feat(automation): route trusted review-agent mentions - #787
Conversation
|
Warning Review limit reached
Next review available in: 1 minute Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (15)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact head |
|
|
Pull request was converted to draft
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head reliability finding (valid, blocking the claimed receipt-based idempotency): dispatch_request() writes its only durable receipt after dispatching Noema, dispatching OpenCode, adding a reaction, and then posting the acknowledgement. If any later call fails after an earlier repository dispatch succeeds—for example, Noema succeeds and OpenCode or the reaction/comment call fails—the source comment remains unreceipted. The five-minute sweep retries it and dispatches the already-successful agent again. The current Noema repository-dispatch concurrency key is PR-scoped with cancel-in-progress: true, so this failure window can cancel/restart a legitimate review rather than merely producing a harmless duplicate.
Please fix test-first with fault injection at every external-call boundary. The durable protocol must track completion per requested agent and allow retrying only missing work. Because there is still an unavoidable crash window between a successful GitHub repository-dispatch response and recording that success, the downstream Noema/OpenCode entrypoints should also enforce idempotency using a deterministic key containing at least target_repository, PR number, exact head SHA, requested agent, and source_comment_id. Receipt/reaction failure must not cause completed agent work to be redispatched, and a partially completed request must not be treated as fully processed. Update the operator record and claim boundary accordingly; do not weaken the current exact-head or review-only controls.
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head blocking defect in the sibling-repository sweep: processed_comment_ids() accepts receipt markers only when the comment author is exactly github-actions[bot], but the scheduled sweep posts target-repository acknowledgements through TARGET_REPOSITORY_TOKEN (PR_REVIEW_MERGE_TOKEN, OPENCODE_APPROVE_TOKEN, or an OpenCode installation token). Those comments are authored by the PAT user or GitHub App bot—not by github-actions[bot]. Consequently, the next five-minute sweep does not recognize its own sibling-repository receipt and redispatches the same mention repeatedly for the entire lookback window (subject only to each run's dispatch cap). This also amplifies the partial-failure idempotency defect from my preceding review.
Please add a failing end-to-end sweep regression using realistic PAT and installation-bot acknowledgement identities, then bind receipt recognition to the authenticated target-token identity (or another durable, non-spoofable central receipt protocol) rather than a hard-coded local-workflow actor. Do not broadly trust arbitrary bot/user markers: a repository workflow or collaborator must not be able to forge a receipt and suppress a required review. Verify local github-actions[bot], cross-repository PAT, and installation-token paths, repeated sweep runs, mixed legitimate/forged markers, token rotation, and partial agent completion. The current head should not merge while the advertised organization sweep can create an unbounded redispatch loop.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headcf4400f7f8fe673f1f89c467a6629bd92dcaae2c. -
Head SHA:
cf4400f7f8fe673f1f89c467a6629bd92dcaae2c -
Workflow run: 31012190358
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: review-agent-comment-invocation.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: review-agent-comment-invocation.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headff02c877db5fbe2863f46b963b1d5c27b5acae37. -
Head SHA:
ff02c877db5fbe2863f46b963b1d5c27b5acae37 -
Workflow run: 31021490652
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (4 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: review-agent-comment-invocation.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: review-agent-comment-invocation.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (6 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (6 files)"]
R5 --> V5["targeted test run"]
|
@coderabbitai review Please review the exact current head |
|
|
Dismissed as stale predecessor-head evidence. This review requested changes against ff02c877db5fbe2863f46b963b1d5c27b5acae37 after its coverage-evidence failure. The current exact head is 8aa7101fdb6a9993e1699639362d6612f6cc42c5; Agent Mention Router Quality CI and every direct security and supply-chain workflow succeeded on that SHA, and the receipt-authority, partial-retry, wrapper routing, executable branch-validation, no-op dispatch-budget, and workflow-trigger defects identified during review were repaired. A new exact-current-head independent verdict is still required.
|
@coderabbitai review Read-only independent review request for exact current head Verify exact-head payload binding, deterministic per-agent invocation keys, central workflow-run ledger authority, partial retry of missing agents only, target acknowledgement non-authority, no-op dispatch-budget handling, realistic PAT/installation-token sweep behavior, wrapper-to-authoritative-agent routing, Bash-compatible base-branch validation, schedule-only organization sweep, least-privilege repository-dispatch permissions, review-only controls, 100% statement/branch/docstring evidence, APA 7 documentation, and the prohibition on approval, merge, release, branch update, or protection mutation. Submit APPROVE only if no blocker remains on this exact SHA. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Revision verification =='
git rev-parse HEAD
git rev-parse "f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae^{commit}"
git merge-base HEAD f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae
printf '%s\n' '== Changed files against requested base =='
git diff --name-status f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae..HEAD
printf '%s\n' '== Changed workflow and Python file outlines =='
git diff --name-only f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae..HEAD |
while IFS= read -r file; do
case "$file" in
*.py|*.yml|*.yaml)
printf '\n-- %s --\n' "$file"
ast-grep outline "$file" --items all 2>/dev/null || true
;;
esac
done
printf '%s\n' '== PR state, reviews, and checks =='
gh pr view 787 --repo ContextualWisdomLab/.github \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commitId:.commit.oid}],checks:[.statusCheckRollup[]|{name,conclusion,status,headSha}]}'Length of output: 16947 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Workflow files =='
for file in \
.github/workflows/agent-mention-router.yml \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml
do
printf '\n-- %s --\n' "$file"
cat -n "$file"
done
printf '%s\n' '== Router implementation =='
sed -n '1,520p' scripts/ci/agent_mention_router.py | cat -n
printf '%s\n' '== Sweep implementation =='
sed -n '1,340p' scripts/ci/agent_mention_sweep.py | cat -n
printf '%s\n' '== Workflow and idempotency test contracts =='
for file in \
tests/test_agent_mention_workflow_contract.py \
tests/test_agent_mention_downstream_idempotency.py \
tests/test_agent_mention_receipt_authority.py \
tests/test_agent_mention_idempotency.py \
tests/test_agent_mention_sweep.py
do
printf '\n-- %s --\n' "$file"
cat -n "$file"
done
printf '%s\n' '== Documentation =='
cat -n docs/automation/review-agent-comment-invocation.md
printf '%s\n' '== Exact-head check runs with failure details =='
gh api "repos/ContextualWisdomLab/.github/commits/8aa7101fdb6a9993e1699639362d6612f6cc42c5/check-runs?per_page=100" \
--jq '.check_runs[] | select(.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral") | {name,status,conclusion,details_url,started_at,completed_at,output}'
printf '%s\n' '== Branch protection and current review requirements =='
gh api "repos/ContextualWisdomLab/.github/branches/main/protection" \
--jq '{required_pull_request_reviews,required_status_checks,enforce_admins}' || trueLength of output: 110802 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Scorecard annotations =='
gh api "repos/ContextualWisdomLab/.github/check-runs/92497764086/annotations?per_page=100" \
--jq '.[] | {path,start_line,end_line,annotation_level,message,title,raw_details}'
printf '%s\n' '== Authoritative dispatch consumers and mutation controls =='
rg -n -i -C 4 \
'(repository_dispatch:|types:\s*\[?(noema-review|merge-scheduler)|event_type:\s*"(noema-review|merge-scheduler)"|enable_auto_merge|update_branches|merge_mode|agent_invocation_key)' \
.github/workflows
printf '%s\n' '== Wrapper-to-router key-field comparison =='
printf '%s\n' '-- Router key fields --'
sed -n '218,243p' scripts/ci/agent_mention_router.py | cat -n
printf '%s\n' '-- Noema wrapper payload validation and forward --'
sed -n '24,100p' .github/workflows/agent-mention-noema-dispatch.yml | cat -n
printf '%s\n' '-- OpenCode wrapper payload validation and forward --'
sed -n '24,122p' .github/workflows/agent-mention-opencode-dispatch.yml | cat -n
printf '%s\n' '== Exact-current-head reviews and requested reviewers =='
gh pr view 787 --repo ContextualWisdomLab/.github \
--json reviewRequests,reviews \
--jq '{reviewRequests:[.reviewRequests[]|.login],reviews:[.reviews[]|{author:.author.login,state,commitId:.commit.oid,submittedAt}]}'Length of output: 49837
Blocker: The wrapper workflows do not enforce the deterministic invocation key
Both wrappers validate only that
A principal that can create a central The Noema path has an additional identity gap. It omits Update both wrappers to:
I also verified the requested SHA and base SHA. GitHub still reports You are interacting with an AI system. |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head8aa7101fdb6a9993e1699639362d6612f6cc42c5. -
Head SHA:
8aa7101fdb6a9993e1699639362d6612f6cc42c5 -
Workflow run: 31064868373
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (4 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: review-agent-comment-invocation.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: review-agent-comment-invocation.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (6 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (6 files)"]
R5 --> V5["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head8aa7101fdb6a9993e1699639362d6612f6cc42c5. -
Head SHA:
8aa7101fdb6a9993e1699639362d6612f6cc42c5 -
Workflow run: 31064868373
-
Workflow attempt: 2
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (4 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: review-agent-comment-invocation.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: review-agent-comment-invocation.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (6 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (6 files)"]
R5 --> V5["targeted test run"]
|
@opencode-agent @cwl-noema-review @coderabbitai review Read-only independent review request for exact current head Every direct exact-head gate is successful: Agent Mention Router Quality CI Verify exact-head payload binding, deterministic per-agent invocation keys, central workflow-run ledger authority, partial retry of missing agents only, acknowledgement/reaction non-authority, no-op dispatch-budget handling, wrapper-to-authoritative-agent routing, Bash-compatible base-branch validation, schedule-only organization sweep, least-privilege repository-dispatch permissions, review-only controls, permanent 100% statement/branch/public-docstring evidence, and the prohibition on approval, merge, release, branch update, or protection mutation. Submit a formal APPROVE only if no blocker remains on this exact SHA; otherwise provide source-backed actionable findings. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae"
head="e0f2457ffb62f09b46c77e9ae19cfd01a624fef0"
repo="ContextualWisdomLab/.github"
printf '%s\n' '== Revision and change set =='
printf 'HEAD: '; git rev-parse HEAD
printf 'requested head exists: '; git rev-parse "${head}^{commit}"
printf 'base exists: '; git rev-parse "${base}^{commit}"
printf 'merge base: '; git merge-base HEAD "$base"
git diff --name-status "${base}..HEAD"
printf '%s\n' '== Relevant file discovery =='
fd -t f . .github/workflows scripts/ci tests docs 2>/dev/null |
rg '(agent[-_]mention|pr_review_fix_scheduler|review-agent-comment-invocation)'
printf '%s\n' '== Workflow outlines =='
for file in .github/workflows/agent-mention-router.yml \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml; do
if [ -f "$file" ]; then
printf '\n-- %s --\n' "$file"
ast-grep outline "$file" --items all 2>/dev/null || true
cat -n "$file"
fi
done
printf '%s\n' '== Python implementation outlines =='
for file in scripts/ci/agent_mention_router.py \
scripts/ci/agent_mention_sweep.py \
scripts/ci/pr_review_fix_scheduler.py; do
if [ -f "$file" ]; then
printf '\n-- %s --\n' "$file"
ast-grep outline "$file" --items all 2>/dev/null || true
cat -n "$file"
fi
done
printf '%s\n' '== Contract and regression tests =='
fd -t f . tests 2>/dev/null |
rg '(agent[-_]mention|pr_review_fix_scheduler)' |
while IFS= read -r file; do
printf '\n-- %s --\n' "$file"
cat -n "$file"
done
printf '%s\n' '== Invocation documentation =='
if [ -f docs/automation/review-agent-comment-invocation.md ]; then
cat -n docs/automation/review-agent-comment-invocation.md
fi
printf '%s\n' '== Exact-head GitHub state =='
gh pr view 787 --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews,reviewThreads,statusCheckRollup \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commitId:.commit.oid,submittedAt}],unresolvedThreads:[.reviewThreads[]|select(.isResolved|not)|{path,line,comments:[.comments[]|{author:.author.login,body}]}],checks:[.statusCheckRollup[]|{name,status,conclusion,headSha}]}'
printf '%s\n' '== Branch protection =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_pull_request_reviews,required_status_checks,enforce_admins,restrictions,required_linear_history,required_conversation_resolution}' || true
printf '%s\n' '== Current-head failed or non-success check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral") | {name,status,conclusion,details_url,output}'Length of output: 182794
Blocker: The wrappers still do not bind the invocation key to the payload
Both wrapper workflows only check that
Neither workflow recreates the canonical sorted JSON or compares its SHA-256 digest with The Noema path has an additional defect. Update both wrappers to reconstruct the router’s canonical JSON and reject a digest mismatch. Include
The repository revision and merge base match the requested SHAs. The GitHub-state query was inconclusive because
|
|
@opencode-agent @cwl-noema-review Please review exact head |
|
Exact-current-head review request for @opencode-agent |
|
@opencode-agent @cwl-noema-review Perform an independent formal exact-head review of |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
base="f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae"
head="e0f2457ffb62f09b46c77e9ae19cfd01a624fef0"
printf '%s\n' '== Revision verification =='
printf 'checkout HEAD: '; git rev-parse HEAD
printf 'requested HEAD: '; git rev-parse "${head}^{commit}"
printf 'base: '; git rev-parse "${base}^{commit}"
printf 'merge-base: '; git merge-base HEAD "$base"
printf '%s\n' '== Changed files =='
git diff --name-status "${base}..HEAD"
printf '%s\n' '== Candidate file discovery =='
fd -t f . .github/workflows scripts/ci tests docs 2>/dev/null |
rg '(agent[-_]mention|review-agent-comment-invocation|pr_review_fix_scheduler)' || true
printf '%s\n' '== Workflow structure =='
for file in .github/workflows/agent-mention-router.yml \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml; do
if [ -f "$file" ]; then
printf '\n-- %s --\n' "$file"
ast-grep outline "$file" --items all 2>/dev/null || true
cat -n "$file"
fi
done
printf '%s\n' '== Router and sweep structure =='
for file in scripts/ci/agent_mention_router.py scripts/ci/agent_mention_sweep.py; do
if [ -f "$file" ]; then
printf '\n-- %s --\n' "$file"
ast-grep outline "$file" --items all 2>/dev/null || true
cat -n "$file"
fi
done
printf '%s\n' '== Relevant tests and documentation =='
fd -t f . tests docs 2>/dev/null |
rg '(agent[-_]mention|review-agent-comment-invocation)' |
while IFS= read -r file; do
printf '\n-- %s --\n' "$file"
cat -n "$file"
done
printf '%s\n' '== Mutation and dispatch control search =='
rg -n -i -C 3 \
'(repository_dispatch|workflow_dispatch|schedule|contents:\s*write|pull-requests:\s*write|enable_auto_merge|update_branches|merge_mode|agent_invocation_key|base_branch|merge|release|branch protection)' \
.github/workflows scripts/ci docs/automation 2>/dev/null || true
printf '%s\n' '== PR state, current reviews, and check rollup =='
gh pr view 787 --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commitId:.commit.oid,submittedAt}],checks:[.statusCheckRollup[]|{name,status,conclusion,headSha}]}'
printf '%s\n' '== Protected-branch requirements =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_pull_request_reviews,required_status_checks,enforce_admins,required_conversation_resolution}' || trueLength of output: 203119 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
head="e0f2457ffb62f09b46c77e9ae19cfd01a624fef0"
printf '%s\n' '== Router key and payload definitions =='
rg -n -C 12 \
'def agent_invocation_key|def noema_payload|def opencode_payload|base_branch|invocation_key|dispatch' \
scripts/ci/agent_mention_router.py
printf '%s\n' '== Wrapper invocation validation and forwarding =='
for file in .github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml; do
printf '\n-- %s --\n' "$file"
rg -n -C 16 \
'(agent_invocation_key|INVOCATION_KEY|base_branch|sha256sum|sort_keys|repository_dispatch|event_type|enable_auto_merge|update_branches|merge_mode|permissions:|contents:)' \
"$file"
done
printf '%s\n' '== Router and sweep execution boundaries =='
for file in .github/workflows/agent-mention-router.yml scripts/ci/agent_mention_sweep.py; do
printf '\n-- %s --\n' "$file"
rg -n -C 10 \
'(schedule|workflow_dispatch|issue_comment|repository_dispatch|contents:|dispatch budget|dispatch_limit|queued|association|bot|acknowledg|reaction|workflow runs|workflow_run|credential|token|base.branch)' \
"$file"
done
printf '%s\n' '== Targeted invocation regression tests =='
fd -t f . tests |
rg 'agent_mention' |
while IFS= read -r file; do
printf '\n-- %s --\n' "$file"
rg -n -C 8 \
'(invocation.key|base.branch|digest|sha256|wrapper|payload|partial|ledger|budget|acknowledg|reaction)' \
"$file" || true
done
printf '%s\n' '== Workflow trigger and permission declarations =='
rg -n -C 5 \
'^(name:|on:|permissions:|[[:space:]]+contents:|[[:space:]]+workflow_dispatch:|[[:space:]]+schedule:|[[:space:]]+repository_dispatch:)' \
.github/workflows/agent-mention-*.yml
printf '%s\n' '== Exact-head failed or incomplete check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral") | {id,name,status,conclusion,details_url,output}'
printf '%s\n' '== Scorecard annotations on exact-head Scorecard failures =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.name == "Scorecard" and .conclusion == "failure") | .id' |
while IFS= read -r run_id; do
[ -n "$run_id" ] || continue
printf '\n-- check run %s --\n' "$run_id"
gh api "repos/${repo}/check-runs/${run_id}/annotations?per_page=100" \
--jq '.[] | {path,start_line,end_line,annotation_level,message,title}'
done
printf '%s\n' '== Unresolved PR review threads =='
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number=787 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false) | {path,line,comments:[.comments.nodes[]|{author:.author.login,body}]}'Length of output: 71163
P1 — Wrapper workflows do not bind the invocation key to the payload
Both wrapper workflows only validate that
Neither wrapper reconstructs the sorted canonical JSON or compares its SHA-256 digest with The Noema path has an additional identity omission. Update both wrappers to recreate the router’s canonical JSON and fail when the calculated digest differs from Current-head gate stateThe exact-head check state does not support approval:
The Scorecard failure has four
The check can be reassessed after the key-binding repair and after all exact-head required checks complete successfully. You are interacting with an AI system. |
Dismissed as stale: this request-changes review is anchored to predecessor head 8aa7101. The current exact head e0f2457 adds the missing scheduler import-fallback regression and has a successful exact-head Agent Mention Router Quality CI plus all direct security and supply-chain checks. A fresh current-head review remains required.
2 participants
Purpose
Provide a central, bounded comment-invocation surface for the existing Noema and OpenCode review planes without copying privileged implementation into product repositories.
Product behavior
@cwl-noema-reviewand review-only@opencode-agentcomments;OWNER,MEMBER, orCOLLABORATORidentities and reject bot-authored requests;issue_commentevents into their default branches;enable_auto_merge=false,update_branches=false, andmerge_mode=disabledcontrols;workflow_dispatchentrypoint remains;ubuntu-24.04runners and immutableactions/checkoutv7.0.1 pins;contents: writeonly to jobs and wrapper workflows that call GitHub's create-repository-dispatch endpoint, while workflow defaults remain read-only and the existing review-agent credential chain remains unchanged;Reliability and security repairs
Review-driven regressions now prove the complete distributed idempotency boundary:
Exact-head verification
Current exact head:
8aa7101fdb6a9993e1699639362d6612f6cc42c5.Current protected base:
f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae.Successful on this exact head:
31063991508;31063991507;31063991539;31063991515;31063991514;31063991505;31063991708;31063991525;31063991502;The predecessor-head OpenCode request-changes review for
ff02c877db5fbe2863f46b9639362d6612f6cc42c5does not exist; the dismissed stale review was anchored toff02c877db5fbe2863f46b963b1d5c27b5acae37and its failed coverage run. It was dismissed only after the current exact head passed the complete focused and security gates. A new exact-current-head CodeRabbit, OpenCode, Noema, and qualifying non-author verdict remains required.Integration boundary
The router is a control-plane invocation surface only. Existing Noema and OpenCode workflows retain reviewer identity, credential resolution, model policy, findings, approvals, and merge policy. Wrapper workflows forward each deterministic exact-key invocation at most once to those authoritative planes. Standalone product repositories require no copied privileged implementation.
Merge acceptance
Do not merge until a qualifying independent non-author approval is anchored to exact head
8aa7101fdb6a9993e1699639362d6612f6cc42c5and branch protection permits merge without administrative bypass. Prior-head reviews, author comments, stale requested-changes verdicts, successful checks without a current verdict, rate-limit notices, target-repository acknowledgements, and reactions are not approval evidence.Supersedes the unique mention-router slice of closed predecessor #757; no predecessor approval or check is reused.