fix(automation): replay isolated review-agent queues on current main - #835
fix(automation): replay isolated review-agent queues on current main#835seonghobae wants to merge 12 commits into
Conversation
|
Warning Review limit reached
Next review available in: 53 minutes Limit details: You’ve used all 1 included review currently available under your plan. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. 📝 WalkthroughWalkthrough워크플로 전역 동시성을 제거하고 인터랙티브 멘션과 조직 스윕에 작업별 동시성 그룹을 적용했습니다. 큐 동작을 검증하는 테스트와 동시성 격리 설계·운영·롤백 문서를 추가했습니다. Changes에이전트 멘션 동시성 격리
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review the unchanged exact head |
|
|
|
@coderabbitai review Re-review only the unchanged exact head |
|
I will limit the review to the bounded five-file agent-mention concurrency isolation repair. I will not use evidence from superseded
|
|
@coderabbitai review Please review only the unchanged exact head |
|
I will limit the review to the bounded five-file agent-mention concurrency-isolation repair. I will not reuse evidence from superseded PR
|
|
@coderabbitai review Please review only unchanged exact head |
|
I will limit the review to the five-file agent-mention concurrency-isolation repair. I will not use evidence from superseded PR ✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
docs/doctoring/agent-mention-concurrency-isolation.md (1)
106-108: 🚀 Performance & Scalability | 🔵 TrivialLine 106의 큐 지연 경보에 시간 임계값을 추가하세요.
queue: max는 대기 항목 수를 최대 100개로 제한하지만, Line 106의bounded queue delay에 대한 시간 상한을 정의하지 않습니다. GitHub 문서도 이 설정을 대기 수 제한으로 설명하고 한도 초과 실행을 취소한다고 설명합니다. (docs.github.com)큐 대기시간 임계값과 한도 초과·취소 신호를 문서에 명시하세요. 그렇지 않으면 긴 대기시간을 정상 상태로 분류할 수 있습니다.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/doctoring/agent-mention-concurrency-isolation.md` around lines 106 - 108, 대화형 큐 경보 항목에 큐 대기시간의 명시적 상한을 추가하고, 100개 pending 한도 초과 및 실행 취소 신호도 함께 문서화하세요. 기존 bounded queue delay 표현을 구체적인 시간 임계값과 한도 초과 시 동작으로 갱신하되, 관련 메트릭의 유한 카디널리티 요구사항은 유지하세요.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/doctoring/agent-mention-concurrency-isolation.md`:
- Line 90: Update the Change management entry in
agent-mention-concurrency-isolation.md to mark independent review as pending
rather than completed, consistent with the stated objective that formal review
evidence is not yet available. Link the supporting evidence only after
independent review and post-integration acceptance are complete.
In `@tests/test_agent_mention_workflow_contract.py`:
- Line 83: tests/test_agent_mention_workflow_contract.py의 해당 assertion을 보강해
workflow 헤더의 루트 concurrency 키를 모든 위치에서 검출하세요. 첫 줄의 concurrency:와 concurrency:
<value> 같은 매핑·스칼라 형식을 모두 거부하도록 키 경계와 값 형식을 함께 검사하고, 기존 허용 범위는 유지하세요.
---
Nitpick comments:
In `@docs/doctoring/agent-mention-concurrency-isolation.md`:
- Around line 106-108: 대화형 큐 경보 항목에 큐 대기시간의 명시적 상한을 추가하고, 100개 pending 한도 초과 및
실행 취소 신호도 함께 문서화하세요. 기존 bounded queue delay 표현을 구체적인 시간 임계값과 한도 초과 시 동작으로 갱신하되,
관련 메트릭의 유한 카디널리티 요구사항은 유지하세요.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d6d9dd78-a578-46b7-982c-336b13bc6fe7
📒 Files selected for processing (5)
.github/workflows/agent-mention-router.ymlCHANGELOG.mddocs/doctoring/agent-mention-concurrency-isolation.mdtests/test_agent_mention_artifact_ledger.pytests/test_agent_mention_workflow_contract.py
|
@coderabbitai review |
|
|
@coderabbitai review |
|
|
@coderabbitai review Please perform a fresh current-head review of exact head |
|
I will limit the review to the five-file concurrency-isolation repair. I will assess the strengthened root-concurrency regression and the corrected doctoring. I will use current source evidence only and will not reuse conclusions from predecessor PR ✅ Action performedReview finished.
|
OpenCode Review Overview
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: agent-mention-router.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: agent-mention-router.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: agent-mention-concurrency-isolation.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: agent-mention-concurrency-isolation.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
APPROVE of the bounded five-file concurrency-isolation repair. Changed-file evidence inspected: .github/workflows/agent-mention-router.yml, tests/test_agent_mention_workflow_contract.py, docs/doctoring/agent-mention-concurrency-isolation.md, CHANGELOG.md, tests/test_agent_mention_artifact_ledger.py. Approval sufficiency: the PR intent (separate job-scoped concurrency groups so scheduled sweeps cannot evict pending interactive trusted-mention routes; queue: max on the local route, cancel-in-progress: false on the sweep) is directly implemented in the current-head workflow and locked by contract tests. Verification posture: trusted static contract tests test_interactive_mentions_and_sweeps_have_independent_queue_contracts and test_workflow_uses_local_event_and_central_sweep_with_job_scoped_writes assert the exact local and sweep concurrency blocks and reject any workflow-level concurrency key; the supported suite python3 -m pytest tests passed (Coverage execution evidence Result: PASS, supported repository test suites passed). Linter/static: no failed GitHub Checks were present at current head and no lint failures appear in evidence. TDD/regression: two workflow contract tests plus the ledger-doc contract test in tests/test_agent_mention_artifact_ledger.py cover the changed surfaces. Coverage: Coverage execution evidence Result: PASS, supported repository test suites passed. Docstring coverage: configured repository docstring gates passed or were advisory per Coverage execution evidence. DAG: CodeGraph current-head evidence (138 files, 2870 nodes) shows the workflow-contract constants are consumed only by the contract tests; the Mermaid flowchart below maps agent-mention-router.yml to the two jobs, their independent concurrency groups, the main risk, and the verification path; it reflects the head flow. PoC/execution: no execution receipts beyond the trusted coverage run; YAML queue semantics are enforced by the passing static contract suite. DDD/domain: CI automation domain; workflow-level concurrency removed and job-scoped queues introduced; changelog and doctoring doc are consistent with the YAML. CDD/context: the doctoring doc records the incident RCA, fail-first evidence (RED head a319d51), the decision, security/privacy boundaries, monitoring, and rollback criteria. Similar issues: predecessor PR #825/#824 evidence is explicitly not reused, and CodeRabbit's two actionable comments on predecessor head 4881c78 are not present as unresolved threads at current head 6a1acb1. Claim/concept check: queue: max (up to 100 pending, serial processing, incompatible with cancel-in-progress: true) matches the GitHub concurrency contract recorded in the doctoring doc, and the YAML never combines the two keywords. Standards search: GitHub Actions concurrency semantics per the repository doctoring record; external lookup is unavailable to the isolated model. Compatibility/convention: the new identifiers review-agent-mention-router-local and review-agent-mention-router-sweep are multi-word kebab-case with no reserved-word or serialization risk; no DB/API/config objects changed; workflow default permissions remain contents: read with unchanged job-scoped writes. Breaking-change/backcompat: the concurrency behavior change is intentional, release-noted in CHANGELOG.md, and alters no consumer API. Performance: queue: max bounds interactive pending runs at the platform limit while the sweep retains single-pending coalescing; the bounded 5/15-minute job timeouts are unchanged. Developer experience: operator-facing CI behavior, specifically trusted @mention acknowledgement that is no longer silently evicted; the doctoring doc adds queue-delay, receipt-delay, sweep-duration, and duplicate-claim monitoring with acceptance criteria. User experience: non-web surface, the @cwl-noema-review and @opencode-agent mention router users and operators; judged from the workflow YAML, doctoring doc, and changelog. Visual/DOM: non-web interaction surface (GitHub Actions concurrency and runtime queue behavior) reviewed; no web UI exists and no Playwright/DOM evidence applies. Accessibility/i18n: no UI change; the doc is English with one Korean date header line (non-blocking). Supply-chain/license: no dependency or package changes in this PR. Packaging: no manifests or package contracts changed; scripts untouched. Security/privacy: the least-privilege trigger guard is unchanged (non-bot OWNER/MEMBER/COLLABORATOR comments on pull requests in the central repository only), no new secrets are introduced, tokens remain github.token, workflow permissions stay contents: read, there is no sequential-id or identifier-exposure surface, and the exact-name artifact ledger retention and metadata minimization are preserved. No blocking findings.
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/agent-mention-router.yml, CHANGELOG.md, docs/doctoring/agent-mention-concurrency-isolation.md, tests/test_agent_mention_artifact_ledger.py, tests/test_agent_mention_workflow_contract.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/agent-mention-router.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":".github/workflows/agent-mention-router.yml","line":27,"hypothesis":"The concurrency fix was not applied: the workflow still declares one shared workflow-level concurrency group, or the local job lacks queue: max, so a scheduled sweep can still evict a pending interactive mention before routing.","attack_or_counterexample":"Replay the original incident: a trusted issue_comment route is queued while the every-five-minute organization sweep starts; with a shared group and a single-pending queue the sweep replaces the pending route before exact-head resolution.","evidence":"Trusted source trace at .github/workflows/agent-mention-router.yml:27 shows the concurrency key nested under job route-local-agent-mention with group review-agent-mention-router-local-${{ github.repository }} and queue: max, and the workflow header contains no concurrency key; the static contract test test_interactive_mentions_and_sweeps_have_independent_queue_contracts in tests/test_agent_mention_workflow_contract.py passed in the supported suite (Coverage execution evidence Result: PASS, supported repository test suites passed), asserting the exact local concurrency block and rejecting any header line starting with concurrency:. source-line-sha256=a399531b10a56a1ae2ddcb1a67a4c9cd9b68fdabafebebbd2c8ee98301a14c82","outcome":"falsified"},{"path":".github/workflows/agent-mention-router.yml","line":74,"hypothesis":"The sweep job lost its non-cancelling protection or shares the local group, so either a running sweep can be cancelled mid-dispatch or a long sweep blocks interactive routes.","attack_or_counterexample":"Start a 15-minute sweep and then trigger a trusted interactive mention: if the two jobs shared one group, the interactive route would wait behind or be evicted by the sweep; if cancel-in-progress were true, the running sweep would be cancelled mid-dispatch.","evidence":"Trusted source trace at .github/workflows/agent-mention-router.yml:74 shows cancel-in-progress: false under job sweep-organization-agent-mentions with the distinct group review-agent-mention-router-sweep-${{ github.repository }} on line 73, so the sweep is neither cancellable nor part of the local group; the same contract test passed in the supported suite (Coverage execution evidence Result: PASS, supported repository test suites passed), asserting the exact sweep concurrency block and independent local/sweep groups. source-line-sha256=0a154ba3f27baabda66de506a511243140983e00ab40cb1a37e9bb7983bdc2d2","outcome":"falsified"}],"residual_risk":"GitHub platform-side acceptance of job-level queue: max and the exact 100-pending limit cannot be proven from local evidence (isolated model, no network); the YAML is internally consistent (queue: max is never combined with cancel-in-progress) and matches the contract recorded in the repository doctoring doc, and no failed GitHub Checks were present at current head. The truncated tail of the new doctoring doc (approximately lines 100-124) and the precise one-line diff of tests/test_agent_mention_artifact_ledger.py were not fully inlined in the evidence packet; current-head CodeGraph source (DOC constant at tests/test_agent_mention_artifact_ledger.py:17 pointing at the new doc) and the passing ledger-doc contract test substantiate both. Direct file reads of the head checkout were unavailable to the model, so the CodeGraph verbatim source blocks and focused hunks were used as the authoritative current-head source."}- Result: APPROVE
- Reason: Concurrency isolation is implemented exactly as intended at current head: the workflow-level concurrency group is removed, independent job-scoped groups are added (queue: max for interactive routes, cancel-in-progress: false for the sweep), the exact YAML shape is locked by passing contract tests, and the change is documented in CHANGELOG.md and the new doctoring record. No blocking findings.
- Head SHA:
6a1acb1559755c27d7267e39fd6275bb9db74dc9 - Workflow run: 31302651908
- Workflow attempt: 1
|
Exact-current-head independent review request for OpenCode formally approved this exact head, all ten hosted workflows are terminal-success, and all CodeRabbit findings are addressed and resolved. Independently review the bounded five-file queue-isolation repair: no workflow-level shared concurrency; trusted local Keep the exact head unchanged. Do not transfer #825 evidence, synthesize author approval, reintroduce a shared queue, weaken the durable ledger or trigger guard, change credentials/reviewer identities, update the branch, merge, release, or bypass protection. After protected integration, operational acceptance still requires live interactive receipts/dispatch and proof that a scheduled sweep cannot replace the route. @coderabbitai review |
Rate Limit Exceeded
|
Pull request was converted to draft
Remove unrelated coverage-materializer and architecture changes that entered this branch after the reviewed concurrency repair. Restore protected-main blobs for unrelated files and retain only the five declared mention-router workflow, contract, doctoring, and changelog paths.
|
@opencode-agent @cwl-noema-review Please independently review the unchanged exact head |
|
Perform a review-only independent review of exact head |
|
@opencode-agent @cwl-noema-review Review exact current head |
Pull request was converted to draft
|
@opencode-agent @cwl-noema-review @coderabbitai review Re-review exact head |
Rate Limit Exceeded
|
|
Exact-current-head read-only review request for This bounded five-file repair separates interactive trusted mention routing from the scheduled organization sweep, using distinct job-scoped concurrency groups. GitHub's current Actions concurrency contract supports Review this exact head only. Preserve reviewer identities and credentials; do not mutate the branch, synthesize author approval, weaken protection, or merge. @opencode-agent review |
|
Exact-current-head read-only control-plane review request for The effective diff is the declared five-file mention-router concurrency repair. Exact-head Agent Mention Router quality, Strix, CodeQL, Security Scan, Python Security, Semgrep, Secret Scan, OSV, Scorecard, and SBOM workflows are terminal-success, and all inline findings are resolved. The prior OpenCode approval was correctly dismissed after later pushes and is not current evidence. @opencode-agent review Review read-only. Preserve independent reviewer identity; do not mutate the branch, synthesize author approval, bypass protection, or merge. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
head='c9fe4779d0030534a366d6a0fe4ae4252bb794fe'
echo '== Commit identities =='
git rev-parse --verify "${base}^{commit}"
git rev-parse --verify "${head}^{commit}"
git show -s --format='BASE %H%nParents: %P%nSubject: %s' "$base"
git show -s --format='HEAD %H%nParents: %P%nSubject: %s' "$head"
echo '== Changed paths and diff stat =='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
git diff --check "$base" "$head"
echo '== Complete requested-scope diff =='
git diff --find-renames --find-copies --unified=80 "$base" "$head" -- \
.github/workflows/agent-mention-router.yml \
tests/test_agent_mention_artifact_ledger.py \
tests/test_agent_mention_workflow_contract.py \
docs/doctoring/agent-mention-concurrency-isolation.md \
CHANGELOG.md
echo '== Current workflow with line numbers =='
git show "${head}:.github/workflows/agent-mention-router.yml" | nl -ba
echo '== Contract-test structure =='
ast-grep outline tests/test_agent_mention_workflow_contract.py --items all
echo '== Ledger-test structure =='
ast-grep outline tests/test_agent_mention_artifact_ledger.py --items all
echo '== Routing and ledger control references =='
rg -n -C 4 \
'concurrency:|queue:|cancel-in-progress|agent_invocation_key|agent_ledger_artifact_name|retention-days|author_association|issue_comment|workflow_dispatch|schedule' \
.github/workflows/agent-mention-router.yml \
scripts/ci/agent_mention_router.py \
scripts/ci/agent_mention_sweep.py \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.ymlLength of output: 29501 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='c9fe4779d0030534a366d6a0fe4ae4252bb794fe'
numbered() {
awk '{ printf "%6d\t%s\n", NR, $0 }'
}
echo '== Complete current router workflow =='
git show "${head}:.github/workflows/agent-mention-router.yml" | numbered
echo '== Complete current workflow contract test =='
git show "${head}:tests/test_agent_mention_workflow_contract.py" | numbered
echo '== Ledger-test assertions that reference the doctoring record =='
git show "${head}:tests/test_agent_mention_artifact_ledger.py" \
| rg -n -C 5 'DOC|artifact|retention|canonical|invocation'
echo '== Router source: canonical request, ledger, and dispatch controls =='
rg -n -C 6 \
'class MentionRequest|def agent_invocation_key|def agent_ledger_artifact_name|def .*artifact|retention|expires_at|author_association|issue_comment|dispatch|canonical' \
scripts/ci/agent_mention_router.py
echo '== Sweep source: routing and dispatch controls =='
rg -n -C 6 \
'def |agent_invocation_key|dispatch|TARGET_REPOSITORY_SOURCE|allowlist|repository|comment|artifact' \
scripts/ci/agent_mention_sweep.py
echo '== Dispatch workflow contracts =='
for workflow in \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml
do
echo "-- ${workflow} --"
rg -n -C 4 \
'workflow_dispatch|repository_dispatch|agent_invocation_key|concurrency|inputs|secrets|permissions|retention' \
"$workflow"
doneLength of output: 53290
I found no source-backed findings in the requested five-file scope. The diff changes exactly the declared five paths. The router has no workflow-level The regression test rejects root-level concurrency. It also asserts both complete job-level concurrency mappings. The reviewed source retains the canonical invocation key, exact-name artifact-ledger lookup, 30-day immutable claim, allowlist handling, credentials, and review-only OpenCode dispatch controls. This static review cannot verify live queue behavior, receipts, or downstream dispatch after protected integration. Those controls need the specified operational acceptance checks. I did not approve, merge, modify the branch, or bypass protection.
|
|
Exact-current-head review request for The five-file bounded repair has terminal-success exact-head quality, security, supply-chain, and Strix evidence; all inline threads are resolved/outdated. Recheck only whether job-scoped local @opencode-agent review |
Rate Limit Exceeded
|
|
Exact-current-head read-only review request for The effective diff remains the declared five-file interactive-route/sweep concurrency repair. All ten exact-head quality, security, and supply-chain workflows are terminal-success; returned inline threads are resolved/outdated. The previous OpenCode approval was dismissed after head movement and is not reused. @opencode-agent review Review read-only. Do not update the branch, modify the durable ledger or credential chain, synthesize approval, bypass protection, or merge. Submit a formal exact-head verdict and preserve the two-independent-approval rule. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
head='c9fe4779d0030534a366d6a0fe4ae4252bb794fe'
echo '== Commit identities =='
git rev-parse --verify "${base}^{commit}"
git rev-parse --verify "${head}^{commit}"
git show -s --format='BASE %H%nParents: %P%nSubject: %s' "$base"
git show -s --format='HEAD %H%nParents: %P%nSubject: %s' "$head"
echo '== Changed paths, stat, and whitespace =='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
git diff --check "$base" "$head"
echo '== Complete five-file diff =='
git diff --find-renames --find-copies --unified=80 "$base" "$head" -- \
.github/workflows/agent-mention-router.yml \
tests/test_agent_mention_artifact_ledger.py \
tests/test_agent_mention_workflow_contract.py \
docs/doctoring/agent-mention-concurrency-isolation.md \
CHANGELOG.md
echo '== Current router workflow =='
git show "${head}:.github/workflows/agent-mention-router.yml" | nl -ba
echo '== Test structure =='
ast-grep outline tests/test_agent_mention_workflow_contract.py --items all
ast-grep outline tests/test_agent_mention_artifact_ledger.py --items all
echo '== Current contract and doctoring assertions =='
git show "${head}:tests/test_agent_mention_workflow_contract.py" | nl -ba
git show "${head}:tests/test_agent_mention_artifact_ledger.py" \
| rg -n -C 6 'DOC|concurrency|artifact|retention|invocation|canonical'Length of output: 29239 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='c9fe4779d0030534a366d6a0fe4ae4252bb794fe'
numbered() { awk '{ printf "%6d\t%s\n", NR, $0 }'; }
echo '== Complete current router workflow =='
git show "${head}:.github/workflows/agent-mention-router.yml" | numbered
echo '== Complete workflow contract test =='
git show "${head}:tests/test_agent_mention_workflow_contract.py" | numbered
echo '== Ledger test assertions that use the doctoring document =='
git show "${head}:tests/test_agent_mention_artifact_ledger.py" \
| rg -n -C 6 'DOC|artifact|retention|invocation|canonical'
echo '== Doctoring claims covered by tests =='
git show "${head}:docs/doctoring/agent-mention-concurrency-isolation.md" \
| rg -n -C 3 'ledger|30-day|canonical|artifact|queue|cancel-in-progress|credential|allowlist'
echo '== Current router source: key, ledger, and route controls =='
rg -n -C 5 \
'class MentionRequest|def agent_invocation_key|def agent_ledger_artifact_name|retention-days|retention|expires_at|author_association|issue_comment|repository_dispatch|dispatch' \
scripts/ci/agent_mention_router.py
echo '== Current dispatch workflow control references =='
for workflow in \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml
do
echo "-- ${workflow} --"
rg -n -C 4 \
'workflow_dispatch|repository_dispatch|agent_invocation_key|concurrency|inputs|secrets|permissions|retention' \
"$workflow"
doneLength of output: 46984
Verdict: no source-backed findings in the requested five-file scope. The diff changes exactly the declared five paths. The router has no workflow-level The regression test rejects root-level concurrency. It also asserts the complete concurrency mapping for each job. The router source retains trusted-comment validation, canonical invocation-key construction, exact-name artifact-ledger lookup, allowlist handling, and review-only OpenCode dispatch flags. The downstream dispatch workflows retain exact-key concurrency, a 30-day artifact claim before forwarding, and the existing dispatch controls. This static review cannot verify live queue behavior, receipt creation, or downstream dispatch after protected integration. Those checks still require operational evidence. I did not modify the branch, approve, merge, or bypass protection.
|
Preserve the bounded five-file mention-router repair while incorporating the hourly NVIDIA NIM review-repair control plane from protected main. Resolve the CHANGELOG additively without transferring predecessor checks or approvals.
|
Exact-current-head review request for The branch was updated by an ordinary two-parent merge commit. Its effective five-file product diff is unchanged, while the protected-main hourly NVIDIA NIM review-repair control plane and additive CHANGELOG history are preserved. No prior-head check, review, or approval transfers. @opencode-agent review Review read-only. Verify the separate local |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='c47afc2dc68488292c1db7c9d6f82dcd5360f181'
head='17c3c1221d685127971c2475a08772f193204855'
echo '== Commit identities and parentage =='
git rev-parse --verify "${base}^{commit}"
git rev-parse --verify "${head}^{commit}"
git show -s --format='BASE %H%nParents: %P%nSubject: %s' "$base"
git show -s --format='HEAD %H%nParents: %P%nSubject: %s' "$head"
echo '== Changed paths, diff stat, and whitespace =='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
git diff --check "$base" "$head"
echo '== Complete requested product diff =='
git diff --find-renames --find-copies --unified=80 "$base" "$head" -- \
.github/workflows/agent-mention-router.yml \
tests/test_agent_mention_artifact_ledger.py \
tests/test_agent_mention_workflow_contract.py \
docs/doctoring/agent-mention-concurrency-isolation.md \
CHANGELOG.md
echo '== Current workflow and current test structure =='
git show "${head}:.github/workflows/agent-mention-router.yml" | nl -ba
ast-grep outline tests/test_agent_mention_workflow_contract.py --items all
ast-grep outline tests/test_agent_mention_artifact_ledger.py --items all
echo '== Workflow, route, ledger, and dispatch control references =='
rg -n -C 5 \
'concurrency:|queue:|cancel-in-progress|agent_invocation_key|agent_ledger_artifact_name|retention-days|author_association|issue_comment|workflow_dispatch|schedule|repository_dispatch' \
.github/workflows/agent-mention-router.yml \
scripts/ci/agent_mention_router.py \
scripts/ci/agent_mention_sweep.py \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.ymlLength of output: 38039 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='c47afc2dc68488292c1db7c9d6f82dcd5360f181'
head='17c3c1221d685127971c2475a08772f193204855'
first_parent='c9fe4779d0030534a366d6a0fe4ae4252bb794fe'
numbered() {
awk '{ printf "%6d\t%s\n", NR, $0 }'
}
echo '== Merge-parent comparison =='
git diff --name-status "$first_parent" "$head"
git diff --stat "$first_parent" "$head"
git diff --check "$first_parent" "$head"
echo '== Current router workflow =='
git show "${head}:.github/workflows/agent-mention-router.yml" | numbered
echo '== Complete current contract test =='
git show "${head}:tests/test_agent_mention_workflow_contract.py" | numbered
echo '== Ledger test assertions for the doctoring record and ledger controls =='
git show "${head}:tests/test_agent_mention_artifact_ledger.py" \
| rg -n -C 6 'DOC|artifact|retention|invocation|canonical|exact'
echo '== Current workflow, router, sweep, and dispatch control references =='
rg -n -C 5 \
'concurrency:|queue:|cancel-in-progress|agent_invocation_key|agent_ledger_artifact_name|retention-days|author_association|issue_comment|workflow_dispatch|schedule|repository_dispatch|NVIDIA|MODEL|TOKEN|permissions:' \
.github/workflows/agent-mention-router.yml \
scripts/ci/agent_mention_router.py \
scripts/ci/agent_mention_sweep.py \
.github/workflows/agent-mention-noema-dispatch.yml \
.github/workflows/agent-mention-opencode-dispatch.yml
echo '== Current structural outlines =='
ast-grep outline tests/test_agent_mention_workflow_contract.py --items all
ast-grep outline tests/test_agent_mention_artifact_ledger.py --items allLength of output: 66298
Verdict: no source-backed findings in the requested scope. The head is a two-parent merge commit. Its parents are The base-to-head product diff changes exactly these five paths:
The comparison with the first parent contains the protected-main hourly NVIDIA NIM control-plane changes. This is consistent with merging protected The router has no workflow-level The workflow contract test rejects root-level concurrency. It asserts both complete job-level concurrency mappings. The scoped diff does not change the existing permissions, credential names, trusted-comment guard, allowlist handling, or dispatch payloads. The current router and dispatch workflows retain canonical invocation keys, exact-name artifact-ledger lookup, 30-day immutable artifact claims before forwarding, and review-only OpenCode flags. This static review does not verify exact-head CI execution, live queue behavior, receipts, or downstream dispatch after protected integration. Those require current workflow evidence and operational acceptance checks. I did not modify the branch, approve the pull request, merge, or bypass branch protection. You are interacting with an AI system. |
|
Current-head review retry after both repository-owned quality checks passed on @opencode-agent review Read-only review only; no branch update, dismissal, self-approval, or gate bypass. |
|
|
1 participant
RCA
Protected
mainroutes trusted interactiveissue_commentrequests and the five-minute organization sweep through one workflow-level concurrency group. GitHub permits one running member and, under the default single-pending contract, a newer queued run can replace an existing pending run even whencancel-in-progressis false. A scheduled sweep can therefore discard a pending trusted@cwl-noema-reviewor review-only@opencode-agentrequest before exact-head resolution, durable-ledger claim, dispatch, or acknowledgement.This is the live control-plane cause of trusted review requests that remain unacknowledged, including the independent review needed by
ContextualWisdomLab/OriginWeave#149.Replacement and branch-integrity history
Historical PR #825 contains the original bounded repair but is based on an obsolete protected-main snapshot. No #825 check, review, approval, comment, or synthetic-merge evidence transfers.
This PR was rebuilt from protected
main6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. After the first reviewed repair head, unrelated coverage-materializer and architecture changes entered this branch and expanded the effective diff to ten files. Exact headc9fe4779d0030534a366d6a0fe4ae4252bb794feremoves that contamination by restoring protected-main blobs for every unrelated path and retaining only the declared five-file mention-router repair. No force-push, rebase, predecessor review transfer, or protected-base mutation was used.Bounded repair
review-agent-mention-router-local-${{ github.repository }}withqueue: max;review-agent-mention-router-sweep-${{ github.repository }}withcancel-in-progress: false;Exact current boundary
At exact head
c9fe4779d0030534a366d6a0fe4ae4252bb794feagainst exact protected base6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba, the effective diff is exactly:.github/workflows/agent-mention-router.ymltests/test_agent_mention_workflow_contract.pytests/test_agent_mention_artifact_ledger.pydocs/doctoring/agent-mention-concurrency-isolation.mdCHANGELOG.mdGitHub reports the PR mergeable. Every currently executable exact-head deterministic, security, and supply-chain workflow is complete and successful:
31868821160: success, with 978 tests plus 16 subtests, 402/402 statements, 168/168 branches, public-script docstrings at 100%, compilation, andgit diff --check;31868821186: success;31868821159: success;31868821218: success;31868821288: success;31868821271: success;31868821263: success;31868821371: success;31868821130: success; and31868821204: success.All returned inline review threads are resolved and outdated. CodeRabbit's prior current-diff findings are implemented: workflow-header concurrency detection is complete, review evidence remains explicitly pending, and monitoring now uses a finite 10-minute receipt threshold plus immediate queue-limit/cancellation signals while preserving finite-cardinality metrics.
The previous OpenCode approval belonged to head
6a1acb1559755c27d7267e39fd6275bb9db74dc9and was correctly dismissed after later pushes. It is not transferred to the current head. Exact headc9fe4779...currently has no qualifying approval.Merge gate
The PR is Ready solely to obtain fresh exact-head automated and independent review. Protected integration still requires:
No predecessor-head, dismissed, queued, skipped, synthetic, status-only, or model-only evidence is promoted as current proof.
Operational acceptance
After protected integration, post fresh trusted Noema/OpenCode review-only comments and require durable receipt/acknowledgement plus downstream dispatch. Verify that a scheduled sweep cannot replace an interactive route. Static PR checks alone are not incident closure.
Supersede #825 only after this replacement proves protected integration and operational acceptance. Close #814 only after protected-main operational evidence.