feat(destination): bound resolution freshness authority - #47
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthrough
Changes신선한 해상도 검증
Estimated code review effort: 4 (Complex) | ~45 minutes Mergeability Score: ⚪ Minimal · up to This PR adds a bounded freshness authority for destination resolution, with the reported checks passing and no actionable merge-blocking risk remaining beyond normal review. Sequence Diagram(s)sequenceDiagram
participant FreshResolutionSnapshot
participant DestinationPolicy
participant FreshConnectionEvidence
FreshResolutionSnapshot->>DestinationPolicy: 주소 정책과 원본 바인딩 검증
DestinationPolicy-->>FreshResolutionSnapshot: 승인 가능한 주소 집합 반환
FreshResolutionSnapshot->>FreshConnectionEvidence: 승인·만료·인가 시각을 포함한 연결 증거 생성
FreshConnectionEvidence-->>FreshResolutionSnapshot: 연결 증거와 시간 정보 제공
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head79cf275686e2376a51783a2d03128eca21e7c0e5. -
Head SHA:
79cf275686e2376a51783a2d03128eca21e7c0e5 -
Workflow run: 31951179896
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
|
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head8b4b9901f07b27727c84c73f58fb88f011551981. -
Head SHA:
8b4b9901f07b27727c84c73f58fb88f011551981 -
Workflow run: 32056056319
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
1 participant
Buyer-visible gap
Protected-main destination policy can pin and non-expansively revalidate DNS answers, but it needs an explicit bounded approval-to-use interval so DNS-rebinding/TOCTOU evidence cannot be reused indefinitely.
Implemented boundary
Current exact head
8b4b9901f07b27727c84c73f58fb88f011551981implements deterministicFreshResolutionSnapshotauthority with:MAX_RESOLUTION_VALIDITY;approved_at <= now < valid_until);The primitive performs no DNS lookup, socket I/O, wall-clock read, proxy selection, TLS, HTTP, browser control, persistence, or model call.
Current exact state
Protected
main:0841d2ab3d8b5e60a03c0a8e818cf438e2716829.Contributor head:
8b4b9901f07b27727c84c73f58fb88f011551981.Fresh comparison reports ahead 10 / behind 0 with merge base exactly protected main. GitHub reports the PR open, Ready and mergeable.
Exact-head evidence
On unchanged exact head
8b4b9901f07b27727c84c73f58fb88f011551981:CIrun31973585673: success;Security Scanrun31973585727: success;SAST Semgreprun31973585722: success;CHANGES_REQUESTEDreview was tied to predecessor head79cf275686e2376a51783a2d03128eca21e7c0e5during a historical coverage failure and is dismissed stale evidence, not current failure or approval.No predecessor-head check, review or status is promoted as current evidence.
Live governance / scope
Organization ruleset
18156473was bounded-refetched after concurrent rule movement and is stable at its2026-08-17T19:09:58.695+09:00revision: the seven configured central workflows are required,required_approving_review_count=1,require_last_push_approval=true,required_review_thread_resolution=true, anddismiss_stale_reviews_on_push=true. There are no bypass actors and the current user cannot bypass.An earlier 18:23 ruleset revision temporarily exposed zero approval/latest-push/thread requirements; that snapshot is historical and must not control integration. All currently applicable exact-head workflows are green and no review thread is open, but no qualifying independent current-head/latest-push formal approval is established. Passing automation and stale-review dismissal are not approval. Protected-main
AGENTS.mdindependently forbids scheduled agents from merging, self-approving, altering workflows, adding secrets, weakening checks, tagging, or publishing. The clean head therefore remains unchanged while integration waits for a qualifying independent latest-push approval; that wait blocks only integration and does not justify source churn.This slice is the independently reusable deterministic freshness authority in
originweave-destination; it does not by itself close the full DNS-rebinding/TOCTOU network path. Dependent network-stack PRs must independently reconcile ancestry and regenerate exact-head evidence after this prerequisite changes or integrates.