feat(perf): attest exact product performance evidence - #2166
Open
seonghobae wants to merge 251 commits into
Open
seonghobae wants to merge 251 commits into
seonghobae wants to merge 251 commits into
Conversation
…main-successor # Conflicts: # CHANGELOG.md # organization_commercial_readiness_fixtures.py # scripts/ci/organization_commercial_readiness_loop.py
…jobs, job-scoped age, and incomplete-PR retry
Devin Review flagged four real bugs in scripts/ci/actions_queue_health.py:
- _run_identity compared a run's own head_sha (the checked-out BASE commit
for pull_request_target runs) against the open PR's head_sha, so active
required-workflow runs were wrongly labeled obsolete and their job
evidence was never fetched. Now compares against the linked pull-request
entry's head_sha instead. Fixing this also exposed a related round-trip
bug: _normalise_run only understood the raw GitHub link shape
({"head": {"sha": ...}}), so re-normalising an already-normalised run
loaded from a collected snapshot (as build_report does) silently zeroed
out the very head_sha the fix depends on. _normalise_run now accepts
both shapes.
- _normalise_pull_request accepted head/base objects whose nested
head_sha/base_ref/base_repository/updated_at fields were present but
empty, instead of treating that as an incomplete identity. A transient,
partially populated API response was silently accepted rather than
triggering collect_snapshot's bounded retry.
- _job_state treated GitHub's "waiting" job status (paused on an
environment/deployment approval) as unclassified "unknown" evidence,
dropping it out of pending_job_count and leaving no blocker/action.
It is now "waiting_approval": pending, with its own blocker distinct
from a runner-capacity SLO breach. pending_job_count now derives from
an explicit is_pending field rather than an execution_state string
prefix, so this and any future non-"queued_" pending state stays
counted.
- build_report measured every job's queue age from the parent run's
creation time, so a later job in an already in-progress run (e.g. one
gated by `needs:`) that had only just become eligible inherited the
whole run's age and could trigger a false capacity-breach alert.
_normalise_job now preserves each job's own created_at, and build_report
prefers it, falling back to the run's created_at only for the synthetic
run-level job used when no job evidence was fetched.
Added regression tests for each scenario (unit-level and full
collect_snapshot -> build_report pipeline) and updated the doctoring doc.
100% statement/branch coverage and 100% docstring coverage retained.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KPmJErfkcHer4UVEgrQxUX
…vulnerabilities (#2240) fix(python-security): stop reporting pip-audit transport failures as vulnerabilities
Step-scoped gating left disabled ticks queued for hours under the org concurrent-job ceiling (run 35219385415). Restore the job-level flag gate and count only successful ticks as coalesce liveness evidence. Co-authored-by: Cursor <cursoragent@cursor.com>
fix(ci): skip inert coalesce ticks before runner admission
Successor of stale draft #2212: admit the reviewed repository on current main so the bounded collector can observe mhtml Actions queue evidence. Co-authored-by: Cursor <cursoragent@cursor.com>
…alth-enroll-2212-successor Merged ahead of queued CI: queue-health contract tests 72 passed locally on seonghobae/queue-health-enroll-2212-successor@30a5e73.
Confirm the next schedule tick after the job-level gate restore skipped in 1s and document OPENCODE_REVIEW_COALESCE_ENABLED re-enable criteria. Co-authored-by: Cursor <cursoragent@cursor.com>
…queue-health-enrollment Merged ahead of queued CI: 72 queue-health contract tests passed locally on codex/pg-llm-batch-queue-health-enrollment@b5b1cfc.
Preserve the queued job timing contract after rebasing onto main so queue age uses job eligibility, not the parent run start. Co-authored-by: Cursor <cursoragent@cursor.com>
…terminal-preexecution-failure Merged ahead of queued CI: 74 queue-health tests passed locally on codex/queue-health-terminal-preexecution-failure@4b2c426 (terminal pre-execution + queued job evidence).
Keep the unique product-performance attestation delta and the stacked reusable-workflow identity parent while adopting current main.
seonghobae
marked this pull request as ready for review
September 17, 2026 20:55
Contributor
Author
Ready-for-review evidenceExact head: Three-dot residual (vs stack base #2164 /
|
Contributor
Author
Diagnose #2166 (exact-head) — cancel-noise + real-pending
Cache: |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| method="GET", | ||
| ) | ||
| try: | ||
| with urllib.request.urlopen(request, timeout=timeout_seconds) as response: |
| method="GET", | ||
| ) | ||
| try: | ||
| with urlopen(request, timeout=30) as response: # noqa: S310 - GitHub HTTPS only |
| bash -c 'set -eu | ||
| cd "$1" | ||
| dist_dir="$(mktemp -d)" | ||
| python3 -m maturin build --offline --release -o "$dist_dir" |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
.github/actions/noema-review/two_phase.py— Python module behavior.github/workflows/actions-queue-health.yml— GitHub Actions review job.github/workflows/agent-review-runtime-quality-ci.yml— GitHub Actions review job.github/workflows/codeql-pr.yml— GitHub Actions review job.github/workflows/codeql-scan-dispatch.yml— GitHub Actions review job.github/workflows/noema-review.yml— GitHub Actions review job.github/workflows/opencode-review-coalesce-tick.yml— GitHub Actions review job.github/workflows/opencode-review-dispatch.yml— GitHub Actions review job.github/workflows/opencode-review.yml— GitHub Actions review job.github/workflows/product-performance-attestation-quality.yml— GitHub Actions review job.github/workflows/product-performance-attestation.yml— GitHub Actions review job.github/workflows/python-security.yml— GitHub Actions review job.jules/sentinel.md— repository behaviorCHANGELOG.d/20260913-product-performance-attestation.md— repository behaviorCHANGELOG.d/20260917-codeql-versioned-handler-bootstrap.md— repository behaviorCHANGELOG.d/20260917-coverage-vcs-python-root-helper.md— repository behaviorCHANGELOG.d/20260917-maturin-offline-coverage-build.md— repository behaviorCHANGELOG.md— repository behaviorconfig/actions_queue_health_repositories.json— repository behaviordocs/adr/0025-codeql-required-workflow-dispatch-architecture.md— operator or user guidancedocs/adr/0030-ci-centralization-scope-given-plan-ceiling.md— operator or user guidancedocs/adr/0031-noema-transport-capacity-redispatch.md— operator or user guidancedocs/ci-baseline-20260916.csv— operator or user guidancedocs/ci-baseline-20260916.md— operator or user guidancedocs/doctoring/actions-capacity-root-cause-20260917.md— operator or user guidancedocs/doctoring/actions-queue-24h-remeasurement-20260917.md— operator or user guidancedocs/doctoring/actions-queue-cancelled-before-runner.md— operator or user guidancedocs/doctoring/actions-queue-health.md— operator or user guidancedocs/doctoring/actions-schedule-run-records-20260917.md— operator or user guidancedocs/doctoring/coalesce-tick-inert-runner-queue-20260917.md— operator or user guidancedocs/doctoring/coalesce-tick-post-2242-live-verify-20260917.md— operator or user guidancedocs/doctoring/codeql-ghas-configuration-identity-2133.md— operator or user guidancedocs/doctoring/codeql-versioned-handler-bootstrap-20260912.md— operator or user guidancedocs/doctoring/opencode-vcs-python-source-root.md— operator or user guidancedocs/doctoring/product-performance-attestation.md— operator or user guidancedocs/doctoring/strix-evidence-binding-2159-2168.md— operator or user guidancedocs/product-technical-gap-baseline.md— operator or user guidancerequirements-opencode-review-ci-hashes.txt— repository behaviorrequirements-opencode-review-ci.txt— repository behaviorscripts/ci/actions_queue_health.py— review and security gate shell pathscripts/ci/actions_queue_health_core.py— review and security gate shell pathscripts/ci/agent_mention_router.py— review and security gate shell pathscripts/ci/agent_mention_sweep.py— review and security gate shell pathscripts/ci/codeql_ghas_configuration_identity.py— review and security gate shell pathscripts/ci/materialize_base_rust_dependencies.py— review and security gate shell pathscripts/ci/materialize_product_performance_artifact.py— review and security gate shell pathscripts/ci/noema_review_gate.py— review and security gate shell pathscripts/ci/noema_review_handoff.py— review and security gate shell pathscripts/ci/organization_commercial_readiness_loop.py— review and security gate shell pathscripts/ci/pingora_edge_policy.py— review and security gate shell pathscripts/ci/pr_auto_rebase.py— review and security gate shell pathscripts/ci/pr_review_autofix_context.py— review and security gate shell pathscripts/ci/pr_review_fix_scheduler.py— review and security gate shell pathscripts/ci/pr_review_merge_scheduler_core.py— review and security gate shell pathscripts/ci/reconcile_repository_labels.py— review and security gate shell pathscripts/ci/reconcile_repository_metadata.py— review and security gate shell pathscripts/ci/resolve_opencode_base_vcs_import_root.sh— review and security gate shell pathscripts/ci/review_admission_controller.py— review and security gate shell pathscripts/ci/strix_evidence_binding.py— review and security gate shell pathscripts/ci/strix_quick_gate.sh— review and security gate shell pathscripts/ci/test_strix_quick_gate.sh— review and security gate shell pathscripts/ci/verify_exact_artifact_sbom_handoff.py— review and security gate shell pathscripts/ci/verify_product_performance_evidence.py— review and security gate shell pathtests/test_actions_queue_health.py— regression suitetests/test_actions_queue_health_cancelled_before_runner.py— regression suitetests/test_actions_queue_health_contract.py— regression suitetests/test_actions_queue_health_post_evidence_retry.py— regression suitetests/test_actions_queue_health_queued_job_evidence.py— regression suitetests/test_actions_queue_health_snapshot_consistency.py— regression suitetests/test_actions_queue_health_startup_failure.py— regression suitetests/test_actions_queue_health_terminal_preexecution.py— regression suitetests/test_agent_review_runtime_quality_consolidation.py— regression suitetests/test_codeql_ghas_configuration_identity.py— regression suitetests/test_codeql_pr_workflow_contract.py— regression suitetests/test_codeql_scan_dispatch_workflow_contract.py— regression suitetests/test_materialize_base_rust_dependencies.py— regression suitetests/test_maturin_offline_build_contract.py— regression suitetests/test_noema_orchestrator_workflow_contract.py— regression suitetests/test_noema_review_gate.py— regression suitetests/test_noema_two_phase_handoff.py— regression suitetests/test_opencode_agent_contract.py— regression suitetests/test_opencode_required_verdict_regression.py— regression suitetests/test_opencode_review_coalesce_tick.py— regression suitetests/test_opencode_review_surfaces.py— regression suitetests/test_opencode_vcs_python_source_root_contract.py— regression suitetests/test_organization_commercial_readiness_loop_receipt_contract.py— regression suitetests/test_pr_review_autofix_nvidia_nim_contract.py— regression suitetests/test_pr_review_merge_scheduler.py— regression suitetests/test_product_performance_artifact_materializer.py— regression suitetests/test_product_performance_attestation_contract.py— regression suitetests/test_product_performance_corrupt_stream_errors.py— regression suitetests/test_product_performance_evidence_verifier.py— regression suitetests/test_product_performance_profile_binding.py— regression suitetests/test_product_technical_gap_baseline_repository_identity_contract.py— regression suitetests/test_python_security_pip_audit_failure_classification.py— regression suitetests/test_scheduler_and_codeql_dispatch_runner_image_contract.py— regression suitetests/test_strix_backend_unavailable_after_exempted_finding.py— regression suitetests/test_strix_evidence_binding.py— regression suite
Changed behavior
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Python: two_phase.py"]
S1 --> I1["Python module behavior"]
I1 --> R1["Review risk: Python: two_phase.py"]
R1 --> V1["pytest plus coverage"]
Evidence --> S2["Workflow: actions-queue-health.yml"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow: actions-queue-health.yml"]
R2 --> V2["actionlint plus required checks"]
Evidence --> S3["Workflow: agent-review-runtime-quality-ci.yml"]
S3 --> I3["GitHub Actions review job"]
I3 --> R3["Review risk: Workflow: agent-review-runtime-quality-ci.yml"]
R3 --> V3["actionlint plus required checks"]
Evidence --> S4["Workflow: codeql-pr.yml"]
S4 --> I4["GitHub Actions review job"]
I4 --> R4["Review risk: Workflow: codeql-pr.yml"]
R4 --> V4["actionlint plus required checks"]
Evidence --> S5["Workflow: codeql-scan-dispatch.yml"]
S5 --> I5["GitHub Actions review job"]
I5 --> R5["Review risk: Workflow: codeql-scan-dispatch.yml"]
R5 --> V5["actionlint plus required checks"]
Evidence --> S6["Workflow: noema-review.yml"]
S6 --> I6["GitHub Actions review job"]
I6 --> R6["Review risk: Workflow: noema-review.yml"]
R6 --> V6["actionlint plus required checks"]
Evidence --> S7["Workflow: opencode-review-coalesce-tick.yml"]
S7 --> I7["GitHub Actions review job"]
I7 --> R7["Review risk: Workflow: opencode-review-coalesce-tick.yml"]
R7 --> V7["actionlint plus required checks"]
Evidence --> S8["Workflow: opencode-review-dispatch.yml"]
S8 --> I8["GitHub Actions review job"]
I8 --> R8["Review risk: Workflow: opencode-review-dispatch.yml"]
R8 --> V8["actionlint plus required checks"]
Evidence --> S9["Workflow: opencode-review.yml"]
S9 --> I9["GitHub Actions review job"]
I9 --> R9["Review risk: Workflow: opencode-review.yml"]
R9 --> V9["actionlint plus required checks"]
Evidence --> S10["Workflow: product-performance-attestation-quality.yml"]
S10 --> I10["GitHub Actions review job"]
I10 --> R10["Review risk: Workflow: product-performance-attestation-quality.yml"]
R10 --> V10["actionlint plus required checks"]
Evidence --> S11["Workflow: product-performance-attestation.yml"]
S11 --> I11["GitHub Actions review job"]
I11 --> R11["Review risk: Workflow: product-performance-attestation.yml"]
R11 --> V11["actionlint plus required checks"]
Evidence --> S12["Workflow: python-security.yml"]
S12 --> I12["GitHub Actions review job"]
I12 --> R12["Review risk: Workflow: python-security.yml"]
R12 --> V12["actionlint plus required checks"]
Evidence --> S13["Repository file: sentinel.md"]
S13 --> I13["repository behavior"]
I13 --> R13["Review risk: Repository file: sentinel.md"]
R13 --> V13["required checks"]
Evidence --> S14["Repository file: 20260913-product-performance-attestation.md"]
S14 --> I14["repository behavior"]
I14 --> R14["Review risk: Repository file: 20260913-product-performance-attestation.md"]
R14 --> V14["required checks"]
Evidence --> S15["Repository file: 20260917-codeql-versioned-handler-bootstrap.md"]
S15 --> I15["repository behavior"]
I15 --> R15["Review risk: Repository file: 20260917-codeql-versioned-handler-bootstrap.md"]
R15 --> V15["required checks"]
Evidence --> S16["Repository file: 20260917-coverage-vcs-python-root-helper.md"]
S16 --> I16["repository behavior"]
I16 --> R16["Review risk: Repository file: 20260917-coverage-vcs-python-root-helper.md"]
R16 --> V16["required checks"]
Evidence --> S17["Repository file: 20260917-maturin-offline-coverage-build.md"]
S17 --> I17["repository behavior"]
I17 --> R17["Review risk: Repository file: 20260917-maturin-offline-coverage-build.md"]
R17 --> V17["required checks"]
Evidence --> S18["Repository file: CHANGELOG.md"]
S18 --> I18["repository behavior"]
I18 --> R18["Review risk: Repository file: CHANGELOG.md"]
R18 --> V18["required checks"]
Evidence --> S19["Repository file: actions_queue_health_repositories.json"]
S19 --> I19["repository behavior"]
I19 --> R19["Review risk: Repository file: actions_queue_health_repositories.json"]
R19 --> V19["required checks"]
Evidence --> S20["Docs: 0025-codeql-required-workflow-dispatch-architecture.md (18 files)"]
S20 --> I20["operator or user guidance"]
I20 --> R20["Review risk: Docs: 0025-codeql-required-workflow-dispatch-architecture.md (18 files)"]
R20 --> V20["docs review"]
Evidence --> S21["Repository file: requirements-opencode-review-ci-hashes.txt"]
S21 --> I21["repository behavior"]
I21 --> R21["Review risk: Repository file: requirements-opencode-review-ci-hashes.txt"]
R21 --> V21["required checks"]
Evidence --> S22["Repository file: requirements-opencode-review-ci.txt"]
S22 --> I22["repository behavior"]
I22 --> R22["Review risk: Repository file: requirements-opencode-review-ci.txt"]
R22 --> V22["required checks"]
Evidence --> S23["CI script: actions_queue_health.py"]
S23 --> I23["review and security gate shell path"]
I23 --> R23["Review risk: CI script: actions_queue_health.py"]
R23 --> V23["bash -n plus Strix self-test"]
Evidence --> S24["CI script: actions_queue_health_core.py"]
S24 --> I24["review and security gate shell path"]
I24 --> R24["Review risk: CI script: actions_queue_health_core.py"]
R24 --> V24["bash -n plus Strix self-test"]
Evidence --> S25["CI script: agent_mention_router.py"]
S25 --> I25["review and security gate shell path"]
I25 --> R25["Review risk: CI script: agent_mention_router.py"]
R25 --> V25["bash -n plus Strix self-test"]
Evidence --> S26["CI script: agent_mention_sweep.py"]
S26 --> I26["review and security gate shell path"]
I26 --> R26["Review risk: CI script: agent_mention_sweep.py"]
R26 --> V26["bash -n plus Strix self-test"]
Evidence --> S27["CI script: codeql_ghas_configuration_identity.py"]
S27 --> I27["review and security gate shell path"]
I27 --> R27["Review risk: CI script: codeql_ghas_configuration_identity.py"]
R27 --> V27["bash -n plus Strix self-test"]
Evidence --> S28["CI script: materialize_base_rust_dependencies.py"]
S28 --> I28["review and security gate shell path"]
I28 --> R28["Review risk: CI script: materialize_base_rust_dependencies.py"]
R28 --> V28["bash -n plus Strix self-test"]
Evidence --> S29["CI script: materialize_product_performance_artifact.py"]
S29 --> I29["review and security gate shell path"]
I29 --> R29["Review risk: CI script: materialize_product_performance_artifact.py"]
R29 --> V29["bash -n plus Strix self-test"]
Evidence --> S30["CI script: noema_review_gate.py"]
S30 --> I30["review and security gate shell path"]
I30 --> R30["Review risk: CI script: noema_review_gate.py"]
R30 --> V30["bash -n plus Strix self-test"]
Evidence --> S31["CI script: noema_review_handoff.py"]
S31 --> I31["review and security gate shell path"]
I31 --> R31["Review risk: CI script: noema_review_handoff.py"]
R31 --> V31["bash -n plus Strix self-test"]
Evidence --> S32["CI script: organization_commercial_readiness_loop.py"]
S32 --> I32["review and security gate shell path"]
I32 --> R32["Review risk: CI script: organization_commercial_readiness_loop.py"]
R32 --> V32["bash -n plus Strix self-test"]
Evidence --> S33["CI script: pingora_edge_policy.py"]
S33 --> I33["review and security gate shell path"]
I33 --> R33["Review risk: CI script: pingora_edge_policy.py"]
R33 --> V33["bash -n plus Strix self-test"]
Evidence --> S34["CI script: pr_auto_rebase.py"]
S34 --> I34["review and security gate shell path"]
I34 --> R34["Review risk: CI script: pr_auto_rebase.py"]
R34 --> V34["bash -n plus Strix self-test"]
Evidence --> S35["CI script: pr_review_autofix_context.py"]
S35 --> I35["review and security gate shell path"]
I35 --> R35["Review risk: CI script: pr_review_autofix_context.py"]
R35 --> V35["bash -n plus Strix self-test"]
Evidence --> S36["CI script: pr_review_fix_scheduler.py"]
S36 --> I36["review and security gate shell path"]
I36 --> R36["Review risk: CI script: pr_review_fix_scheduler.py"]
R36 --> V36["bash -n plus Strix self-test"]
Evidence --> S37["CI script: pr_review_merge_scheduler_core.py"]
S37 --> I37["review and security gate shell path"]
I37 --> R37["Review risk: CI script: pr_review_merge_scheduler_core.py"]
R37 --> V37["bash -n plus Strix self-test"]
Evidence --> S38["CI script: reconcile_repository_labels.py"]
S38 --> I38["review and security gate shell path"]
I38 --> R38["Review risk: CI script: reconcile_repository_labels.py"]
R38 --> V38["bash -n plus Strix self-test"]
Evidence --> S39["CI script: reconcile_repository_metadata.py"]
S39 --> I39["review and security gate shell path"]
I39 --> R39["Review risk: CI script: reconcile_repository_metadata.py"]
R39 --> V39["bash -n plus Strix self-test"]
Evidence --> S40["CI script: resolve_opencode_base_vcs_import_root.sh"]
S40 --> I40["review and security gate shell path"]
I40 --> R40["Review risk: CI script: resolve_opencode_base_vcs_import_root.sh"]
R40 --> V40["bash -n plus Strix self-test"]
Evidence --> S41["CI script: review_admission_controller.py"]
S41 --> I41["review and security gate shell path"]
I41 --> R41["Review risk: CI script: review_admission_controller.py"]
R41 --> V41["bash -n plus Strix self-test"]
Evidence --> S42["CI script: strix_evidence_binding.py"]
S42 --> I42["review and security gate shell path"]
I42 --> R42["Review risk: CI script: strix_evidence_binding.py"]
R42 --> V42["bash -n plus Strix self-test"]
Evidence --> S43["CI script: strix_quick_gate.sh"]
S43 --> I43["review and security gate shell path"]
I43 --> R43["Review risk: CI script: strix_quick_gate.sh"]
R43 --> V43["bash -n plus Strix self-test"]
Evidence --> S44["CI script: test_strix_quick_gate.sh"]
S44 --> I44["review and security gate shell path"]
I44 --> R44["Review risk: CI script: test_strix_quick_gate.sh"]
R44 --> V44["bash -n plus Strix self-test"]
Evidence --> S45["CI script: verify_exact_artifact_sbom_handoff.py"]
S45 --> I45["review and security gate shell path"]
I45 --> R45["Review risk: CI script: verify_exact_artifact_sbom_handoff.py"]
R45 --> V45["bash -n plus Strix self-test"]
Evidence --> S46["CI script: verify_product_performance_evidence.py"]
S46 --> I46["review and security gate shell path"]
I46 --> R46["Review risk: CI script: verify_product_performance_evidence.py"]
R46 --> V46["bash -n plus Strix self-test"]
Evidence --> S47["Test: test_actions_queue_health.py (35 files)"]
S47 --> I47["regression suite"]
I47 --> R47["Review risk: Test: test_actions_queue_health.py (35 files)"]
R47 --> V47["targeted test run"]
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
ea49a16ac2953e3df9b31dc345fc08480ff6862e - Workflow run: 35314535856
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Python: two_phase.py"]
S1 --> I1["Python module behavior"]
I1 --> R1["Review risk: Python: two_phase.py"]
R1 --> V1["pytest plus coverage"]
Evidence --> S2["Workflow: actions-queue-health.yml"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow: actions-queue-health.yml"]
R2 --> V2["actionlint plus required checks"]
Evidence --> S3["Workflow: agent-review-runtime-quality-ci.yml"]
S3 --> I3["GitHub Actions review job"]
I3 --> R3["Review risk: Workflow: agent-review-runtime-quality-ci.yml"]
R3 --> V3["actionlint plus required checks"]
Evidence --> S4["Workflow: codeql-pr.yml"]
S4 --> I4["GitHub Actions review job"]
I4 --> R4["Review risk: Workflow: codeql-pr.yml"]
R4 --> V4["actionlint plus required checks"]
Evidence --> S5["Workflow: codeql-scan-dispatch.yml"]
S5 --> I5["GitHub Actions review job"]
I5 --> R5["Review risk: Workflow: codeql-scan-dispatch.yml"]
R5 --> V5["actionlint plus required checks"]
Evidence --> S6["Workflow: noema-review.yml"]
S6 --> I6["GitHub Actions review job"]
I6 --> R6["Review risk: Workflow: noema-review.yml"]
R6 --> V6["actionlint plus required checks"]
Evidence --> S7["Workflow: opencode-review-coalesce-tick.yml"]
S7 --> I7["GitHub Actions review job"]
I7 --> R7["Review risk: Workflow: opencode-review-coalesce-tick.yml"]
R7 --> V7["actionlint plus required checks"]
Evidence --> S8["Workflow: opencode-review-dispatch.yml"]
S8 --> I8["GitHub Actions review job"]
I8 --> R8["Review risk: Workflow: opencode-review-dispatch.yml"]
R8 --> V8["actionlint plus required checks"]
Evidence --> S9["Workflow: opencode-review.yml"]
S9 --> I9["GitHub Actions review job"]
I9 --> R9["Review risk: Workflow: opencode-review.yml"]
R9 --> V9["actionlint plus required checks"]
Evidence --> S10["Workflow: product-performance-attestation-quality.yml"]
S10 --> I10["GitHub Actions review job"]
I10 --> R10["Review risk: Workflow: product-performance-attestation-quality.yml"]
R10 --> V10["actionlint plus required checks"]
Evidence --> S11["Workflow: product-performance-attestation.yml"]
S11 --> I11["GitHub Actions review job"]
I11 --> R11["Review risk: Workflow: product-performance-attestation.yml"]
R11 --> V11["actionlint plus required checks"]
Evidence --> S12["Workflow: python-security.yml"]
S12 --> I12["GitHub Actions review job"]
I12 --> R12["Review risk: Workflow: python-security.yml"]
R12 --> V12["actionlint plus required checks"]
Evidence --> S13["Repository file: sentinel.md"]
S13 --> I13["repository behavior"]
I13 --> R13["Review risk: Repository file: sentinel.md"]
R13 --> V13["required checks"]
Evidence --> S14["Repository file: 20260913-product-performance-attestation.md"]
S14 --> I14["repository behavior"]
I14 --> R14["Review risk: Repository file: 20260913-product-performance-attestation.md"]
R14 --> V14["required checks"]
Evidence --> S15["Repository file: 20260917-codeql-versioned-handler-bootstrap.md"]
S15 --> I15["repository behavior"]
I15 --> R15["Review risk: Repository file: 20260917-codeql-versioned-handler-bootstrap.md"]
R15 --> V15["required checks"]
Evidence --> S16["Repository file: 20260917-coverage-vcs-python-root-helper.md"]
S16 --> I16["repository behavior"]
I16 --> R16["Review risk: Repository file: 20260917-coverage-vcs-python-root-helper.md"]
R16 --> V16["required checks"]
Evidence --> S17["Repository file: 20260917-maturin-offline-coverage-build.md"]
S17 --> I17["repository behavior"]
I17 --> R17["Review risk: Repository file: 20260917-maturin-offline-coverage-build.md"]
R17 --> V17["required checks"]
Evidence --> S18["Repository file: CHANGELOG.md"]
S18 --> I18["repository behavior"]
I18 --> R18["Review risk: Repository file: CHANGELOG.md"]
R18 --> V18["required checks"]
Evidence --> S19["Repository file: actions_queue_health_repositories.json"]
S19 --> I19["repository behavior"]
I19 --> R19["Review risk: Repository file: actions_queue_health_repositories.json"]
R19 --> V19["required checks"]
Evidence --> S20["Docs: 0025-codeql-required-workflow-dispatch-architecture.md (18 files)"]
S20 --> I20["operator or user guidance"]
I20 --> R20["Review risk: Docs: 0025-codeql-required-workflow-dispatch-architecture.md (18 files)"]
R20 --> V20["docs review"]
Evidence --> S21["Repository file: requirements-opencode-review-ci-hashes.txt"]
S21 --> I21["repository behavior"]
I21 --> R21["Review risk: Repository file: requirements-opencode-review-ci-hashes.txt"]
R21 --> V21["required checks"]
Evidence --> S22["Repository file: requirements-opencode-review-ci.txt"]
S22 --> I22["repository behavior"]
I22 --> R22["Review risk: Repository file: requirements-opencode-review-ci.txt"]
R22 --> V22["required checks"]
Evidence --> S23["CI script: actions_queue_health.py"]
S23 --> I23["review and security gate shell path"]
I23 --> R23["Review risk: CI script: actions_queue_health.py"]
R23 --> V23["bash -n plus Strix self-test"]
Evidence --> S24["CI script: actions_queue_health_core.py"]
S24 --> I24["review and security gate shell path"]
I24 --> R24["Review risk: CI script: actions_queue_health_core.py"]
R24 --> V24["bash -n plus Strix self-test"]
Evidence --> S25["CI script: agent_mention_router.py"]
S25 --> I25["review and security gate shell path"]
I25 --> R25["Review risk: CI script: agent_mention_router.py"]
R25 --> V25["bash -n plus Strix self-test"]
Evidence --> S26["CI script: agent_mention_sweep.py"]
S26 --> I26["review and security gate shell path"]
I26 --> R26["Review risk: CI script: agent_mention_sweep.py"]
R26 --> V26["bash -n plus Strix self-test"]
Evidence --> S27["CI script: codeql_ghas_configuration_identity.py"]
S27 --> I27["review and security gate shell path"]
I27 --> R27["Review risk: CI script: codeql_ghas_configuration_identity.py"]
R27 --> V27["bash -n plus Strix self-test"]
Evidence --> S28["CI script: materialize_base_rust_dependencies.py"]
S28 --> I28["review and security gate shell path"]
I28 --> R28["Review risk: CI script: materialize_base_rust_dependencies.py"]
R28 --> V28["bash -n plus Strix self-test"]
Evidence --> S29["CI script: materialize_product_performance_artifact.py"]
S29 --> I29["review and security gate shell path"]
I29 --> R29["Review risk: CI script: materialize_product_performance_artifact.py"]
R29 --> V29["bash -n plus Strix self-test"]
Evidence --> S30["CI script: noema_review_gate.py"]
S30 --> I30["review and security gate shell path"]
I30 --> R30["Review risk: CI script: noema_review_gate.py"]
R30 --> V30["bash -n plus Strix self-test"]
Evidence --> S31["CI script: noema_review_handoff.py"]
S31 --> I31["review and security gate shell path"]
I31 --> R31["Review risk: CI script: noema_review_handoff.py"]
R31 --> V31["bash -n plus Strix self-test"]
Evidence --> S32["CI script: organization_commercial_readiness_loop.py"]
S32 --> I32["review and security gate shell path"]
I32 --> R32["Review risk: CI script: organization_commercial_readiness_loop.py"]
R32 --> V32["bash -n plus Strix self-test"]
Evidence --> S33["CI script: pingora_edge_policy.py"]
S33 --> I33["review and security gate shell path"]
I33 --> R33["Review risk: CI script: pingora_edge_policy.py"]
R33 --> V33["bash -n plus Strix self-test"]
Evidence --> S34["CI script: pr_auto_rebase.py"]
S34 --> I34["review and security gate shell path"]
I34 --> R34["Review risk: CI script: pr_auto_rebase.py"]
R34 --> V34["bash -n plus Strix self-test"]
Evidence --> S35["CI script: pr_review_autofix_context.py"]
S35 --> I35["review and security gate shell path"]
I35 --> R35["Review risk: CI script: pr_review_autofix_context.py"]
R35 --> V35["bash -n plus Strix self-test"]
Evidence --> S36["CI script: pr_review_fix_scheduler.py"]
S36 --> I36["review and security gate shell path"]
I36 --> R36["Review risk: CI script: pr_review_fix_scheduler.py"]
R36 --> V36["bash -n plus Strix self-test"]
Evidence --> S37["CI script: pr_review_merge_scheduler_core.py"]
S37 --> I37["review and security gate shell path"]
I37 --> R37["Review risk: CI script: pr_review_merge_scheduler_core.py"]
R37 --> V37["bash -n plus Strix self-test"]
Evidence --> S38["CI script: reconcile_repository_labels.py"]
S38 --> I38["review and security gate shell path"]
I38 --> R38["Review risk: CI script: reconcile_repository_labels.py"]
R38 --> V38["bash -n plus Strix self-test"]
Evidence --> S39["CI script: reconcile_repository_metadata.py"]
S39 --> I39["review and security gate shell path"]
I39 --> R39["Review risk: CI script: reconcile_repository_metadata.py"]
R39 --> V39["bash -n plus Strix self-test"]
Evidence --> S40["CI script: resolve_opencode_base_vcs_import_root.sh"]
S40 --> I40["review and security gate shell path"]
I40 --> R40["Review risk: CI script: resolve_opencode_base_vcs_import_root.sh"]
R40 --> V40["bash -n plus Strix self-test"]
Evidence --> S41["CI script: review_admission_controller.py"]
S41 --> I41["review and security gate shell path"]
I41 --> R41["Review risk: CI script: review_admission_controller.py"]
R41 --> V41["bash -n plus Strix self-test"]
Evidence --> S42["CI script: strix_evidence_binding.py"]
S42 --> I42["review and security gate shell path"]
I42 --> R42["Review risk: CI script: strix_evidence_binding.py"]
R42 --> V42["bash -n plus Strix self-test"]
Evidence --> S43["CI script: strix_quick_gate.sh"]
S43 --> I43["review and security gate shell path"]
I43 --> R43["Review risk: CI script: strix_quick_gate.sh"]
R43 --> V43["bash -n plus Strix self-test"]
Evidence --> S44["CI script: test_strix_quick_gate.sh"]
S44 --> I44["review and security gate shell path"]
I44 --> R44["Review risk: CI script: test_strix_quick_gate.sh"]
R44 --> V44["bash -n plus Strix self-test"]
Evidence --> S45["CI script: verify_exact_artifact_sbom_handoff.py"]
S45 --> I45["review and security gate shell path"]
I45 --> R45["Review risk: CI script: verify_exact_artifact_sbom_handoff.py"]
R45 --> V45["bash -n plus Strix self-test"]
Evidence --> S46["CI script: verify_product_performance_evidence.py"]
S46 --> I46["review and security gate shell path"]
I46 --> R46["Review risk: CI script: verify_product_performance_evidence.py"]
R46 --> V46["bash -n plus Strix self-test"]
Evidence --> S47["Test: test_actions_queue_health.py (35 files)"]
S47 --> I47["regression suite"]
I47 --> R47["Review risk: Test: test_actions_queue_health.py (35 files)"]
R47 --> V47["targeted test run"]
Contributor
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
seonghobae
added
enhancement
ChatGPT Codex Connector
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
Implements the organization-owned authenticated performance-evidence boundary tracked by #2162. This PR remains intentionally stacked on #2164 because performance attestation must inherit the repaired reusable-workflow source identity rather than repeat the cross-repository
github.workflow_shadefect.Current authority
ea49a16ac2953e3df9b31dc345fc08480ff6862e.main:64aa08d7fa487deacd41c761c36277ca68cab6c9.merge(main)sync (ea49a16ac); behind 0 / ahead 61 vs current main; no force push.origin/main...HEAD): product-performance attestation workflows/scripts/tests/docs plus stacked fix(attestation): bind reusable workflow source to OIDC identity #2164 exact-artifact identity delta — none of the product-performance paths exist on main.Trust boundary
The reusable workflow authenticates the caller repository/source SHA and same-run artifact ID/name/digest, then materializes exactly three inert regular files and independently re-hashes the declared result/runtime/fixture bytes. Product code is never executed inside the signer. Both the uncredentialed verifier and credentialed signer independently resolve the called reusable-workflow identity from GitHub OIDC
job_workflow_ref+job_workflow_sha(not callergithub.workflow_sha), bind callerperformance_profileto sealedselected_profile, and bind attestedsource_shato sealedcandidate_sha.