fix: keep cross-repo OpenCode evidence healthy - #939
Conversation
📝 WalkthroughWalkthrough교차 저장소 상태 공개, Python lock materialization, trusted uv 다운로드, Strix 제공자 증거 처리를 fail-closed 방식으로 변경했다. 관련 계약 테스트와 운영 문서를 갱신했다. ChangesOpenCode 리뷰 검증
신뢰된 Python lock materialization
Strix 증거 게이트
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: 🟡 Moderate · up to Nested lock files may be skipped during dependency evidence collection, which can leave trusted coverage bootstrap evidence incomplete; merge should wait until the collection logic handles repository-relative lock-file paths correctly. Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent review Perform a fresh read-only semantic review of exact current head Focus on the static fixed-URL/fixed-User-Agent uv request boundary, no-proxy/no-redirect behavior, bounded download/checksum/version enforcement, and the cross-repository OpenCode App status-publication guard. Verify that optional status publication cannot substitute for exact-head formal review or weaken branch protection. Review only; do not mutate, self-approve, enable auto-merge, or merge. |
|
@coderabbitai review Please perform a fresh read-only semantic review of exact current head Focus on the new fail-closed cross-repository status guard: unavailable |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='f97b9a44201633d2a94bf73c6bb7fde900135553'
base_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
repo='ContextualWisdomLab/.github'
pr_number='939'
echo '== Commit identity and ancestry =='
git cat-file -e "${head_sha}^{commit}"
git cat-file -e "${base_sha}^{commit}"
printf 'HEAD parent/base relationship: '
git merge-base --is-ancestor "$base_sha" "$head_sha" && echo yes || echo no
printf 'merge-base: '
git merge-base "$base_sha" "$head_sha"
printf 'checked-out HEAD: '
git rev-parse HEAD
echo '== Changed files and exact diff =='
git diff --name-status "$base_sha" "$head_sha"
git diff --unified=80 "$base_sha" "$head_sha" -- \
.github/workflows/opencode-review-dispatch.yml \
tests/test_opencode_agent_contract.py
echo '== Workflow outline and relevant control-flow context =='
ast-grep outline .github/workflows/opencode-review-dispatch.yml --items all || true
rg -n -C 12 --glob 'opencode-review-dispatch.yml' \
'github\.token|opencode-app|commit.status|statuses|reviews|pulls|PR_HEAD_SHA|APPROVED|CHANGES_REQUESTED|exit 1|exit 0|repository_dispatch' \
.github/workflows/opencode-review-dispatch.yml
echo '== Contract-test context =='
ast-grep outline tests/test_opencode_agent_contract.py --items all || true
rg -n -C 10 \
'github\.token|opencode-app|commit.status|statuses|reviews|PR_HEAD_SHA|APPROVED|CHANGES_REQUESTED|exit.?1|exit.?0' \
tests/test_opencode_agent_contract.py
echo '== Live PR identity, reviews, and check rollup =='
gh pr view "$pr_number" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],checks:[.statusCheckRollup[]|{name,conclusion,status,workflowName}]}'Length of output: 161212 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='f97b9a44201633d2a94bf73c6bb7fde900135553'
base_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
repo='ContextualWisdomLab/.github'
pr_number='939'
echo '== Commit ancestry =='
printf 'base ancestor of head: '
git merge-base --is-ancestor "$base_sha" "$head_sha" && echo yes || echo no
printf 'merge-base: '; git merge-base "$base_sha" "$head_sha"
printf 'current checkout: '; git rev-parse HEAD
echo '== Exact changed hunks: status-publication guard =='
git diff --unified=30 "$base_sha" "$head_sha" -- .github/workflows/opencode-review-dispatch.yml |
sed -n '/Publish repository_dispatch OpenCode status/,+130p'
echo '== Exact changed hunks: regression contract =='
git diff --unified=30 "$base_sha" "$head_sha" -- tests/test_opencode_agent_contract.py |
sed -n '1,260p'
echo '== Guard source with line numbers =='
nl -ba .github/workflows/opencode-review-dispatch.yml |
sed -n '7828,7895p'
echo '== Exact-head Strix workflow runs =='
gh run list --repo "$repo" --workflow strix.yml --commit "$head_sha" --limit 20 \
--json databaseId,event,status,conclusion,headSha,url,workflowName \
--jq '.[] | {databaseId,event,status,conclusion,headSha,url,workflowName}'
echo '== Current branch-protection requirements =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_linear_history,allow_force_pushes,allow_deletions}' \
|| trueLength of output: 13167 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head_sha='f97b9a44201633d2a94bf73c6bb7fde900135553'
echo '== Current exact-head Strix runs =='
gh run list --repo "$repo" --workflow strix.yml --commit "$head_sha" --limit 20 \
--json databaseId,event,status,conclusion,headSha,url,workflowName \
--jq '.[] | {databaseId,event,status,conclusion,headSha,url,workflowName}'
echo '== Branch protection: required checks and reviews =='
gh api "repos/${repo}/branches/main/protection" |
jq '{
required_status_check_contexts: (.required_status_checks.contexts // []),
strict_required_status_checks: (.required_status_checks.strict // null),
required_approving_review_count: (.required_pull_request_reviews.required_approving_review_count // 0),
dismiss_stale_reviews: (.required_pull_request_reviews.dismiss_stale_reviews // false),
require_code_owner_reviews: (.required_pull_request_reviews.require_code_owner_reviews // false),
require_last_push_approval: (.required_pull_request_reviews.require_last_push_approval // false),
enforce_admins: (.enforce_admins.enabled // false)
}'
echo '== Current live PR review and check state =='
gh pr view 939 --repo "$repo" --json headRefOid,reviews,statusCheckRollup \
--jq '{
head: .headRefOid,
reviews: [.reviews[] | {author:.author.login,state,commit:.commit.oid}],
active_or_non_success_checks: [
.statusCheckRollup[]
| select(.status != "COMPLETED" or ((.conclusion // "") | ascii_upcase | IN("SUCCESS","SKIPPED","NEUTRAL") | not))
| {name,status,conclusion,workflowName}
]
}'Length of output: 2589
I found no source-level defect in the new cross-repository status-publication guard.
The regression contract checks the required guard structure and failure path. It is static coverage. It does not execute mocked API failure or review-payload cases. Live verification is incomplete:
Therefore, the statement that all exact-head checks are terminal-success is not supported by the live data. I did not approve, merge, enable auto-merge, or modify repository state. I applied the existing exact-current-head evidence rule during this review. 🧠 Learnings used
|
|
@opencode-agent review Perform a fresh read-only semantic review of exact current head Review the fail-closed exact-head formal-review guard and the subsequent Strix outage-gate changes as one current tree. Keep source-review evidence distinct from workflow/provider evidence. Do not mutate, self-approve, enable auto-merge, dismiss reviews, weaken gates, or merge. |
|
@coderabbitai review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='939'
head='ac5665148bb113f92e97d2fc49a729bca2f050b5'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Exact commit identity =='
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
printf 'checked-out head: '; git rev-parse HEAD
printf 'base is ancestor: '; git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
printf 'merge base: '; git merge-base "$base" "$head"
echo '== Changed files =='
git diff --name-status "$base" "$head"
echo '== Focused exact diff =='
git diff --unified=45 "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_trusted_uv_download_contract.py \
.github/workflows/opencode-review-dispatch.yml \
tests/test_opencode_agent_contract.py
echo '== Python module outline =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all || true
echo '== Trusted uv request and enforcement context =='
rg -n -C 14 --glob 'materialize_base_python_requirements.py' \
'TRUSTED_UV_DOWNLOAD|Request\(|urlopen\(|ProxyHandler|HTTPRedirectHandler|timeout|read\(|sha256|checksum|version|extract' \
scripts/ci/materialize_base_python_requirements.py
echo '== Trusted uv contract context =='
ast-grep outline tests/test_trusted_uv_download_contract.py --items all || true
rg -n -C 10 \
'Request|urlopen|User-Agent|TRUSTED_UV_DOWNLOAD|ProxyHandler|HTTPRedirectHandler|timeout|sha256|version' \
tests/test_trusted_uv_download_contract.py
echo '== Status-publication guard context =='
rg -n -C 16 --glob 'opencode-review-dispatch.yml' \
'Publish repository_dispatch OpenCode status|github\.token|opencode-app|reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit 1|exit 0|statuses|commit.status' \
.github/workflows/opencode-review-dispatch.yml
echo '== Status-guard contract context =='
rg -n -C 10 \
'github\.token|opencode-app|reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit.?1|exit.?0|status' \
tests/test_opencode_agent_contract.py
echo '== Live PR exact-head state =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{
number,state,isDraft,mergeable,headRefOid,baseRefOid,
reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],
checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName,headSha}]
}'
echo '== Branch protection, if readable =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{
required_status_checks: (.required_status_checks // null),
required_pull_request_reviews: (.required_pull_request_reviews // null),
enforce_admins: (.enforce_admins.enabled // null)
}' || echo 'Branch-protection query was unavailable.'Length of output: 156484 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='ac5665148bb113f92e97d2fc49a729bca2f050b5'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Checkout and ancestry =='
printf 'checkout='; git rev-parse HEAD
printf 'merge_base='; git merge-base "$base" "$head"
printf 'base_ancestor='; git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
echo '== Changed paths at exact revisions =='
git diff --name-status "$base" "$head"
echo '== Exact trusted uv diff =='
git diff --unified=25 "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_trusted_uv_download_contract.py
echo '== Exact trusted uv implementation =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
nl -ba |
sed -n '/TRUSTED_UV_DOWNLOAD/,/^[[:space:]]*def /p'
echo '== Exact trusted uv contract functions =='
git show "${head}:tests/test_trusted_uv_download_contract.py" |
nl -ba |
sed -n '/test_urlopen_receives_one_static_release_request/,/^[[:space:]]*def /p'
echo '== Exact status guard diff =='
git diff --unified=28 "$base" "$head" -- \
.github/workflows/opencode-review-dispatch.yml \
tests/test_opencode_agent_contract.py |
sed -n '/Publish repository_dispatch OpenCode status/,+180p'
echo '== Exact status guard implementation =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
nl -ba |
sed -n '7828,7918p'
echo '== Exact status guard contract =='
git show "${head}:tests/test_opencode_agent_contract.py" |
nl -ba |
sed -n '1997,2053p'Length of output: 12650 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='ac5665148bb113f92e97d2fc49a729bca2f050b5'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
numbered_range() {
start="$1"
end="$2"
awk -v start="$start" -v end="$end" 'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }'
}
echo '== Trusted uv downloader and enforcement =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
numbered_range 55 285
echo '== Trusted uv request contract =='
git show "${head}:tests/test_trusted_uv_download_contract.py" |
numbered_range 1 180
echo '== Exact cross-repository status guard =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
numbered_range 7828 7918
echo '== Exact cross-repository status contract =='
git show "${head}:tests/test_opencode_agent_contract.py" |
numbered_range 1997 2053
echo '== Strix exact diff and contracts =='
git diff --unified=30 "$base" "$head" -- \
.github/workflows/strix.yml \
tests/test_required_workflow_queue_contract.py \
tests/test_strix_nvidia_nim_not_found_fallback.pyLength of output: 48876
I found no blocking source-level defect.
Trusted
Cross-repository commit-status limitation
Strix outage gate
Live evidence
I applied the existing exact-current-head evidence rule during this review. I did not modify repository state, approve, merge, release, dismiss reviews, or change protections. 🧠 Learnings usedYou are interacting with an AI system. |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current-head read-only review request for ac5665148bb113f92e97d2fc49a729bca2f050b5 against protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
This is now the canonical repair after closing superseded #943. Review the combined causal boundaries: fixed-origin static User-Agent for trusted uv bootstrap; proof of an exact-head formal OpenCode review before tolerating unavailable cross-repository status publication; and fail-closed Strix behavior when provider evidence is incomplete. Nine directly observed exact-head hosted workflows, including Trusted uv Materializer Quality CI, are terminal-success and no inline thread exists.
Do not transfer #943 evidence, update this branch, synthesize author approval, neutralize missing security evidence, or bypass protection.
|
Canonical exact-current-head review dispatch for Review the combined root-cause repair only: fixed-origin static Keep this request read-only. Do not update the branch, synthesize author approval, merge, release, neutralize missing security evidence, or weaken protection. @coderabbitai review |
Rate Limit Exceeded
|
|
@opencode-agent review Review exact current head |
Rate Limit Exceeded
|
Cite RFC 9110 and NIST SP 800-53 for the static User-Agent, exact-head review proof, and Strix incomplete-evidence failure. Isolate Darwin installer tests on the linux x86_64 path.
|
Reviewed. CHANGELOG + APA 7th doctoring for User-Agent pin, exact-head review proof before skipping cross-repo status, and fail-closed Strix outage. Local suite 976 passed x2. Auto-merge armed. |
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='939'
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Revision identity and ancestry =='
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
printf 'checkout='; git rev-parse HEAD
printf 'merge_base='; git merge-base "$base" "$head"
printf 'base_is_ancestor='; git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
echo '== Scoped changes =='
git diff --name-status "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
.github/workflows/opencode-review-dispatch.yml \
.github/workflows/strix.yml \
scripts/ci/strix_quick_gate.sh \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirement_paths.py \
tests/test_trusted_uv_download_contract.py \
tests/test_opencode_agent_contract.py \
tests/test_required_workflow_queue_contract.py \
tests/test_strix_nvidia_nim_not_found_fallback.py \
tests/test_strix_internal_scope_instruction_contract.py
echo '== Materializer map =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all || true
echo '== Trusted uv and requirements collector =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
nl -ba | sed -n '40,365p;475,545p'
echo '== Trusted uv and lock-discovery contracts =='
for file in \
tests/test_trusted_uv_download_contract.py \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirement_paths.py
do
echo "--- ${file}"
git show "${head}:${file}" |
rg -n -C 8 'Request|User-Agent|urlopen|ProxyHandler|HTTPRedirectHandler|sha256|64 \* 1024|version|base_hash_locks|_is_candidate_lock_path|requirements/ci\.txt|service/requirements/package\.txt|relative'
done
echo '== OpenCode status guard and contract =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
rg -n -C 18 'Publish repository_dispatch OpenCode status|github\.token|opencode-app|reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit 1|exit 0|statuses|commit.status'
git show "${head}:tests/test_opencode_agent_contract.py" |
rg -n -C 10 'reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit.?1|exit.?0|status'
echo '== Strix controls and contracts =='
for file in \
.github/workflows/strix.yml \
scripts/ci/strix_quick_gate.sh \
tests/test_required_workflow_queue_contract.py \
tests/test_strix_nvidia_nim_not_found_fallback.py \
tests/test_strix_internal_scope_instruction_contract.py
do
echo "--- ${file}"
git show "${head}:${file}" |
rg -n -i -C 10 'provider|backend|unavailable|not found|nim|quota|token limit|incomplete|neutral|exit 1|exit 0|instruction|internal.*scope|sandbox|caller'
done
echo '== PR head, reviews, and checks =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}]}'
echo '== Unresolved review threads, first page =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
-f query='query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){reviewThreads(first:100){nodes{isResolved isOutdated path line} pageInfo{hasNextPage}}}}}' \
--jq '{unresolved:[.data.repository.pullRequest.reviewThreads.nodes[]|select(.isResolved|not)|{path,line,isOutdated}],hasNextPage:.data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage}'
echo '== Exact-head runs for requested workflows =='
for workflow in \
'Trusted uv Materializer Quality CI' 'Strix' 'CodeQL PR' 'Python Security' \
'Security Scan' 'SAST Semgrep' 'Secret Scan' 'OSV-Scanner PR' \
'Scorecard PR' 'SBOM Generation'
do
echo "--- ${workflow}"
gh run list --repo "$repo" --workflow "$workflow" --commit "$head" --limit 10 \
--json status,conclusion,headSha,workflowName,url \
--jq '.[]|{status,conclusion,headSha,workflowName,url}' || true
done
echo '== Branch protection, if readable =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_status_checks:(.required_status_checks//null),required_pull_request_reviews:(.required_pull_request_reviews//null)}' || trueLength of output: 7992 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='939'
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
show_range() {
local file="$1" start="$2" end="$3"
git show "${head}:${file}" |
awk -v start="$start" -v end="$end" 'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }'
}
echo '== Trusted uv download, verification, and requirements discovery =='
show_range scripts/ci/materialize_base_python_requirements.py 40 365
show_range scripts/ci/materialize_base_python_requirements.py 475 545
echo '== Trusted uv request and requirements discovery contracts =='
for file in \
tests/test_trusted_uv_download_contract.py \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirement_paths.py
do
echo "--- ${file}"
git show "${head}:${file}" |
rg -n -C 8 'Request|User-Agent|urlopen|ProxyHandler|HTTPRedirectHandler|sha256|64 \* 1024|version|base_hash_locks|_is_candidate_lock_path|requirements/ci\.txt|service/requirements/package\.txt|relative'
done
echo '== Exact OpenCode status-publication guard and contract =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
rg -n -C 20 'Publish repository_dispatch OpenCode status|github\.token|opencode-app|reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit 1|exit 0|statuses|commit.status'
git show "${head}:tests/test_opencode_agent_contract.py" |
rg -n -C 10 'reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit.?1|exit.?0|status'
echo '== Strix failure and internal-scope controls =='
for file in \
.github/workflows/strix.yml \
scripts/ci/strix_quick_gate.sh \
tests/test_required_workflow_queue_contract.py \
tests/test_strix_nvidia_nim_not_found_fallback.py \
tests/test_strix_internal_scope_instruction_contract.py
do
echo "--- ${file}"
git show "${head}:${file}" |
rg -n -i -C 10 'provider|backend|unavailable|not found|nim|quota|token limit|incomplete|neutral|exit 1|exit 0|instruction|internal.*scope|sandbox|caller'
done
echo '== Direct static counts =='
materializer="$(git show "${head}:scripts/ci/materialize_base_python_requirements.py")"
printf 'Request constructions: '; printf '%s\n' "$materializer" | grep -c 'urllib\.request\.Request('
printf 'urlopen calls: '; printf '%s\n' "$materializer" | grep -c 'urllib\.request\.urlopen('
printf 'classifier calls within base_hash_locks: '
printf '%s\n' "$materializer" | awk '/^def base_hash_locks\(/,/^def /' | grep -c '_is_candidate_lock_path('
echo '== Current PR state, reviews, and rollup =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}]}'
echo '== Unresolved review threads, first page =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
-f query='query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){reviewThreads(first:100){nodes{isResolved isOutdated path line} pageInfo{hasNextPage}}}}}' \
--jq '{unresolved:[.data.repository.pullRequest.reviewThreads.nodes[]|select(.isResolved|not)|{path,line,isOutdated}],hasNextPage:.data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage}'
echo '== Exact-head workflow runs =='
for workflow in \
'Trusted uv Materializer Quality CI' 'Strix' 'CodeQL PR' 'Python Security' \
'Security Scan' 'SAST Semgrep' 'Secret Scan' 'OSV-Scanner PR' \
'Scorecard PR' 'SBOM Generation'
do
echo "--- ${workflow}"
gh run list --repo "$repo" --workflow "$workflow" --commit "$head" --limit 10 \
--json status,conclusion,headSha,workflowName,url \
--jq '.[]|{status,conclusion,headSha,workflowName,url}' || true
done
echo '== Branch protection, if readable =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_status_checks:(.required_status_checks//null),required_pull_request_reviews:(.required_pull_request_reviews//null)}' || trueLength of output: 112772 🏁 Script executed: #!/bin/bash
set -u
repo='ContextualWisdomLab/.github'
pr='939'
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
show_range() {
local file="$1" start="$2" end="$3"
git show "${head}:${file}" |
awk -v start="$start" -v end="$end" 'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }'
}
echo '== Materializer request and path classifier =='
show_range scripts/ci/materialize_base_python_requirements.py 40 125
show_range scripts/ci/materialize_base_python_requirements.py 215 330
show_range scripts/ci/materialize_base_python_requirements.py 475 535
echo '== Complete requirement discovery regression =='
git show "${head}:tests/test_materialize_base_python_requirement_paths.py" |
awk '{printf "%6d %s\n", NR, $0}'
echo '== Exact OpenCode status-publication guard =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
awk '
/name: Publish repository_dispatch OpenCode status/ {active=1}
active {printf "%6d %s\n", NR, $0}
active && /^ - name: / && $0 !~ /Publish repository_dispatch OpenCode status/ {exit}
'
echo '== Guard contract =='
git show "${head}:tests/test_opencode_agent_contract.py" |
rg -n -C 12 'Publish repository_dispatch OpenCode status|reviews\?per_page|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|review.*evidence|exit.?1|exit.?0'
echo '== Current PR state and review evidence =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews \
--jq '{number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}]}'
echo '== Unresolved review threads, first page =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
-f query='query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){reviewThreads(first:100){nodes{isResolved isOutdated path line} pageInfo{hasNextPage}}}}}' \
--jq '{unresolved:[.data.repository.pullRequest.reviewThreads.nodes[]|select(.isResolved|not)|{path,line,isOutdated}],hasNextPage:.data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage}' || true
echo '== Exact-head workflow runs =='
for workflow in \
'Trusted uv Materializer Quality CI' 'Strix' 'CodeQL PR' 'Python Security' \
'Security Scan' 'SAST Semgrep' 'Secret Scan' 'OSV-Scanner PR' \
'Scorecard PR' 'SBOM Generation'
do
printf '%s: ' "$workflow"
gh run list --repo "$repo" --workflow "$workflow" --commit "$head" --limit 10 \
--json status,conclusion,headSha \
--jq '[.[]|{status,conclusion,headSha}]' || true
done
echo '== Branch protection, if readable =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_status_checks:(.required_status_checks//null),required_pull_request_reviews:(.required_pull_request_reviews//null)}' || trueLength of output: 64302
I found no blocking source-level defect in the requested scope.
The trusted
The cross-repository OpenCode status guard remains fail-closed.
The current live review list has no qualifying OpenCode formal review for this head. The guard will therefore fail closed if the limited-token cross-repository path runs. It will not treat optional status publication as substitute review evidence. The Strix controls remain bounded and fail-closed.
Live evidence:
I did not execute repository code or tests. I did not modify source, approve, merge, release, alter protections, or enable auto-merge. You are interacting with an AI system. |
Dismissed solely as stale predecessor-head evidence: this review is bound to 56dbb09, while the unchanged current head is 38cb3b9. The cited cancelled/failed checks do not transfer; current-head checks and review threads must still satisfy protected-main rules. This dismissal is not an approval and does not weaken any current finding.
|
Exact-current-head read-only review request for All observed exact-head quality, security, supply-chain, trusted-uv, and bounded Strix workflows are terminal-success and the only source-backed thread is resolved. Recheck the combined causal boundaries: fixed static User-Agent at the immutable Astral archive origin; exact-base regular-blob lock discovery for conventional requirements paths with bounded includes; formal exact-head review authority before optional cross-repository status tolerance; and static trusted Strix scope instruction with no caller-controlled text. Do not transfer predecessor findings, mutate the branch, synthesize approval, or merge. @opencode-agent review |
Rate Limit Exceeded
|
|
Cross-repository Strix semantic-evidence defect reproduced from Inkspan and needs to be handled at this central owner boundary rather than patched in the leaf. Exact leaf evidence:
The proposed remedy contradicts the leaf's explicit contract rather than identifying an implementation escape: Inkspan ADR Central acceptance criterion for the Strix path: semantic findings that propose an authorization/ownership policy must be checked against the target repository's authoritative AGENTS/accepted ADR/public contract before being emitted as a source vulnerability. If the proposed fix conflicts with an explicit leaf ownership contract and there is no independent source-backed bypass of that contract, Strix should abstain/reclassify rather than fabricate a vulnerability. This must remain fail-closed for real traversal or path-authority escapes. Please cover this with a central regression using the Inkspan boundary above, then re-run the exact-current Inkspan head after the central fix; the expected result is no path-traversal finding merely because |
Resolve #939 conflicts with #782 by keeping trusted-uv User-Agent, path-aware lock discovery, exact-head formal-review proof, and fail-closed Strix provider evidence, while retaining hourly NVIDIA NIM repair, conflict-scope symlink refusal, and the independent review-workflow blob pin advanced to the #939 revision. Co-authored-by: Seongho Bae <[email protected]>
|
Merged current Resolution kept both sides:
No gate was weakened. Predecessor checks and earlier reviews must not transfer to this head. |
Do not cancel in-flight required scan-pr-queue runs, and run the OpenCode required-workflow stub jobs in parallel, so a later same-head success is not hidden behind a cancelled or queued required check. Co-authored-by: Seongho Bae <[email protected]>
|
Current-head follow-up: the rollup was red with zero failed jobs. Root cause was a cancelled required
|
|
Correction: the exact head is |
Update the leftover concurrency assertion so it requires cancel-in-progress: false instead of the cancelled-required-check expression. Co-authored-by: Seongho Bae <[email protected]>
|
Exact head is now |
|
Pushed The previous head ( This head keeps the four gates and only changes the required-workflow queue contract:
Local contract tests for those files passed. Do not transfer predecessor reviews; this SHA still needs its own exact-head formal review. Two qualifying independent approvals including last-push approval are still required. I am not merging. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Approve #939 at f74e4f7114487adcd77f24b9fc1a27505d92d46c.
This head keeps the fail-closed gates: trusted-uv static User-Agent, exact SHA-256 or bounded relative -r includes only, path-aware requirements/ lock discovery, exact-head formal OpenCode review before cross-repo status skip, and Strix red on incomplete provider evidence. The latest increment stops cancelling required scan-pr-queue runs and runs the OpenCode stub jobs in parallel so a later same-head success is not hidden behind a cancelled or queued required check.
Local evidence on this head: 169 focused contract, materialize, Strix, trusted-uv, and OpenCode agent tests passed.
Next action: do not push another commit unless a required exact-head check fails. When every required check on this SHA is terminal-success, complete the two independent last-push approvals and merge through the protected ruleset. Do not bypass, dismiss, or transfer predecessor-head evidence.
After merge, the next increment should tell operators that a close event no longer cancels in-flight required scans, and inspect_pr should skip a closed --pr-number leftover instead of attempting mutation. Keep #1020 stacked behind this merge; both edit scripts/ci/materialize_base_python_requirements.py.
Sent by Cursor Automation: fix all
|
Fresh exact-head observation for Failed/cancelled/timed-out check runs on this SHA: none. The earlier PR-body note that Python Security and CodeQL were still queued is now superseded: both workflow runs completed success ( The only remaining non-terminal required check is Scheduler evidence:
I am not pushing, not transferring predecessor reviews, and not merging. Next required evidence is the remaining OpenCode stub plus an exact-head OpenCode formal review, then the second qualifying independent last-push approval. |
|
Fresh Context Fabric canary exposes a broader cross-repository materialization boundary on a protected-default target. Consumer:
The exact head currently has only 7 check-runs total, all repository-local: the Python test matrix/package evidence plus the protected-main attestation job (skipped because this is a PR). There is no exact-head This is non-passing under the consumer ruleset and must not be repaired with a dummy source commit, synthetic status, self-approval, or gate weakening. Please include this canary when validating the protected-main cross-repository evidence path: a ready PR targeting the current protected default branch must materialize every applicable required workflow on the unchanged exact head, and review workflows must bind any formal verdict to that same head. Context Fabric will revalidate #4 only after the central repair lands; predecessor/local-only checks will not be transferred. |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Not an approval. Exact-head observation for f74e4f7114487adcd77f24b9fc1a27505d92d46c: every applicable quality/security check is terminal-success except the latest required scan-pr-queue, which is cancelled on run 31962167848. Earlier same-head scan-pr-queue successes do not satisfy GitHub because the latest conclusion wins.
This COMMENT review is only to wake a fresh PR-scoped scheduler run on the unchanged head. Do not transfer predecessor reviews, do not push merely to retrigger, and do not treat the cancelled leftover as a product failure. Main still cancels in-flight required scans; this branch already sets cancel-in-progress: false for after merge.
|
Latest required REST Scheduler decision on that success was I did not push, did not approve, and am not merging. Do not push merely to retrigger. |
|
Re-checked
I am not pushing, not approving, and not merging. A new commit would only recreate main’s cancel-in-progress race. |
3 participants
Summary
This PR repairs central cross-repository review evidence without weakening a gate.
requirements*.txtlocks and direct.txtchildren of repository-relativerequirements/directories from the authenticated exact base commit while keeping lock validation separate from path eligibility.Existing test-first evidence
31784776654established the bounded-scope contract and passed the focused/complete central harness after repair.31787913977established the missing requirements-lock paths before repair and then passed focused validation.Downstream contradiction 1 — Inkspan #197: omitted repository-local dependency became a synthetic HIGH
Exact downstream evidence:
ContextualWisdomLab/inkspan#197exact target headb13209ff9832c6ac0c8239b29e12720a9895eab4;31906069281, attempt 2, job95151082222;office/src/inkspan_office/cli.py;Missing Safe Renderer Component Leading to Potential Office Document Rendering Vulnerabilities;ModuleNotFoundError: No module named 'inkspan_office.safe_renderer'because the bounded workspace did not contain that unchanged dependency;office/src/inkspan_office/safe_renderer.py; repository CI31906069634, Security Scan31906069670, and SAST Semgrep31906069692all succeeded.This is a central evidence contradiction: a deliberately omitted unchanged dependency was converted into a source vulnerability. Repair acceptance is a bounded trusted repository-local dependency closure from authenticated source identity, or an explicit context-insufficiency/abstention classification when scope omission prevents source-backed judgment. Do not broaden to an unbounded checkout, execute target code to discover imports, synthesize a clean result, or weaken the required gate. Add a regression shaped like
cli.py -> .safe_rendererand preserve exact-head/source provenance.Downstream contradiction 2 — Inkspan #246: scanner invented host authorization authority
Exact downstream evidence:
ContextualWisdomLab/inkspan#246predecessor target head9eebccbd95008d1ac25fec7bd730d92654d3cf07;31843901859, job94906388922;office/src/inkspan_office/safe_renderer.py;Path Traversal in write_office_document Function;base_directoryparameter.That proposed invariant conflicts with Inkspan's accepted authority boundary:
write_office_document()publishes to a caller-selected path while the embedding host owns directory authorization, tenant path isolation, quotas, retention, encryption, and distribution. Central acceptance is to provide bounded authenticated authority/context when available or abstain/classify context insufficiency when exploitability depends on an authorization boundary absent from the scanned component. Preserve detection of genuine symlink/race/extension/publication failures; do not fabricate a host policy, mutate product code to satisfy scanner-authored authority, synthesize a clean result, or weaken Strix.Downstream contradiction 3 — Inkspan #141: delegated DOCX hyperlink validation was omitted and reported as missing
Exact downstream evidence:
ContextualWisdomLab/inkspan#141exact target headd1148b4980c689e1a1a0fb6e7dc092f17ac60225;31872469049, Strix job94983150711;9244047394, digestsha256:d8252393e302cccf568d57b27bdffd7e6c86cfc55c3f10c3b3f34c0ef0d5bfbf;Missing DOCX Input Validation in Inkspan Office Renderer Leading to Potential SSRF and Data Exfiltration;safe_renderer.pylacked DOCX-specific rich-runhrefvalidation and proposed duplicating a DOCX validator in that facade;safe_renderer.pydelegates deterministic rendering torenderer.render_office_document()after facade-level cross-format safety checks;renderer.pyalready implements_validate_docx_hyperlink_target()with a 4096-character ceiling, printable-ASCII/backslash rejection, strict absolute HTTP(S) scheme/host checks, credential rejection, and invokes it from_add_docx_rich_paragraph()before creating the external relationship;31872470055, Security Scan31872470056, and SAST Semgrep31872470050all succeeded on that exact head.This is the same dependency-closure failure class as #197, but with a delegated security invariant rather than a missing import. The bounded workspace omitted the unchanged module that actually owns the validation, then the model interpreted omitted dependency context as missing product validation.
Central acceptance for this class:
safe_renderer.render_office_document -> renderer._render_docx -> _add_docx_rich_paragraph -> _validate_docx_hyperlink_target;Until this exact central contradiction is repaired and proven by downstream reruns, the affected historical Strix failures remain non-passing evidence but are not source-backed Inkspan vulnerabilities.
Current exact-head evidence
Current exact head remains
f74e4f7114487adcd77f24b9fc1a27505d92d46c. Previous prose naming predecessor38cb3b9c4dd9febc475ecdc2f71c0c354032be5cas current is superseded.Fresh exact-head observations previously established Security Scan, OSV-Scanner PR, Hourly NVIDIA NIM Review Repair, Strix Changed Path Quality CI, Scorecard PR, SAST Semgrep, Secret Scan, Trusted uv Materializer Quality CI, and SBOM Generation success. Python Security and CodeQL PR were still queued at that observation and therefore non-passing. Formal review state included one current APPROVED review from
cursor; older predecessor review evidence is not transferred.Merge boundary
Live repository rules require two approving reviews, stale-review dismissal after push, latest-push approval by someone other than the pusher, and review-thread resolution. Merge only after the unchanged current head has every applicable exact-head workflow terminal-success, two qualifying independent approvals satisfying the latest-push condition, and no unresolved review thread. Do not push merely to retrigger approval, transfer predecessor evidence, weaken policy, or use administrator bypass.