fix(strix): admit exact MLLO console and design consumers - #2113
fix(strix): admit exact MLLO console and design consumers#2113seonghobae wants to merge 2 commits into
Conversation
Signed-off-by: Seongho Bae <me@seonghobae.me> Commit-Message-Assisted-by: Codex (OpenAI Codex)
|
Warning Review limit reachedNext included review available in 50 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review — Please verify the exact consumer boundary, both live workflow gates, and preservation of private-target and live-revision checks. Cross-organization runtime access remains unverified; do not treat allowlisting as credential authorization. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== PR metadata and changed files =="
gh pr view 2113 --repo ContextualWisdomLab/.github --json number,title,baseRefName,headRefName,files --jq '{number,title,baseRefName,headRefName,files:[.files[].path]}'
echo
echo "== Diff =="
gh pr diff 2113 --repo ContextualWisdomLab/.github --patch
echo
echo "== Workflow inventory =="
fd -t f . .github/workflows 2>/dev/null || true
echo
echo "== Candidate references =="
rg -n -i -C 5 'HYOSUNG-ITX-AI-Business-Department|llm-gateway-console|ContextualWisdomLab|private|head\.sha|github\.sha|repository' .github 2>/dev/null || trueLength of output: 200945 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Changed files =="
git diff --name-only 'origin/main...HEAD' 2>/dev/null || git diff --name-only HEAD~1..HEAD
echo
echo "== Changed hunks only =="
git diff --unified=80 'origin/main...HEAD' -- .github/workflows/strix.yml .github/workflows/opencode-review.yml 2>/dev/null || true
echo
echo "== Strix workflow structural map =="
ast-grep outline .github/workflows/strix.yml --items all 2>/dev/null || true
echo
echo "== Exact allowlist occurrences with context =="
rg -n -C 18 'HYOSUNG-ITX-AI-Business-Department/llm-gateway-console|ContextualWisdomLab/\*|target_repository|GH_REPOSITORY|is_private|live_head_sha|live_head' .github/workflows/strix.yml .github/workflows/opencode-review.yml 2>/dev/null || true
echo
echo "== Tests changed or boundary-test definitions =="
fd -t f . tests 2>/dev/null | sort | while IFS= read -r f; do
rg -n -l 'HYOSUNG-ITX-AI-Business-Department|llm-gateway-console|strix' "$f" 2>/dev/null && echo "$f"
doneLength of output: 82870 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Boundary regression test =="
cat -n tests/test_strix_hyosung_repository_admission.py
echo
echo "== Scope and rollback record =="
cat -n docs/doctoring/hyosung-strix-consumer-admission.md
echo
echo "== Both changed workflow gates =="
sed -n '538,660p' .github/workflows/strix.yml
echo
echo "== Live event admission gate =="
sed -n '200,242p' .github/workflows/strix.yml
echo
echo "== Consumer boundary probe against both literal patterns =="
pattern='^(ContextualWisdomLab/[A-Za-z0-9_.-]+|HYOSUNG-ITX-AI-Business-Department/llm-gateway-console)$'
for candidate in \
'ContextualWisdomLab/.github' \
'ContextualWisdomLab/appguardrail' \
'HYOSUNG-ITX-AI-Business-Department/llm-gateway-console' \
'HYOSUNG-ITX-AI-Business-Department/llm-gateway-console-extra' \
'HYOSUNG-ITX-AI-Business-Department/LLM-gateway-console' \
'HYOSUNG-ITX-AI-Business-Department/other-repository' \
'hyosung-itx-ai-business-department/llm-gateway-console' \
'HYOSUNG-ITX-AI-Business-Department/llm-gateway-console/foo' \
'HYOSUNG-ITX-AI-Business-Department/llm-gateway-console '
do
if [[ "$candidate" =~ $pattern ]]; then result=admit; else result=reject; fi
printf '%s\t%s\n' "$result" "$candidate"
done
echo
echo "== Static checks =="
git diff --check origin/main...HEAD
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/strix.yml
else
echo "actionlint is not installed in this environment"
fiLength of output: 16072
The focused-test result in the doctoring record is not independent runtime evidence. Cross-organization App access, credential authorization, private-target ZDR, and a successful exact-revision scan remain unverified. The allowlist does not establish any of these conditions.
|
|
Visual inspection: opened the exact 5d8f6df doctoring file in GitHub Preview at 1265×712, English/default UI, and directly inspected screenshots of both the opening and lower paragraphs. Observed text wraps within the document, with readable spacing and no content overlap or horizontal clipping. Proposed status, local-test limits, required runtime evidence and rollback are visible. This is documentation-only visual evidence, not MLLO UI or runtime acceptance. |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head 직접 검토(CWl COMMENT, 승인 아님): 5d8f6df075eceeb821bdcca9b71763150a6ee8c5의 3-file delta를 검토했습니다. 두 admission 지점은 동일한 exact repository allowlist를 사용하고, 기존 live PR state/base/head 검증·visibility resolution·private-target 처리·credential fallback 순서를 약화하지 않습니다. 회귀는 허용 대상, sibling repository, 다른 organization, suffix 및 newline 변형을 모두 fail-closed로 구분합니다. 현재 source-level blocking finding은 확인하지 못했습니다. 다만 문서가 명시하듯 allowlist는 App 설치/권한 증거가 아니며, exact cross-organization dispatch canary와 terminal hosted Checks/qualifying independent approval 전에는 integration 또는 consumer-local workflow 제거를 주장할 수 없습니다.
|
Exact-head CodeQL RCA for |
|
Current-head CI diagnosis for 5d8f6df: OpenCode admission job 103559589108 failed at 13:20:16 UTC because an authenticated current-head model verdict had not yet arrived; this is not an HTTP 410 provider error. CodeQL actions compatibility rerun job 103560317191 failed at 13:24:17 UTC with GitHub installation API rate-limit HTTP 403 while reading/dispatching the verdict. The codeql-dispatch/actions and /python statuses already point to successful receiver run 34696053799. Preserve those receiver results and repair/retry only the compatibility verdict admission after capacity returns; do not restart the scan or relax the gate. Agent Review Runtime Quality CI passed; live Strix/Noema work must retain its existing run handles. |
|
Correction to the preceding diagnostic: successful codeql-dispatch commit statuses do not establish that receiver run 34696053799 succeeded. The receiver is terminal FAILURE. Python job 103560020156 uploaded artifact 10298508871, then its final compatibility-job rerun request failed at 13:24:01 UTC with HTTP 403: the workflow run containing this job is already running. This is distinct from the later installation rate-limit failure in compatibility job 103560317191. Preserve the scan artifacts and successful commit statuses, but keep the overall acceptance incomplete until compatibility recovery succeeds. Do not widen token permissions based on the earlier target-app-token notice: status publication had a fallback, and the terminal failure was the concurrent rerun request. |
|
Canonical-owner resolution: the verified sibling-wake failure is already addressed by open bootstrap PR #2106 (current head 24bb659), which preserves #2051/#2056 and stages one post-matrix settlement while retaining the legacy client contract. This PR will not duplicate or merge that unapproved handler into its admission-only delta. Dependency sequence is #2106 protected handler -> #2040 versioned producer adoption -> fresh exact-head review evidence for this consumer admission. The observed #2113 receiver run 34696053799 is another production-CI reproduction for that owner. Existing artifacts remain evidence; successful commit statuses alone do not complete the run. |
|
@coderabbitai approve Please independently assess exact head 5d8f6df. Current-head Strix job 103559168618 is now terminal SUCCESS, Agent Review Runtime Quality also succeeded, and the complete review-thread query reports zero unresolved threads. Noema job 103559043847 remains active and CodeQL compatibility settlement remains unresolved; do not treat this approval request or the successful Strix check as full merge authorization. Keep the narrowly scoped consumer allowlist and all live-repository/token/provenance validation boundaries. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
pr="2113"
expected_sha="5d8f6df075eceeb821bdcca9b71763150a6ee8c5"
echo "== Pull request revision and mergeability =="
gh pr view "$pr" --repo "$repo" \
--json number,state,headRefOid,baseRefOid,mergeable,reviewDecision,statusCheckRollup \
--jq '{number,state,headRefOid,baseRefOid,mergeable,reviewDecision,statusCheckRollup:[.statusCheckRollup[]|{name,conclusion,status,detailsUrl}]}'
echo "== Exact commit =="
gh api "repos/$repo/commits/$expected_sha" \
--jq '{sha:.sha,parents:[.parents[].sha],message:.commit.message,verification:.commit.verification.verified}'
echo "== Changed files at exact revision against PR base =="
base_sha=$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)
gh api "repos/$repo/compare/$base_sha...$expected_sha" \
--jq '{status,total_commits,files:[.files[].filename]}'
echo "== Exact-head relevant workflow runs =="
gh run list --repo "$repo" --commit "$expected_sha" --limit 100 \
--json databaseId,name,workflowName,status,conclusion,event,headSha,htmlUrl,createdAt,updatedAt \
--jq '.[] | select((.workflowName|test("Strix|Noema|Agent Review Runtime Quality|CodeQL"; "i")) or (.name|test("Strix|Noema|Agent Review Runtime Quality|CodeQL"; "i")))'
echo "== Named job state checks =="
for job_id in 103559168618 103559043847; do
gh api "repos/$repo/actions/jobs/$job_id" \
--jq '{id,name,status,conclusion,run_id,head_sha,started_at,completed_at,html_url}'
done
echo "== Unresolved review threads =="
pr_id=$(gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved }
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes')
jq '{thread_count:length,unresolved_count:([.[] | select(.isResolved == false)] | length)}' <<<"$pr_id"
echo "== Allowlist, privacy, and revision-validation locations =="
rg -n -C 4 'HYOSUNG-ITX-AI-Business-Department/llm-gateway-console|ContextualWisdomLab/\[A-Za-z0-9_.-\]\+|is_private|head\.sha|github\.sha|base\.sha|head\.repo|base\.repo' .github/workflows/strix.yml 2>/dev/null || true
echo "== Whitespace validation =="
git diff --check "$base_sha...$expected_sha"Length of output: 10477 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/.github"
pr="2113"
sha="5d8f6df075eceeb821bdcca9b71763150a6ee8c5"
base_sha="fb17ef556f94f673234aa557254ae52779e9a7b0"
echo "== Exact-head relevant workflow runs =="
gh run list --repo "$repo" --commit "$sha" --limit 100 \
--json databaseId,name,workflowName,status,conclusion,event,headSha,url,createdAt,updatedAt \
--jq '.[] | select((.workflowName|test("Strix|Noema|Agent Review Runtime Quality|CodeQL"; "i")) or (.name|test("Strix|Noema|Agent Review Runtime Quality|CodeQL"; "i"))) | {databaseId,name,workflowName,status,conclusion,event,headSha,url,createdAt,updatedAt}'
echo "== Named job state checks =="
for job_id in 103559168618 103559043847; do
gh api "repos/$repo/actions/jobs/$job_id" \
--jq '{id,name,status,conclusion,run_id,started_at,completed_at,html_url}'
done
echo "== All review threads =="
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]] | {thread_count:length,unresolved_count:([.[] | select(.isResolved == false)] | length)}'
echo "== Extracted admission predicates =="
rg -n -C 8 'HYOSUNG-ITX-AI-Business-Department/llm-gateway-console|ContextualWisdomLab/\[A-Za-z0-9_.-\]\+|is_private|head\.sha|github\.sha|base\.sha|head\.repo|base\.repo' .github/workflows/strix.yml
echo "== Allowlist occurrence count and workflow diff =="
rg -n 'HYOSUNG-ITX-AI-Business-Department/llm-gateway-console' .github/workflows/strix.yml
git diff --unified=12 "$base_sha...$sha" -- .github/workflows/strix.yml
echo "== Static whitespace check =="
git diff --check "$base_sha...$sha"Length of output: 30259
The two live Strix gates retain the same anchored allowlist. They admit all valid The private-target check still requires a resolved Strix job This approval is not full merge authorization. Noema job ✏️ Learnings added
✅ Action performedComments resolved. Approval is disabled; enable |
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Noema LLM review
The PR narrowly extends the Strix target-repository allowlist to the scoped Hyosung consumer in both admission checks, adds a focused boundary test, and documents the operational caveats. The regex changes are anchored and constrained to the exact owner/name pair; the tests cover in-scope, out-of-scope, suffix, and newline cases. No confirmed regression, security, or maintainability defect was found in the changed lines.
Reviewed changed lines
.github/workflows/strix.yml:546 (RIGHT): The TARGET_REPOSITORY check changes from a single ContextualWisdomLab pattern to an alternation anchored with ^ and $. The added HYOSUNG-ITX-AI-Business-Department/llm-gateway-console alternative is exact and cannot match sibling repos or suffix variants. Existing behavior for ContextualWisdomLab repos is preserved. The error message is appropriately generalized..github/workflows/strix.yml:620 (RIGHT): The dispatch metadata REPOSITORY check mirrors the same anchored alternation. Combined with PR_NUMBER and SHA validations, the allowlist extension does not introduce a bypass; only the exact scoped repo is admitted.tests/test_strix_hyosung_repository_admission.py:22 (RIGHT): The boundary test executes the extracted regex via bash against in-scope and out-of-scope names, including a suffix collision and a trailing-newline case. The assertions correctly require those cases to be rejected under the anchored alternation.
Adversarial validation
.github/workflows/strix.yml:546 (RIGHT)falsified: The newly added alternation might accidentally admit a sibling repository such as HYOSUNG-ITX-AI-Business-Department/llm-gateway-console-extra because a prefix match could pass. — The workflow pattern ends with $ and the test suite explicitly asserts returncode 1 for this value, confirming the anchored alternation rejects the suffix variant..github/workflows/strix.yml:620 (RIGHT)falsified: The dispatch REPOSITORY check might accept a name with a trailing newline or other whitespace, allowing repository-name smuggling against the allowlist. — The test parameterization includes the trailing-newline case and expects a non-zero exit; the anchored pattern's $ matches before the newline, so a newline cannot be smuggled into the allowlist match.- Residual risk: Code-level correctness is verified, but the change does not and cannot prove that the existing scoped credential has cross-org read/status access or a valid target App installation; the PR documentation acknowledges this. Runtime verification before adoption remains an operational requirement, not a code defect.
Findings
- No blocking findings.
- Result: APPROVE
- Head SHA:
5d8f6df075eceeb821bdcca9b71763150a6ee8c5 - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
seonghobae
added
bug
ChatGPT Codex Connector
|
Current-head independent review is now present: cwl-noema-review submitted APPROVED for 5d8f6df, and Noema job 103559043847 completed SUCCESS. Strix job 103559168618 is also SUCCESS. This is formal review evidence, not merely a green status. CodeQL compatibility settlement and live branch protection must still converge before merge; the Hyosung consumer execution remains unverified. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
5d8f6df075eceeb821bdcca9b71763150a6ee8c5. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34695759430/job/103560317191)
- CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34695759430/job/103560317848)
- CodeQL PR/Dispatch current-head CodeQL scan: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34695759430/job/103560353168)
- CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34695759430/job/103560317191)
- CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34695759430/job/103560317848)
- Dispatch current-head CodeQL scan check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34695759430/job/103560353168)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Docs: hyosung-strix-consumer-admission.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: hyosung-strix-consumer-admission.md"]
R2 --> V2["docs review"]
Evidence --> S3["Test: test_strix_hyosung_repository_admission.py"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_strix_hyosung_repository_admission.py"]
R3 --> V3["targeted test run"]
OpenCode Review Overview
|
Commit-Message-Assisted-by: Codex (OpenAI Codex) Signed-off-by: Seongho Bae <me@seonghobae.me>
seonghobae
changed the title
1 participant
The MLLO console and its design owner need the central
orchestrator/freereview path. Two repository boundaries currently reject their names before scanning.Admit exactly
HYOSUNG-ITX-AI-Business-Department/llm-gateway-consoleandHYOSUNG-ITX-AI-Business-Department/llm-gateway-console-design. Preserve the existing ContextualWisdomLab scope and reject lookalikes, other organizations, appended paths and malformed names. Live PR revision checks, private-target handling, model routing and status credential separation remain unchanged.At
095c971725682d0a0eaa76e8475ddfd4dc9273d0, the added design cases went RED to GREEN; 97 related tests plus one subtest passed, as did actionlint and diff checks. Older approvals/checks do not certify this changed head.This is a proposed owner contract, not App installation or private-target permission evidence. OpenCode admission is a separate open dependency. No dispatch or credential mutation was performed. Adoption requires independent review, protected merge and an actual exact-revision scan with result publication.