From 1677a6c15dd0d0c8f6cd1aa23a628bf736351dba Mon Sep 17 00:00:00 2001 From: fullsend-code <278716306+fullsend-ai-coder[bot]@users.noreply.github.com> Date: Sun, 11 Oct 2026 12:55:00 +0000 Subject: [PATCH] chore: inherit upstream REVIEW_FINDING_SEVERITY_THRESHOLD MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The per-repo review harness override previously pinned REVIEW_FINDING_SEVERITY_THRESHOLD to "high" for both runner and sandbox. On PR #582 (a security-sensitive change to .github/workflows/preview.yaml) that override caused the fullsend review to post zero correctness or security findings while a competing bot caught a fork-origin guard regression on the `prepare` job. Verified behavior of scripts/post-review.sh in the pinned base harness fullsend-ai/agents@ce2eedd: * The severity filter (jq pass around line 726) is absolute: it drops every finding below the threshold with no category-based exemption. A `high`-only threshold therefore discards all `low` and `medium` findings from the correctness, security, intent-coherence and style-conventions sub-agents. * The `[protected-path]` medium that reached the comment on PR #582 does not evidence a category exemption. It is appended by the post-script itself after severity filtering (around line 875), so it survives any threshold. A per-category exemption (issue #583 option 3) is therefore not available at the pinned harness commit. This change drops the override entirely (issue #583 option 1) so the upstream default `low` applies via layered-config deep merge — the previous partial override, which set only REVIEW_FINDING_SEVERITY_THRESHOLD and relied on the upstream REVIEW_PROTECTED_PATHS, already proved the merge is deep. readonly_repo: true is retained explicitly for the bool-merge reason already documented in the file. If signal noise becomes too high after one week of observation, step up to "medium" for both runner and sandbox (option 2) by adding env.runner and env.sandbox back with that value; a comment in the file points at that follow-up. Closes #583 Co-Authored-By: Claude Opus 4.7 --- .fullsend/customized/harness/review.yaml | 34 ++++++++++++++++++++---- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/.fullsend/customized/harness/review.yaml b/.fullsend/customized/harness/review.yaml index 243d5c72..785aeece 100644 --- a/.fullsend/customized/harness/review.yaml +++ b/.fullsend/customized/harness/review.yaml @@ -20,8 +20,32 @@ base: https://raw.githubusercontent.com/fullsend-ai/agents/ce2eedd097dcccf17e29f # forward the upstream read-only guarantee explicitly. readonly_repo: true -env: - runner: - REVIEW_FINDING_SEVERITY_THRESHOLD: "high" - sandbox: - REVIEW_FINDING_SEVERITY_THRESHOLD: "high" +# REVIEW_FINDING_SEVERITY_THRESHOLD is intentionally NOT overridden here — +# inherit the upstream default ("low") from the base harness. +# +# History: this file previously pinned the threshold to "high" for both +# runner and sandbox. On PR #582 (a security-sensitive change to +# .github/workflows/preview.yaml) that override caused the review agent to +# post zero correctness/security findings while CodeRabbit caught a +# fork-origin guard regression on the `prepare` job. See issue #583. +# +# Verified behavior of the pinned base harness +# (fullsend-ai/agents@ce2eedd097dcccf17e29f4a7cd337ec4d95d7194, +# scripts/post-review.sh): +# * The severity filter (jq pass around line 726) drops EVERY finding +# below the threshold with no category-based exemption, so a +# `high`-only threshold throws away `low`/`medium` findings from the +# correctness, security, intent-coherence and style-conventions +# sub-agents. +# * The `[protected-path]` medium that reached the comment on PR #582 +# is not evidence of a category exemption; it is appended by the +# post-script itself after severity filtering (around line 875), so +# it survives any threshold. +# A per-category exemption (issue #583 option 3) is therefore not +# available at this pinned harness commit. Dropping the override to +# inherit the upstream `low` default (issue #583 option 1) is the +# minimal change that restores sub-agent findings on governance paths. +# +# If signal noise is too high after one week of observation, step up to +# "medium" for both runner and sandbox (issue #583 option 2) by adding +# the env.runner / env.sandbox keys back here.