fix(noema): isolate 429 continuation dispatch authority - #2373
seonghobae wants to merge 6 commits into
Conversation
|
Warning Review limit reachedNext included review available in 9 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (6)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
.github/workflows/noema-review.yml— GitHub Actions review jobdocs/adr/0031-noema-transport-capacity-redispatch.md— operator or user guidancescripts/ci/noema_review_gate.py— review and security gate shell pathtests/test_noema_orchestrator_workflow_contract.py— regression suitetests/test_noema_review_gate.py— regression suitetests/test_noema_reviewer_token_lifetime.py— regression suite
Changed behavior
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: noema-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: noema-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Docs: 0031-noema-transport-capacity-redispatch.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: 0031-noema-transport-capacity-redispatch.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script: noema_review_gate.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: noema_review_gate.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test: test_noema_orchestrator_workflow_contract.py (3 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_noema_orchestrator_workflow_contract.py (3 files)"]
R4 --> V4["targeted test run"]
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
8f9720240633f8a1cd39d193489f56057027e46a - Workflow run: 36192948657
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: noema-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: noema-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Docs: 0031-noema-transport-capacity-redispatch.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: 0031-noema-transport-capacity-redispatch.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script: noema_review_gate.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: noema_review_gate.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test: test_noema_orchestrator_workflow_contract.py (3 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_noema_orchestrator_workflow_contract.py (3 files)"]
R4 --> V4["targeted test run"]
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
|
Exact-head admission correction for Current review state includes |
|
Canonical consolidation rationale before branch mutation: #2373 exact head To preserve single-writer ancestry without weakening the stronger implementation, I will ordinary-forward #2373 with a two-parent commit whose first parent is #2373 current head, second parent is this exact head, and tree is byte-identical to #2373 current tree |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head successor-integration review for bf88c9c1c6dacb52f0eb60b1368835a8b1c91a35 (COMMENT, not approval).
The new commit preserves #2373 tree fb27729369c8491f38f53aef7c44b7e98f30e852 byte-for-byte and records #2387 exact head 33b9028318ddd0cf6c34d1816b09b94e95346c10 as its explicit second parent. GitHub compare reports zero changed files from prior #2373 head 8f972024…; #2387 is now an ancestor with no lost delta. The effective protected-main diff remains the six canonical Noema workflow/ADR/gate/test paths, 6 ahead / 0 behind, mergeable, unresolved threads 0.
Fresh exact-head Runtime 36240466170, CodeQL 36240466151, Python Security 36240466337, SAST 36240466238, and Security 36240466139 are queued. The predecessor CHANGES_REQUESTED review predates this exact head and no qualifying exact-head approval exists. This review records ancestry/equivalence only and is not merge authority.
This branch has not been deployed
1 participant
Cause
Noema's post-failure
repository_dispatchselected the independent reviewer App token, whose Contents permission is read-only. The REST endpoint requires Contents write, so a typed capacity failure could terminate at 403 after the same-head check. OriginWeave's #2165 record shows this sequence. This also blocks review recovery relevant to .github#945.Change
GITHUB_TOKENContents write. The job has no checkout, model input, or reviewer credential.Validation
actionlint .github/workflows/noema-review.yml— passed.GITHUB_ACTIONS=true uv run --no-sync python -m pytest tests/test_noema_orchestrator_workflow_contract.py tests/test_noema_review_gate.py tests/test_noema_two_phase_handoff.py tests/test_required_workflow_queue_contract.py -q— 217 passed.GITHUB_ACTIONS=true. Hosted exact-head checks and independent review pending.Related: .github#2165, .github#945. This is the least-privilege alternative to #2372, which grants Contents write to the model-processing review job. Gateway-side 429 cases are tracked in contextual-orchestrator#1249 and #1251; this PR does not change gateway routing or replay ambiguous provider outcomes.