fix: bind Noema App slug to review identity

.github/workflows/noema-review.yml

@@ -304,6 +304,8 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token }}
           NOEMA_REVIEW_TOKEN_SOURCE: ${{ steps.noema_credential.outputs.source == 'pat' && 'noema-review-pat' || steps.noema_credential.outputs.source == 'github-app' && 'noema-review-github-app' || 'noema-review-app-oidc' }}
+          NOEMA_REVIEW_ACTOR: ${{ steps.noema_github_app_token.outputs['app-slug'] && format('{0}[bot]', steps.noema_github_app_token.outputs['app-slug']) || '' }}
+          NOEMA_REVIEW_INSTALLATION_ID: ${{ steps.noema_github_app_token.outputs['installation-id'] }}
         run: |
           set -euo pipefail
           if [ -z "${PR_NUMBER:-}" ]; then

docs/doctoring/noema-orchestrator-free-zdr.md

@@ -74,3 +74,7 @@ Noema reviews each current head without waiting for an OpenCode approval,
 review-thread resolution, or other check conclusions. All trigger types share
 one repository-and-PR concurrency key, and the reviewer fails closed when its
 identity or substantive LLM summary cannot be verified.
+
+Runtime acceptance requires a GitHub review whose commit and embedded head SHA
+both match the live PR head. A successful Actions job without that review body
+is not Noema review evidence.

scripts/ci/noema_review_gate.py

@@ -23,6 +23,7 @@
     "opencode-agent[bot]",
     "opencode-agent",
 }
+GITHUB_APP_BOT_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\[bot\]$")
 MAX_DIFF_CHARS = 60000
 MAX_CONTEXT_FILES = 12
 MAX_FILE_CONTEXT_CHARS = 4000
@@ -190,6 +191,16 @@ def existing_noema_review(pr: dict[str, Any], actor: str) -> bool:
 
 def current_actor() -> str:
     """Return the verified user or GitHub App bot login for the active token."""
+    action_actor = os.environ.get("NOEMA_REVIEW_ACTOR", "").strip()
+    installation_id = os.environ.get("NOEMA_REVIEW_INSTALLATION_ID", "").strip()
+    if action_actor or installation_id:
+        if (
+            os.environ.get("NOEMA_REVIEW_TOKEN_SOURCE") != "noema-review-github-app"
+            or not GITHUB_APP_BOT_RE.fullmatch(action_actor)
+            or not installation_id.isdigit()
+        ):
+            raise RuntimeError("Noema GitHub App identity binding is invalid")
+        return action_actor
     for args, suffix in (
         (["gh", "api", "user", "--jq", ".login"], ""),
         (["gh", "api", "/installation", "--jq", ".app_slug"], "[bot]"),

scripts/ci/noema_review_handoff.py

@@ -32,6 +32,8 @@
 MAX_TRANSIENT_BACKOFF_MULTIPLIER = 4
 NOEMA_REVIEW_AUTHOR = "cwl-noema-review[bot]"
 NOEMA_REVIEW_MARKER = "<!-- noema-review-gate "
+NOEMA_MARKER_HEAD_RE = re.compile(r"<!-- noema-review-gate head_sha=([0-9a-fA-F]{40}) decision=[a-z_]+ -->")
+NOEMA_BODY_HEAD_RE = re.compile(r"Head SHA:\s*`([0-9a-fA-F]{40})`")
 TERMINAL_NOEMA_STATES = {"APPROVED", "CHANGES_REQUESTED", "COMMENTED"}
 
 
@@ -103,6 +105,13 @@ def noema_review_state(reviews: list[dict[str, Any]], head_sha: str) -> str | No
             continue
         if NOEMA_REVIEW_MARKER not in str(review.get("body") or ""):
             continue
+        body = str(review.get("body") or "")
+        marker_heads = NOEMA_MARKER_HEAD_RE.findall(body)
+        body_heads = NOEMA_BODY_HEAD_RE.findall(body)
+        if len(marker_heads) != 1 or len(body_heads) != 1:
+            continue
+        if marker_heads[0].lower() != head_sha.lower() or body_heads[0].lower() != head_sha.lower():
+            continue
         state = str(review.get("state") or "").upper()
         if state in TERMINAL_NOEMA_STATES:
             return state

tests/test_noema_review_gate.py

@@ -114,6 +114,15 @@ def test_existing_noema_review_matches_actor_and_head():
 
 
 def test_current_actor_fetch_diff_and_json_extraction(monkeypatch):
+    monkeypatch.setenv("NOEMA_REVIEW_ACTOR", "cwl-noema-review[bot]")
+    monkeypatch.setenv("NOEMA_REVIEW_INSTALLATION_ID", "123")
+    monkeypatch.setenv("NOEMA_REVIEW_TOKEN_SOURCE", "noema-review-github-app")
+    monkeypatch.setattr(noema, "run", lambda *args, **kwargs: (_ for _ in ()).throw(AssertionError("API not needed")))
+    assert noema.current_actor() == "cwl-noema-review[bot]"
+
+    monkeypatch.delenv("NOEMA_REVIEW_ACTOR")
+    monkeypatch.delenv("NOEMA_REVIEW_INSTALLATION_ID")
+    monkeypatch.delenv("NOEMA_REVIEW_TOKEN_SOURCE")
     monkeypatch.setattr(noema, "run", lambda *args, **kwargs: "noema\n")
     assert noema.current_actor() == "noema"
     monkeypatch.setattr(noema, "run", lambda *args, **kwargs: (_ for _ in ()).throw(RuntimeError("no gh")))
@@ -138,6 +147,22 @@ def app_identity(args, **kwargs):
         noema.extract_json_object("not-json")
 
 
+@pytest.mark.parametrize(
+    ("actor", "installation_id", "source"),
+    [
+        ("opencode-agent[bot]", "123", "noema-review-pat"),
+        ("not a bot", "123", "noema-review-github-app"),
+        ("cwl-noema-review[bot]", "not-numeric", "noema-review-github-app"),
+    ],
+)
+def test_current_actor_rejects_unbound_action_identity(monkeypatch, actor, installation_id, source):
+    monkeypatch.setenv("NOEMA_REVIEW_ACTOR", actor)
+    monkeypatch.setenv("NOEMA_REVIEW_INSTALLATION_ID", installation_id)
+    monkeypatch.setenv("NOEMA_REVIEW_TOKEN_SOURCE", source)
+    with pytest.raises(RuntimeError, match="identity binding is invalid"):
+        noema.current_actor()
+
+
 def test_review_context_builders_include_codegraph_threads_and_files(monkeypatch, tmp_path):
     assert noema.truncate_text("abc", 10) == "abc"
     assert "truncated 2 characters" in noema.truncate_text("abcdef", 4)

tests/test_noema_review_handoff.py

@@ -121,6 +121,22 @@ def test_noema_state_ignores_forged_marker_from_other_actor():
     assert handoff.noema_review_state([unmarked], HEAD) is None
 
 
+@pytest.mark.parametrize(
+    "body",
+    [
+        f"<!-- noema-review-gate head_sha={HEAD} decision=approved -->",
+        f"- Head SHA: `{OTHER_HEAD}`\n<!-- noema-review-gate head_sha={HEAD} decision=approved -->",
+        f"- Head SHA: `{HEAD}`\n<!-- noema-review-gate head_sha={OTHER_HEAD} decision=approved -->",
+        f"- Head SHA: `{HEAD}`\n- Head SHA: `{HEAD}`\n<!-- noema-review-gate head_sha={HEAD} decision=approved -->",
+        f"- Head SHA: `{HEAD}`\n<!-- noema-review-gate head_sha={HEAD} decision=approved -->\n<!-- noema-review-gate head_sha={HEAD} decision=approved -->",
+    ],
+)
+def test_noema_state_rejects_missing_stale_or_duplicate_head_bindings(body):
+    value = noema_review()
+    value["body"] = body
+    assert handoff.noema_review_state([value], HEAD) is None
+
+
 def test_stale_initial_head_never_reads_reviews_or_dispatches(capsys):
     fake = FakeGitHub([[opencode_review()]], heads=[OTHER_HEAD])
 

tests/test_repository_branch_coverage_review_schedulers.py

@@ -78,7 +78,10 @@ def test_noema_handoff_returns_current_terminal_state() -> None:
         {
             "commit_id": head,
             "user": {"login": handoff.NOEMA_REVIEW_AUTHOR},
-            "body": handoff.NOEMA_REVIEW_MARKER,
+            "body": (
+                f"- Head SHA: `{head}`\n"
+                f"<!-- noema-review-gate head_sha={head} decision=approve -->"
+            ),
             "state": "approved",
         }
     ]

tests/test_required_workflow_queue_contract.py

@@ -669,6 +669,8 @@ def test_noema_review_supports_review_token_pat_fallback() -> None:
         in workflow
     )
     assert "steps.noema_credential.outputs.source == 'github-app'" in workflow
+    assert "NOEMA_REVIEW_ACTOR: ${{ steps.noema_github_app_token.outputs['app-slug']" in workflow
+    assert "NOEMA_REVIEW_INSTALLATION_ID: ${{ steps.noema_github_app_token.outputs['installation-id'] }}" in workflow
 
 
 def test_noema_review_mints_a_least_privilege_github_app_token() -> None: