fix(noema): authorize exact-head 429 continuation dispatch - #2372
seonghobae wants to merge 2 commits into
Conversation
|
Warning Review limit reachedNext included review available in 51 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Planned supersession by #2373 (not closing yet). Line-level comparison against This PR will be closed with that evidence only after #2373 passes current-head required checks and receives a GitHub-recognised non-author approval. Until then it stays open; no rerun or cancel is requested. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
.github/workflows/noema-review.yml— GitHub Actions review jobscripts/ci/noema_review_gate.py— review and security gate shell pathtests/test_noema_orchestrator_workflow_contract.py— regression suitetests/test_noema_review_gate.py— regression suite
Changed behavior
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: noema-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: noema-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script: noema_review_gate.py"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script: noema_review_gate.py"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test: test_noema_orchestrator_workflow_contract.py (2 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_noema_orchestrator_workflow_contract.py (2 files)"]
R3 --> V3["targeted test run"]
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
40e1a6b4b956703f8f246d062c847210dde60bd3 - Workflow run: 36191814438
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: noema-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: noema-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script: noema_review_gate.py"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script: noema_review_gate.py"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test: test_noema_orchestrator_workflow_contract.py (2 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_noema_orchestrator_workflow_contract.py (2 files)"]
R3 --> V3["targeted test run"]
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
This branch has not been deployed
1 participant
Failure and fix
A Noema run exhausted provider capacity after trying distinct free-pool candidates, then its same-head continuation failed with
Resource not accessible by integration (HTTP 403)atPOST /repos/.../dispatches(run 36026163711). The re-dispatch step preferred a read-scoped reviewer credential. Its job also requested onlycontents: read, while GitHub requires Contents write for repository dispatch.The trusted Noema job now requests Contents write and uses its repository-scoped
github.tokenonly for re-dispatch. Reviewer credentials still handle model context and verdict publication. The existing exact-live-head check remains.The retry counter previously treated malformed or oversized values as zero, replenishing its own two-attempt budget. Invalid values now exhaust that budget. The workflow preserves the supplied JSON type so empty and nonnumeric values cannot be silently converted to zero before validation. An absent initial counter remains zero.
Gateway candidate selection is tracked separately in contextual-orchestrator #1249 and #1251. This PR repairs the Noema continuation authority and counter integrity; it does not claim a hosted retry or independent approval yet.
Validation
uv run --no-sync python -m pytest tests/test_noema_review_gate.py tests/test_noema_two_phase_handoff.py tests/test_noema_orchestrator_workflow_contract.py tests/test_required_workflow_queue_contract.py -q: 222 passedGITHUB_ACTIONS=true uv run --no-sync python -m pytest tests/test_noema_review_gate.py tests/test_noema_two_phase_handoff.py tests/test_noema_orchestrator_workflow_contract.py -q: 152 passedactionlint .github/workflows/noema-review.yml: passedgit diff --check: passedProtected merge still requires terminal checks and an independent current-head Noema or OpenCode approval.