[PetrefiedThunder]

Summary

• Engine Review Pass (.github/workflows/pr-guards.yml):
  • issue_comment runs execute in the default-branch context, so failing the job counted the failure against main's head commit (24+ failed runs per 4 hours on main).
  • The verdict is still posted as the Engine Review Pass commit status on the PR head SHA. The job itself now fails only for pull_request and pull_request_review events and logs a warning otherwise, the same pattern Head SHA Check Guard uses in this file.
  • The PR lookup on issue_comment now goes through the same helper, so a transient API error no longer fails the run on main.
• Secrets Audit (.github/workflows/security.yml):
  • Runs scripts/ci/check_secrets_baseline.sh, the check pr-gate.yml and pr-secrets-non-main.yml already use.
  • It still fails when a secret is missing from .secrets.baseline (detect-secrets-hook exit 1). It now passes line-number-only drift (exit 3), which failed security on main five times since 2026-10-24.
  • New test test_main_secrets_audit_tolerates_baseline_line_drift pins this.
• Copy gate: this PR first reworded frontend/src/app/trust/page.tsx. feat(trace): report depth exhaustion and walk transformation links by direction #3713 made the same fix on main, so after merging main this PR takes main's wording and no longer touches the trust page or the copy baseline.

Type of Change

• Bug fix
• New feature
• Enhancement to existing feature
• Refactor (no behavior change)
• Documentation
• CI/CD or infrastructure
• Security fix

Test Plan

• Unit tests added/updated: tests/scripts/test_security_workflow_boundaries.py (new test), plus test_check_workflow_inventory.py. All pass.
• Integration tests pass
• Manual testing performed:
  • Strict duplicate-key YAML parse of both workflows.
  • actionlint v1.7.12 with CI's ignore list on all workflows (exit 0).
  • scripts/ci/check_supply_chain.py passes.
  • check-copy.mjs --gate against main's baseline passes.
  • Node harness of the Engine Review Pass script:
    • pull_request and pull_request_review set a failure status and fail the job.
    • issue_comment sets a failure status and logs a warning.
    • issue_comment with a failing PR lookup logs a warning.
• N/A (docs, config, etc.)

Checklist

• My code follows the existing patterns in the codebase
• I have not introduced hardcoded secrets or credentials
• If this PR adds a test that uses sys.modules[X] = stub, I justified it in the PR description (no such test)
• I have updated relevant documentation (if applicable)
• My changes generate no new warnings or lint errors

Related Issues

These are main-branch failures tracked by the deploy-path health routine:

• Engine Review Pass failing on issue_comment events.
• security / Secrets Audit failing on line drift in .secrets.baseline.

Vercel Preview Built was red here because Vercel has created no deployments since 2026-10-29 09:20Z (see the comment on this PR). This PR no longer touches frontend/, so that guard skips.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VyDxaAGDu8kUNAqqsCa4AZ

---

Note

Low Risk
CI-only guard behavior changes; PR verdicts still come from commit statuses and the shared secrets script still blocks unknown findings.

Overview
Fixes false-red main branch runs from two CI guards while keeping PR gating behavior intact.

Engine Review Pass (pr-guards.yml) now routes failures through a failRun helper aligned with Head SHA Check Guard: the job only fails on pull_request / pull_request_review. On issue_comment (default-branch context), it still posts the Engine Review Pass commit status on the PR head SHA but logs a warning instead of failing the workflow run. PR lookup on comments is wrapped in try/catch so transient API errors follow the same rule.

Secrets Audit on main (security.yml) no longer invokes detect-secrets-hook directly; it runs the shared scripts/ci/check_secrets_baseline.sh used by PR gates. New secrets still fail (exit 1); baseline line-number drift after merges (exit 3) no longer fails security on main. A workflow boundary test locks in that the main detect-secrets job uses the script and not a bare hook.

^{Reviewed by Cursor Bugbot for commit 9d9e3fc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Findings

Actionable comments posted: 2

Caution

Review failed

The pull request is closed.

Recent review info

Run configuration

• Source mode: Auto
• Repository: regengine/RegEngine
• Branch: claude/gracious-hamilton-9ythnt
• File: .coderabbit.yaml
• Commit: 9d9e3fc
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c1b71824-3bfe-4a08-b656-7b520f74cef3

Commits

Reviewing files that changed from the base of the PR and between c581466 and 9d9e3fc.

Files selected for processing: 3

• .github/workflows/pr-guards.yml
• .github/workflows/security.yml
• tests/scripts/test_security_workflow_boundaries.py

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

Walkthrough

Engine Review Pass now uses event-aware failure handling and catches issue-comment pull-request lookup errors. The secrets scan calls the shared baseline-check script. A workflow-boundary test checks that the workflow uses the script instead of invoking detect-secrets-hook directly.

Estimated code review effort: 3 (Moderate) | ~20 minutes

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[PetrefiedThunder]

Engine Review Pass is failing with "No passing review from a non-author engine for current head SHA". This is the repo's review gate, not a defect in this change.

The author engine is claude. To pass, an OWNER, MEMBER or COLLABORATOR has to leave a review or comment containing a line REVIEW: PASS <engine> <head SHA>, where <engine> is a non-author engine such as codex or gemini. The current head is 9d9e3fcea4d7e0a392c11c39b236a0a100aaca8b. Any later push needs a fresh marker for its SHA.

I will not post that marker myself.

---

Generated by Claude Code

[github-actions]

✅ Bundle Size Report

Metric	Size
Total JS	5581.7KB (5.45MB)
Total CSS	131.9KB
Limit	10.0MB

Bundle is within the 10.0MB limit.

[github-actions]

PR Blocker Checklist

Head SHA: 9d9e3fcea4d7e0a392c11c39b236a0a100aaca8b

Status: Ready

• All review threads resolved
• No reviews requesting changes
• No blocked review engines

[PetrefiedThunder]

Vercel Preview Built failed on f8b130b with "No ready regengine Vercel preview for f8b130b… after 25 minutes". This is not caused by this PR.

• Vercel has created no GitHub deployment for any commit since 2026-10-29 09:20Z. That covers PR previews and production. The newest records are Preview a645af2 at 09:20Z and Production c770b2b at 07:34Z.
• Main pushes since then (9f3ff20, 6a223a7, fb4e5df) have no Vercel status at all, even though frontend/scripts/vercel-ignore-build.sh always builds production.
• The same guard failed the same way on codex/jev-evidence-diagnostic-1029 (9531a88) at 09:53Z. The last successful preview wait was at 07:57Z.

The Vercel project's Git integration or its GitHub app access needs checking on the Vercel side. Nothing in this repository can fix that, and no fix exists yet. I re-ran the job once. It will stay red until Vercel builds previews again.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-31T08:26:24.033848Z We couldn’t complete this review. Comment @codex review to try again.	9d9e3fc	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[PetrefiedThunder]

REVIEW: PASS hermes 9d9e3fc

Gate-strength review of Claude's CI fix (head matches requested 9d9e3fce…; full SHA above). Diff is exactly 3 files / +44/−25: pr-guards.yml, security.yml, test_security_workflow_boundaries.py.

(1)–(3) Engine Review Pass not weakened

• Non-author PASS still required: nonAuthorPassMarkers filters PASS where engine ≠ author prefix; author-engine PASS is ignored (pr-guards.yml:1372-1376, 1391-1407).
• Full 40-char SHA match only: markerRegex anchors ^[0-9A-Fa-f]{40}$ and compares markerSha.toLowerCase() !== headShaLower (1344-1370). Prefix / stale SHA rejected.
• Marker must be alone on its own line; spoofing gated by ALLOWED_ASSOCIATIONS = OWNER/MEMBER/COLLABORATOR only (1244, 1320-1331) — BOT/NONE/CONTRIBUTOR ignored. Latest marker per engine uses updated_at, so an edit that drops PASS is honored.
• Only change: failRun mirrors Head SHA Check Guard — on issue_comment (default-branch context) the job warns instead of setFailed, while still posting the Engine Review Pass commit status on the PR head (1187-1196, 1247-1266). Merge verdict remains the status context, not the issue_comment workflow-run conclusion. Does not open self-review or injection paths.

(4) Trust / secrets surface

• No pull_request_target in either changed workflow. engine-review-pass does not check out or execute PR code; only SHA-pinned actions/github-script@3a2844b7… with least-privilege statuses:write + read perms (1172-1181).
• security.yml Secrets Audit still if: github.event_name != 'pull_request' (main/schedule/dispatch only) — trusted ref, no fork-PR secret exposure. Actions remain SHA-pinned.

(5) Secrets Audit

• Switches bare detect-secrets-hook → shared scripts/ci/check_secrets_baseline.sh (same as pr-gate.yml / pr-secrets-non-main.yml).
• Script still fails exit 1 (new secret not in baseline); tolerates exit 3 (line/metadata drift only); no allowlist broadening; no secret printing added (check_secrets_baseline.sh:54-64). Baseline report step unchanged and informational.

(6) Tests / local verification

• New test_main_secrets_audit_tolerates_baseline_line_drift pins the shared-script wiring and forbids a bare hook in the main job.
• Local: pytest tests/scripts/test_security_workflow_boundaries.py → 7 passed; actionlint v1.7.12 with CI ignore list on all workflows → exit 0; bash -n on the secrets script → ok.

CI (head 9d9e3fcea4d7e0a392c11c39b236a0a100aaca8b)

• Required PR Gate / Backend / Frontend / Secrets / Workflow Contract / supply-chain / CodeQL / security path jobs: success.
• Commit status Engine Review Pass: was failure awaiting non-author PASS (expected; this comment is that PASS).
• Non-blocking noise: PR Blocker Checklist cancelled; CodeRabbit/Bugbot still in progress at review time.

Non-blocking follow-ups

• No automated test for the new failRun issue_comment attribution (PR used a manual Node harness). Consider a small fixture later.
• Secrets test is structural (wiring), not a behavioral exit-1/exit-3 assert — acceptable because the shared script is already the PR-gate path.

No push. No merge.