From dcdb40cf6faed11f8e2bfd141e54982a310fbdce Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 19:18:39 +0900 Subject: [PATCH 1/7] ci(autofix): retarget corrective source repair after premature merge --- .../source-fix-pr1714-no-model-job-timeout.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/source-fix-pr1714-no-model-job-timeout.yml b/.github/workflows/source-fix-pr1714-no-model-job-timeout.yml index ad3accb2fa..c9506386ff 100644 --- a/.github/workflows/source-fix-pr1714-no-model-job-timeout.yml +++ b/.github/workflows/source-fix-pr1714-no-model-job-timeout.yml @@ -3,7 +3,7 @@ name: Source Fix PR 1714 No Model Job Timeout on: push: branches: - - fix/autofix-job-timeout + - fix/no-heuristic-model-job-timeouts paths: - scripts/ci/source_fix_pr1714_no_model_job_timeout.py - .github/workflows/source-fix-pr1714-no-model-job-timeout.yml @@ -30,7 +30,7 @@ jobs: shell: bash run: | set -euo pipefail - remote_head="$(git ls-remote origin refs/heads/fix/autofix-job-timeout | cut -f1)" + remote_head="$(git ls-remote origin refs/heads/fix/no-heuristic-model-job-timeouts | cut -f1)" test -n "$remote_head" test "$remote_head" = "$GITHUB_SHA" @@ -75,7 +75,7 @@ jobs: allowed='^(.github/workflows/pr-review-autofix.yml|tests/test_pr_review_autofix_writer_security_contract.py|CHANGELOG.md|docs/product-technical-gap-baseline.md|scripts/ci/source_fix_pr1714_no_model_job_timeout.py|.github/workflows/source-fix-pr1714-no-model-job-timeout.yml)$' bad="$(git status --short | sed -E 's/^.. //' | grep -Ev "$allowed" || true)" test -z "$bad" - remote_head="$(git ls-remote origin refs/heads/fix/autofix-job-timeout | cut -f1)" + remote_head="$(git ls-remote origin refs/heads/fix/no-heuristic-model-job-timeouts | cut -f1)" test "$remote_head" = "$GITHUB_SHA" - name: Publish normal non-force repair commit @@ -90,12 +90,12 @@ jobs: echo "::error::No workflow-starting mutation credential is configured; refusing github.token publication." exit 1 fi - remote_head="$(git ls-remote origin refs/heads/fix/autofix-job-timeout | cut -f1)" + remote_head="$(git ls-remote origin refs/heads/fix/no-heuristic-model-job-timeouts | cut -f1)" test "$remote_head" = "$GITHUB_SHA" git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" git add -A git diff --cached --check - git commit -m "fix(autofix): remove model wall-clock termination" + git commit -m "fix(autofix): remove leaf model-compute and evidence heuristics" git remote set-url origin "https://x-access-token:${workflow_push_token}@github.com/${GITHUB_REPOSITORY}.git" - git push origin HEAD:fix/autofix-job-timeout + git push origin HEAD:fix/no-heuristic-model-job-timeouts From f46a3083857bb558d23a18d5f68adce101519c09 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:03:24 +0900 Subject: [PATCH 2/7] fix(autofix): repair stale leaf-compute regression --- .../source_fix_pr1714_no_model_job_timeout.py | 29 ++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/scripts/ci/source_fix_pr1714_no_model_job_timeout.py b/scripts/ci/source_fix_pr1714_no_model_job_timeout.py index 415cf176ae..2e06ccf166 100644 --- a/scripts/ci/source_fix_pr1714_no_model_job_timeout.py +++ b/scripts/ci/source_fix_pr1714_no_model_job_timeout.py @@ -79,8 +79,35 @@ def patch_workflow() -> None: def patch_test() -> None: - """Replace the timeout-positive regression with fail-closed authority contracts.""" + """Replace heuristic-positive regressions with fail-closed authority contracts.""" text = TEST.read_text(encoding="utf-8") + reasoning_old = '''def test_writer_uses_the_gateway_free_pool_with_high_reasoning() -> None: + """Pin the write-capable pool and its deliberate high-reasoning budget.""" + workflow = _workflow_text() + + assert f'"model": "{_TARGET_MODEL}"' in workflow + assert '"orchestrator/free": {' in workflow + assert workflow.count(f"MODEL: {_TARGET_MODEL}") == 2 + assert '"reasoningEffort": "high"' in workflow + assert "COPILOT_GITHUB_TOKEN" not in workflow +''' + reasoning_new = '''def test_writer_uses_the_gateway_free_pool_without_leaf_compute_policy() -> None: + """Pin the gateway pool while forbidding leaf-owned test-time-compute policy.""" + workflow = _workflow_text() + + assert f'"model": "{_TARGET_MODEL}"' in workflow + assert '"orchestrator/free": {' in workflow + assert workflow.count(f"MODEL: {_TARGET_MODEL}") == 2 + assert '"reasoningEffort":' not in workflow + assert "COPILOT_GITHUB_TOKEN" not in workflow +''' + text = replace_once( + text, + reasoning_old, + reasoning_new, + "stale high-reasoning positive regression", + ) + marker = "def test_autofix_job_has_a_bounded_runtime() -> None:\n" start = text.find(marker) if start < 0 or text.find(marker, start + 1) >= 0: From a403124c1199660b0f921f6b3934adc1643a2f42 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:11:08 +0900 Subject: [PATCH 3/7] fix(autofix): publish validated repair through OIDC app authority --- ...source-fix-pr1714-no-model-job-timeout.yml | 52 ++++++++++++++----- 1 file changed, 40 insertions(+), 12 deletions(-) diff --git a/.github/workflows/source-fix-pr1714-no-model-job-timeout.yml b/.github/workflows/source-fix-pr1714-no-model-job-timeout.yml index c9506386ff..8be1d07c60 100644 --- a/.github/workflows/source-fix-pr1714-no-model-job-timeout.yml +++ b/.github/workflows/source-fix-pr1714-no-model-job-timeout.yml @@ -14,6 +14,7 @@ concurrency: permissions: contents: read + id-token: write jobs: repair: @@ -66,30 +67,57 @@ jobs: python -m compileall -q scripts tests git diff --check - - name: Retire one-shot artifacts and verify scope + - name: Verify exact repair scope shell: bash run: | set -euo pipefail - rm scripts/ci/source_fix_pr1714_no_model_job_timeout.py - rm .github/workflows/source-fix-pr1714-no-model-job-timeout.yml - allowed='^(.github/workflows/pr-review-autofix.yml|tests/test_pr_review_autofix_writer_security_contract.py|CHANGELOG.md|docs/product-technical-gap-baseline.md|scripts/ci/source_fix_pr1714_no_model_job_timeout.py|.github/workflows/source-fix-pr1714-no-model-job-timeout.yml)$' + allowed='^(.github/workflows/pr-review-autofix.yml|tests/test_pr_review_autofix_writer_security_contract.py|CHANGELOG.md|docs/product-technical-gap-baseline.md)$' bad="$(git status --short | sed -E 's/^.. //' | grep -Ev "$allowed" || true)" test -z "$bad" remote_head="$(git ls-remote origin refs/heads/fix/no-heuristic-model-job-timeouts | cut -f1)" test "$remote_head" = "$GITHUB_SHA" + - name: Exchange repository-scoped OpenCode app token + id: target_app_token + shell: bash + env: + OIDC_AUDIENCE: opencode-github-action + OPENCODE_API_BASE_URL: https://api.opencode.ai + run: | + set -euo pipefail + test -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" + test -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" + request_url="${ACTIONS_ID_TOKEN_REQUEST_URL}" + separator="&" + case "$request_url" in + *\?*) ;; + *) separator="?" ;; + esac + oidc_response="$( + curl -fsS \ + -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \ + "${request_url}${separator}audience=${OIDC_AUDIENCE}" + )" + oidc_token="$(jq -r '.value // empty' <<<"$oidc_response")" + test -n "$oidc_token" + token_response="$( + curl -fsS \ + -X POST \ + -H "Authorization: Bearer ${oidc_token}" \ + "${OPENCODE_API_BASE_URL}/exchange_github_app_token" + )" + app_token="$(jq -r '.token // empty' <<<"$token_response")" + test -n "$app_token" + echo "::add-mask::$app_token" + echo "token=$app_token" >>"$GITHUB_OUTPUT" + - name: Publish normal non-force repair commit env: - PRIMARY_PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }} - FALLBACK_PUSH_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }} + WORKFLOW_PUSH_TOKEN: ${{ steps.target_app_token.outputs.token }} shell: bash run: | set -euo pipefail - workflow_push_token="${PRIMARY_PUSH_TOKEN:-${FALLBACK_PUSH_TOKEN:-}}" - if [ -z "$workflow_push_token" ]; then - echo "::error::No workflow-starting mutation credential is configured; refusing github.token publication." - exit 1 - fi + test -n "$WORKFLOW_PUSH_TOKEN" remote_head="$(git ls-remote origin refs/heads/fix/no-heuristic-model-job-timeouts | cut -f1)" test "$remote_head" = "$GITHUB_SHA" git config user.name "github-actions[bot]" @@ -97,5 +125,5 @@ jobs: git add -A git diff --cached --check git commit -m "fix(autofix): remove leaf model-compute and evidence heuristics" - git remote set-url origin "https://x-access-token:${workflow_push_token}@github.com/${GITHUB_REPOSITORY}.git" + git remote set-url origin "https://x-access-token:${WORKFLOW_PUSH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" git push origin HEAD:fix/no-heuristic-model-job-timeouts From 29520f3029ebe5ec95a985f066b77085185ba06a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 2 Sep 2026 11:13:12 +0000 Subject: [PATCH 4/7] fix(autofix): remove leaf model-compute and evidence heuristics --- .github/workflows/pr-review-autofix.yml | 28 ++++--------- CHANGELOG.md | 2 + docs/product-technical-gap-baseline.md | 10 +++++ ...review_autofix_writer_security_contract.py | 39 +++++++++++-------- 4 files changed, 42 insertions(+), 37 deletions(-) diff --git a/.github/workflows/pr-review-autofix.yml b/.github/workflows/pr-review-autofix.yml index 3da5a98ec9..d6fa7f8f44 100644 --- a/.github/workflows/pr-review-autofix.yml +++ b/.github/workflows/pr-review-autofix.yml @@ -23,16 +23,12 @@ permissions: jobs: autofix: runs-on: ubuntu-latest - # Bound the job well short of GitHub's 360-minute platform default. Setup - # (checkout, OIDC token exchange, OpenCode CLI install, context collection) - # is API/IO-bound and normally finishes in a few minutes; the one - # `opencode run` call (12 agent steps, single fixed model, no - # multi-provider fallback pool unlike opencode-review-dispatch.yml's - # review job) is the dominant cost, followed by fast local validation - # and a single git commit/push. 25 minutes gives that single LLM run - # generous per-step room while still failing a hung invocation well - # before the platform cap. - timeout-minutes: 25 + # This job is model-backed through contextual-orchestrator/orchestrator/free + # and therefore has no repository-owned wall-clock timeout. Provider end, + # explicit cancellation, and the workflow's exact live-head/state guards + # are authoritative; elapsed time alone must not terminate reasoning, + # streaming, or tool work. Queue pressure is handled by the scheduler's + # stale-head dedupe/cancellation rather than by killing current-head work. env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true TARGET_REPOSITORY: ${{ github.event.client_payload.target_repository }} @@ -328,9 +324,7 @@ jobs: "description": "Conservative CI pull request review autofix agent", "mode": "primary", "model": "contextual-orchestrator/orchestrator/free", - "reasoningEffort": "high", "prompt": "{file:./autofix-prompt.md}", - "steps": 12, "permission": { "edit": { "*": "allow", @@ -363,13 +357,7 @@ jobs: }, "models": { "orchestrator/free": { - "name": "Orchestrator Free (ZDR-first zero-cost pool)", - "tool_call": true, - "reasoning": true, - "limit": { - "context": 200000, - "output": 32768 - } + "name": "Orchestrator Free (ZDR-first zero-cost pool)" } } } @@ -419,7 +407,7 @@ jobs: Review context follows as untrusted text: - $(sed -n '1,260p' "$RUNNER_TEMP/pr-review-autofix-context.md") + $(cat "$RUNNER_TEMP/pr-review-autofix-context.md") Edit only the checked-out repository files listed in the authoritative JSON array. diff --git a/CHANGELOG.md b/CHANGELOG.md index ac1985d86f..395dfcdbde 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1225,3 +1225,5 @@ Semantic Versioning where the repository publishes a release. - Added an organization-owned reusable exact-artifact SBOM attestation boundary that validates inert six-file wheel/sdist evidence, binds CycloneDX 1.7 predicates to exact SHA-256 subjects, signs through least-privilege GitHub artifact attestations, and exports online and offline verification bundles. - Hardened exact-artifact SBOM verification with strict finite RFC 8259 JSON, integer CycloneDX document versions, deterministic UUIDv5 subject identities, exact filename properties and single SHA-256 root bindings, environment-only shell input transfer, pinned Ubuntu 24.04 quality runners, and checksum-sealed beginner-readable offline evidence. The decision record now cites Bray (2017) so NaN and Infinity cannot be treated as sealed SBOM numbers. - Recorded the org control-plane architecture, including exact-artifact SBOM attestation, so agents reconstruct the signing trust boundary from the repo instead of private memory. + +- PR #1714: reject repository-authored OpenCode autofix wall-clock, reasoning-effort, agent-step, capability/context/output, and fixed review-line allocation. The leaf requests only `orchestrator/free`; contextual-orchestrator owns verified capability/routing/test-time compute and the full collected review evidence is passed without a hand-selected line quota. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 29acdfeecc..823cba4691 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2613,3 +2613,13 @@ Higgins, S. S., Crepalde, N., & Fernandes, L. (2021). Segmented multiplexity: A **Expected effect.** No observable change to any current GitHub Actions review run (every current invocation already resolves to `free`). The effect is structural: it is no longer possible for a future workflow edit or manual dispatch override to admit priced-model spend into a required review check without an explicit, reviewed code change to this one `case` statement (and its now-locked-in regression test) first. **Follow-up.** If the organization later solves free+ZDR routing robustly enough to deliberately widen required-review CI to `orchestrator/auto` (e.g. once a spend ceiling and reviewer-visible cost evidence exist for that path), the change is exactly one `case` arm plus the corresponding assertions in `test_sidecar_pins_the_pool_to_free_for_github_actions` — this entry is the record of *why* it was narrowed, not a permanent prohibition. + + +### OpenCode autofix orchestration authority — PR #1714 + +- **Root cause:** the leaf workflow proposed `timeout-minutes: 25` and also carried repository-authored `reasoningEffort: high`, a 12-step agent budget, asserted tool/reasoning capabilities, fixed context/output limits, and a 260-line review-context cutoff. None of those leaf allocations had executable research/model evidence establishing them as decision authority. +- **Owner boundary:** `.github` requests exactly `contextual-orchestrator/orchestrator/free` through the gateway token. contextual-orchestrator owns provider discovery, verified capability admission, routing, and research-backed test-time compute; the leaf does not invent provider/model capability or compute limits. +- **Evidence contract:** the complete review context produced by the governed collector is passed to the model. If contextual-orchestrator cannot admit/serve the request under its verified capability/privacy/free-pool contracts, the path fails closed rather than silently sampling evidence or selecting a paid/provider fallback. +- **Termination contract:** provider completion, explicit cancellation, and exact live-head/state guards end model work. Scheduler stale-head dedupe/cancellation handles queue waste without terminating the sole current-head model run by elapsed time. +- **Regression:** `test_autofix_model_job_delegates_termination_and_compute_to_orchestrator` and `test_autofix_review_context_is_not_sampled_by_a_fixed_line_quota` forbid reintroduction of those leaf heuristics while preserving the exact `orchestrator/free` contract. +- **Status:** Proposed until the one-shot source repair self-removes and fresh exact-head Checks are GREEN. diff --git a/tests/test_pr_review_autofix_writer_security_contract.py b/tests/test_pr_review_autofix_writer_security_contract.py index b6e246a183..191050eb4e 100644 --- a/tests/test_pr_review_autofix_writer_security_contract.py +++ b/tests/test_pr_review_autofix_writer_security_contract.py @@ -31,14 +31,14 @@ def _step_header(workflow: str, step_name: str) -> str: return step[:run_start] -def test_writer_uses_the_gateway_free_pool_with_high_reasoning() -> None: - """Pin the write-capable pool and its deliberate high-reasoning budget.""" +def test_writer_uses_the_gateway_free_pool_without_leaf_compute_policy() -> None: + """Pin the gateway pool while forbidding leaf-owned test-time-compute policy.""" workflow = _workflow_text() assert f'"model": "{_TARGET_MODEL}"' in workflow assert '"orchestrator/free": {' in workflow assert workflow.count(f"MODEL: {_TARGET_MODEL}") == 2 - assert '"reasoningEffort": "high"' in workflow + assert '"reasoningEffort":' not in workflow assert "COPILOT_GITHUB_TOKEN" not in workflow @@ -96,21 +96,26 @@ def test_read_only_steps_do_not_prefer_mutation_credentials() -> None: assert "OPENCODE_APPROVE_TOKEN" not in header -def test_autofix_job_has_a_bounded_runtime() -> None: - """The autofix job must not fall back to GitHub's 360-minute platform default. - - Without a job-level timeout-minutes, a stuck OpenCode CLI invocation (a - rate-limited provider, a hung agent loop) could occupy a shared runner for - up to six hours. The job runs a single `opencode run` call against one - fixed model with a bounded 12-step agent budget -- not the multi-provider - fallback pool that justifies opencode-review-dispatch.yml's much longer - review job -- so it needs a much shorter bound than that job's default. - """ +def test_autofix_model_job_delegates_termination_and_compute_to_orchestrator() -> None: + """Leaf OpenCode config must not invent model-time or test-time-compute authority.""" workflow = _workflow_text() job = workflow.split(" autofix:\n", maxsplit=1)[1] job_header = job.split(" steps:\n", maxsplit=1)[0] - match = re.search(r"^ timeout-minutes: (\d+)$", job_header, flags=re.MULTILINE) - assert match is not None, "autofix must declare a job-level timeout-minutes" - autofix_timeout = int(match.group(1)) - assert 5 <= autofix_timeout <= 60 + assert "timeout-minutes:" not in job_header + assert '"model": "contextual-orchestrator/orchestrator/free"' in workflow + assert '"reasoningEffort":' not in workflow + assert '"steps": 12' not in workflow + assert '"tool_call": true' not in workflow + assert '"reasoning": true' not in workflow + assert '"limit": {' not in workflow + assert "no repository-owned wall-clock timeout" in job_header + assert "cancel-in-progress: false" in workflow + + +def test_autofix_review_context_is_not_sampled_by_a_fixed_line_quota() -> None: + """Exact review evidence must reach the model without a repository-authored line cutoff.""" + workflow = _workflow_text() + + assert "sed -n '1,260p'" not in workflow + assert '$(cat "$RUNNER_TEMP/pr-review-autofix-context.md")' in workflow From 6676ef9e1c4363ddc3ab758a843419918e4f77fd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:15:51 +0900 Subject: [PATCH 5/7] chore(autofix): remove completed source-fix workflow --- ...source-fix-pr1714-no-model-job-timeout.yml | 129 ------------------ 1 file changed, 129 deletions(-) delete mode 100644 .github/workflows/source-fix-pr1714-no-model-job-timeout.yml diff --git a/.github/workflows/source-fix-pr1714-no-model-job-timeout.yml b/.github/workflows/source-fix-pr1714-no-model-job-timeout.yml deleted file mode 100644 index 8be1d07c60..0000000000 --- a/.github/workflows/source-fix-pr1714-no-model-job-timeout.yml +++ /dev/null @@ -1,129 +0,0 @@ -name: Source Fix PR 1714 No Model Job Timeout - -on: - push: - branches: - - fix/no-heuristic-model-job-timeouts - paths: - - scripts/ci/source_fix_pr1714_no_model_job_timeout.py - - .github/workflows/source-fix-pr1714-no-model-job-timeout.yml - -concurrency: - group: source-fix-pr1714-${{ github.repository }}-${{ github.ref_name }} - cancel-in-progress: true - -permissions: - contents: read - id-token: write - -jobs: - repair: - runs-on: ubuntu-slim - steps: - - name: Checkout exact writer head - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - ref: ${{ github.sha }} - fetch-depth: 0 - persist-credentials: false - - - name: Revalidate exact remote head - shell: bash - run: | - set -euo pipefail - remote_head="$(git ls-remote origin refs/heads/fix/no-heuristic-model-job-timeouts | cut -f1)" - test -n "$remote_head" - test "$remote_head" = "$GITHUB_SHA" - - - name: Set up Python 3.14 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - with: - python-version: "3.14" - cache: pip - - - name: Install exact test toolchain - shell: bash - run: | - set -euo pipefail - python -m pip install --require-hashes -r requirements-opencode-review-ci-hashes.txt - - - name: Apply causal-owner repair - shell: bash - run: | - set -euo pipefail - python scripts/ci/source_fix_pr1714_no_model_job_timeout.py - python -m py_compile scripts/ci/source_fix_pr1714_no_model_job_timeout.py - git diff --check - - - name: Verify autofix timeout and writer-security contract - shell: bash - run: | - set -euo pipefail - python -m pytest \ - tests/test_pr_review_autofix_writer_security_contract.py \ - tests/test_pr_review_fix_scheduler.py \ - tests/test_required_workflow_queue_contract.py \ - -q - python -m compileall -q scripts tests - git diff --check - - - name: Verify exact repair scope - shell: bash - run: | - set -euo pipefail - allowed='^(.github/workflows/pr-review-autofix.yml|tests/test_pr_review_autofix_writer_security_contract.py|CHANGELOG.md|docs/product-technical-gap-baseline.md)$' - bad="$(git status --short | sed -E 's/^.. //' | grep -Ev "$allowed" || true)" - test -z "$bad" - remote_head="$(git ls-remote origin refs/heads/fix/no-heuristic-model-job-timeouts | cut -f1)" - test "$remote_head" = "$GITHUB_SHA" - - - name: Exchange repository-scoped OpenCode app token - id: target_app_token - shell: bash - env: - OIDC_AUDIENCE: opencode-github-action - OPENCODE_API_BASE_URL: https://api.opencode.ai - run: | - set -euo pipefail - test -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" - test -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" - request_url="${ACTIONS_ID_TOKEN_REQUEST_URL}" - separator="&" - case "$request_url" in - *\?*) ;; - *) separator="?" ;; - esac - oidc_response="$( - curl -fsS \ - -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \ - "${request_url}${separator}audience=${OIDC_AUDIENCE}" - )" - oidc_token="$(jq -r '.value // empty' <<<"$oidc_response")" - test -n "$oidc_token" - token_response="$( - curl -fsS \ - -X POST \ - -H "Authorization: Bearer ${oidc_token}" \ - "${OPENCODE_API_BASE_URL}/exchange_github_app_token" - )" - app_token="$(jq -r '.token // empty' <<<"$token_response")" - test -n "$app_token" - echo "::add-mask::$app_token" - echo "token=$app_token" >>"$GITHUB_OUTPUT" - - - name: Publish normal non-force repair commit - env: - WORKFLOW_PUSH_TOKEN: ${{ steps.target_app_token.outputs.token }} - shell: bash - run: | - set -euo pipefail - test -n "$WORKFLOW_PUSH_TOKEN" - remote_head="$(git ls-remote origin refs/heads/fix/no-heuristic-model-job-timeouts | cut -f1)" - test "$remote_head" = "$GITHUB_SHA" - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add -A - git diff --cached --check - git commit -m "fix(autofix): remove leaf model-compute and evidence heuristics" - git remote set-url origin "https://x-access-token:${WORKFLOW_PUSH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" - git push origin HEAD:fix/no-heuristic-model-job-timeouts From 8e60e577232b63e44a314d7fa59a02be83ff3d4e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:16:01 +0900 Subject: [PATCH 6/7] chore(autofix): remove completed source-fix driver --- .../source_fix_pr1714_no_model_job_timeout.py | 178 ------------------ 1 file changed, 178 deletions(-) delete mode 100644 scripts/ci/source_fix_pr1714_no_model_job_timeout.py diff --git a/scripts/ci/source_fix_pr1714_no_model_job_timeout.py b/scripts/ci/source_fix_pr1714_no_model_job_timeout.py deleted file mode 100644 index 2e06ccf166..0000000000 --- a/scripts/ci/source_fix_pr1714_no_model_job_timeout.py +++ /dev/null @@ -1,178 +0,0 @@ -"""One-shot repair for PR #1714's model-backed autofix no-heuristics contract.""" - -from __future__ import annotations - -from pathlib import Path - -WORKFLOW = Path(".github/workflows/pr-review-autofix.yml") -TEST = Path("tests/test_pr_review_autofix_writer_security_contract.py") -CHANGELOG = Path("CHANGELOG.md") -BASELINE = Path("docs/product-technical-gap-baseline.md") - - -def replace_once(text: str, old: str, new: str, label: str) -> str: - """Replace one literal block and fail closed if the exact head moved semantically.""" - count = text.count(old) - if count != 1: - raise SystemExit(f"PR1714 {label}: expected one literal block, found {count}") - return text.replace(old, new, 1) - - -def patch_workflow() -> None: - """Remove repository-authored model termination, compute, capability, and evidence heuristics.""" - text = WORKFLOW.read_text(encoding="utf-8") - timeout_old = ''' # Bound the job well short of GitHub's 360-minute platform default. Setup - # (checkout, OIDC token exchange, OpenCode CLI install, context collection) - # is API/IO-bound and normally finishes in a few minutes; the one - # `opencode run` call (12 agent steps, single fixed model, no - # multi-provider fallback pool unlike opencode-review-dispatch.yml's - # review job) is the dominant cost, followed by fast local validation - # and a single git commit/push. 25 minutes gives that single LLM run - # generous per-step room while still failing a hung invocation well - # before the platform cap. - timeout-minutes: 25 -''' - timeout_new = ''' # This job is model-backed through contextual-orchestrator/orchestrator/free - # and therefore has no repository-owned wall-clock timeout. Provider end, - # explicit cancellation, and the workflow's exact live-head/state guards - # are authoritative; elapsed time alone must not terminate reasoning, - # streaming, or tool work. Queue pressure is handled by the scheduler's - # stale-head dedupe/cancellation rather than by killing current-head work. -''' - text = replace_once(text, timeout_old, timeout_new, "autofix timeout block") - - text = replace_once( - text, - ' "reasoningEffort": "high",\n', - "", - "repository-authored reasoning effort", - ) - text = replace_once( - text, - ' "steps": 12,\n', - "", - "repository-authored agent step budget", - ) - capability_old = ''' "name": "Orchestrator Free (ZDR-first zero-cost pool)", - "tool_call": true, - "reasoning": true, - "limit": { - "context": 200000, - "output": 32768 - } -''' - capability_new = ''' "name": "Orchestrator Free (ZDR-first zero-cost pool)" -''' - text = replace_once( - text, - capability_old, - capability_new, - "leaf model capability and context/output declarations", - ) - text = replace_once( - text, - ' $(sed -n \'1,260p\' "$RUNNER_TEMP/pr-review-autofix-context.md")\n', - ' $(cat "$RUNNER_TEMP/pr-review-autofix-context.md")\n', - "review-context line quota", - ) - WORKFLOW.write_text(text, encoding="utf-8") - - -def patch_test() -> None: - """Replace heuristic-positive regressions with fail-closed authority contracts.""" - text = TEST.read_text(encoding="utf-8") - reasoning_old = '''def test_writer_uses_the_gateway_free_pool_with_high_reasoning() -> None: - """Pin the write-capable pool and its deliberate high-reasoning budget.""" - workflow = _workflow_text() - - assert f'"model": "{_TARGET_MODEL}"' in workflow - assert '"orchestrator/free": {' in workflow - assert workflow.count(f"MODEL: {_TARGET_MODEL}") == 2 - assert '"reasoningEffort": "high"' in workflow - assert "COPILOT_GITHUB_TOKEN" not in workflow -''' - reasoning_new = '''def test_writer_uses_the_gateway_free_pool_without_leaf_compute_policy() -> None: - """Pin the gateway pool while forbidding leaf-owned test-time-compute policy.""" - workflow = _workflow_text() - - assert f'"model": "{_TARGET_MODEL}"' in workflow - assert '"orchestrator/free": {' in workflow - assert workflow.count(f"MODEL: {_TARGET_MODEL}") == 2 - assert '"reasoningEffort":' not in workflow - assert "COPILOT_GITHUB_TOKEN" not in workflow -''' - text = replace_once( - text, - reasoning_old, - reasoning_new, - "stale high-reasoning positive regression", - ) - - marker = "def test_autofix_job_has_a_bounded_runtime() -> None:\n" - start = text.find(marker) - if start < 0 or text.find(marker, start + 1) >= 0: - raise SystemExit("PR1714 stale timeout test marker moved or duplicated") - replacement = '''def test_autofix_model_job_delegates_termination_and_compute_to_orchestrator() -> None: - """Leaf OpenCode config must not invent model-time or test-time-compute authority.""" - workflow = _workflow_text() - job = workflow.split(" autofix:\\n", maxsplit=1)[1] - job_header = job.split(" steps:\\n", maxsplit=1)[0] - - assert "timeout-minutes:" not in job_header - assert '"model": "contextual-orchestrator/orchestrator/free"' in workflow - assert '"reasoningEffort":' not in workflow - assert '"steps": 12' not in workflow - assert '"tool_call": true' not in workflow - assert '"reasoning": true' not in workflow - assert '"limit": {' not in workflow - assert "no repository-owned wall-clock timeout" in job_header - assert "cancel-in-progress: false" in workflow - - -def test_autofix_review_context_is_not_sampled_by_a_fixed_line_quota() -> None: - """Exact review evidence must reach the model without a repository-authored line cutoff.""" - workflow = _workflow_text() - - assert "sed -n '1,260p'" not in workflow - assert '$(cat "$RUNNER_TEMP/pr-review-autofix-context.md")' in workflow -''' - TEST.write_text(text[:start] + replacement, encoding="utf-8") - - -def append_traceability() -> None: - """Document the model-authority and complete-evidence boundary.""" - changelog = CHANGELOG.read_text(encoding="utf-8") - note = ( - "\n- PR #1714: reject repository-authored OpenCode autofix wall-clock, reasoning-effort, " - "agent-step, capability/context/output, and fixed review-line allocation. The leaf requests " - "only `orchestrator/free`; contextual-orchestrator owns verified capability/routing/test-time " - "compute and the full collected review evidence is passed without a hand-selected line quota.\n" - ) - if "PR #1714: reject repository-authored OpenCode autofix wall-clock" not in changelog: - CHANGELOG.write_text(changelog + note, encoding="utf-8") - - baseline = BASELINE.read_text(encoding="utf-8") - section = ''' - -### OpenCode autofix orchestration authority — PR #1714 - -- **Root cause:** the leaf workflow proposed `timeout-minutes: 25` and also carried repository-authored `reasoningEffort: high`, a 12-step agent budget, asserted tool/reasoning capabilities, fixed context/output limits, and a 260-line review-context cutoff. None of those leaf allocations had executable research/model evidence establishing them as decision authority. -- **Owner boundary:** `.github` requests exactly `contextual-orchestrator/orchestrator/free` through the gateway token. contextual-orchestrator owns provider discovery, verified capability admission, routing, and research-backed test-time compute; the leaf does not invent provider/model capability or compute limits. -- **Evidence contract:** the complete review context produced by the governed collector is passed to the model. If contextual-orchestrator cannot admit/serve the request under its verified capability/privacy/free-pool contracts, the path fails closed rather than silently sampling evidence or selecting a paid/provider fallback. -- **Termination contract:** provider completion, explicit cancellation, and exact live-head/state guards end model work. Scheduler stale-head dedupe/cancellation handles queue waste without terminating the sole current-head model run by elapsed time. -- **Regression:** `test_autofix_model_job_delegates_termination_and_compute_to_orchestrator` and `test_autofix_review_context_is_not_sampled_by_a_fixed_line_quota` forbid reintroduction of those leaf heuristics while preserving the exact `orchestrator/free` contract. -- **Status:** Proposed until the one-shot source repair self-removes and fresh exact-head Checks are GREEN. -''' - if "### OpenCode autofix orchestration authority — PR #1714" not in baseline: - BASELINE.write_text(baseline + section, encoding="utf-8") - - -def main() -> None: - """Apply production, regression, and traceability changes.""" - patch_workflow() - patch_test() - append_traceability() - - -if __name__ == "__main__": - main() From b2a96566bf91fd491f87aee0cfd2bc70d16e7775 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 21:19:20 +0900 Subject: [PATCH 7/7] test(autofix): complete successor cleanup delta --- tests/test_pr_review_autofix_writer_security_contract.py | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/test_pr_review_autofix_writer_security_contract.py b/tests/test_pr_review_autofix_writer_security_contract.py index 191050eb4e..6c5f642de7 100644 --- a/tests/test_pr_review_autofix_writer_security_contract.py +++ b/tests/test_pr_review_autofix_writer_security_contract.py @@ -2,7 +2,6 @@ from __future__ import annotations -import re from pathlib import Path