Repository navigation
fix(noema): bounded complete serializer prerequisite - #2662
Open
seonghobae wants to merge 1 commit into
Open
seonghobae wants to merge 1 commit into
seonghobae wants to merge 1 commit into
Conversation
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 26 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
.github/workflows/agent-review-runtime-quality-ci.yml— GitHub Actions review jobscripts/ci/noema_review_gate.py— review and security gate shell pathtests/test_agent_review_runtime_quality_consolidation.py— regression suitetests/test_noema_complete_auto_input.py— regression suite
Changed behavior
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: agent-review-runtime-quality-ci.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: agent-review-runtime-quality-ci.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script: noema_review_gate.py"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script: noema_review_gate.py"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test: test_agent_review_runtime_quality_consolidation.py (2 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_agent_review_runtime_quality_consolidation.py (2 files)"]
R3 --> V3["targeted test run"]
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
23307c6442bf60fa602be39d6016c0ee3c20e1de - Workflow run: 40245286138
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: agent-review-runtime-quality-ci.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: agent-review-runtime-quality-ci.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script: noema_review_gate.py"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script: noema_review_gate.py"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test: test_agent_review_runtime_quality_consolidation.py (2 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_agent_review_runtime_quality_consolidation.py (2 files)"]
R3 --> V3["targeted test run"]
Contributor
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Noema LLM review
The personal-auto path preserves the complete diff and changed-line location list while rejecting partial or oversized input. The size check covers the serialized request, not just the raw diff. Other routes retain their existing bounds, and the workflow changes enroll both the implementation and its regression tests.
Reviewed changed lines
scripts/ci/noema_review_gate.py:79 (RIGHT): Complete-input admission requires both the exact auto model and the designated personal endpoint; matching either alone does not enable it.scripts/ci/noema_review_gate.py:562 (RIGHT): For the selected route, an admissible diff is returned intact before the legacy character-based truncation path.scripts/ci/noema_review_gate.py:1657 (RIGHT): The complete-input branch serializes the entire allowed-location list rather than applying the existing location-list cap.scripts/ci/noema_review_gate.py:1695 (RIGHT): The budget applies to the final JSON bytes, including escaped prompt content, location metadata, and the request envelope, before HTTP request construction..github/workflows/agent-review-runtime-quality-ci.yml:226 (RIGHT): Implementation changes select both the Noema and review-repair suites; the new serializer test is also included in the workflow trigger and test commands.tests/test_noema_complete_auto_input.py:29 (RIGHT): The serializer fixture checks that all 1,000 changed-side locations survive and that the prompt retains the complete diff.tests/test_agent_review_runtime_quality_consolidation.py:403 (RIGHT): The enrollment contract checks the new test's trigger, occurrence count, pytest enrollment, and compileall enrollment.
Adversarial validation
scripts/ci/noema_review_gate.py:562 (RIGHT)falsified: Personal-auto requests still lose source beyond the existing 60,000-character diff limit. — Static control-flow tracing shows that this diff is below the new byte budget and returns unchanged before the legacy truncation logic. The corresponding test asserts equality with the original diff and a false truncation flag.scripts/ci/noema_review_gate.py:1657 (RIGHT)falsified: The diff can remain complete while the old 32 KiB allowed-location limit silently removes reviewable lines. — The selected branch directly dumps all allowed_locations with truncated=false instead of calling the bounded serializer. The added fixture checks that the resulting list contains all 1,000 locations.scripts/ci/noema_review_gate.py:1695 (RIGHT)falsified: A raw diff below the fetch budget can produce an oversized request through location metadata or JSON escaping and still reach HTTP submission. — The entire payload is serialized and encoded before its length is checked. An oversized result raises before Request construction, regardless of whether the raw diff passed fetch_diff.scripts/ci/noema_review_gate.py:1646 (RIGHT)falsified: A caller can submit an already-truncated diff through the complete-input route. — The new guard raises an untruncated-diff error before prompt and request construction. The added partial-input fixture explicitly exercises this condition and checks that no opener is constructed.scripts/ci/noema_review_gate.py:79 (RIGHT)falsified: The expanded input policy unintentionally applies to arbitrary auto endpoints or orchestrator aliases. — Both combinations fail the helper's exact conjunction and retain the original fetch truncation path. These two combinations are also present in the added parameterized regression fixture..github/workflows/agent-review-runtime-quality-ci.yml:226 (RIGHT)falsified: Changes to the implementation or its new test can bypass the consolidated quality checks. — Both paths are added to the workflow trigger. The implementation selects both relevant suites; the new test selects review_repair and appears in its pytest and compileall commands. The consolidation tests add routing expectations and enrollment assertions.- Residual risk: Validation was static against the supplied diff and excerpts; tests and CI were not executed. Actual provider capacity and the omitted transport implementation were not independently verified.
Findings
- No blocking findings.
- Result: APPROVE
- Head SHA:
23307c6442bf60fa602be39d6016c0ee3c20e1de - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
Small main-based prerequisite for #2661. Extracts only the reviewed bounded complete personal-auto serializer; no exact-canary/security feature, bootstrap admission, secrets, attestations, App identity, workflow trust-ref or approval-rule changes.
autoendpoint only; other routes retain legacy limits.Verification
Base:
6a03ae990eb4769869f4f77970cc21ed35141e09.Normal independent App review is required. No author approval or merge is requested from automation; parent owns any normal merge after real exact-head approval. The runtime-quality workflow is currently disabled; local enrollment is not claimed as hosted execution.