fix(reviewer): fail closed on empty CodeGraph semantics - #546
Merged
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (36)
📝 WalkthroughWalkthroughCodeGraph 실행이 현재 헤드 변경 파일 범위와 격리된 환경을 사용하도록 변경되었다. 빈 탐색 결과는 심볼 복구 후 재탐색한다. 엄격한 게이트는 wrapper-owned provenance와 독립 check 증거를 검증한다. ChangesCodeGraph 범위와 실행 경계
Estimated code review effort: 4 (Complex) | ~60 minutes Merge Risk: 🟡 Moderate · up to Malformed CodeGraph output can be treated as trusted semantic evidence, potentially allowing strict reviewer runs to proceed without wrapper-owned provenance. Require standalone-marker parsing before merge. Sequence Diagram(s)sequenceDiagram
participant ReviewerCLI
participant DockerCodeGraphRunner
participant ExploreContainer
participant NodeContainer
participant EvidenceGate
ReviewerCLI->>DockerCodeGraphRunner: changed-file scope와 explore 요청
DockerCodeGraphRunner->>ExploreContainer: 격리된 codegraph explore 실행
ExploreContainer-->>DockerCodeGraphRunner: trusted session envelope 반환
DockerCodeGraphRunner->>NodeContainer: 빈 결과이면 변경 파일 심볼 조회
NodeContainer-->>DockerCodeGraphRunner: JSON 심볼 맵 반환
DockerCodeGraphRunner->>ExploreContainer: 심볼 시드로 explore 재실행
ExploreContainer-->>ReviewerCLI: wrapper-owned explore 결과 반환
ReviewerCLI->>EvidenceGate: ReviewManifest 전달
EvidenceGate-->>ReviewerCLI: semantic evidence 또는 blocked reason 반환
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
changed the title
This was referenced Sep 3, 2026
20 tasks
seonghobae
marked this pull request as ready for review
September 6, 2026 00:04
seonghobae
added a commit
that referenced
this pull request
Sep 6, 2026
Promote source-bound Context Graph release attestation after post-#546 exact-head application CI, semantic reviewer, required Security Scan, and patch-validator image GREEN with no unresolved review threads.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Defect
Noema strict reviewer must preserve exact current-head changed-file identity as untrusted data across CodeGraph admission, first explore, bounded empty-result recovery, sandbox path handling, and strict semantic gating. This lane owns reviewer semantic evidence only; provider/model routing, quarantine/security verdicts, outbound authority and central runner capacity remain with their canonical owners.
Retained RED → causal repairs
The branch retains the established executable lineage for complete changed-file scope, fail-before-execution budgets, canonical-JSON prompt isolation, empty-result symbol recovery, second-explore prompt isolation, and Linux exact Git-path identity. Hosted REDs then exposed stale dedup test authority/coverage holes and a missing nested-runner docstring; the minimum repairs culminated in exact head
7d3de5a859be96b953927201d9ba782673f4bb8ewithout weakening thresholds, sandbox boundaries, provider routing, or required gates.Fresh exact-head GREEN — partial release gate
Exact
7d3de5a859be96b953927201d9ba782673f4bb8enow has terminal GREEN for both principal source gates:reviewer-ci 33991772403, job101375158146: exact checkout, hash-pinned dependencies, 100% line+branch pytest, 100% docstring coverage, lock-pinned CodeGraph tooling, Cosign/Trivy image verification, and the real no-network CodeGraph sandbox smoke test all succeeded;ci 33991772454, job101375158075: exact checkout, live-base verification, lockfile control, install, typecheck, release tests, release security scan, KPI verification, dependency-license inventory, acquisition manifest and acquisition integrity all succeeded.The previously valid CodeRabbit finding about accepting an embedded
## codegraph exploresubstring had already been repaired by RED895b4fc0fe8ef35d566619f506165aca26288909→401c3ab54cb36157ebfa8995f985aa6d4a6973e5. Because the unchanged exact head now proves reviewer+CI GREEN, that outdated review thread has been resolved rather than left as stale process debt.Current exact authority
main@e1ac9d50f6c646f04be8c137c8acdc7200182fcd;7d3de5a859be96b953927201d9ba782673f4bb8e;patch-validator-image 33991772389is still in progress on the exact head; its job has passed exact checkout, stale-head refusal, Trivy/Syft/Grype setup and dependency materialization and is currently in the exact-head image build;Security Scan 33991772437remains queued.Do not mark Ready or merge until Security and image/SBOM/vulnerability/provenance evidence also become terminal success on this unchanged exact head. Do not substitute predecessor evidence, rerun-storm, leaf
runs-onchanges, no-op source churn, self-approval, force-push/destructive rebase, or gate suppression.Merge discipline
After #546 reaches protected semantic-review truth, affected open heads need regenerated semantic evidence and ordinary non-force restack as necessary. Raw/truncated/partial/cached-wrong-prompt evidence never becomes merge authority.
Summary by CodeRabbit
개선 사항
버그 수정