Skip to content

fix(ci): restore reviewed central Strix reliability contracts - #2574

Merged
seonghobae merged 15 commits into
mainfrom
fix/central-b5f-restored-strix-reliability-20261004
Oct 13, 2026
Merged

seonghobae merged 15 commits into
mainfrom
fix/central-b5f-restored-strix-reliability-20261004

Conversation

@seonghobae

@seonghobae seonghobae commented Oct 4, 2026 •

Copy link
Copy Markdown
Contributor

Scope and lineage

This is the existing central Strix-owner repair lane. Related original PRs remain #2291 and #2504; this PR does not declare either predecessor completely carried over or complete.

  • Protected base integrated: main@7554587c2e3106a388998bcad048a3d7121de25e
  • Exact published head: 822a968397d16ddfd0b258c91c2560181631beb1
  • Exact published tree: ebc31142d89f660c7806bf86276c579ef65cb23e
  • Prior branch head 32f2e1621cfa9cbe1e5ebb235b63f3ac3c8a4d26 and protected main are both ancestors. Publication was an ordinary expected-old-SHA fast-forward; no force push or rebase was used.

Current repair

The completed-report identity boundary previously treated every colon as a path-token terminator. On Linux, a distinct filename such as scripts/ci/strix_quick_gate.sh:backup therefore inherited the identity of the changed file; the private-scope-root spelling had the same defect.

  • RED d8aeb759f780d58b13c8692fe52dd39cd4f60d80 proves both false bindings.
  • GREEN 983e31ff828baeca9873042d8c3faf1b949f2df8 accepts only numeric path:line or path:line:column colon suffixes and rejects named suffixes.
  • Ordinary two-parent protected-main integration: d1cd94627279e1bcb9b5cd5fddbad9a0056d6e1a.
  • The existing CodeQL pagination, review-receipt, discovery-modality and report-container repairs remain intact.

Exact-head verification

Executed from a clean detached worktree at 822a968397d16ddfd0b258c91c2560181631beb1:

  • Python compilation and diff whitespace checks: pass.
  • Focused identity, boundary, CLI and baseline contract cohort: 44 passed.
  • Full repository suite with warnings as errors: 5,222 passed, 11 skipped, 40 subtests passed.
  • Strix scope module: 55/55 statements and 26/26 branches, 100%.

Skipped tests are retained platform/conditional cases; they were not converted to passes or excluded to improve the result.

Remaining gates

Keep this PR Draft / Proposed. Hosted source-executing security/runtime Checks, no unresolved actionable review, and qualifying independent current-head approval are still required. A zero-step runner/admission failure is not source evidence. Local verification is not merge authorization, and no bypass is requested.

Summary by CodeRabbit

  • 개선 사항

    • CodeQL 분석 결과가 여러 페이지에 나뉘어 있어도 전체 결과를 확인하도록 개선했습니다. 이후 페이지에서 오류가 발생하면 불완전한 결과를 정상 결과처럼 사용하지 않습니다.
    • 리뷰 보고서에 입력 모달리티 정보가 정규화되어 표시됩니다.
  • 버그 수정

    • 잘못되었거나 모호한 스캔 보고서와 증거 경로를 식별해 검증을 거부하도록 보완했습니다.
    • HTTP 오류 응답 처리와 현재 커밋 판정 확인의 안정성을 높였습니다.

@coderabbitai

coderabbitai Bot commented Oct 4, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 13 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 2674c151-ae2b-4852-9b42-318725471938
📥 Commits

Reviewing files that changed from the base of the PR and between 5fcc991 and 75abb26.

📒 Files selected for processing (13)
  • .github/workflows/opencode-review.yml
  • CHANGELOG.md
  • docs/product-technical-gap-baseline.md
  • scripts/ci/contextual_orchestrator_review_launcher.py
  • scripts/ci/strix_report_scope.py
  • tests/test_codeql_ghas_configuration_identity.py
  • tests/test_codeql_ghas_configuration_pagination.py
  • tests/test_contextual_orchestrator_review_policy.py
  • tests/test_migrated_receipt_rejection.py
  • tests/test_opencode_required_rerun_capacity.py
  • tests/test_opencode_required_verdict_regression.py
  • tests/test_report_identity_controls.py
  • tests/test_report_scope_boundary_repro.py

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 8c0f4c38-55cf-4ab0-bd53-99cfc578be10
📥 Commits

Reviewing files that changed from the base of the PR and between 822a968 and 5fcc991.

📒 Files selected for processing (11)
  • .github/workflows/opencode-review.yml
  • CHANGELOG.md
  • docs/product-technical-gap-baseline.md
  • scripts/ci/contextual_orchestrator_review_launcher.py
  • scripts/ci/strix_report_scope.py
  • tests/test_codeql_ghas_configuration_identity.py
  • tests/test_codeql_ghas_configuration_pagination.py
  • tests/test_contextual_orchestrator_review_policy.py
  • tests/test_opencode_required_rerun_capacity.py
  • tests/test_opencode_required_verdict_regression.py
  • tests/test_report_identity_controls.py
🚧 Files skipped from review as they are similar to previous changes (1)
  • CHANGELOG.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

워크플로가 OpenCode 리뷰 결과를 파일로 전달하도록 변경했습니다. Strix 보고서 경로 검증과 CodeQL 페이지 조회 관련 테스트를 추가했습니다. 오케스트레이터 보고서에 정규화된 입력 모달리티를 기록합니다.

Changes: OpenCode verdict 처리

Layer / File(s) Summary
리뷰 결과 파일 전달 및 판정 검증
.github/workflows/opencode-review.yml, tests/test_migrated_receipt_rejection.py, tests/test_opencode_required_rerun_capacity.py, tests/test_opencode_required_verdict_regression.py
워크플로가 페이지가 매겨진 리뷰 결과를 임시 파일에 저장하고 경로를 Python 판정 검사기에 전달합니다. 테스트는 잘못된 receipt 거부와 현재 HEAD 판정 누락 시 출력을 확인합니다.

Strix 보고서 경로 검증

Layer / File(s) Summary
경로 토큰 경계 및 재현 테스트
scripts/ci/strix_report_scope.py, tests/test_report_scope_boundary_repro.py, CHANGELOG.md
경로 종료 규칙을 변경하고 재현 테스트를 추가했습니다. 숫자형 줄·열 접미사는 계속 지원하며, 경로 경계 사례와 관련 검증 결과를 기록합니다.
보고서 신원 검증 및 기록
tests/test_report_identity_controls.py, docs/product-technical-gap-baseline.md
테스트는 허용·거부되는 경로 증거, 잘못된 보고서 컨테이너, CLI 결과를 확인합니다. 기준선 문서는 2026-10-07 관측과 Strix report-identity 검증 기록을 추가합니다.

CodeQL 페이지 조회 및 HTTP 오류 테스트

Layer / File(s) Summary
페이지 순회 및 HTTP 오류 경계
tests/test_codeql_ghas_configuration_pagination.py, tests/test_codeql_ghas_configuration_identity.py
테스트는 후속 페이지의 분석 결과 반영, 페이지 요청 실패, per_page 입력 거부를 확인합니다. HTTP 오류 진단의 본문 읽기 제한, 스트림 종료 및 Retry-After 처리도 검증합니다.

오케스트레이터 입력 모달리티

Layer / File(s) Summary
입력 모달리티 정규화 및 보고
scripts/ci/contextual_orchestrator_review_launcher.py, tests/test_contextual_orchestrator_review_policy.py
런처가 발견 모델의 입력 모달리티를 정규화해 보고서 행에 추가합니다. 테스트는 누락·유효·잘못된 입력의 처리 결과를 확인합니다.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 5fcc9

The report-identity fix addresses the previously identified false match. No actionable merge-blocking issue remains after normal checks.

Pre-merge checks · Passed 4 · Failed 1

Failed Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 53.85% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 39 functions across 13 files. (3 skipped:… Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed Passed checks (4 passed)
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed 제목은 중앙 Strix 신뢰성 계약 복원을 명확하게 요약하며, 보고서 식별자·범위 검증과 관련된 주요 변경 사항에 부합합니다.
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

Docstring coverage is 53.85% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 39 functions across 13 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches 💡 2
📝 Generate docstrings 💡
  • Commit to this branch
  • Create a new PR
🛠️ Fix failing CI checks 💡
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

…d launcher

Restore the HTTP error lifecycle repairs from the original #2504 lineage
that the main-based successor did not carry:

- codeql_ghas_configuration_identity: read at most 400 bytes of an HTTP
  error body for diagnostics and close the error stream before raising.
- contextual_orchestrator_review_launcher: close urllib HTTPError after
  classification and reject over-long Retry-After values before int(),
  so a long digit header cannot raise inside the probe handler.

Add offline regressions for all three cases (RED on the parent) and let
the identity test double accept the bounded read size argument; its
assertions are unchanged.

Copy link
Copy Markdown
Contributor Author

Exact-head handoff for 822a968397d16ddfd0b258c91c2560181631beb1 (tree ebc31142d89f660c7806bf86276c579ef65cb23e):

  • clean detached-worktree focused contracts: 44 passed;
  • full repository suite with warnings as errors: 5,222 passed, 11 skipped, 40 subtests passed;
  • strix_report_scope.py: 55/55 statements and 26/26 branches (100%);
  • protected main@7554587c2e3106a388998bcad048a3d7121de25e and the prior PR head are both ancestors; publication was a non-force expected-SHA fast-forward;
  • current hosted Semgrep, runtime-quality, Python-security and security jobs failed before any step (steps=null); CodeQL jobs were skipped. These runs are runner/admission evidence, not source GREEN or source failure.

The PR remains Draft. No blind rerun, Ready transition, merge, or bypass is requested. Please review the current exact head for the colon-suffixed report-identity boundary and regression blast radius.

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Oct 7, 2026 •

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai[bot]

This comment was marked as resolved.

Resolve the 9 conflicts against main while preserving both contracts:
- CHANGELOG.md, docs/product-technical-gap-baseline.md: keep both entries.
- strix_report_scope.py: identical logic on both sides; take main's text.
- codeql_ghas_configuration_identity.py: keep main's Link-header pagination
  (stricter: grammar/endpoint/filter binding, page cap); PR's per_page
  validation is retained once (main already carried the same check).
  The PR's pagination regressions are adapted to emit Link headers.
- opencode-review.yml: keep main's verdict ordering and exit-0 inner
  contract (outer step still fails closed); keep the PR's file-based review
  transfer so paginated reviews never travel through argv.
- fixture_github_reads.py, verdict/rerun tests: take main's superset.
- test_codeql_ghas_configuration_identity.py: keep the PR's size-aware
  HTTPError.read stub (main's slice breaks on read(-1)).

Verification: 21-module set + analyses pagination with -W error, bash 5.3:
587 passed; 22 additional dependent modules: 1004 passed.
Review msg_9b8d3db6efb6 (APPROVE with non-blocking nits a/b): remove unused
base64/workflow_sha/helper from the conflict resolution and restore main's
stdout 'will rerun this failed job' check alongside the stderr reason.
-W error, bash 5.3: 21-module set + analyses pagination 587 passed.
CodeRabbit thread 4204714584 (822a, still valid on bf87): the sentence-period
alternative of PATH_TOKEN_END accepted any non-path character after '.', so
'strix_quick_gate.sh.:backup' (and '.@', '.#', ...) matched the changed file in
both plain and private-scope-root forms. A period now ends a token only when
a real delimiter or end of text follows.

RED: 7 failed/35 passed (6 lookalikes + 1 over-strict control, dropped).
GREEN: 41 passed; strix_report_scope.py 100% stmt/branch; -W error bash5.3
21-module set + analyses pagination + scope tests: 596 passed.
Clean ordinary merge; no conflicts. Keeps PR #2574 current with main after
the fast-mlsirm self-hosted routing and Noema quota separation landed.
Clean ordinary merge; keeps the required up-to-date base.
@seonghobae
seonghobae marked this pull request as ready for review October 13, 2026 04:41
@seonghobae

Copy link
Copy Markdown
Contributor Author

Marked ready for review so the self-hosted OpenCode/Strix current-head gates can execute (they are skipped while Draft). Current head d0bac43681a8235dba59e0a46f87e852e52fd776 = ordinary merges of main 65117620/f160d0d2/a422fa25 plus the reviewed period-suffix Strix scope fix 97885626 (CodeRabbit thread 4204714584). Local -W error, bash 5.3: 21-module set 587/596 passed, latest merges 664 and 135 passed. Noema currently fails before review with "Noema bootstrap refused: independent issuer or custody input unavailable" (repository variables NOEMA_TOOLING_MANIFEST_SHA256/NOEMA_EXECUTION_ADMISSION_SHA256 unset); that is an infrastructure stop, not a pass. No approval or bypass is claimed here.

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 2 potential issues.

Devin Review

Comment thread scripts/ci/contextual_orchestrator_review_policy.py Outdated
Comment thread docs/product-technical-gap-baseline.md Outdated
…elta

Address Devin review comments 4254805046 and 4254805128 on the current
PR #2574 head. Keep one normalize_input_modalities implementation and record
the 2026-10-07 protected-main observation as a dated delta instead of
rewriting the 2026-08-26 snapshot.

Focused -W error validation: 174 passed under bash 5.3.
…th protected main; clean ordinary merge.
@seonghobae
seonghobae merged commit 376727e into main Oct 13, 2026
17 of 23 checks passed
@seonghobae
seonghobae deleted the fix/central-b5f-restored-strix-reliability-20261004 branch October 13, 2026 06:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant