Skip to content

fix(automation): run hourly NVIDIA NIM review repair - #782

Open
seonghobae wants to merge 119 commits into
mainfrom
fix/hourly-nvidia-nim-review-repair-main
Open

fix(automation): run hourly NVIDIA NIM review repair#782
seonghobae wants to merge 119 commits into
mainfrom
fix/hourly-nvidia-nim-review-repair-main

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Purpose

Activate a protected one-hour Clearfolio review → repair → revalidation loop while preserving the independent reviewer workflow, its credential system, and product-neutral reuse by other ContextualWisdomLab services.

Exact current head

355d9e545fd971638066e90654fdfaa105431968

All checks, reviews, approvals, and comments for predecessor heads are historical only.

Product and MSA behavior

  • Run .github/workflows/clearfolio-hourly-review-repair.yml at minute 23 of every hour.
  • Target only ContextualWisdomLab/clearfolio pull requests into protected main.
  • Permit one repair dispatch per run and enforce a one-hour same-head retry floor.
  • Reuse .github/workflows/pr-review-fix-scheduler.yml without copying privileged implementation into product repositories.
  • Retain product-level and engine-level single-flight concurrency.
  • Forward only explicitly mapped scheduler credentials; never use secrets: inherit.
  • Bind reusable scheduler source to immutable called-workflow repository/SHA/ref/path evidence.

OpenCode, token, and write-scope boundary

  • Model execution uses NVIDIA_NIM_API_KEY; COPILOT_GITHUB_TOKEN, GitHub Models, and GitHub tokens are not model credentials.
  • The product caller and reusable scheduler keep the workflow-generated GITHUB_TOKEN read-only and declare no job-level write elevation.
  • Repository mutation requires the explicitly mapped PR_REVIEW_MERGE_TOKEN or OPENCODE_APPROVE_TOKEN; there is no github.token write fallback.
  • Missing established mutation credentials fail closed before queue mutation or dispatch.
  • The independent review workflow, reviewer identity, and review credential chain remain unchanged.
  • The repair worker cannot approve, merge, release, weaken branch protection, or reinterpret failed checks.
  • Ordinary and conflict repair share the same sealed NUL-delimited exact thread-path inventory, pre-model worktree snapshot, ignored/symlink/mode/race checks, .git denial, hook suppression, fixed /usr/bin/git, and explicit revalidated push destination.

Exact-head quality state

For 355d9e545fd971638066e90654fdfaa105431968:

  • Hourly NVIDIA NIM Review Repair run 31177021917: success.
  • CodeQL PR 31177021921: success.
  • Python Security 31177021892: success.
  • SAST Semgrep 31177021889: success.
  • Security Scan 31177021847: success.
  • Secret Scan 31177021866: success.
  • OSV-Scanner PR 31177022185: success.
  • Scorecard PR 31177021886: success.
  • SBOM Generation 31177021885: success.
  • Strix Changed Path Quality CI run 31177021926: cancelled and therefore not accepted. A fresh rerun proved the repository baseline (1,064 tests plus 16 subtests) and then reproduced deterministic quick-gate contract mismatches that require a branch change rather than another unchanged-head retry.
  • Current inline review threads are resolved or outdated.
  • No qualifying independent non-author formal approval exists for this exact head.

The deterministic repair must preserve the stronger existing security boundaries: sealed JSON-only autofix path authority, validated immutable central scheduler source outputs, and no github.token mutation fallback. The OpenCode writer also needs a capability-backed reasoning configuration; the selected target is NVIDIA-hosted mistralai/mistral-small-4-119b-2603 with supported high reasoning effort, while retaining NVIDIA_NIM_API_KEY as the only model credential.

Activation and merge gate

Scheduled workflows execute only from protected main; the production heartbeat is inactive while this PR is unmerged. Merge requires the deterministic exact-head Strix failures to be repaired, every replacement-head check to pass, zero unresolved valid findings, a current-head automated review, a qualifying independent non-author formal approval, and branch-protection success without bypass. Pending, queued, cancelled, skipped-required, neutral-required, absent, stale-head, status-only, author-only, or synthetic evidence is not acceptance.

Documentation

  • docs/automation/hourly-review-repair.md
  • docs/doctoring/hourly-nvidia-nim-autofix.md
  • docs/doctoring/clearfolio-hourly-review-caller.md
  • CHANGELOG.md

Supersedes closed predecessor #779 only after protected merge and accepted-main verification.

Summary by CodeRabbit

  • 새 기능
    • 매시간 PR 검토 및 수정 자동화가 추가되었습니다.
    • Clearfolio 대상 저장소에서 제한된 범위로 리뷰·수정·재검증을 실행합니다.
    • NVIDIA NIM 기반 자동 수정과 충돌 해결을 지원합니다.
  • 보안 및 안정성 개선
    • 신뢰할 수 있는 소스와 커밋만 실행하며, 변경 범위를 엄격히 검증합니다.
    • 필요한 자격 증명만 사용하고, 승인되지 않은 파일·권한·원격 저장소 변경을 차단합니다.
    • 실패 시 안전하게 중단하고 재시도 및 동시 실행을 제한합니다.
  • 문서
    • 운영, 검증, 롤백 및 보안 절차를 문서화했습니다.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Clearfolio 시간별 호출자와 재사용 스케줄러를 추가했습니다. 스케줄러는 호출 워크플로의 저장소, 파일, SHA, ref와 체크아웃 결과를 검증합니다. 자동수정은 NVIDIA NIM을 사용하고, 허용 경로와 작업 트리 스냅샷으로 변경 범위를 검증합니다.

Changes

시간별 리뷰 복구 흐름

Layer / File(s) Summary
호출자와 불변 스케줄러 소스 검증
.github/workflows/clearfolio-hourly-review-repair.yml, .github/workflows/pr-review-fix-scheduler.yml, docs/automation/*, docs/doctoring/clearfolio-hourly-review-caller.md, tests/test_pr_review_fix_*
Clearfolio 호출자의 시간 설정, 대상 저장소, 제한, 시크릿과 권한을 구성했습니다. 호출 워크플로의 식별자와 체크아웃 결과를 검증합니다.
NVIDIA NIM 자동수정 경계
.github/workflows/hourly-nvidia-nim-review-repair.yml, .github/workflows/pr-review-autofix.yml, docs/doctoring/hourly-nvidia-nim-autofix.md, tests/test_pr_review_autofix_nvidia_nim_contract.py
NVIDIA NIM 모델과 API 키를 자동수정 단계에 연결했습니다. OpenCode 권한을 제한하고 GitHub·OIDC 자격 증명을 제거합니다.
허용 경로와 충돌 수정 범위 검증
scripts/ci/pr_review_autofix_context.py, scripts/ci/pr_review_conflict_scope.py, tests/test_pr_review_conflict_scope*.py, tests/test_hourly_autofix_context_quality_gate.py
NUL 구분 허용 경로와 SHA-256 봉인을 생성합니다. 작업 트리 스냅샷과 비교해 범위를 벗어난 파일, ignored 파일, 모드 및 심볼릭 링크 변경을 거부합니다.
계약 검증과 운영 기록
tests/test_pr_review_conflict_scope_git_executable.py, CHANGELOG.md
고정 Git 실행 파일과 자동화 경계를 검증합니다. 운영 절차와 변경 사항을 기록합니다.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ClearfolioCaller
  participant ReviewFixScheduler
  participant PRReviewAutofix
  participant OpenCode
  participant NVIDIANIM
  ClearfolioCaller->>ReviewFixScheduler: 대상 저장소와 제한 전달
  ReviewFixScheduler->>PRReviewAutofix: 검증된 워크플로 SHA로 실행
  PRReviewAutofix->>OpenCode: 허용 경로와 NVIDIA NIM 설정 전달
  OpenCode->>NVIDIANIM: 자동수정 요청
  NVIDIANIM-->>OpenCode: 수정 결과 반환
  OpenCode-->>PRReviewAutofix: 작업 트리 변경 반환
  PRReviewAutofix->>PRReviewAutofix: 변경 범위 검증 후 커밋·푸시
Loading

Possibly related issues

  • ContextualWisdomLab/four-pillars#28 — 시간별 exact-head PR 검토·수정 스케줄러와 NVIDIA NIM 경계를 직접 다룹니다.
  • ContextualWisdomLab/.github#713 — 시간별 자동화와 중앙 검토·수정 스케줄러 구조가 연결됩니다.
  • ContextualWisdomLab/life-os#119 — NVIDIA NIM 기반 시간별 OpenCode 자동화와 자격 증명 분리 목표가 연결됩니다.
  • ContextualWisdomLab/TEPP#2 — NVIDIA NIM 자격 증명 격리와 시간별 자동화 경계가 연결됩니다.

Possibly related PRs

Suggested reviewers: opencode-agent

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed Docstring coverage is 95.65% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed 제목은 시간별 NVIDIA NIM 리뷰 및 수리 자동화라는 주요 변경을 명확하고 간결하게 설명합니다.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/hourly-nvidia-nim-review-repair-main

Comment @coderabbitai help to get the list of available commands.

@seonghobae
seonghobae marked this pull request as ready for review August 5, 2026 11:46

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

@opencode-agent @cwl-noema-review Independently review exact current head 63b50227caefb49abd389a8da41edcfc1d32428e against protected main at f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae. Every direct current-head workflow is successful: Hourly NVIDIA NIM Review Repair 31002522693, Python Security 31002522736, Security Scan 31002522780, CodeQL PR 31002522802, SAST Semgrep 31002522718, Secret Scan 31002522761, OSV-Scanner PR 31002523083, Scorecard PR 31002522717, and SBOM Generation 31002522776. The PR is now Ready under its documented acceptance rule.

Verify the one-hour cadence and retry floor, one-dispatch/single-flight bounds, immutable called-workflow and repository-dispatch source binding, NVIDIA_NIM_API_KEY-only OpenCode model authentication, absence of COPILOT_GITHUB_TOKEN and GitHub Models fallback, missing-secret fail-closed behavior, strict secret step scope, child-process stripping of GitHub and OIDC credentials, file-only agent permissions, exact-head/live-head/file-allowlist/syntax/conflict guards, byte-for-byte preservation of the independent reviewer workflow, and the prohibition on approval, merge, release, or protection weakening. Distinguish this current-main replacement from closed predecessor #779. Submit actionable findings or an exact-head formal review; approval still must satisfy repository independence and branch protection.

@seonghobae
seonghobae enabled auto-merge (squash) August 5, 2026 11:46

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review @coderabbitai review

Review exact current head 63b50227caefb49abd389a8da41edcfc1d32428e against current protected main base f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae only. Permanent RED run 31002306348 recorded 13 expected contract failures on the test-only head. Permanent GREEN run 31002522693 passed the exact-head hourly cadence, immutable source identity, NVIDIA_NIM_API_KEY-only provider, missing-secret fail-closed guard, non-file permission denials, model-child GitHub/OIDC credential stripping, byte-identical independent reviewer boundary, compilation, and diff checks. Direct exact-head security, supply-chain, and SAST runs have also succeeded; duplicate reruns may still be queued. Verify one-dispatch/single-flight bounds, source pinning, secret step scope, absence of COPILOT_GITHUB_TOKEN and GitHub Models model authentication, same-repository/live-head guards, APA 7 doctoring, and the inability of the worker to approve, merge a PR, release, or weaken checks. Submit a formal current-head verdict; do not reuse ancestor reviews.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '== Repository and requested commits =='
git remote -v
git rev-parse HEAD
git show -s --format='HEAD %H%nparents %P%nsubject %s' HEAD
git cat-file -e '63b50227caefb49abd389a8da41edcfc1d32428e^{commit}' 2>/dev/null && \
  git show -s --format='requested-head %H%nparents %P%nsubject %s' 63b50227caefb49abd389a8da41edcfc1d32428e || true
git cat-file -e 'f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae^{commit}' 2>/dev/null && \
  git show -s --format='baseline %H%nsubject %s' f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae || true

printf '%s\n' '== Changed paths and diff summary =='
git diff --stat f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae 63b50227caefb49abd389a8da41edcfc1d32428e 2>/dev/null || \
git diff --stat HEAD^ HEAD
git diff --name-status f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae 63b50227caefb49abd389a8da41edcfc1d32428e 2>/dev/null || \
git diff --name-status HEAD^ HEAD

printf '%s\n' '== Candidate automation source =='
fd -HI -t f .github docs 2>/dev/null | sort | \
  grep -E 'hourly|review.*repair|dispatch|opencode|automation|doctoring|CHANGELOG' || true

printf '%s\n' '== Workflow and helper outlines =='
for f in \
  .github/workflows/hourly-nvidia-nim-review-repair.yml \
  .github/workflows/opencode-review-dispatch.yml
do
  if [ -f "$f" ]; then
    echo "--- $f"
    nl -ba "$f"
  fi
done

printf '%s\n' '== Security-sensitive references in tracked text files =='
rg -n -i -C 3 \
  'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|github models|models:|mistral-nemotron|nemotron-3-nano|canonical_ref|repository_dispatch|workflow_call|concurrency|cron|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|permissions:|pull-requests:\s*write|contents:\s*write|gh pr (merge|review)|release' \
  .github docs CHANGELOG.md 2>/dev/null || true

printf '%s\n' '== Independent reviewer workflow blob comparison =='
if git cat-file -e 'f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae:.github/workflows/opencode-review-dispatch.yml' 2>/dev/null; then
  echo -n 'baseline blob: '
  git rev-parse 'f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae:.github/workflows/opencode-review-dispatch.yml'
fi
if git cat-file -e '63b50227caefb49abd389a8da41edcfc1d32428e:.github/workflows/opencode-review-dispatch.yml' 2>/dev/null; then
  echo -n 'head blob: '
  git rev-parse '63b50227caefb49abd389a8da41edcfc1d32428e:.github/workflows/opencode-review-dispatch.yml'
fi

printf '%s\n' '== Referenced workflow runs =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
  gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
    --jq '"\(.id) \(.name) status=\(.status) conclusion=\(.conclusion) head_sha=\(.head_sha) event=\(.event)"' \
    2>&1 || true
done

Length of output: 5016


🏁 Script executed:

#!/bin/bash
set -euo pipefail

head_sha='63b50227caefb49abd389a8da41edcfc1d32428e'
base_sha='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'

show_numbered() {
  file="$1"
  if [ -f "$file" ]; then
    echo "--- $file"
    awk '{ printf "%5d  %s\n", NR, $0 }' "$file"
  else
    echo "--- MISSING: $file"
  fi
}

printf '%s\n' '== Exact changed workflow diff =='
git diff --no-ext-diff --unified=80 "$base_sha" "$head_sha" -- \
  .github/workflows/hourly-nvidia-nim-review-repair.yml \
  .github/workflows/pr-review-autofix.yml \
  .github/workflows/pr-review-fix-scheduler.yml

printf '%s\n' '== Current workflow source =='
show_numbered .github/workflows/hourly-nvidia-nim-review-repair.yml
show_numbered .github/workflows/pr-review-autofix.yml
show_numbered .github/workflows/pr-review-fix-scheduler.yml

printf '%s\n' '== Contract-test source =='
for f in \
  tests/test_pr_review_autofix_nvidia_nim_contract.py \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py
do
  show_numbered "$f"
done

printf '%s\n' '== Repository-wide security-sensitive executable references =='
git grep -n -I -E \
  'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|models\.inference\.ai|github[ _-]?models|canonical_ref|ACTIONS_ID_TOKEN_REQUEST_TOKEN|ACTIONS_ID_TOKEN_REQUEST_URL|GITHUB_TOKEN|GH_TOKEN|repository_dispatch|workflow_call|concurrency:|cron:|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b|gh pr (merge|review)|gh release|branches/.+protection' \
  "$head_sha" -- .github ':!*.md' || true

printf '%s\n' '== Independent reviewer workflow immutable blob check =='
expected_blob='83f6830d5c21a324b4dbcd4e5c21a07968994b81'
base_blob=$(git rev-parse "$base_sha:.github/workflows/opencode-review-dispatch.yml")
head_blob=$(git rev-parse "$head_sha:.github/workflows/opencode-review-dispatch.yml")
printf 'expected=%s\nbaseline=%s\nhead=%s\n' "$expected_blob" "$base_blob" "$head_blob"
git diff --no-ext-diff --exit-code "$base_sha" "$head_sha" -- .github/workflows/opencode-review-dispatch.yml || true

printf '%s\n' '== Requested workflow runs =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
  printf 'run %s: ' "$run"
  gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
    --jq '[.id, .name, .status, .conclusion, .head_sha, .event] | `@tsv`' 2>&1 || true
done

Length of output: 156113


🤖 web_search executed:

GitHub Actions contexts documentation job.workflow_repository job.workflow_sha job.workflow_ref job.workflow_file_path github.workflow_ref github.workflow_sha

Length of output: 13390


@seonghobae Formal review completed for 63b50227caefb49abd389a8da41edcfc1d32428e against f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae.

I found no actionable findings in the requested scope.

Verified items:

  • The scheduler runs at minute 23 of every hour.
  • The same-head retry floor is one hour.
  • The scheduler retains one dispatch per run and repository-scoped single-flight concurrency.
  • The reusable scheduler binds its source to job.workflow_repository, job.workflow_sha, job.workflow_ref, and job.workflow_file_path.
  • The scheduler validates the identity before checkout and verifies the checked-out SHA and workflow file before it runs the helper.
  • canonical_ref remains accepted and ignored.
  • The dispatch worker pins its trusted helper checkout to ${{ github.sha }}.
  • The autofix worker enables only nvidia-nim.
  • The primary model is nvidia-nim/mistralai/mistral-nemotron.
  • The helper model is nvidia-nim/nvidia/nemotron-3-nano-30b-a3b.
  • The autofix workflow contains no COPILOT_GITHUB_TOKEN, GitHub Models provider, or GitHub-token model fallback.
  • secrets.NVIDIA_NIM_API_KEY is bound only to the two OpenCode execution steps.
  • Both model steps fail closed when NVIDIA_NIM_API_KEY is absent.
  • Both OpenCode child processes remove GITHUB_TOKEN, GH_TOKEN, and Actions OIDC request credentials.
  • Global and named-agent permissions deny non-file interactions.
  • Same-repository, exact-head, live-head, file-allowlist, syntax, and conflict-marker guards remain in place.
  • .github/workflows/opencode-review-dispatch.yml is unchanged. Its baseline and head blob are both 83f6830d5c21a324b4dbcd4e5c21a07968994b81.
  • The nine listed workflow runs completed successfully for this exact head.

GitHub documents the job.workflow_* identity properties used by the reusable workflow. These properties are unavailable on GitHub Enterprise Server. This PR targets GitHub.com.

This review covers current PR #782. It does not evaluate closed predecessor #779 as the implementation source.

I do not issue approval. Approval must remain subject to the required independent reviewer and branch-protection policy.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review @coderabbitai review

Review exact current head 63b50227caefb49abd389a8da41edcfc1d32428e only. The permanent hourly NVIDIA NIM contract and all direct current-head security/supply-chain workflows have succeeded at least once; later duplicate same-head reruns are still settling. Verify the hourly minute-23 cadence, one-hour retry floor, immutable called-workflow source identity, NVIDIA_NIM_API_KEY-only model authentication, primary/helper model routing, missing-secret fail-closed behavior, child-process token/OIDC scrubbing, complete unattended-agent permission denials, independent reviewer byte stability, exact-head/same-repository/file-allowlist/live-head safeguards, APA 7 doctoring, and the prohibition on approval, merge, release, or branch-protection changes. Submit current-head verdicts and qualifying independent approval without reusing #779 evidence.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

@seonghobae I will review PR #782 at exact head 63b50227caefb49abd389a8da41edcfc1d32428e only.

I will verify the requested scheduler, source-binding, NVIDIA NIM credential, token-scrubbing, permission, safety-guard, independent-reviewer, and documentation controls. I will not reuse #779 evidence. I will not issue approval unless the required independent approval and branch-protection conditions are satisfied.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head_expected='63b50227caefb49abd389a8da41edcfc1d32428e'
base_expected='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'

printf '%s\n' '== checked-out commit =='
git rev-parse HEAD
printf '%s\n' '== expected commits present =='
git cat-file -e "${head_expected}^{commit}"
git cat-file -e "${base_expected}^{commit}"

printf '%s\n' '== changed paths =='
git diff --name-status "$base_expected" "$head_expected"

printf '%s\n' '== changed workflow files =='
git diff --stat "$base_expected" "$head_expected" -- .github/workflows
fd -a -t f .github/workflows | sort

printf '%s\n' '== workflow and helper symbols =='
for f in \
  .github/workflows/hourly-nvidia-nim-review-repair.yml \
  .github/workflows/opencode-review-dispatch.yml
do
  if [ -f "$f" ]; then
    printf '\n--- %s ---\n' "$f"
    cat -n "$f"
  fi
done

printf '%s\n' '== references to hourly scheduler, dispatch, and model authentication =='
rg -n -C 3 \
  -e 'NVIDIA_NIM_API_KEY' \
  -e 'COPILOT_GITHUB_TOKEN' \
  -e 'GitHub Models|models\.github' \
  -e 'canonical_ref' \
  -e 'repository_dispatch|workflow_dispatch|concurrency|cron' \
  -e 'GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST' \
  -e 'opencode|nemotron|mistral-nemotron' \
  -e 'pull-requests:\s*write|contents:\s*write|actions:\s*write' \
  .github scripts 2>/dev/null || true

Length of output: 2843


🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='63b50227caefb49abd389a8da41edcfc1d32428e'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'

printf '%s\n' '== independent reviewer workflow blob at head and base =='
git rev-parse "${head}:.github/workflows/opencode-review-dispatch.yml"
git rev-parse "${base}:.github/workflows/opencode-review-dispatch.yml"
git diff --exit-code "$base" "$head" -- .github/workflows/opencode-review-dispatch.yml \
  && echo 'independent-reviewer workflow: unchanged'

printf '%s\n' '== all workflow paths at reviewed head =='
git ls-tree -r --name-only "$head" .github/workflows | sort

for f in \
  .github/workflows/hourly-nvidia-nim-review-repair.yml \
  .github/workflows/pr-review-autofix.yml \
  .github/workflows/pr-review-fix-scheduler.yml
do
  printf '\n== %s at exact head ==\n' "$f"
  git show "${head}:${f}" | cat -n
done

printf '%s\n' '== exact workflow diffs =='
git diff --unified=80 "$base" "$head" -- \
  .github/workflows/hourly-nvidia-nim-review-repair.yml \
  .github/workflows/pr-review-autofix.yml \
  .github/workflows/pr-review-fix-scheduler.yml

printf '%s\n' '== scheduler/autofix source and credential references at exact head =='
git grep -n -I -E \
  'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|models\.github|GitHub Models|canonical_ref|ACTIONS_ID_TOKEN_REQUEST|GITHUB_TOKEN|GH_TOKEN|repository_dispatch|workflow_call|workflow_dispatch|concurrency|cron|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b' \
  "$head" -- .github scripts 2>/dev/null || true

printf '%s\n' '== focused contract test outlines =='
ast-grep outline tests/test_pr_review_autofix_nvidia_nim_contract.py --items all
ast-grep outline tests/test_pr_review_fix_hourly_contract.py --items all
ast-grep outline tests/test_pr_review_fix_scheduler_source_pin.py --items all

printf '%s\n' '== focused contract test assertions =='
for f in \
  tests/test_pr_review_autofix_nvidia_nim_contract.py \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py
do
  printf '\n== %s ==\n' "$f"
  git show "${head}:${f}" | sed -n '1,280p'
done

Length of output: 223866


🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='63b50227caefb49abd389a8da41edcfc1d32428e'

printf '%s\n' '== scheduler helper outline =='
ast-grep outline scripts/ci/pr_review_fix_scheduler.py --items all

printf '%s\n' '== scheduler helper dispatch, bounds, and guard references =='
git show "${head}:scripts/ci/pr_review_fix_scheduler.py" |
  nl -ba |
  grep -E -C 8 \
    'max.dispatch|retry.hours|repository.dispatch|autofix|head.sha|live.head|allowed|allowlist|same.repository|pull.request|conflict|syntax|dispatch' || true

printf '%s\n' '== selected helper source =='
git show "${head}:scripts/ci/pr_review_fix_scheduler.py" | sed -n '1,920p'

printf '%s\n' '== prohibited worker operation scan =='
git show "${head}:.github/workflows/pr-review-autofix.yml" |
  nl -ba |
  grep -Ei -C 4 \
    'pulls/.*/merge|/merges|merge.pull|pulls/.*/reviews|approve|releases|branches/.*/protection|rulesets|gh pr (merge|review)|gh release|gh api.*(merge|protection|ruleset|releases)' || true

printf '%s\n' '== operator documentation =='
for f in \
  docs/automation/hourly-review-repair.md \
  docs/doctoring/hourly-nvidia-nim-autofix.md \
  CHANGELOG.md
do
  printf '\n== %s ==\n' "$f"
  git show "${head}:${f}" | cat -n
done

Length of output: 39579


@seonghobae: Formal review verdict: request changes.

  • High — conflict resolution can push edits outside the conflict file set. In .github/workflows/pr-review-autofix.yml, the conflict path instructs OpenCode to edit only conflicted_files, but it does not enforce this instruction. After the model process at Line 524, the workflow stages all worktree changes with git add -A at Line 535 and pushes them. The normal autofix path has a file-allowlist validation step, but that step does not run when RESOLVE_CONFLICT == 'true'. A prompt is not an enforcement boundary because the model has edit: allow over the full worktree. Derive an allowed-path file from conflicted_files, reject all changed and untracked paths outside that set, and perform this check before staging or committing. Update the doctoring claim that all changed paths are rejected outside the allowlist.

I verified commit 63b50227caefb49abd389a8da41edcfc1d32428e against base f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae. I also verified the hourly 23 * * * * cadence, one-hour retry default, one-dispatch default, repository-scoped single-flight concurrency, immutable called-workflow source checks, NIM-only ordinary autofix configuration, missing-secret preflight, subprocess credential stripping, and unchanged independent reviewer blob 83f6830d5c21a324b4dbcd4e5c21a07968994b81.

You are interacting with an AI system.

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review @coderabbitai review

Please review exact head 63b50227caefb49abd389a8da41edcfc1d32428e. Direct security, dependency, SBOM, Secret Scan, Semgrep, Python Security, focused hourly-NVIDIA-NIM contract, and an earlier exact-head CodeQL run are successful; the latest CodeQL rerun remains in progress. Treat only current-head evidence as authoritative. Verify the NVIDIA-NIM-only model path, one-hour cadence/retry floor, immutable reusable-workflow source, model-process credential isolation, unchanged independent reviewer workflow, and absence of approve/merge/release/protection APIs.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Please review exact current head 63b50227caefb49abd389a8da41edcfc1d32428e. Verify the hourly cadence, one-hour same-head retry floor, immutable called-workflow source binding, NVIDIA NIM-only model authentication, strict secret scoping and child-process credential stripping, permission denials, unchanged independent review workflow, permanent contract gate, doctoring, and branch-protection boundaries. Submit an approval only if no blocking finding remains.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='63b50227caefb49abd389a8da41edcfc1d32428e'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
expected_blob='83f6830d5c21a324b4dbcd4e5c21a07968994b81'

git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"

printf '%s\n' '== reviewed commits =='
git show -s --format='head=%H%nbase=%P%nsubject=%s' "$head"
git show -s --format='baseline=%H%nsubject=%s' "$base"

printf '%s\n' '== changed paths =='
git diff --name-status "$base" "$head"

printf '%s\n' '== scheduler and autofix workflow at exact head =='
for path in \
  .github/workflows/hourly-nvidia-nim-review-repair.yml \
  .github/workflows/pr-review-fix-scheduler.yml \
  .github/workflows/pr-review-autofix.yml \
  scripts/ci/pr_review_fix_scheduler.py \
  docs/automation/hourly-review-repair.md \
  docs/doctoring/hourly-nvidia-nim-autofix.md
do
  printf '\n--- %s ---\n' "$path"
  git show "${head}:${path}" | nl -ba
done

printf '%s\n' '== independent reviewer blob =='
printf 'expected=%s\n' "$expected_blob"
printf 'base=%s\n' "$(git rev-parse "${base}:.github/workflows/opencode-review-dispatch.yml")"
printf 'head=%s\n' "$(git rev-parse "${head}:.github/workflows/opencode-review-dispatch.yml")"
git diff --exit-code "$base" "$head" -- .github/workflows/opencode-review-dispatch.yml

printf '%s\n' '== security-sensitive references at exact head =='
git grep -n -I -E \
  'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|models\.github|GitHub Models|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b|23 \* \* \* \*|retry.hours|canonical_ref|job\.workflow_(repository|sha|ref|file_path)|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|gh pr (merge|review)|pulls/.*/(merge|reviews)|releases|branches/.+protection|rulesets|git add -A|conflicted_files' \
  "$head" -- .github scripts docs ':!*.md' || true

printf '%s\n' '== current-head workflow runs =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
  gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
    --jq '[.id, .name, .status, .conclusion, .head_sha, .event] | `@tsv`' \
    2>&1 || true
done

Length of output: 3363


🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='63b50227caefb49abd389a8da41edcfc1d32428e'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
expected_blob='83f6830d5c21a324b4dbcd4e5c21a07968994b81'

show_file() {
  path="$1"
  printf '\n--- %s ---\n' "$path"
  git show "${head}:${path}" | awk '{ printf "%5d  %s\n", NR, $0 }'
}

printf '%s\n' '== exact-head workflow and helper source =='
for path in \
  .github/workflows/hourly-nvidia-nim-review-repair.yml \
  .github/workflows/pr-review-fix-scheduler.yml \
  .github/workflows/pr-review-autofix.yml \
  scripts/ci/pr_review_fix_scheduler.py \
  docs/automation/hourly-review-repair.md \
  docs/doctoring/hourly-nvidia-nim-autofix.md
do
  show_file "$path"
done

printf '%s\n' '== independent reviewer blob comparison =='
printf 'expected=%s\n' "$expected_blob"
printf 'base=%s\n' "$(git rev-parse "${base}:.github/workflows/opencode-review-dispatch.yml")"
printf 'head=%s\n' "$(git rev-parse "${head}:.github/workflows/opencode-review-dispatch.yml")"
if git diff --quiet "$base" "$head" -- .github/workflows/opencode-review-dispatch.yml; then
  printf '%s\n' 'workflow_unchanged=true'
else
  printf '%s\n' 'workflow_unchanged=false'
fi

printf '%s\n' '== focused security controls at exact head =='
git grep -n -I -E \
  'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|models\.github|GitHub Models|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b|23 \* \* \* \*|retry.hours|canonical_ref|job\.workflow_(repository|sha|ref|file_path)|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|gh pr (merge|review)|pulls/.*/(merge|reviews)|releases|branches/.+protection|rulesets|git add -A|conflicted_files' \
  "$head" -- .github scripts docs ':!*.md' || true

printf '%s\n' '== specified workflow-run metadata =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
  printf 'run=%s ' "$run"
  gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
    --jq '[.name, .status, .conclusion, .head_sha, .event] | `@tsv`' \
    2>&1 || true
done

Length of output: 166782


@seonghobae Formal review verdict: request changes.

High — Conflict resolution does not enforce its file boundary

In .github/workflows/pr-review-autofix.yml, the conflict path records conflicted_files at Line 472. It instructs OpenCode to edit only those files at Lines 493-507. This is a prompt constraint only.

The OpenCode agent has edit: allow for the full PR worktree. After model execution, the workflow stages every worktree change with git add -A at Line 535. The conflict path does not validate changed or untracked paths against conflicted_files before it commits and pushes at Lines 558-559.

An unrelated model edit can therefore be committed during conflict resolution.

Before git add -A, derive a normalized allowed-path file from conflicted_files. Reject every changed or untracked path that is not in that file. Keep the conflict-marker, Python syntax, and live-head checks after this path validation. Update docs/doctoring/hourly-nvidia-nim-autofix.md at Lines 133-138 because its statement that the workflow rejects all paths outside the allowlist is not true for conflict resolution.

I verified the following controls at exact head 63b50227caefb49abd389a8da41edcfc1d32428e:

  • The scheduler uses 23 * * * *.
  • The retry floor defaults to one hour.
  • The dispatch limit defaults to one.
  • Repository-scoped scheduler concurrency is present.
  • The reusable scheduler validates and checks out job.workflow_repository, job.workflow_sha, job.workflow_ref, and job.workflow_file_path.
  • The autofix worker checks out trusted helper source at ${{ github.sha }}.
  • The autofix OpenCode configuration enables only nvidia-nim.
  • The primary model is nvidia-nim/mistralai/mistral-nemotron.
  • The helper model is nvidia-nim/nvidia/nemotron-3-nano-30b-a3b.
  • secrets.NVIDIA_NIM_API_KEY is bound only to the two OpenCode execution steps.
  • Both OpenCode steps fail closed when the NVIDIA secret is absent.
  • Both OpenCode child processes remove GITHUB_TOKEN, GH_TOKEN, and Actions OIDC request credentials.
  • Both permission maps deny the required non-file interactions.
  • .github/workflows/opencode-review-dispatch.yml is unchanged at blob 83f6830d5c21a324b4dbcd4e5c21a07968994b81.
  • The listed hourly contract, security, CodeQL, Semgrep, secret scan, OSV, Scorecard, and SBOM runs completed successfully for this exact head.

I found no separate approve, merge, release, or branch-protection operation in the reviewed scheduler or autofix worker. I do not approve this PR while the conflict-resolution file-boundary issue remains.

You are interacting with an AI system.

Copy link
Copy Markdown
Contributor Author

@opencode-agent Please independently review exact current head 63b50227caefb49abd389a8da41edcfc1d32428e after current-head checks complete. Confirm the repair worker uses only NVIDIA_NIM_API_KEY for model authentication, strips GitHub and OIDC credentials from child processes, cannot approve/merge/release, binds trusted workflow source immutably, preserves one-dispatch single-flight limits, and satisfies 100% coverage/docstring and doctoring contracts. Submit APPROVE only if no blocker remains.

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review Please perform a second independent exact-head review of 63b50227caefb49abd389a8da41edcfc1d32428e after current checks complete. Verify the NVIDIA NIM-only write-capable OpenCode boundary, immutable source receipt, credential isolation, denied non-file interactions, hourly bounded scheduler semantics, unchanged independent reviewer credentials, APA 7 doctoring, and fail-closed missing-secret/provider behavior. Submit APPROVE only if no actionable finding remains.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='63b50227caefb49abd389a8da41edcfc1d32428e'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
reviewer_blob='83f6830d5c21a324b4dbcd4e5c21a07968994b81'

git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"

printf '%s\n' '== exact commits =='
git show -s --format='head %H%nsubject %s' "$head"
git show -s --format='base %H%nsubject %s' "$base"

printf '%s\n' '== changed paths =='
git diff --name-status "$base" "$head"

printf '%s\n' '== reviewer workflow blob stability =='
printf 'expected %s\n' "$reviewer_blob"
printf 'base     %s\n' "$(git rev-parse "$base:.github/workflows/opencode-review-dispatch.yml")"
printf 'head     %s\n' "$(git rev-parse "$head:.github/workflows/opencode-review-dispatch.yml")"
git diff --exit-code "$base" "$head" -- .github/workflows/opencode-review-dispatch.yml || true

printf '%s\n' '== hourly scheduler and source binding =='
git show "$head:.github/workflows/hourly-nvidia-nim-review-repair.yml" | nl -ba
git show "$head:.github/workflows/pr-review-fix-scheduler.yml" | nl -ba

printf '%s\n' '== autofix model steps, permission maps, and conflict handling =='
git show "$head:.github/workflows/pr-review-autofix.yml" | nl -ba | \
  grep -E -C 12 \
  'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|GitHub Models|models\.github|mistral-nemotron|nemotron-3-nano|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST|permission|conflicted_files|RESOLVE_CONFLICT|git add|git commit|git push|merge|approve|release|protection' || true

printf '%s\n' '== scheduler helper safeguards =='
git show "$head:scripts/ci/pr_review_fix_scheduler.py" | nl -ba | \
  grep -E -C 8 \
  'retry|dispatch|concurrency|same.repository|head.sha|live.head|allowlist|allowed|conflict|syntax' || true

printf '%s\n' '== focused contract tests and operator documentation =='
for path in \
  tests/test_pr_review_autofix_nvidia_nim_contract.py \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py \
  docs/automation/hourly-review-repair.md \
  docs/doctoring/hourly-nvidia-nim-autofix.md
do
  printf '\n--- %s ---\n' "$path"
  git show "$head:$path" | nl -ba
done

printf '%s\n' '== exact-head workflow run status =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
  gh api "repos/ContextualWisdomLab/.github/actions/runs/$run" \
    --jq '[.id,.name,.status,.conclusion,.head_sha] | `@tsv`' 2>&1 || true
done

Length of output: 3741


🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='63b50227caefb49abd389a8da41edcfc1d32428e'

numbered_show() {
  local path="$1"
  printf '\n--- %s ---\n' "$path"
  git show "${head}:${path}" | awk '{printf "%5d  %s\n", NR, $0}'
}

printf '%s\n' '== hourly scheduler =='
numbered_show '.github/workflows/hourly-nvidia-nim-review-repair.yml'

printf '%s\n' '== reusable scheduler workflow =='
numbered_show '.github/workflows/pr-review-fix-scheduler.yml'

printf '%s\n' '== autofix workflow: credential, permissions, conflict and staging controls =='
git show "${head}:.github/workflows/pr-review-autofix.yml" |
  awk '{printf "%5d  %s\n", NR, $0}' |
  grep -E -C 15 \
    'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|GitHub Models|models\.github|mistral-nemotron|nemotron-3-nano|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST|permissions:|conflicted_files|RESOLVE_CONFLICT|git add|git commit|git push|merge|approve|release|protection' || true

printf '%s\n' '== conflict branch in full context =='
git show "${head}:.github/workflows/pr-review-autofix.yml" |
  awk '{printf "%5d  %s\n", NR, $0}' |
  sed -n '430,570p'

printf '%s\n' '== scheduler helper guard references =='
git show "${head}:scripts/ci/pr_review_fix_scheduler.py" |
  awk '{printf "%5d  %s\n", NR, $0}' |
  grep -E -C 8 \
    'retry|dispatch|concurrency|same.repository|head.sha|live.head|allowlist|allowed|conflict|syntax' || true

printf '%s\n' '== focused contracts: relevant assertions =='
for path in \
  tests/test_pr_review_autofix_nvidia_nim_contract.py \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py
do
  printf '\n--- %s ---\n' "$path"
  git show "${head}:${path}" |
    awk '{printf "%5d  %s\n", NR, $0}' |
    grep -E -C 4 \
      'conflict|allowlist|NVIDIA|COPILOT|GitHub Models|credential|permission|cron|retry|workflow_(repository|sha|ref|file_path)|checkout|dispatch|approve|merge|release|protection' || true
done

printf '%s\n' '== doctoring: safeguards and stated claims =='
git show "${head}:docs/doctoring/hourly-nvidia-nim-autofix.md" |
  awk '{printf "%5d  %s\n", NR, $0}' |
  grep -E -C 4 \
    'allowlist|conflict|NVIDIA|credential|GitHub|permission|approval|merge|release|protection|APA' || true

printf '%s\n' '== exact-head workflow runs =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
  printf 'run %s: ' "$run"
  gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
    --jq '[.id,.name,.status,.conclusion,.head_sha] | `@tsv`' 2>&1 || true
done

Length of output: 86050


@seonghobae Formal review verdict: request changes.

I reviewed exact head 63b50227caefb49abd389a8da41edcfc1d32428e.

I verified the requested hourly cadence, one-hour retry floor, one-dispatch bound, repository-scoped concurrency, immutable called-workflow source binding, NVIDIA NIM-only provider configuration, model routing, NVIDIA secret scope, missing-secret failure, child-process GitHub/OIDC credential stripping, permission denials, exact-head checkout, and unchanged reviewer workflow blob 83f6830d5c21a324b4dbcd4e5c21a07968994b81.

The permanent contract gate and all nine listed direct workflows completed successfully for this exact head.

One blocking finding remains:

  • High — conflict resolution does not enforce the conflict-file boundary. In .github/workflows/pr-review-autofix.yml, the conflict prompt restricts the agent to conflicted_files at Lines 493-507. The workflow does not enforce that restriction. The conflict path skips Validate changed files, then runs git add -A at Line 535 and pushes the result. The OpenCode agent has edit: allow for the worktree. It can therefore modify a non-conflicted path, and the workflow will stage and push that modification.
    Snapshot the worktree immediately after git merge and before OpenCode runs. After OpenCode exits, reject model-caused changes and untracked paths outside conflicted_files before staging. Preserve expected non-conflict changes that git merge produced. Add a focused contract test. Update docs/doctoring/hourly-nvidia-nim-autofix.md Lines 133-138 because the current claim that the workflow rejects all paths outside the allowlist does not apply to conflict resolution.

I cannot approve while this write-capable path remains unbounded.

You are interacting with an AI system.

Copy link
Copy Markdown
Contributor Author

@opencode-agent review
@cwl-noema-review
@coderabbitai review

Review exact current head 63b50227caefb49abd389a8da41edcfc1d32428e only. Verify hourly minute-23 cadence, one-hour same-head retry floor, immutable called-workflow source binding, NVIDIA NIM-only model authentication through NVIDIA_NIM_API_KEY, child-process GitHub/OIDC credential removal, complete file-only permission denials, reviewer workflow byte preservation, and absence of approval, merge, release, or branch-protection authority in the repair worker.

@seonghobae
seonghobae marked this pull request as draft August 5, 2026 11:53
auto-merge was automatically disabled August 5, 2026 11:53

Pull request was converted to draft

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='63b50227caefb49abd389a8da41edcfc1d32428e'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
reviewer_blob='83f6830d5c21a324b4dbcd4e5c21a07968994b81'

git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"

printf '%s\n' '== Commits =='
printf 'checked_out='; git rev-parse HEAD
git show -s --format='head=%H%nbase-parent=%P%nsubject=%s' "$head"
git show -s --format='baseline=%H%nsubject=%s' "$base"

printf '%s\n' '== Changed paths =='
git diff --name-status "$base" "$head"

printf '%s\n' '== Independent reviewer workflow identity =='
printf 'expected=%s\n' "$reviewer_blob"
printf 'base=%s\n' "$(git rev-parse "$base:.github/workflows/opencode-review-dispatch.yml")"
printf 'head=%s\n' "$(git rev-parse "$head:.github/workflows/opencode-review-dispatch.yml")"
git diff --quiet "$base" "$head" -- .github/workflows/opencode-review-dispatch.yml &&
  printf '%s\n' 'reviewer_workflow_unchanged=true'

printf '%s\n' '== Exact-head workflow source =='
for path in \
  .github/workflows/hourly-nvidia-nim-review-repair.yml \
  .github/workflows/pr-review-fix-scheduler.yml \
  .github/workflows/pr-review-autofix.yml \
  scripts/ci/pr_review_fix_scheduler.py \
  docs/doctoring/hourly-nvidia-nim-autofix.md
do
  printf '\n--- %s ---\n' "$path"
  git show "${head}:${path}" | nl -ba
done

printf '%s\n' '== Sensitive control references =='
git grep -n -I -E \
  '23 \* \* \* \*|retry.hours|canonical_ref|workflow_(repository|sha|ref|file_path)|NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|GitHub Models|models\.github|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|permissions:|repository_dispatch|concurrency:|conflicted_files|RESOLVE_CONFLICT|git add -A|gh pr (merge|review)|gh release|pulls/.*/(merge|reviews)|branches/.+protection|rulesets' \
  "$head" -- .github scripts docs ':!*.md' || true

printf '%s\n' '== Exact-head workflow runs =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
  printf 'run=%s ' "$run"
  gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
    --jq '[.name,.status,.conclusion,.head_sha,.event] | `@tsv`' 2>&1 || true
done

Length of output: 3707


🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='63b50227caefb49abd389a8da41edcfc1d32428e'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'

numbered_show() {
  path="$1"
  printf '\n--- %s ---\n' "$path"
  git show "${head}:${path}" | awk '{ printf "%5d  %s\n", NR, $0 }'
}

printf '%s\n' '== Exact-head workflow source =='
for path in \
  .github/workflows/hourly-nvidia-nim-review-repair.yml \
  .github/workflows/pr-review-fix-scheduler.yml \
  .github/workflows/pr-review-autofix.yml \
  scripts/ci/pr_review_fix_scheduler.py \
  docs/doctoring/hourly-nvidia-nim-autofix.md
do
  numbered_show "$path"
done

printf '%s\n' '== Autofix conflict branch, complete context =='
git show "${head}:.github/workflows/pr-review-autofix.yml" |
  awk '{ printf "%5d  %s\n", NR, $0 }' |
  sed -n '430,575p'

printf '%s\n' '== Scheduler dispatch and retry controls =='
git show "${head}:scripts/ci/pr_review_fix_scheduler.py" |
  awk '{ printf "%5d  %s\n", NR, $0 }' |
  grep -E -C 8 'retry|dispatch|concurrency|same.repository|head.sha|live.head|allowlist|allowed|conflict|syntax' || true

printf '%s\n' '== Sensitive control references at exact head =='
git grep -n -I -E \
  '23 \* \* \* \*|retry.hours|canonical_ref|workflow_(repository|sha|ref|file_path)|NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|GitHub Models|models\.github|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|permissions:|repository_dispatch|concurrency:|conflicted_files|RESOLVE_CONFLICT|git add -A|gh pr (merge|review)|gh release|pulls/.*/(merge|reviews)|branches/.+protection|rulesets' \
  "$head" -- .github scripts docs ':!*.md' || true

printf '%s\n' '== Relevant exact-head contract assertions =='
for path in \
  tests/test_pr_review_autofix_nvidia_nim_contract.py \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py
do
  printf '\n--- %s ---\n' "$path"
  git show "${head}:${path}" |
    awk '{ printf "%5d  %s\n", NR, $0 }' |
    grep -E -C 4 'conflict|allowlist|NVIDIA|COPILOT|GitHub Models|credential|permission|cron|retry|workflow_(repository|sha|ref|file_path)|checkout|dispatch|approve|merge|release|protection' || true
done

printf '%s\n' '== Exact-head workflow run metadata =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
  printf 'run=%s ' "$run"
  gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
    --jq '[.name,.status,.conclusion,.head_sha,.event] | `@tsv`' 2>&1 || true
done

Length of output: 245059


@seonghobae Formal review verdict: request changes.

I reviewed only commit 63b50227caefb49abd389a8da41edcfc1d32428e.

High — Conflict resolution does not enforce its file boundary

In .github/workflows/pr-review-autofix.yml, the conflict path records conflicted_files at Line 472. It tells OpenCode to edit only those paths at Lines 493-507. This restriction is only in the prompt.

The OpenCode agent has edit: allow for the PR worktree. After OpenCode exits, the workflow runs git add -A at Line 535 and pushes the merge commit at Lines 558-559. It does not reject changed or untracked paths outside conflicted_files.

An OpenCode conflict-resolution run can therefore modify an unrelated path, and the workflow can stage and push that modification.

Before git add -A, create an allowed-path list from conflicted_files. Compare model-caused changed and untracked paths against this list. Do not reject legitimate non-conflict changes made by git merge before OpenCode runs. A pre-OpenCode worktree snapshot can distinguish merge changes from model changes. Add a focused contract test. Update docs/doctoring/hourly-nvidia-nim-autofix.md Lines 133-138 because the stated file-allowlist enforcement does not apply to the conflict path.

I verified these controls at the requested commit:

  • The scheduler uses 23 * * * *.
  • The same-head retry default is one hour.
  • The dispatch limit is one.
  • The scheduler uses repository-scoped single-flight concurrency.
  • The scheduler validates job.workflow_repository, job.workflow_sha, job.workflow_ref, and job.workflow_file_path before checkout.
  • The scheduler checks out the validated SHA and verifies the checked-out commit and workflow file.
  • canonical_ref remains accepted and is not consumed.
  • The worker checks out trusted helper source at ${{ github.sha }}.
  • The OpenCode configuration enables only nvidia-nim.
  • The primary model is nvidia-nim/mistralai/mistral-nemotron.
  • The helper model is nvidia-nim/nvidia/nemotron-3-nano-30b-a3b.
  • secrets.NVIDIA_NIM_API_KEY is bound only to the two OpenCode execution steps.
  • Both OpenCode steps fail if NVIDIA_NIM_API_KEY is empty.
  • Both OpenCode child processes remove GITHUB_TOKEN, GH_TOKEN, and Actions OIDC request credentials.
  • Both permission maps deny the required non-file interactions.
  • .github/workflows/opencode-review-dispatch.yml is unchanged at blob 83f6830d5c21a324b4dbcd4e5c21a07968994b81.
  • I found no approval, PR-merge, release, or branch-protection operation in the reviewed scheduler or autofix worker.
  • The nine listed workflow runs completed successfully for this exact commit.

I cannot approve while the conflict-resolution write path remains unbounded.

You are interacting with an AI system.

Copy link
Copy Markdown
Contributor Author

@opencode-agent review

Use the newest exact head only. If every required check is green and there is no actionable finding, submit formal approval; otherwise state the blocker. Do not mutate or merge.

@seonghobae
seonghobae dismissed opencode-agent[bot]’s stale review August 7, 2026 11:36

Dismissed as stale predecessor-head evidence. This review is explicitly bound to head 1ce6406 and failed coverage run 31153569479. The live head is b921e26; its hourly quality gate and every direct security, code-scanning, dependency, Scorecard, and SBOM workflow completed successfully, and all inline findings are resolved or outdated. A fresh independent exact-head approval is still required.

Copy link
Copy Markdown
Contributor Author

Exact-current-head independent merge-gate refresh for b921e26854f1b0fd367c76a32af6db966374bcef against protected main. Refetch live state before verdict; do not reuse any predecessor-head review or check.

@opencode-agent review
@cwl-noema-review
@coderabbitai review

All repository-required exact-head workflow runs currently recorded for this SHA are complete/successful, and all known inline threads are resolved or outdated. Review read-only and fail closed: independently inspect the complete diff, current exact-head checks/statuses, unresolved threads, NVIDIA-NIM-only model credential boundary, read-only workflow GITHUB_TOKEN, explicit mutation-token mapping, conflict/symlink/path/race protections, full 100% helper coverage/docstring contract, and absence of temporary/self-modifying branch-writer scope. Submit a formal non-author APPROVED review only if every current-head requirement is genuinely satisfied. Do not modify the branch, synthesize approval, bypass protection, or merge.

@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 17 minutes and 24 seconds before sending another message.

Copy link
Copy Markdown
Contributor Author

Exact-current-head review request for b921e26854f1b0fd367c76a32af6db966374bcef. Predecessor-head reviews and checks do not transfer. Current exact-head inline threads are resolved/outdated; preserve reviewer identities, credential scopes, and the independent review chain. New same-head workflow reruns are queued, so do not approve or merge until required contexts finish successfully.

@coderabbitai review
@opencode-agent review
@cwl-noema-review review
@strix review

Review read-only. Do not update the branch, synthesize approval, bypass protection, or alter the existing reviewer credentials. Submit an exact-head verdict only after inspecting the complete current diff and same-head required checks.

@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 15 minutes and 41 seconds before sending another message.

Copy link
Copy Markdown
Contributor Author

@opencode-agent review
@cwl-noema-review review

Do not post another top-level acknowledgement. Submit the formal exact-head review verdict through the GitHub review API when current-head checks are complete; approve only if no blocker remains. Do not mutate or merge.

Copy link
Copy Markdown
Contributor Author

@coderabbitai full review

Use the exact current head only and submit the review verdict through the formal GitHub review surface; do not post another summary comment, mutate, or merge.

@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 7 minutes and 22 seconds before sending another message.

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review

Please use the GitHub review API rather than another comment for the final exact-head verdict. Do not mutate or merge.

Copy link
Copy Markdown
Contributor Author

@opencode-agent

Final action expected: use the GitHub review API for the exact current head. Approve only if current required checks are successful and no actionable finding remains; otherwise post one concrete blocking review. Do not mutate or merge.

Copy link
Copy Markdown
Contributor Author

Exact-current-head review retry after the prior CodeRabbit rate-limit window elapsed. Refetch and review only b921e26854f1b0fd367c76a32af6db966374bcef; all newly rerun repository security/quality workflows now report completed/success on this unchanged SHA, and review threads remain resolved/outdated. No predecessor-head evidence transfers.

@coderabbitai review
@opencode-agent review
@cwl-noema-review

Read-only review only. Preserve independent reviewer identity/credentials and branch protection. Do not edit, approve from the author identity, synthesize approval, merge, or reinterpret queued/stale evidence.

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review

Submit one formal exact-current-head review through GitHub's review API. Do not add another discussion comment, mutate, or merge.

@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='782'
expected_head='b921e26854f1b0fd367c76a32af6db966374bcef'

echo '== Live PR identity =='
pr_json="$(gh api "repos/${repo}/pulls/${pr}")"
printf '%s\n' "$pr_json" | jq '{
  number, state, draft,
  head_sha: .head.sha, head_ref: .head.ref,
  base_sha: .base.sha, base_ref: .base.ref,
  mergeable, mergeable_state
}'
head_sha="$(printf '%s\n' "$pr_json" | jq -r '.head.sha')"
base_sha="$(printf '%s\n' "$pr_json" | jq -r '.base.sha')"
printf 'expected_head=%s\nlive_head=%s\nbase_sha=%s\n' \
  "$expected_head" "$head_sha" "$base_sha"
if [ "$head_sha" != "$expected_head" ]; then
  echo 'ERROR: requested head is no longer live' >&2
  exit 0
fi

echo '== Commit identity and complete diff =='
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head_sha"
git diff --stat "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"

echo '== Exact-head checks =='
gh api "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.app.slug] | `@tsv`' | sort

echo '== Exact-head Actions runs =='
gh api "repos/${repo}/actions/runs?head_sha=${head_sha}&per_page=100" --paginate \
  --jq '.workflow_runs[] | [.id,.name,.status,(.conclusion // "null"),.event] | `@tsv`' | sort -n

echo '== Current-head formal reviews =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" --paginate \
  --jq --arg head "$head_sha" \
  '.[] | select(.commit_id == $head) |
   [.user.login,.state,.submitted_at] | `@tsv`' || true

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
  -f query='
query($owner:String!, $name:String!, $number:Int!) {
  repository(owner:$owner,name:$name) {
    pullRequest(number:$number) {
      reviewThreads(first:100) {
        nodes {
          isResolved
          comments(first:1) {
            nodes { author { login } path originalLine body }
          }
        }
      }
    }
  }
}' \
  --jq '
    [.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] as $items |
    "count=\($items|length)",
    ($items[] | [.comments.nodes[0].author.login, (.comments.nodes[0].path // ""), (.comments.nodes[0].originalLine|tostring)] | `@tsv`)
  '

echo '== Relevant workflow source =='
for file in \
  .github/workflows/clearfolio-hourly-review-repair.yml \
  .github/workflows/pr-review-fix-scheduler.yml \
  .github/workflows/pr-review-autofix.yml \
  .github/workflows/hourly-nvidia-nim-review-repair.yml
do
  echo "--- $file"
  nl -ba "$file"
done

echo '== Relevant helper outlines =='
ast-grep outline scripts/ci/pr_review_conflict_scope.py --items all
ast-grep outline scripts/ci/pr_review_autofix_context.py --items all

echo '== Security-sensitive source references =='
git grep -n -I -E \
  'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|github-models|models\.github\.ai|\
GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|\
actions: write|issues: write|contents: write|secrets: inherit|\
git push origin|gh pr (merge|review)|gh release|branches/.+protection|\
repository_dispatch|workflow_(repository|sha|ref|file_path)|\
max_dispatches|retry_hours|concurrency:|cron:' \
  "$head_sha" -- .github/workflows scripts/ci tests || true

echo '== Independent reviewer workflow identity =='
printf 'base_blob='
git rev-parse "${base_sha}:.github/workflows/opencode-review-dispatch.yml"
printf 'head_blob='
git rev-parse "${head_sha}:.github/workflows/opencode-review-dispatch.yml"
git diff --no-ext-diff --exit-code "$base_sha" "$head_sha" -- \
  .github/workflows/opencode-review-dispatch.yml || true

Length of output: 14294


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='782'
head_sha='b921e26854f1b0fd367c76a32af6db966374bcef'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'

live_head="$(gh api "repos/${repo}/pulls/${pr}" --jq '.head.sha')"
printf 'expected_head=%s\nlive_head=%s\n' "$head_sha" "$live_head"
if [ "$live_head" != "$head_sha" ]; then
  echo 'ERROR: requested head is no longer live' >&2
  exit 0
fi

show_file() {
  file="$1"
  echo "--- ${file}"
  awk '{ printf "%5d  %s\n", NR, $0 }' "$file"
}

echo '== Caller, scheduler, and autofix workflows =='
show_file .github/workflows/clearfolio-hourly-review-repair.yml
show_file .github/workflows/pr-review-fix-scheduler.yml
show_file .github/workflows/pr-review-autofix.yml
show_file .github/workflows/hourly-nvidia-nim-review-repair.yml

echo '== Scope-verifier and context-helper outlines =='
ast-grep outline scripts/ci/pr_review_conflict_scope.py --items all
ast-grep outline scripts/ci/pr_review_autofix_context.py --items all

echo '== Source-focused security references =='
git grep -n -I -E \
  'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|github-models|models\.github\.ai|\
GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|\
actions: write|issues: write|contents: write|secrets: inherit|\
git push origin|gh pr (merge|review)|gh release|branches/.+protection|\
repository_dispatch|workflow_(repository|sha|ref|file_path)|\
max_dispatches|retry_hours|concurrency:|cron:' \
  "$head_sha" -- .github/workflows scripts/ci tests || true

echo '== Independent reviewer workflow identity =='
printf 'base_blob='
git rev-parse "${base_sha}:.github/workflows/opencode-review-dispatch.yml"
printf 'head_blob='
git rev-parse "${head_sha}:.github/workflows/opencode-review-dispatch.yml"
if git diff --no-ext-diff --quiet "$base_sha" "$head_sha" -- \
  .github/workflows/opencode-review-dispatch.yml; then
  echo 'reviewer_workflow_diff=none'
else
  echo 'reviewer_workflow_diff=present'
fi

echo '== Reviews on requested head =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" --paginate |
  jq -r --arg head "$head_sha" \
  '.[] | select(.commit_id == $head) |
   [.user.login,.state,.submitted_at] | `@tsv`' || true

echo '== Current terminal status for pending exact-head runs =='
for run in 31174617755 31174617864; do
  gh api "repos/${repo}/actions/runs/${run}" \
    --jq '[.id,.name,.status,(.conclusion // "null"),.head_sha] | `@tsv`'
done

echo '== Current unresolved-thread count =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
  -f query='
query($owner:String!, $name:String!, $number:Int!) {
  repository(owner:$owner,name:$name) {
    pullRequest(number:$number) {
      reviewThreads(first:100) { nodes { isResolved } }
    }
  }
}' --jq \
  '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'

Length of output: 53976


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='782'
head_sha='b921e26854f1b0fd367c76a32af6db966374bcef'

live_head="$(gh api "repos/${repo}/pulls/${pr}" --jq '.head.sha')"
printf 'expected_head=%s\nlive_head=%s\n' "$head_sha" "$live_head"
if [ "$live_head" != "$head_sha" ]; then
  echo 'ERROR: requested head is no longer live' >&2
  exit 0
fi

show_range() {
  file="$1"
  first="$2"
  last="$3"
  echo "--- ${file}:${first}-${last}"
  sed -n "${first},${last}p" "$file" |
    awk -v first="$first" '{ printf "%5d  %s\n", NR + first - 1, $0 }'
}

echo '== NUL inventory and worktree verifier =='
show_range scripts/ci/pr_review_conflict_scope.py 38 339
show_range scripts/ci/pr_review_autofix_context.py 131 278

echo '== Relevant contract assertions =='
show_range tests/test_pr_review_fix_hourly_contract.py 1 150
show_range tests/test_pr_review_autofix_nvidia_nim_contract.py 30 250
show_range tests/test_opencode_agent_contract.py 1090 1145

echo '== Fixed-string prohibited-operation scan =='
for needle in \
  'COPILOT_GITHUB_TOKEN' \
  'github-models' \
  'models.github.ai' \
  'secrets: inherit' \
  'git push origin' \
  'gh pr merge' \
  'gh pr review' \
  'gh release' \
  'actions: write' \
  'issues: write' \
  'contents: write'
do
  printf '%s\n' "--- ${needle}"
  git grep -n -I -F "$needle" "$head_sha" -- \
    .github/workflows scripts/ci tests || true
done

echo '== Model subprocess credential stripping =='
git grep -n -I -F 'env -u GITHUB_TOKEN' "$head_sha" -- \
  .github/workflows/pr-review-autofix.yml
git grep -n -I -F 'ACTIONS_ID_TOKEN_REQUEST_TOKEN' "$head_sha" -- \
  .github/workflows/pr-review-autofix.yml

echo '== Current exact-head required-run states =='
for run in 31174617755 31174617864; do
  gh api "repos/${repo}/actions/runs/${run}" \
    --jq '[.id,.name,.status,(.conclusion // "null"),.head_sha] | `@tsv`'
done

echo '== Current PR gate state =='
gh api "repos/${repo}/pulls/${pr}" --jq \
  '{head_sha:.head.sha,draft,mergeable,mergeable_state}'

Length of output: 42593


@seonghobae Exact-head review completed for b921e26854f1b0fd367c76a32af6db966374bcef against e71fdab2ab088001f218765ecb5e3b7fabfee11a.

I found no actionable implementation defect in the reviewed scheduler and autofix boundary.

I verified these controls:

  • The Clearfolio caller runs at minute 23 each hour.
  • The caller sets max_dispatches: "1" and retry_hours: "1".
  • The caller and reusable scheduler use single-flight concurrency.
  • The caller and scheduler retain workflow-level contents: read.
  • The scheduler has no job-level write permission and no github.token fallback.
  • The scheduler fails before dispatch when both explicit scheduler credentials are absent.
  • The scheduler validates and checks out the immutable called-workflow identity.
  • The autofix worker uses only NVIDIA NIM with NVIDIA_NIM_API_KEY.
  • The OpenCode subprocesses remove GitHub and OIDC credentials.
  • Ordinary and conflict repair use snapshot verification and NUL-delimited path authority.
  • The verifier includes ignored paths and validates symlink targets.
  • The model cannot edit .git.
  • Both push paths disable hooks and use the reconstructed target URL.
  • The independent reviewer workflow is byte-identical to the base.
  • There are zero unresolved review threads.

I cannot issue approval yet. The exact-head query showed these required runs as nonterminal:

  • Strix Security Scan is in_progress.
  • Required OpenCode Review is queued.

The PR is also reported as mergeable_state: blocked. These states are current-head evidence and prevent an approval verdict. I did not edit, approve, merge, release, or change branch protection.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

Exact-head gate refresh for b921e26854f1b0fd367c76a32af6db966374bcef: latest same-head CodeQL 31174617479, Python Security 31174617655, SAST 31174617519, Security Scan 31174617548, Secret Scan 31174617713, OSV 31174618902, Scorecard 31174617530, and SBOM 31174617450 are now all completed success; all inline threads remain resolved/outdated. Predecessor-head reviews remain non-transferable.

@opencode-agent review
@cwl-noema-review review
@strix review
@coderabbitai review

Read-only independent current-head review only. Preserve reviewer identities and credential scopes; do not update the branch, synthesize approval, merge, or bypass branch protection. Submit a formal exact-head verdict after inspecting the full live diff and these same-head gates.

Copy link
Copy Markdown
Contributor Author

@opencode-agent

Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge.

@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='782'
expected_head='b921e26854f1b0fd367c76a32af6db966374bcef'

echo '== Live PR identity =='
pr_json="$(gh api "repos/${repo}/pulls/${pr}")"
printf '%s\n' "$pr_json" | jq '{
  number, state, draft,
  head_sha: .head.sha, head_ref: .head.ref,
  base_sha: .base.sha, base_ref: .base.ref,
  mergeable, mergeable_state
}'
head_sha="$(printf '%s\n' "$pr_json" | jq -r '.head.sha')"
base_sha="$(printf '%s\n' "$pr_json" | jq -r '.base.sha')"
if [ "$head_sha" != "$expected_head" ]; then
  echo "ERROR: expected ${expected_head}, received ${head_sha}" >&2
  exit 0
fi

echo '== Complete changed-path list =='
git diff --name-status "$base_sha" "$head_sha"
echo '== Diff summary =='
git diff --stat "$base_sha" "$head_sha"

echo '== Exact-head check runs =='
gh api "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.app.slug] | `@tsv`' | sort

echo '== Exact-head Actions workflow runs =='
gh api "repos/${repo}/actions/runs?head_sha=${head_sha}&per_page=100" --paginate \
  --jq '.workflow_runs[] | [.id,.name,.status,(.conclusion // "null"),.event] | `@tsv`' | sort -n

echo '== Claimed workflow runs =='
for run in \
  31174617479 31174617655 31174617519 31174617548 \
  31174617713 31174618902 31174617530 31174617450
do
  gh api "repos/${repo}/actions/runs/${run}" \
    --jq '[.id,.name,.status,(.conclusion // "null"),.head_sha] | `@tsv`'
done

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
  -f query='
query($owner:String!, $name:String!, $number:Int!) {
  repository(owner:$owner,name:$name) {
    pullRequest(number:$number) {
      reviewThreads(first:100) {
        nodes {
          isResolved
          comments(first:1) { nodes { author { login } path originalLine } }
        }
      }
    }
  }
}' \
  --jq '
    [.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] as $items |
    "count=\($items|length)",
    ($items[] | [.comments.nodes[0].author.login, (.comments.nodes[0].path // ""), (.comments.nodes[0].originalLine|tostring)] | `@tsv`)
  '

echo '== Workflow maps =='
for file in \
  .github/workflows/clearfolio-hourly-review-repair.yml \
  .github/workflows/pr-review-fix-scheduler.yml \
  .github/workflows/pr-review-autofix.yml \
  .github/workflows/hourly-nvidia-nim-review-repair.yml
do
  echo "--- ${file}"
  nl -ba "$file"
done

echo '== Helper maps =='
ast-grep outline scripts/ci/pr_review_conflict_scope.py --items all
ast-grep outline scripts/ci/pr_review_autofix_context.py --items all

echo '== Independent reviewer workflow integrity =='
printf 'base_blob='
git rev-parse "${base_sha}:.github/workflows/opencode-review-dispatch.yml"
printf 'head_blob='
git rev-parse "${head_sha}:.github/workflows/opencode-review-dispatch.yml"
git diff --no-ext-diff --exit-code "$base_sha" "$head_sha" -- \
  .github/workflows/opencode-review-dispatch.yml || true

Length of output: 13989


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='782'
head_sha='b921e26854f1b0fd367c76a32af6db966374bcef'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'

live_head="$(gh api "repos/${repo}/pulls/${pr}" --jq '.head.sha')"
printf 'expected_head=%s\nlive_head=%s\n' "$head_sha" "$live_head"
if [ "$live_head" != "$head_sha" ]; then
  echo 'ERROR: live head changed; stop review.' >&2
  exit 0
fi

show_file() {
  file="$1"
  echo "--- ${file}"
  awk '{ printf "%5d  %s\n", NR, $0 }' "$file"
}

show_range() {
  file="$1"
  first="$2"
  last="$3"
  echo "--- ${file}:${first}-${last}"
  sed -n "${first},${last}p" "$file" |
    awk -v first="$first" '{ printf "%5d  %s\n", NR + first - 1, $0 }'
}

echo '== Critical workflow source =='
show_file .github/workflows/clearfolio-hourly-review-repair.yml
show_file .github/workflows/pr-review-fix-scheduler.yml
show_file .github/workflows/pr-review-autofix.yml
show_file .github/workflows/hourly-nvidia-nim-review-repair.yml

echo '== Complete helper implementations =='
show_file scripts/ci/pr_review_conflict_scope.py
show_file scripts/ci/pr_review_autofix_context.py

echo '== Security and scheduler contract tests =='
show_file tests/test_pr_review_fix_hourly_contract.py
show_file tests/test_pr_review_fix_scheduler_source_pin.py
show_file tests/test_pr_review_autofix_nvidia_nim_contract.py
show_range tests/test_opencode_agent_contract.py 1090 1150

echo '== Source-sensitive references =='
git grep -n -I -E \
  'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|github-models|models\.github\.ai|\
GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|\
actions: write|issues: write|contents: write|secrets: inherit|\
git push origin|gh pr (merge|review)|gh release|branches/.+protection|\
repository_dispatch|workflow_(repository|sha|ref|file_path)|\
max_dispatches|retry_hours|concurrency:|cron:' \
  "$head_sha" -- .github/workflows scripts/ci tests || true

echo '== Independent reviewer workflow identity =='
printf 'base_blob='
git rev-parse "${base_sha}:.github/workflows/opencode-review-dispatch.yml"
printf 'head_blob='
git rev-parse "${head_sha}:.github/workflows/opencode-review-dispatch.yml"
if git diff --no-ext-diff --quiet "$base_sha" "$head_sha" -- \
  .github/workflows/opencode-review-dispatch.yml; then
  echo 'reviewer_workflow_diff=none'
else
  echo 'reviewer_workflow_diff=present'
fi

echo '== Pending run refresh =='
for run in 31174617755 31174617864; do
  gh api "repos/${repo}/actions/runs/${run}" \
    --jq '[.id,.name,.status,(.conclusion // "null"),.head_sha] | `@tsv`'
done

Length of output: 112313


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='782'
head_sha='b921e26854f1b0fd367c76a32af6db966374bcef'
base_sha='e71fdab2ab088001f218765ecb5e3b7fabfee11a'

live_head="$(gh api "repos/${repo}/pulls/${pr}" --jq '.head.sha')"
printf 'expected_head=%s\nlive_head=%s\n' "$head_sha" "$live_head"
if [ "$live_head" != "$head_sha" ]; then
  echo 'ERROR: live head changed; stop review.' >&2
  exit 0
fi

echo '== Diff integrity =='
git diff --check "$base_sha" "$head_sha"
git diff --numstat "$base_sha" "$head_sha"

echo '== Prohibited-operation scan =='
for needle in \
  'COPILOT_GITHUB_TOKEN' \
  'github-models' \
  'models.github.ai' \
  'secrets: inherit' \
  'git push origin' \
  'gh pr merge' \
  'gh pr review' \
  'gh release' \
  'actions: write' \
  'issues: write' \
  'contents: write' \
  'branches/'
do
  printf '%s\n' "--- ${needle}"
  git grep -n -I -F "$needle" "$head_sha" -- \
    .github/workflows scripts/ci tests || true
done

echo '== Credential stripping and explicit push scan =='
git grep -n -I -F 'env -u GITHUB_TOKEN' "$head_sha" -- \
  .github/workflows/pr-review-autofix.yml
git grep -n -I -F 'ACTIONS_ID_TOKEN_REQUEST_TOKEN' "$head_sha" -- \
  .github/workflows/pr-review-autofix.yml
git grep -n -I -F 'expected_origin="${GITHUB_SERVER_URL}/${TARGET_REPOSITORY}.git"' \
  "$head_sha" -- .github/workflows/pr-review-autofix.yml
git grep -n -I -F 'core.hooksPath=/dev/null push "$expected_origin"' \
  "$head_sha" -- .github/workflows/pr-review-autofix.yml

echo '== Current pending-gate state =='
for run in 31174617755 31174617864; do
  gh api "repos/${repo}/actions/runs/${run}" \
    --jq '[.id,.name,.status,(.conclusion // "null"),.head_sha] | `@tsv`'
done

Length of output: 3195


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='782'
head_sha='b921e26854f1b0fd367c76a32af6db966374bcef'

live_head="$(gh api "repos/${repo}/pulls/${pr}" --jq '.head.sha')"
printf 'expected_head=%s\nlive_head=%s\n' "$head_sha" "$live_head"
if [ "$live_head" != "$head_sha" ]; then
  echo 'ERROR: live head changed; stop review.' >&2
  exit 0
fi

echo '== Prohibited-operation scan =='
git grep -n -I -F 'COPILOT_GITHUB_TOKEN' "$head_sha" -- .github/workflows scripts/ci tests || true
git grep -n -I -F 'github-models' "$head_sha" -- .github/workflows scripts/ci tests || true
git grep -n -I -F 'models.github.ai' "$head_sha" -- .github/workflows scripts/ci tests || true
git grep -n -I -F 'secrets: inherit' "$head_sha" -- .github/workflows scripts/ci tests || true
git grep -n -I -F 'git push origin' "$head_sha" -- .github/workflows scripts/ci tests || true
git grep -n -I -F 'gh pr merge' "$head_sha" -- .github/workflows scripts/ci tests || true
git grep -n -I -F 'gh pr review' "$head_sha" -- .github/workflows scripts/ci tests || true
git grep -n -I -F 'gh release' "$head_sha" -- .github/workflows scripts/ci tests || true
git grep -n -I -F 'actions: write' "$head_sha" -- .github/workflows scripts/ci tests || true
git grep -n -I -F 'issues: write' "$head_sha" -- .github/workflows scripts/ci tests || true
git grep -n -I -F 'contents: write' "$head_sha" -- .github/workflows scripts/ci tests || true
git grep -n -I -F 'branches/' "$head_sha" -- .github/workflows scripts/ci tests || true

echo '== Credential stripping and explicit push =='
git grep -n -I -F 'env -u GITHUB_TOKEN' "$head_sha" -- .github/workflows/pr-review-autofix.yml
git grep -n -I -F 'ACTIONS_ID_TOKEN_REQUEST_TOKEN' "$head_sha" -- .github/workflows/pr-review-autofix.yml
git grep -n -I -F 'expected_origin="${GITHUB_SERVER_URL}/${TARGET_REPOSITORY}.git"' \
  "$head_sha" -- .github/workflows/pr-review-autofix.yml
git grep -n -I -F 'core.hooksPath=/dev/null push "$expected_origin"' \
  "$head_sha" -- .github/workflows/pr-review-autofix.yml

echo '== Pending-gate state =='
gh api "repos/${repo}/actions/runs/31174617755" \
  --jq '[.id,.name,.status,(.conclusion // "null"),.head_sha] | `@tsv`'
gh api "repos/${repo}/actions/runs/31174617864" \
  --jq '[.id,.name,.status,(.conclusion // "null"),.head_sha] | `@tsv`'

Length of output: 48998


@seonghobae Formal exact-head review completed for b921e26854f1b0fd367c76a32af6db966374bcef against e71fdab2ab088001f218765ecb5e3b7fabfee11a.

I found no actionable implementation defect in the reviewed hourly scheduler and NVIDIA NIM autofix boundary.

Verified controls:

  • The Clearfolio caller runs at minute 23 of each hour.
  • The caller limits dispatches to one and uses a one-hour retry floor.
  • The caller and scheduler use single-flight concurrency.
  • The scheduler workflow token has contents: read only.
  • The scheduler requires an explicit scheduler credential and does not elevate github.token.
  • The scheduler validates the immutable job.workflow_* identity before checkout.
  • The scheduler verifies the checked-out workflow SHA.
  • The autofix worker uses NVIDIA NIM only.
  • NVIDIA_NIM_API_KEY is scoped to the two model execution steps.
  • Both model subprocesses remove GitHub and OIDC credentials.
  • Ordinary and conflict repair use the snapshot verifier and NUL-delimited path authority.
  • The verifier includes ignored paths and validates symlink targets.
  • The agent cannot edit .git.
  • Both push paths revalidate the live head, disable hooks, and use the reconstructed target URL.
  • git diff --check is clean.
  • There are zero unresolved review threads.
  • .github/workflows/opencode-review-dispatch.yml is byte-identical to the base. Both blobs are 83f6830d5c21a324b4dbcd4e5c21a07968994b81.

The GitHub Models references found by the broad scan are in the unchanged independent reviewer workflow and unrelated existing workflows. They do not apply to pr-review-autofix.yml, which remains NVIDIA NIM-only.

I cannot approve this head. Two exact-head required runs are nonterminal:

  • Strix Security Scan run 31174617755 is in_progress.
  • Required OpenCode Review run 31174617864 is queued.

These runs must complete successfully for this same SHA before an approval verdict is valid. I did not modify, merge, release, or change branch protection.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review

Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge.

Copy link
Copy Markdown
Contributor Author

@coderabbitai

Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge.

@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='782'

echo '== Live pull request =='
pr_json="$(gh api "repos/${repo}/pulls/${pr}")"
printf '%s\n' "$pr_json" | jq '{
  number,
  state,
  draft,
  head_sha: .head.sha,
  head_ref: .head.ref,
  base_sha: .base.sha,
  base_ref: .base.ref,
  mergeable,
  mergeable_state
}'

head_sha="$(printf '%s\n' "$pr_json" | jq -r '.head.sha')"
base_sha="$(printf '%s\n' "$pr_json" | jq -r '.base.sha')"

echo '== Commit and diff integrity =='
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head_sha"
git diff --check "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"

echo '== Exact-head check runs =='
gh api "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.app.slug] | `@tsv`' |
  sort

echo '== Exact-head workflow runs =='
gh api "repos/${repo}/actions/runs?head_sha=${head_sha}&per_page=100" --paginate \
  --jq '.workflow_runs[] | [.id,.name,.status,(.conclusion // "null"),.event] | `@tsv`' |
  sort -n

echo '== Current-head reviews =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" --paginate \
  --jq --arg head "$head_sha" \
  '.[] | select(.commit_id == $head) |
   [.user.login,.state,.submitted_at] | `@tsv`' || true

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
  -f query='
query($owner:String!, $name:String!, $number:Int!) {
  repository(owner:$owner,name:$name) {
    pullRequest(number:$number) {
      reviewThreads(first:100) {
        nodes {
          isResolved
          comments(first:1) {
            nodes { author { login } path originalLine }
          }
        }
      }
    }
  }
}' \
  --jq '
    [.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] as $items |
    "unresolved_count=\($items|length)",
    ($items[] | [.comments.nodes[0].author.login, (.comments.nodes[0].path // ""), (.comments.nodes[0].originalLine|tostring)] | `@tsv`)
  '

Length of output: 6496


@seonghobae The live head is now 355d9e545fd971638066e90654fdfaa105431968.

I cannot submit the formal review yet. This merge commit invalidates the prior-head evidence.

Current required checks are nonterminal. Hourly NVIDIA NIM Review Repair and exact-head-path-policy are in progress. CodeQL, Python Security, Secret Scan, SBOM Generation, Scorecard PR, SAST Semgrep, OSV-Scanner PR, Required OpenCode Review, Required Noema Review, and Strix Security Scan are queued or pending.

There are zero unresolved review threads. I did not modify, approve, or merge the PR.

You are interacting with an AI system.

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review @coderabbitai

No further discussion comments are needed. Complete the formal exact-current-head review through the review API only; do not mutate or merge.

@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='782'

echo '== Live PR identity =='
pr_json="$(gh api "repos/${repo}/pulls/${pr}")"
printf '%s\n' "$pr_json" | jq '{
  number, state, draft,
  head_sha: .head.sha, head_ref: .head.ref,
  base_sha: .base.sha, base_ref: .base.ref,
  mergeable, mergeable_state
}'
head_sha="$(printf '%s\n' "$pr_json" | jq -r '.head.sha')"
base_sha="$(printf '%s\n' "$pr_json" | jq -r '.base.sha')"

echo '== Current-head commit and changed paths =='
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head_sha"
git diff --check "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"

echo '== Current-head check runs =='
gh api "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.app.slug] | `@tsv`' |
  sort

echo '== Current-head Actions workflow runs =='
gh api "repos/${repo}/actions/runs?head_sha=${head_sha}&per_page=100" --paginate \
  --jq '.workflow_runs[] | [.id,.name,.status,(.conclusion // "null"),.event] | `@tsv`' |
  sort -n

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
  -f query='
query($owner:String!, $name:String!, $number:Int!) {
  repository(owner:$owner,name:$name) {
    pullRequest(number:$number) {
      reviewThreads(first:100) {
        nodes {
          isResolved
          comments(first:1) { nodes { author { login } path originalLine } }
        }
      }
    }
  }
}' \
  --jq '
    [.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] as $items |
    "unresolved_count=\($items|length)",
    ($items[] | [.comments.nodes[0].author.login, (.comments.nodes[0].path // ""), (.comments.nodes[0].originalLine|tostring)] | `@tsv`)
  '

Length of output: 6583


@seonghobae Formal review cannot complete for the current head 355d9e545fd971638066e90654fdfaa105431968.

The current head is a new merge commit. Prior-head evidence does not apply.

These current-head gates are nonterminal:

  • CodeQL PR
  • Python Security
  • Security Scan
  • Secret Scan
  • SBOM Generation
  • Scorecard PR
  • SAST Semgrep
  • OSV-Scanner PR
  • Required Noema Review
  • Required OpenCode Review
  • Strix Security Scan
  • exact-head-path-policy

Hourly NVIDIA NIM Review Repair completed successfully. There are zero unresolved review threads. GitHub reports mergeable_state: blocked.

I did not modify, approve, merge, release, or change protection.

You are interacting with an AI system.

Copy link
Copy Markdown
Contributor Author

/oc Refetch PR #782 and proceed only if the exact live head is still 355d9e545fd971638066e90654fdfaa105431968; abort without writing if another writer moved it. Treat the PR body and all predecessor-head evidence as historical. Exact-head Strix Changed Path Quality CI run 31177021926, job 92861142867, surfaced deterministic contract failures after 1,064 repository tests + 16 subtests passed. Repair these test-first, without weakening any security boundary:

  1. Authoritative allowed-path prompt contract. The current worker already derives a sealed NUL inventory and renders it as an authoritative JSON array inside <autofix-allowed-paths-json>. Preserve that machine-authoritative separation from untrusted Markdown. Reproduce the failing Strix assertion and make the permanent contract assert the actual semantic boundary (sealed NUL source → strict UTF-8 JSON array → explicit authoritative tagged prompt → verifier consumes the same sealed zlist). Do not fall back to parsing Markdown headings and do not broaden editable paths. If the production prompt needs a minimal wording/tag normalization to make the authority unmistakable, keep JSON as the only model-readable authority and update the focused tests accordingly.

  2. Immutable central scheduler checkout. Keep Resolve immutable called-workflow source validating job.workflow_repository == ContextualWisdomLab/.github, 40-hex job.workflow_sha, workflow path/ref consistency, then checkout via ${{ steps.trusted_source.outputs.repository }} and ${{ steps.trusted_source.outputs.sha }}. The Strix literal expectation for repository: ContextualWisdomLab/.github is stale relative to this stronger validated-output binding. Update the stale regression to prove the semantic source pin; do not replace the validated output with caller/event-controlled input.

  3. Mutation credential separation. Preserve scheduler GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }} and its fail-closed empty-token guard. The Strix expectation that appends || github.token is stale and conflicts with the documented least-privilege contract. Update the stale assertion; never add a github.token mutation fallback and do not modify existing independent-review credential names/scopes/identity chains.

  4. Role-specific reasoning configuration. This one is a real capability gap, but do not add an unsupported parameter to mistral-nemotron or Nemotron 3 Nano. Current authoritative docs establish that OpenCode 1.17.13 supports model-level options.reasoningEffort, while NVIDIA's current hosted NIM API for mistralai/mistral-small-4-119b-2603 explicitly supports reasoning_effort: high and the model card states native function calling/tool use. Replace the ordinary/conflict write-capable primary autofix model with nvidia-nim/mistralai/mistral-small-4-119b-2603, declare reasoning: true, options.reasoningEffort: high, and a variants.high.reasoningEffort: high contract in the generated OpenCode config; keep NVIDIA NIM as the only model provider and NVIDIA_NIM_API_KEY as the only model credential. Keep the Nano small model non-reasoning unless a current NVIDIA primary source proves a compatible tool-calling reasoning control; NVIDIA documents Nano parallel reasoning as incompatible with tool calling, so do not enable it for this file-editing role. Update the permanent NIM contract tests and operator/doctoring documentation with APA-7-style references to the current OpenCode Models/Agents docs and NVIDIA Mistral Small 4 model/API documentation. Do not make latency the optimization objective.

Run the four formerly failing Strix contracts first, then the complete Hourly NVIDIA NIM Review Repair quality suite with exact current production statement/branch/docstring coverage gates, compileall, git diff --check, and the Strix changed-path self-test. Commit only ordinary source/tests/docs to this existing branch. Do not create helper/self-modifying/encoded-patch workflows, change branch protection, approve, merge, release, alter review-agent credentials, use COPILOT_GITHUB_TOKEN, or count cancellation as success. Keep #782 Ready only if it was already Ready; after any head move all predecessor checks/reviews are invalid and must be rerun on the new exact head.

Copy link
Copy Markdown
Contributor Author

Exact-current-head review request for 355d9e545fd971638066e90654fdfaa105431968 against protected main 1131b1bbafb24e455fc8619cdf316813e8721861.

Current exact-head Hourly NVIDIA NIM Review Repair, CodeQL, Python Security, Semgrep, Security Scan, Secret Scan, OSV, Scorecard, SBOM, and CodeRabbit status are successful. The previously cancelled Strix Changed Path Quality CI job has been explicitly rerun and is not counted until terminal success. All visible inline threads are resolved/outdated. Predecessor-head reviews and the stale head recorded in the PR body do not transfer.

@coderabbitai review
@opencode-agent review
@cwl-noema-review review
@strix review

Review-only. Do not update the branch, create repair automation, approve from the author identity, merge, or bypass protection. Submit an exact-head verdict only.

@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='782'
expected_head='355d9e545fd971638066e90654fdfaa105431968'
expected_base='1131b1bbafb24e455fc8619cdf316813e8721861'

echo '== Live pull request identity =='
pr_json="$(gh api "repos/${repo}/pulls/${pr}")"
printf '%s\n' "$pr_json" | jq '{
  number, state, draft,
  head_sha: .head.sha, head_ref: .head.ref,
  base_sha: .base.sha, base_ref: .base.ref,
  mergeable, mergeable_state
}'
head_sha="$(printf '%s\n' "$pr_json" | jq -r '.head.sha')"
base_sha="$(printf '%s\n' "$pr_json" | jq -r '.base.sha')"
printf 'expected_head=%s\nexpected_base=%s\n' "$expected_head" "$expected_base"
if [ "$head_sha" != "$expected_head" ] || [ "$base_sha" != "$expected_base" ]; then
  echo 'ERROR: live PR identity differs from requested review identity'
  exit 0
fi

echo '== Commit and complete diff =='
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head_sha"
git diff --check "$base_sha" "$head_sha"
git diff --stat "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
git diff --no-ext-diff --unified=30 "$base_sha" "$head_sha"

echo '== Current-head check runs =='
gh api "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | [.name, .status, (.conclusion // "null"), .app.slug, .details_url] | `@tsv`' \
  | sort

echo '== Current-head Actions runs =='
gh api "repos/${repo}/actions/runs?head_sha=${head_sha}&per_page=100" --paginate \
  --jq '.workflow_runs[] | [.id, .name, .status, (.conclusion // "null"), .event, .html_url] | `@tsv`' \
  | sort -n

echo '== Unresolved review threads =='
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
  -f query='
query($owner:String!, $name:String!, $number:Int!) {
  repository(owner:$owner,name:$name) {
    pullRequest(number:$number) {
      reviewThreads(first:100) {
        nodes {
          isResolved
          comments(first:1) { nodes { author { login } path originalLine body } }
        }
      }
    }
  }
}' \
  --jq '
    [.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] as $items |
    "unresolved_count=\($items|length)",
    ($items[] | [.comments.nodes[0].author.login, (.comments.nodes[0].path // ""), (.comments.nodes[0].originalLine|tostring)] | `@tsv`)
  '

echo '== Workflow and helper maps =='
for file in \
  .github/workflows/clearfolio-hourly-review-repair.yml \
  .github/workflows/pr-review-fix-scheduler.yml \
  .github/workflows/pr-review-autofix.yml \
  .github/workflows/hourly-nvidia-nim-review-repair.yml \
  scripts/ci/pr_review_conflict_scope.py \
  scripts/ci/pr_review_autofix_context.py \
  tests/test_pr_review_autofix_nvidia_nim_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py
do
  if [ -f "$file" ]; then
    echo "--- $file"
    nl -ba "$file"
  fi
done

echo '== Sensitive-operation scan in reviewed sources =='
git grep -n -I -E \
  'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|github\.token|GITHUB_TOKEN|GH_TOKEN|\
ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|github-models|models\.github\.ai|\
reasoning(Effort)?|mistral-small-4-119b-2603|nemotron|\
workflow_(repository|sha|ref|file_path)|repository_dispatch|\
max_dispatches|retry_hours|concurrency:|cron:|\
contents: write|actions: write|issues: write|secrets: inherit|\
git push origin|gh pr (merge|review)|gh release|branches/.+protection' \
  "$head_sha" -- .github/workflows scripts/ci tests docs CHANGELOG.md || true

echo '== Independent reviewer workflow integrity =='
printf 'base_blob='
git rev-parse "${base_sha}:.github/workflows/opencode-review-dispatch.yml"
printf 'head_blob='
git rev-parse "${head_sha}:.github/workflows/opencode-review-dispatch.yml"
if git diff --no-ext-diff --quiet "$base_sha" "$head_sha" -- .github/workflows/opencode-review-dispatch.yml; then
  echo 'reviewer_workflow_diff=none'
else
  echo 'reviewer_workflow_diff=present'
fi

Length of output: 184025


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='782'
head_sha='355d9e545fd971638066e90654fdfaa105431968'
base_sha='1131b1bbafb24e455fc8619cdf316813e8721861'

live_head="$(gh api "repos/${repo}/pulls/${pr}" --jq '.head.sha')"
printf 'expected_head=%s\nlive_head=%s\n' "$head_sha" "$live_head"
if [ "$live_head" != "$head_sha" ]; then
  echo 'ERROR: live head changed; do not use this review.'
  exit 0
fi

echo '== Strix rerun status and jobs =='
gh api "repos/${repo}/actions/runs/31177021926" \
  --jq '{id,name,status,conclusion,head_sha,event,html_url}'
gh api "repos/${repo}/actions/runs/31177021926/jobs?per_page=100" --paginate \
  --jq '.jobs[] | [.id,.name,.status,(.conclusion // "null"),.html_url] | `@tsv`' \
  | sort -n

echo '== Exact-head non-success or nonterminal checks =='
gh api "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" --paginate \
  --jq '.check_runs[] | select(.status != "completed" or (.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped")) | [.name,.status,(.conclusion // "null"),.details_url] | `@tsv`' \
  | sort

echo '== Relevant workflow source =='
for file in \
  .github/workflows/clearfolio-hourly-review-repair.yml \
  .github/workflows/pr-review-fix-scheduler.yml \
  .github/workflows/pr-review-autofix.yml \
  .github/workflows/hourly-nvidia-nim-review-repair.yml
do
  echo "--- $file"
  sed -n '=' "$file" | sed 'N;s/\n/\t/'
  cat "$file"
done

echo '== Exact sensitive-operation references =='
git grep -n -I -E \
  'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|github\.token|\
GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|\
workflow_(repository|sha|ref|file_path)|\
repository_dispatch|max_dispatches|retry_hours|\
git -c core\.hooksPath=/dev/null (commit|push)|\
expected_origin=|gh pr (merge|review)|gh release|branches/.+protection' \
  "$head_sha" -- .github/workflows scripts/ci tests || true

echo '== Independent reviewer workflow identity =='
printf 'base_blob='
git rev-parse "${base_sha}:.github/workflows/opencode-review-dispatch.yml"
printf 'head_blob='
git rev-parse "${head_sha}:.github/workflows/opencode-review-dispatch.yml"
git diff --no-ext-diff --exit-code "$base_sha" "$head_sha" -- \
  .github/workflows/opencode-review-dispatch.yml || true

echo '== Current review states and unresolved threads =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" --paginate \
  --jq --arg head "$head_sha" \
  '.[] | select(.commit_id == $head) | [.user.login,.state,.submitted_at] | `@tsv`' \
  | sort || true
gh api graphql \
  -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
  -f query='
query($owner:String!, $name:String!, $number:Int!) {
  repository(owner:$owner,name:$name) {
    pullRequest(number:$number) {
      reviewThreads(first:100) { nodes { isResolved } }
    }
  }
}' \
  --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'

Length of output: 48383


@seonghobae Exact-current-head review completed for 355d9e545fd971638066e90654fdfaa105431968 against 1131b1bbafb24e455fc8619cdf316813e8721861.

I found no actionable implementation defect in the reviewed source.

I verified these controls:

  • The Clearfolio caller runs at minute 23 each hour.
  • The caller sets one dispatch and a one-hour retry floor.
  • The caller and scheduler use single-flight concurrency.
  • The scheduler keeps the workflow token read-only.
  • The scheduler requires explicit scheduler credentials. It has no github.token fallback.
  • The scheduler validates the immutable job.workflow_* source identity before checkout.
  • The scheduler verifies the checked-out source SHA.
  • The autofix worker uses NVIDIA NIM only.
  • NVIDIA_NIM_API_KEY is bound to the two OpenCode execution steps.
  • The model subprocesses remove GitHub and Actions OIDC credentials.
  • Ordinary and conflict repair use NUL-delimited path authority and complete worktree snapshots.
  • The verifier includes ignored paths and validates symlink targets.
  • Both publication paths disable hooks and push to an explicit target URL after a live-head check.
  • .github/workflows/opencode-review-dispatch.yml is byte-identical to the base.
  • There are zero unresolved review threads.

I cannot issue an approval or final passing verdict yet.

Strix Changed Path Quality CI run 31177021926 remains in_progress. Its exact-head-path-policy job 92874855878 is also in_progress. This current-head gate must complete successfully before a formal approval is valid.

I did not modify the branch, credentials, branch protection, merge state, or release state.

You are interacting with an AI system.

Copy link
Copy Markdown
Contributor Author

@opencode-agent address

Refetch PR #782 and abort without writing unless the exact Ready head is still 355d9e545fd971638066e90654fdfaa105431968. The cancelled exact-head Strix Changed Path Quality CI attempt is not acceptable evidence: its job log proves 1,064 tests + 16 subtests passed, then four deterministic self-test assertions were evaluated against current production and the run was later cancelled. Fix the deterministic contract mismatches test-first; do not weaken production security.

  1. In the Strix quick-gate regression, replace the obsolete Markdown-authority literals Autofix allowed paths, authoritative: and <autofix-allowed-paths> with assertions for the existing stronger machine contract: the sealed NUL list is strict-UTF-8 decoded, serialized as a JSON array, placed under the explicit Autofix allowed paths, authoritative JSON array: / <autofix-allowed-paths-json> block, and the same .zlist is consumed by the post-model verifier. Do not parse the untrusted review-context Markdown and do not broaden the editable-path set.
  2. Replace the stale scheduler assertion requiring literal repository: ContextualWisdomLab/.github with a semantic assertion proving job.workflow_repository, job.workflow_sha, job.workflow_ref, and job.workflow_file_path are validated against the canonical repository/path and then actions/checkout consumes only steps.trusted_source.outputs.repository and .sha. Do not revert to caller/event-controlled checkout inputs.
  3. Replace the stale assertion requiring a github.token mutation fallback. The current scheduler intentionally has contents: read, GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }}, and fails closed when neither established mutation credential exists. Preserve that boundary and add/retain an explicit negative assertion against || github.token for scheduler writes.
  4. Reconcile the stale generic reasoningEffort assertion with current provider reality rather than injecting an unsupported parameter. OpenCode supports provider-specific model options, but NVIDIA NIM 1.15 documents reasoning_effort only for GPT-OSS multi-LLM deployments; Nemotron 3 Nano uses thinking / max_thinking_tokens, while the active mistralai/mistral-nemotron endpoint documents tool calling but no reasoning-effort control. Update the permanent contract to require only capability-supported reasoning controls. If you choose to configure the existing Nemotron 3 Nano fallback, use an NVIDIA-documented thinking budget through OpenCode provider/model options and test that exact supported setting; do not add reasoningEffort merely to satisfy a string assertion.

Run the four formerly failing quick-gate contracts first, then the complete repository tests, Strix quick-gate, exact production statement/branch coverage, docstring gate, compileall and git diff --check. Commit only ordinary source/tests/docs on this existing branch. Do not create helper/one-shot/self-modifying/encoded-patch workflows, alter review-agent credential names/scopes/identities, use COPILOT_GITHUB_TOKEN, change branch protection, approve, merge, or release. After any head move, discard all predecessor-head checks/reviews and rerun exact-head validation.

seonghobae commented Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

@opencode-agent address

Refetch PR #782 and abort without writing unless the exact live head is still 355d9e545fd971638066e90654fdfaa105431968. Fresh exact-head Strix rerun 31177021926, job 92897822131, proves the branch baseline itself is healthy (1064 passed, 16 subtests passed) and then fails deterministically in scripts/ci/test_strix_quick_gate.sh; do not rerun unchanged head again. Repair the five proven contracts test-first and keep every existing trust boundary: (1) replace the stale literal assertions Autofix allowed paths, authoritative: / <autofix-allowed-paths> with semantic assertions for the current sealed NUL allowlist → strict UTF-8 JSON array → dedicated <autofix-allowed-paths-json> authoritative prompt block, preserving JSON as the sole model-readable authority and the same sealed verifier inventory; (2) replace the stale literal repository: ContextualWisdomLab/.github scheduler assertion with checks that job.workflow_repository, 40-hex job.workflow_sha, workflow path/ref are validated and checkout consumes only steps.trusted_source.outputs.repository + .sha; (3) reverse the stale scheduler credential assertion: require GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }}, the existing fail-closed empty-token guard, and explicit absence of || github.token in the mutation credential path; never weaken this boundary; (4) implement the missing role-specific reasoning contract by replacing the current non-reasoning primary mistralai/mistral-nemotron with hosted NVIDIA NIM mistralai/mistral-small-4-119b-2603, keep reasoning: true, use the OpenCode 1.x-compatible model options.reasoningEffort: "high" plus variants.high.reasoningEffort: "high", and make MODEL match that exact catalog id; keep NVIDIA_NIM_API_KEY as the only model credential and do not force the small tool-calling fallback into a reasoning mode whose tool compatibility is not proven; (5) update the focused contract tests and APA-7 doctoring/operations docs for that model/reasoning change. This model/parameter combination is source-backed by current NVIDIA Build/NIM documentation: /v1/chat/completions with reasoning_effort: "high" is supported for mistralai/mistral-small-4-119b-2603. The repository's protected-main opencode.jsonc already demonstrates the OpenCode 1.x reasoning + options.reasoningEffort + variants.high.reasoningEffort shape for capable models; preserve that schema rather than applying OpenCode v2 syntax to the pinned 1.17.13 worker. Record primary references in APA 7 form in authoritative doctoring. Preserve the immutable OpenCode CLI pin, same-repo/exact-head checks, no Copilot credential, sealed write scope, no self-modifying/repair workflows, and no approval/merge/release/protection changes. Run the focused contract tests first, then all 1064+ repository tests, Strix quick gate, syntax/compile checks, coverage/docstring gates, and git diff --check; commit only ordinary source/tests/docs needed for these exact failures. Predecessor checks/reviews do not transfer.

Copy link
Copy Markdown
Contributor Author

@opencode-agent address

Use the exact-head deterministic Strix/OpenCode repair instructions already recorded in comment 5218519384. Refetch the live head first and abort if it differs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants