feat(enterprise): fit governed calibration reports - #546
Conversation
|
Important Review skippedNo new commits to review since the last review. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe change adds governed enterprise calibration-report fitting, public exports, deterministic validation, provenance controls, privacy tests, convergence-aware trace validation, and bounded HTML output publication. ChangesEnterprise calibration reporting
Essay report trace and publication controls
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Caller
participant EnterpriseReporting
participant BundleBuilder
participant SharedFacetFitter
participant ReportTuple
Caller->>EnterpriseReporting: submit executions and report parameters
EnterpriseReporting->>BundleBuilder: validate and build governed bundle
EnterpriseReporting->>SharedFacetFitter: fit each criterion design
SharedFacetFitter-->>EnterpriseReporting: return shared calibration report
EnterpriseReporting-->>ReportTuple: return reports in criterion order
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@coderabbitai review @opencode-agent @cwl-noema-review Review the exact current implementation head after the focused validation commit lands. Verify that the enterprise workflow calls the governed bundle assembler once, normalizes review triggers once, delegates each canonical criterion design once to the exact shared Rust-backed report helper, returns only |
|
|
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage evidence job did not run or did not publish coverage evidence. Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (5 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (5 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs (7 files)"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs (7 files)"]
R2 --> V2["docs review"]
Evidence --> S3["Test (3 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (3 files)"]
R3 --> V3["targeted test run"]
|
|
@opencode-agent @cwl-noema-review Re-run exact-head coverage and review for |
|
The exact-head OpenCode Central issue ContextualWisdomLab/.github#784 defines the fail-closed repair, and draft PR ContextualWisdomLab/.github#789 adds the bounded classifier and exact-head native peer-check verifier with 81 focused tests and 100% statement/branch coverage. No product test is skipped, no Python substitute is added, and no approval or merge rule is weakened. Keep this PR unmerged until the central workflow integration lands and a fresh exact-head independent approval replaces the current request-changes verdict. |
|
@cwl-noema-review Re-evaluate exact unchanged head |
|
@opencode-agent @cwl-noema-review @coderabbitai review Re-run the independent review on exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/fast-mlsirm'
sha='d111e2b1341b0daab6b813074c7a7dbcf5c24ff4'
echo '== Exact commit =='
git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' HEAD
test "$(git rev-parse HEAD)" = "$sha"
echo '== PR head, checks, and reviews =='
gh pr view 546 --repo "$repo" --json headRefOid,state,isDraft,statusCheckRollup,reviews \
--jq '{headRefOid,state,isDraft,statusCheckRollup,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid,submittedAt}]}'
echo '== Check runs pinned to exact commit =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" \
--jq '.check_runs[] | {name,status,conclusion,app:.app.slug,details_url,started_at,completed_at}'
echo '== Current unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='fast-mlsirm' -F number=546 \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved isOutdated path line
comments(first: 10) { nodes { author { login } body } }
}
}
}
}
}' \
--jq '.data.repository.pullRequest.reviewThreads.nodes[] | select((.isResolved | not) and (.isOutdated | not))'
echo '== Relevant source outlines =='
ast-grep outline python/fast_mlsirm/scoring/enterprise_issue/reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/enterprise_issue/calibration.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/essay/calibration_reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/essay/calibration_report_html.py --items all --view expanded
echo '== Enterprise reporting implementation =='
sed -n '1,340p' python/fast_mlsirm/scoring/enterprise_issue/reporting.py
echo '== Canonical bundle ordering and shared Rust-backed helper =='
rg -n -C 10 \
'def build_enterprise_issue_facets_calibration_bundle|sorted\(|def fit_scoring_facets_calibration_report|fit_scoring_facets_design\(' \
python/fast_mlsirm/scoring/enterprise_issue/calibration.py \
python/fast_mlsirm/scoring/calibration_reporting.py \
python/fast_mlsirm/scoring/calibration.py
echo '== Trace and output-root implementation =='
sed -n '1,220p' python/fast_mlsirm/scoring/essay/calibration_reporting.py
sed -n '1,300p' python/fast_mlsirm/scoring/essay/calibration_report_html.py
echo '== Focused test evidence =='
sed -n '1,520p' tests/test_scoring_enterprise_issue_calibration_reporting.py
sed -n '1,280p' tests/test_scoring_essay_facets_report_html_output_security.py
echo '== Coverage and docstring configuration/evidence =='
fd -HI '^(pyproject\.toml|pytest\.ini|\.coveragerc|tox\.ini)$' . -x sh -c 'echo "--- $1"; rg -n -C 5 "coverage|branch|fail_under|docstring|interrogate" "$1" || true' sh {}
rg -n -C 5 'coverage|branch|docstring|enterprise_issue_facets_calibration_reports' \
.github docs CHANGELOG.md -g '*.yml' -g '*.yaml' -g '*.md' 2>/dev/null || trueLength of output: 203198 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/fast-mlsirm'
sha='d111e2b1341b0daab6b813074c7a7dbcf5c24ff4'
log='/tmp/coderabbit-shell-logs/shell-output-Jvd17V'
echo '== Saved-log section markers =='
rg -n '^== (Exact commit|PR head, checks, and reviews|Check runs pinned|Current unresolved|Relevant source outlines|Enterprise reporting implementation|Canonical bundle ordering|Trace and output-root implementation|Focused test evidence|Coverage and docstring)' "$log"
echo '== Exact-head metadata from saved log =='
sed -n '1,260p' "$log"
echo '== Exact-head checks and independent reviews =='
gh pr view 546 --repo "$repo" --json headRefOid,statusCheckRollup,reviews \
--jq '{headRefOid,checks:[.statusCheckRollup[]|{name:.name,status:.status,conclusion:.conclusion,workflowName:.workflowName}],reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid,submittedAt}]}'
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" \
--jq '[.check_runs[]|{name,status,conclusion,app:.app.slug,details_url}]'
echo '== Current central workflow coverage and docstring evidence =='
gh run view 30989444525 --repo "$repo" --json headSha,status,conclusion,jobs \
--jq '{headSha,status,conclusion,jobs:[.jobs[]|{name,status,conclusion,databaseId}]}'
gh run view 30989444525 --repo "$repo" --log-failed 2>&1 || true
gh run view 30989444525 --repo "$repo" --log 2>&1 | rg -n -i -C 3 'coverage|fail-under|100%|docstring|enterprise_issue|calibration_report' || true
echo '== Orchestration and shared fitting boundary =='
sed -n '1,280p' python/fast_mlsirm/scoring/enterprise_issue/reporting.py
rg -n -C 8 \
'def build_enterprise_issue_facets_calibration_bundle|def fit_scoring_facets_calibration_report|fit_scoring_facets_design\(' \
python/fast_mlsirm/scoring/enterprise_issue/calibration.py \
python/fast_mlsirm/scoring/calibration_reporting.py \
python/fast_mlsirm/scoring/calibration.py
echo '== Trace and output confinement =='
rg -n -C 12 \
'def _validate_iteration_trace_length|def render_essay_facets_calibration_report_html|output_root|resolve\(|is_relative_to|mkdir|write_text' \
python/fast_mlsirm/scoring/essay/calibration_reporting.py \
python/fast_mlsirm/scoring/essay/calibration_report_html.py
echo '== Focused assertions =='
rg -n -C 6 \
'build_enterprise_issue_facets_calibration_bundle|fit_scoring_facets_calibration_report|report_id|metadata|source|issue|n_iter|output_root|symlink|absolute|traversal' \
tests/test_scoring_enterprise_issue_calibration_reporting.py \
tests/test_scoring_essay_facets_report_html_output_security.pyLength of output: 108897
I found no actionable implementation defect in the inspected boundary.
The workflow returns The trace contract is consistent. A nonconverged fit can retain one terminal likelihood after The HTML renderer resolves the approved root and output before the write. It rejects traversal and absolute escapes outside the root. It resolves existing symlink parents before containment checks. It rejects a non-directory root. It rechecks the resolved parent after directory creation. The documented caller-owned-root condition limits the remaining filesystem race boundary. The current exact-head evidence is successful for CI I cannot submit ✅ Action performedReview finished.
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Re-review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/fast-mlsirm'
sha='d111e2b1341b0daab6b813074c7a7dbcf5c24ff4'
echo '== exact local head =='
git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' HEAD
test "$(git rev-parse HEAD)" = "$sha"
echo '== current PR state, exact head, checks, reviews =='
gh pr view 546 --repo "$repo" \
--json state,isDraft,headRefOid,statusCheckRollup,reviews \
--jq '{state,isDraft,headRefOid,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}],reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid,submittedAt}]}'
echo '== exact-head check runs =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,details_url,started_at,completed_at}]'
echo '== unresolved current review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='fast-mlsirm' -F number=546 \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) {
nodes { author { login } body }
}
}
}
}
}
}' \
--jq '.data.repository.pullRequest.reviewThreads.nodes[] | select((.isResolved | not) and (.isOutdated | not))'
echo '== relevant source outlines =='
ast-grep outline python/fast_mlsirm/scoring/enterprise_issue/reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/enterprise_issue/calibration.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/calibration_reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/essay/calibration_reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/essay/calibration_report_html.py --items all --view expanded
echo '== enterprise reporting implementation =='
sed -n '1,340p' python/fast_mlsirm/scoring/enterprise_issue/reporting.py
echo '== canonical design order and shared Rust-backed fitting boundary =='
rg -n -C 10 \
'def build_enterprise_issue_facets_calibration_bundle|sorted\(|def fit_scoring_facets_calibration_report|fit_scoring_facets_design\(' \
python/fast_mlsirm/scoring/enterprise_issue/calibration.py \
python/fast_mlsirm/scoring/calibration_reporting.py \
python/fast_mlsirm/scoring/calibration.py
echo '== trace validation and output-root confinement =='
sed -n '1,260p' python/fast_mlsirm/scoring/essay/calibration_reporting.py
sed -n '1,340p' python/fast_mlsirm/scoring/essay/calibration_report_html.py
echo '== focused tests =='
sed -n '1,560p' tests/test_scoring_enterprise_issue_calibration_reporting.py
sed -n '1,320p' tests/test_scoring_essay_facets_report_html_output_security.py
echo '== coverage and docstring configuration =='
fd -HI '^(pyproject\.toml|pytest\.ini|\.coveragerc|tox\.ini)$' . \
-x sh -c 'echo "--- $1"; rg -n -C 6 "coverage|branch|fail_under|docstring|interrogate" "$1" || true' sh {}
echo '== workflow references to coverage and docstrings =='
rg -n -i -C 6 \
'coverage-source-tree|coverage-evidence|fail-under|branch coverage|100%|docstring|interrogate' \
.github docs CHANGELOG.md -g '*.yml' -g '*.yaml' -g '*.md' 2>/dev/null || true
echo '== exact CI evidence =='
gh run view 30989444525 --repo "$repo" --json headSha,status,conclusion,jobs \
--jq '{headSha,status,conclusion,jobs:[.jobs[]|{name,status,conclusion,databaseId}]}'
gh run view 30989444525 --repo "$repo" --log 2>&1 \
| rg -n -i -C 3 'coverage|fail-under|100%|docstring|enterprise_issue|calibration_report' || trueLength of output: 170334 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/fast-mlsirm'
sha='d111e2b1341b0daab6b813074c7a7dbcf5c24ff4'
echo '== coverage and docstring evidence job logs =='
for job in 92252058660 92252152867; do
echo "--- job $job ---"
gh run view 30989443683 --repo "$repo" --job "$job" --log 2>&1 \
| rg -n -i -C 5 \
'coverage|TOTAL|reporting\.py|calibration_report_html\.py|fail-under|100%|docstring|missing|passed|failed' \
|| true
done
echo '== OpenCode exact-head request-changes review =='
gh pr view 546 --repo "$repo" --json reviews \
--jq '.reviews[] | select(.author.login == "opencode-agent" and .commit.oid == "'"$sha"'") | {state,submittedAt,body}'
echo '== current PR mergeability and review requirements =='
gh pr view 546 --repo "$repo" \
--json mergeStateStatus,reviewDecision,isDraft,headRefOid,baseRefOid \
--jq '{mergeStateStatus,reviewDecision,isDraft,headRefOid,baseRefOid}'
echo '== bounded output-path helpers =='
sed -n '450,560p' python/fast_mlsirm/scoring/essay/calibration_report_html.py
echo '== report helper delegation =='
sed -n '400,475p' python/fast_mlsirm/scoring/essay/calibration_reporting.py
echo '== changed files and public documentation/changelog entries =='
base="$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD HEAD^)"
git diff --name-status "$base" HEAD
sed -n '1,220p' docs/enterprise_issue_facets_calibration_reports.md
sed -n '1,150p' docs/changelog.d/enterprise-issue-facets-calibration-reports.mdLength of output: 17787
I found no actionable implementation defect in the inspected code and tests.
The shared report helper delegates to The workflow returns The terminal trace rule is consistent. A nonconverged fit can retain one terminal likelihood after The HTML renderer confines publication to the resolved caller-approved root. It rejects non-directory roots and paths that escape through relative, absolute, or existing symlink paths. It revalidates the resolved parent after directory creation and before the write. The exact-head CI, Security Scan, SAST, Strix, I cannot submit an approval. GitHub returned HTTP 404 when I requested the current Re-run or expose the exact-head coverage and docstring logs. Then replace or resolve the active request-changes review under repository policy. Obtain an independent exact-head approval before merge.
|
|
@opencode-agent @cwl-noema-review Re-run the independent exact-head review for |
|
Exact-current-head review requested for @opencode-agent |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/fast-mlsirm'
sha='d111e2b1341b0daab6b813074c7a7dbcf5c24ff4'
echo '== exact local commit =='
git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' HEAD
test "$(git rev-parse HEAD)" = "$sha"
echo '== PR head, checks, and formal reviews =='
gh pr view 546 --repo "$repo" \
--json state,isDraft,headRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,reviews \
--jq '{state,isDraft,headRefOid,mergeStateStatus,reviewDecision,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}],reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid,submittedAt}]}'
echo '== check runs pinned to exact commit =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" \
--jq '[.check_runs[]|{name,status,conclusion,app:.app.slug,details_url}]'
echo '== unresolved current threads =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='fast-mlsirm' -F number=546 \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved isOutdated path line
comments(first: 10) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select((.isResolved | not) and (.isOutdated | not))'
echo '== changed files =='
base="$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD HEAD^)"
git diff --name-status "$base" HEAD
echo '== source outlines =='
ast-grep outline python/fast_mlsirm/scoring/enterprise_issue/reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/enterprise_issue/calibration.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/calibration_reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/essay/calibration_reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/essay/calibration_report_html.py --items all --view expanded
echo '== orchestration and shared Rust-backed boundary =='
sed -n '1,320p' python/fast_mlsirm/scoring/enterprise_issue/reporting.py
rg -n -C 10 \
'def build_enterprise_issue_facets_calibration_bundle|sorted\(|def fit_scoring_facets_calibration_report|fit_scoring_facets_design\(' \
python/fast_mlsirm/scoring/enterprise_issue/calibration.py \
python/fast_mlsirm/scoring/calibration_reporting.py \
python/fast_mlsirm/scoring/calibration.py
echo '== trace and output-root code =='
rg -n -C 14 \
'def _validate_iteration_trace_length|def render_essay_facets_calibration_report_html|output_root|resolve\(|is_relative_to|mkdir|write_text' \
python/fast_mlsirm/scoring/essay/calibration_reporting.py \
python/fast_mlsirm/scoring/essay/calibration_report_html.py
echo '== focused test assertions =='
rg -n -C 7 \
'build_enterprise_issue_facets_calibration_bundle|fit_scoring_facets_calibration_report|report_id|metadata|source|issue|n_iter|output_root|symlink|absolute|traversal|coverage' \
tests/test_scoring_enterprise_issue_calibration_reporting.py \
tests/test_scoring_essay_facets_report_html_output_security.py
echo '== coverage/docstring configuration and docs =='
fd -HI '^(pyproject\.toml|pytest\.ini|\.coveragerc|tox\.ini)$' . \
-x sh -c 'echo "--- $1"; rg -n -C 6 "coverage|branch|fail_under|docstring|interrogate" "$1" || true' sh {}
rg -n -i -C 5 \
'coverage-source-tree|coverage-evidence|branch coverage|100%|docstring|APA|enterprise_issue_facets_calibration_reports' \
.github docs CHANGELOG.md -g '*.yml' -g '*.yaml' -g '*.md' 2>/dev/null || trueLength of output: 194942
I found no actionable implementation defect.
The shared helper retains the existing Rust-backed The workflow returns only The trace contract is consistent. A nonconverged fit can retain one terminal likelihood value after The HTML renderer confines output to the resolved caller-approved root. The current working directory is the default root. It rejects relative, absolute, and existing-symlink escapes. It rejects a non-directory root. It rechecks the resolved parent after directory creation and before the write. The exact-head checks succeeded for Python, Rust, package, GPU smoke, fuzz, SAST, Security Scan, Strix, I cannot approve the PR. The exact-head
|
|
@coderabbitai review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/fast-mlsirm'
sha='d111e2b1341b0daab6b813074c7a7dbcf5c24ff4'
echo '== exact local commit =='
git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' HEAD
test "$(git rev-parse HEAD)" = "$sha"
echo '== exact-head PR checks and formal reviews =='
gh pr view 546 --repo "$repo" \
--json state,isDraft,headRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,reviews \
--jq '{state,isDraft,headRefOid,mergeStateStatus,reviewDecision,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}],reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid,submittedAt}]}'
echo '== check runs pinned to exact commit =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,details_url}]'
echo '== unresolved current review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='fast-mlsirm' -F number=546 \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved isOutdated path line
comments(first: 10) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select((.isResolved | not) and (.isOutdated | not))'
echo '== implementation outlines =='
ast-grep outline python/fast_mlsirm/scoring/enterprise_issue/reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/enterprise_issue/calibration.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/calibration_reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/essay/calibration_reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/essay/calibration_report_html.py --items all --view expanded
echo '== enterprise orchestration and shared fitting boundary =='
sed -n '1,340p' python/fast_mlsirm/scoring/enterprise_issue/reporting.py
rg -n -C 10 \
'def build_enterprise_issue_facets_calibration_bundle|sorted\(|def fit_scoring_facets_calibration_report|fit_scoring_facets_design\(' \
python/fast_mlsirm/scoring/enterprise_issue/calibration.py \
python/fast_mlsirm/scoring/calibration_reporting.py \
python/fast_mlsirm/scoring/calibration.py
echo '== trace and output-root implementation =='
sed -n '1,250p' python/fast_mlsirm/scoring/essay/calibration_reporting.py
sed -n '430,590p' python/fast_mlsirm/scoring/essay/calibration_report_html.py
echo '== focused tests =='
sed -n '1,560p' tests/test_scoring_enterprise_issue_calibration_reporting.py
sed -n '1,340p' tests/test_scoring_essay_facets_report_html_output_security.py
echo '== coverage/docstring configuration and documentation =='
fd -HI '^(pyproject\.toml|pytest\.ini|\.coveragerc|tox\.ini)$' . \
-x sh -c 'echo "--- $1"; rg -n -C 6 "coverage|branch|fail_under|docstring|interrogate" "$1" || true' sh {}
rg -n -i -C 5 \
'coverage-source-tree|coverage-evidence|branch coverage|100%|docstring|APA|enterprise_issue_facets_calibration_reports' \
.github docs CHANGELOG.md -g '*.yml' -g '*.yaml' -g '*.md' 2>/dev/null || trueLength of output: 173379
I found no actionable implementation defect.
The shared report helper retains the existing Rust-backed The workflow returns only The HTML renderer confines publication to the canonical caller-approved root. It rejects relative, absolute, and existing-symlink escapes. It rejects a non-directory root. It rechecks the resolved parent after directory creation and before the write. The exact-head checks are successful for Python, Rust, package, GPU smoke, fuzz, SAST, Security Scan, Strix, I did not bypass the remaining review requirements. The exact-head
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headd111e2b1341b0daab6b813074c7a7dbcf5c24ff4. -
Head SHA:
d111e2b1341b0daab6b813074c7a7dbcf5c24ff4 -
Workflow run: 30993478444
-
Workflow attempt: 2
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (5 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (5 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs (7 files)"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs (7 files)"]
R2 --> V2["docs review"]
Evidence --> S3["Test (3 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (3 files)"]
R3 --> V3["targeted test run"]
Dismissed as obsolete infrastructure-only evidence. The review identified no product-source defect and was based on failed central coverage-evidence workflow run 30993478444 attempt 1. The exact unchanged head subsequently passed repository CI 30989444525, SAST 30989444533, Security Scan 30989444567, Strix 30989443777, and repaired current coverage-source-tree/coverage-evidence checks. A fresh independent exact-head approval remains required before merge.
|
@opencode-agent @cwl-noema-review The two stale |
|
@opencode-agent review Re-evaluate the live exact current head under the repaired central coverage contract. Treat old coverage-workflow failures as stale only after current evidence is recomputed. Review the governed enterprise calibration orchestration, exact provenance, privacy, Rust trace compatibility, and canonical publication-root confinement. Submit a formal current-head verdict; do not mutate or merge. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/fast-mlsirm'
pr_number='546'
echo '== live PR metadata, checks, and reviews =='
gh pr view "$pr_number" --repo "$repo" \
--json state,isDraft,headRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,reviews \
--jq '{
state,
isDraft,
headRefOid,
mergeStateStatus,
reviewDecision,
checks: [.statusCheckRollup[] | {name,status,conclusion,workflowName}],
reviews: [.reviews[] | {author:.author.login,state,commit:.commit.oid,submittedAt}]
}'
echo '== local checkout =='
git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' HEAD
sha="$(gh pr view "$pr_number" --repo "$repo" --json headRefOid --jq .headRefOid)"
echo "== exact-head check runs: $sha =="
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,details_url}]'
echo '== unresolved, non-outdated review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='fast-mlsirm' -F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
| select((.isResolved | not) and (.isOutdated | not))'
echo '== implementation outlines =='
ast-grep outline python/fast_mlsirm/scoring/enterprise_issue/reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/enterprise_issue/calibration.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/calibration_reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/essay/calibration_reporting.py --items all --view expanded
ast-grep outline python/fast_mlsirm/scoring/essay/calibration_report_html.py --items all --view expanded
echo '== enterprise orchestration =='
sed -n '1,340p' python/fast_mlsirm/scoring/enterprise_issue/reporting.py
echo '== canonical ordering and Rust-backed report delegation =='
rg -n -C 10 \
'def build_enterprise_issue_facets_calibration_bundle|sorted\(|def fit_scoring_facets_calibration_report|fit_scoring_facets_design\(' \
python/fast_mlsirm/scoring/enterprise_issue/calibration.py \
python/fast_mlsirm/scoring/calibration_reporting.py \
python/fast_mlsirm/scoring/calibration.py
echo '== trace validation and output-root confinement =='
rg -n -C 14 \
'def _validate_iteration_trace_length|def render_essay_facets_calibration_report_html|output_root|resolve\(|is_relative_to|mkdir|write_text' \
python/fast_mlsirm/scoring/essay/calibration_reporting.py \
python/fast_mlsirm/scoring/essay/calibration_report_html.py
echo '== focused test assertions =='
rg -n -C 7 \
'build_enterprise_issue_facets_calibration_bundle|fit_scoring_facets_calibration_report|report_id|metadata|source|issue|n_iter|output_root|symlink|absolute|traversal' \
tests/test_scoring_enterprise_issue_calibration_reporting.py \
tests/test_scoring_essay_facets_report_html_output_security.py
echo '== coverage, docstring, documentation, and changelog evidence =='
fd -HI '^(pyproject\.toml|pytest\.ini|\.coveragerc|tox\.ini)$' . \
-x sh -c 'echo "--- $1"; rg -n -C 5 "coverage|branch|fail_under|docstring|interrogate" "$1" || true' sh {}
rg -n -i -C 5 \
'coverage-source-tree|coverage-evidence|branch coverage|100%|docstring|APA|enterprise_issue_facets_calibration_reports' \
.github docs CHANGELOG.md -g '*.yml' -g '*.yaml' -g '*.md' 2>/dev/null || trueLength of output: 194305
I found no actionable implementation defect.
The shared report helper retains the existing Rust-backed Each returned value is a The trace contract is consistent. A nonconverged fit can retain one terminal likelihood value after The HTML renderer resolves the caller-approved root and output path before writing. It rejects relative, absolute, and existing-symlink escapes. It rejects a non-directory root. It rechecks the resolved parent after directory creation. The current exact-head checks succeeded. This includes Python, Rust, package, GPU smoke, fuzz, The prior Pull request You are interacting with an AI system. |
|
@opencode-agent address Continue the existing PR branch and resolve every exact-current-head review and failed GitHub Check directly. Do not open a competing PR, add a Python compatibility stub for the native module, create a temporary branch writer, or reuse failed source-only coverage evidence. After the central Preserve the Rust computation layer, GPU plus low-context-switching CPU parallelism, realistic true-parameter recovery and RMSE tests, multilevel/multiple-membership and temporal-model cases, Python 3.14, 100% production statement/branch coverage and public docstrings, security/SBOM/provenance checks, APA 7 doctoring, and CHANGELOG/version discipline. Use |
2 participants
Buyer-visible gap
Enterprise executions can already be assembled into the canonical connected many-facet bundle, and the scoring package exposes domain-neutral names for the canonical Rust-backed report. This PR completes the bounded enterprise orchestration boundary so callers no longer have to manually wire criterion fitting, report IDs, review triggers, and exact bundle provenance.
Implemented boundary
build_enterprise_issue_facets_calibration_bundle()once.fit_scoring_facets_calibration_report()once per canonical criterion design.ScoringFacetsCalibrationReportvalues.Rust trace compatibility
The shared report and HTML replay gates match the Rust estimator contract: a nonconverged fit may retain one terminal post-update likelihood after its
n_iteroptimization iterations. The terminal value remains evidence and is not misreported as another iteration. Other trace cardinalities continue to fail closed.Bounded artifact publication
The standalone facets-report renderer now requires publication within one canonical caller-approved root. It rejects traversal, absolute escapes, existing symlink-parent escapes, and non-directory roots before report writes, then rechecks the canonical parent after directory creation. The current working directory is the default boundary. This is a confinement control, not an operating-system sandbox; the caller must retain authority over the approved directory during publication.
Verification
The focused suite covers deterministic orchestration, execution-order invariance, exact provenance, invalid identifiers, reserved metadata, source privacy, and a realistic connected Rust-backed two-criterion fit. The iteration-cap fixture verifies the terminal likelihood contract and publishes its HTML only beneath an explicit temporary root. Separate adversarial tests cover relative, absolute, symlink, and invalid-root paths. Added and modified production paths are held to focused 100% statement and branch coverage and complete public docstrings. Documentation, APA 7 doctoring, changelog fragments, and rendered
CHANGELOG.mdare included.Exact head
d111e2b1341b0daab6b813074c7a7dbcf5c24ff4passed repository CI30989444525, SAST Semgrep30989444533, Security Scan30989444567, and Strix30989443777. Keep the PR unmerged until current-head automated review, an independent approving review, unresolved-thread policy, and branch protection are satisfied. Do not merge by bypass.Closes #544
Advances #404
Summary by CodeRabbit
New Features
Bug Fixes
Documentation
Tests