fix: keep cross-repo OpenCode evidence healthy - #939
Conversation
|
Warning Review limit reached
Next review available in: 9 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthrough교차 저장소 상태 공개, Python lock materialization, trusted uv 다운로드, Strix 제공자 증거 처리를 fail-closed 방식으로 변경했다. 관련 계약 테스트와 운영 문서를 갱신했다. ChangesOpenCode 리뷰 검증
신뢰된 Python lock materialization
Strix 증거 게이트
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: 🟡 Moderate · up to Nested lock files may be skipped during dependency evidence collection, which can leave trusted coverage bootstrap evidence incomplete; merge should wait until the collection logic handles repository-relative lock-file paths correctly. Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent review Perform a fresh read-only semantic review of exact current head Focus on the static fixed-URL/fixed-User-Agent uv request boundary, no-proxy/no-redirect behavior, bounded download/checksum/version enforcement, and the cross-repository OpenCode App status-publication guard. Verify that optional status publication cannot substitute for exact-head formal review or weaken branch protection. Review only; do not mutate, self-approve, enable auto-merge, or merge. |
|
@coderabbitai review Please perform a fresh read-only semantic review of exact current head Focus on the new fail-closed cross-repository status guard: unavailable |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='f97b9a44201633d2a94bf73c6bb7fde900135553'
base_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
repo='ContextualWisdomLab/.github'
pr_number='939'
echo '== Commit identity and ancestry =='
git cat-file -e "${head_sha}^{commit}"
git cat-file -e "${base_sha}^{commit}"
printf 'HEAD parent/base relationship: '
git merge-base --is-ancestor "$base_sha" "$head_sha" && echo yes || echo no
printf 'merge-base: '
git merge-base "$base_sha" "$head_sha"
printf 'checked-out HEAD: '
git rev-parse HEAD
echo '== Changed files and exact diff =='
git diff --name-status "$base_sha" "$head_sha"
git diff --unified=80 "$base_sha" "$head_sha" -- \
.github/workflows/opencode-review-dispatch.yml \
tests/test_opencode_agent_contract.py
echo '== Workflow outline and relevant control-flow context =='
ast-grep outline .github/workflows/opencode-review-dispatch.yml --items all || true
rg -n -C 12 --glob 'opencode-review-dispatch.yml' \
'github\.token|opencode-app|commit.status|statuses|reviews|pulls|PR_HEAD_SHA|APPROVED|CHANGES_REQUESTED|exit 1|exit 0|repository_dispatch' \
.github/workflows/opencode-review-dispatch.yml
echo '== Contract-test context =='
ast-grep outline tests/test_opencode_agent_contract.py --items all || true
rg -n -C 10 \
'github\.token|opencode-app|commit.status|statuses|reviews|PR_HEAD_SHA|APPROVED|CHANGES_REQUESTED|exit.?1|exit.?0' \
tests/test_opencode_agent_contract.py
echo '== Live PR identity, reviews, and check rollup =='
gh pr view "$pr_number" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],checks:[.statusCheckRollup[]|{name,conclusion,status,workflowName}]}'Length of output: 161212 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='f97b9a44201633d2a94bf73c6bb7fde900135553'
base_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
repo='ContextualWisdomLab/.github'
pr_number='939'
echo '== Commit ancestry =='
printf 'base ancestor of head: '
git merge-base --is-ancestor "$base_sha" "$head_sha" && echo yes || echo no
printf 'merge-base: '; git merge-base "$base_sha" "$head_sha"
printf 'current checkout: '; git rev-parse HEAD
echo '== Exact changed hunks: status-publication guard =='
git diff --unified=30 "$base_sha" "$head_sha" -- .github/workflows/opencode-review-dispatch.yml |
sed -n '/Publish repository_dispatch OpenCode status/,+130p'
echo '== Exact changed hunks: regression contract =='
git diff --unified=30 "$base_sha" "$head_sha" -- tests/test_opencode_agent_contract.py |
sed -n '1,260p'
echo '== Guard source with line numbers =='
nl -ba .github/workflows/opencode-review-dispatch.yml |
sed -n '7828,7895p'
echo '== Exact-head Strix workflow runs =='
gh run list --repo "$repo" --workflow strix.yml --commit "$head_sha" --limit 20 \
--json databaseId,event,status,conclusion,headSha,url,workflowName \
--jq '.[] | {databaseId,event,status,conclusion,headSha,url,workflowName}'
echo '== Current branch-protection requirements =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_linear_history,allow_force_pushes,allow_deletions}' \
|| trueLength of output: 13167 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head_sha='f97b9a44201633d2a94bf73c6bb7fde900135553'
echo '== Current exact-head Strix runs =='
gh run list --repo "$repo" --workflow strix.yml --commit "$head_sha" --limit 20 \
--json databaseId,event,status,conclusion,headSha,url,workflowName \
--jq '.[] | {databaseId,event,status,conclusion,headSha,url,workflowName}'
echo '== Branch protection: required checks and reviews =='
gh api "repos/${repo}/branches/main/protection" |
jq '{
required_status_check_contexts: (.required_status_checks.contexts // []),
strict_required_status_checks: (.required_status_checks.strict // null),
required_approving_review_count: (.required_pull_request_reviews.required_approving_review_count // 0),
dismiss_stale_reviews: (.required_pull_request_reviews.dismiss_stale_reviews // false),
require_code_owner_reviews: (.required_pull_request_reviews.require_code_owner_reviews // false),
require_last_push_approval: (.required_pull_request_reviews.require_last_push_approval // false),
enforce_admins: (.enforce_admins.enabled // false)
}'
echo '== Current live PR review and check state =='
gh pr view 939 --repo "$repo" --json headRefOid,reviews,statusCheckRollup \
--jq '{
head: .headRefOid,
reviews: [.reviews[] | {author:.author.login,state,commit:.commit.oid}],
active_or_non_success_checks: [
.statusCheckRollup[]
| select(.status != "COMPLETED" or ((.conclusion // "") | ascii_upcase | IN("SUCCESS","SKIPPED","NEUTRAL") | not))
| {name,status,conclusion,workflowName}
]
}'Length of output: 2589
I found no source-level defect in the new cross-repository status-publication guard.
The regression contract checks the required guard structure and failure path. It is static coverage. It does not execute mocked API failure or review-payload cases. Live verification is incomplete:
Therefore, the statement that all exact-head checks are terminal-success is not supported by the live data. I did not approve, merge, enable auto-merge, or modify repository state. I applied the existing exact-current-head evidence rule during this review. 🧠 Learnings used
|
|
@opencode-agent review Perform a fresh read-only semantic review of exact current head Review the fail-closed exact-head formal-review guard and the subsequent Strix outage-gate changes as one current tree. Keep source-review evidence distinct from workflow/provider evidence. Do not mutate, self-approve, enable auto-merge, dismiss reviews, weaken gates, or merge. |
|
@coderabbitai review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='939'
head='ac5665148bb113f92e97d2fc49a729bca2f050b5'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Exact commit identity =='
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
printf 'checked-out head: '; git rev-parse HEAD
printf 'base is ancestor: '; git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
printf 'merge base: '; git merge-base "$base" "$head"
echo '== Changed files =='
git diff --name-status "$base" "$head"
echo '== Focused exact diff =='
git diff --unified=45 "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_trusted_uv_download_contract.py \
.github/workflows/opencode-review-dispatch.yml \
tests/test_opencode_agent_contract.py
echo '== Python module outline =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all || true
echo '== Trusted uv request and enforcement context =='
rg -n -C 14 --glob 'materialize_base_python_requirements.py' \
'TRUSTED_UV_DOWNLOAD|Request\(|urlopen\(|ProxyHandler|HTTPRedirectHandler|timeout|read\(|sha256|checksum|version|extract' \
scripts/ci/materialize_base_python_requirements.py
echo '== Trusted uv contract context =='
ast-grep outline tests/test_trusted_uv_download_contract.py --items all || true
rg -n -C 10 \
'Request|urlopen|User-Agent|TRUSTED_UV_DOWNLOAD|ProxyHandler|HTTPRedirectHandler|timeout|sha256|version' \
tests/test_trusted_uv_download_contract.py
echo '== Status-publication guard context =='
rg -n -C 16 --glob 'opencode-review-dispatch.yml' \
'Publish repository_dispatch OpenCode status|github\.token|opencode-app|reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit 1|exit 0|statuses|commit.status' \
.github/workflows/opencode-review-dispatch.yml
echo '== Status-guard contract context =='
rg -n -C 10 \
'github\.token|opencode-app|reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit.?1|exit.?0|status' \
tests/test_opencode_agent_contract.py
echo '== Live PR exact-head state =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{
number,state,isDraft,mergeable,headRefOid,baseRefOid,
reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],
checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName,headSha}]
}'
echo '== Branch protection, if readable =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{
required_status_checks: (.required_status_checks // null),
required_pull_request_reviews: (.required_pull_request_reviews // null),
enforce_admins: (.enforce_admins.enabled // null)
}' || echo 'Branch-protection query was unavailable.'Length of output: 156484 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='ac5665148bb113f92e97d2fc49a729bca2f050b5'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Checkout and ancestry =='
printf 'checkout='; git rev-parse HEAD
printf 'merge_base='; git merge-base "$base" "$head"
printf 'base_ancestor='; git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
echo '== Changed paths at exact revisions =='
git diff --name-status "$base" "$head"
echo '== Exact trusted uv diff =='
git diff --unified=25 "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_trusted_uv_download_contract.py
echo '== Exact trusted uv implementation =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
nl -ba |
sed -n '/TRUSTED_UV_DOWNLOAD/,/^[[:space:]]*def /p'
echo '== Exact trusted uv contract functions =='
git show "${head}:tests/test_trusted_uv_download_contract.py" |
nl -ba |
sed -n '/test_urlopen_receives_one_static_release_request/,/^[[:space:]]*def /p'
echo '== Exact status guard diff =='
git diff --unified=28 "$base" "$head" -- \
.github/workflows/opencode-review-dispatch.yml \
tests/test_opencode_agent_contract.py |
sed -n '/Publish repository_dispatch OpenCode status/,+180p'
echo '== Exact status guard implementation =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
nl -ba |
sed -n '7828,7918p'
echo '== Exact status guard contract =='
git show "${head}:tests/test_opencode_agent_contract.py" |
nl -ba |
sed -n '1997,2053p'Length of output: 12650 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='ac5665148bb113f92e97d2fc49a729bca2f050b5'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
numbered_range() {
start="$1"
end="$2"
awk -v start="$start" -v end="$end" 'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }'
}
echo '== Trusted uv downloader and enforcement =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
numbered_range 55 285
echo '== Trusted uv request contract =='
git show "${head}:tests/test_trusted_uv_download_contract.py" |
numbered_range 1 180
echo '== Exact cross-repository status guard =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
numbered_range 7828 7918
echo '== Exact cross-repository status contract =='
git show "${head}:tests/test_opencode_agent_contract.py" |
numbered_range 1997 2053
echo '== Strix exact diff and contracts =='
git diff --unified=30 "$base" "$head" -- \
.github/workflows/strix.yml \
tests/test_required_workflow_queue_contract.py \
tests/test_strix_nvidia_nim_not_found_fallback.pyLength of output: 48876
I found no blocking source-level defect.
Trusted
Cross-repository commit-status limitation
Strix outage gate
Live evidence
I applied the existing exact-current-head evidence rule during this review. I did not modify repository state, approve, merge, release, dismiss reviews, or change protections. 🧠 Learnings usedYou are interacting with an AI system. |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current-head read-only review request for ac5665148bb113f92e97d2fc49a729bca2f050b5 against protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
This is now the canonical repair after closing superseded #943. Review the combined causal boundaries: fixed-origin static User-Agent for trusted uv bootstrap; proof of an exact-head formal OpenCode review before tolerating unavailable cross-repository status publication; and fail-closed Strix behavior when provider evidence is incomplete. Nine directly observed exact-head hosted workflows, including Trusted uv Materializer Quality CI, are terminal-success and no inline thread exists.
Do not transfer #943 evidence, update this branch, synthesize author approval, neutralize missing security evidence, or bypass protection.
|
Canonical exact-current-head review dispatch for Review the combined root-cause repair only: fixed-origin static Keep this request read-only. Do not update the branch, synthesize author approval, merge, release, neutralize missing security evidence, or weaken protection. @coderabbitai review |
Rate Limit Exceeded
|
|
@opencode-agent review Review exact current head |
Rate Limit Exceeded
|
Cite RFC 9110 and NIST SP 800-53 for the static User-Agent, exact-head review proof, and Strix incomplete-evidence failure. Isolate Darwin installer tests on the linux x86_64 path.
|
Reviewed. CHANGELOG + APA 7th doctoring for User-Agent pin, exact-head review proof before skipping cross-repo status, and fail-closed Strix outage. Local suite 976 passed x2. Auto-merge armed. |
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
|
@coderabbitai review current head 0d90922, including nested |
Rate Limit Exceeded
|
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='939'
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Commit identity and ancestry =='
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
printf 'checkout='; git rev-parse HEAD
printf 'base_is_ancestor='; git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
printf 'merge_base='; git merge-base "$base" "$head"
echo '== Changed paths on requested commit range =='
git diff --name-status "$base" "$head"
echo '== Requirements collector diff =='
git diff --unified=45 "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py
echo '== Requirements collector structure and relevant implementation =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all || true
rg -n -C 14 \
'_is_candidate_lock_path|base_hash_locks|requirements|rglob|glob|relative_to|candidate\.name' \
scripts/ci/materialize_base_python_requirements.py
echo '== Requirements collector regression tests =='
ast-grep outline tests/test_materialize_base_python_requirements.py --items all || true
rg -n -C 12 \
'base_hash_locks|_is_candidate_lock_path|requirements/ci\.txt|service/requirements/package\.txt|nested|relative' \
tests/test_materialize_base_python_requirements.py
echo '== Trusted uv boundary context at requested commit =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
nl -ba | sed -n '55,290p'
echo '== Live PR identity, reviews, and checks =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{
number,state,isDraft,mergeable,headRefOid,baseRefOid,
reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],
checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName,headSha}]
}'
echo '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line }
pageInfo { hasNextPage endCursor }
}
}
}
}' \
--jq '{
unresolved: [.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved | not)
| {path,line,isOutdated}],
hasNextPage: .data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage
}' || echo 'Review-thread query unavailable.'
echo '== Branch protection, if readable =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{
required_status_checks: (.required_status_checks // null),
required_pull_request_reviews: (.required_pull_request_reviews // null),
enforce_admins: (.enforce_admins.enabled // null)
}' || echo 'Branch-protection query unavailable.'Length of output: 54837 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='939'
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
echo '== New end-to-end requirements-path regression contract =='
fd -a '^test_materialize_base_python_requirement_paths\.py$' tests -x sh -c '
echo "--- $1"
awk "{printf \"%6d %s\\n\", NR, \$0}" "$1"
' sh {}
echo '== Exact collector implementation =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
awk 'NR >= 83 && NR <= 185 || NR >= 483 && NR <= 535 { printf "%6d %s\n", NR, $0 }'
echo '== Exact trusted-uv network and verification boundary =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
awk 'NR >= 56 && NR <= 360 { printf "%6d %s\n", NR, $0 }'
echo '== Current PR identity, review evidence, and check rollup =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{
number,state,isDraft,mergeable,headRefOid,baseRefOid,
reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],
checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName,headSha}]
}'
echo '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line }
pageInfo { hasNextPage }
}
}
}
}' \
--jq '{
unresolved: [.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved | not)
| {path,line,isOutdated}],
hasNextPage: .data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage
}' || echo 'Review-thread query unavailable.'
echo '== Branch-protection policy, if readable =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{
required_status_checks: (.required_status_checks // null),
required_pull_request_reviews: (.required_pull_request_reviews // null),
enforce_admins: (.enforce_admins.enabled // null)
}' || echo 'Branch-protection query unavailable.'Length of output: 36879 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
echo '== Exact current cross-repository status-publication guard =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
awk '
/Publish repository_dispatch OpenCode status/ {show=1}
show {printf "%6d %s\n", NR, $0}
show && /^( [^[:space:]]|jobs:|name:)/ && NR > start + 1 {exit}
'
echo '== Exact current Strix outage handling =='
git show "${head}:.github/workflows/strix.yml" |
awk '
/provider|backend|NIM|unavailable|exit 1|exit 0|incomplete|failure/i {
low=NR-10; high=NR+18
}
{lines[NR]=$0}
END {
for (n=1; n<=NR; n++) {
if (n>=low && n<=high) printf "%6d %s\n", n, lines[n]
}
}
' || true
echo '== Exact-head runs for named quality, security, and supply-chain workflows =='
for workflow in \
'Trusted uv Materializer Quality CI' \
'CodeQL PR' \
'Python Security' \
'Security Scan' \
'SAST Semgrep' \
'Secret Scan' \
'OSV-Scanner PR' \
'Scorecard PR' \
'SBOM Generation'
do
echo "--- ${workflow}"
gh run list --repo "$repo" --workflow "$workflow" --commit "$head" --limit 20 \
--json databaseId,status,conclusion,headSha,event,displayTitle,url,workflowName \
--jq '.[] | {databaseId,status,conclusion,headSha,event,workflowName,displayTitle,url}' \
|| echo "Workflow query unavailable: ${workflow}"
doneLength of output: 21095 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
echo '== Exact Strix provider/backend failure handling =='
git show "${head}:.github/workflows/strix.yml" |
rg -n -i -C 18 \
'provider|backend|unavailable|not found|nim|quota|token limit|incomplete|neutral|exit 1|exit 0|security evidence'
echo '== Exact Strix failure contracts =='
for file in \
tests/test_required_workflow_queue_contract.py \
tests/test_strix_nvidia_nim_not_found_fallback.py
do
echo "--- ${file}"
git show "${head}:${file}" |
rg -n -i -C 10 \
'provider|backend|unavailable|not found|nim|neutral|exit 1|exit 0|incomplete|fail'
doneLength of output: 92475
I found no blocking source-level defect.
The trusted
The cross-repository status guard remains fail-closed.
The Strix provider-failure gate remains fail-closed.
Live exact-head evidence is consistent with the request.
GitHub returned HTTP 403 for the I applied the existing exact-current-head evidence rule during this review. I did not approve, merge, release, or modify repository state. 🧠 Learnings usedYou are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review Re-review exact current head |
|
@coderabbitai review Review only exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='939'
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Commit identity and ancestry =='
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
printf 'checkout='; git rev-parse HEAD
printf 'merge_base='; git merge-base "$base" "$head"
printf 'base_is_ancestor='; git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
echo '== Scoped changed paths =='
git diff --name-status "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
.github/workflows/opencode-review-dispatch.yml \
.github/workflows/strix.yml \
scripts/ci/strix_quick_gate.sh \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirement_paths.py \
tests/test_trusted_uv_download_contract.py \
tests/test_opencode_agent_contract.py \
tests/test_required_workflow_queue_contract.py \
tests/test_strix_nvidia_nim_not_found_fallback.py \
tests/test_strix_internal_scope_instruction_contract.py
echo '== Materializer structure =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all || true
echo '== Trusted uv and requirements discovery controls =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
nl -ba | sed -n '55,310p;465,555p'
echo '== Trusted uv and requirements-path contracts =='
for file in \
tests/test_trusted_uv_download_contract.py \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirement_paths.py
do
echo "--- ${file}"
git show "${head}:${file}" |
rg -n -C 8 \
'Request|User-Agent|urlopen|ProxyHandler|HTTPRedirectHandler|sha256|64 \* 1024|version|base_hash_locks|_is_candidate_lock_path|requirements/ci\.txt|service/requirements/package\.txt|relative'
done
echo '== Exact OpenCode status-publication guard =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
rg -n -C 18 \
'Publish repository_dispatch OpenCode status|github\.token|opencode-app|reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit 1|exit 0|statuses|commit.status'
echo '== OpenCode guard regression contract =='
git show "${head}:tests/test_opencode_agent_contract.py" |
rg -n -C 10 \
'reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit.?1|exit.?0|status'
echo '== Strix failure and internal-scope controls =='
for file in .github/workflows/strix.yml scripts/ci/strix_quick_gate.sh \
tests/test_required_workflow_queue_contract.py \
tests/test_strix_nvidia_nim_not_found_fallback.py \
tests/test_strix_internal_scope_instruction_contract.py
do
echo "--- ${file}"
git show "${head}:${file}" |
rg -n -i -C 10 \
'provider|backend|unavailable|not found|nim|quota|token limit|incomplete|neutral|exit 1|exit 0|instruction|internal.*scope|sandbox'
done
echo '== Live PR identity, reviews, and check rollup =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{
number,state,isDraft,mergeable,headRefOid,baseRefOid,
reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],
checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName,headSha}]
}'
echo '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line }
pageInfo { hasNextPage }
}
}
}
}' \
--jq '{unresolved:[.data.repository.pullRequest.reviewThreads.nodes[]|select(.isResolved|not)|{path,line,isOutdated}],hasNextPage:.data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage}' \
|| echo 'Review-thread query unavailable.'
echo '== Main protection policy, if visible =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_status_checks:(.required_status_checks//null),required_pull_request_reviews:(.required_pull_request_reviews//null),enforce_admins:(.enforce_admins.enabled//null)}' \
|| echo 'Branch-protection query unavailable.'Length of output: 7869 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='939'
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
echo '== Trusted uv and requirements discovery controls =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
awk 'NR >= 40 && NR <= 320 || NR >= 475 && NR <= 540 {printf "%6d %s\n", NR, $0}'
echo '== Trusted uv and requirements-path contracts =='
for file in \
tests/test_trusted_uv_download_contract.py \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirement_paths.py
do
echo "--- ${file}"
git show "${head}:${file}" |
rg -n -C 8 \
'Request|User-Agent|urlopen|ProxyHandler|HTTPRedirectHandler|sha256|64 \* 1024|version|base_hash_locks|_is_candidate_lock_path|requirements/ci\.txt|service/requirements/package\.txt|relative'
done
echo '== Exact OpenCode status-publication guard =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
rg -n -C 18 \
'Publish repository_dispatch OpenCode status|github\.token|opencode-app|reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit 1|exit 0|statuses|commit.status'
echo '== OpenCode guard regression contract =='
git show "${head}:tests/test_opencode_agent_contract.py" |
rg -n -C 10 \
'reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit.?1|exit.?0|status'
echo '== Strix failure and internal-scope controls =='
for file in .github/workflows/strix.yml scripts/ci/strix_quick_gate.sh \
tests/test_required_workflow_queue_contract.py \
tests/test_strix_nvidia_nim_not_found_fallback.py \
tests/test_strix_internal_scope_instruction_contract.py
do
echo "--- ${file}"
git show "${head}:${file}" |
rg -n -i -C 10 \
'provider|backend|unavailable|not found|nim|quota|token limit|incomplete|neutral|exit 1|exit 0|instruction|internal.*scope|sandbox'
done
echo '== Live PR identity, reviews, and check rollup =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{
number,state,isDraft,mergeable,headRefOid,baseRefOid,
reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],
checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName,headSha}]
}'
echo '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line }
pageInfo { hasNextPage }
}
}
}
}' \
--jq '{unresolved:[.data.repository.pullRequest.reviewThreads.nodes[]|select(.isResolved|not)|{path,line,isOutdated}],hasNextPage:.data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage}' \
|| echo 'Review-thread query unavailable.'
echo '== Main protection policy, if visible =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_status_checks:(.required_status_checks//null),required_pull_request_reviews:(.required_pull_request_reviews//null),enforce_admins:(.enforce_admins.enabled//null)}' \
|| echo 'Branch-protection query unavailable.'Length of output: 120271 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
echo '== Trusted uv implementation =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
awk 'NR >= 40 && NR <= 315 {printf "%6d %s\n", NR, $0}'
echo '== Requirements lock discovery implementation =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
awk 'NR >= 475 && NR <= 535 {printf "%6d %s\n", NR, $0}'
echo '== Requirements discovery regressions =='
git show "${head}:tests/test_materialize_base_python_requirement_paths.py" |
awk '{printf "%6d %s\n", NR, $0}'
git show "${head}:tests/test_materialize_base_python_requirements.py" |
rg -n -C 8 \
'base_hash_locks|_is_candidate_lock_path|requirements/ci\.txt|service/requirements/package\.txt|relative'
echo '== Trusted uv request-boundary contract =='
git show "${head}:tests/test_trusted_uv_download_contract.py" |
awk '{printf "%6d %s\n", NR, $0}'
echo '== OpenCode status-publication guard only =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
awk '
/name: Publish repository_dispatch OpenCode status/ {in_block=1}
in_block {printf "%6d %s\n", NR, $0}
in_block && /^ - name: / && $0 !~ /Publish repository_dispatch OpenCode status/ {exit}
'
echo '== OpenCode guard static contract =='
git show "${head}:tests/test_opencode_agent_contract.py" |
rg -n -C 12 \
'Publish repository_dispatch OpenCode status|reviews\?per_page|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|review.*evidence|exit.?1|exit.?0'
echo '== Direct structural checks =='
materializer="$(git show "${head}:scripts/ci/materialize_base_python_requirements.py")"
printf 'static Request constructions: '
printf '%s\n' "$materializer" | grep -c 'urllib\.request\.Request('
printf 'urlopen calls: '
printf '%s\n' "$materializer" | grep -c 'urllib\.request\.urlopen('
printf 'candidate classifier calls in base_hash_locks: '
printf '%s\n' "$materializer" | awk '/^def base_hash_locks\(/,/^def /' | grep -c '_is_candidate_lock_path('
guard="$(git show "${head}:.github/workflows/opencode-review-dispatch.yml)"
printf 'guard review endpoint occurrences: '
printf '%s\n' "$guard" | awk '/name: Publish repository_dispatch OpenCode status/,/^ - name: /' | grep -c '/pulls/.*reviews'
printf 'guard exact-head predicate occurrences: '
printf '%s\n' "$guard" | awk '/name: Publish repository_dispatch OpenCode status/,/^ - name: /' | grep -c 'PR_HEAD_SHA'Length of output: 71843 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
echo '== Trusted uv executable-version enforcement =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
awk 'NR >= 302 && NR <= 360 {printf "%6d %s\n", NR, $0}'
echo '== Version-enforcement contract references =='
git show "${head}:tests/test_materialize_base_python_requirements.py" |
rg -n -C 8 \
'TRUSTED_UV_VERSION|version|uv 0\.12\.1|_install_trusted_uv|_verified_uv_binary'Length of output: 18382
I found no blocking source-level defect in the requested scope.
The trusted
The cross-repository OpenCode status guard remains fail-closed.
The returned live review list has no formal OpenCode review bound to The Strix controls remain fail-closed.
Live evidence:
I did not run repository code or tests. I did not modify repository state, approve, merge, release, dismiss reviews, or change protections.
|
|
@opencode-agent @cwl-noema-review Review exact unchanged head |
Pull request was converted to draft
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact head |
Rate Limit Exceeded
|
|
Exact-current-head read-only review request for This head is the prerequisite for the bounded Strix tool-protocol fallback in #933. It supplies a trusted static instruction for internally-created changed-file scope, keeps host paths and caller-controlled instructions out of the sandbox, expands exact-base requirements-lock discovery only to repository-relative regular blobs, and preserves fail-closed cross-repository OpenCode evidence. Every currently observed exact-head hosted quality, security, SAST, secret, OSV, Scorecard, SBOM, Python Security, Strix changed-path, and trusted-materializer workflow is terminal-success; all review threads are resolved. Auto-merge is armed subject to fresh qualifying independent approvals and the protected-main ruleset. Review this exact head only. Preserve reviewer identities and credential separation; do not mutate the branch, synthesize author approval, weaken protection, or merge. @opencode-agent review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='939'
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Revision identity and ancestry =='
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
printf 'checkout='; git rev-parse HEAD
printf 'merge_base='; git merge-base "$base" "$head"
printf 'base_is_ancestor='; git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
echo '== Scoped changes =='
git diff --name-status "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
.github/workflows/opencode-review-dispatch.yml \
.github/workflows/strix.yml \
scripts/ci/strix_quick_gate.sh \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirement_paths.py \
tests/test_trusted_uv_download_contract.py \
tests/test_opencode_agent_contract.py \
tests/test_required_workflow_queue_contract.py \
tests/test_strix_nvidia_nim_not_found_fallback.py \
tests/test_strix_internal_scope_instruction_contract.py
echo '== Materializer map =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all || true
echo '== Trusted uv and requirements collector =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
nl -ba | sed -n '40,365p;475,545p'
echo '== Trusted uv and lock-discovery contracts =='
for file in \
tests/test_trusted_uv_download_contract.py \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirement_paths.py
do
echo "--- ${file}"
git show "${head}:${file}" |
rg -n -C 8 'Request|User-Agent|urlopen|ProxyHandler|HTTPRedirectHandler|sha256|64 \* 1024|version|base_hash_locks|_is_candidate_lock_path|requirements/ci\.txt|service/requirements/package\.txt|relative'
done
echo '== OpenCode status guard and contract =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
rg -n -C 18 'Publish repository_dispatch OpenCode status|github\.token|opencode-app|reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit 1|exit 0|statuses|commit.status'
git show "${head}:tests/test_opencode_agent_contract.py" |
rg -n -C 10 'reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit.?1|exit.?0|status'
echo '== Strix controls and contracts =='
for file in \
.github/workflows/strix.yml \
scripts/ci/strix_quick_gate.sh \
tests/test_required_workflow_queue_contract.py \
tests/test_strix_nvidia_nim_not_found_fallback.py \
tests/test_strix_internal_scope_instruction_contract.py
do
echo "--- ${file}"
git show "${head}:${file}" |
rg -n -i -C 10 'provider|backend|unavailable|not found|nim|quota|token limit|incomplete|neutral|exit 1|exit 0|instruction|internal.*scope|sandbox|caller'
done
echo '== PR head, reviews, and checks =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}]}'
echo '== Unresolved review threads, first page =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
-f query='query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){reviewThreads(first:100){nodes{isResolved isOutdated path line} pageInfo{hasNextPage}}}}}' \
--jq '{unresolved:[.data.repository.pullRequest.reviewThreads.nodes[]|select(.isResolved|not)|{path,line,isOutdated}],hasNextPage:.data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage}'
echo '== Exact-head runs for requested workflows =='
for workflow in \
'Trusted uv Materializer Quality CI' 'Strix' 'CodeQL PR' 'Python Security' \
'Security Scan' 'SAST Semgrep' 'Secret Scan' 'OSV-Scanner PR' \
'Scorecard PR' 'SBOM Generation'
do
echo "--- ${workflow}"
gh run list --repo "$repo" --workflow "$workflow" --commit "$head" --limit 10 \
--json status,conclusion,headSha,workflowName,url \
--jq '.[]|{status,conclusion,headSha,workflowName,url}' || true
done
echo '== Branch protection, if readable =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_status_checks:(.required_status_checks//null),required_pull_request_reviews:(.required_pull_request_reviews//null)}' || trueLength of output: 7992 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='939'
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
show_range() {
local file="$1" start="$2" end="$3"
git show "${head}:${file}" |
awk -v start="$start" -v end="$end" 'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }'
}
echo '== Trusted uv download, verification, and requirements discovery =='
show_range scripts/ci/materialize_base_python_requirements.py 40 365
show_range scripts/ci/materialize_base_python_requirements.py 475 545
echo '== Trusted uv request and requirements discovery contracts =='
for file in \
tests/test_trusted_uv_download_contract.py \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirement_paths.py
do
echo "--- ${file}"
git show "${head}:${file}" |
rg -n -C 8 'Request|User-Agent|urlopen|ProxyHandler|HTTPRedirectHandler|sha256|64 \* 1024|version|base_hash_locks|_is_candidate_lock_path|requirements/ci\.txt|service/requirements/package\.txt|relative'
done
echo '== Exact OpenCode status-publication guard and contract =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
rg -n -C 20 'Publish repository_dispatch OpenCode status|github\.token|opencode-app|reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit 1|exit 0|statuses|commit.status'
git show "${head}:tests/test_opencode_agent_contract.py" |
rg -n -C 10 'reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit.?1|exit.?0|status'
echo '== Strix failure and internal-scope controls =='
for file in \
.github/workflows/strix.yml \
scripts/ci/strix_quick_gate.sh \
tests/test_required_workflow_queue_contract.py \
tests/test_strix_nvidia_nim_not_found_fallback.py \
tests/test_strix_internal_scope_instruction_contract.py
do
echo "--- ${file}"
git show "${head}:${file}" |
rg -n -i -C 10 'provider|backend|unavailable|not found|nim|quota|token limit|incomplete|neutral|exit 1|exit 0|instruction|internal.*scope|sandbox|caller'
done
echo '== Direct static counts =='
materializer="$(git show "${head}:scripts/ci/materialize_base_python_requirements.py")"
printf 'Request constructions: '; printf '%s\n' "$materializer" | grep -c 'urllib\.request\.Request('
printf 'urlopen calls: '; printf '%s\n' "$materializer" | grep -c 'urllib\.request\.urlopen('
printf 'classifier calls within base_hash_locks: '
printf '%s\n' "$materializer" | awk '/^def base_hash_locks\(/,/^def /' | grep -c '_is_candidate_lock_path('
echo '== Current PR state, reviews, and rollup =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}]}'
echo '== Unresolved review threads, first page =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
-f query='query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){reviewThreads(first:100){nodes{isResolved isOutdated path line} pageInfo{hasNextPage}}}}}' \
--jq '{unresolved:[.data.repository.pullRequest.reviewThreads.nodes[]|select(.isResolved|not)|{path,line,isOutdated}],hasNextPage:.data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage}'
echo '== Exact-head workflow runs =='
for workflow in \
'Trusted uv Materializer Quality CI' 'Strix' 'CodeQL PR' 'Python Security' \
'Security Scan' 'SAST Semgrep' 'Secret Scan' 'OSV-Scanner PR' \
'Scorecard PR' 'SBOM Generation'
do
echo "--- ${workflow}"
gh run list --repo "$repo" --workflow "$workflow" --commit "$head" --limit 10 \
--json status,conclusion,headSha,workflowName,url \
--jq '.[]|{status,conclusion,headSha,workflowName,url}' || true
done
echo '== Branch protection, if readable =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_status_checks:(.required_status_checks//null),required_pull_request_reviews:(.required_pull_request_reviews//null)}' || trueLength of output: 112772 🏁 Script executed: #!/bin/bash
set -u
repo='ContextualWisdomLab/.github'
pr='939'
head='38cb3b9c4dd9febc475ecdc2f71c0c354032be5c'
show_range() {
local file="$1" start="$2" end="$3"
git show "${head}:${file}" |
awk -v start="$start" -v end="$end" 'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }'
}
echo '== Materializer request and path classifier =='
show_range scripts/ci/materialize_base_python_requirements.py 40 125
show_range scripts/ci/materialize_base_python_requirements.py 215 330
show_range scripts/ci/materialize_base_python_requirements.py 475 535
echo '== Complete requirement discovery regression =='
git show "${head}:tests/test_materialize_base_python_requirement_paths.py" |
awk '{printf "%6d %s\n", NR, $0}'
echo '== Exact OpenCode status-publication guard =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
awk '
/name: Publish repository_dispatch OpenCode status/ {active=1}
active {printf "%6d %s\n", NR, $0}
active && /^ - name: / && $0 !~ /Publish repository_dispatch OpenCode status/ {exit}
'
echo '== Guard contract =='
git show "${head}:tests/test_opencode_agent_contract.py" |
rg -n -C 12 'Publish repository_dispatch OpenCode status|reviews\?per_page|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|review.*evidence|exit.?1|exit.?0'
echo '== Current PR state and review evidence =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews \
--jq '{number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}]}'
echo '== Unresolved review threads, first page =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
-f query='query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){reviewThreads(first:100){nodes{isResolved isOutdated path line} pageInfo{hasNextPage}}}}}' \
--jq '{unresolved:[.data.repository.pullRequest.reviewThreads.nodes[]|select(.isResolved|not)|{path,line,isOutdated}],hasNextPage:.data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage}' || true
echo '== Exact-head workflow runs =='
for workflow in \
'Trusted uv Materializer Quality CI' 'Strix' 'CodeQL PR' 'Python Security' \
'Security Scan' 'SAST Semgrep' 'Secret Scan' 'OSV-Scanner PR' \
'Scorecard PR' 'SBOM Generation'
do
printf '%s: ' "$workflow"
gh run list --repo "$repo" --workflow "$workflow" --commit "$head" --limit 10 \
--json status,conclusion,headSha \
--jq '[.[]|{status,conclusion,headSha}]' || true
done
echo '== Branch protection, if readable =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_status_checks:(.required_status_checks//null),required_pull_request_reviews:(.required_pull_request_reviews//null)}' || trueLength of output: 64302
I found no blocking source-level defect in the requested scope.
The trusted
The cross-repository OpenCode status guard remains fail-closed.
The current live review list has no qualifying OpenCode formal review for this head. The guard will therefore fail closed if the limited-token cross-repository path runs. It will not treat optional status publication as substitute review evidence. The Strix controls remain bounded and fail-closed.
Live evidence:
I did not execute repository code or tests. I did not modify source, approve, merge, release, alter protections, or enable auto-merge. You are interacting with an AI system. |
Dismissed solely as stale predecessor-head evidence: this review is bound to 56dbb09, while the unchanged current head is 38cb3b9. The cited cancelled/failed checks do not transfer; current-head checks and review threads must still satisfy protected-main rules. This dismissal is not an approval and does not weaken any current finding.
|
Exact-current-head read-only review request for All observed exact-head quality, security, supply-chain, trusted-uv, and bounded Strix workflows are terminal-success and the only source-backed thread is resolved. Recheck the combined causal boundaries: fixed static User-Agent at the immutable Astral archive origin; exact-base regular-blob lock discovery for conventional requirements paths with bounded includes; formal exact-head review authority before optional cross-repository status tolerance; and static trusted Strix scope instruction with no caller-controlled text. Do not transfer predecessor findings, mutate the branch, synthesize approval, or merge. @opencode-agent review |
Rate Limit Exceeded
|
2 participants
Summary
This PR repairs central cross-repository review evidence without weakening a gate.
Trusted uv materialization
cwl-trusted-uv-materializer/1User-Agent to the fixed Astral archive URL;Base requirements-lock discovery
requirements*.txtlocks and direct.txtchildren of repository-relativerequirements/directories;uv.lockfiles only through the separately verified trusted-uv path.Cross-repository OpenCode evidence
Bounded Strix pull-request scope
--instructiononly when the gate created the internal changed-file scope;/workspace/<workspace_subdir>is the complete authorized target and the runner host path is intentionally absent in the sandbox;Test-first evidence
31784776654wrote the failing bounded-scope contract, applied the trusted static instruction, passed shell syntax, focused regression, and the completescripts/ci/test_strix_quick_gate.shharness, then removed its temporary workflows.31787913977demonstrated the missingrequirements/ci.txtandservice/requirements/package.txtpaths before the change, replaced the basename-only collector predicate, passed the focused regression,compileall, andgit diff --check, then removed its temporary workflow.docs/doctoring/strix-bounded-pr-scope.mdanddocs/doctoring/base-requirements-lock-discovery.mdpreserve both trust contracts and recovery evidence.38cb3b9c4dd9febc475ecdc2f71c0c354032be5c.Merge boundary
Do not transfer predecessor checks or earlier OpenCode change requests. Merge only after every exact-head workflow is terminal-success, the unchanged current head receives the two qualifying independent approvals required by the protected ruleset including last-push approval, and every review thread remains resolved. Auto-merge or direct merge may execute only through the normal protected ruleset; no bypass or review dismissal is requested.