fix(opencode): retain adversarial fallback scope - #1273
Conversation
|
Warning Review limit reachedNext included review available in 45 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (5)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (9)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughOpenCode 커버리지 소스를 현재 워크플로 시도와 아티팩트 ID에 연결합니다. 소비자는 시도 일치와 아티팩트 존재를 검증한 뒤 다운로드합니다. 관련 계약 테스트, fallback 허용 목록, Strix 검증과 문서를 갱신합니다. ChangesOpenCode 커버리지 아티팩트 재실행
Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: ⚪ Minimal · up to This change scopes coverage evidence to the current workflow attempt and expands the fallback allowlist for the extracted adversarial-evidence paths. The supplied contract coverage indicates stale artifacts are rejected and missing evidence fails closed, with no remaining merge-blocking risk. Sequence Diagram(s)sequenceDiagram
participant coverage-source-tree
participant upload-artifact
participant coverage-evidence
participant download-artifact
coverage-source-tree->>upload-artifact: 현재 시도 이름으로 커버리지 소스 업로드
upload-artifact-->>coverage-source-tree: artifact-id 반환
coverage-source-tree-->>coverage-evidence: artifact-id와 run_attempt 전달
coverage-evidence->>coverage-evidence: 현재 시도 신원 검증
coverage-evidence->>download-artifact: artifact-ids로 다운로드
download-artifact-->>coverage-evidence: 커버리지 소스 전달
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
7bbbed45a4eeaeec6d392dab5a8fad2f82674498. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32661154228/job/97247436674)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32661154228/job/97247436674)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: opencode-adversarial-fallback-scope.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: opencode-adversarial-fallback-scope.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
7bbbed45a4eeaeec6d392dab5a8fad2f82674498. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32661154228/job/97247436674)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32661154228/job/97247436674)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: opencode-adversarial-fallback-scope.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: opencode-adversarial-fallback-scope.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…HEAD # Conflicts: # scripts/ci/test_strix_quick_gate.sh
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Disposition: informational and accepted. The added classifier intentionally matches the exact bare timeout emitted by the existing self-test fixture, while the existing qualified path remains covered. No further source change is required. |
|
Disposition: informational and accepted. The added litellm.Timeout classifier intentionally matches the exact bare timeout emitted by the existing self test fixture, while the existing qualified litellm.exceptions.Timeout path remains covered. No further source change is required. |
|
Exact-head RCA: Strix run 32688204055 checked out 9fd37e2 and completed the source scan, but NVIDIA NIM emitted provider infrastructure/failure-signal output; the fallback then used the protected-base openai-direct alias and LiteLLM rejected it before authoritative evidence. No source finding was produced. The separate scan-pr-queue run was cancelled before steps. This PR remains non-mergeable until its base/control-plane provider repair is available and fresh exact-head checks plus formal review are produced. |
Current-head re-review request\n\nCurrent exact head: 212d070\n\nThe previous REQUEST_CHANGES review is tied to an older Strix/provider-failure head. Current-head evidence must be re-established from this SHA; predecessor failures and approvals are not being reused. Please inspect the complete current diff and publish a substantive review after the current required Checks finish. No merge is requested until exact-head checks and independent approval are current. |
|
Exact-head formal review request for 212d070. Please inspect the complete changed-file diff, with emphasis on adversarial fallback scope and provider-failure handling. Publish a substantive Reviews API verdict tied only to this exact SHA, including security/control-plane impact, test gaps, and residual uncertainty. Do not reuse predecessor-head evidence or failed provider checks as source findings. @opencode-agent |
|
Current-head conflict repair and verification:
Current hosted required Checks and independent review are still pending, with no valid unresolved review threads. This PR remains |
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
3ab55c3da0e9b05c6cc9e80fc3d5fe89a6f53b84. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32724098358/job/97421469269)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32724098358/job/97421469269)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
3ab55c3da0e9b05c6cc9e80fc3d5fe89a6f53b84. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32724098358/job/97421469269)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32724098358/job/97421469269)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
…ain-replacement-20260824 # Conflicts: # CHANGELOG.md # tests/test_pr_review_autofix_nvidia_nim_contract.py
Resolved the stale merge conflict against
|
# Conflicts: # CHANGELOG.md # tests/test_pr_review_autofix_nvidia_nim_contract.py
Stale base resolved — merged current
|
The only conflict is REVIEW_DISPATCH_BLOB_SHA, which pins `.github/workflows/opencode-review-dispatch.yml` byte-for-byte via `git hash-object`. Both sides' values are correct for their own tree and wrong for the merge: branch 254df8e… == hash of the branch's copy main ade10b3… == hash of main's copy merged ccc0d34… == hash of the merged file, neither side's value Taking either side verbatim would fail the pin, so the constant is recomputed against the actual merged file. The accompanying semantic assertion still holds: the merged dispatch workflow contains no `pr-review-autofix` reference. Verified after resolution: 2895 passed, 1 skipped, coverage 100%, interrogate 100%; zero conflict markers; `ruff check --select F821` clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
#1932 changed `.github/workflows/opencode-review-dispatch.yml`, which REVIEW_DISPATCH_BLOB_SHA pins by whole-file `git hash-object`. The workflow itself auto-merged cleanly; only the pin line conflicted, and again neither side's value is right for the merge: this branch ccc0d34… (its own tree) main 26e8555… (after #1932) merged 449cee2… (recomputed) 449cee2 matches the value predicted by simulating this merge before #1932 landed, so the pin behaves exactly as expected under a base change. Verified: 2896 passed, 1 skipped, coverage 100%, interrogate 100%; zero conflict markers; `ruff check --select F821` clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
seonghobae
added
bug
ChatGPT Codex Connector
Resolves the one conflicted file, tests/test_pr_review_autofix_nvidia_nim_contract.py. The conflict is the REVIEW_DISPATCH_BLOB_SHA content pin on .github/workflows/opencode-review-dispatch.yml, where neither side of the conflict is correct: that workflow was itself auto-merged by this merge, so the resulting file hashes to a third value. Taking either side would have failed test_independent_review_agent_workflow_matches_reviewed_blob, which asserts the constant equals `git hash-object` of the merged file. HEAD 449cee2 origin/main d86497b merged (recomputed) 3e4329a Verified on the merge result: the 23 contract tests in that file pass, the full suite is 2989 passed / 1 skipped, interrogate reports 100%, `git diff --check` is clean, and every markdown file in the PR diff has a balanced fence count. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KPmJErfkcHer4UVEgrQxUX
Stale base resolved — merged current
|
| side | value |
|---|---|
HEAD |
449cee234a94387502861f3a7603dc4868f69983 |
origin/main |
d86497b3f43bebbabbb4f504eb5132cdf3b7b293 |
| merged, recomputed | 3e4329a7f79fdcd36ff21b5bd9fa2dc4622dac0e |
Taking either side would have failed test_independent_review_agent_workflow_matches_reviewed_blob, which asserts the constant equals git hash-object of the file as merged. The value was recomputed from the merge result, not chosen.
Verified on the merge result before pushing:
tests/test_pr_review_autofix_nvidia_nim_contract.py— 23 passed- full suite — 2989 passed, 1 skipped, 21 subtests passed
interrogate— 100.0% (minimum 100.0%)git diff --check— clean- every markdown file in the PR diff has a balanced fenced-block count
No history was rewritten: this is a merge commit, so existing checkouts of the branch stay valid.
The four failing checks on the previous head (CodeQL ×2, noema-review, opencode-review) and the two cancelled ones are all classes tracked elsewhere — dispatch pre-runner cancellation (#1929), free-pool provider-family availability (#1915) — and none of them can be influenced by this diff. They are re-running against the new head now; I will classify whatever the new head produces rather than carry the old attribution forward.
Generated by Claude Code
On the "Out of Scope Changes" warningNoting rather than acting on it, with reasons. The same review reports no actionable comments, Merge Risk: Minimal, and "no remaining merge-blocking risk". The warning is a scope opinion on a pull request that has carried this content since 2026-08-23 — its stated purpose is to be a clean current- One flagged item is not scope at all: the On the remedy the warning proposes — splitting the rest into separate PRs — this repository has a recorded failure of exactly that manoeuvre. I am not the right actor for it either way: this is a restructuring decision, not a bug report, so I am leaving it to whoever owns the lane instead of pushing a split. Generated by Claude Code |
2 participants
Outcome
Keeps the extracted adversarial-evidence gate and its test inside the exact central OpenCode fallback allowlist. This is a clean current-main replacement for #904 and omits its unrelated pip-lock and materializer history.
Closes #626.
Supersedes #904.
Verification
Standards
The doctoring record cites NIST SP 800-53 Rev. 5 SA-11 and the stable OWASP Web Security Testing Guide v4.2 in APA 7th form.
Summary by CodeRabbit
버그 수정
문서
테스트