fix(tests): parse DOI links in doctoring contracts - #2171
seonghobae wants to merge 1 commit into
Conversation
|
Warning Review limit reachedNext included review available in 11 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Repository: ContextualWisdomLab/fast-mlsirm/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Exact-head blocker re-audit: 현재 다음 실질 blocker가 있어 Draft/Proposed로 교정합니다:
Queued/pending review·Checks 또는 승인 대기만으로 Draft 전환하지 않았습니다. Current head에서 blocker가 해소되면 Ready review admission을 복구합니다. |
|
Continuation report for the #2114/#2120 review-gate investigation, now bound to #2171 head cffb90f. Completed independent verification and submitted scoped COMMENT reviews on the existing repair owners:
New RCA from Strix run 36237188327, job 108408520367, retained artifact 10919666896: discovery completed, sequential provider probes advanced through several completed candidates, then nvidia_nim meta/llama-3.2-90b-vision-instruct started at 2026-09-26T19:06:49.173Z with no later outcome before cancellation at 2026-09-27T01:00:56.653Z. It blocked route readiness for approximately 5h54m, before the gateway probe and scan. The current no-inference-deadline runtime is intentional under ADR-0003; ADR-0029's old 90-second per-probe wall-time claim no longer applies. The serial preflight's eight-ready target lets one pending route prevent reaching remaining candidates. The next shared repair belongs in readiness scheduling rather than scan code, credential broadening, or a fixed inference deadline. Organization inventory found 51 assigned running jobs (30 Strix / 19 Noema / 2 compatibility), while #2171 OpenCode coverage and CodeQL dispatch were unassigned. This proves occupancy but not the exact concurrency ceiling. Five oldest jobs still bind open current-head PRs; no stale cancellation was justified. The Actions budget does not halt spending (prevent_further_usage=false). The DOI contract tests also passed 6/6 on this head and 6/6 after an isolated conflict-free merge with current main. Hosted exact-head gate success and qualifying approval remain separate requirements; no merge, bypass, or synthetic status was performed. Shared readiness repair implementedThe serial-preflight RCA now has a concrete shared repair: ContextualWisdomLab/.github#2411 at c3934de96acf2a296c08257da2437dedf4efed64, tracking ContextualWisdomLab/.github#2408. The existing route validator is reused with concurrent scheduling bounded by the unchanged sixteen-base-probe budget per stage and one locked four-escalation budget across primary/fallback. One or eight held probes no longer prevent eight later ready routes from starting the sidecar; pending calls are not cancelled, rejected or admitted. Catalog serving priority, free/ZDR selection, all-unavailable failure and fallback ordering are preserved. The exact baseline reproduced the serial obstruction. Final-source focused tests pass 143/143 with warnings as errors in both ordinary local and GITHUB_ACTIONS=true modes; Ruff and diff whitespace checks pass. Implementation and proposed ADR amendment are reviewable at ContextualWisdomLab/.github#2411. The fresh PR checks are queued at the exact current head. Deployment and live-provider completion remain unproven, so neither this repair nor the overall goal is marked complete. Project #1 records the issue and PR as In Progress. Security prerequisite verified and integratedThe separate Noema #2387 pip-audit failure is confirmed: the shared Strix lock retains AnyIO 4.14.0 with three known findings. The canonical fix is ContextualWisdomLab/.github#2278 at 8a5251bf409fe84b3dd0cba1e48992f5b8d9eda5. Both official wheel/sdist bytes match the committed hashes. A strict audit of all 106 listed distributions reproduces the original three findings and returns zero findings for the repaired lock, with zero skipped packages. The exact owner commit is integrated into ContextualWisdomLab/.github#2411 by an ordinary two-parent merge. Current head is 4ebadfc4d69552e18f9043335335e2a994cff2cd, superseding the earlier c3934de96 checkpoint. Related integrated-tree tests pass 144/144; the owner's branch and requested-changes review were preserved. Fresh hosted checks are queued at this new head; old-head checks/reviews are not transferred, and no main merge or deployment is claimed. Governance RCA correction (2026-09-27)Central repair PR #2411 now targets e7c2d0a6db4826646c477be7b88865c63f3ad5ad. September 4's documented correction intentionally restored the dispatch-safe CodeQL required workflow; the original inventory discrepancy is therefore superseded. The stale July explanation has been corrected without removing the gate. The current ruleset instead has two review-policy mismatches against the protected-main auditor: one approval instead of two, and last-push approval disabled. A two-field candidate passes the auditor and preserves disabled code-owner review, but remains unapplied pending maintainer policy intent. Latest repair-head jobs are queued; hosted acceptance is not established. Default-branch alerts 11–13 all concern AnyIO, and the independently audited 4.14.2 lock fix is already included in #2411. Protected integration deployed (2026-09-27 10:38 UTC)Maintainer-authorized bypass integration #2414 is MERGED at main 23c6beaff3d8a1f376f1ba1e194118bd143a0788. Canonical OpenCode gateway owner #2333 and Noema continuation owner #2387 are also confirmed MERGED. Source includes #2385 prerequisites, #2360 Cargo roots, #2411 readiness, duplicate full-suite repair, and already-deployed #2416 self-hosted CodeQL/OpenCode/control allocation. Merged-tree contracts: 133 passed with warnings as errors. The security lock remains byte-identical to the zero-finding audit. This is deployed source, not a claim of current downstream model verdicts or completed hosted security checks. Live old inferences were preserved. Five self-hosted runners were observed online; central assignment samples include actual self-hosted Noema and OpenCode execution. Organization approval settings were left unchanged as instructed. REST Actions observation reached the API rate limit after merge; subsequent acceptance must use fresh authoritative run/check evidence when available. Self-hosted 재검증 후속 확인 (2026-09-27 11:05 UTC)중앙 대기 실행은 500건이며 org runner 5대가 online, 4대 busy입니다. fast-mlsirm CodeQL producer run CodeQL 설치 권한 RCA 및 후속 검증 (2026-09-27 12:28 UTC)새 native scan |
This branch has not been deployed
1 participant
Summary
doi.orgauthority, and a non-empty DOI path. The contract tests cover missing links, look-alike hosts, HTTP, an embedded DOI substring in another host's URL, and the real links in both notes.Verification
https://evil.example/https://doi.org/10.1000/example..venv/bin/python -m pytest -q tests/test_architecture_baseline_contract.py tests/test_governance_index_contract.py tests/test_changelog_fragment_contract.py→ 16 passed.This addresses the two pre-existing CodeQL Python findings without suppressing alerts. The CodeQL result on this PR is pending hosted verification.
Local CodeQL verification
CodeQL CLI 2.27.1 with bundled Python queries 1.8.11, run in an isolated Linux ARM64 container with Python 3.12 and networking disabled:
py/incomplete-url-substring-sanitizationfindings, attests/test_architecture_baseline_contract.py:34andtests/test_governance_index_contract.py:32.cffb90fb742d0ebcb9c5aa49c8323ce349138eab: the full default Python suite produced zero SARIF findings. The centralcodeql_sarif_gate.pyreturnedCODEQL_SARIF files=1 results=0 medium_plus=0(exit 0).The required hosted Python compatibility job is still awaiting central scan run 36283765134. Local results do not establish that the hosted job succeeded.