Uh oh!
There was an error while loading. Please reload this page.
feat(coverage): add bounded PyO3 peer-evidence gate - #789
Conversation
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughPyO3/maturin 네이티브 확장 수집 실패 분류기와 안전한 증거 파일 처리를 추가했습니다. 정확한 PR HEAD의 Python·Rust·package CheckRun 성공을 검증하고, 결과를 OpenCode 승인 흐름과 품질 CI에 연결했습니다. ChangesPython 네이티브 확장 peer-gate
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant PythonTest as Python 테스트 실행
participant Classifier as classify-pytest
participant GitHub as GitHub CheckRuns
participant PeerGate as require-checks
participant Approval as OpenCode 승인 흐름
PythonTest->>Classifier: 로그·pyproject 스냅샷·변경 파일 전달
Classifier-->>PythonTest: PASS 또는 DEFERRED 모듈명
Approval->>GitHub: PR HEAD의 CheckRun 조회
GitHub-->>PeerGate: Python·Rust·package CheckRun JSON
PeerGate-->>Approval: exact-head 성공 여부
Approval-->>Approval: peer check 충족 시 승인 진행
Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
commented
Aug 6, 2026
@opencode-agent address Integrate the published PyO3 native-extension helper into the protected central OpenCode coverage/review path on this same branch; keep the PR Draft until the integration is complete and exact-head evidence passes. Mirror the existing fail-closed R peer-evidence pattern rather than creating a second privileged reviewer. Required behavior:
Update the doctoring and CHANGELOG to distinguish source-only measurement, trusted native peer evidence, and remaining interpretation limits. Preserve immutable called-workflow source, reviewer credentials, NVIDIA/OpenCode model policy, independent approval, unresolved-thread, and branch-protection boundaries. |
seonghobae
commented
Aug 6, 2026
@jules Implement the remaining central workflow integration on this existing Draft PR. Preserve the published helper and fail-closed trust boundary; do not create another PR or temporary workflow. Required scope:
Do not build PR-selected native code in the central sandbox, add a compatibility stub, skip product tests, use networked PR execution, change reviewer tokens or NVIDIA/OpenCode policy, weaken approval/protection gates, mark Ready, merge, or release. Commit as normal descendants without force-push, and report exact verification commands and the final head SHA. |
seonghobae
commented
Aug 6, 2026
@jules Implement the remaining integration directly on this branch; do not create any temporary, self-modifying, encoded-patch, or branch-writing workflow. Required GREEN slice:
After integration, rerun OpenCode review for unchanged |
seonghobae
commented
Aug 6, 2026
@jules Integrate the committed helper into the central Required fail-closed flow:
Do not build PR-selected native code inside the central sandbox, introduce a Python stub, auto-approve, weaken required checks, use COPILOT_GITHUB_TOKEN, or disturb the existing reviewer-agent secret contract. Update APA 7 doctoring and the authoritative changelog after GREEN. |
seonghobae
commented
Aug 6, 2026
@coderabbitai Review the current Draft head |
Rate Limit Exceeded
|
seonghobae
commented
Aug 6, 2026
Prepare the next bounded integration only after For the eventual current-main integration:
Keep Draft. Do not mutate the authoritative workflow from the pre-#759 base, approve, or merge. |
seonghobae
commented
Aug 7, 2026
@jules Implement the existing TDD RED workflow contracts on exact live head Precondition: before every write, re-read the live head and stop without mutation unless it is the expected current head or your own direct descendant. Coverage integrationIn Initialize exactly: python_native_peer_check_required=0Only after a Python configured/default pytest/coverage command actually fails:
python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" classify-pytest \
--log "$log_file" \
--pyproject "$project_dir/pyproject.toml" \
--changed-files "$changed_files_file" \
--repo-root "$COVERAGE_SOURCE_WORKDIR"
and set In the compact PASS decision, when the variable is 1, emit exactly: Do not build/install PR-selected native code, add a Python stub, skip tests, or grant network access. Approval integrationMirror—but do not replace—the existing R peer-check pattern. Add independent functions that:
python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" require-checks \
--checks-json "$checks_file" \
--head-sha "$HEAD_SHA" \
--required-check "CI::python" \
--required-check "CI::rust" \
--required-check "CI::package"
Call this gate in both approval paths that already call Permanent tests and verificationMake the current tests GREEN without weakening them: python -m pytest -q \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_nested_project.py \
tests/test_python_native_extension_peer_gate_workflow_contract.pyThen run the permanent Python 3.10/3.14 quality workflow, focused and complete 100% production statement/branch coverage, interrogate 100%, compileall, actionlint, full central tests, security and supply-chain checks. Fix actual failures only. Preserve After GREEN, report the exact final SHA and verification commands in a PR comment. Do not request approval or change Draft state. |
seonghobae
commented
Aug 7, 2026
Exact-head quality run @jules Implement the central workflow integration now rather than weakening these tests. Preserve the existing R peer gate and privileged reviewer chain. After GREEN, run full central coverage/docstrings/actionlint and replay OpenCode review against exact fast-mlsirm heads #546, #549, and #550. |
seonghobae
commented
Aug 7, 2026
@opencode-agent address Fix the exact current-head quality failure on Run
Implement the documented fail-closed flow:
After GREEN, run all 90 focused tests at 100% statement/branch coverage, the complete central suite, interrogate 100%, compileall, actionlint, Python 3.10 compatibility, security workflows, and exact-head review. Keep Draft, |
seonghobae
commented
Aug 7, 2026
@jules Implement the missing production integration on current branch |
seonghobae
commented
Aug 7, 2026
@opencode-agent address Implement the committed workflow-integration RED contract on this Draft branch. Do not weaken the helper or tests. Preserve the existing R peer gate and reviewer credential chain. The central coverage job must capture bounded combined pytest output and status, classify only the exact unchanged maturin/PyO3 module-absence collection failure, then require trusted exact-head After GREEN, run the permanent workflow contracts, full central coverage/docstrings/actionlint/security, then replay exact current heads of fast-mlsirm #546, #549, and #550. |
seonghobae
commented
Aug 7, 2026
@opencode-agent address A new RED trust-boundary contract is committed at |
seonghobae
commented
Aug 7, 2026
@jules Apply and remove the committed one-shot patcher python3 scripts/ci/apply_pyo3_peer_gate_workflow_integration.py
rm scripts/ci/apply_pyo3_peer_gate_workflow_integration.py
python3 -m coverage erase
python3 -m coverage run --branch -m pytest -q \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_nested_project.py \
tests/test_python_native_extension_peer_gate_workflow_contract.py
python3 -m coverage report \
--include=scripts/ci/python_native_extension_peer_gate.py \
--show-missing --fail-under=100
python3 -m pytest -q \
tests/test_opencode_agent_contract.py \
tests/test_repository_branch_coverage_review_schedulers.py
python3 -m compileall -q \
scripts/ci/python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_nested_project.py \
tests/test_python_native_extension_peer_gate_workflow_contract.pyThe reviewed local proof is 91 focused tests and 100% helper statement/branch coverage. The patch also removes the temporary source-snapshot workflow and the duplicate quality workflow. Keep only |
seonghobae
commented
Aug 7, 2026
@opencode-agent address The branch now contains |
seonghobae
commented
Aug 7, 2026
@jules@opencode-agent The implementation patcher remains committed at exact head |
seonghobae
commented
Aug 7, 2026
/oc Complete the current Draft PR by applying the already reviewed permanent integration directly; do not add or retain another one-shot/branch-writer workflow.
Keep Draft until a workflow-free exact head is green. Do not build PR-selected native code in the central sandbox, alter reviewer credentials, weaken branch protection, or introduce |
seonghobae
commented
Aug 7, 2026
@opencode-agent address Exact head
Apply the reviewed integration directly to Preserve the existing R peer gate and reviewer credential chain. The PyO3 classifier is a non-success deferral only. Approval must query live exact-head After direct integration, delete the patcher and temporary workflows, update permanent workflow contracts/doctoring/changelog, run Python 3.10/3.14, complete central tests, 100% production statement/branch coverage, docstrings, compilation, actionlint, security and supply-chain gates on one unchanged head. Keep Draft until GREEN. |
seonghobae
commented
Aug 7, 2026
@opencode-agent address The branch has been reduced to a reviewable permanent-source state at exact head Complete the vertical slice through ordinary reviewed commits only:
Prove the exact |
seonghobae
commented
Aug 7, 2026
@opencode-agent address Integrate the published PyO3 deferral helper into the permanent central workflow on exact current Draft head Required bounded implementation:
Run: python -m coverage erase
python -m coverage run -m pytest -q \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_nested_project.py \
tests/test_python_native_extension_peer_gate_workflow_contract.py
python -m coverage report
pytest -q
python -m interrogate scripts/ci
python -m compileall -q scripts/ci testsThen rerun exact-head CodeQL, Python Security, SAST, Security Scan, Secret Scan, OSV, Scorecard, SBOM, CodeRabbit/OpenCode/Noema. Keep Draft until the complete unchanged head is GREEN and independently approved. |
seonghobae
commented
Aug 7, 2026
Additional current-head hardening before GREEN:
Preserve 100% branch coverage and Python 3.10 compatibility. |
seonghobae
commented
Aug 7, 2026
@opencode-agent address Complete the permanent integration for exact head Wire
Update the permanent workflow contracts, quality workflow path/test/compile coverage for every current helper/test/doctoring file, authoritative doctoring and CHANGELOG. Run Python 3.10 compatibility, Python 3.14 focused and complete tests, 100% production statement/branch/docstrings, actionlint, compilation, all security/supply-chain gates, and keep Draft until the workflow-free exact head succeeds. |
seonghobae
commented
Aug 7, 2026
/opencode Continue directly on The helper tests pass, but the permanent workflow-contract tests correctly fail because the gate has not yet been integrated into
Run the focused helper and workflow-contract suite first, then the complete central quality/coverage/docstring/compile/actionlint/security suite. Commit the minimal integration directly to the current branch. |
seonghobae
commented
Aug 7, 2026
@opencode-agent Complete the missing permanent workflow integration on current Draft head Exact failure evidence: quality run Implement the bounded integration directly in permanent source:
Run the focused 90-test gate, complete central 100% statement/branch coverage, production docstrings, Python 3.10/3.14 compilation, actionlint, and clean-tree verification. Keep Draft; do not approve, merge, tag, release, or publish. |
seonghobae
commented
Aug 7, 2026
/oc Complete the missing permanent workflow integration on exact head Directly integrate the bounded classifier and approval evidence into the permanent review workflow:
Run all five focused peer-gate test files, complete central statement/branch coverage and production docstrings, Python 3.10/3.14 compilation, actionlint, and |
seonghobae
commented
Aug 7, 2026
@opencode-agent address Apply the exact-current-head integration request already specified for |
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
fix/pyo3-native-peer-gatecannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintofix/pyo3-native-peer-gate, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 789 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files># merge path: git commit# rebase path: git rebase --continue
git push origin HEAD:fix/pyo3-native-peer-gate
# rebase path only: git push --force-with-lease origin HEAD:fix/pyo3-native-peer-gate- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (3 files)"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["CI script: python_native_extension_peer_gate.py"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (8 files)"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
31c8d207a5d5cbdde3e0ea98dcd7f50c383b6e4b - Workflow run: 32746726352
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (3 files)"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["CI script: python_native_extension_peer_gate.py"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (8 files)"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
fix/pyo3-native-peer-gatecannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintofix/pyo3-native-peer-gate, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 789 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files># merge path: git commit# rebase path: git rebase --continue
git push origin HEAD:fix/pyo3-native-peer-gate
# rebase path only: git push --force-with-lease origin HEAD:fix/pyo3-native-peer-gate- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (3 files)"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["CI script: python_native_extension_peer_gate.py"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (8 files)"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
31c8d207a5d5cbdde3e0ea98dcd7f50c383b6e4b - Workflow run: 32752464940
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (3 files)"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["CI script: python_native_extension_peer_gate.py"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (8 files)"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
Scheduled review-feedback autofix for this PR head.
|
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
seonghobae
commented
Aug 24, 2026
@opencode-agent review Please publish an independent substantive formal Reviews API verdict for exact current head |
There was a problem hiding this comment.
This head is still a deferral gate, not a maturin/fast_mlsirm._core build. That distinction matters for #1292.
#789 can stop source-only collection errors from looking like ordinary test failures, and it correctly refuses to convert missing evidence into PASS. It does not compile the Rust numeric core, so psychometrics ownership tests that import fast_mlsirm._core remain unable to prove RMSE/recovery on this coverage path.
The body already says exact-head formal approval is still missing and that protected-main SAST/Trivy scanned a synthetic merge, not 3ffde3c5. Those are still merge blockers. Do not close #1292 when/if this merges.
Next action: keep #789 on its own exact-head OpenCode/Strix/required-check path. Open a separate current-main repair for #1292 only if the coverage sandbox must actually build the declared maturin extension; do not stack that build onto this deferral PR or onto #1314.
Sent by Cursor Automation: Fix Issues
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
3ffde3c5d3c98f0c840abcba151af08cf0255b46. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32783789557/job/97611298039)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32783789557/job/97611298039)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (3 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (3 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: python_native_extension_peer_gate.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: python_native_extension_peer_gate.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (8 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (8 files)"]
R5 --> V5["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
3ffde3c5d3c98f0c840abcba151af08cf0255b46. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32783789557/job/97611298039)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32783789557/job/97611298039)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (3 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (3 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: python_native_extension_peer_gate.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: python_native_extension_peer_gate.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (8 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (8 files)"]
R5 --> V5["targeted test run"]
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Scheduled review-feedback autofix for this PR head.
|
Buyer-visible blocker
Central OpenCode coverage can fail before pytest collection in maturin/PyO3 repositories because the source-only sandbox intentionally does not build or import an unchanged compiled extension. Treating that environment limitation as an ordinary source-test failure blocks otherwise valid exact-head review evidence; treating it as success would weaken the gate.
Bounded peer-evidence repair
pyproject.tomlbefore untrusted tests; reject symlinked ancestors, final links, non-regular files, device/inode/path drift, growth, malformed input, and bounded-read overflow.requirements/dependency path, workflow/action files, or any repositorypyproject.toml.docs/requirements/from dependency inputs.DEFERRED, neverPASS.CI::python,CI::rust, andCI::package, with bounded complete GraphQL pagination and rejection of stale, pending, failed, status-only, lookalike, missing, or duplicate contexts.AGENTS.mdorARCHITECTURE.mdpolicy changes, and reject duplicate Unreleased Changelog sibling headings.Current exact-head identity and verification
main@613a33e0cb1c6db9790fae99f6253445712ac37a3ffde3c5d3c98f0c840abcba151af08cf0255b46446be4513dbbcb02b7bf8ce27827614cfbbd7f0d17837a3c…; that merge preserves predecessor owner head31c8d207…and protected main613a33e….Verification
Changedheading both failed the focused contract.test_strix_quick_gate: PASS;git diff --checkclean.3ffde3c…checkout, 100% peer-gate statement/branch coverage, 1,523 full tests plus 16 subtests, 100% owned production statement/branch coverage, docstrings, actionlint, and clean-patch gate.3ffde3c…; merge-preview jobs explicitly analyzed synthetic merge84dd43ed….Security and merge gate
This PR does not skip tests, build PR-selected extensions, enable sandbox network access, introduce a Python substitute for Rust arithmetic, or convert missing evidence into success. It remains non-mergeable under governance until an independent formal approval is recorded on this same SHA. Status/check success and predecessor verdicts are not approval evidence.
Protected-main SAST and Trivy remain a separate known provenance defect: on this current head they scanned synthetic merge
84dd43ed37bb8cb85ae1c76a5360e63b86cf188e, not submitted head3ffde3c…. The canonical owner paths remain #941/#897 and the evidence is tracked in #1222; it is not reclassified as a #789 source vulnerability.After protected integration, a real affected PyO3 consumer must rerun the protected-main path before incident closure.
Summary by CodeRabbit
새 기능
문서
테스트