feat(reviewer): enforce actionable finding contract

[seonghobae]

Evidence-based gap

PR #546 fails closed on empty or forged CodeGraph semantics. PR #548 binds each failed check to its own current-head path:line RCA. Neither changes the canonical Finding output contract: a model could still omit priority, evidence type, observable impact, trigger, and an exact regression command, while a fenced suggestion in a top-level review body would not be directly applicable.

This stack addresses that one remaining root gap without changing central workflows or concurrency.

Repair

• make P1/P2/P3, evidence type, observable impact, trigger, smallest fix, and exact regression command typed finding data rather than prompt-only prose
• reject multiline/Markdown-breaking regression commands and suggestion fence injection
• accept suggested replacement text only when path:line is a right-side anchor in the exact current-head diff
• publish valid replacement text through GitHub's inline review comments payload as an applyable suggestion
• preserve fix(reviewer): bind failed checks to actionable source evidence #548's exact failed-check check_name causal binding

Verification

• uv run --project reviewer pytest -q -> 509 passed
• uv run --project reviewer interrogate -q reviewer/noema_reviewer -> passed
• uv run --project reviewer python -m compileall -q reviewer/noema_reviewer -> passed
• git diff --check origin/codex/noema-failed-check-source-rca...HEAD -> passed

No central .github workflow or concurrency file is changed. This is a stacked product PR; do not use admin bypass.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Pull request is closed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.