fix(review): re-evaluate fallback change requests

[seonghobae]

Problem and change

A peer-check-only OpenCode CHANGES_REQUESTED fallback can remain a substantive receipt after peer GitHub checks recover, causing the caller to suppress a fresh substantive review. Heading-only classification is also unsafe because it can discard a real product finding written as ordinary prose.

This repair recognizes only the complete canonical producer envelope: fixed producer prose, the exact current head SHA, one or more failed-check rows, and the optional generated Mermaid evidence map. Extra prose, mixed findings, unknown formats, or an additional finding remain formal blockers. A newer peer-check-only fallback cannot resurrect an older approval. Approval eligibility, branch protection, model routing, and downstream gates are unchanged.

Status: Draft / Proposed. Owner issue: #2125.

Current authority

Protected base: main@e6334e229581a918e2f22de18733b76fa65d7e71.
Current head: 1a85dbeebdbfb5399f151545bc727ce6e9f88ce0.

The branch was converged non-destructively onto the current protected base with an ordinary two-parent commit. Fresh compare is behind_by=0; the effective delta remains exactly three files:

• docs/doctoring/opencode-peer-check-reevaluation.md
• scripts/ci/opencode_review_receipt_gate.py
• tests/test_opencode_review_receipt_gate.py

No open PR currently descends from this branch.

Validation and acceptance

The regression uses the actual current producer payload in .github/workflows/opencode-review-dispatch.yml, not a shortened synthetic copy. The focused receipt tests previously demonstrated the intended RED→GREEN behavior and 100% statement/branch coverage for the receipt module on the predecessor source; those results are historical evidence only after the convergence commit.

The new exact head requires fresh hosted checks and an independent current-head formal review before merge. It does not itself approve any consumer PR, establish model availability, repair CodeQL terminal publication/reconciliation, or relax any required status. After protected integration, affected consumers still require a fresh receiver/formal-review cycle before a peer-check-only fallback can be treated as non-substantive.

Fixes #2125.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Independent validation: focused suites passed 77 tests; with GITHUB_ACTIONS=true and the existing approval gate included, 108 tests passed. Please review fallback rejection and newest-review ordering without weakening approval eligibility.

[coderabbitai]

@seonghobae I will review #2126. I will verify fallback rejection, newest-review ordering, and approval eligibility.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Exact-head review of da2c955b09b77c4729a31a30d29fef210e1a1677 (COMMENT, not approval).

The three-file delta correctly applies the existing fallback-marker exclusion to both APPROVED and CHANGES_REQUESTED receipts. Reverse-chronological evaluation now stops at a newer fallback instead of reusing an older same-head approval, while a later substantive change request remains reusable. Approval eligibility, actor/head binding, Draft approval rejection, and malformed/status-only filtering are unchanged. I found no new substantive source defect in this delta.

Fresh isolated validation with warnings as errors: receipt/live-Draft/required-verdict suites 77 passed; production/test compile and git diff --check passed. The local environment injects an unrelated pytest-asyncio deprecation before collection, so the focused run disabled that non-project plugin; the repository tests themselves emit no warning.

Hosted CodeQL 34705252034 is not a source-analysis failure: first-pass Python job 103584917913 recorded verdict=pending; exact-head dispatch statuses for both languages are now success. The remaining required-run settlement belongs to #2106/#2056. Current OpenCode status is also fail-closed and there is no independent current-head approval, so this review does not authorize merge or bypass.

[seonghobae]

@coderabbitai review

Please review current head 7ea0e368eb0cd537b696e4ec5999859d13d90504, especially preserving mixed/unknown Findings as blockers while re-evaluating only the canonical peer-check-only fallback. Latest focused result: 26 tests passed, 155 statements and 68 branches covered at 100%. The earlier combined receipt/caller result was 117 passed at the preceding merge; no hosted or deployed claim is made from these local results. Independent formal review is still required.

[coderabbitai]

@seonghobae I will review the current head. I will verify fallback classification, blocker handling for mixed and unknown Findings headings, newest-review ordering, and approval eligibility.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Full local regression completed on 7ea0e368eb0cd537b696e4ec5999859d13d90504 with a clean unchanged working tree:

GITHUB_ACTIONS=true PYTHONPATH=. /private/tmp/mllo-main-integration-20260912/.venv-ci/bin/python -m pytest -q --maxfail=3

Exit 0: 3057 passed, 1 skipped, 36 subtests passed in 234.70s. Local log: /private/tmp/central-7ea0e368-full-tests.log. The skipped test is not verified. Separate focused module coverage on the same head: 155 statements and 68 branches, 100%; 26 tests passed. These replace earlier-head local results for assessment of this revision, but do not prove hosted checks, independent approval, protected merge or MLLO deployment.

[seonghobae]

Exact-head gate update for 7ea0e368eb0cd537b696e4ec5999859d13d90504.

Security Scan 34706242915, Python Security 34706242834, and SAST Semgrep 34706242829 are terminal GREEN. CodeQL PR 34706242951 is terminal FAIL: Python job 103586831978 and Actions job 103586832008 each show DISPATCH_OUTCOME=success with VERDICT_STATE=pending; coordinator job 103587430043 dispatched successfully. This is settlement/admission evidence, not a source/SARIF finding, and is routed to canonical owner #1929.

This head has no independent APPROVED review. The PR is therefore not merge-ready and must remain Draft/Proposed until the canonical handler yields a terminal unchanged-head verdict and independent review completes. No blind rerun or no-op retrigger is authorized.

[seonghobae]

The concrete unstructured-prose finding is repaired at 51299f1a4398ce8481d14bbb0515dd5367aefaee. The canonical producer now supplies a full-payload fixture; extra prose remains blocking. Final merge receipt tests pass (25), with 100% statement/branch coverage. Previous 7ea0e36 gate comments are historical.

Restoring Ready for independent review of the repaired code. Ready does not assert approval or merge readiness; required checks and independent formal approval remain enforced. This resumes the normal review event rather than bypassing checks or manually retrying a live run.

[seonghobae]

Second exact canary for #2125/#2126, preserving canonical ownership: #2114 is unchanged at e7c58c04ed7e59c23cbe4a5f38d4c522ae712712. Its Runtime Quality, Security, Python Security, SAST, and CodeQL are now all terminal GREEN. The current-head OpenCode CHANGES_REQUESTED receipt was the deterministic peer-check fallback created before that rollup became clean; it contains no new source/parser finding.

A fresh @opencode-agent review on unchanged #2114 routed correctly through the mention router and OpenCode forwarder, but Required PR Review Merge Scheduler run 34718967679 terminated with block: current-head OpenCode review requested changes. That reproduces the same-head stale-fallback deadlock #2126 is intended to repair on a second owner PR, not only the original #2113 canary. Acceptance should therefore include: once #2126 is protected-main integrated, repeat the unchanged-head #2114 review request and require a new authenticated current-head verdict rather than the old peer-check-only fallback remaining terminal. Source-level REQUEST_CHANGES must still stay terminal.

#2126's own current Noema RED was separately RCA'd: exact-head job 103589243128 provisioned orchestrator/free, had five ready routes, then the gateway call failed after 1623.7s with HTTP 502 (phase=response_error, served model deepseek-ai/deepseek-v4-flash-0731), explicitly stating gateway owns repair/failover. This is not a #2126 source finding. I issued one targeted rerun of that failed Noema job only; no source/no-op commit, Draft toggle, provider override, or gate weakening was used. The current OpenCode required job likewise failed only because no authenticated exact-head verdict had yet been published after successful dispatch.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 51299f1a4398ce8481d14bbb0515dd5367aefaee.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34707140933/job/103621703488)
• noema-review check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34707140933/job/103621703488)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Docs: opencode-peer-check-reevaluation.md"]
  S1 --> I1["operator or user guidance"]
  I1 --> R1["Review risk: Docs: opencode-peer-check-reevaluation.md"]
  R1 --> V1["docs review"]
  Evidence --> S2["CI script: opencode_review_receipt_gate.py"]
  S2 --> I2["review and security gate shell path"]
  I2 --> R2["Review risk: CI script: opencode_review_receipt_gate.py"]
  R2 --> V2["bash -n plus Strix self-test"]
  Evidence --> S3["Test: test_opencode_review_receipt_gate.py"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test: test_opencode_review_receipt_gate.py"]
  R3 --> V3["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 51299f1a4398ce8481d14bbb0515dd5367aefaee
• Workflow run: 34719432879
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES
• Coverage gate: success
• Model pool: exhausted
• Verdict: REQUEST_CHANGES
• Formal review: fix(review): re-evaluate fallback change requests #2126 (review)

[seonghobae]

Fresh downstream acceptance case for this receipt contract: .github#2114@e7c58c04ed7e59c23cbe4a5f38d4c522ae712712 now has an OpenCode CHANGES_REQUESTED receipt whose body is exactly the peer-check fallback class this PR is intended to re-evaluate. The receipt names only Required Noema failure (34716210618) and pre-scan Strix cancellations (34716210593); it contains no product/parser finding. #2114's owned Runtime Quality, CodeQL, Security, Semgrep, and Python Security gates are otherwise converged.

Use unchanged #2114 as the post-integration acceptance consumer: after this contract lands normally and its Noema/Strix peers recover, a fresh formal review must be requested rather than treating the old peer-only CHANGES_REQUESTED as substantive forever. Conversely, mixed or unknown prose must remain blocking exactly as this branch's current tests require. This does not authorize #2126 or #2114 merge; #2126 itself still needs exact-head peer-check/review convergence and protected integration.

[seonghobae]

Exact-head Noema acceptance update — 51299f1a4398ce8481d14bbb0515dd5367aefaee

Required Noema run 34707140933 has now settled on attempt 3 as terminal failure; this supersedes the earlier in-progress snapshot without changing the PR head. The failure is not in receipt-gate source/admission:

• admit-current-head job 103635607651: SUCCESS on the exact live head;
• noema-review job 103635607612: live-head validation, reviewer credential selection, repository-scoped App token, repository visibility, and contextual-orchestrator sidecar provisioning all SUCCESS;
• Provision contextual-orchestrator review sidecar: SUCCESS (23:03:18Z–23:14:45Z);
• Prepare Noema model verdict: FAILURE (23:14:45Z–23:20:57Z);
• verdict publication was therefore skipped, and the failure-evidence upload succeeded.

This is a second unchanged-head serving/model-verdict-stage failure after attempt 2. Attempt 2's provider/probe details remain historical evidence already attached to .github#1948; this attempt's job metadata alone does not justify projecting those same 429/timeout/502 causes onto attempt 3. Do not churn this PR head or weaken receipt semantics to manufacture a fresh review. The next repair belongs to the existing Noema/free-pool/serving owner path; after that repair, rerun the unchanged exact head and require a substantive authenticated review before ordinary integration.

[seonghobae]

Attempt 3 gives a stronger RCA and changes the next action: do not rerun this unchanged head again against the current central sidecar pin.

Exact head remains 51299f1a4398ce8481d14bbb0515dd5367aefaee. Required Noema run 34707140933, attempt 3, job 103635607612 passed stale-trigger rejection, credential selection, repository App token minting, live-head validation and sidecar provisioning, then failed only in Prepare Noema model verdict. Retained artifact 10307437409 is exact-head bound.

The artifact shows the central sidecar reached ready_count=4 during preflight, but its vendored CO runtime repeatedly cuts provider calls at ~90 seconds (observed 90.051–90.105s across NIM/NIM_SUB routes, plus 90.085s and 90.102s in the verdict path) and ends 502 provider_connection_error. Protected .github/main@fb17ef556f94f673234aa557254ae52779e9a7b0 still hard-pins CO 414f22973658c4ddc3d4320fcf7acd9b4e8ba991; protected CO has since advanced to 012beaacd0631f8cd3391c77744eeb626269b5de but still has no immutable GitHub Release.

So this Noema RED is review-infrastructure/runtime evidence, not a new #2126 source finding. The current OpenCode CHANGES_REQUESTED remains fail-closed and non-approving, but another targeted Noema rerun against the same stale pin is not a repair. Canonical next boundary is CO immutable release (#1030 owner) -> central released-identity/gateway-only migration (#1759 owner) -> unchanged #2126 exact-head Noema/OpenCode revalidation. Keep this PR source-stable until that owner path changes the runtime actually consumed here.

[seonghobae]

2026-09-20 exact-head admission correction for 51299f1a4398ce8481d14bbb0515dd5367aefaee.

This PR is not currently merge-ready: the branch is 277 commits behind protected main@e6334e2..., has CHANGES_REQUESTED with no qualifying current-head approval, and its GREEN receipts predate the current protected-base relation. Ready state would keep non-admissible work in the saturated runner/review queue and can make stale receipts appear current.

Moving the PR to Draft / Proposed preserves every commit, review, thread, and valid delta. It is not closure or abandonment. Reconcile protected main non-destructively where needed, resolve all valid findings, obtain terminal exact-head Checks and a qualifying independent current-head approval, then return to Ready. No review dismissal, synthetic status, manual rerun, bypass, Force Push, or merge is authorized by this correction.

[seonghobae]

Exact-head integration review for 1a85dbeebdbfb5399f151545bc727ce6e9f88ce0. The branch is now an ordinary two-parent/non-force descendant of the previous #2126 head and protected main@e6334e229581a918e2f22de18733b76fa65d7e71; fresh compare is behind_by=0 and the effective delta remains exactly the intended three receipt-contract files. Current producer wording on protected main is consumed dynamically by the regression, so the convergence did not freeze a stale producer fixture. Fresh hosted SAST/Python Security/Security/CodeQL are queued and therefore this comment is not GREEN evidence or an approval. Keep Draft until current-head hosted acceptance and independent formal review settle.