feat(coverage): add bounded PyO3 peer-evidence gate - #789
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughPyO3/maturin 네이티브 확장 수집 실패 분류기와 안전한 증거 파일 처리를 추가했습니다. 정확한 PR HEAD의 Python·Rust·package CheckRun 성공을 검증하고, 결과를 OpenCode 승인 흐름과 품질 CI에 연결했습니다. ChangesPython 네이티브 확장 peer-gate
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant PythonTest as Python 테스트 실행
participant Classifier as classify-pytest
participant GitHub as GitHub CheckRuns
participant PeerGate as require-checks
participant Approval as OpenCode 승인 흐름
PythonTest->>Classifier: 로그·pyproject 스냅샷·변경 파일 전달
Classifier-->>PythonTest: PASS 또는 DEFERRED 모듈명
Approval->>GitHub: PR HEAD의 CheckRun 조회
GitHub-->>PeerGate: Python·Rust·package CheckRun JSON
PeerGate-->>Approval: exact-head 성공 여부
Approval-->>Approval: peer check 충족 시 승인 진행
Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent address Integrate the published PyO3 native-extension helper into the protected central OpenCode coverage/review path on this same branch; keep the PR Draft until the integration is complete and exact-head evidence passes. Mirror the existing fail-closed R peer-evidence pattern rather than creating a second privileged reviewer. Required behavior:
Update the doctoring and CHANGELOG to distinguish source-only measurement, trusted native peer evidence, and remaining interpretation limits. Preserve immutable called-workflow source, reviewer credentials, NVIDIA/OpenCode model policy, independent approval, unresolved-thread, and branch-protection boundaries. |
|
@jules Implement the remaining central workflow integration on this existing Draft PR. Preserve the published helper and fail-closed trust boundary; do not create another PR or temporary workflow. Required scope:
Do not build PR-selected native code in the central sandbox, add a compatibility stub, skip product tests, use networked PR execution, change reviewer tokens or NVIDIA/OpenCode policy, weaken approval/protection gates, mark Ready, merge, or release. Commit as normal descendants without force-push, and report exact verification commands and the final head SHA. |
|
@jules Implement the remaining integration directly on this branch; do not create any temporary, self-modifying, encoded-patch, or branch-writing workflow. Required GREEN slice:
After integration, rerun OpenCode review for unchanged |
|
@jules Integrate the committed helper into the central Required fail-closed flow:
Do not build PR-selected native code inside the central sandbox, introduce a Python stub, auto-approve, weaken required checks, use COPILOT_GITHUB_TOKEN, or disturb the existing reviewer-agent secret contract. Update APA 7 doctoring and the authoritative changelog after GREEN. |
|
@coderabbitai Review the current Draft head |
Rate Limit Exceeded
|
|
Prepare the next bounded integration only after For the eventual current-main integration:
Keep Draft. Do not mutate the authoritative workflow from the pre-#759 base, approve, or merge. |
|
@jules Implement the existing TDD RED workflow contracts on exact live head Precondition: before every write, re-read the live head and stop without mutation unless it is the expected current head or your own direct descendant. Coverage integrationIn Initialize exactly: python_native_peer_check_required=0Only after a Python configured/default pytest/coverage command actually fails:
python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" classify-pytest \
--log "$log_file" \
--pyproject "$project_dir/pyproject.toml" \
--changed-files "$changed_files_file" \
--repo-root "$COVERAGE_SOURCE_WORKDIR"
and set In the compact PASS decision, when the variable is 1, emit exactly: Do not build/install PR-selected native code, add a Python stub, skip tests, or grant network access. Approval integrationMirror—but do not replace—the existing R peer-check pattern. Add independent functions that:
python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" require-checks \
--checks-json "$checks_file" \
--head-sha "$HEAD_SHA" \
--required-check "CI::python" \
--required-check "CI::rust" \
--required-check "CI::package"
Call this gate in both approval paths that already call Permanent tests and verificationMake the current tests GREEN without weakening them: python -m pytest -q \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_nested_project.py \
tests/test_python_native_extension_peer_gate_workflow_contract.pyThen run the permanent Python 3.10/3.14 quality workflow, focused and complete 100% production statement/branch coverage, interrogate 100%, compileall, actionlint, full central tests, security and supply-chain checks. Fix actual failures only. Preserve After GREEN, report the exact final SHA and verification commands in a PR comment. Do not request approval or change Draft state. |
|
Exact-head quality run @jules Implement the central workflow integration now rather than weakening these tests. Preserve the existing R peer gate and privileged reviewer chain. After GREEN, run full central coverage/docstrings/actionlint and replay OpenCode review against exact fast-mlsirm heads #546, #549, and #550. |
|
@opencode-agent address Fix the exact current-head quality failure on Run
Implement the documented fail-closed flow:
After GREEN, run all 90 focused tests at 100% statement/branch coverage, the complete central suite, interrogate 100%, compileall, actionlint, Python 3.10 compatibility, security workflows, and exact-head review. Keep Draft, |
|
@jules Implement the missing production integration on current branch |
|
@opencode-agent address Implement the committed workflow-integration RED contract on this Draft branch. Do not weaken the helper or tests. Preserve the existing R peer gate and reviewer credential chain. The central coverage job must capture bounded combined pytest output and status, classify only the exact unchanged maturin/PyO3 module-absence collection failure, then require trusted exact-head After GREEN, run the permanent workflow contracts, full central coverage/docstrings/actionlint/security, then replay exact current heads of fast-mlsirm #546, #549, and #550. |
|
@opencode-agent address A new RED trust-boundary contract is committed at |
|
@jules Apply and remove the committed one-shot patcher python3 scripts/ci/apply_pyo3_peer_gate_workflow_integration.py
rm scripts/ci/apply_pyo3_peer_gate_workflow_integration.py
python3 -m coverage erase
python3 -m coverage run --branch -m pytest -q \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_nested_project.py \
tests/test_python_native_extension_peer_gate_workflow_contract.py
python3 -m coverage report \
--include=scripts/ci/python_native_extension_peer_gate.py \
--show-missing --fail-under=100
python3 -m pytest -q \
tests/test_opencode_agent_contract.py \
tests/test_repository_branch_coverage_review_schedulers.py
python3 -m compileall -q \
scripts/ci/python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_nested_project.py \
tests/test_python_native_extension_peer_gate_workflow_contract.pyThe reviewed local proof is 91 focused tests and 100% helper statement/branch coverage. The patch also removes the temporary source-snapshot workflow and the duplicate quality workflow. Keep only |
|
@opencode-agent address The branch now contains |
|
@jules @opencode-agent The implementation patcher remains committed at exact head |
|
/oc Complete the current Draft PR by applying the already reviewed permanent integration directly; do not add or retain another one-shot/branch-writer workflow.
Keep Draft until a workflow-free exact head is green. Do not build PR-selected native code in the central sandbox, alter reviewer credentials, weaken branch protection, or introduce |
|
@opencode-agent address Exact head
Apply the reviewed integration directly to Preserve the existing R peer gate and reviewer credential chain. The PyO3 classifier is a non-success deferral only. Approval must query live exact-head After direct integration, delete the patcher and temporary workflows, update permanent workflow contracts/doctoring/changelog, run Python 3.10/3.14, complete central tests, 100% production statement/branch coverage, docstrings, compilation, actionlint, security and supply-chain gates on one unchanged head. Keep Draft until GREEN. |
|
@opencode-agent address The branch has been reduced to a reviewable permanent-source state at exact head Complete the vertical slice through ordinary reviewed commits only:
Prove the exact |
|
@opencode-agent address Integrate the published PyO3 deferral helper into the permanent central workflow on exact current Draft head Required bounded implementation:
Run: python -m coverage erase
python -m coverage run -m pytest -q \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_nested_project.py \
tests/test_python_native_extension_peer_gate_workflow_contract.py
python -m coverage report
pytest -q
python -m interrogate scripts/ci
python -m compileall -q scripts/ci testsThen rerun exact-head CodeQL, Python Security, SAST, Security Scan, Secret Scan, OSV, Scorecard, SBOM, CodeRabbit/OpenCode/Noema. Keep Draft until the complete unchanged head is GREEN and independently approved. |
|
Additional current-head hardening before GREEN:
Preserve 100% branch coverage and Python 3.10 compatibility. |
|
@opencode-agent address Complete the permanent integration for exact head Wire
Update the permanent workflow contracts, quality workflow path/test/compile coverage for every current helper/test/doctoring file, authoritative doctoring and CHANGELOG. Run Python 3.10 compatibility, Python 3.14 focused and complete tests, 100% production statement/branch/docstrings, actionlint, compilation, all security/supply-chain gates, and keep Draft until the workflow-free exact head succeeds. |
|
/opencode Continue directly on The helper tests pass, but the permanent workflow-contract tests correctly fail because the gate has not yet been integrated into
Run the focused helper and workflow-contract suite first, then the complete central quality/coverage/docstring/compile/actionlint/security suite. Commit the minimal integration directly to the current branch. |
|
@opencode-agent Complete the missing permanent workflow integration on current Draft head Exact failure evidence: quality run Implement the bounded integration directly in permanent source:
Run the focused 90-test gate, complete central 100% statement/branch coverage, production docstrings, Python 3.10/3.14 compilation, actionlint, and clean-tree verification. Keep Draft; do not approve, merge, tag, release, or publish. |
|
/oc Complete the missing permanent workflow integration on exact head Directly integrate the bounded classifier and approval evidence into the permanent review workflow:
Run all five focused peer-gate test files, complete central statement/branch coverage and production docstrings, Python 3.10/3.14 compilation, actionlint, and |
|
@opencode-agent address Apply the exact-current-head integration request already specified for |
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
fix/pyo3-native-peer-gatecannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintofix/pyo3-native-peer-gate, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 789 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/pyo3-native-peer-gate
# rebase path only: git push --force-with-lease origin HEAD:fix/pyo3-native-peer-gate- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Workflow: python-native-extension-peer-gate-quality-ci.yml"]
S2 --> I2["GitHub Actions review job"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["actionlint plus required checks"]
Evidence --> S3["Repository file: AGENTS.md"]
S3 --> I3["repository behavior"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["required checks"]
Evidence --> S4["Repository file: ARCHITECTURE.md"]
S4 --> I4["repository behavior"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["required checks"]
Evidence --> S5["Repository file: CHANGELOG.md"]
S5 --> I5["repository behavior"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["required checks"]
Evidence --> S6["Docs: python-native-extension-peer-evidence.md (2 files)"]
S6 --> I6["operator or user guidance"]
I6 --> Conflict["Merge conflict blocks this path"]
Conflict --> V6["docs review"]
Evidence --> S7["CI script: load_contextual_orchestrator_token.sh"]
S7 --> I7["review and security gate shell path"]
I7 --> Conflict["Merge conflict blocks this path"]
Conflict --> V7["bash -n plus Strix self-test"]
Evidence --> S8["CI script: opencode_review_receipt_gate.py"]
S8 --> I8["review and security gate shell path"]
I8 --> Conflict["Merge conflict blocks this path"]
Conflict --> V8["bash -n plus Strix self-test"]
Evidence --> S9["CI script: python_native_extension_peer_gate.py"]
S9 --> I9["review and security gate shell path"]
I9 --> Conflict["Merge conflict blocks this path"]
Conflict --> V9["bash -n plus Strix self-test"]
Evidence --> S10["Test: test_contextual_orchestrator_review_sidecar_contract.py (10 files)"]
S10 --> I10["regression suite"]
I10 --> Conflict["Merge conflict blocks this path"]
Conflict --> V10["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
fc261aa82efad766cf266f2afd94366a621c36eb - Workflow run: 33345713212
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Workflow: python-native-extension-peer-gate-quality-ci.yml"]
S2 --> I2["GitHub Actions review job"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["actionlint plus required checks"]
Evidence --> S3["Repository file: AGENTS.md"]
S3 --> I3["repository behavior"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["required checks"]
Evidence --> S4["Repository file: ARCHITECTURE.md"]
S4 --> I4["repository behavior"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["required checks"]
Evidence --> S5["Repository file: CHANGELOG.md"]
S5 --> I5["repository behavior"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["required checks"]
Evidence --> S6["Docs: python-native-extension-peer-evidence.md (2 files)"]
S6 --> I6["operator or user guidance"]
I6 --> Conflict["Merge conflict blocks this path"]
Conflict --> V6["docs review"]
Evidence --> S7["CI script: load_contextual_orchestrator_token.sh"]
S7 --> I7["review and security gate shell path"]
I7 --> Conflict["Merge conflict blocks this path"]
Conflict --> V7["bash -n plus Strix self-test"]
Evidence --> S8["CI script: opencode_review_receipt_gate.py"]
S8 --> I8["review and security gate shell path"]
I8 --> Conflict["Merge conflict blocks this path"]
Conflict --> V8["bash -n plus Strix self-test"]
Evidence --> S9["CI script: python_native_extension_peer_gate.py"]
S9 --> I9["review and security gate shell path"]
I9 --> Conflict["Merge conflict blocks this path"]
Conflict --> V9["bash -n plus Strix self-test"]
Evidence --> S10["Test: test_contextual_orchestrator_review_sidecar_contract.py (10 files)"]
S10 --> I10["regression suite"]
I10 --> Conflict["Merge conflict blocks this path"]
Conflict --> V10["targeted test run"]
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
Resolved 6 conflicting files against current main (AGENTS.md, CHANGELOG.md, scripts/ci/load_contextual_orchestrator_token.sh, scripts/ci/opencode_review_receipt_gate.py, tests/test_contextual_orchestrator_review_sidecar_contract.py, tests/test_pr_review_autofix_nvidia_nim_contract.py): - AGENTS.md/CHANGELOG.md: kept both sides' additions (this branch's PyO3 gate notes plus main's hourly-caller consolidation, Pingora policy, and independently-landed Fixed entries). - load_contextual_orchestrator_token.sh + its contract test: took main's generalized _contextual_orchestrator_stat() helper (handles both GNU and BSD stat output via a shared fallback) over this branch's narrower Darwin-specific inline branch, since it fully subsumes the same portability fix with less duplication. - opencode_review_receipt_gate.py: took main's REPO_RE (explicit `.github` allowlist carve-out, landed via #1388) over this branch's broader "block only literal '..'" approach, since main's is the narrower, safer, already-integrated fix for the same underlying `.github`-repo-name problem. - test_pr_review_autofix_nvidia_nim_contract.py: recomputed REVIEW_DISPATCH_BLOB_SHA against the actual post-merge content of opencode-review-dispatch.yml (auto-merged cleanly; verified no duplicate steps and matching main's job/step topology before trusting it). Verified post-merge: coverage run -m pytest tests -q (2912 passed, 1 skipped, 21 subtests), coverage report --fail-under=100 (100%), interrogate (100%). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Resolved the merge conflict against current `main` (the previous CHANGES_REQUESTED was purely `mergeStateStatus: DIRTY`, not content feedback). New head `a71bafd6` merges cleanly — 6 files had real content conflicts (AGENTS.md, CHANGELOG.md, `load_contextual_orchestrator_token.sh`, `opencode_review_receipt_gate.py`, and two dependent test files), resolved by preserving both branches' intent and, where the same underlying fix existed on both sides in different forms, taking main's already-integrated version (the generalized `_contextual_orchestrator_stat()` helper over a Darwin-specific inline branch; main's narrower `.github`-allowlist `REPO_RE` over a broader "block only literal '..'" version). No modify/delete conflicts. Post-merge verification on the new head: `coverage run -m pytest tests -q` → 2912 passed, 1 skipped, 21 subtests; `coverage report --fail-under=100` → 100%; `interrogate` → 100%. 🤖 Generated with Claude Code |
|
Scheduled review-feedback autofix for this PR head.
|
|
Scheduled review-feedback autofix for this PR head.
|
One conflict: REVIEW_DISPATCH_BLOB_SHA, which pins `.github/workflows/opencode-review-dispatch.yml` by whole-file `git hash-object`. Neither side's value is correct for the merge — this branch carries 2d2b719… and main 26e8555…, each right only for its own tree — so the constant is recomputed against the merged file: 44a7062. The merge also clears 12 test failures this branch carried on its own head; main's newer content resolves them. Verified by running the full suite on both and diffing failure names, not counts: unmerged head 12 failed, 2930 passed after merge 0 failed, 3030 passed introduced: 0 fixed: 12 coverage 100%, interrogate 100%, `ruff check --select F821` clean, zero conflict markers. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 participant
Buyer-visible blocker
Central OpenCode coverage can fail before pytest collection in maturin/PyO3 repositories because the source-only sandbox intentionally does not build or import an unchanged compiled extension. Treating that environment limitation as an ordinary source-test failure blocks otherwise valid exact-head review evidence; treating it as success would weaken the gate.
Bounded peer-evidence repair
pyproject.tomlbefore untrusted tests; reject symlinked ancestors, final links, non-regular files, device/inode/path drift, growth, malformed input, and bounded-read overflow.requirements/dependency path, workflow/action files, or any repositorypyproject.toml.docs/requirements/from dependency inputs.DEFERRED, neverPASS.CI::python,CI::rust, andCI::package, with bounded complete GraphQL pagination and rejection of stale, pending, failed, status-only, lookalike, missing, or duplicate contexts.AGENTS.mdorARCHITECTURE.mdpolicy changes, and reject duplicate Unreleased Changelog sibling headings.Current exact-head identity and verification
main@613a33e0cb1c6db9790fae99f6253445712ac37a3ffde3c5d3c98f0c840abcba151af08cf0255b46446be4513dbbcb02b7bf8ce27827614cfbbd7f0d17837a3c…; that merge preserves predecessor owner head31c8d207…and protected main613a33e….Verification
Changedheading both failed the focused contract.test_strix_quick_gate: PASS;git diff --checkclean.3ffde3c…checkout, 100% peer-gate statement/branch coverage, 1,523 full tests plus 16 subtests, 100% owned production statement/branch coverage, docstrings, actionlint, and clean-patch gate.3ffde3c…; merge-preview jobs explicitly analyzed synthetic merge84dd43ed….Security and merge gate
This PR does not skip tests, build PR-selected extensions, enable sandbox network access, introduce a Python substitute for Rust arithmetic, or convert missing evidence into success. It remains non-mergeable under governance until an independent formal approval is recorded on this same SHA. Status/check success and predecessor verdicts are not approval evidence.
Protected-main SAST and Trivy remain a separate known provenance defect: on this current head they scanned synthetic merge
84dd43ed37bb8cb85ae1c76a5360e63b86cf188e, not submitted head3ffde3c…. The canonical owner paths remain #941/#897 and the evidence is tracked in #1222; it is not reclassified as a #789 source vulnerability.After protected integration, a real affected PyO3 consumer must rerun the protected-main path before incident closure.
Summary by CodeRabbit
새 기능
문서
버그 수정
테스트