Skip to content

PASAY-OC-CONCURRENCY-001 — bot comments must not cancel active Owner /oc runs #95

Closed
#96
Closed
PASAY-OC-CONCURRENCY-001 — bot comments must not cancel active Owner /oc runs#95
#96

Description

@jhackuy
jhackuy
opened on Aug 28, 2026

Route

workflow-governance-only · bounded one-file fix

Proven failure

On PR #94 an Owner-triggered /oc OpenCode run was actively executing, then an automated review/bot issue comment caused another opencode.yml workflow instance. The new bot-triggered instance did not need to execute the OpenCode job, but the workflow-level concurrency group with cancel-in-progress: true cancelled the already-running legitimate Owner /oc run before the job-level actor/command filter could protect it.

This is a real automation reliability defect: CodeRabbit / github-actions comments can interrupt an authorized OpenCode task on the same issue/PR.

Goal

Ensure only a new authorized human /oc execution for the same target may supersede/cancel a previous /oc execution. Bot comments, non-/oc comments, review status comments, and unrelated issue-comment events must never cancel an active Owner /oc run.

Scope

Expected changed file only:

  • .github/workflows/opencode.yml

Do not touch business code, deployment workflows, crossrepo dispatcher #94, secrets, models, permissions, runners, or Agent topology.

Preferred mature GitHub Actions pattern

Use event/dispatch gating so irrelevant issue-comment events cannot enter the same cancel-in-progress concurrency lane as a legitimate run. Keep implementation simple and native to GitHub Actions; no custom daemon/poller/watcher.

Possible acceptable solutions include a concurrency key that distinguishes actionable human /oc from ignored events, or moving/structuring trigger gating so ignored bot/non-command events cannot cancel actionable runs. The final implementation must be proven against actual GitHub Actions concurrency semantics, not assumed from job-level if behavior.

Required invariants

  1. Owner/human comment containing the accepted /oc command → OpenCode job runs.
  2. A second authorized /oc on the same issue/PR may intentionally cancel/supersede the first if this is the documented desired behavior.
  3. github-actions[bot] comment on same PR while /oc is running → active /oc is NOT cancelled.
  4. coderabbitai[bot] comment on same PR while /oc is running → active /oc is NOT cancelled.
  5. Human non-/oc comment → active /oc is NOT cancelled.
  6. Existing credential isolation and verified OpenCode 1.18.24 routing remain unchanged.
  7. No production deploy, no merge automation, no new runner.

Deterministic validation

Add/extend the smallest existing workflow validator if already in the same file mechanism; if that would require a second file, STOP and report rather than expanding scope. At minimum use actionlint/YAML parse plus a documented event/concurrency truth table showing the computed concurrency group / cancel behavior for the five cases above.

Delivery

  • one bounded branch / PR
  • no auto-merge
  • OpenCode Review + CodeRabbit
  • final report: root cause, exact workflow change, event/concurrency matrix, changed files, checks, new HEAD

STOP after review-ready PR.

Activity

  1. jhackuy commented on Aug 28, 2026

    @jhackuy
    jhackuy
    on Aug 28, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    /oc Execute PASAY-OC-CONCURRENCY-001 exactly as specified in Issue #95. This is a bounded workflow-governance fix. Change only .github/workflows/opencode.yml; do not touch #94 files, production deploy, business code, secrets, model/provider, permissions, runners, or Agent topology. First verify the proven cancellation root cause against current workflow-level concurrency semantics. Implement the minimum native GitHub Actions fix so bot/non-/oc comments can never cancel an active authorized /oc run, while a new authorized /oc on the same issue may intentionally supersede it. Validate YAML/actionlint and provide an explicit event/concurrency truth table for Owner /oc, second Owner /oc, github-actions bot comment, CodeRabbit bot comment, and human non-/oc comment. Create a review-ready PR, no merge, report branch/PR/HEAD/checks, STOP.

  2. pasay-opencode-bot commented on Aug 28, 2026

    @pasay-opencode-bot
    pasay-opencode-botBot
    on Aug 28, 2026
    Contributor

    PASAY-OC-CONCURRENCY-001 — 执行报告（STOP @ Blocker）

    1. 状态：BLOCKED — 未应用任何文件改动

    按 Issue #95 范围执行 PASAY-OC-CONCURRENCY-001。已验证根因、完成最小原生修复设计、产出 review-ready 补丁规格与事件/并发真值表。但 唯一受批准的文件编辑子代理 pasay-implementer 在硬编码沙盒绑定下拒绝编辑 workflows，且我（PASAY Lead）自身按系统约束不可编辑文件或运行 shell。未提交、未 push、未创建 PR。

    2. 已完成的子代理工作（证据链）

    子代理 任务 状态 关键产物
    explore 仓库上下文 + opencode.yml + 治理文件 + git 状态 已派出（步数耗尽前未读完 opencode.yml 与 git 子目录） 列出 .github/workflows/ 全部 8 个文件 + .github/ 其他文件
    pasay-researcher GitHub Actions 并发语义权威研究 完成 引用 docs.github.com 与 actionlint 官方文档 6 大类问题全部有出处；确认根因 + 推荐 Pattern A
    pasay-implementer 应用 .github/workflows/opencode.yml 边界编辑 拒绝（hardcoded PASAY-OC-QUAL-001 沙盒禁止改 workflows + 禁 git 命令） 零文件改动

    PASAY Lead 本人：直接 read 读完 .github/workflows/opencode.yml（117 行全文）、.git/HEAD、.git/config、AGENTS.md、SOLO_HANDOFF.md（200 行）、.trae/rules/pasay-governance.md、CURRENT_ARCHITECTURE.md（80 行）—— 无编辑工具，无 shell。

    3. 已验证的根因（官方文档支撑）

    Workflow-level concurrency.group 在 run 创建时即被求值，先于任何 job-level if:。 这是 GitHub Actions 的官方语义。

    证据：

    • concurrency.group 可使用 github 上下文（含 github.event.*），已由 Contexts reference 的「Context availability」表格明确允许。
    • 官方文档展示 concurrency.cancel-in-progress 使用表达式 ${{ !contains(github.ref, 'release/') }} —— 证实并发键/取消判定使用同一 github 上下文，发生在 job 调度前。
    • 官方推荐 fallback 模式：group: ${{ github.head_ref || github.run_id }} —— 即"非匹配事件落到唯一 key"的官方惯用法，正是本修复采用的 Pattern A。
    • issue_comment 触发器无原生正文/作者过滤；bot 账户（github-actions[bot]、coderabbitai[bot]）会以 comment.user.type == 'Bot' 送达。

    → Job-level if: 太晚，无法阻止 group 已匹配的取消。这就是 Issue 描述的 PR #94 真实失败。

    4. 最小原生修复（Pattern A，GitHub 官方惯用法）

    把现有 job if: 的同款谓词搬入 concurrency.group，使非可执行事件落到 ignored-<run_id>（永不冲突）；可执行事件保留 opencode-<N>，第二 /oc 故意落到同 group → 允许 supersede。

    当前 concurrency: 块（行 9–11）

    concurrency:
  group: opencode-${{ github.event.issue.number || github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

    替换为（review-ready patch，未应用）

    concurrency:
  group: >-
    ${{
      (github.event.comment.user.type != 'Bot'
       && (contains(github.event.comment.body, ' /oc')
           || startsWith(github.event.comment.body, '/oc')
           || contains(github.event.comment.body, ' /opencode')
           || startsWith(github.event.comment.body, '/opencode')))
      && format('opencode-{0}', github.event.issue.number || github.event.pull_request.number)
      || format('ignored-{0}', github.run_id)
    }}
  cancel-in-progress: true

    不变项（必须保留）：

    • on: 触发器（issue_comment / pull_request_review_comment, types: created）
    • 整个 jobs.opencode 块，特别是 job-level if:（行 15–20，作为 defense-in-depth）
    • 凭据隔离步骤（行 26–41）permissions:、所有 env、OpenCode 1.18.24 SHA256 校验步骤（行 59–78）、effective config 校验（行 80–96）、handler 步骤（行 98–109）、runtime 记录（行 111–117）

    5. 事件 / 并发真值表（Issue 要求的 5 例 + 自检）

    # 事件源 comment.user.type 注释正文（首词） concurrency.group 求值 与运行中 Owner /oc 同 group? 取消运行中？ job if: job 运行？ Issue 不变量
    1 Owner /oc on issue #N User /oc ... opencode-N —（首发） N/A true yes Invariant #1 ✓
    2 第二 Owner /oc on same issue #N（运行中） User /oc ... opencode-N 是 yes（intentional supersede） true yes Invariant #2 ✓
    3 github-actions[bot] 评论 on PR #N（运行中） Bot （CI 状态文本） ignored-<run_id> 否 no false no Invariant #3 ✓
    4 coderabbitai[bot] 评论 on PR #N（运行中） Bot （CodeRabbit review） ignored-<run_id> 否 no false no Invariant #4 ✓
    5 真人非 /oc 评论 on PR #N（运行中） User looks good ignored-<run_id> 否 no false no Invariant #5 ✓

    不变量 #6（凭据隔离 + OpenCode 1.18.24 路由）：本 patch 不触及 steps:、permissions:、env、OPENCODE_VERSION='1.18.24'、OPENCODE_ASSET_SHA256 —— 全部 byte-identical 保留。
    不变量 #7（无生产部署 / 无 merge 自动化 / 无新 runner）：本 patch 不引入任何 runner、不动 .github/workflows/pasay-deploy-phase1.yml、不动权限块。

    6. Blocker 详述（诚实）

    pasay-implementer 返回了明确拒绝，原文要点：

    "Never modify … workflows — The task asks me to edit .github/workflows/opencode.yml. My developer policy explicitly lists workflows among files I must never modify."
    "For PASAY-OC-QUAL-001 you may write only under .opencode-qualification/"
    "Never run git commands"
    "Different qualification identifier — PASAY-OC-CONCURRENCY-001 vs PASAY-OC-QUAL-001"

    其审计声明：Files changed: none；Git operations: none；Commit: none；Push: none；PR: none。

    约束拓扑（PASAY Lead 视角）：

    • 受批准子代理仅 3 个：explore（只读）、pasay-researcher（只读）、pasay-implementer（写但沙盒在 PASAY-OC-QUAL-001，禁 workflows/git）
    • PASAY Lead 自身系统约束：「Never edit files or run shell commands yourself. Never use general or any unapproved subagent.」
    • 因此本任务在当前受批准代理拓扑下 无路可执行文件写入

    7. Git / 分支 / PR / HEAD / 检查 当前真值

    项 真值
    当前 HEAD opencode/issue95-20260828144049（未变）
    新增 commit 无
    新增 push 无
    新增 PR 无
    Checks（GitHub Actions） 无新运行（无 commit → 无触发）
    actionlint / YAML 校验 未执行（无文件改动可校验）
    修改的文件 无

    注：环境为容器化 git 工作区，.git/refs/heads/ 与 .git/refs/remotes/origin/ 当前为空（仅 .git/HEAD 指向工作分支）；按系统上下文，自动 push/PR 基础设施将在"我的响应之后"处理 working tree 状态——而本 working tree 未被任何受批准代理改动，故无 push。

    8. STOP

    按 AGENTS.md §5「Agent self-report is never enough to claim success」与系统约束「Never redefine scope / Never ask the user」，本任务在此节点诚实 STOP。补丁已完整规格化（§4）+ 真值表已对所有 6 条不变量证明（§5）+ 根因已对官方文档证明（§3）。唯一缺口是无可用代理可将其落地——这超出 PASAY Lead 的执行边界，需要由具备 workflow-edit 资格的子代理或 Owner 接手应用。

    完整 subagent evidence chain：

    • explore：派 → 部分完成（步数受限）
    • pasay-researcher：派 → 完成（官方文档全引用）
    • pasay-implementer：派 → 拒绝（硬沙盒越界，零文件改动）

    github run

  3. jhackuy
    closed this as completedin #96on Aug 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions