fix: 声明级流程走查修复（4 子代理审计结论落地） - #17
Conversation
…urity 升级归属（ADR-0015 断言 30→35 锁对齐）
|
Warning Review limit reached
Next review available in: 22 minutes Limit details: You’ve used all 3 included reviews currently available. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
Comment |
PR Summary by QodoAlign maintenance and owner-control workflow declarations
AI Description
Diagram
High-Level Assessment
Files changed (7)
|
Code Review by Qodo
1. Disposition conditions match absence
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| "if": {"properties": {"disposition": {"const": "rejected"}}}, | ||
| "then": {"required": ["reason"]} |
There was a problem hiding this comment.
1. Disposition conditions match absence 🐞 Bug ≡ Correctness
Both conditional schemas treat a missing disposition as a match, so an otherwise valid open entry is incorrectly required to contain both reason and defer_condition. This makes the newly declared backlog contract reject entries before producer-gate disposition.
Agent Prompt
## Issue description
The `rejected` and `deferred` JSON Schema conditions also match when `disposition` is absent, causing both conditional fields to become required.
## Issue Context
Under JSON Schema semantics, `properties` validates only properties that are present; it does not require `disposition` to exist. Each `if` must explicitly require the discriminator.
## Fix Focus Areas
- registry/schemas/backlog-entry.json[23-31]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| "evidence": {"type": "string", "description": "指标/证据/期望状态引用（issue 链接或 drift 报告锚点）"}, | ||
| "expected_state_ref": {"type": "string", "description": "期望状态引用（governance/expected-state.json 锚点，drift 类必填）"}, |
There was a problem hiding this comment.
2. Drift reference remains optional 🐞 Bug ≡ Correctness
Entries with source: drift can pass the schema without expected_state_ref, despite both the schema description and issue lifecycle requiring that reference. Such entries lose the expected-state anchor needed to triage and repair drift.
Agent Prompt
## Issue description
The schema describes `expected_state_ref` as mandatory for drift entries but never conditionally requires it.
## Issue Context
Add a discriminator condition for `source: drift`, including `required: [source]`, whose `then` requires `expected_state_ref`.
## Fix Focus Areas
- registry/schemas/backlog-entry.json[16-31]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| "reason": {"type": "string", "description": "disposition=rejected 时的驳回理由（必填）"}, | ||
| "defer_condition": {"type": "string", "description": "disposition=deferred 时的机器可判定条件（必填；到期由 curator 机制扫描重排 top-k）"} |
There was a problem hiding this comment.
3. Empty disposition metadata accepted 🐞 Bug ≡ Correctness
The schema accepts reason: "" for rejected entries and defer_condition: "" for deferred entries because both fields are unconstrained strings. These values satisfy required while violating the lifecycle’s mandatory reason and machine-evaluable deferral condition.
Agent Prompt
## Issue description
Required disposition metadata can currently be empty and still satisfy the schema.
## Issue Context
At minimum, enforce non-empty values with `minLength`; define and validate a structured condition or expression grammar if `defer_condition` must be machine-evaluable.
## Fix Focus Areas
- registry/schemas/backlog-entry.json[18-21]
- registry/schemas/backlog-entry.json[23-31]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| - {path: "standards/flows.yaml#maintain_loop.maintenance_wave.acceptance", op: contains, value: pre_approved} | ||
| - {path: "standards/team-collaboration.yaml#teams.delivery_squad.lifecycle.trigger", op: contains, value: maintenance_wave.trigger} | ||
| - {path: "registry/teams/dev-wave.yaml#lifecycle.trigger", op: contains, value: maintenance_wave.trigger} | ||
| - {path: "standards/team-collaboration.yaml#interfaces.backlog.entry_schema", op: exists} |
There was a problem hiding this comment.
4. Schema assertion checks only scalar 🐞 Bug ☼ Reliability
The new S15 assertion verifies only that entry_schema contains a non-null scalar, not that the referenced file exists or parses as JSON Schema. Deleting, misspelling, or corrupting backlog-entry.json therefore leaves the advertised anti-regression scenario and repository validator green.
Agent Prompt
## Issue description
The regression assertion checks the reference key but never resolves or validates its target.
## Issue Context
Resolve `interfaces.backlog.entry_schema` within the repository, reject escaping or missing paths, parse the target as JSON, and validate it as a Draft 2020-12 schema. Add negative tests for missing and malformed targets.
## Fix Focus Areas
- standards/scenarios.yaml[131-133]
- scripts/simulate-wave.py[167-185]
- scripts/validate.py[75-85]
- tests/test_validate.py[58-63]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
1 participant
4 个子代理并行走查全部流程声明，发现并修复 6 处缺陷：
本地：validate OK / 17 场景全通 / pytest 20 passed