent review is still required; no bypass or self-approval is being used. |
|
Closing this stacked bootstrap branch as superseded. #1121 has already merged to protected |
github-project-automation
Bot
moved this from In Progress
to Done
in naruon Platform Roadmap
2 participants
Purpose
Bootstrap the trusted
pull_request_targetStrix runtime contract required before #1121 can install its PR-headstrix-agent==1.5.3hashed lock.Bounded scope
--no-depsso stale transitive metadata cannot re-resolve the cryptography override;strix_runsoutput;This PR intentionally does not change the Strix version lock and does not include #969/#1051 pip-audit work. #1121 remains the version/override PR and should be updated only after this base-executed runtime prerequisite lands.
Refs #952 and #1121.