feat(ai): persist tenant-safe proposal audit history - #54
Conversation
|
Warning Review limit reached
Next review available in: 13 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughAI 제안 감사 도메인과 PostgreSQL 저장소를 추가했습니다. 제안 및 결정 이벤트를 테넌트 범위로 저장합니다. SHA-256 다이제스트, 멱등성, append-only 제약, 통합 검증, CI PostgreSQL 설정을 추가했습니다. ChangesAI 제안 감사 저장
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related issues
Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant Caller
participant PostgresProposalAuditRepository
participant PostgreSQL
Caller->>PostgresProposalAuditRepository: appendDecision()
PostgresProposalAuditRepository->>PostgreSQL: proposal digest와 decision INSERT
PostgreSQL-->>PostgresProposalAuditRepository: 성공 또는 제약조건 오류
PostgresProposalAuditRepository->>PostgreSQL: 동일 idempotency key 조회
PostgreSQL-->>PostgresProposalAuditRepository: 기존 decision payload
PostgresProposalAuditRepository-->>Caller: 기존 이벤트 재사용 또는 충돌 오류
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (4)
apps/ai-service/migrations/0001_proposal_audit.sql (1)
1-5: 🗄️ Data Integrity & Integration | 🔵 Trivial이 마이그레이션은 재적용하면
CREATE TABLE,CREATE FUNCTION,CREATE TRIGGER에서 실패합니다. 적용 이력을 기록하는 테이블이나 마이그레이션 러너가 없으면 운영자가 부분 적용 상태를 판별할 수 없습니다. 이력 테이블 또는 러너 도입을 후속 작업으로 계획하십시오.Also applies to: 118-132
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/ai-service/migrations/0001_proposal_audit.sql` around lines 1 - 5, 마이그레이션에 재적용 가능한 `CREATE TABLE`, `CREATE FUNCTION`, `CREATE TRIGGER` 처리를 추가하고, 부분 적용 상태를 확인할 수 있도록 적용 이력을 기록하는 테이블 또는 마이그레이션 러너 도입을 후속 작업으로 계획하십시오.package.json (1)
15-15: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
format:check가 경로를 명시적으로 열거합니다. 파일이 추가될 때마다 이 목록을 갱신해야 하고, 누락 시 포맷 검사가 조용히 건너뜁니다.prettier --single-quote --check .와.prettierignore조합으로 전환하면 목록 관리가 사라집니다. 변경 범위가 넓으므로 후속 작업으로 진행해도 됩니다.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` at line 15, Update the format:check script in package.json to run Prettier against the repository root instead of explicitly enumerating files, and add or reuse a .prettierignore configuration to exclude paths that should not be checked. Preserve the existing single-quote option while ensuring newly added files are included automatically.apps/ai-service/src/proposal-audit-domain.test.ts (1)
153-167: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value경계 조건 테스트가 없습니다. 도메인은
requiresConfirmation !== true거부, 텍스트 1000자 상한,rationale/operations20개 상한을 강제합니다. 이 세 경계에 대한 케이스를 추가하면 상한 값 변경 시 회귀를 잡을 수 있습니다.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/ai-service/src/proposal-audit-domain.test.ts` around lines 153 - 167, Extend the tests around createProposalDecisionEvent with boundary cases for the domain constraints: reject decisions where requiresConfirmation is not true, accept text at the 1000-character limit while rejecting longer text, and accept rationale and operations at 20 items while rejecting 21. Use the existing test fixtures and ProposalAuditValidationError assertions, covering each boundary explicitly.apps/ai-service/src/proposal-audit-domain.ts (1)
426-443: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
validateProposalDecisionEvent는 각 필드를requireUuidV4,requireDigest,requireString,requireTimestamp로 검증한 뒤createProposalDecisionEvent에 넘깁니다.createProposalDecisionEvent는 같은 검증을 다시 수행합니다. 키 존재 검사만 이 함수에서 하고 값 검증은createProposalDecisionEvent에 위임하면 중복이 사라집니다. 동작은 동일합니다.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/ai-service/src/proposal-audit-domain.ts` around lines 426 - 443, Update validateProposalDecisionEvent to retain only key-presence checks and delegate all field value validation to createProposalDecisionEvent; remove the requireUuidV4, requireDigest, requireString, and requireTimestamp calls from this function while preserving the existing decision and optional reason behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 54-67: Remove the “Render proposal audit formatting diff” step
from the workflow so validate proceeds to the formatting, lint, typecheck, test,
build, and compose validation stages. Do not run Prettier with --write in CI;
formatting should be applied locally via pnpm format and checked by the existing
format-check stage.
In `@apps/ai-service/src/postgres-proposal-audit-repository.ts`:
- Around line 259-279: Update the INSERT parameter list in saveProposal to
JSON.stringify safe.proposal.rationale and safe.proposal.operations before
binding them to the jsonb columns, while leaving safe.request unchanged; update
the related unit-test expectations to assert the serialized JSON strings.
---
Nitpick comments:
In `@apps/ai-service/migrations/0001_proposal_audit.sql`:
- Around line 1-5: 마이그레이션에 재적용 가능한 `CREATE TABLE`, `CREATE FUNCTION`, `CREATE
TRIGGER` 처리를 추가하고, 부분 적용 상태를 확인할 수 있도록 적용 이력을 기록하는 테이블 또는 마이그레이션 러너 도입을 후속 작업으로
계획하십시오.
In `@apps/ai-service/src/proposal-audit-domain.test.ts`:
- Around line 153-167: Extend the tests around createProposalDecisionEvent with
boundary cases for the domain constraints: reject decisions where
requiresConfirmation is not true, accept text at the 1000-character limit while
rejecting longer text, and accept rationale and operations at 20 items while
rejecting 21. Use the existing test fixtures and ProposalAuditValidationError
assertions, covering each boundary explicitly.
In `@apps/ai-service/src/proposal-audit-domain.ts`:
- Around line 426-443: Update validateProposalDecisionEvent to retain only
key-presence checks and delegate all field value validation to
createProposalDecisionEvent; remove the requireUuidV4, requireDigest,
requireString, and requireTimestamp calls from this function while preserving
the existing decision and optional reason behavior.
In `@package.json`:
- Line 15: Update the format:check script in package.json to run Prettier
against the repository root instead of explicitly enumerating files, and add or
reuse a .prettierignore configuration to exclude paths that should not be
checked. Preserve the existing single-quote option while ensuring newly added
files are included automatically.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: dc77fac4-1656-44d2-a3e5-d67e16cd42e5
📒 Files selected for processing (12)
.github/workflows/ci.ymlapps/ai-service/migrations/0001_proposal_audit.sqlapps/ai-service/migrations/README.mdapps/ai-service/package.jsonapps/ai-service/src/postgres-proposal-audit-repository.integration.test.tsapps/ai-service/src/postgres-proposal-audit-repository.test.tsapps/ai-service/src/postgres-proposal-audit-repository.tsapps/ai-service/src/proposal-audit-domain.test.tsapps/ai-service/src/proposal-audit-domain.tsdocs/superpowers/plans/2026-08-04-ai-proposal-audit-repository-slice.mdpackage.jsonturbo.json
1 participant
Summary
Implements #49 as the next reviewable slice of #46 after #48.
workspace_id, validates stored JSON/scalars, and returns deterministic orderingDeferred
Validated production pool configuration, NestJS repository wiring, proposal retrieval and decision HTTP routes, authenticated actor derivation, external model transport, and separately authorized proposal execution remain subsequent reviewable slices.
Validation gate
Merge only when CI, AppGuardrail, Semgrep, Security Scan, Commercial Readiness, CodeRabbit, and all human/security review requirements pass on the exact head with no unresolved actionable findings.
Closes #49
Refs #46
Summary by CodeRabbit
새 기능
문서
테스트 및 품질