Repository navigation
fix(code-review): accept no-impact capsule preparation (0.51.2) - #503
Merged
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (13)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour. 📜 Recent review details⏰ Context from checks skipped due to timeout. (5)
🧰 Additional context used📚 Code guidelines (1)📓 Path-based instructions (5)Validate metadata: name, version, commands, dependencies, and parity with packaged src.⚙️ CodeRabbit configuration file Files:
CI: secrets, hatch/verify-modules-signature gates, contract-test alignment, action versions.⚙️ CodeRabbit configuration file Files:
Specification truth: proposal/tasks/spec deltas vs.⚙️ CodeRabbit configuration file Files:
Contract-first and integration tests: migration suites, bundle validation, and flakiness.⚙️ CodeRabbit configuration file Files:
Preserve the clean-code compliance gate and its category references (naming, kiss, yagni, dry, and solid)📄 CodeRabbit inference engine (CLAUDE.md) Files:
🪛 ast-grep (0.45.3)tests/host/proof_capsule_deferred_review_ci.py[error] 176-176: Command coming from incoming request (subprocess-from-request) [error] 202-202: Command coming from incoming request (subprocess-from-request) 🔀 Multi-repo context nold-ai/specfact-cliLinked repositories findingsnold-ai/specfact-cli
🔇 Additional comments (7)
📝 SummarySummary
Validation statusThe PR description reports passing tests and checks, but signed-head CI remains pending. It also reports approved timeouts for the candidate and installed-reviewer checks; those are not passes. Merge, signing, and registry publication remain follow-up steps. WalkthroughThe capsule workflows now accept validated no-governed-impact outcomes while continuing normal review and cleanup. Tests cover accepted and rejected outcomes and adjust regression checks. The package metadata and release records identify version 0.51.2. ChangesNo-impact capsule review
Test regression corrections
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Bug fix Sequence Diagram(s)sequenceDiagram
participant IndependentReviewer
participant ScopeResolution
participant InstalledReview
participant Cleanup
IndependentReviewer->>ScopeResolution: Resolve review scope
ScopeResolution-->>IndependentReviewer: NOT_APPLICABLE, no_governed_impact, no paths, exit 0
IndependentReviewer->>InstalledReview: Run review without preparation
IndependentReviewer->>Cleanup: Clean up after review
Merge Risk: ⚪ Minimal · up to The no-impact path retains its selection checks and normal review behavior. No issue identified here needs to block merge; signing and publication remain post-merge steps. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 19 functions across 5 files. (8 skipped: 8 unsupported.)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
13 of 14 tasks
djm81
marked this pull request as ready for review
October 9, 2026 07:00
|
Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here. So far, Strix has reviewed 48 pull requests across this workspace. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
djm81
added a commit
that referenced
this pull request
Oct 9, 2026
# Summary Promote the current `dev` branch to `main`, releasing `nold-ai/specfact-code-review` **0.51.2**. Portable reviews now resolve explicit corresponding tests before fallback, avoid unused pytest setup, and handle pinned CrossHair constructor signatures, callable pytest markers and Literal inputs without the reproduced runtime crashes. Pylint similarity caching is bounded to one invocation. The release also carries the merged agentic SDLC roadmap, risk-first workflow guidance and public OpenSpec design/evidence updates. It preserves incomplete-analysis semantics, contracts, deadlines, isolation and no-write requirements. Refs: #499, #501, #503, #504, #494, #500; related capsule work #460 and #498. ## Scope - [x] Bundle source changes under `packages/` - [x] Registry/manifest changes and the signed `0.51.2` registry artifact - [x] CI/workflow changes for mandatory host proofs and bounded preparation/failure diagnostics - [x] Documentation and OpenSpec/governance changes - [ ] Signing-tool implementation changes ## Bundle Impact - `nold-ai/specfact-code-review`: **0.51.0 → 0.51.2**. - Other bundle versions remain unchanged. - Core compatibility remains `>=0.55.1,<1.0.0`. - The separate native capsule PR #498 is not included in this promotion. Its remaining installed/native acceptance follows reviewer promotion. ## Validation Evidence Checked 2026-10-09, Europe/Berlin, against release head `bb57584c6d6ea7154f275a470a85d0c68909812c`, including merged source #503 and normal dev registry publication #504. ### Required local gates The reviewed source in #503 passed format, type/lint, 28 contracts, normal hooks, clean-code/Semgrep, workflow/manifests/imports, planned requirements and strict OpenSpec validation. Full and SMART each passed **27 mandatory host proofs and 5,181 portable tests**, with 75 declared skips and 95 subtests. The final test-only correction passed all 66 affected dispatch/constructor/bridge checks and normal hooks. Its affected source and tests, and the complete `packages/` tree, are byte-for-byte unchanged on this release head, so these gates were not repeated. The exact #503 head `2da6cbdd` received an automatic GitHub CodeRabbit review with no actionable comments across 13 files; some CI context was skipped for timeout. Its latest CLI review failed with a WebSocket connection error and is not clean evidence. The release head's fresh CI and reviews must be assessed separately. ### Signature + version integrity - [x] All seven manifests pass `verify-modules-signature.py --require-signature --payload-from-filesystem --enforce-version-bump --version-check-base origin/main` using the public signing key. The signed #503 source's entire `packages/` tree matches the current release head; the new head's module signature CI also passes. - [x] Code Review version is bumped to `0.51.2`; its signed payload checksum is `d4bcfd8db105c60440b3bdefbe414f1dc148a75c21b8533801d43d888b3d0df4`. - [x] Registry archive and checksum sidecar match SHA-256 `dca4ffc795c54835d437f005c50613b5b42cb401d6937261b4508a92c5fd67b7`; the packaged signed manifest matches `dev`. - [x] Registry publication PR #504 is merged. Registry latest version is 0.51.2; archive/sidecar hash and packaged signed manifest match the actual release head. Current dev publication and module signature checks pass. ## CI and Branch Protection Fresh release-head checks and reviews are pending. Preserve the existing required checks and evaluate actual defect/test failures normally. Previously reported inline review threads are resolved after independently verifying their fixes or invalid-finding dispositions. The independently reproduced P2 same-stem correspondence finding is explicitly deferred by the owner to the [open #498 annotation](#498 (comment)); the #502 thread is resolved as transferred, not fixed. This does not claim green CI. The user approved the known reviewer timeout failures as explicit exceptions pending promotion. On signed source head `88411209`, [ordinary CP312 job](https://github.com/nold-ai/specfact-cli-modules/actions/runs/37862310996/job/113601873468) successfully prepared both runtime descriptors and reported `crosshair_timeout_observed` with no exception class observed. The independent installed `0.51.0` reviewer again timed out. These remain incomplete evidence, never PASS; the exception does not waive crashes, defects or test failures. No deadline, contract selection or assurance rule is weakened. ## Docs / Pages - [x] Existing changelog, agent rules, SDLC roadmap and public change artifacts are included from merged dev work. - [x] No Pages workflow changes are included. ## Checklist - [x] Release diff and bundle/registry impact reviewed. - [x] All changes are existing merged dev changes; no extra implementation commits are introduced by this PR. - [x] Rollout: human merge to `main` promotes the corrected reviewer; then #498 can continue with the updated reviewer and ordinary installed/native evidence. Apple Developer ID/notarization remains separate; accepted first-run trust warnings do not change this release's assurance claims. This PR requests promotion only. Creating it does not merge or publish `main` automatically. ## Integrated release fixes [Patch PR #503](#503) merged to `dev`, followed by normal registry publication [#504](#504). Both are now included in this release head. The patch fixes both valid no-impact preparation rejections, separates mutation from an assertion, adds identity equality to the deliberate hash-failure fixture, and removes the brittle exact child pass-count assertion. Normal review, cleanup, failure exits, contracts, selections, deadlines and negative-test behavior remain intact. All previously reported fixed review threads are resolved. The same-stem test-selection fix is not included in #503. The owner approved deferral to the [open #498 follow-up](#498 (comment)), with full project test-suite runs for release acceptance during deferral and correction required before #498 final installed/native acceptance. Historical #503 CI passed all three CP311/CP312/CP313 customer candidates. Its independent installed 0.51.0 reviewer returned an unclassified structured FAIL with findings and Pylint UNKNOWN, and quality jobs stopped at prerequisites before tools/tests. Individual private findings were not retained. That failure remains unwaived and is not established as a timeout; fresh release CI must be assessed on its own evidence. Known, independently classified timeout failures retain only the user-approved incomplete-evidence exception. Native #498 remains separate and must select the next available patch version when rebased.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Registry-only or workflow-only capsule PRs can legitimately resolve to
NOT_APPLICABLE/no_governed_impact. Both hosted preparation paths currently reject that outcome before normal review. Accept the exact successful no-impact outcome without acquiring runtimes, then invoke the existing reviewer and preserve its exit.This is the owner-requested upstream patch for release PR #502, on
bugfix/release-502-autofixtargetingdev. Code Review advances 0.51.1 → 0.51.2 before release promotion; no changes are committed directly todevormain.Refs #502, #460. Reuses active OpenSpec
code-review-portable-reviewer-bootstrap.Changes
__hash__ = Noneremoves the negative regression for preserving custom errors. Production adapters already distinguish standard unhashable types from real custom hash failures.Validation
Checked 2026-10-09, Europe/Berlin:
0.51.2checksum isd4bcfd8db105c60440b3bdefbe414f1dc148a75c21b8533801d43d888b3d0df4; stale0.51.1signature is removed. Existing CI added signature-only child4feca6048e26c7f8de64c29948066d15683797d4; inspection confirms a single manifest signature line, and all seven strict signature/checksum/version checks pass. No local private key is accessed.7d9b8f54completed (review_completed) with zero findings across all 13 files. Its signature-only CI child does not change reviewed source. Signed-head CI has been approved and remains pending completion.Integration
After human merge to
dev, normal signing/registry publication must produce the signed0.51.2artifact. Refresh #502's release version/body against its actual updated head and resolve its fixed threads only then. The separate native #498 must use the next available patch version when rebased; it is not included here. No merge, main publication or OpenSpec archive is performed automatically.New review correction
CodeRabbit Minor Remove the exact pass-count assertion. is corrected in pushed source head
2da6cbddd8103e7f4f2b61484e541a8a179baa43. A controlled additional constructor case makes the actual child pass 14 cases while the original outer proof fails only on its13 passedstring. Removing that one summary assertion makes the expanded proof pass; restoring the temporary case leaves a one-line final source change, with all 66 original dispatch/constructor/bridge checks and normal hooks passing. Explicit selections, contract assertions, failure exits and the 30-second bound remain unchanged. Signed module bytes are unchanged, so the prepared0.51.2version/signature remains valid.The fresh five-file CLI review was interrupted by
connection / WebSocket closedand exited 1 without a completed review. It is not PASS, and it is not retried after work started. Earlier completed zero-finding reviews remain historical evidence; the new source's GitHub review and CI are pending. The release thread stays open until this upstream correction reaches #502.