fix: retry Strix provider tool protocol failures - #933
Conversation
|
Warning Review limit reached
Next review available in: 43 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent review Evaluate exact current head |
|
@opencode-agent review Evaluate exact current head |
|
@opencode-agent @cwl-noema-review Formal review-only request for exact current head |
|
@coderabbitai review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='b4e60dcec7abea2466b5f1d35b7f42e23313ebc8'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== Local commit availability =='
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git merge-base --is-ancestor "$base" "$head"
printf 'base is ancestor of head: yes\n'
printf '%s\n' '== Changed files and diff =='
git diff --check "${base}...${head}"
git diff --name-status "${base}...${head}"
git diff --find-renames --find-copies --unified=80 "${base}...${head}" -- \
scripts/ci/strix_quick_gate.sh \
scripts/ci/test_strix_quick_gate.sh
printf '%s\n' '== Affected shell-file structure =='
ast-grep outline scripts/ci/strix_quick_gate.sh --lang bash --items all
ast-grep outline scripts/ci/test_strix_quick_gate.sh --lang bash --items all
printf '%s\n' '== Exact error handling and test assertions =='
rg -n -C 12 -F 'ModelBehaviorError: Tool execute not found in agent strix' \
scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh
rg -n -C 8 -e 'fallback|retry|provider|vulnerab|severity|exit|fail' \
scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.shLength of output: 179323 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='933'
head='b4e60dcec7abea2466b5f1d35b7f42e23313ebc8'
printf '%s\n' '== Pull request identity =='
gh api "repos/${repo}/pulls/${pr}" \
--jq '{number, state, draft, base: .base.sha, head: .head.sha, mergeable_state, review_decision}'
printf '%s\n' '== Check runs for the exact head =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, app: .app.slug, details_url}'
printf '%s\n' '== Commit statuses for the exact head =='
gh api "repos/${repo}/commits/${head}/status" \
--jq '.statuses[]? | {context, state, creator: .creator.login, target_url}'
printf '%s\n' '== Reviews =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" \
--jq '.[] | {user: .user.login, state, commit_id, submitted_at, body}'
printf '%s\n' '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {author: .comments.nodes[0].author.login, path: .comments.nodes[0].path, line: .comments.nodes[0].line, body: .comments.nodes[0].body}'Length of output: 11103 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='b4e60dcec7abea2466b5f1d35b7f42e23313ebc8'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
log='/tmp/coderabbit-shell-logs/shell-output-smoFw4'
printf '%s\n' '== Exact change summary =='
git diff --stat "${base}...${head}"
git diff --numstat "${base}...${head}"
git diff --unified=20 "${base}...${head}" -- scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh \
| grep -E -C 25 'ModelBehaviorError|tool-protocol|retryable|fallback|^[-+]{3} ' || true
printf '%s\n' '== Exact match locations in the head and base =='
for ref in "$base" "$head"; do
printf '%s\n' "-- $ref --"
git grep -n -F 'ModelBehaviorError: Tool execute not found in agent strix' "$ref" -- \
scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh || true
done
printf '%s\n' '== Focused head excerpts =='
git show "${head}:scripts/ci/strix_quick_gate.sh" > /tmp/strix_quick_gate.head.sh
git show "${head}:scripts/ci/test_strix_quick_gate.sh" > /tmp/test_strix_quick_gate.head.sh
for file in /tmp/strix_quick_gate.head.sh /tmp/test_strix_quick_gate.head.sh; do
printf '%s\n' "-- $file --"
grep -n -E 'ModelBehaviorError: Tool execute not found in agent strix|tool-protocol|is_.*error|retryable|fallback|non-recoverable|threshold vulnerabilities' "$file" \
| head -n 160
done
printf '%s\n' '== Context around every exact signal in the head =='
for file in /tmp/strix_quick_gate.head.sh /tmp/test_strix_quick_gate.head.sh; do
grep -n -F 'ModelBehaviorError: Tool execute not found in agent strix' "$file" \
| cut -d: -f1 \
| while read -r line; do
start=$(( line > 35 ? line - 35 : 1 ))
end=$(( line + 45 ))
printf '\n-- %s:%s-%s --\n' "$file" "$start" "$end"
sed -n "${start},${end}p" "$file" | nl -ba -v "$start"
done
done
printf '%s\n' '== Narrow initial output recovery, if available =='
grep -n -E '^(== Local|base is ancestor|== Changed|[AMDR]\t|diff --git)' "$log" | head -n 100 || trueLength of output: 62263
The existing positive fixture emits both I confirmed that the fallback-success path checks previously reported threshold vulnerabilities before accepting fallback success. The exact head also matches the requested base, and the reported exact-head checks are terminal. No unresolved review threads were returned. 🧠 Learnings usedYou are interacting with an AI system. |
|
Exact-current-head review request for The bounded two-file change classifies only the exact provider-side Review this unchanged head read-only. Do not update the branch, synthesize author approval, merge, release, or weaken protection. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='933'
head='b4e60dcec7abea2466b5f1d35b7f42e23313ebc8'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== Commit relation and changed files =='
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git merge-base --is-ancestor "$base" "$head"
git diff --check "${base}...${head}"
git diff --name-status "${base}...${head}"
git diff --find-renames --find-copies --unified=60 "${base}...${head}" -- \
scripts/ci/strix_quick_gate.sh \
scripts/ci/test_strix_quick_gate.sh
printf '%s\n' '== Shell file outlines =='
ast-grep outline scripts/ci/strix_quick_gate.sh --lang bash --items all
ast-grep outline scripts/ci/test_strix_quick_gate.sh --lang bash --items all
printf '%s\n' '== Retry predicate and regression coverage =='
rg -n -C 18 -F 'ModelBehaviorError: Tool execute not found in agent strix' \
scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh
rg -n -C 10 -e 'is_model_tool_protocol_error|tool-protocol|agent_finish|fallback|retryable|non-recoverable' \
scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh
printf '%s\n' '== Pull request and exact-head state =='
gh api "repos/${repo}/pulls/${pr}" \
--jq '{number,state,draft,base:.base.sha,head:.head.sha,mergeable_state,review_decision}'
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | {name,status,conclusion,app:.app.slug}'
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" \
--jq '.[] | {user:.user.login,state,commit_id,submitted_at}'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {author:.comments.nodes[0].author.login,path:.comments.nodes[0].path,line:.comments.nodes[0].line,body:.comments.nodes[0].body}'Length of output: 181115 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Predicate definition and caller =='
rg -n -A35 -B8 '^is_model_tool_protocol_error\(\)' scripts/ci/strix_quick_gate.sh
rg -n -A18 -B12 '\bis_model_tool_protocol_error\b' scripts/ci/strix_quick_gate.sh
printf '%s\n' '== Tool-protocol fake Strix fixture =='
rg -n -A45 -B10 'tool-protocol-primary|tool-protocol-fallback-success|agent_finish' \
scripts/ci/test_strix_quick_gate.sh
printf '%s\n' '== Exact diff only =='
git diff --unified=25 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba...b4e60dcec7abea2466b5f1d35b7f42e23313ebc8 -- \
scripts/ci/strix_quick_gate.sh \
scripts/ci/test_strix_quick_gate.sh
printf '%s\n' '== Targeted current-head review and unresolved-thread state =='
gh api 'repos/ContextualWisdomLab/.github/pulls/933/reviews?per_page=100' \
--jq '.[] | {user:.user.login,state,commit_id,submitted_at}'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=933 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {author:.comments.nodes[0].author.login,path:.comments.nodes[0].path,line:.comments.nodes[0].line,body:.comments.nodes[0].body}]'Length of output: 31826
One blocking issue remains.
Restrict the predicate to literal The exact-head check runs are terminal with success, neutral, or expected skipped conclusions. The unresolved-thread query returned no threads. These results do not remove the semantic blocker. I did not approve the pull request. 🧠 Learnings usedYou are interacting with an AI system. |
|
@opencode-agent review Review exact current head |
Rate Limit Exceeded
|
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current-head source review for b4e60dcec7abea2466b5f1d35b7f42e23313ebc8 against protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
The two-file diff adds one narrowly identified OpenAI Agents SDK ModelBehaviorError family to the existing provider-infrastructure and distinct-model fallback paths. It remains fail-closed: the signal is not treated as a clean scan; threshold vulnerability artifacts produced before fallback still block; fallback exhaustion still fails; and no permission, target scope, severity threshold, credential, or publication boundary changes. The tool token is intentionally bounded to an alphanumeric/underscore name while requiring the full exception class, missing-tool phrase, and target agent strix, covering both observed execute and agent_finish failures without matching a generic target-application error. The permanent regression proves exactly two model attempts and a successful distinct fallback. All nine directly observed exact-head hosted workflows are terminal-success and no inline thread exists.
A qualifying independent reviewer must still submit formal approval on this unchanged head. Do not update the branch, classify provider failure as clean evidence, synthesize author approval, or bypass protection.
Cite NIST SP 800-53 and the Agents SDK for retrying only ModelBehaviorError missing-tool signals. Add ARCHITECTURE.md diagram. Isolate Darwin installer tests on the linux x86_64 path.
|
Reviewed. CHANGELOG, ARCHITECTURE.md, APA 7th doctoring. Tool-protocol filter case passed. Local suite 977 passed x2. Auto-merge armed. |
|
@opencode-agent review Review exact current head only. Strix retries only the exact OpenAI Agents SDK |
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
e5af8e53dfc752054a954c8cea4478678a555811. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Bandit (Python SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099284/job/94509010731)
- Close Empty PR/close-empty: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718098992/job/94507852853)
- CodeQL PR/Detect CodeQL languages: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099184/job/94507850652)
- Detect CodeQL languages check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099184/job/94507850652)
- Detect Python check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099284/job/94507851567)
- OSV-Scanner PR/osv-scan / osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099857/job/94507853350)
- Python 3.10 compatibility contract check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099138/job/94507850676)
- Python 3.14 full quality gate check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099138/job/94507850582)
- Python Security/Bandit (Python SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099284/job/94509010731)
- Python Security/Detect Python: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099284/job/94507851567)
- Python Security/pip-audit (Python dependency audit): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099284/job/94509010398)
- SAST Semgrep/Semgrep (multi-language SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099288/job/94507851434)
- SBOM Generation/generate-sbom: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099169/job/94507850637)
- Scorecard PR/Scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099194/job/94507851017)
- Scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099194/job/94507851017)
- Secret Scan/gitleaks (secret scan): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099230/job/94507851202)
- Security Scan/dependency-review: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099254/job/94507851573)
- Security Scan/osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099254/job/94507851403)
- Security Scan/scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099254/job/94507851511)
- Security Scan/trivy-fs: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099254/job/94507851461)
- Semgrep (multi-language SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099288/job/94507851434)
- Strix Changed Path Quality CI/exact-head-path-policy: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099128/job/94507852865)
- Trusted uv Materializer Quality CI/Python 3.10 compatibility contract: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099138/job/94507850676)
- Trusted uv Materializer Quality CI/Python 3.14 full quality gate: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099138/job/94507850582)
- close-empty check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718098992/job/94507852853)
- coverage-source-tree check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099278/job/94508216789)
- dependency-review check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099254/job/94507851573)
- exact-head-path-policy check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099128/job/94507852865)
- generate-sbom check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099169/job/94507850637)
- gitleaks (secret scan) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099230/job/94507851202)
- osv-scan / osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099857/job/94507853350)
- osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099254/job/94507851403)
- pip-audit (Python dependency audit) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099284/job/94509010398)
- required-workflow-bootstrap check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099278/job/94507852284)
- scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099254/job/94507851511)
- trivy-fs check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31718099254/job/94507851461)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (4 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: strix-tool-protocol-fallback.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: strix-tool-protocol-fallback.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script (3 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script (3 files)"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test: test_materialize_base_python_requirements.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_materialize_base_python_requirements.py"]
R4 --> V4["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (4 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: strix-tool-protocol-fallback.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: strix-tool-protocol-fallback.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script (2 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script (2 files)"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test: test_materialize_base_python_requirements.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_materialize_base_python_requirements.py"]
R4 --> V4["targeted test run"]
|
|
Returned to Draft because the exact tree mixes the narrow Strix tool-protocol retry classifier with an unrelated trusted-uv materializer branch. The valid slice is specific: only the exact provider-side Rebuild from protected |
|
@coderabbitai review Review only exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='933'
head='c8f9306a70edd1ca700f246058e4b530cc7a38b6'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== Commit relation and diff integrity =='
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git merge-base --is-ancestor "$base" "$head"
printf 'base_is_ancestor=yes\n'
git diff --check "${base}...${head}"
git diff --name-status "${base}...${head}"
git diff --stat "${base}...${head}"
printf '%s\n' '== Exact changed-file diff =='
git diff --find-renames --find-copies --unified=45 "${base}...${head}"
printf '%s\n' '== Shell structure =='
ast-grep outline scripts/ci/strix_quick_gate.sh --lang bash --items all
ast-grep outline scripts/ci/test_strix_quick_gate.sh --lang bash --items all
printf '%s\n' '== Retry classifier and caller =='
rg -n -A45 -B12 '^is_model_tool_protocol_error\(\)' scripts/ci/strix_quick_gate.sh
rg -n -A25 -B15 '\bis_model_tool_protocol_error\b' scripts/ci/strix_quick_gate.sh
printf '%s\n' '== Protocol fixtures and assertions =='
rg -n -A60 -B15 'tool-protocol|ModelBehaviorError: Tool |agent_finish|fallback' \
scripts/ci/test_strix_quick_gate.sh
printf '%s\n' '== Evidence and severity handling near recovery =='
rg -n -A40 -B20 'previously_reported|vulnerab|severity|threshold|clean|fallback' \
scripts/ci/strix_quick_gate.sh
printf '%s\n' '== Exact-head pull request state =='
gh api "repos/${repo}/pulls/${pr}" \
--jq '{number,state,draft,base:.base.sha,head:.head.sha,mergeable_state,review_decision}'
printf '%s\n' '== Exact-head checks =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | {name,status,conclusion,app:.app.slug}'
printf '%s\n' '== Reviews bound to exact head =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" \
--jq '.[] | select(.commit_id == "'"${head}"'") | {user:.user.login,state,submitted_at}'
printf '%s\n' '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {author:.comments.nodes[0].author.login,path:.comments.nodes[0].path,line:.comments.nodes[0].line,body:.comments.nodes[0].body}]'Length of output: 98817 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
head='c8f9306a70edd1ca700f246058e4b530cc7a38b6'
printf '%s\n' '== Changed files =='
git diff --name-status "${base}...${head}"
printf '%s\n' '== Compact diff =='
git diff --unified=12 "${base}...${head}" -- \
scripts/ci/strix_quick_gate.sh \
scripts/ci/test_strix_quick_gate.sh \
CHANGELOG.md ARCHITECTURE.md
printf '%s\n' '== Exact classifier =='
sed -n '2938,2960p' scripts/ci/strix_quick_gate.sh
printf '%s\n' '== All protocol test locations =='
rg -n -C 18 -F 'tool-protocol' scripts/ci/test_strix_quick_gate.sh
rg -n -C 12 -F 'agent_finish' scripts/ci/test_strix_quick_gate.sh
rg -n -C 12 -F 'Tool execute not found in agent strix' scripts/ci/test_strix_quick_gate.sh
printf '%s\n' '== Test case registry and selection =='
rg -n -C 8 'STRIX_TEST_CASE_FILTER|run_test|case .*tool|tool.*case' \
scripts/ci/test_strix_quick_gate.shLength of output: 36102
One blocking issue remains.
Restrict The base commit is an ancestor of the requested head. No unresolved review threads were returned. The exact-head checks are still queued or in progress. Several prior attempts are cancelled. These checks are not terminal-success evidence. I did not approve the pull request.
|
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
c8f9306a70edd1ca700f246058e4b530cc7a38b6. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31806356496/job/94786122377)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31806356496/job/94786122377)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (4 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: strix-tool-protocol-fallback.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: strix-tool-protocol-fallback.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script (2 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script (2 files)"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test: test_materialize_base_python_requirements.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_materialize_base_python_requirements.py"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
c8f9306a70edd1ca700f246058e4b530cc7a38b6. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31806356496/job/94786122377)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31806356496/job/94786122377)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (4 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: strix-tool-protocol-fallback.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: strix-tool-protocol-fallback.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script (2 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script (2 files)"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test: test_materialize_base_python_requirements.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_materialize_base_python_requirements.py"]
R4 --> V4["targeted test run"]
1 participant
Purpose
Strix can terminate before producing evidence when the selected provider/model emits the exact OpenAI Agents SDK error
ModelBehaviorError: Tool execute not found in agent strix. Classify only this exact provider-side signal as retryable so a configured fallback model may complete the scan; vulnerability and incomplete-scan evidence remain fail-closed.Bounded scope
The effective diff is now limited to four directly related files:
scripts/ci/strix_quick_gate.sh;scripts/ci/test_strix_quick_gate.sh;docs/doctoring/strix-tool-protocol-fallback.md; andCHANGELOG.md.Unrelated
AGENTS.md,CLAUDE.md, architecture, and Python-lock materializer test drift was removed by forward commits without force-pushing history.Exact current head:
9313561b0c36136fa6cf42ffdad2b4297e3f2eb1.Known exact-head prerequisite blocker
The predecessor exact-head required Strix scan reached the new fallback path but then created a synthetic demonstration application inside the temporary scan scope and reported SQL-injection/SSRF findings against that scanner-created content. The gate correctly failed closed because those locations could not be mapped to the immutable PR changed-file inventory. That failure is not authorization to ignore unmapped findings.
PR #939 owns the bounded static instruction and changed-file-scope contract intended to keep Strix focused on the mounted current-head source. This PR remains Draft until that prerequisite is protected-main integrated or this exact head independently proves that Strix no longer substitutes scanner-created demo files for repository evidence. No predecessor-head run or review transfers.
Validation contract
bash -n scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh;STRIX_TEST_CASE_FILTER=tool-protocol-fallback-success bash scripts/ci/test_strix_quick_gate.sh;The change does not alter repository permissions, scan scope, severity thresholds, reviewer identities, model credentials, or merge authority.
COPILOT_GITHUB_TOKENis not introduced.