[sehtej-coderabbit]

Summary

Moves the CodeRabbit configuration from .coderabbit.yaml to .coderabbit.config.ts so that it can depend on the pull request author, and uses that to stop CodeRabbit from blocking core contributors' pull requests.

For a pull request whose author is a member of the SPACE core-contributor GitHub team (CORE_CONTRIBUTOR_TEAMS in the file), reviews.auto_approvals.enabled is false: CodeRabbit still reviews and comments, but it neither submits a "changes requested" review nor approves automatically, so a person decides. For every other author the value stays true, as it is today: CodeRabbit requests changes on actionable findings and approves once they are resolved. auto_approvals.enabled is the only switch CodeRabbit has for the request-changes review (the older request_changes_workflow key is an alias of it), and the team overrides under auto_approvals.overrides only withhold approval, so the team check has to happen in the configuration itself, which a YAML file cannot do. When CodeRabbit cannot resolve the author's teams, or when there is no pull request (an issue event or a chat command), the author is treated as not a core contributor and the workflow stays on; a request-changes review posted during such a lapse stays until a maintainer dismisses it.

Every other setting, string, and comment is carried over unchanged. The YAML | blocks are written with a small text template tag that reproduces their exact value, and the &test_instructions anchor becomes a shared constant. CodeRabbit evaluates the file itself, so nothing is added to any package.json; the @coderabbitai/config import only supplies types.

ci/scripts/lib/rust-isolated-crates.sh lists the configuration file among the root files the isolated-crates lint knows it never reads; the entry follows the rename, so a change to the file keeps linting only the affected crates instead of every crate.

Validation

• tsc --noEmit (strict) on .coderabbit.config.ts with @coderabbitai/config@1.2.0 installed passes. The SDK's strict schema type rejects unknown keys and invalid enum values.
• The factory was evaluated with Node under eleven synthetic contexts: author in the core team (three spellings and team combinations), author in another team only, author in a team with a similar slug, resolved with no teams, lookups reporting unavailable, unsupported, and stale, no pull request, and a local CLI invocation. In every case the result deep-equals the object js-yaml parses from the deleted .coderabbit.yaml (132 keys, byte-for-byte string equality), except reviews.auto_approvals.enabled, which is false only for the core-team cases. Every result also validates against https://coderabbit.ai/integrations/schema.v2.json.
• coderabbit review --uncommitted ran on this change (the CLI evaluates the TypeScript configuration too).
• Not validated: the team slug. CORE_CONTRIBUTOR_TEAMS names perplexityai/space, which the author cannot see from outside the organization; a maintainer should confirm it and that the team is visible to the CodeRabbit GitHub App. Also not validated: the live team lookup. @coderabbitai configuration on this pull request shows the resolved values, and its author is not on the team, so it shows auto_approvals.enabled: true; a core contributor's pull request after merge shows false.

Severity and risk

Severity: does not apply.

Risk: pull requests from core contributors no longer receive CodeRabbit's approval either, since the same switch controls both; branch rules that counted on that approval need a person instead. Request-changes reviews CodeRabbit already submitted on open pull requests stay until dismissed. If the team slug is wrong or the team is not visible to the CodeRabbit GitHub App, every author is treated as a non-member and behavior is unchanged from today. If CodeRabbit fails to evaluate the file, it reports the error on the pull request and reviews fall back to the web settings until fixed. Roll back by reverting this commit; .coderabbit.yaml takes precedence over the TypeScript file as soon as it exists again.

AI assistance: Claude Code drafted the TypeScript file from the YAML, the validation harness, and this description.

🤖 Generated with Claude Code

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

Thanks for opening this pull request! A SPACE maintainer will take a look.

CONTRIBUTING.md explains how we review outside contributions.

[coderabbitai]

Automatic approval withheld

Automatic approval is disabled by the configured approval policy for this pull request. Review comments and requests for changes continue normally.

Commit: 2a99150ec9ed.

No actionable comments were generated in the recent review.

Walkthrough

The repository replaces .coderabbit.yaml with .coderabbit.config.ts, which returns configuration from a factory. The factory checks resolved pull-request author groups and applies automatic approval settings based on a case-insensitive match to the core contributor team. The new configuration also defines review guidance, merge-risk rules, pre-merge checks, tool settings, and knowledge-base scopes. The isolated Rust lint path classification now refers to .coderabbit.config.ts.

Possibly related PRs

• perplexityai/SPACE#1428: Adds the YAML configuration that this pull request replaces.
• perplexityai/SPACE#1680: Changes the automatic approval setting that this pull request makes conditional on contributor group membership.
• perplexityai/SPACE#1436: Updates merge-risk criteria and approval path overrides that this pull request carries into the TypeScript configuration.

Merge Risk: Minimal · up to 2a991

This moves the CodeRabbit configuration to TypeScript and turns off automatic approvals for the core-contributor team. No concrete defect was found. A maintainer should still confirm the team slug and that the CodeRabbit app can see the team, because the author did not validate either.

Security architecture risk: Low · up to 2a991

The change deliberately makes automated review non-blocking for resolved core contributors. Uncertain membership retains the previous behavior, and sensitive-path approval restrictions remain configured. No new exploitable bypass was established, but effective protection depends on external team-resolution and repository approval rules that could not be verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The direct security impact is repository-wide review-policy enforcement for core-authored pull requests, including changes that trigger security-oriented pre-merge checks. The factory changes bot review authority rather than granting authors a new credential or expanding the existing workflow token’s permissions.

Trust Boundaries and Controls

• inferred — The new policy boundary trusts the evaluator’s resolved author-group data, then applies an exact team-path comparison. No inspected source path populates that context from contributor text. This supports the intended restriction, but authenticated membership provenance and the trusted configuration revision remain external assumptions rather than verified guarantees.

Resilience and Maintainability Implications

• observed — The unchanged reset workflow serializes relevant runs per pull request without cancelling an active run, attempts every selected dismissal, and reports failure if any dismissal fails. It does not transact with concurrent bot approvals: partial failure can leave approvals, while a race can dismiss a fresh approval. These pre-existing behaviors are not established as worsened by the new core-team exemption.

Hardening Proposals

• proposed — Validate the effective policy against repository and organization approval rules, and confirm the evaluator’s authoritative author-group provenance and configuration revision. This would establish whether the intended human-review handoff is enforced; it is not evidence of an observed bypass.

Pre-merge checks: 6

Check name	Status	Explanation
Title check		The title does not follow the required format. It starts with "coderabbit:", which is a lowercase area followed by a colon, so the prefix is valid. The summary after the colon starts with the lowercas…
Description Follows The Pr Template		The description includes all four required items: Summary, Validation, Severity and risk, and an AI assistance line. Each has content.
Bug Fixes Name A Regression Test		The PR changes CodeRabbit configuration and CI path classification. It does not fix application behavior under crates/, shim/, or ui/.
Weakened Safeguards Are Justified		The description explains why core contributors' reviews no longer block merges. It also explains why the renamed configuration is excluded from isolated Rust lint selection. The diff does not change a…
Agent Tooling Runs No New Commands		The diff does not change an agent plugin manifest, skill, or guideline file. The CI script change only updates a path classification. The CodeRabbit configuration does not add a command or server entr…
Public-Safe Content		The diff, title, and description do not contain content that matches the check’s failure conditions. The workstation paths in the configuration are placeholders.

Full details: Title check

Explanation

The title does not follow the required format. It starts with "coderabbit:", which is a lowercase area followed by a colon, so the prefix is valid. The summary after the colon starts with the lowercase word "move", and it has no trailing period, ticket ID, or internal link. The title is also related to the changeset: the change moves the review config from YAML to TypeScript and adds a team-based switch that disables auto-approvals and request-changes reviews for core contributors. The title covers the main change, though it does not name the team-based switch in detail.

Full details: Weakened Safeguards Are Justified

Explanation

The description explains why core contributors' reviews no longer block merges. It also explains why the renamed configuration is excluded from isolated Rust lint selection. The diff does not change any listed review-guidance file.

Full details: Agent Tooling Runs No New Commands

Explanation

The diff does not change an agent plugin manifest, skill, or guideline file. The CI script change only updates a path classification. The CodeRabbit configuration does not add a command or server entry to the agent tooling.

Recent review info

Automatic approval policy

Commit: 2a99150ec9ed.

Setting	Effective value	Source
Automatic approvals	Disabled	Override 1, Override 3
Merge risk	Moderate	Global configuration
Security risk	Not set	Global configuration

Matching overrides (numbered as in the resolved configuration):

• Override 1 — any author; paths: .coderabbit.yaml, .coderabbit.yml, coderabbit.yaml, coderabbit.yml, .coderabbit.config.ts; automatic approvals: disabled.
• Override 3 — any author; paths: .coderabbit.yaml, .coderabbit.yml, coderabbit.yaml, coderabbit.yml, .coderabbit.config.ts, .claude/settings*.json, **/.mcp.json, **/hooks.json, .agents/plugins/**/hooks/**, .agents/plugins/**/scripts/**, .agents/plugins/**/commands/**, .agents/plugins/**/agents/**, **/skills/**/hooks/**, **/skills/**/scripts/**, **/skills/**/commands/**, **/skills/**/agents/**, .claude/commands/**, .claude/agents/**, **/marketplace.json, .github/**, ci/**, !ci/scripts/setup-nextest-*.sh, scripts/source_guards/**, scripts/check*, clippy.toml, deny.toml, .gitleaks.toml, .pre-commit-config.yaml, lefthook.yaml, rust-toolchain.toml, .cargo/**, supply-chain/**, pyproject.toml, uv.lock, **/package.json, **/package-lock.json, **/go.mod, **/go.sum, **/requirements*.txt, **/requirements*.in, proto/**, db/**, docs/versioning.md, crates/l40_api/api/src/auth.rs, crates/l40_api/api/src/auth/**, crates/l40_api/api/src/middleware/auth*, crates/l40_api/api/src/middleware/auth/**, crates/l40_api/api/src/routes/authz.rs, crates/l10_foundation/bearer/**, crates/l10_foundation/rustls/**, crates/l10_foundation/guest/**, crates/l10_foundation/pii/**, shim/**, docker/**, !docker/Dockerfile.rust-build-kind, templates/**, infra/space/aws/**, infra/space/cluster/**, infra/space/identity/**, infra/space/observability/**, infra/space/packer/**, infra/space/kind/charts/**, LICENSE, SECURITY.md; automatic approvals: disabled.

Any matching disabled override withholds approval, regardless of risk. Otherwise, the strictest explicitly set limit wins for each score. Limits omitted by all matching overrides inherit the global configuration.

Not set means no limit was configured after inheritance. Use @coderabbitai configuration to inspect the resolved settings and their sources.

Run configuration

• Source mode: Auto
• Repository: perplexityai/SPACE
• Branch: main
• File: .coderabbit.yaml
• Commit: 2f19d5f
• Layers: Repository YAML; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Enterprise
• Run ID: eafdc711-66c7-435e-bef8-b2b6d119c254

Commits

Reviewing files that changed from the base of the PR and between 2f19d5f and 2a99150.

Files selected for processing: 3

• .coderabbit.config.ts
• .coderabbit.yaml
• ci/scripts/lib/rust-isolated-crates.sh

Files with no reviewable changes: 1

• .coderabbit.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.