feat(kdo): integrate H5-R2B H2 repeat-call advisory - #67
Conversation
|
Warning Review limit reached
Next review available in: 4 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (11)
Comment |
8c04d3b to
d5c9f1b
Compare
0c91b48 to
ad41442
Compare
PR Summary by Qodofeat(kdo): H5-R2B H2-bound repeat-call advisory integration
AI Description
Diagram
High-Level Assessment
Files changed (11)
|
Code Review by Qodo
1. Forged repeat state accepted
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| if ( | ||
| derived.nextState.toolName !== signal.toolName || | ||
| derived.nextState.toolInputIdentity !== signal.toolInputIdentity || | ||
| derived.nextState.callFingerprint !== signal.callFingerprint |
There was a problem hiding this comment.
1. Forged repeat state accepted 🐞 Bug ⛨ Security
The projector compares only the bound call fields, so a signal with arbitrary priorStateIdentity and nextStateIdentity is accepted once its unkeyed SHA-256 identity is recomputed. This permits a threshold-two system advisory without a canonical count-1-to-count-2 R2A transition.
Agent Prompt
## Issue description
The advisory source-binding check validates only tool identity fields and does not prove that the signal's prior and next state identities are the canonical count-1 and count-2 states.
## Issue Context
`validateRepeatCallAdvisorySignalJson` establishes internal hash consistency, not authenticity or derivation from the bound call. Derive the first transition from `null`, derive the second transition from that state, and compare the supplied canonical signal against the complete expected threshold-two signal.
## Fix Focus Areas
- packages/kodac-runtime/src/session/model-visible-history.ts[488-498]
- packages/kodac-runtime/src/agent/repeat-call-signal.ts[607-620]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| assertRepeatAdvisorySourceBinding(record, assistantRecord, toolResultRecord) | ||
| projected = [...projected, record.message] | ||
| assertProjectedBounds(projected) |
There was a problem hiding this comment.
2. Duplicate advisories project repeatedly 🐞 Bug ≡ Correctness
A separately sequenced event can replay the same advisory payload because the projector does not track consumed record identities, signal identities, or source tuples. Each replay appends another system message for the same threshold crossing.
Agent Prompt
## Issue description
The same valid advisory payload can be replayed at a later contiguous event sequence and will be projected repeatedly.
## Issue Context
Define the intended uniqueness key, such as advisory record identity or signal/source tuple, track it within each request anchor, and reject a second use. Add a projection regression with two increasing-sequence events carrying the same advisory payload.
## Fix Focus Areas
- packages/kodac-runtime/src/session/model-visible-history.ts[512-513]
- packages/kodac-runtime/src/session/model-visible-history.ts[557-574]
- packages/kodac-runtime/test/kdo-h5-r2b-repeat-call-advisory-history.test.ts[195-203]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| const matchingCalls = (assistantRecord.message.toolCalls ?? []).filter( | ||
| (call) => call.id === toolResultId && call.name === toolResultName, | ||
| ) |
There was a problem hiding this comment.
3. Stale batch advisory accepted 🐞 Bug ≡ Correctness
Source binding accepts a matching call anywhere in the assistant batch without proving that its fingerprint remains the final active chain. Consequently, an advisory for A in an A,A,B batch can be projected after B has reset the chain.
Agent Prompt
## Issue description
Projection accepts an advisory tied to an earlier call even when a later completed call in the same batch changes the active repeat chain.
## Issue Context
Preserve legitimate A,A,A behavior while rejecting A,A,B: process the ordered assistant calls and corresponding seen results after the triggering call, and require the advisory fingerprint to remain the final active chain before appending it. Add a direct projector regression for an A,A,B event history.
## Fix Focus Areas
- packages/kodac-runtime/src/session/model-visible-history.ts[470-500]
- packages/kodac-runtime/src/session/model-visible-history.ts[557-573]
- packages/kodac-runtime/src/agent/loop.ts[250-280]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| export function validateRepeatCallAdvisoryHistoryRecord(value: unknown): RepeatCallAdvisoryHistoryRecord { | ||
| const record = asPlainRecord(value, "repeatCallAdvisoryHistoryRecord") | ||
| exactKeys(record, ADVISORY_RECORD_KEYS, "repeatCallAdvisoryHistoryRecord") |
There was a problem hiding this comment.
4. Proxy payload executes traps 🐞 Bug ☼ Reliability
The new advisory-record validator reflects over caller-owned payload objects before rejecting them, allowing Proxy traps to execute during journal projection. This violates the hostile-input validation boundary and can cause side effects or denial of service.
Agent Prompt
## Issue description
A Proxy supplied as an advisory event payload can execute traps when the validator inspects its prototype, keys, or descriptors.
## Issue Context
The primitive signal-string validator is hook-free, but the outer advisory record is not. Introduce a serialized or otherwise hook-free boundary before reflective object validation, and add tests proving no Proxy trap runs through both the direct validator and projector paths.
## Fix Focus Areas
- packages/kodac-runtime/src/session/model-visible-history.ts[149-176]
- packages/kodac-runtime/src/session/model-visible-history.ts[381-395]
- packages/kodac-runtime/test/kdo-h5-r2b-repeat-call-advisory-history.test.ts[120-149]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
1 participant
Implements canonical
KDO-H5-R2B — H2-BOUND REPEAT-CALL ADVISORY INTEGRATIONunder the original authorization plus canonical reconciliations C1 and C2.Exact certified identity
The only delta from accepted pre-ledger head
ad414424...to current head07fb9cf...is the authorized evidence ledger:docs/planning/KODAC_KDO_H5_R2B_H2_REPEAT_CALL_ADVISORY_EVIDENCE_2026-08-15.mdCertified implementation
[2], identity7331f353c9a29af123cd54fa99453768b35fe2534db5d009df9dae67cdc80222;model.history.repeat_call_advisory.appendedH2 event;role=systemadvisory with no tool name/id/raw args/preview/result content;C1 historical-test reconciliation
Exactly five historical tests were minimally reconciled. No test was deleted, skipped, disabled, or broadly weakened.
C2 K3 applicability
The complete 11-path ledger-bearing diff has empty intersection with the canonical K3-R4 and K3-R5
pull_request.pathstrigger sets. Therefore on this exact head:No unrelated trigger path was touched merely to force workflow scheduling.
Exact-head post-ledger evidence
For
07fb9cf787155d19d75dd369c951f7444525e452:k2-runtime-gate— PASSExplicit boundaries
No denied/failed attempt counting without canonical completed tool-result evidence. No user-role reminder injection. No raw argument preview. No hard duplicate/cycle relaxation. No H5-R1A activation. No H5-R3 guarded tool pipeline. No subagents/delegation/worktree/Git writes. No K2/approval/confinement/Done Gate change. No H5 completion or H6 readiness claim.
The bounded claim
KODAC_H2_BOUND_REPEAT_CALL_ADVISORY_PROVENremains unavailable until this exact certified head is merged into canonicalmain.