fix(opencode): include adversarial gate in fallback scope - #904
fix(opencode): include adversarial gate in fallback scope#904seonghobae wants to merge 16 commits into
Conversation
|
Warning Review limit reached
Next review available in: 55 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent review Evaluate exact current head |
|
Exact-current-head review request for Review the bounded two-file refactor-drift repair: add exactly Keep the exact head unchanged. Do not synthesize author approval, broaden the fallback directory or file cap, duplicate the adversarial gate, alter provider/credential/review/merge authority, update the branch, merge, release, or bypass protection. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
head="f9db98ffbff1d3073c88f76c453eb3542227fb20"
base="6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba"
printf '%s\n' '== checked-out revision and ancestry =='
git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor_of_head=true" || echo "base_is_ancestor_of_head=false"
printf '%s\n' '== changed paths and patch =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --find-renames --find-copies --unified=80 "$base" "$head" -- \
scripts/ci/opencode_review_adversarial_evidence.py \
scripts/ci/test_opencode_review_adversarial_evidence.py \
scripts/ci/opencode_review_process.py \
scripts/ci/test_opencode_review_process.py
printf '%s\n' '== relevant file locations =='
fd -t f -a 'opencode_review.*(process|adversarial).*\.py$|test_opencode_review.*(process|adversarial).*\.py$' scripts/ci 2>/dev/null || true
printf '%s\n' '== relevant fallback and adversarial-gate references =='
rg -n -C 5 \
'CENTRAL_REVIEW_PROCESS_FALLBACK|adversarial_evidence_rejection_reason|fallback|allowlist|allowlisted|24' \
scripts/ci \
-g '*opencode*review*.py' || true
printf '%s\n' '== pull request metadata, reviews, review threads, and exact-head check suites =='
gh pr view 904 --repo "$repo" --json number,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews,statusCheckRollup
gh api "repos/${repo}/pulls/904/comments?per_page=100" --paginate \
--jq '.[] | {id, user: .user.login, commit_id, path, line, body, created_at}' || true
gh api "repos/${repo}/commits/${head}/check-suites?per_page=100" --paginate \
--jq '.check_suites[] | {app: .app.slug, name: .app.name, status, conclusion, head_sha, created_at, updated_at}' || trueLength of output: 25543 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
head="f9db98ffbff1d3073c88f76c453eb3542227fb20"
base="6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba"
printf '%s\n' '== complete pull request patch =='
git diff --check "$base" "$head"
git diff --unified=100 "$base" "$head" -- \
.github/workflows/opencode-review-dispatch.yml \
tests/test_opencode_agent_contract.py
printf '%s\n' '== changed-line function and assertion context =='
ast-grep outline tests/test_opencode_agent_contract.py --items all --type function --view expanded || true
rg -n -C 12 \
'CENTRAL_REVIEW_PROCESS_FALLBACK|adversarial_evidence|fallback|allowlist|allowlisted|24|provider|credential|model|merge' \
tests/test_opencode_agent_contract.py \
.github/workflows/opencode-review-dispatch.yml
printf '%s\n' '== exact current-head review thread state =='
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number=904 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) {
nodes { author { login } body commit { oid } }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes'Length of output: 201742 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="f9db98ffbff1d3073c88f76c453eb3542227fb20"
base="6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba"
workflow=".github/workflows/opencode-review-dispatch.yml"
test_file="tests/test_opencode_agent_contract.py"
printf '%s\n' '== patch statistics =='
git diff --stat "$base" "$head" -- "$workflow" "$test_file"
git diff --numstat "$base" "$head" -- "$workflow" "$test_file"
printf '%s\n' '== exact modified hunks =='
git diff --unified=12 "$base" "$head" -- "$workflow" "$test_file"
printf '%s\n' '== base/head central fallback scope excerpts =='
for revision in "$base" "$head"; do
echo "--- $revision $workflow ---"
git show "${revision}:${workflow}" |
grep -n -E -C 18 'central_review_process_fallback_scope|CENTRAL_REVIEW_PROCESS_FALLBACK|opencode_review_adversarial_evidence|adversarial_evidence\.py|changed_count' |
head -n 260 || true
done
printf '%s\n' '== base/head contract-test excerpts =='
for revision in "$base" "$head"; do
echo "--- $revision $test_file ---"
git show "${revision}:${test_file}" |
grep -n -E -C 18 'central_review_process|fallback.*scope|adversarial_evidence|allowlist|allowlisted' |
head -n 320 || true
doneLength of output: 60360
FindingP2 — Make the regression test reject allowlist broadening Line 1795 in This test still passes if a later change adds a broad entry such as Extend the contract to reject wildcard or directory entries for the adversarial-evidence paths. The contract should prove that only these exact entries authorize this repair:
Review evidence
🧠 Learnings usedYou are interacting with an AI system. |
Keep installer tests on the documented linux x86_64 path, record the control-plane fallback architecture, and cite NIST SP 800-53 SA-11 plus OWASP testing so the extracted gate cannot leave the core review path.
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
|
@opencode-agent review Re-evaluate exact current head |
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_opencode_agent_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_opencode_agent_contract.py"]
R2 --> V2["targeted test run"]
|
Pull request was converted to draft
|
Returned to Draft because the exact tree is broader than the two-path fallback-scope repair. The valid product fix is narrow: add the extracted adversarial-evidence module and its existing test twin to the bounded OpenCode review-process allowlist, retain the 24-file cap, and prove both exact paths remain covered. Head Rebuild from protected |
|
@coderabbitai review Review only exact current head |
Rate Limit Exceeded
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
9bcf1287a0af0ba59907a349829fee80c727ac96. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Changed Path Quality CI/exact-head-path-policy: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31722380634/job/94522262574)
- exact-head-path-policy check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31722380634/job/94522262574)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (4 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (4 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: opencode-adversarial-fallback-scope.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: opencode-adversarial-fallback-scope.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: materialize_base_python_requirements.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: materialize_base_python_requirements.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
9bcf1287a0af0ba59907a349829fee80c727ac96. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Changed Path Quality CI/exact-head-path-policy: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31722380634/job/94522262574)
- exact-head-path-policy check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31722380634/job/94522262574)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (4 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (4 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: opencode-adversarial-fallback-scope.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: opencode-adversarial-fallback-scope.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: materialize_base_python_requirements.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: materialize_base_python_requirements.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
|
Exact-current-head read-only review request for A non-destructive forward commit restored the exact previously bounded two-file adversarial-fallback repair; GitHub compare reports zero changed files from @opencode-agent review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
pr="904"
head="0c5e0812a578cfb11c7cb0613597f26dc5fcb20f"
base="6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba"
previous="f9db98ffbff1d3073c88f76c453eb3542227fb20"
workflow=".github/workflows/opencode-review-dispatch.yml"
contract="tests/test_opencode_agent_contract.py"
printf '%s\n' '== revision identity and ancestry =='
printf 'checkout='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git cat-file -e "${previous}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true' || echo 'base_is_ancestor=false'
git diff --quiet "$previous" "$head" && echo 'previous_tree_equals_head=true' || echo 'previous_tree_equals_head=false'
printf '%s\n' '== complete current-head change set =='
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
git diff --unified=40 "$base" "$head"
printf '%s\n' '== fallback scope and contract context at current head =='
git show "${head}:${workflow}" | grep -n -E -C 24 \
'central_review_process_fallback_scope|CENTRAL_REVIEW_PROCESS_FALLBACK|adversarial_evidence|changed_count|24' || true
git show "${head}:${contract}" | grep -n -E -C 24 \
'fallback_changed_file_allowed|CENTRAL_REVIEW_PROCESS_FALLBACK|adversarial_evidence|allowlist|wildcard|directory' || true
printf '%s\n' '== direct searches for broad fallback entries =='
git show "${head}:${workflow}" | grep -n -E \
'scripts/ci/(\*|[^[:space:]"]*/\*)|tests/(\*|[^[:space:]"]*/\*)|adversarial_evidence' || true
git show "${head}:${contract}" | grep -n -E \
'scripts/ci/(\*|[^[:space:]"]*/\*)|tests/(\*|[^[:space:]"]*/\*)|adversarial_evidence' || true
printf '%s\n' '== target file existence and public symbol =='
git cat-file -e "${head}:scripts/ci/adversarial_evidence.py" && echo 'production_file_exists=true'
git cat-file -e "${head}:tests/test_adversarial_evidence.py" && echo 'test_twin_exists=true'
git show "${head}:scripts/ci/adversarial_evidence.py" | grep -n -E \
'^(def |class )adversarial_evidence_rejection_reason\b|adversarial_evidence_rejection_reason' || true
printf '%s\n' '== PR metadata, reviews, and exact-head checks =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,isDraft,mergeStateStatus,reviewDecision,reviews,statusCheckRollup
gh api "repos/${repo}/commits/${head}/check-suites?per_page=100" --paginate \
--jq '.check_suites[] | {app: .app.slug, status, conclusion, head_sha, created_at, updated_at}'
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) {
nodes { author { login } body commit { oid } }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes'Length of output: 163334
FindingP2 — Make the allowlist contract reject wildcard and directory authorization Line 1795 in The test still passes if a later change adds an entry such as:
Such an entry would authorize the two target paths while widening the fallback trust boundary. Extend the contract so it proves that the allowlist segment has no wildcard or directory-level entry that can match either:
Review evidence
I did not mutate or merge the branch. You are interacting with an AI system. |
…ent-main-20260809
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head5cf43f700595d9b8c433e96ede3957b6586d7add. -
Head SHA:
5cf43f700595d9b8c433e96ede3957b6586d7add -
Workflow run: 31955196111
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_opencode_agent_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_opencode_agent_contract.py"]
R2 --> V2["targeted test run"]
…ent-main-20260809
…ent-main-20260809
|
@opencode-agent please review current PR HEAD 2b47a9e and re-run the failing hourly cadence/conflict-scope gate. Report only exact-head findings. |
|
Current HEAD |
…ent-main-20260809
…ent-main-20260809
…ent-main-20260809
…ent-main-20260809
…ent-main-20260809
|
Exact-head lock repair pushed as 7659f00 from aab6eb3. Updated the hashed pip audit runtime from pip 26.1.2 to pip 26.2.1 with exact hashes. The same lock has passed local pip-audit in this maintenance loop; hosted checks and exact-head approval must be re-evaluated. No bypass or force push was used. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
opencode-agent
Bot
added
area: accessibility
1 participant
Summary
Exact identity and scope repair
main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;f9db98ffbff1d3073c88f76c453eb3542227fb20;0c5e0812a578cfb11c7cb0613597f26dc5fcb20f;After the bounded allowlist repair, unrelated central architecture/materializer/documentation changes entered this branch. A non-destructive forward commit now points to the exact previously bounded tree. GitHub compare reports zero changed files between
f9db98ff...and the current head. No force-push, rebase, history rewrite, predecessor evidence transfer, or gate weakening was used.Every predecessor check, review, approval, or generated merge result is historical only. Current-head evidence must regenerate.
RCA and feasibility
The symptom was
CENTRAL_REVIEW_PROCESS_FALLBACK_ELIGIBLE=falsewhen a central review-process change touched the extracted adversarial-evidence gate. The immediate cause was two missing path cases. The root cause was refactor drift: the gate moved out of an already allowlisted normalizer after the allowlist was established.The smallest repair allowlists exactly the production module and its existing test twin. Duplicating the gate, broadening to a directory wildcard, increasing the 24-file cap, or weakening the fallback check would enlarge the trust boundary and was rejected.
Test-first contract
The bounded tree records a failing protected-main probe for the absent production path, then verifies:
adversarial_evidence_rejection_reason;These RED/GREEN facts are lineage only, not current-head gate evidence.
Verification posture
The current head must regenerate every applicable exact-head quality, security, supply-chain, and semantic-review result. Pending, queued, skipped, cancelled, absent, stale, predecessor-head, local-only, author-only, status-only, synthetic, or model-only evidence is not acceptance.
Merge and operational acceptance
Merge or auto-merge only after the unchanged current head has terminal-success required gates, zero valid unresolved findings, a qualifying current-head semantic verdict, two qualifying independent non-author approvals including last-push approval, compatible live-base evidence, and ordinary expected-head branch-protection authorization. Protected-main fallback evidence must prove that changes to either exact path remain eligible without widening the trust boundary before issue #626 is operationally closed. No self-approval, administrative bypass, synthetic approval, or protection weakening is requested.
Fixes #626.