chore(fuzz): remove dead duplicate fuzz target - #1486
Conversation
fuzz/fuzz_opencode_normalize_output.py was an orphaned duplicate of fuzz/fuzz_opencode_review_normalize_output.py, which is the file actually named in .clusterfuzzlite/Dockerfile and imported by tests/test_fuzz_targets.py. The duplicate called NORMALIZER.extract_json_object(text), a function that no longer exists in scripts/ci/opencode_review_normalize_output.py (current API is iter_json_objects) -- it would AttributeError if ever executed and was reachable from no test, workflow, or doc. Deleted; no other file referenced it by name outside one unrelated case pattern in scripts/ci/strix_quick_gate.sh (a separate, pre-existing filename mismatch, out of scope here).
|
Warning Review limit reachedNext included review available in 29 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Noema LLM review
Unable to review due to missing file content
Reviewed changed lines
Adversarial validation
- Residual risk: high
Findings
-
[high] fuzz/fuzz_opencode_normalize_output.py:1 (LEFT): File content unavailable due to HTTP 404 error
-
Result: COMMENT
-
Head SHA:
8514d0c8d4e57f180d806bb7dfcd9ccd27b6e3f2 -
Reviewer credential:
noema-review-github-app -
Actor:
cwl-noema-review[bot]
|
Contextual-Orchestrator와 관계한 것들을 같이 손보든 어쩌든 해결하세요. Bypass merge 필요하면 가능 (chicken and eggs 상황이라면) + NVIDIA NIM 만 쓰는 건 허용하지 않아요. Contextual-Orchestrator를 쓰세요. Timeout은 적어도 3시간으로 잡으세요. 120초 같은 건 당황스럽군요. Opencode와 Noema 는 Coderabbitai 및 Devin 수준으로 실제로 리뷰를 하게 하시오. Strix도 보안 리뷰를 꼼꼼하게 하도록 하시오. 특히 보안 리뷰는 전체 코드로 수행하는 것입니다. Contextual-Orchestrator는 실시간으로 빠르면서 능력이 좋은 모델에 요청을 보내어 시간을 당기시오. |
Use protected main as the authoritative tree and preserve only PR #1486's one-file deletion while retaining the prior branch head as first parent and current protected main as second parent. No force push and no unrelated current-main changes are overwritten.
…1564) QUEUE_SATURATION_CHICKEN_EGG: exact head is mechanically mergeable, all substantive review threads are resolved, no CHANGES_REQUESTED exists, independent Devin review verified the final CodeGraph-contract cleanup, and all fresh hosted required workflows remain queued in the saturated central Actions fleet. The source fix removes a self-hosting blocker that prevents Noema from reviewing deletion-only PRs such as #1486. Protected ruleset exposes OrganizationAdmin bypass; no substantive failing test/security finding is bypassed.
|
@opencode-agent review Fresh exact-head review requested for |
|
Superseded by current-main successor #1624. Fresh protected-main inspection now confirms the live ClusterFuzzLite target and Strix normalizer-support path both use |
built and CI-green, genuinely unreachable pending the sandbox Corrected an initial wrong instinct first: naruon's own "noema_agent.py" looked like a DDD naming collision with the CI review agent's Noema, but docs/CWL-MASTER-CONTEXT.md explicitly defines Noema as one shared agent runtime across three consumers (CI review agent, naruon's do-anything agent, wardnet's AI SOC quarantine sandbox) -- owner-confirmed per naruon#1527. Checked the master context before concluding two same-named components were separate, per this session's own established lesson from an earlier mistake of exactly that kind. Found: naruon already has a real, tested, CI-green agent + plugin- registry system (services/noema_agent.py, services/agent_registry.py, four open PRs #1527/#1486/#1516/#1537, none authored by either active peer session) matching the platform plan's own documented registry architecture almost exactly. The confirmed gap: nothing in the API or frontend layer ever calls it -- the agent, registry, and manifests are mutually consistent and fully tested but completely unreachable, and have been since the agent's original commit two months ago. This connects directly to item 6: the master context has this agent running inside quarantine-sandbox-runtime, which a peer session is separately, actively building (still early-stage, confirmed via direct coordination) -- wiring the agent to a real trigger before that sandbox exists would ship an unsandboxed, writeback-capable LLM agent against the documented design, not merely ship an incomplete feature. Not implemented this tick pending that dependency. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…in Review)
commits/{sha}/status only reflects the legacy Status API, not GitHub's
Checks API that every workflow in this org actually posts through.
Re-checked with commits/{sha}/check-runs: metadata-only gate evaluation
fails on all 4 (expected — real code changes, not eligible for that
script's fast path, and already excluded from this org's own failed-check
enumeration). noema-review genuinely failed on #1527/#1537 — pulled the
job log for #1527 and logged a new, concrete review-failure case (a JSON
repair failure) for item 23's aggregation ask. strix was cancelled on
#1486/#1537, consistent with the already-documented repo-wide
concurrency-group starvation, not a new finding.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2 participants
What
Removes
fuzz/fuzz_opencode_normalize_output.py, an orphaned duplicate offuzz/fuzz_opencode_review_normalize_output.py.Why
Confirmed hollow/broken path from the org-wide hollow-path audit:
.clusterfuzzlite/Dockerfileandtests/test_fuzz_targets.pyboth reference onlyfuzz/fuzz_opencode_review_normalize_output.pyas the real, live fuzz target.fuzz/fuzz_opencode_normalize_output.py, calledNORMALIZER.extract_json_object(text)at line 35.extract_json_objectdoes not exist inscripts/ci/opencode_review_normalize_output.py— the current API isiter_json_objects(verified by grepping everydefin that module). The duplicate would raiseAttributeErrorif it were ever executed, and nothing executes it: no test imports it, no workflow runs it, no doc names it.Verified independently against current
origin/mainbefore making any change (re-ran the grep forextract_json_object/iter_json_objects, confirmed the Dockerfile and test-file references, and confirmed no other file in the repo names the dead file — one incidental exception noted below).Scope note
While verifying, I found
scripts/ci/strix_quick_gate.shhas onecasepattern that matches the old filenamefuzz/fuzz_opencode_normalize_output.py(not the real targetfuzz_opencode_review_normalize_output.py) when deciding whether to copy the normalizer support file into a PR scan scope. That looks like a separate, pre-existing filename-mismatch bug, not the hollow-path finding this PR addresses, so I left it untouched and am flagging it separately rather than scope-creeping this change.Validation
Run from a clean clone on this branch:
2105 passed, 1 skipped(skip pre-existing/unrelated)TOTAL ... 100%RESULT: PASSED (minimum: 100.0%, actual: 100.0%)No PR template exists in this repository (checked
.github/pull_request_template.md,.github/PULL_REQUEST_TEMPLATE/), so this description follows the repo's own conventions fromAGENTS.md/CLAUDE.mdinstead.Generated by Claude Code