feat: add gated three-stage PR review - #5830
Merged
Merged
Conversation
atomantic
force-pushed
the
codex/pr-reviewer-three-stage
branch
3 times, most recently
from
September 2, 2026 15:02
2653ba7 to
13e61eb
Compare
atomantic
force-pushed
the
codex/pr-reviewer-three-stage
branch
from
September 2, 2026 15:39
13e61eb to
feff432
Compare
atomantic
enabled auto-merge
September 2, 2026 16:33
…d vendor list The three-stage pr-reviewer pipeline named its own providers: the gate accepted only an Ollama-backed Claude wrapper, and the final actions stage only codex or antigravity. An install with just grok — or just a local Claude — could not run the pipeline at all, and the picker showed an empty provider list with no explanation. Stages now declare an execution PROFILE, which maps to one of two enforceable POSTURES (`no-tool`, `sandboxed-actions`). Each vendor row in providerVendors.js declares which postures it has a maintained argv recipe for, and eligibility is the intersection of that table with the install's own enabled providers. Adding a recipe makes a vendor selectable everywhere at once — picker, spawn-time gate, and auto-selection — with no vendor names to keep in sync. - Vendor recipes now cover codex (`--sandbox read-only` / `workspace-write`), antigravity (`--mode plan` / `accept-edits` under `--sandbox`), grok (`--permission-mode plan --tools ''` / `--sandbox workspace`), and claude (tool-free only — it has permission modes but no OS sandbox, so it fails closed for the actions stage). Unknown commands still fail closed. - Claude's tool-free posture is no longer restricted to a local Ollama endpoint. The enforced argv (`--restricted --tools '' --permission-mode plan`) is the control, and contributor PR content is public. `validatePublicReviewModel` keeps the stricter installed-and-tool-free probe where it is meaningful — a local runtime — and requires a model id only there, since grok and antigravity pick their own. - `resolveAgentProviderAndModel` routes a public-review stage through the posture-eligible set rather than the ordinary pin → active → fallback chain, which could swap untrusted content onto a provider with no enforced posture. An install with nothing eligible now blocks permanently with an actionable reason instead of re-dispatching. - `GET /api/providers` publishes `publicReviewPostures` per provider; the schedule UI filters on it, names the eligible providers inline, and warns when a stage has none. Local installed-model filtering applies only to a local provider, so a cloud CLI stage can pick from its own catalog. Also fixes a stage-boundary bug in the same flow: `handlePipelineProgression` never set `executionProfile`, so stage 3 inherited stage 2's gate profile from task metadata and would have run under the wrong contract. The profile is now set-or-cleared per stage, and a restricted pipeline whose next stage declares no profile fails closed rather than handing public content to an unrestricted agent.
atomantic
force-pushed
the
codex/pr-reviewer-three-stage
branch
from
September 2, 2026 17:14
feff432 to
17d8404
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a gated, role-aware three-stage review pipeline for contributor pull requests.
Safety and configuration
Validation