🛡️ Sentinel: [MEDIUM] Fix information leakage in CI subprocess errors

.github/workflows/pr-review-merge-scheduler.yml

@@ -24,6 +24,11 @@ on:
         required: false
         default: true
         type: boolean
+      update_branches:
+        description: Update outdated PR branches after OpenCode approval
+        required: false
+        default: true
+        type: boolean
 
 concurrency:
   group: pr-review-merge-scheduler
@@ -46,6 +51,7 @@ jobs:
       PROJECT_FLOW: ${{ vars.PROJECT_FLOW || 'git-flow' }}
       TRIGGER_REVIEWS: ${{ github.event_name != 'workflow_dispatch' || inputs.trigger_reviews == true }}
       ENABLE_AUTO_MERGE: ${{ github.event_name != 'workflow_dispatch' || inputs.enable_auto_merge == true }}
+      UPDATE_BRANCHES: ${{ github.event_name != 'workflow_dispatch' || inputs.update_branches == true }}
     steps:
       - name: Checkout trusted scheduler
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -78,4 +84,9 @@ jobs:
           else
             args+=(--no-enable-auto-merge)
           fi
+          if [ "$UPDATE_BRANCHES" = "true" ]; then
+            args+=(--update-branches)
+          else
+            args+=(--no-update-branches)
+          fi
           python3 scripts/ci/pr_review_merge_scheduler.py "${args[@]}"

.jules/bolt.md

@@ -0,0 +1,3 @@
+## 2024-06-21 - Python JSON Decoding Optimization
+**Learning:** In Python, string slicing `text[index:]` inside a loop can cause O(N^2) complexity and severe memory copying overhead. When decoding JSON incrementally from a large text blob, `json.JSONDecoder().raw_decode(text, index)` can parse from a given index without slicing. Combining this with `text.find("{", index)` to skip irrelevant characters is significantly faster than `enumerate(text)`.
+**Action:** Always prefer `raw_decode(text, index)` and `string.find()` over string slicing and character-by-character iteration when scanning large files for JSON objects.

.jules/sentinel.md

@@ -2,3 +2,13 @@
 **Vulnerability:** Markdown Injection / HTML Comment Breakout
 **Learning:** JSON serialized into HTML comments (like `<!-- json -->`) can contain `-->` in string values, causing GitHub's Markdown parser to close the comment prematurely and render the remaining JSON as attacker-controlled text or Markdown.
 **Prevention:** Always escape `<` and `>` as `\u003c` and `\u003e` (and `&` as `\u0026`) when embedding JSON in HTML contexts (even Markdown comments) to prevent breakout.
+
+## 2024-06-25 - Force Python JSON Normalizer to Prevent CI Gate Bypass
+**Vulnerability:** Workflow CI Security Bypass / Markdown Injection
+**Learning:** The GitHub Actions workflow `opencode-review.yml` attempted to optimize performance by doing a fast-path bash string extraction. If this succeeded, it skipped the Python JSON normalizer (`opencode_review_normalize_output.py`). This is a security flaw because the bash script does not escape `<, >, &` characters, allowing attackers to inject `-->` directly in JSON strings to break out of HTML comment sections.
+**Prevention:** Removed the fast-path check entirely. We must always enforce JSON normalization via `opencode_review_normalize_output.py` because it correctly parses the JSON payload and safely escapes all characters as `\u003c`, `\u003e` and `\u0026`.
+
+## 2025-02-23 - [Information Leakage in CI Subprocess Errors]
+**Vulnerability:** The script `scripts/ci/pr_review_merge_scheduler.py` included `process.stderr` in the `RuntimeError` exception when a subprocess failed. This could potentially leak sensitive information (e.g., API keys, auth tokens) into GitHub Actions logs.
+**Learning:** CI/CD error messages must fail securely without exposing the stderr of external commands that may contain sensitive data, especially when interfacing with authenticated CLI tools like `gh`.
+**Prevention:** Avoid printing or including raw `stderr` in exceptions or logs unless sanitized.

README.md

@@ -5,3 +5,49 @@ Organization profile repository for **맥락지혜 연구실 / Contextual Wisdom
 The public GitHub organization profile lives in [profile/README.md](profile/README.md).
 
 Homepage: https://contextualwisdomlab.github.io/
+
+PR governance live audit: [PR_GOVERNANCE_AUDIT.md](PR_GOVERNANCE_AUDIT.md).
+
+## PR review and merge policy
+
+OpenCode judges PRs; GitHub Actions performs mechanical updates and merges.
+The scheduler updates a same-repository PR branch only when the latest OpenCode
+review is approved and GitHub reports the PR as behind. After that update, the
+new head must pass OpenCode, Strix, required checks, and review-thread gates
+again before auto-merge or `--match-head-commit` merge can proceed.
+Branch updates and merges run through the workflow `GITHUB_TOKEN`, so GitHub
+records those mechanical mutations as `github-actions[bot]` rather than an
+OpenCode app token or a personal token.
+
+OpenCode review execution is `workflow_dispatch`-only. The scheduler dispatches
+same-head Strix evidence first, then dispatches OpenCode for the same PR head.
+This avoids running PR-head review, CodeGraph, coverage, or PoC code from a
+privileged `pull_request_target` OpenCode workflow.
+
+OpenCode approval is evidence-gated. Before approval, the review summary must
+name changed files, CodeGraph or structural MCP evidence, a Change Flow DAG,
+100% test coverage evidence, 100% docstring coverage evidence, and a concrete
+PoC/execution result. The PoC can be a temporary scratch repro, focused test,
+lint, security check, performance probe, or UI verification command, but it must
+be actually run and cited. Scratch PoC files are not committed.
+
+Failed GitHub Checks are not reviewed as URL lists. OpenCode must explain the
+failed check name, failing step, source-backed file and line when available,
+root cause, fix direction, and focused rerun command. Cancelled or superseded
+checks must be described as queue or evidence blockers rather than invented
+source-code findings.
+
+Operational cases folded into the central policy:
+
+- `naruon`: approved PRs can become `BEHIND`; the scheduler treats that as an
+  update request, not as a merge signal. GitHub Actions updates the branch with
+  `expected_head_sha`, then the new head is reviewed again.
+- `pg-erd-cloud`: successful bot merges used current-head evidence and
+  `--match-head-commit`; the centralized path keeps that head-SHA guard.
+- `.github`: PRs that edit trusted review workflows can fail because
+  `pull_request_target` runs the base branch's trusted scripts. A same-head
+  manual `workflow_dispatch` Strix run may supply evidence for review, but it
+  does not replace required PR checks until the trusted base branch catches up.
+- `naruon#745`: new OpenCode review-flow work improves Mermaid output by
+  replacing generic risk sketches with changed-file flow DAGs. The central
+  workflow carries that review contract while keeping the self-test drift fix.

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Supported Versions
+
+Please check the security policy of individual repositories for specific version support details. In general, we only provide security updates for the latest major version of our active projects.
+
+## Reporting a Vulnerability
+
+We take the security of our systems seriously, and we value the security community. The disclosure of security vulnerabilities helps us ensure the security and privacy of our users.
+
+If you believe you have found a security vulnerability in any Contextual Wisdom Lab repository, please report it to us as described below.
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Instead, please report them via [GitHub's private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) if enabled on the specific repository, or email the lab maintainers directly.
+
+When reporting a vulnerability, please include:
+* A description of the vulnerability and its impact.
+* The repository and specific version where it was found.
+* Steps to reproduce the vulnerability.
+* Any relevant logs, code snippets, or proof-of-concept.
+
+We will endeavor to respond to your report promptly, verify the vulnerability, and work on a fix as quickly as possible.

ci-review-prompt.md

@@ -0,0 +1,7 @@
+You are a general-purpose, meticulous CI code-review agent.
+
+OpenCode runtime tools are enabled: bash, task, webfetch, websearch, and lsp. Use bash for direct verification commands, task for focused subreviews when risk warrants it, webfetch and websearch for current external facts, and lsp for symbol-aware diagnostics when a language server is available.
+
+Actively consult configured MCP evidence sources when reachable: CodeGraph for structural checks, DeepWiki for repository documentation, Context7 for current library and API documentation, and web_search for bounded external lookups such as industry standards, international standards, official platform specifications, and comparable issue or PR precedents.
+
+Do not rely on model memory for user-claimed concepts, standards, runtime support, or domain terminology when a search source is available. Inspect changed files and focused hunks directly when external evidence is insufficient. Request changes only for source-backed, line-specific blockers with observable impact, concrete fix direction, and a verification command when the repository provides one.

opencode.jsonc

@@ -0,0 +1,148 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "model": "github-models/openai/gpt-5",
+  "small_model": "github-models/deepseek/deepseek-v3-0324",
+  "enabled_providers": ["github-models"],
+  "lsp": true,
+  "mcp": {
+    "codegraph": {
+      "type": "local",
+      "command": ["npx", "-y", "@colbymchenry/codegraph@0.9.9", "serve", "--mcp"],
+      "enabled": true
+    },
+    "deepwiki": {
+      "type": "remote",
+      "url": "https://mcp.deepwiki.com/mcp",
+      "enabled": true,
+      "timeout": 10000
+    },
+    "context7": {
+      "type": "local",
+      "command": ["npx", "-y", "@upstash/context7-mcp@3.1.0", "--transport", "stdio"],
+      "enabled": true,
+      "timeout": 10000,
+      "environment": {
+        "NPM_CONFIG_IGNORE_SCRIPTS": "true",
+        "NPM_CONFIG_LOGLEVEL": "error"
+      }
+    },
+    "web_search": {
+      "type": "local",
+      "command": ["npx", "-y", "@guhcostan/web-search-mcp@1.0.5"],
+      "enabled": true,
+      "timeout": 10000,
+      "environment": {
+        "NPM_CONFIG_IGNORE_SCRIPTS": "true",
+        "NPM_CONFIG_LOGLEVEL": "error"
+      }
+    }
+  },
+  "permission": {
+    "edit": "deny",
+    "bash": "allow",
+    "read": "allow",
+    "grep": "allow",
+    "glob": "allow",
+    "list": "allow",
+    "task": "allow",
+    "webfetch": "allow",
+    "websearch": "allow",
+    "lsp": "allow",
+    "external_directory": "allow"
+  },
+  "agent": {
+    "ci-review": {
+      "description": "Compact read-only CI pull request reviewer",
+      "mode": "primary",
+      "prompt": "{file:./ci-review-prompt.md}",
+      "steps": 4,
+      "permission": {
+        "edit": "deny",
+        "bash": "allow",
+        "read": "allow",
+        "grep": "allow",
+        "glob": "allow",
+        "list": "allow",
+        "task": "allow",
+        "webfetch": "allow",
+        "websearch": "allow",
+        "lsp": "allow",
+        "external_directory": "allow"
+      }
+    },
+    "ci-review-fallback": {
+      "description": "Expanded read-only CI pull request reviewer fallback",
+      "mode": "primary",
+      "prompt": "{file:./ci-review-prompt.md}",
+      "steps": 12,
+      "permission": {
+        "edit": "deny",
+        "bash": "allow",
+        "read": "allow",
+        "grep": "allow",
+        "glob": "allow",
+        "list": "allow",
+        "task": "allow",
+        "webfetch": "allow",
+        "websearch": "allow",
+        "lsp": "allow",
+        "external_directory": "allow"
+      }
+    }
+  },
+  "provider": {
+    "github-models": {
+      "npm": "@ai-sdk/openai-compatible",
+      "name": "GitHub Models",
+      "options": {
+        "baseURL": "https://models.github.ai/inference",
+        "apiKey": "{env:STRIX_GITHUB_MODELS_TOKEN}"
+      },
+      "models": {
+        "openai/gpt-5": {
+          "name": "OpenAI GPT-5",
+          "tool_call": true,
+          "limit": {
+            "context": 200000,
+            "output": 100000
+          }
+        },
+        "deepseek/deepseek-r1-0528": {
+          "name": "DeepSeek R1 0528",
+          "tool_call": true,
+          "reasoning": true,
+          "limit": {
+            "context": 128000,
+            "output": 4096
+          }
+        },
+        "deepseek/deepseek-v3-0324": {
+          "name": "DeepSeek V3 0324",
+          "tool_call": true,
+          "limit": {
+            "context": 128000,
+            "output": 4096
+          }
+        },
+        "openai/o3": {
+          "name": "OpenAI o3",
+          "tool_call": true,
+          "reasoning": true,
+          "limit": {
+            "context": 200000,
+            "output": 100000
+          }
+        },
+        "openai/o4-mini": {
+          "name": "OpenAI o4-mini",
+          "tool_call": true,
+          "reasoning": true,
+          "limit": {
+            "context": 200000,
+            "output": 100000
+          }
+        }
+      }
+    }
+  }
+}

pyproject.toml

@@ -0,0 +1,11 @@
+[tool.coverage.run]
+source = ["scripts/ci"]
+omit = ["tests/*"]
+
+[tool.coverage.report]
+fail_under = 100
+show_missing = true
+
+[tool.interrogate]
+exclude = ["tests"]
+fail-under = 100

requirements-opencode-review-ci.txt

@@ -0,0 +1,3 @@
+coverage==7.14.2
+interrogate==1.7.0
+pytest==9.1.1