fix(ci): make hourly RCA recovery feasible - #15
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughHourly 워크플로가 PR, release-blocker, dry-run 게이트를 NVIDIA NIM 자격 증명 검사보다 먼저 평가합니다. 자격 증명은 fingerprint로 검증합니다. 모델 재시도마다 pristine workspace를 복원합니다. 관련 ADR, 운영 절차 및 계약 테스트를 추가했습니다. ChangesHourly 게이트와 자격 증명 처리
에이전트 실행과 운영 절차
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant GitHub as GitHub API
participant Workflow as Hourly workflow
participant CredentialGate as NVIDIA credential gate
participant OpenCode
participant Workspace as pristine workspace
participant Broker as NIM credential broker
GitHub->>Workflow: PR, release-blocker, dry-run 상태 제공
Workflow->>CredentialGate: 결정적 게이트 결과 전달
CredentialGate->>CredentialGate: credential fingerprint 생성
CredentialGate->>Workspace: 통과 시 기준선 workspace 준비
Workflow->>OpenCode: 임시 구성으로 모델 실행
OpenCode->>Broker: 모델 요청
Broker-->>OpenCode: 응답 또는 실패 상태
OpenCode-->>Workflow: 종료 상태 반환
Workflow->>Workspace: 재시도 시 pristine 상태로 복원
Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review @opencode-agent @cwl-noema-review Review-only request for exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/OriginWeave"
pr_number="15"
expected_head="3cf49fd8e849236ad131c08057a439ea4ccb74d0"
expected_base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
echo "== Checked-out commit =="
git rev-parse HEAD
echo "== Requested commits exist locally =="
git cat-file -t "$expected_head"
git cat-file -t "$expected_base"
echo "== PR metadata =="
gh pr view "$pr_number" --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,mergeCommit,statusCheckRollup,reviews \
--jq '{
number, state, isDraft, headRefOid, baseRefOid, mergeCommit,
statusCheckRollup: [.statusCheckRollup[] | {
name: .name,
status: .status,
conclusion: .conclusion,
detailsUrl: .detailsUrl
}],
reviews: [.reviews[] | {
author: .author.login,
state: .state,
commit: .commit.oid,
submittedAt: .submittedAt
}]
}'
echo "== Changed files for exact requested range =="
git diff --name-status "$expected_base" "$expected_head"
echo "== Candidate workflow and contract files =="
fd -HI -t f .github . 2>/dev/null | \
rg '(^|/)([^/]*[Ww]orkflow[^/]*|.*\.(ya?ml|md|json|sh))$' | \
head -n 300
echo "== Gate and egress references in the exact requested range =="
git diff --unified=80 "$expected_base" "$expected_head" -- \
':!**/package-lock.json' ':!**/pnpm-lock.yaml' | \
rg -n -C 8 \
'egress-policy|allowed-endpoints|api\.github\.com|cafe\.github\.com|\*\.github\.com|NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|nim_api_key_unavailable|open_pull_request|release_blocker|dry.run|gh api' \
|| true
echo "== Exact-head check runs =="
gh api --paginate \
"repos/$repo/commits/$expected_head/check-runs?per_page=100" \
--jq '.check_runs[] | [
.name, .status, .conclusion, .details_url,
(.output.title // ""), (.output.summary // "")
] | `@tsv`'
echo "== Open review threads =="
gh api graphql -F owner="ContextualWisdomLab" -F name="OriginWeave" -F number="$pr_number" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes {
author { login }
body
commit { oid }
path
line
}
}
}
}
}
}
}' --jq '
.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {
isOutdated,
comments: [
.comments.nodes[] | {
author: .author.login,
body,
commit: .commit.oid,
path,
line
}
]
}'Length of output: 8589 🏁 Script executed: #!/bin/bash
set -uo pipefail
repo="ContextualWisdomLab/OriginWeave"
pr_number="15"
head="3cf49fd8e849236ad131c08057a439ea4ccb74d0"
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
workflow=".github/workflows/hourly-product-development.yml"
contract="tests/test_hourly_product_development_contract.py"
echo "== Workflow structure =="
ast-grep outline "$workflow" --items all 2>&1 || true
echo "== Changed workflow =="
cat -n "$workflow"
echo "== Contract test structure =="
ast-grep outline "$contract" --items all 2>&1 || true
echo "== Contract test =="
cat -n "$contract"
echo "== Exact-range diff =="
git diff --check "$base" "$head"
git diff --unified=12 "$base" "$head" -- "$workflow" "$contract" CHANGELOG.md
echo "== Sensitive tokens in exact head =="
git grep -n -I -E \
'COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|nim_api_key_unavailable|allowed-endpoints|egress-policy|cafe\.github\.com|\*\.github\.com|api\.github\.com|open_pull_request|release_blocker|dry_run|dry-run' \
"$head" -- . ':!CHANGELOG.md' || true
echo "== Required GitHub API gate calls in workflow =="
rg -n -C 6 -P \
'\bgh\s+api\b|NVIDIA_NIM_API_KEY|nim_api_key_unavailable|open_pull_request|release_blocker|dry.run|allowed-endpoints|egress-policy' \
"$workflow" || true
echo "== Exact-head check-run conclusions =="
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | select(.name != null) | [.name, .status, .conclusion, .details_url] | `@tsv`' \
|| true
echo "== Unresolved review threads =="
gh api graphql -F owner="ContextualWisdomLab" -F name="OriginWeave" -F number="$pr_number" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes {
author { login }
body
commit { oid }
path
line
}
}
}
}
}
}
}' --jq '
[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {
isOutdated,
comments: [
.comments.nodes[] | {
author: .author.login,
body,
commit: .commit.oid,
path,
line
}
]
}]'
echo "== Branch protection and rulesets =="
gh api "repos/$repo/branches/main/protection" --jq '{
required_pull_request_reviews,
required_status_checks,
enforce_admins,
restrictions
}' 2>&1 || true
gh api --paginate "repos/$repo/rulesets?includes_parents=true" \
--jq '.[] | {id, name, target, enforcement, conditions, rules}' 2>&1 || trueLength of output: 62592 🏁 Script executed: #!/bin/bash
set -uo pipefail
repo="ContextualWisdomLab/OriginWeave"
owner="ContextualWisdomLab"
name="OriginWeave"
pr_number="15"
head="3cf49fd8e849236ad131c08057a439ea4ccb74d0"
ruleset_id="18156473"
echo "== Pull request author and review decision =="
gh pr view "$pr_number" --repo "$repo" \
--json author,reviewDecision,reviews,headRefOid,baseRefOid \
--jq '{
author: .author.login,
reviewDecision,
headRefOid,
baseRefOid,
reviews: [.reviews[] | {
author: .author.login,
state,
commit: .commit.oid,
submittedAt
}]
}' 2>&1 || true
echo "== Commit status contexts =="
gh api "repos/$repo/commits/$head/status" \
--jq '{
state,
statuses: [.statuses[] | {
context, state, target_url, description, created_at, updated_at
}]
}' 2>&1 || true
echo "== Active ruleset detail =="
gh api "repos/$repo/rulesets/$ruleset_id" \
--jq '{
id, name, target, enforcement, source_type, source,
conditions, rules, bypass_actors
}' 2>&1 || true
echo "== Repository merge-policy flags =="
gh api "repos/$repo" \
--jq '{
default_branch,
allow_merge_commit,
allow_squash_merge,
allow_rebase_merge,
allow_auto_merge,
allow_update_branch,
use_squash_pr_title_as_default,
has_discussions
}' 2>&1 || true
echo "== Exact head and range reconfirmation =="
printf 'checked_out='; git rev-parse HEAD
printf 'range_files=\n'
git diff --name-only \
b228693f9e0a11d1794c1e4b0f7a3a38559a5491 \
3cf49fd8e849236ad131c08057a439ea4ccb74d0Length of output: 3993
No valid unresolved finding was identified. Verified:
I did not mutate the branch or merge the PR. I did not submit a formal GitHub
|
|
@coderabbitai review Review-only request for exact unchanged head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/OriginWeave"
pr="15"
head="3cf49fd8e849236ad131c08057a439ea4ccb74d0"
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
echo "== Exact revision =="
printf 'checked_out='
git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
gh pr view "$pr" --repo "$repo" --json headRefOid,baseRefOid,state,isDraft \
--jq '{headRefOid, baseRefOid, state, isDraft}'
echo "== Exact range =="
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
echo "== Workflow candidates =="
fd -HI -t f -e yml -e yaml .github 2>/dev/null | sort
workflow="$(fd -HI -t f 'hourly-product-development\.ya?ml' .github 2>/dev/null | head -n 1)"
test_file="$(fd -HI -t f 'test_hourly_product_development_contract\.py' . 2>/dev/null | head -n 1)"
printf 'workflow=%s\ntest_file=%s\n' "$workflow" "$test_file"
echo "== Workflow gate and egress configuration =="
if [ -n "$workflow" ]; then
rg -n -C 8 -P 'egress-policy|allowed-endpoints|api\.github\.com|cafe\.github\.com|\*\.github\.com|NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|nim_api_key_unavailable|open_pull_request|release_blocker|dry.run|\bgh\s+api\b' "$workflow"
fi
echo "== Contract assertions =="
if [ -n "$test_file" ]; then
sed -n '1,260p' "$test_file"
fi
echo "== Sensitive terms in exact range =="
git diff --unified=30 "$base" "$head" | rg -n -C 5 'egress-policy|allowed-endpoints|api\.github\.com|cafe\.github\.com|\*\.github\.com|NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|nim_api_key_unavailable|open_pull_request|release_blocker|dry.run|\bgh\s+api\b' || true
echo "== Exact-head check runs =="
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion, .details_url] | `@tsv`'
echo "== Unresolved review threads =="
gh api graphql -F owner="ContextualWisdomLab" -F name="OriginWeave" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } body commit { oid } path line }
}
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated, comments: [.comments.nodes[] | {author: .author.login, body, commit: .commit.oid, path, line}]}]'Length of output: 23432
No valid current-head finding was identified. Verified:
I did not modify the branch or merge
|
|
@coderabbitai approve Exact-head formal approval request for |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/OriginWeave"
owner="ContextualWisdomLab"
name="OriginWeave"
pr="15"
head="3cf49fd8e849236ad131c08057a439ea4ccb74d0"
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
echo "== Pull request state =="
gh pr view "$pr" --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision \
--jq '{state,isDraft,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision}'
echo "== Exact checked-out revision and diff integrity =="
printf 'checked_out='
git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
git diff --check "$base" "$head"
echo "== Gate and egress configuration at exact head =="
workflow="$(fd -HI -t f 'hourly-product-development\.ya?ml' .github | head -n 1)"
test_file="$(fd -HI -t f 'test_hourly_product_development_contract\.py' . | head -n 1)"
printf 'workflow=%s\ntest_file=%s\n' "$workflow" "$test_file"
rg -n -C 8 -P \
'egress-policy|allowed-endpoints|api\.github\.com|cafe\.github\.com|\*\.github\.com|NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|nim_api_key_unavailable|open_pull_request|release_blocker|dry.run|\bgh\s+api\b' \
"$workflow"
sed -n '1,280p' "$test_file"
echo "== Exact-head check runs =="
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,details_url}]'
echo "== Exact-head legacy commit statuses =="
gh api "repos/$repo/commits/$head/status" \
--jq '{state,statuses:[.statuses[] | {context,state,target_url,description}]}'
echo "== Unresolved review threads =="
gh api graphql -F owner="$owner" -F name="$name" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } body commit { oid } path line }
}
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated, comments: [.comments.nodes[] | {author: .author.login, body, commit: .commit.oid, path, line}]}]'Length of output: 16851
The PR is open, non-draft, and unchanged. Required completed checks, SAST, and security checks succeeded. No unresolved review thread exists. The egress and gate-order contract satisfies the requested conditions. I did not modify the branch or merge [approve] You are interacting with an AI system. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/hourly-product-development.yml (1)
74-85: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftNIM 키를 결정적 gate 이후의 별도 step으로 이동하십시오.
elif는 키 검사를 뒤로 이동하지만,NIM_UPSTREAM_API_KEY는 gate step 시작 전에 환경 변수로 주입됩니다. 따라서 open PR, release blocker, 또는 dry-run이 중단되어도 해당 step은 NIM 키를 받습니다. 이는 PR의 credential boundary와 일치하지 않습니다.
.github/workflows/hourly-product-development.yml#L74-L85: 결정적 gate step에서는NIM_UPSTREAM_API_KEY를 제거하십시오.develop == true일 때만 실행되는 별도 credential gate 또는 model step에 키를 주입하십시오.CHANGELOG.md#L39-L39: 실제 step-level credential boundary를 구현한 뒤에만 현재 설명을 유지하십시오.tests/test_hourly_product_development_contract.py#L105-L116: 결정적 gate step에 NIM secret 환경 변수가 없고, credential step이 gate 결과로 조건 실행되는지 검사하십시오.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/hourly-product-development.yml around lines 74 - 85, 결정적 gate step의 환경 변수에서 NIM_UPSTREAM_API_KEY를 제거하고, develop == true일 때만 실행되는 별도 credential gate 또는 model step에 해당 secret을 주입하십시오. .github/workflows/hourly-product-development.yml의 gate 로직을 수정하고, CHANGELOG.md 39행의 설명은 실제 step-level credential boundary가 구현된 경우에만 유지하십시오. tests/test_hourly_product_development_contract.py 105-116행에는 gate step에 NIM secret이 없고 credential step이 gate 결과에 따라 조건 실행되는지 검증을 추가하십시오.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/test_hourly_product_development_contract.py`:
- Around line 166-179: Update the retry loop in the scheduler flow exercised by
“Run OpenCode in an unprivileged no-Git workspace” to classify failures with the
required cause=model_timeout, cause=model_or_tool_failure, or
cause=credential_broker_unavailable contracts and emit
feasible_retry=true/false. Stop model fallback when the credential broker is
unavailable, while continuing to try the next model only for model or tool
failures; ensure the existing test assertions pass.
- Around line 134-150: Update the workflow text used by the “Prepare immutable
baseline and disposable workspace” step so it includes, in order, “Perform
root-cause analysis,” “Verify that the corrective action is feasible,”
“Implement only a feasible corrective action,” and “Rerun the exact failed
command.” Preserve the existing step structure and ensure the phrases are
present in the block inspected by
test_agent_prompt_requires_rca_feasibility_action_and_revalidation.
- Around line 152-164: Update the “Run OpenCode in an unprivileged no-Git
workspace” step so each model iteration calls reset_agent_workspace before
opencode run, recreating AGENT_WORKSPACE from the immutable HEAD baseline.
Ensure the reset removes the existing workspace and extracts git archive HEAD
into it, preventing failed attempts’ edits from reaching later models.
---
Outside diff comments:
In @.github/workflows/hourly-product-development.yml:
- Around line 74-85: 결정적 gate step의 환경 변수에서 NIM_UPSTREAM_API_KEY를 제거하고, develop
== true일 때만 실행되는 별도 credential gate 또는 model step에 해당 secret을 주입하십시오.
.github/workflows/hourly-product-development.yml의 gate 로직을 수정하고, CHANGELOG.md
39행의 설명은 실제 step-level credential boundary가 구현된 경우에만 유지하십시오.
tests/test_hourly_product_development_contract.py 105-116행에는 gate step에 NIM
secret이 없고 credential step이 gate 결과에 따라 조건 실행되는지 검증을 추가하십시오.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e136bde6-3381-4f2e-a69f-87715bdd2569
📒 Files selected for processing (3)
.github/workflows/hourly-product-development.ymlCHANGELOG.mdtests/test_hourly_product_development_contract.py
seonghobae
changed the title
|
@coderabbitai review Fresh exact-head review request for |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/OriginWeave"
owner="ContextualWisdomLab"
name="OriginWeave"
pr="15"
head="057607206111f2bf9bf69c334c164e6e4e01f984"
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
echo "== Exact revision and PR state =="
printf 'checked_out='
git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
gh pr view "$pr" --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,mergeable,mergeStateStatus \
--jq '{state,isDraft,headRefOid,baseRefOid,mergeable,mergeStateStatus}'
echo "== Changed files and whitespace integrity =="
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
echo "== Candidate file structure =="
workflow="$(fd -HI -t f 'hourly-product-development\.ya?ml' .github | head -n 1)"
contract="$(fd -HI -t f 'test_hourly_product_development_contract\.py' . | head -n 1)"
printf 'workflow=%s\ncontract=%s\n' "$workflow" "$contract"
ast-grep outline "$workflow" --items all 2>&1 || true
ast-grep outline "$contract" --items all 2>&1 || true
echo "== Complete changed workflow at checked-out exact head =="
cat -n "$workflow"
echo "== Complete contract test at checked-out exact head =="
cat -n "$contract"
echo "== Exact three-file diff =="
git diff --unified=20 "$base" "$head" -- "$workflow" "$contract" CHANGELOG.md
echo "== Boundary, egress, gate, retry, and budget references =="
rg -n -C 8 -P \
'egress-policy|allowed-endpoints|api\.github\.com|cafe\.github\.com|\*\.github\.com|NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|nim_api_key_unavailable|open_pull_request|release_blocker|dry.run|\bgh\s+api\b|credential broker|broker|127\.0\.0\.1|localhost|pristine|git reset|git clean|checkout|180|timeout|retry|RCA|feasibility' \
"$workflow" "$contract" CHANGELOG.md || true
echo "== Sensitive credential references in the exact head =="
git grep -n -I -E \
'COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|NIM_API_KEY|API_KEY|cafe\.github\.com|\*\.github\.com' \
"$head" -- . ':!CHANGELOG.md' || true
echo "== Exact-head check runs =="
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,details_url}]'
echo "== Exact-head legacy status contexts =="
gh api "repos/$repo/commits/$head/status" \
--jq '{state,statuses:[.statuses[] | {context,state,target_url,description}]}'
echo "== Unresolved review threads =="
gh api graphql -F owner="$owner" -F name="$name" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } body commit { oid } path line }
}
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated, comments: [.comments.nodes[] | {author: .author.login, body, commit: .commit.oid, path, line}]}]'Length of output: 148886
Credential materializes outside the conditional credential step. The deterministic open-PR, release-blocker, and dry-run gate at Line 63 does not receive the NVIDIA secret. Harden Runner remains fail-closed with the reviewed folded allowlist. Each fallback rebuilds the workspace from The I did not modify the branch or merge
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Exact-head review-only request for |
|
@coderabbitai approve Formal exact-head approval request for |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/OriginWeave"
owner="ContextualWisdomLab"
name="OriginWeave"
pr="15"
head="b132d0955ced35d5121f227e4aba8d45acbb40dd"
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
echo "== Exact revision and pull request state =="
printf 'checked_out='
git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
gh pr view "$pr" --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision,author \
--jq '{state,isDraft,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision,author: .author.login}'
echo "== Exact range integrity and files =="
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
echo "== Candidate workflow and contract files =="
workflow="$(fd -HI -t f 'hourly-product-development\.ya?ml' .github | head -n 1)"
contract="$(fd -HI -t f 'test_hourly_product_development_contract\.py' . | head -n 1)"
printf 'workflow=%s\ncontract=%s\n' "$workflow" "$contract"
echo "== Workflow contract references =="
rg -n -C 6 -P \
'egress-policy|allowed-endpoints|api\.github\.com|cafe\.github\.com|\*\.github\.com|COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|nim_api_key_unavailable|open_pull_request|release_blocker|dry.run|credential broker|broker|127\.0\.0\.1|localhost|git archive|pristine|180|timeout|RCA|reproduc|remedi|feasib|lease|lock|writer|revalid|gh api' \
"$workflow" "$contract" CHANGELOG.md || true
echo "== Complete exact-range diff =="
git diff --unified=16 "$base" "$head" -- "$workflow" "$contract" CHANGELOG.md
echo "== Sensitive credentials and endpoint patterns at exact head =="
git grep -n -I -E \
'COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|NIM_API_KEY|API_KEY|cafe\.github\.com|\*\.github\.com|egress-policy|allowed-endpoints' \
"$head" -- . ':!CHANGELOG.md' || true
echo "== Exact-head check runs =="
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,details_url}]'
echo "== Exact-head legacy status contexts =="
gh api "repos/$repo/commits/$head/status" \
--jq '{state,statuses:[.statuses[] | {context,state,target_url,description}]}'
echo "== Unresolved review threads =="
gh api graphql -F owner="$owner" -F name="$name" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } body commit { oid } path line }
}
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated, comments: [.comments.nodes[] | {author: .author.login, body, commit: .commit.oid, path, line}]}]'Length of output: 108740
Two approval conditions are not satisfied:
The pull request is open, non-draft, mergeable, and unchanged. The reported review threads are resolved. I did not modify the branch or merge You are interacting with an AI system. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/OriginWeave"
owner="ContextualWisdomLab"
name="OriginWeave"
pr="15"
head="b132d0955ced35d5121f227e4aba8d45acbb40dd"
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
echo "== Exact revisions and changed files =="
printf 'checked_out='; git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
echo "== Pull request state =="
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,author,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision \
--jq '{number,state,isDraft,author:.author.login,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision}'
echo "== Changed-file outlines =="
while IFS=$'\t' read -r status path; do
[ -n "$path" ] || continue
printf '\n-- %s %s --\n' "$status" "$path"
case "$path" in
*.py|*.js|*.ts|*.tsx|*.go|*.rs|*.java|*.yml|*.yaml)
ast-grep outline "$path" --items all 2>&1 || true
;;
*)
printf '%s\n' "No AST outline requested for this file type."
;;
esac
done < <(git diff --name-status "$base" "$head")
echo "== Workflow and contract references =="
rg -n -C 6 -P \
'egress-policy|allowed-endpoints|api\.github\.com|cafe\.github\.com|\*\.github\.com|NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|nim_api_key_unavailable|open_pull_request|release_blocker|dry.run|\bgh\s+api\b|credential broker|broker|127\.0\.0\.1|localhost|git archive|pristine|RCA|reproduc|remediation|feasibility|permission|reviewer|policy|lease|runtime|reversib|revalidat|180|timeout|concurrency' \
.github tests CHANGELOG.md 2>/dev/null || true
echo "== Exact range diff =="
git diff --unified=18 "$base" "$head"
echo "== Exact-head check runs =="
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,details_url}]'
echo "== Exact-head legacy statuses =="
gh api "repos/$repo/commits/$head/status" \
--jq '{state,statuses:[.statuses[] | {context,state,target_url,description}]}'
echo "== Unresolved review threads =="
gh api graphql -F owner="$owner" -F name="$name" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } body commit { oid } path line }
}
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated,comments:[.comments.nodes[]|{author:.author.login,body,commit:.commit.oid,path,line}]}]'
echo "== Pull request reviews on the exact head =="
gh pr view "$pr" --repo "$repo" --json reviews \
--jq '[.reviews[] | {author:.author.login,state,commit:.commit.oid,submittedAt}]'Length of output: 3887 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/OriginWeave"
owner="ContextualWisdomLab"
name="OriginWeave"
pr="15"
head="b132d0955ced35d5121f227e4aba8d45acbb40dd"
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
workflow=".github/workflows/hourly-product-development.yml"
hourly_contract="tests/test_hourly_product_development_contract.py"
blocker_contract="tests/test_scheduler_blocker_resolution_contract.py"
echo "== Structured-file outlines =="
ast-grep outline "$workflow" --items all 2>&1 || true
ast-grep outline "$hourly_contract" --items all 2>&1 || true
ast-grep outline "$blocker_contract" --items all 2>&1 || true
echo "== Complete workflow =="
cat -n "$workflow"
echo "== Complete hourly contract =="
cat -n "$hourly_contract"
echo "== Complete scheduler blocker contract =="
cat -n "$blocker_contract"
echo "== Changed documentation =="
cat -n AGENTS.md
cat -n CHANGELOG.md
echo "== Exact five-file diff =="
git diff --unified=24 "$base" "$head" -- \
"$workflow" AGENTS.md CHANGELOG.md "$hourly_contract" "$blocker_contract"
echo "== Credential and scheduler boundary references =="
rg -n -C 10 -P \
'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|NIM_API_KEY|API_KEY|nim_api_key_unavailable|open_pull_request|release_blocker|dry.run|\bgh\s+api\b|egress-policy|allowed-endpoints|api\.github\.com|cafe\.github\.com|\*\.github\.com|credential broker|broker|127\.0\.0\.1|localhost|git archive|git reset|git clean|pristine|RCA|reproduc|remediation|feasibility|permission|reviewer|policy|lease|runtime|reversib|revalidat|180|timeout|concurrency' \
"$workflow" "$hourly_contract" "$blocker_contract" AGENTS.md CHANGELOG.md
echo "== Sensitive credential references at the exact head =="
git grep -n -I -E \
'COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|NIM_API_KEY|[A-Z_]*API_KEY|cafe\.github\.com|\*\.github\.com' \
"$head" -- . ':!CHANGELOG.md' || true
echo "== Exact-head checks =="
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,details_url}]'
echo "== Exact-head legacy statuses =="
gh api "repos/$repo/commits/$head/status" \
--jq '{state,statuses:[.statuses[] | {context,state,target_url,description}]}'
echo "== Current unresolved review threads =="
gh api graphql -F owner="$owner" -F name="$name" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } body commit { oid } path line }
}
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated,comments:[.comments.nodes[]|{author:.author.login,body,commit:.commit.oid,path,line}]}]'
echo "== Current branch protection and rulesets =="
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,enforce_admins,restrictions}' \
2>&1 || true
gh api --paginate "repos/$repo/rulesets?includes_parents=true" \
--jq '[.[] | {id,name,target,enforcement,conditions,rules}]' \
2>&1 || trueLength of output: 211054 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/OriginWeave"
owner="ContextualWisdomLab"
name="OriginWeave"
pr="15"
head="b132d0955ced35d5121f227e4aba8d45acbb40dd"
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
echo "== Exact pull request state =="
gh pr view "$pr" --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,mergeable,mergeStateStatus \
--jq '{state,isDraft,headRefOid,baseRefOid,mergeable,mergeStateStatus}'
echo "== Exact-head check summary =="
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '{
non_success: [
.check_runs[]
| select(.status != "completed" or (.conclusion != "success" and .conclusion != "skipped"))
| {name,status,conclusion,details_url}
],
completed_success: [
.check_runs[]
| select(.status == "completed" and .conclusion == "success")
| .name
]
}'
echo "== Exact-head legacy status summary =="
gh api "repos/$repo/commits/$head/status" \
--jq '{state,statuses:[.statuses[] | {context,state,description}]}'
echo "== Current unresolved review threads =="
gh api graphql -F owner="$owner" -F name="$name" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
comments(first: 20) {
nodes { author { login } body commit { oid } path line }
}
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {comments:[.comments.nodes[]|{author:.author.login,body,commit:.commit.oid,path,line}]}]'
echo "== Exact range unchanged =="
test "$(git rev-parse HEAD)" = "$head"
git diff --check "$base" "$head"Length of output: 2971
RCA contract does not require materially distinct remediation candidates for every failure. The remaining requested controls are present:
I did not submit approval. The exact-head
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@coderabbitai review Please review the exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/OriginWeave"
owner="ContextualWisdomLab"
name="OriginWeave"
pr="15"
head="9bc89c1ab719d8a6601d7bc79a132138862a0e9f"
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
echo "== Exact identity and PR state =="
printf 'checked_out='; git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,author,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision \
--jq '{number,state,isDraft,author:.author.login,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision}'
test "$(git rev-parse HEAD)" = "$head"
echo "== Exact changed range =="
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
echo "== Locate and map changed implementation and contract files =="
workflow="$(fd -HI -t f 'hourly-product-development\.ya?ml' .github | head -n 1)"
hourly_contract="$(fd -HI -t f 'test_hourly_product_development_contract\.py' . | head -n 1)"
blocker_contract="$(fd -HI -t f 'test_scheduler_blocker_resolution_contract\.py' . | head -n 1)"
printf 'workflow=%s\nhourly_contract=%s\nblocker_contract=%s\n' \
"$workflow" "$hourly_contract" "$blocker_contract"
ast-grep outline "$workflow" --items all 2>&1 || true
ast-grep outline "$hourly_contract" --items all 2>&1 || true
ast-grep outline "$blocker_contract" --items all 2>&1 || true
echo "== Complete exact diff =="
git diff --unified=28 "$base" "$head"
echo "== Broker, retry evidence, credentials, publication, and contracts =="
rg -n -C 12 -P \
'/statusz|broker|provider.?generation|generation|retry.evidence|attempt.evidence|remediation|materially distinct|pristine|git archive|NVIDIA_NIM_API_KEY|OPENCODE_PR_TOKEN|credential|fingerprint|FORBIDDEN_SECRET|publish|publication|authority|fail.closed|exit [01]|open_pull_request|release_blocker|dry.run|egress-policy|allowed-endpoints|diagnostic|SHA-?256|rolling' \
"$workflow" "$hourly_contract" "$blocker_contract" AGENTS.md CHANGELOG.md 2>/dev/null || true
echo "== Workflow step map and relevant implementation slices =="
rg -n '^\s{6}- name:|^\s{8}id:|^\s{8}if:|timeout-minutes:|concurrency:|cancel-in-progress:' "$workflow"
rg -n -C 20 -P '/statusz|provider.?generation|retry.evidence|attempt.evidence|reset_agent_workspace|git archive|NVIDIA_NIM_API_KEY|OPENCODE_PR_TOKEN|Validate and seal|Publish|credential broker' "$workflow" || true
echo "== Exact-head sensitive names and endpoint patterns =="
git grep -n -I -E \
'COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|NIM_API_KEY|[A-Z_]*API_KEY|OPENCODE_PR_TOKEN|FORBIDDEN_SECRET|cafe\.github\.com|\*\.github\.com|egress-policy|allowed-endpoints' \
"$head" -- . ':!CHANGELOG.md' || true
echo "== Exact-head check state =="
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '{
non_success: [.check_runs[]
| select(.status != "completed" or (.conclusion != "success" and .conclusion != "skipped"))
| {name,status,conclusion,details_url}],
completed: [.check_runs[] | {name,status,conclusion,details_url}]
}'
gh api "repos/$repo/commits/$head/status" \
--jq '{state,statuses:[.statuses[] | {context,state,description,target_url}]}'
echo "== Unresolved review threads =="
gh api graphql -F owner="$owner" -F name="$name" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } body commit { oid } path line }
}
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated,comments:[.comments.nodes[]|{author:.author.login,body,commit:.commit.oid,path,line}]}]'Length of output: 204368 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
head="9bc89c1ab719d8a6601d7bc79a132138862a0e9f"
workflow=".github/workflows/hourly-product-development.yml"
provider_contract="tests/test_provider_retry_feasibility_contract.py"
hourly_contract="tests/test_hourly_product_development_contract.py"
echo "== Broker request generation and status endpoint =="
sed -n '266,407p' "$workflow"
echo "== Status reader and retry classification =="
sed -n '445,585p' "$workflow"
echo "== Provider retry regression contract =="
cat -n "$provider_contract"
echo "== Hourly regression assertions around retry and publication =="
sed -n '240,332p' "$hourly_contract"
echo "== Exact diff for provider retry implementation and tests =="
git diff --unified=40 "$base" "$head" -- \
"$workflow" "$provider_contract" "$hourly_contract" \
docs/adr/0009-hourly-agent-credential-boundary.md CHANGELOG.md
echo "== Focused consistency search for status counters and classification =="
rg -n -C 5 -P \
'REQUEST_COUNTER|LAST_AUTH_REJECTED_REQUEST|LAST_RATE_LIMITED_REQUEST|request_counter|last_auth_rejected_request|last_rate_limited_request|record_provider_status|provider_before|provider_auth_rejected|provider_rate_limited|credential_broker_unavailable|read_provider_status' \
"$workflow" "$provider_contract" "$hourly_contract"
echo "== Reconfirm current head and check state =="
test "$(git rev-parse HEAD)" = "$head"
gh pr view 15 --repo ContextualWisdomLab/OriginWeave \
--json headRefOid,state,isDraft,mergeable \
--jq '{headRefOid,state,isDraft,mergeable}'
gh api --paginate "repos/ContextualWisdomLab/OriginWeave/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[]
| select(.status != "completed" or (.conclusion != "success" and .conclusion != "skipped"))
| {name,status,conclusion,details_url}]'Length of output: 129766
No valid code finding applies to the requested scope. Verified:
|
|
@coderabbitai review |
|
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/OriginWeave"
owner="ContextualWisdomLab"
name="OriginWeave"
pr="15"
head="bbce6970880c1cc78111b9fde4fb68c5969a4c7d"
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
echo "== Exact identity and pull request state =="
printf 'checked_out='; git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,author,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision \
--jq '{number,state,isDraft,author:.author.login,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision}'
test "$(git rev-parse HEAD)" = "$head"
echo "== Exact-range integrity and changed files =="
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
echo "== Candidate file map =="
workflow="$(fd -HI -t f 'hourly-product-development\.ya?ml' .github | head -n 1)"
hourly_contract="$(fd -HI -t f 'test_hourly_product_development_contract\.py' . | head -n 1)"
provider_contract="$(fd -HI -t f 'test_provider_retry_feasibility_contract\.py' . | head -n 1)"
printf 'workflow=%s\nhourly_contract=%s\nprovider_contract=%s\n' \
"$workflow" "$hourly_contract" "$provider_contract"
ast-grep outline "$workflow" --items all 2>&1 || true
ast-grep outline "$hourly_contract" --items all 2>&1 || true
ast-grep outline "$provider_contract" --items all 2>&1 || true
echo "== Complete exact-range diff =="
git diff --unified=28 "$base" "$head"
echo "== File-size bound and changed-file comparison control flow =="
rg -n -C 16 -P \
'1048576|1[ _-]?(MiB|mebibyte)|file.?size|stat |wc -c|changed.?file|read|bytes|bundle|workspace|AGENT_WORKSPACE|find |while read|mapfile|xargs' \
"$workflow" "$hourly_contract" "$provider_contract" tests 2>/dev/null || true
echo "== Fail-closed scheduler, credential, retry, and publication controls =="
rg -n -C 12 -P \
'/statusz|broker|provider.?generation|request_counter|auth_rejected|rate_limited|credential_broker_unavailable|NVIDIA_NIM_API_KEY|OPENCODE_PR_TOKEN|fingerprint|FORBIDDEN_SECRET|nim_api_key_unavailable|open_pull_request|release_blocker|dry.run|egress-policy|allowed-endpoints|api\.github\.com|cafe\.github\.com|\*\.github\.com|git archive|pristine|retry.evidence|materially distinct|feasibility|timeout|180|diagnostic|drift|authority|fail.closed|exit [01]' \
"$workflow" "$hourly_contract" "$provider_contract" AGENTS.md CHANGELOG.md 2>/dev/null || true
echo "== Workflow step map =="
rg -n '^\s{6}- name:|^\s{8}id:|^\s{8}if:|timeout-minutes:|concurrency:|cancel-in-progress:' "$workflow"
echo "== Focused workflow slices =="
rg -n -C 24 -P \
'1048576|changed.?file|Validate and seal|OPENCODE_PR_TOKEN|/statusz|read_provider_status|provider_before|credential_broker_unavailable|Start loopback|Require NVIDIA|reset_agent_workspace|git archive' \
"$workflow" || true
echo "== Exact-head sensitive values and endpoint patterns =="
git grep -n -I -E \
'COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|NIM_API_KEY|[A-Z_]*API_KEY|OPENCODE_PR_TOKEN|FORBIDDEN_SECRET|cafe\.github\.com|\*\.github\.com|egress-policy|allowed-endpoints' \
"$head" -- . ':!CHANGELOG.md' || true
echo "== Exact-head check state =="
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '{
non_success: [.check_runs[]
| select(.status != "completed" or (.conclusion != "success" and .conclusion != "skipped"))
| {name,status,conclusion,details_url}],
completed: [.check_runs[] | {name,status,conclusion,details_url}]
}'
gh api "repos/$repo/commits/$head/status" \
--jq '{state,statuses:[.statuses[] | {context,state,description,target_url}]}'
echo "== Current unresolved review threads =="
gh api graphql -F owner="$owner" -F name="$name" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } body commit { oid } path line }
}
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated,comments:[.comments.nodes[]|{author:.author.login,body,commit:.commit.oid,path,line}]}]'Length of output: 204804 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/OriginWeave"
pr="15"
head="bbce6970880c1cc78111b9fde4fb68c5969a4c7d"
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
workflow=".github/workflows/hourly-product-development.yml"
hourly_contract="tests/test_hourly_product_development_contract.py"
echo "== Exact file-size-related diff =="
git diff --unified=60 "$base" "$head" -- "$workflow" "$hourly_contract" CHANGELOG.md \
| rg -n -C 24 'MAX_CHANGED_FILE_BYTES|1_048_576|oversized|read_bytes|changed =|changed.?file|workspace|PR_MESSAGE|stat'
echo "== Complete bundle-validation implementation =="
sed -n '597,780p' "$workflow"
echo "== Contract methods that cover bundle limits and ordering =="
rg -n -A80 -B4 -P \
'def test_(pr_message_is_bounded|workspace|changed_file|bundle|file_size|size)' \
"$hourly_contract" || true
echo "== All contract references for the workspace bound =="
rg -n -C 8 -P \
'MAX_CHANGED_FILE_BYTES|1_048_576|oversized workspace|oversized|read_bytes\(\).*read_bytes|changed =|new_files|old_files' \
"$hourly_contract" "$workflow"
echo "== Baseline preparation and metadata constraints =="
sed -n '167,247p' "$workflow"
sed -n '781,870p' "$workflow"
echo "== Exact current identity and check state =="
test "$(git rev-parse HEAD)" = "$head"
gh pr view "$pr" --repo "$repo" --json headRefOid,baseRefOid,state,isDraft \
--jq '{headRefOid,baseRefOid,state,isDraft}'
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[]
| select(.status != "completed" or (.conclusion != "success" and .conclusion != "skipped"))
| {name,status,conclusion,details_url}]'Length of output: 104731
The new workspace file-size control has no regression test. Add a contract test that requires:
This control protects the new resource-exhaustion boundary. It should not rely only on implementation review. The remaining reviewed controls are present:
You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/OriginWeave"
owner="ContextualWisdomLab"
name="OriginWeave"
pr="15"
head="da90535c6b6bc4bea69195cc3f6d9a831e13e962"
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
workflow=".github/workflows/hourly-product-development.yml"
contract="tests/test_hourly_product_development_contract.py"
echo "== Exact PR identity and state =="
printf 'checked_out='; git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,author,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision \
--jq '{number,state,isDraft,author:.author.login,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision}'
test "$(git rev-parse HEAD)" = "$head"
echo "== Exact range integrity and changed files =="
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
echo "== File outlines =="
ast-grep outline "$workflow" --items all 2>&1 || true
ast-grep outline "$contract" --items all 2>&1 || true
echo "== Exact delta since prior reviewed head =="
git diff --check "bbce6970880c1cc78111b9fde4fb68c5969a4c7d" "$head"
git diff --unified=60 "bbce6970880c1cc78111b9fde4fb68c5969a4c7d" "$head"
echo "== Workspace validator implementation =="
rg -n -C 35 -P \
'MAX_CHANGED_FILE_BYTES|new_files|stat\(\)\.st_size|read_bytes\(\)|oversized workspace|changed-file|changed file|Validate and seal' \
"$workflow"
echo "== Relevant regression-contract methods =="
rg -n -A110 -B8 -P \
'def test_.*(workspace|changed_file|file_size|bundle|size)|MAX_CHANGED_FILE_BYTES|new_files|read_bytes' \
"$contract"
echo "== Full focused diff against base =="
git diff --unified=45 "$base" "$head" -- "$workflow" "$contract"
echo "== Gate and credential controls at exact head =="
rg -n -C 6 -P \
'egress-policy|allowed-endpoints|NVIDIA_NIM_API_KEY|OPENCODE_PR_TOKEN|COPILOT_GITHUB_TOKEN|open_pull_request|release_blocker|dry.run|credential broker|/statusz|git archive|timeout-minutes' \
"$workflow"
echo "== Exact-head checks =="
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '{
non_success: [.check_runs[]
| select(.status != "completed" or (.conclusion != "success" and .conclusion != "skipped"))
| {name,status,conclusion,details_url}],
completed: [.check_runs[] | {name,status,conclusion,details_url}]
}'
echo "== Unresolved review threads =="
gh api graphql -F owner="$owner" -F name="$name" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } body commit { oid } path line }
}
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated, comments:[.comments.nodes[] | {author:.author.login,body,commit:.commit.oid,path,line}]}]'Length of output: 102216
No valid finding applies to the requested scope. The new
The workflow validator satisfies this order. It rejects every oversized workspace file before it compares changed-file bytes. The delta from the prior reviewed head adds only this regression contract. It does not change the validator or weaken scheduler, credential, publication, retry, or egress controls. No unresolved review thread exists.
You are interacting with an AI system. |
|
@coderabbitai review Review-only request for exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/OriginWeave"
owner="ContextualWisdomLab"
name="OriginWeave"
pr="15"
head="da90535c6b6bc4bea69195cc3f6d9a831e13e962"
base="b228693f9e0a11d1794c1e4b0f7a3a38559a5491"
echo "== Exact PR identity and state =="
printf 'checked_out='; git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,author,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision \
--jq '{number,state,isDraft,author:.author.login,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision}'
test "$(git rev-parse HEAD)" = "$head"
echo "== Exact-range integrity and changed files =="
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
echo "== Candidate files =="
workflow="$(fd -HI -t f 'hourly-product-development\.ya?ml' .github | head -n 1)"
hourly_contract="$(fd -HI -t f 'test_hourly_product_development_contract\.py' . | head -n 1)"
provider_contract="$(fd -HI -t f 'test_provider_retry_feasibility_contract\.py' . | head -n 1)"
workspace_contract="$(fd -HI -t f 'test_hourly_workspace_size_contract\.py' . | head -n 1)"
printf 'workflow=%s\nhourly_contract=%s\nprovider_contract=%s\nworkspace_contract=%s\n' \
"$workflow" "$hourly_contract" "$provider_contract" "$workspace_contract"
echo "== Complete exact-range diff =="
git diff --unified=32 "$base" "$head"
echo "== Focused implementation and contract controls =="
rg -n -C 12 -P \
'egress-policy|allowed-endpoints|api\.github\.com|cafe\.github\.com|\*\.github\.com|NVIDIA_NIM_API_KEY|OPENCODE_PR_TOKEN|COPILOT_GITHUB_TOKEN|nim_api_key_unavailable|open_pull_request|release_blocker|dry.run|\bgh\s+api\b|/statusz|broker|provider.?generation|request_counter|auth_rejected|rate_limited|credential_broker_unavailable|fingerprint|SHA-?256|rolling|FORBIDDEN_SECRET|MAX_CHANGED_FILE_BYTES|1048576|PR_MESSAGE|read_bytes|stat\(\)\.st_size|git archive|pristine|retry.evidence|materially distinct|feasibility|rollback|revert|drift|authority|fail.closed|exit [01]' \
"$workflow" "$hourly_contract" "$provider_contract" "$workspace_contract" AGENTS.md CHANGELOG.md 2>/dev/null || true
echo "== Workflow control map =="
rg -n '^\s{6}- name:|^\s{8}id:|^\s{8}if:|timeout-minutes:|concurrency:|cancel-in-progress:' "$workflow"
echo "== Validation, publication, and retry slices =="
rg -n -C 28 -P \
'Validate and seal|MAX_CHANGED_FILE_BYTES|PR_MESSAGE|read_bytes|Start loopback|/statusz|read_provider_status|provider_before|credential_broker_unavailable|reset_agent_workspace|git archive|OPENCODE_PR_TOKEN|open_pull_request|release_blocker|dry.run|gh\s+api|Repository state changed|rollback|revert' \
"$workflow" || true
echo "== Exact-head sensitive references =="
git grep -n -I -E \
'COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|NIM_API_KEY|[A-Z_]*API_KEY|OPENCODE_PR_TOKEN|FORBIDDEN_SECRET|cafe\.github\.com|\*\.github\.com|egress-policy|allowed-endpoints' \
"$head" -- . ':!CHANGELOG.md' || true
echo "== Exact-head check state =="
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '{
non_success: [.check_runs[]
| select(.status != "completed" or (.conclusion != "success" and .conclusion != "skipped"))
| {name,status,conclusion,details_url}],
completed: [.check_runs[] | {name,status,conclusion,details_url}]
}'
gh api "repos/$repo/commits/$head/status" \
--jq '{state,statuses:[.statuses[] | {context,state,description,target_url}]}'
echo "== Unresolved review threads =="
gh api graphql -F owner="$owner" -F name="$name" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } body commit { oid } path line }
}
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated, comments:[.comments.nodes[] | {author:.author.login,body,commit:.commit.oid,path,line}]}]'Length of output: 204657
Publication does not roll back a pushed branch when PR creation fails. This creates a partial publication state. The next scheduler run can see no open PR and continue, while the stale branch remains remotely published. Add a bounded cleanup path after a failed The other reviewed controls are present:
I did not approve, modify the branch, or merge You are interacting with an AI system. |
2 participants
Fleet incident
OriginWeave's protected-main Hourly Product Development workflow had five coupled failure modes:
NVIDIA_NIM_API_KEYwas still materialized in the deterministic gate step's environment before that branch ran;A later governance audit found a sixth failure mode: maintenance could identify a blocker and report it without proving whether any proposed corrective action had actual tool support, sufficient actor permissions, an eligible reviewer, compatible branch/ruleset policy, an uncontested writer lease, and enough remaining runtime to complete and verify the action.
A fresh exact-head review found a seventh failure mode: post-model bundle validation rematerialized the raw NVIDIA key only to detect accidental disclosure, so a non-model validation step still received the credential after the broker stopped.
A subsequent validator audit found an eighth failure mode: changed-file discovery called
read_bytes()on every model-controlled workspace file before applying the nominal one-mebibyte per-file bound. A malicious or accidental oversized file could therefore force unbounded trusted-runner I/O and allocation before the validator reached its size rejection.Repair
egress-policy: blockand the exact reviewed endpoint allowlist;api.github.com:443explicit and do not add broad*.github.com:443egress;NVIDIA_NIM_API_KEYonly in a separate credential step conditioned onsteps.gate.outputs.develop == 'true'and in the loopback broker that actually needs it;ready == true;RCA → reproduce → feasibility check → bounded corrective action → exact-command revalidationfor every failed command or unexpected result;HEADbefore every model attempt so fallback models never inherit partial edits;model_timeout,model_or_tool_failure, andcredential_broker_unavailableseparately;reviewer-provisioning gap, not ordinary approval latency;cancel-in-progress: false, no competing branch writer, and no temporary write-capable repair workflow.TDD evidence
73dd8a27a7e926b9059d77d3be85e7dcb63aa5e1first introduced the deterministic ordering and exact-egress regression while the inherited workflow still failed it.cece5844077633019e84ef4f1c20eb678b997458added the RCA, realistic-runtime, pristine-retry, and broker-aware feasibility contracts first. Exact-head CI run31258067839, job93104444325, failed for all four intended reasons.80409575134a31df22e42cb44db2d39e6f2c8208implemented those scheduler contracts; exact-head CI, production coverage, SAST, and Security Scan subsequently passed at2780ad381c72749763fb707f1726e1e39b61bfd7.e0e2e895c6aa6e2460823751f775bccb8fe559deadded the step-level secret-boundary contract first. Exact-head CI run31258507967, job93105557709, failed because the new deterministic and credential steps did not yet exist.0a8a1835cfdbcdcfd0c9bc2cf590a55e2503d624separated deterministic governance from conditional secret materialization.057607206111f2bf9bf69c334c164e6e4e01f984updated the authoritative changelog contract.bd2d6377998a93948153f49db0386a3d85eb3b6cadded the generalized blocker-resolution contract before the governing agent policy existed. Exact-head CI run31259517074, job93108034124, failed exactly 13 assertions for the absent RCA, feasibility, action, state-transition, and reviewer-provisioning terms.b132d0955ced35d5121f227e4aba8d45acbb40ddadded the smallest governingAGENTS.mdpolicy. Exact-head CI run31259595580then passed 40 Python repository contracts, formatting, locked workspace checks, all Rust tests, strict Clippy, rustdoc, and exact 100% production function/line/region/branch coverage. Exact-head SAST Semgrep run31259595585and Security Scan run31259595575also completed successfully.Validate and seal the credential-free change bundle.5ab936ab1ed72507a3646ffee681a1c5fc789b98added the fingerprint-only post-model leak-scanning contract first. Exact-head CI run31260342137, job93110071371, failed at the Python repository-contract step as intended.678a3f1033605bebe130cc1782a98c527d58491eimplemented the bounded fingerprint scanner and removed raw secret materialization from bundle validation.a83e5732e5c35af9a547c7c1015d52286301afedrecorded the corrected credential boundary. Exact-head CI run31260876378, SAST Semgrep run31260876376, and Security Scan run31260876369all completed successfully; CI includes exact 100% production function, line, region, and branch coverage.1c11de9c5212d68e58cb8692499f5944d5ba1b5dadded the pre-read workspace-size contract before changing the validator. Exact-head CI run31275891448, Rust-contracts job93149223124, ran 54 Python repository contracts and failed exactly the new assertion because changed-file discovery still had no pre-read size guard.2aa0c0a8865fa262f843d7418895d76987526dd5implemented the smallest root-cause repair: collect model workspace metadata, reject files larger than 1,048,576 bytes, and only then perform full byte comparison for changed-file discovery.933950b980d4a76dd163a84d45d41ecf690e58aeandbbce6970880c1cc78111b9fde4fb68c5969a4c7daligned ADR 0009 and the changelog with the pre-read bound. On exact headbbce697..., CI run31276172147, SAST Semgrep run31276172213, and Security Scan run31276172141completed successfully. Rust-contracts job93149967734ran 54 Python contracts with zero failures, then passed formatting, locked workspace checks, all Rust tests, strict Clippy, and rustdoc. Production-coverage job93149967776independently reported that production functions, lines, regions, and branches are 100% covered.Corrective-action realism evidence
The scheduler may not infer that an approval route exists merely because a team or bot name is known. A live formal review request to the organization team
independent-reviewerswas attempted on the unchanged PR and GitHub rejected it with HTTP 422 because the team is not a collaborator onContextualWisdomLab/OriginWeave. The request produced no reviewer assignment and no formal review. Until repository access is provisioned for an eligible non-author reviewer or team, this condition is a reviewer-provisioning gap. Repeating the same request, posting a comment, invoking an unsupported bot command, self-approving, or weakening the approval requirement is not a feasible corrective action.The fingerprint repair was selected only after checking the operational boundary. Removing leak detection would weaken the security gate; retaining the raw key in bundle validation would preserve the boundary violation; moving the scan into the untrusted model workspace would expose the credential. The selected design derives a one-way runner-owned fingerprint while the credential is already authorized, keeps it unreadable to UID 65532, deletes it before candidate scanning, uses a rolling hash only as a prefilter, and confirms exact candidate bytes with SHA-256. This preserves exact leak detection without extending raw-key authority.
For the workspace resource-bound defect, retaining the existing
len(new_bytes)check was rejected because it executes only after the full allocation and cannot prevent the root cause. A streaming full-file comparison would reduce peak allocation but still permits unbounded trusted I/O and complicates the existing one-mebibyte contract. A metadatastat()gate before changed-file reads directly enforces the existing product limit, is deterministic and reversible, requires no new dependency or authority, and keeps the later byte-level validation as defense in depth.Feasibility boundary
The scheduler does not treat every failure as repairable. A healthy broker plus a model timeout or model/tool failure permits the next clean model attempt. A failed broker is an infrastructure cause and stops model fallback immediately. Inside a successful model session, a corrective action is permitted only when it fits the allowed paths, permissions, dependencies, remaining runtime, and unchanged quality or security gates. Otherwise the workspace remains unchanged rather than manufacturing a successful patch.
For governance blockers, command acceptance is not completion evidence. The scheduler must refetch the authoritative PR, review, check, branch, workflow-run, or protected-main object and prove the intended state transition. If the first candidate fails, that evidence feeds the RCA and the next safe feasible candidate is evaluated in the same run. Only when no safe feasible candidate exists may an external blocker be reported.
The 180-minute job budget is deliberate rather than cosmetic: three model attempts consume at most 105 minutes, leaving 75 minutes for toolchain setup, broker startup, bundle sealing, Rust or Python verification, exact coverage, and publication rechecks. Hourly triggers remain serialized by the existing concurrency group rather than racing another writer.
Closure criteria
Merge only after exact-head CI, production coverage, SAST, Security Scan, CodeRabbit and other feedback cleanup, branch protection, repository policy, and qualifying independent non-author approval pass. After protected merge:
open_pull_requestwithout materializing the NVIDIA secret;HEAD, and retry only when feasible;No invented credential, no
COPILOT_GITHUB_TOKEN, no synthesized approval, no bypassed protection, and no weakening or rewriting of failed tests or checks.Summary by CodeRabbit
개선 사항
문서
테스트