Skip to content

feat(api): validate model string on Responses and chat completions - #176

Closed
seonghobae wants to merge 1 commit into
mainfrom
feat/responses-model-validation
Closed

feat(api): validate model string on Responses and chat completions#176
seonghobae wants to merge 1 commit into
mainfrom
feat/responses-model-validation

Conversation

@seonghobae

Copy link
Copy Markdown
Contributor

Summary

  • Validate model when present: non-empty string, max 256 characters.
  • Wire on both POST /v1/responses and POST /v1/chat/completions.
  • Complements feat(api): validate OpenAI model as non-empty string #168 chat-only model validation without depending on its merge.
  • Documented Semgrep FP nosemgrep on audited cost_ledger SQL and ModelClient TLS/urlopen.

Test plan

  • python tests/test_responses_model_validation.py
  • pytest tests/test_responses_model_validation.py -q

Reject empty, blank, non-string, or overlong model ids on both
/v1/responses and /v1/chat/completions before routing or passthrough.
@seonghobae
seonghobae enabled auto-merge (squash) August 13, 2026 02:20
@coderabbitai

coderabbitai Bot commented Aug 13, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 114 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f1bb6281-4967-495e-811b-4ef7b35f951b

📥 Commits

Reviewing files that changed from the base of the PR and between 6841b71 and ba576b2.

📒 Files selected for processing (5)
  • contextual_orchestrator/cost_ledger.py
  • contextual_orchestrator/orchestrator.py
  • contextual_orchestrator/server.py
  • docs/rest_api_design.md
  • tests/test_responses_model_validation.py

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@seonghobae

Copy link
Copy Markdown
Contributor Author

OpenCode/Noema Checks가 초록이어도 Reviews 탭에 APPROVE/REQUEST_CHANGES가 없는 이유:

  1. required opencode-review job은 스텁입니다. 모델/리뷰 POST를 하지 않고, 실제 판정은 .githubopencode-review-dispatch.yml (repository_dispatch)가 올립니다.
  2. 이 PR head ba576b22에 대한 그 디스패치가 없었습니다. 그래서 OpenCode 판정이 없습니다.
  3. noema-reviewCurrent head does not have a primary OpenCode approval; Noema review skipped.로 exit 0 했습니다. OpenCode APPROVE가 없으면 Noema는 올리지 않습니다.
  4. CodeRabbit는 OSS 한도로 본문 리뷰를 시작하지 못했습니다.

방금 opencode-review dispatch를 ContextualWisdomLab/contextual-orchestrator#176@ba576b22로 넣었습니다. 큐가 비면 그 런이 실제 판정을 Reviews에 올려야 합니다. 초록 체크는 리뷰 증거가 아닙니다.

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head ba576b22afe1b6fa53451e1c6412245e03fc789f.

  • Head SHA: ba576b22afe1b6fa53451e1c6412245e03fc789f

  • Workflow run: 31775364013

  • Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs: rest_api_design.md"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs: rest_api_design.md"]
  R2 --> V2["docs review"]
  Evidence --> S3["Test: test_responses_model_validation.py"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test: test_responses_model_validation.py"]
  R3 --> V3["targeted test run"]
Loading

@opencode-agent

Copy link
Copy Markdown
Contributor

OpenCode Review Overview

  • Head SHA: ba576b22afe1b6fa53451e1c6412245e03fc789f
  • Workflow run: 31775364013
  • Workflow attempt: 1
  • Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head ba576b22afe1b6fa53451e1c6412245e03fc789f.

  • Head SHA: ba576b22afe1b6fa53451e1c6412245e03fc789f

  • Workflow run: 31775364013

  • Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs: rest_api_design.md"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs: rest_api_design.md"]
  R2 --> V2["docs review"]
  Evidence --> S3["Test: test_responses_model_validation.py"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test: test_responses_model_validation.py"]
  R3 --> V3["targeted test run"]
Loading

@opencode-agent
opencode-agent Bot disabled auto-merge August 14, 2026 07:17
@seonghobae seonghobae closed this Aug 15, 2026
seonghobae added a commit to ContextualWisdomLab/.github that referenced this pull request Aug 16, 2026
The one-dispatch-per-run scheduler walked created-at order, so leftover
increments with a previous-head verdict consumed the slot while a later
PR such as ContextualWisdomLab/contextual-orchestrator#176 stayed green
on the required stub with no APPROVED or CHANGES_REQUESTED.

Keep fail-closed on the required check, and stable-sort the queue so
never-reviewed PRs take the budget before leftover re-reviews.
seonghobae added a commit to ContextualWisdomLab/.github that referenced this pull request Aug 19, 2026
The one-dispatch-per-run scheduler walked created-at order, so leftover
increments with a previous-head verdict consumed the slot while a later
PR such as ContextualWisdomLab/contextual-orchestrator#176 stayed green
on the required stub with no APPROVED or CHANGES_REQUESTED.

Keep fail-closed on the required check, and stable-sort the queue so
never-reviewed PRs take the budget before leftover re-reviews.
seonghobae added a commit to ContextualWisdomLab/.github that referenced this pull request Aug 19, 2026
The one-dispatch-per-run scheduler walked created-at order, so leftover
increments with a previous-head verdict consumed the slot while a later
PR such as ContextualWisdomLab/contextual-orchestrator#176 stayed green
on the required stub with no APPROVED or CHANGES_REQUESTED.

Keep fail-closed on the required check, and stable-sort the queue so
never-reviewed PRs take the budget before leftover re-reviews.
seonghobae added a commit to ContextualWisdomLab/.github that referenced this pull request Aug 20, 2026
The one-dispatch-per-run scheduler walked created-at order, so leftover
increments with a previous-head verdict consumed the slot while a later
PR such as ContextualWisdomLab/contextual-orchestrator#176 stayed green
on the required stub with no APPROVED or CHANGES_REQUESTED.

Keep fail-closed on the required check, and stable-sort the queue so
never-reviewed PRs take the budget before leftover re-reviews.
opencode-agent Bot pushed a commit to ContextualWisdomLab/.github that referenced this pull request Aug 20, 2026
The one-dispatch-per-run scheduler walked created-at order, so leftover
increments with a previous-head verdict consumed the slot while a later
PR such as ContextualWisdomLab/contextual-orchestrator#176 stayed green
on the required stub with no APPROVED or CHANGES_REQUESTED.

Keep fail-closed on the required check, and stable-sort the queue so
never-reviewed PRs take the budget before leftover re-reviews.
seonghobae added a commit to ContextualWisdomLab/.github that referenced this pull request Aug 21, 2026
* fix(review): fail closed when required check is not a verdict

The required opencode-review job only echoed success, so PRs such as
contextual-orchestrator#176 looked reviewed with an empty Reviews tab.
Fail closed unless opencode-agent posted APPROVED or CHANGES_REQUESTED
on the current head, and stop Noema from exiting 0 when that approval
is missing.

* fix(noema): confine CodeGraph context path to the workspace

Strix on NVIDIA NIM reported path traversal in load_codegraph_context
because NOEMA_CODEGRAPH_CONTEXT_PATH was opened without a workspace
root. Reject .. components and realpath escapes, keep missing in-tree
files on the existing unavailable path, and pin the regression.

* test(review): prove draft PRs skip central OpenCode dispatch

* fix(ci): use valid checkout pin for draft review repair

* fix(review): dispatch OpenCode for draft pull requests

* docs(review): record verified draft dispatch contract

* test(noema): prove existing review cannot bypass primary approval

* test(noema): cover approved existing-review branch

* fix(noema): require primary approval before existing verdict

* docs(review): record Noema approval-order verification

* test(review): reproduce repository dispatch payload overflow

* chore(review): remove superseded payload repair workflow

* test(review): prove LineageWeave remains centrally routable

* fix(ci): publish verified LineageWeave route with workflow token

* test(review): export verified LineageWeave route patch

* chore(review): remove superseded one-shot route repair

* chore(review): remove superseded route publisher

* chore(review): remove superseded route patch exporter

* chore(review): remove unrelated materializer test changes

* fix(noema): fail closed on drafts without primary approval

A draft skip must not make required noema-review green before
opencode-agent posts a current-head verdict.

* fix(review): spend dispatch budget on empty Reviews tabs first

The one-dispatch-per-run scheduler walked created-at order, so leftover
increments with a previous-head verdict consumed the slot while a later
PR such as ContextualWisdomLab/contextual-orchestrator#176 stayed green
on the required stub with no APPROVED or CHANGES_REQUESTED.

Keep fail-closed on the required check, and stable-sort the queue so
never-reviewed PRs take the budget before leftover re-reviews.

* fix(review): treat GitHub run-name as an in-progress OpenCode dispatch

Live workflow runs set name to the interpolated run-name, so
"OpenCode Review Dispatch owner/repo#N@sha" did not match the short
alias. The scheduler posted a second same-head dispatch and
cancel-in-progress killed the review that had already passed coverage.

* chore(review): preserve main materializer executable mode

* test(review): isolate scheduler repository environment

* test(review): require raw current-head verdict token

* fix(review): log raw current-head verdict token

* fix(review): ignore fallback-only approvals in dispatch priority

* fix(review): preserve draft dispatch budget

* docs: complete GitHub client docstring

* fix(review): reject fallback-only verdict evidence

* fix(scheduler): preserve default branch for targeted stacks

* fix(review): route fork heads through review-only path

* fix(review): delay failed fork head ref retries

* fix: classify Strix bootstrap outages as infrastructure

* fix: preserve OSV base results across checkout

* fix: clear root-owned OSV output before checkout

* fix(security): refresh pip audit dependency

* test(review): reject legacy placeholder as active review

* fix(review): ignore required-workflow placeholders

* chore(review): restore OSV workflow to owner boundary

* chore(review): restore OSV contract tests to owner boundary

* chore(review): restore pip lock to security owner boundary

* fix(osv): unlink root-owned base result before restore

* test(scheduler): cover centralized review run filtering

* chore(review): restore canonical OSV workflow ownership

* chore(review): remove foreign OSV workflow assertions

* chore(review): restore canonical Strix workflow ownership

* chore(review): remove foreign Strix false-green regression

* docs(test): complete fixture initializer docstring

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant