docs(doctoring): land #2247 keep-with-residual supersession verdict by seonghobae · Pull Request #2256 · ContextualWisdomLab/.github

seonghobae · 2026-09-17T21:42:07Z

Summary

Lands the keep-with-residual supersession verdict for docs(doctoring): post-#2242 schedule queue admission lever verdict #2247 into docs/doctoring/pr-2247-supersession-keep-residual-20260918.md.
Records three-dot / carryover evidence that docs(doctoring): ground coalesce fail-open N=600 and re-enable gate #2249 and docs(doctoring): Actions queue-wait remasure after #2228–#2244 #2252 do not fully succeed docs(doctoring): post-#2242 schedule queue admission lever verdict #2247's admission-levers doctoring residual; do not close docs(doctoring): post-#2242 schedule queue admission lever verdict #2247 as superseded.
Docs-only; no workflow or scripts/ci/ changes.

Test plan

Confirm the PR is a single new doctoring markdown file vs main.
Confirm verdict text matches the source keep-open residual findings (unique path, run ids, rejected levers).
Confirm docs(doctoring): post-#2242 schedule queue admission lever verdict #2247 remains open pending its own residual landing (this PR does not merge or close docs(doctoring): post-#2242 schedule queue admission lever verdict #2247).

Made with Cursor

Preserve the live three-dot / carryover evidence that #2249 and #2252 do not fully succeed #2247's admission-levers doctoring residual. Co-authored-by: Cursor <cursoragent@cursor.com>

coderabbitai · 2026-09-17T21:42:14Z

Warning

Review limit reached

Next included review available in 58 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9aa8963f-4a42-4076-88fc-0110d327875f

📥 Commits

Reviewing files that changed from the base of the PR and between e6334e2 and dc27485.

📒 Files selected for processing (26)

.github/workflows/codeql-scan-dispatch.yml
.github/workflows/opencode-review-dispatch.yml
CHANGELOG.d/20260920-strix-trusted-binder-runtime-fixture.md
CHANGELOG.md
docs/doctoring/pr-2247-supersession-keep-residual-20260918.md
docs/product-technical-gap-baseline.md
requirements-strix-ci-hashes.txt
requirements-strix-ci.txt
scripts/ci/actions_queue_health.py
scripts/ci/actions_queue_health_core.py
scripts/ci/strix_quick_gate.sh
scripts/ci/test_strix_quick_gate.sh
tests/test_actions_queue_health_cancelled_before_runner.py
tests/test_actions_queue_health_post_evidence_retry.py
tests/test_actions_queue_health_snapshot_consistency.py
tests/test_actions_queue_health_terminal_preexecution.py
tests/test_codeql_scan_dispatch_ghas_credential_contract.py
tests/test_noema_document_review_context.py
tests/test_noema_review_document_boundaries.py
tests/test_opencode_agent_contract.py
tests/test_organization_commercial_readiness_loop_receipt_contract.py
tests/test_pr_review_autofix_nvidia_nim_contract.py
tests/test_pr_review_merge_scheduler.py
tests/test_strix_evidence_binder_trusted_path.py
tests/test_strix_runtime_dependencies.py
tests/test_strix_trusted_fixture_boundary.py

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Semgrep OSS and Bandit B310 Medium alerts on main flagged dynamic urllib use in CodeQL identity and Strix evidence helpers. Fail closed unless the URL is https://api.github.com so file:// and arbitrary hosts cannot reach urlopen. Co-authored-by: Cursor <cursoragent@cursor.com>

Bumps [anyio](https://github.com/agronholm/anyio) from 4.14.0 to 4.14.2. - [Release notes](https://github.com/agronholm/anyio/releases) - [Commits](agronholm/anyio@4.14.0...4.14.2) --- updated-dependencies: - dependency-name: anyio dependency-version: 4.14.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Replace retired urllib urlopen monkeypatches with direct CodeQL and Strix dedicated-opener patches. Remove the PR-specific global conftest bridge so both security helpers exercise the same explicit transport boundary without live network access.

Clears Bandit/Semgrep B310 on shared scripts/ci urlopen so the anyio bump is not blocked by unrelated SAST.

Restore the unrelated #2269 URL-opener paths to protected main while retaining the AnyIO 4.14.2 pin and hashes. The URL/redirect responsibility remains in canonical #2279; this PR owns only the dependency security update. Validated with 56 focused tests, 3,335 full tests plus 28 skipped/40 subtests, warnings-as-errors, diff check, and pip-audit reporting no known vulnerabilities.

…e the consumer root Green step for a8d6261. The 24 specialized cases in test_strix_quick_gate.sh installed the trusted gate/model/binder into $repo_root_dir/scripts/ci and ran ./scripts/ci/strix_quick_gate.sh, so a consumer-root binder lookup could never fail there and masked the #2292 defect. Each case now materializes into $tmp_dir/trusted-source/scripts/ci and runs the gate from that directory with STRIX_REPO_ROOT=$repo_root_dir, which keeps the old repo-root semantics (the gate defaults REPO_ROOT to SCRIPT_DIR/../..). Evidence: - tests/test_strix_trusted_fixture_boundary.py: fails on a8d6261 (CI job 106083294309), passes here. - bash scripts/ci/test_strix_quick_gate.sh on Linux, umask 022: a8d6261 PASS (rc=0, 727s) and this commit PASS (rc=0, 726s). - strix-related pytest (8 files): 242 passed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5o6j4zfxGPdRaH4Lug8UY

Remove the unused queue-health collector and CLI, validate run IDs at the shared parsing boundary, and exercise document-reader and scheduler edge cases. The main baseline failed the 100% gate before PR #2358.

…wner

- Select a target-scoped credential that can actually read code-scanning analyses before the GHAS base/head configuration identity check, instead of the first non-empty token (the OpenCode app token returns 403). Ported from #2275. - Replace the set-membership URL assertion flagged by CodeQL py/incomplete-url-substring-sanitization with an issubset check. Ported from #2351.

Preserve #2385, #2359, and #2286 as explicit parents while composing their byte-identical overlapping locks and endpoint contract. This creates one exact-head bootstrap stack for the coverage-image, 100% coverage, AnyIO audit, and CodeQL dispatch failures without force-push, rebase, or delta disposal.

seonghobae · 2026-09-26T16:59:34Z

Admission correction — exact current head 59a3cd594e4dd01d26349ce27fdbf7ee82f203bf was re-fetched immediately before this transition. The PR remains Open and its branch, commits, reviews, and valid delta are preserved, but it is not merge-admissible: terminal workflow failure: Python Security:failure. Moving it to Draft/Proposed records the live blocker without retiring or closing the work. Return it to Ready only after the same exact head (or a non-destructive reconciled successor) is mergeable, has no substantive unresolved review state, and has terminal required Checks.

seonghobae · 2026-09-26T17:08:46Z

Run 35278138086 / job 105467909801 reported the same two stale B310 findings.

Root-cause repair (exact-head preserving, non-force).

The failed Python Security evidence was inherited from the stale central base, not introduced by this PR's documentation delta. I ordinary-restacked this branch on current canonical security/CodeQL owner #2291 (b90d873e67860944308d5cef919a1f95243ef98f) using a two-parent commit; the PR remains Open and Draft.

Post-restack evidence:

effective delta versus fix(strix): resolve evidence binder from trusted source #2291: exactly one existing docs/doctoring/ file;
no force push or history rewrite;
git diff --check: clean;
current owner security validation on the reconstructed tree: Bandit MEDIUM+/MEDIUM+ scan 0 findings; test_strix_runtime_dependencies.py + test_codeql_scan_dispatch_ghas_credential_contract.py: 5 passed.

New exact head: dc274855cc037418454f87ff88630928bf49fadb. Fresh hosted Checks are required before any Ready/merge decision; queued, pending, skipped, or absent Checks are not GREEN.

seonghobae · 2026-09-26T17:12:56Z

Concurrent-head re-audit: dc274855cc037418454f87ff88630928bf49fadb (base main@e6334e229581a918e2f22de18733b76fa65d7e71, 45 ahead / 0 behind).

새 head는 0-behind·mergeable·미해결 thread 0·활성 CHANGES_REQUESTED 0·terminal workflow failure 0입니다. Checks는 queued/pending이나 review admission blocker가 아니므로 Ready로 복구합니다.

이전 head의 approval/Checks는 병합 근거로 승계하지 않습니다. Current head의 terminal Checks와 qualifying independent approval 전에는 merge하지 않습니다.

opencode-agent

Pull request overview

OpenCode reviewed the current-head product diff. Coverage is a separate gate.

Changed files

.github/workflows/codeql-scan-dispatch.yml — GitHub Actions review job
.github/workflows/opencode-review-dispatch.yml — GitHub Actions review job
CHANGELOG.d/20260920-strix-trusted-binder-runtime-fixture.md — repository behavior
CHANGELOG.md — repository behavior
docs/doctoring/pr-2247-supersession-keep-residual-20260918.md — operator or user guidance
docs/product-technical-gap-baseline.md — operator or user guidance
requirements-strix-ci-hashes.txt — repository behavior
requirements-strix-ci.txt — repository behavior
scripts/ci/actions_queue_health.py — review and security gate shell path
scripts/ci/actions_queue_health_core.py — review and security gate shell path
scripts/ci/strix_quick_gate.sh — review and security gate shell path
scripts/ci/test_strix_quick_gate.sh — review and security gate shell path
tests/test_actions_queue_health_cancelled_before_runner.py — regression suite
tests/test_actions_queue_health_post_evidence_retry.py — regression suite
tests/test_actions_queue_health_snapshot_consistency.py — regression suite
tests/test_actions_queue_health_terminal_preexecution.py — regression suite
tests/test_codeql_scan_dispatch_ghas_credential_contract.py — regression suite
tests/test_noema_document_review_context.py — regression suite
tests/test_noema_review_document_boundaries.py — regression suite
tests/test_opencode_agent_contract.py — regression suite
tests/test_organization_commercial_readiness_loop_receipt_contract.py — regression suite
tests/test_pr_review_autofix_nvidia_nim_contract.py — regression suite
tests/test_pr_review_merge_scheduler.py — regression suite
tests/test_strix_evidence_binder_trusted_path.py — regression suite
tests/test_strix_runtime_dependencies.py — regression suite
tests/test_strix_trusted_fixture_boundary.py — regression suite

Changed behavior

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: codeql-scan-dispatch.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: codeql-scan-dispatch.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Workflow: opencode-review-dispatch.yml"]
  S2 --> I2["GitHub Actions review job"]
  I2 --> R2["Review risk: Workflow: opencode-review-dispatch.yml"]
  R2 --> V2["actionlint plus required checks"]
  Evidence --> S3["Repository file: 20260920-strix-trusted-binder-runtime-fixture.md"]
  S3 --> I3["repository behavior"]
  I3 --> R3["Review risk: Repository file: 20260920-strix-trusted-binder-runtime-fixture.md"]
  R3 --> V3["required checks"]
  Evidence --> S4["Repository file: CHANGELOG.md"]
  S4 --> I4["repository behavior"]
  I4 --> R4["Review risk: Repository file: CHANGELOG.md"]
  R4 --> V4["required checks"]
  Evidence --> S5["Docs: pr-2247-supersession-keep-residual-20260918.md (2 files)"]
  S5 --> I5["operator or user guidance"]
  I5 --> R5["Review risk: Docs: pr-2247-supersession-keep-residual-20260918.md (2 files)"]
  R5 --> V5["docs review"]
  Evidence --> S6["Repository file: requirements-strix-ci-hashes.txt"]
  S6 --> I6["repository behavior"]
  I6 --> R6["Review risk: Repository file: requirements-strix-ci-hashes.txt"]
  R6 --> V6["required checks"]
  Evidence --> S7["Repository file: requirements-strix-ci.txt"]
  S7 --> I7["repository behavior"]
  I7 --> R7["Review risk: Repository file: requirements-strix-ci.txt"]
  R7 --> V7["required checks"]
  Evidence --> S8["CI script: actions_queue_health.py"]
  S8 --> I8["review and security gate shell path"]
  I8 --> R8["Review risk: CI script: actions_queue_health.py"]
  R8 --> V8["bash -n plus Strix self-test"]
  Evidence --> S9["CI script: actions_queue_health_core.py"]
  S9 --> I9["review and security gate shell path"]
  I9 --> R9["Review risk: CI script: actions_queue_health_core.py"]
  R9 --> V9["bash -n plus Strix self-test"]
  Evidence --> S10["CI script: strix_quick_gate.sh"]
  S10 --> I10["review and security gate shell path"]
  I10 --> R10["Review risk: CI script: strix_quick_gate.sh"]
  R10 --> V10["bash -n plus Strix self-test"]
  Evidence --> S11["CI script: test_strix_quick_gate.sh"]
  S11 --> I11["review and security gate shell path"]
  I11 --> R11["Review risk: CI script: test_strix_quick_gate.sh"]
  R11 --> V11["bash -n plus Strix self-test"]
  Evidence --> S12["Test: test_actions_queue_health_cancelled_before_runner.py (14 files)"]
  S12 --> I12["regression suite"]
  I12 --> R12["Review risk: Test: test_actions_queue_health_cancelled_before_runner.py (14 files)"]
  R12 --> V12["targeted test run"]

Findings

No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.

Head SHA: dc274855cc037418454f87ff88630928bf49fadb
Workflow run: 36279935746
Workflow attempt: 1
Coverage gate: failure

Review outcome

Coverage is a gate, not the review. This body reviews the changed product files.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: codeql-scan-dispatch.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: codeql-scan-dispatch.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Workflow: opencode-review-dispatch.yml"]
  S2 --> I2["GitHub Actions review job"]
  I2 --> R2["Review risk: Workflow: opencode-review-dispatch.yml"]
  R2 --> V2["actionlint plus required checks"]
  Evidence --> S3["Repository file: 20260920-strix-trusted-binder-runtime-fixture.md"]
  S3 --> I3["repository behavior"]
  I3 --> R3["Review risk: Repository file: 20260920-strix-trusted-binder-runtime-fixture.md"]
  R3 --> V3["required checks"]
  Evidence --> S4["Repository file: CHANGELOG.md"]
  S4 --> I4["repository behavior"]
  I4 --> R4["Review risk: Repository file: CHANGELOG.md"]
  R4 --> V4["required checks"]
  Evidence --> S5["Docs: pr-2247-supersession-keep-residual-20260918.md (2 files)"]
  S5 --> I5["operator or user guidance"]
  I5 --> R5["Review risk: Docs: pr-2247-supersession-keep-residual-20260918.md (2 files)"]
  R5 --> V5["docs review"]
  Evidence --> S6["Repository file: requirements-strix-ci-hashes.txt"]
  S6 --> I6["repository behavior"]
  I6 --> R6["Review risk: Repository file: requirements-strix-ci-hashes.txt"]
  R6 --> V6["required checks"]
  Evidence --> S7["Repository file: requirements-strix-ci.txt"]
  S7 --> I7["repository behavior"]
  I7 --> R7["Review risk: Repository file: requirements-strix-ci.txt"]
  R7 --> V7["required checks"]
  Evidence --> S8["CI script: actions_queue_health.py"]
  S8 --> I8["review and security gate shell path"]
  I8 --> R8["Review risk: CI script: actions_queue_health.py"]
  R8 --> V8["bash -n plus Strix self-test"]
  Evidence --> S9["CI script: actions_queue_health_core.py"]
  S9 --> I9["review and security gate shell path"]
  I9 --> R9["Review risk: CI script: actions_queue_health_core.py"]
  R9 --> V9["bash -n plus Strix self-test"]
  Evidence --> S10["CI script: strix_quick_gate.sh"]
  S10 --> I10["review and security gate shell path"]
  I10 --> R10["Review risk: CI script: strix_quick_gate.sh"]
  R10 --> V10["bash -n plus Strix self-test"]
  Evidence --> S11["CI script: test_strix_quick_gate.sh"]
  S11 --> I11["review and security gate shell path"]
  I11 --> R11["Review risk: CI script: test_strix_quick_gate.sh"]
  R11 --> V11["bash -n plus Strix self-test"]
  Evidence --> S12["Test: test_actions_queue_health_cancelled_before_runner.py (14 files)"]
  S12 --> I12["regression suite"]
  I12 --> R12["Review risk: Test: test_actions_queue_health_cancelled_before_runner.py (14 files)"]
  R12 --> V12["targeted test run"]

opencode-agent · 2026-09-27T10:41:36Z

OpenCode Review Overview

Head SHA: dc274855cc037418454f87ff88630928bf49fadb
Workflow run: 36279935746
Workflow attempt: 1
Gate result: COVERAGE_BLOCKED
Coverage gate: failure
Model pool: unknown
Verdict: COVERAGE_BLOCKED
Formal review: docs(doctoring): land #2247 keep-with-residual supersession verdict #2256 (review)

Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment.

docs(doctoring): record #2247 keep-with-residual supersession verdict

59a3cd5

Preserve the live three-dot / carryover evidence that #2249 and #2252 do not fully succeed #2247's admission-levers doctoring residual. Co-authored-by: Cursor <cursoragent@cursor.com>

seonghobae and others added 7 commits September 18, 2026 18:39

test(security): pin GitHub API redirect credential boundary

225260a

fix(security): contain GitHub API redirects to admitted origin

0ae2204

test(security): pin Strix redirect credential boundary

062663a

fix(security): contain Strix GitHub API redirects

2708a6b

test(security): align Strix transport seam with dedicated opener

4dcd25c

seonghobae added documentation Improvements or additions to documentation priority: medium Normal-priority or P2 work labels Sep 19, 2026 — with ChatGPT Codex Connector

seonghobae mentioned this pull request Sep 19, 2026

chore(metadata): record public-surface label taxonomy wave 3 #1653

Draft

seonghobae added 18 commits September 19, 2026 19:13

merge(security): carry #2269 urllib GitHub API opener into #2278

6d10002

Clears Bandit/Semgrep B310 on shared scripts/ci urlopen so the anyio bump is not blocked by unrelated SAST.

merge: carry AnyIO lock update onto protected owner

c51c8d2

fix(opencode): materialize every coverage lock input

e43a75b

docs(gap): bind coverage repair to canonical PR

c4a73a1

test(strix): bind evidence helper to trusted source root

513302a

fix(strix): resolve evidence binder from trusted source

c08b13d

test(strix): materialize trusted binder fixtures

ca7e1e7

fix(strix): restore complete verified fixture tree

db1fd61

test(strix): require consumer-free trusted binder fixture

fb9c0e2

repair(strix): restore executable harness after binary blob corruption

78b33a8

test(strix): require binder-free consumer fixture

191bd63

test(strix): separate trusted gate from consumer root

ef1a866

docs(strix): bind consumer isolation evidence to exact commits

abc9a7d

docs(strix): describe separated trusted runtime fixture

00082e8

test(strix): retain canonical gate source under scan

782d67b

fix(deps): restore AnyIO owner isolation

8a5251b

seonghobae and others added 18 commits September 20, 2026 22:09

test(strix): red specialized fixture owner boundary

a8d6261

test(strix): pin trusted evidence-binder path

1794626

repair(codeql): restore exact endpoint-set assertion

657d104

chore(foundation): converge dependency and CodeQL repairs

f1a8dc8

fix(opencode): adopt AnyIO security prerequisite

42e4198

fix(test-gate): restore full branch coverage

38cfcae

Remove the unused queue-health collector and CLI, validate run IDs at the shared parsing boundary, and exercise document-reader and scheduler edge cases. The main baseline failed the 100% gate before PR #2358.

test(queue-health): scope permission assertion to workflow token

21247ef

test(queue-health): isolate collector edge cases

57c168b

repair(foundation): converge CodeQL endpoint contract into coverage o…

f229816

…wner

fix(security): update AnyIO lock for audit gate

3b3ce16

fix(ci): bind AnyIO security pin to Strix input

8e1aba9

merge: adopt current CI owner and repair CodeQL URL oracle

361a9eb

test(strix): require Job Analysis authority context

1fd22f4

fix(strix): include Job Analysis authority context

808a8a7

docs(strix): record Job Analysis authority context

b90d873

seonghobae marked this pull request as draft September 26, 2026 17:01

merge(owner): restack doctoring evidence on current security stack

dc27485

seonghobae marked this pull request as ready for review September 26, 2026 17:14

opencode-agent Bot requested changes Sep 27, 2026

View reviewed changes

Navigation Menu

docs(doctoring): land #2247 keep-with-residual supersession verdict - #2256

docs(doctoring): land #2247 keep-with-residual supersession verdict#2256
seonghobae wants to merge 45 commits into
mainfrom
docs/pr-2247-supersession-keep-residual-20260918

seonghobae commented Sep 17, 2026

Uh oh!

coderabbitai Bot commented Sep 17, 2026 •

edited

Loading

Review limit reached

Uh oh!

seonghobae commented Sep 26, 2026

Uh oh!

seonghobae commented Sep 26, 2026

Uh oh!

seonghobae commented Sep 26, 2026

Uh oh!

opencode-agent Bot left a comment

Uh oh!

opencode-agent Bot commented Sep 27, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

seonghobae commented Sep 17, 2026

Summary

Test plan

Uh oh!

coderabbitai Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

seonghobae commented Sep 26, 2026

Uh oh!

seonghobae commented Sep 26, 2026

Uh oh!

seonghobae commented Sep 26, 2026

Uh oh!

opencode-agent Bot left a comment

Choose a reason for hiding this comment

Pull request overview

Changed files

Changed behavior

Findings

Review outcome

Changed-File Evidence Map

Uh oh!

opencode-agent Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

OpenCode Review Overview

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 17, 2026 •

edited

Loading

opencode-agent Bot commented Sep 27, 2026 •

edited

Loading