fix(ci): keep the drift-checked SLM agent mirror out of the duplication scan (#16401)

[mrveiss]

Closes #16401.

Single-issue rationale: this unblocks base's duplication-guard for every SLM agent change. It's the ignore change plus a test, and the pin follows from this PR's own CI measurement.

Thinking Path

• Train-g went red on duplication-guard: the SLM scope measured 4740 lines against its 4729 pin. The only changed clone pairs were the SLM agent files and their mandatory Ansible mirror (autobot-slm-backend/ansible/roles/slm_agent/files/slm/agent/), which detect_agent_code_drift_test.py requires to be byte-identical. So every agent change adds clones and trips the absolute pin, and it always will.
• The drift test already guarantees the mirror equals its source, so scanning it adds nothing.

What Changed

• .github/workflows/duplication-guard.yml: the SLM scope's jscpd -i list gains **/ansible/roles/slm_agent/files/**, citing the drift test. SLM_MAX_DUP_LINES stays at 4729 in this commit. It's an absolute count (ci(duplication-guard): the percentage ratchet fails PRs that delete unique code, so gate on the absolute duplicated-line count #16319) that can only come from a real jscpd run.
• New repo_tests/duplication_guard_excludes_agent_mirror_test.py: it parses the workflow's real -i list and asserts that the pattern matches the mirror, doesn't match the canonical source, and doesn't widen to a sibling role.
• docs/developer/RATCHET_BASELINES.md: a scope boundary note.

Verification

• This PR changes only the workflow, a test and a doc, and it's 0 behind base, so its first duplication-guard run measures base with the mirror excluded.
• A follow-up commit lowers SLM_MAX_DUP_LINES to that figure, with the run ID recorded beside it as the workflow already does. That figure must be below 4729; otherwise the exclusion didn't take.
• No repo code was run locally.

Model Used

Claude Opus 5 as coordinator; a devops-engineer subagent implemented it.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a7f2275b-ae54-4c71-856c-8b57ba42c33f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• fix(tests): stop gating a disk-bound model load on a CPU work budget, and prove it stays offline and import-free (#15055, #15235) #16404 fix(tests): stop gating a disk-bound model load on a CPU work budget, and prove it stays offline and import-free (test(perf): startup benchmarks assert absolute wall-clock budgets and fail on runner load — passed and failed on the same code minutes apart #15055, test(perf): three calibrated budgets are drifting or disk-bound — the startup margin is 1.4x, not the 1.9x its note records #15235)
• chore(ci): merge train 2026-09-11-g2, test vehicle, do not merge (#15937) #16400 chore(ci): merge train 2026-09-11-g2, test vehicle, do not merge (Enable the merge queue — no PR merges against a stale base #15937)
• fix(terminal): clear TerminalModals' auto-hide timers on unmount and on re-show (#16315) #16397 fix(terminal): clear TerminalModals' auto-hide timers on unmount and on re-show (fix(terminal): TerminalModals' message auto-hide timers are never cleared, on unmount or when a newer message replaces them #16315)
• fix(ci): bring CI's pytest environment up to its declared floors, and gate on them (#16264) #16391 fix(ci): bring CI's pytest environment up to its declared floors, and gate on them (ci: the pytest environment sits below two declared floors, and the floor banner tells CI readers the opposite #16264)
• fix(security): the dev proxy stops granting admin without a login, and the session check endpoint is tested (#16382, #16385) #16390 fix(security): the dev proxy stops granting admin without a login, and the session check endpoint is tested (SLM Vite dev-server proxy injects X-Internal-API-Key on /autobot-api with no session check #16382, SLM backend: add direct test coverage for GET /api/auth/me #16385)
• fix(security): the SLM proxy checks the caller's SLM session before it adds the backend key (#16374) #16386 fix(security): the SLM proxy checks the caller's SLM session before it adds the backend key (security(slm): the SLM nginx /autobot-api/ proxy adds the internal API key for every caller, so anyone reaching the SLM host is a backend admin #16374)
• fix(ci): retire the CodeQL suite file nothing loads, and record the real guard behind alert #1030 (#16283, #16302) #16377 fix(ci): retire the CodeQL suite file nothing loads, and record the real guard behind alert feat: Voice conversation mode — Hands-free with VAD (Tier 2) #1030 (ci(security): codeql.yml is disabled, so the reviewed codeql-config.yml exclusions apply to nothing #16283, ci(security): codeql-config.yml's file-scoped query-filters exclude nothing, under either setup #16302)
• fix(security): write the service-key export only to its configured directory, never into a checkout, and keep one (#16348) #16372 fix(security): write the service-key export only to its configured directory, never into a checkout, and keep one (security(service-auth): generate_service_keys.py writes its live-key export relative to the working directory, so a run inside a checkout drops keys into the work tree #16348)
• fix(security): authenticate every skills route, and require admin to change, fetch or execute (#16368) #16370 fix(security): authenticate every skills route, and require admin to change, fetch or execute (security(api): every route in api/skills.py (catalog fetch/install, enable, execute) is unauthenticated, and the router-auth guards can't see feature routers #16368)
• fix(ci): let the system-package retry recover from its own timeout, and fetch before unpacking (#15515) #16367 fix(ci): let the system-package retry recover from its own timeout, and fetch before unpacking (ci(runner): apt provisioning times out (exit 124) three attempts in a row and fails the shard before any test runs #15515)
• fix(guards): tell a baseline entry that matches nothing apart from one that under-matches (#16334) #16365 fix(guards): tell a baseline entry that matches nothing apart from one that under-matches (bug(guards): --audit-baseline says "no longer match anything" for an entry that still matches, so the reader deletes a live exemption #16334)
• fix(ci): stop the regen bot's approved runs cancelling the job that approved them (#16360) #16363 fix(ci): stop the regen bot's approved runs cancelling the job that approved them (ci: the regen bot's own push cancels the job that approves its parked runs, so a PR's CI can silently never run #16360)
• fix(ci): keep line numbers out of the secrets baseline, so a line move no longer rewrites it (#16353) #16362 fix(ci): keep line numbers out of the secrets baseline, so a line move no longer rewrites it (ci(secrets): .secrets.baseline stores a line number per finding, so every PR that shifts lines in a file with findings rewrites it and conflicts with every other such PR #16353)
• test(guards): name the deliberate fixed sleeps, and stop a random temp name deciding a language test (#16255, #16341) #16358 test(guards): name the deliberate fixed sleeps, and stop a random temp name deciding a language test (tests: 32 more fixed sleeps are followed by an assertion, and some decide the outcome by the clock #16255, test(voice): test_no_filename_hint flakes when tempfile's random name forms a language-code token (e.g. _lv_) #16341)
• fix(ci): gate the frontend npm audit on one report, retry it, and report 'could not check' apart from advisories (#16337) #16357 fix(ci): gate the frontend npm audit on one report, retry it, and report 'could not check' apart from advisories (ci(security): the npm audit gate fails an audit-endpoint error exactly like a high advisory — retry, and report 'could not check' distinctly #16337)
• fix(docker): retry apt fetches and fail apt-get update on a lost index, set once for every image (#16291) #16356 fix(docker): retry apt fetches and fail apt-get update on a lost index, set once for every image (ci(docker): an unreachable Ubuntu mirror surfaces as a misleading 'held broken packages' error; apt steps neither retry nor fail on index errors #16291)
• feat(slm): Redis control and detailed health live in the SLM only; remove the unreachable user-GUI copies (#16245, #16252) #16352 feat(slm): Redis control and detailed health live in the SLM only; remove the unreachable user-GUI copies (tech-debt(frontend): move SettingsPanel's detailed system health and Redis service management into the SLM #16245, bug(frontend): RedisServiceControl calls /api/service-monitor/services/* and no mounted router serves those paths #16252)
• fix(code-sync): delete files removed from source through the updater, and check drift across every file (#16310, #16322) #16351 fix(code-sync): delete files removed from source through the updater, and check drift across every file (deploy: the builtin updater never removes files deleted from source, so deleted modules pile up on every host #16310, deploy: ansible synchronize never deletes files removed from source on remote fleet nodes #16322)
• fix(pre-commit): run detect-secrets serially and refresh the baseline's line numbers (#16343) #16349 fix(pre-commit): run detect-secrets serially and refresh the baseline's line numbers (pre-commit: detect-secrets runs in parallel batches that race on .secrets.baseline, so large commits and base merges can't commit #16343)
• fix(kb): make three summarisation paths do what they claim (#14840, #15700, #16110) #16345 fix(kb): make three summarisation paths do what they claim (context-overflow summarization can never succeed — _get_gateway imports a module and a symbol that do not exist #14840, sec(kb): the chat-to-knowledge summariser interpolates whole transcripts unframed, and the result is persisted to the knowledge base #15700, bug(kb): summary quality is scored against text[:200] — a 300-word summary judged on a 200-character window #16110)
• ci(python-suite): queue the shards first in, first out across PRs, with a per-shard job-level queue: max group (#16320) #16328 ci(python-suite): queue the shards first in, first out across PRs, with a per-shard job-level queue: max group (ci: queue python-suite shards FIFO across PRs (queue: max), so one PR's suite finishes before the next starts #16320)
• docs(env): move the generated env-var table into ENV_VARS.md and drop its count line, so env-var PRs stop conflicting (#16317) #16318 docs(env): move the generated env-var table into ENV_VARS.md and drop its count line, so env-var PRs stop conflicting (docs: the generated env-var table and its count line live in CLAUDE_RULES.md, so every env-var PR conflicts with every other #16317)
• fix(terminal): render TerminalModals in TerminalWindow, with each action reporting the parent's real outcome (#16285) #16313 fix(terminal): render TerminalModals in TerminalWindow, with each action reporting the parent's real outcome (fix(terminal): TerminalModals reports success after a fixed delay, and nothing renders it; TerminalWindow still has the modals inline #16285)
• refactor(slm-backend): retire the 7 dead SLM monitoring modules whose function is live elsewhere (#16282) #16308 refactor(slm-backend): retire the 7 dead SLM monitoring modules whose function is live elsewhere (tech-debt(slm-backend): 11 of the 12 modules in monitoring/ are imported by no live code #16282)
• feat(auth): one permission vocabulary, key scopes as bundles, /me permissions, and API-key scope enforcement (#16270, #16040) #16298 feat(auth): one permission vocabulary, key scopes as bundles, /me permissions, and API-key scope enforcement (auth: extend Permission to cover chat, teams and webhooks, define key scopes as permission bundles, and return effective permissions from /me #16270, API key scopes are stored and displayed but never enforced — keys inherit full user authority #16040)
• feat(slm): nodes report their GPUs in the heartbeat, and the SLM serves them per node (#16280, #16281) #16292 feat(slm): nodes report their GPUs in the heartbeat, and the SLM serves them per node (feat(slm-agent): report per-node GPU telemetry in the heartbeat, from one shared nvidia-smi/rocm-smi parser #16280, feat(slm-backend): serve per-node GPU state (GET /api/monitoring/gpu/nodes) and the autobot_gpu_* series Grafana already queries #16281)
• fix(llc): kill an agent's whole process tree on cancel, timeout or stall (#13097, #13099) #16284 fix(llc): kill an agent's whole process tree on cancel, timeout or stall (LLC adapters: agent cancel/timeout orphans the whole subprocess tree #13097, LLC adapters: no stall or first-output watchdog — a hung run holds a slot for the full 3600s timeout #13099)
• feat(agents): renew work claims only while the run makes progress, and refuse writes under a lapsed claim (#15950) #16273 feat(agents): renew work claims only while the run makes progress, and refuse writes under a lapsed claim (Enforce work claims: task executor and base agent acquire declared scopes #15950)
• security(auth): authenticate every transcriber route, and stop anonymous callers owning every recording (#15758) #16259 security(auth): authenticate every transcriber route, and stop anonymous callers owning every recording (security(auth): transcriber routes authenticate no one -- every caller resolves to DEFAULT_USER #15758)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.

[mrveiss]

Measured SLM scope with the mirror excluded: duplication-guard run 34632034006 (job 103370927070), on this PR's head. The PR was 0 behind base affea4b38, and it changes only the workflow, a test and a doc, so the figure is base with the mirror excluded.

measured:  2945 duplicated lines (129 clones, 258231 lines scanned in 754 files)
pin:       4729 duplicated lines

That's under the old pin by 1784 lines, so the exclusion took. A follow-up commit sets SLM_MAX_DUP_LINES: '2945', citing this run ID next to it.

[mrveiss]

Content review: approve.

Correct fix and correctly scoped exclusion: **/ansible/roles/slm_agent/files/** added to the SLM-scope jscpd ignore list, since that tree is a drift-test-enforced (detect_agent_code_drift_test.py) byte-identical mirror of autobot-slm-backend/slm/agent/ — duplication between mandatory-identical copies isn't something anyone can act on. Pin re-derived (4729→2945) via an actual re-measurement with the mirror excluded, not just a subtracted estimate — matches RATCHET_BASELINES.md rule 3 ("derive the population a second way before freezing").

duplication_guard_excludes_agent_mirror_test.py is well-targeted: parses the real workflow YAML and translates the glob to regex rather than asserting a literal substring, and separately checks (a) the mirror path matches, (b) the canonical source does NOT match (exclusion isn't too broad), (c) an unrelated sibling role's mirrored files do NOT match (exclusion hasn't silently widened past the one path #16401 justifies, since siblings have no drift-test guarantee).

closingIssuesReferences=[16401], matches its own Closes #16401. CI green. Ready.