Uh oh!
There was an error while loading. Please reload this page.
Guard autofix dispatch with current OpenCode review - #278
Conversation
There was a problem hiding this comment.
Pull request overview
This PR tightens the criteria for dispatching automated “review autofix” runs so they only trigger when there is a current-head OpenCode CHANGES_REQUESTED review, while still including unresolved review threads as supplemental context (not standalone evidence).
Changes:
- Update
needs_autofix()to early-return unless the PR has a current-head OpenCode change request that is considered autofixable. - Add a regression test ensuring thread-only feedback does not trigger an autofix run.
- Adjust existing test wording to match the new dispatch criteria.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| tests/test_pr_review_fix_scheduler.py | Adds regression coverage for “thread-only feedback should not dispatch autofix” and updates an existing test’s description to match the new behavior. |
| scripts/ci/pr_review_fix_scheduler.py | Makes needs_autofix() require current-head OpenCode change requests before considering threads as additional context. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Uh oh!
There was an error while loading. Please reload this page.
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head bounded evidence and found no blocking issues. FindingsNo blocking findings. SummaryApproval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (3 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["CI script (3 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script (3 files)"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
|
e1d6a87 to
f0c857cCompareThere was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head evidence but found unresolved reviewer or review-agent threads before approval.
Findings
1. HIGH .github/workflows/opencode-review.yml:1 - Unresolved reviewer thread blocks automated approval
- Problem: OpenCode reached an APPROVE control result, but the approval step found unresolved, non-outdated human or review-agent thread evidence on the current pull request.
- Root cause: Reviewer and review-agent feedback can arrive after bounded model evidence is prepared, so the approval step must re-query GitHub immediately before publishing an approval.
- Fix: Address or resolve the listed reviewer thread(s), then re-run OpenCode on the current head.
- Regression test: Keep the approval gate querying reviewThreads(first: 100) after model output and before create_pull_review APPROVE, including bot review agents other than OpenCode itself.
Review thread evidence
Latest unresolved reviewer thread evidence
scripts/ci/pr_review_fix_scheduler.py line 118
Latest reviewer comment: @copilot-pull-request-reviewer at 2026-07-01T09:20:08Z
Comment URL: #278 (comment)
Comment excerpt: 'needs_autofix()' now requires a current-head OpenCode change request to be present, so the skip reason returned by 'inspect_pr()' ("no current-head change request or active unresolved review thread") is now misleading: unresolved threads are no longer standalone dispatch evidence. Update the skip message (and/or the logic that produces it) so it reflects the new gating behavior.
Result: REQUEST_CHANGES
Reason: unresolved reviewer or review-agent thread(s) were present before approval.
Head SHA:
f0c857c6d9ad5101c6f410e86b200c5b8eaa33f6Workflow run: 28507829736
Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script (3 files)"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script (3 files)"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test (2 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (2 files)"]
R3 --> V3["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head evidence but found unresolved reviewer or review-agent threads before approval.
Findings
1. HIGH .github/workflows/opencode-review.yml:1 - Unresolved reviewer thread blocks automated approval
- Problem: OpenCode reached an APPROVE control result, but the approval step found unresolved, non-outdated human or review-agent thread evidence on the current pull request.
- Root cause: Reviewer and review-agent feedback can arrive after bounded model evidence is prepared, so the approval step must re-query GitHub immediately before publishing an approval.
- Fix: Address or resolve the listed reviewer thread(s), then re-run OpenCode on the current head.
- Regression test: Keep the approval gate querying reviewThreads(first: 100) after model output and before create_pull_review APPROVE, including bot review agents other than OpenCode itself.
Review thread evidence
Latest unresolved reviewer thread evidence
scripts/ci/pr_review_fix_scheduler.py line 118
Latest reviewer comment: @copilot-pull-request-reviewer at 2026-07-01T09:20:08Z
Comment URL: #278 (comment)
Comment excerpt: 'needs_autofix()' now requires a current-head OpenCode change request to be present, so the skip reason returned by 'inspect_pr()' ("no current-head change request or active unresolved review thread") is now misleading: unresolved threads are no longer standalone dispatch evidence. Update the skip message (and/or the logic that produces it) so it reflects the new gating behavior.
Result: REQUEST_CHANGES
Reason: unresolved reviewer or review-agent thread(s) were present before approval.
Head SHA:
d7ea1ee5f17a96c2f6ab5804e7ce3f21210ef22cWorkflow run: 28508619714
Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script (3 files)"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script (3 files)"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test (2 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (2 files)"]
R3 --> V3["targeted test run"]
seonghobae
commented
Jul 8, 2026
Triage (kept open — carries unique un-merged value): Unique value still not on main: the scheduler change in Superseded parts to drop on rebase: the bundled opencode-review.yml knob changes (step Blocker (central-infra): the required |
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/opencode-review.yml, .github/workflows/pr-review-autofix.yml, scripts/ci/pr_review_fix_scheduler.py, scripts/ci/test_strix_quick_gate.sh, tests/test_pr_review_fix_scheduler.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/opencode-review.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: All tests pass with 100% coverage, and the changes align with repository standards.
- Head SHA:
89cb15c0cc98d91cf4f5bd2f083f8fcada113f01 - Workflow run: 29084093977
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script (2 files)"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script (2 files)"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test: test_pr_review_fix_scheduler.py"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_pr_review_fix_scheduler.py"]
R3 --> V3["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found source-backed failed-check findings that must be addressed before merge.
- Result: REQUEST_CHANGES
- Reason: failed current-head checks were mapped to line-specific findings below for
320e2cc447f488922cc06f7cccb258206a54a0c5. - Head SHA:
320e2cc447f488922cc06f7cccb258206a54a0c5 - Workflow run: 29084751108
- Workflow attempt: 1
Failed checks
- Strix Security Scan/strix workflow run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/29084751103)
Findings
1. HIGH .github/workflows/strix.yml:1 - Current-head Strix evidence is missing because the workflow run was cancelled before logs
Problem: Strix Security Scan reported a current-head workflow_run conclusion of cancelled, but GitHub emitted no failed job log and no Strix Vulnerability Report window.
Root cause: The security gate has no usable Strix evidence for this head SHA. This PR changes trusted Strix workflow or gate inputs, but the cancelled pull_request_target run still used the base branch copies, so current-head edits cannot affect this run.
Fix: Do not invent an application code fix from this cancelled run. Re-run Strix after the trusted base branch contains the workflow/gate change or capture equivalent temporary evidence tied to this head SHA; keep the workflow concurrency line at .github/workflows/strix.yml:1 aligned with the intended queue isolation.
Regression test: Keep failed-check evidence collection explicit for cancelled workflow runs with no job log and cover self-modifying Strix workflow PRs so reviews explain trusted-base execution semantics.
Suggested edit: preserve
.github/workflows/strix.yml:1withcancel-in-progress: false, cancel only superseded non-current-head runs when needed, and rerun current-head Strix until logs exist.
Failed check evidence for line-specific fixes
Failed GitHub Check Evidence
- PR: #278
- Head SHA:
320e2cc447f488922cc06f7cccb258206a54a0c5 - Repository:
ContextualWisdomLab/.github
Line-specific repair contract
Treat the check logs and annotations below as diagnostic evidence, not as a complete review.
For each actionable failed check, inspect the local source or diff and identify the exact file line that must change.
OpenCode
REQUEST_CHANGESfindings must includepath,line,root_cause,fix_direction,regression_test_direction, andsuggested_diff.Do not request changes with only a GitHub Actions URL or a generic check name.
When Strix logs contain multiple
Vulnerability ReportorModel ... Vulnerabilities ...sections, include every model-reported vulnerability in the review evidence and findings, including model name, title, severity, endpoint, and Code Locations/path:line evidence when present.Create one OpenCode finding per Strix model vulnerability report; do not satisfy two model reports with one combined finding, even when titles or locations match.
Failed check: Strix Security Scan
- Type:
workflow_run - Conclusion:
cancelled - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/29084751103
- Workflow run id:
29084751103
No GitHub Actions job log is available for this failed workflow run.
The workflow run completed as cancelled before GitHub emitted a failed job log. Treat this as missing current-head security evidence, not as a source-code vulnerability report.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["CI script (3 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script (3 files)"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found source-backed failed-check findings that must be addressed before merge.
- Result: REQUEST_CHANGES
- Reason: failed current-head checks were mapped to line-specific findings below for
320e2cc447f488922cc06f7cccb258206a54a0c5. - Head SHA:
320e2cc447f488922cc06f7cccb258206a54a0c5 - Workflow run: 29084912291
- Workflow attempt: 1
Failed checks
- Strix Security Scan/strix workflow run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/29084751103)
Findings
1. HIGH .github/workflows/strix.yml:1 - Current-head Strix evidence is missing because the workflow run was cancelled before logs
Problem: Strix Security Scan reported a current-head workflow_run conclusion of cancelled, but GitHub emitted no failed job log and no Strix Vulnerability Report window.
Root cause: The security gate has no usable Strix evidence for this head SHA. This PR changes trusted Strix workflow or gate inputs, but the cancelled pull_request_target run still used the base branch copies, so current-head edits cannot affect this run.
Fix: Do not invent an application code fix from this cancelled run. Re-run Strix after the trusted base branch contains the workflow/gate change or capture equivalent temporary evidence tied to this head SHA; keep the workflow concurrency line at .github/workflows/strix.yml:1 aligned with the intended queue isolation.
Regression test: Keep failed-check evidence collection explicit for cancelled workflow runs with no job log and cover self-modifying Strix workflow PRs so reviews explain trusted-base execution semantics.
Suggested edit: preserve
.github/workflows/strix.yml:1withcancel-in-progress: false, cancel only superseded non-current-head runs when needed, and rerun current-head Strix until logs exist.
Failed check evidence for line-specific fixes
Failed GitHub Check Evidence
- PR: #278
- Head SHA:
320e2cc447f488922cc06f7cccb258206a54a0c5 - Repository:
ContextualWisdomLab/.github
Line-specific repair contract
Treat the check logs and annotations below as diagnostic evidence, not as a complete review.
For each actionable failed check, inspect the local source or diff and identify the exact file line that must change.
OpenCode
REQUEST_CHANGESfindings must includepath,line,root_cause,fix_direction,regression_test_direction, andsuggested_diff.Do not request changes with only a GitHub Actions URL or a generic check name.
When Strix logs contain multiple
Vulnerability ReportorModel ... Vulnerabilities ...sections, include every model-reported vulnerability in the review evidence and findings, including model name, title, severity, endpoint, and Code Locations/path:line evidence when present.Create one OpenCode finding per Strix model vulnerability report; do not satisfy two model reports with one combined finding, even when titles or locations match.
Failed check: Strix Security Scan
- Type:
workflow_run - Conclusion:
cancelled - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/29084751103
- Workflow run id:
29084751103
No GitHub Actions job log is available for this failed workflow run.
The workflow run completed as cancelled before GitHub emitted a failed job log. Treat this as missing current-head security evidence, not as a source-code vulnerability report.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["CI script (3 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script (3 files)"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found source-backed failed-check findings that must be addressed before merge.
- Result: REQUEST_CHANGES
- Reason: failed current-head checks were mapped to line-specific findings below for
8dc30f8bbd0526a713bc0e3fe5d6199047f3df9f. - Head SHA:
8dc30f8bbd0526a713bc0e3fe5d6199047f3df9f - Workflow run: 29085855269
- Workflow attempt: 1
Failed checks
- Strix Security Scan/strix workflow run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/29085855225)
- strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/29085989047)
Findings
1. HIGH .github/workflows/strix.yml:1 - Current-head Strix evidence is missing because the workflow run was cancelled before logs
Problem: Strix Security Scan reported a current-head workflow_run conclusion of cancelled, but GitHub emitted no failed job log and no Strix Vulnerability Report window.
Root cause: The security gate has no usable Strix evidence for this head SHA. This PR changes trusted Strix workflow or gate inputs, but the cancelled pull_request_target run still used the base branch copies, so current-head edits cannot affect this run.
Fix: Do not invent an application code fix from this cancelled run. Re-run Strix after the trusted base branch contains the workflow/gate change or capture equivalent temporary evidence tied to this head SHA; keep the workflow concurrency line at .github/workflows/strix.yml:1 aligned with the intended queue isolation.
Regression test: Keep failed-check evidence collection explicit for cancelled workflow runs with no job log and cover self-modifying Strix workflow PRs so reviews explain trusted-base execution semantics.
Suggested edit: preserve
.github/workflows/strix.yml:1withcancel-in-progress: false, cancel only superseded non-current-head runs when needed, and rerun current-head Strix until logs exist.
Failed check evidence for line-specific fixes
Failed GitHub Check Evidence
- PR: #278
- Head SHA:
8dc30f8bbd0526a713bc0e3fe5d6199047f3df9f - Repository:
ContextualWisdomLab/.github
Line-specific repair contract
Treat the check logs and annotations below as diagnostic evidence, not as a complete review.
For each actionable failed check, inspect the local source or diff and identify the exact file line that must change.
OpenCode
REQUEST_CHANGESfindings must includepath,line,root_cause,fix_direction,regression_test_direction, andsuggested_diff.Do not request changes with only a GitHub Actions URL or a generic check name.
When Strix logs contain multiple
Vulnerability ReportorModel ... Vulnerabilities ...sections, include every model-reported vulnerability in the review evidence and findings, including model name, title, severity, endpoint, and Code Locations/path:line evidence when present.Create one OpenCode finding per Strix model vulnerability report; do not satisfy two model reports with one combined finding, even when titles or locations match.
Failed check: strix
- Type:
status_context - Conclusion:
FAILURE - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/29085989047
No GitHub Actions job log is available for this status context.
Failed check: Strix Security Scan
- Type:
workflow_run - Conclusion:
cancelled - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/29085855225
- Workflow run id:
29085855225
No GitHub Actions job log is available for this failed workflow run.
The workflow run completed as cancelled before GitHub emitted a failed job log. Treat this as missing current-head security evidence, not as a source-code vulnerability report.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (3 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["CI script (3 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script (3 files)"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (3 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (3 files)"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/opencode-review.yml, .github/workflows/pr-review-autofix.yml, .github/workflows/strix.yml, ci-review-prompt.md, code-reviewer-prompt.md, and 6 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/opencode-review.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: No blocking issues found in current-head evidence.
- Head SHA:
caae0cbfde098d7481d9073c5f7819b196b14c4e - Workflow run: 29086121630
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["CI script (3 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (3 files)"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/opencode-review.yml, .github/workflows/pr-review-autofix.yml, .github/workflows/strix.yml, ci-review-prompt.md, code-reviewer-prompt.md, and 5 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/opencode-review.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: No blocking issues found in current-head evidence.
- Head SHA:
d102480ff714a4742bacdb39d0de31ee7787de07 - Workflow run: 29087495934
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (3 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["CI script (3 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script (3 files)"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/opencode-review.yml, .github/workflows/pr-review-autofix.yml, .github/workflows/strix.yml, ci-review-prompt.md, code-reviewer-prompt.md, and 5 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/opencode-review.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: No blocking issues found in current-head evidence
- Head SHA:
ef26bea14ab7797739b4c93e2dcdf13bf55a4d69 - Workflow run: 29087703651
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (3 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["CI script (3 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script (3 files)"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
Uh oh!
There was an error while loading. Please reload this page.
![pr-auto-rebase[bot]](https://github.laxmiang.work.gd/r/github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Event-driven scheduler runs in target repositories stop retrying once their triggering event is consumed, so a PR that becomes mergeable AFTER its last event (approval published after the scheduler pass, merge-preview checks landing late, a temporary base-branch policy blocker clearing) has no later trigger and accumulates as approved-but-unmerged. Live evidence: bandscope #600/#604/#606/#627, html4tree #139-#148, clearfolio #136-#141, codec-carver #226-#232, appguardrail #278-#283, keyverse #10/#14, gyeot #9/#10, aFIPC #127/#128, nonnest2 #42/#44/#45, naruon #1034. Add an org-queue-sweep job to the central scheduler workflow: - runs hourly (cron 17 * * * *) only in ContextualWisdomLab/.github, or on workflow_dispatch with org_sweep=true; the single-repository scan skips those triggers so nothing double-runs - re-runs the trusted scheduler script against every non-archived org repository through the same guarded merge/update/review contract - requires a cross-repository mutation credential (PR_REVIEW_MERGE_TOKEN, OPENCODE_APPROVE_TOKEN, or the exchanged OpenCode app token) and fails with a visible ::error reason instead of silently no-opping on the repository-scoped github.token - prints each repository's per-PR decision log so every unmerged PR has a concrete logged reason at most one hour old - queue hygiene: cancels workflow runs still queued after ORG_SWEEP_STALE_QUEUE_HOURS (default 24h), logging run id, workflow, head branch, and age, so the Actions queue only holds current-head work Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Fxd76REwJfmQcXCJjLi6Z
…iewer PAT fallback (#451) * feat(scheduler): hourly org-wide approved-PR queue sweep Event-driven scheduler runs in target repositories stop retrying once their triggering event is consumed, so a PR that becomes mergeable AFTER its last event (approval published after the scheduler pass, merge-preview checks landing late, a temporary base-branch policy blocker clearing) has no later trigger and accumulates as approved-but-unmerged. Live evidence: bandscope #600/#604/#606/#627, html4tree #139-#148, clearfolio #136-#141, codec-carver #226-#232, appguardrail #278-#283, keyverse #10/#14, gyeot #9/#10, aFIPC #127/#128, nonnest2 #42/#44/#45, naruon #1034. Add an org-queue-sweep job to the central scheduler workflow: - runs hourly (cron 17 * * * *) only in ContextualWisdomLab/.github, or on workflow_dispatch with org_sweep=true; the single-repository scan skips those triggers so nothing double-runs - re-runs the trusted scheduler script against every non-archived org repository through the same guarded merge/update/review contract - requires a cross-repository mutation credential (PR_REVIEW_MERGE_TOKEN, OPENCODE_APPROVE_TOKEN, or the exchanged OpenCode app token) and fails with a visible ::error reason instead of silently no-opping on the repository-scoped github.token - prints each repository's per-PR decision log so every unmerged PR has a concrete logged reason at most one hour old - queue hygiene: cancels workflow runs still queued after ORG_SWEEP_STALE_QUEUE_HOURS (default 24h), logging run id, workflow, head branch, and age, so the Actions queue only holds current-head work Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Fxd76REwJfmQcXCJjLi6Z * feat(noema-review): NOEMA_REVIEW_TOKEN PAT fallback for the second reviewer The two-reviewer merge rule needs a second approving-review identity beyond OpenCode. Today it only works if the Noema Worker is deployed and NOEMA_TOKEN_EXCHANGE_URL is set, so no PR gets a second review and .github's classic 2-review protection blocks every .github PR. Add a NOEMA_REVIEW_TOKEN secret fallback: when present it is used directly as the reviewer identity and the OIDC app-token exchange is skipped; the review step prefers it over the exchanged app token. The secret is never emitted as a step output. When neither the secret nor the exchange URL is configured, the step still emits the unconfigured notice and skips (green-by-skip), not a failure. noema_review_gate.py already refuses to review as a primary review actor, so the fallback cannot manufacture a fake second review from the github-actions/opencode identity. Pairs with the noema PydanticAI reviewer agent (ContextualWisdomLab/noema#9) that produces the verdict this identity publishes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Fxd76REwJfmQcXCJjLi6Z --------- Co-authored-by: Claude <noreply@anthropic.com>
Summary
Verification