feat: route autofix through contextual orchestrator - #1168
Conversation
📝 WalkthroughWalkthroughNVIDIA NIM 기반 자동수정 경계를 Contextual Orchestrator 게이트웨이로 전환했다. 워크플로, 계약 테스트, 복구 문서가 새 URL·토큰·모델·도구 루프 설정을 사용한다. Strix 게이트가 단일 라인 소스 스니펫을 별도로 검사한다. ChangesContextual Orchestrator 게이트웨이 전환
Strix 단일 라인 검사
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: 🟡 Moderate · up to The PR changes write-capable autofix routing through a gateway, but the current head still has a bounded correctness risk where single-line source validation can behave like the general path, plus incomplete protection for the authentication header. Required security and formal checks are also not passing, so merge should wait for fixes or explicit owner acceptance. Sequence Diagram(s)sequenceDiagram
participant PRReviewAutofix
participant OpenCode
participant ContextualOrchestrator
PRReviewAutofix->>OpenCode: 게이트웨이 URL·토큰·모델 설정 전달
OpenCode->>ContextualOrchestrator: HTTPS 모델 실행 요청
ContextualOrchestrator-->>OpenCode: KV 공급자 자격 증명 기반 응답
OpenCode-->>PRReviewAutofix: 자동수정 또는 충돌 해결 결과 반환
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent Please independently review exact current head |
|
Review-dispatch diagnostic (not a review result): the exact-head independent-review invocation was accepted by the central router, but the router runs |
|
Current-head review evidence (e30ce15): 78 focused autofix/scheduler tests pass; changed contract tests are 100% interrogate-covered, Ruff passes, Python compilation passes, both affected workflows pass actionlint, and git diff --check is clean. The writer uses the contextual-orchestrator gateway with automatic routing, retains the independent read-only reviewer workflow, strips GitHub/OIDC credentials from model subprocesses, and preserves exact-head/allowlist/hook-disabled push guards. Independent approval and protected Checks remain required before merge. |
|
@opencode-agent please review exact current head |
|
Current-head validation for e30ce15:
The PR remains blocked pending independent approval and terminal protected Checks. |
|
@opencode-agent Please re-review exact current HEAD e30ce15 for PR #1168. Check the contextual-orchestrator gateway route and full current diff; provide independent findings or approval only for this SHA. |
|
Exact-head update: pushed |
|
@opencode-agent please review exact current head |
1 similar comment
|
@opencode-agent please review exact current head |
|
Current-head validation after commit
Please review this exact HEAD, including the gateway-only provider, URL/token scope, mutation credential boundary, and documentation/runtime alignment. |
|
@opencode-agent review Head SHA: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Addressed the three current-head review findings in
Test-first evidence:
Exact GitHub blobs were re-read at this head: |
|
Current-head validation for 8505f91: the contextual-orchestrator gateway contract, writer security contract, hourly fix contract, Python compilation, actionlint for the two affected workflows, and git diff --check pass locally. The gateway owns provider discovery; raw provider keys are not exposed to the model subprocess, missing gateway configuration fails closed, and mutation credentials remain scoped to the write steps. Hosted required checks are still pending on this exact head. Please review this exact head and report any remaining actionable finding. |
|
@opencode-agent review Head SHA: 8505f91 |
|
Exact current-head verification for
Please review this exact current head with the independent OpenCode reviewer. Hosted Checks and formal protected approval remain authoritative; no merge or approval is claimed. |
|
@opencode-agent please review exact current HEAD |
|
Dependency status: contextual-orchestrator PR #787 is merged into its protected |
|
Current-head validation for bd478a1: after the latest remote merge, 47 contextual-autofix/security/hourly-contract tests pass locally; interrogate 100%, compileall, actionlint for both affected workflows, and git diff --check also pass. The focused gate now uses gateway terminology, while reviewer and write-capable flows remain distinct and the automatic-discovery trust boundary remains documented. Hosted required Checks are still pending on this exact head. |
Current-head audit — normal path
|
Verification updateThe long The retained exact-head evidence remains: 97 focused contract/security/conflict tests passed, actionlint passed, touched Strix scripts passed bash syntax, interrogate passed at 100%, and |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Exact-head verification completedFor exact head
Live hosted state is still normal-path blocked: required Checks remain queued, no independent approval is present, and no merge/deployment is claimed. |
Current-head remediation updateThe exact-head finding about clean (non-conflicting) base merges still requiring gateway availability was valid: Exact-head verification after the fix:
Live base remains |
Review disposition — exact head
|
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Exact-head review disposition
|
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Exact-head follow-up disposition
|
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Current-head disposition
|
|
@opencode-agent Please perform a review-only formal review of exact current head |
|
Exact-head maintainer review (2026-08-21): reviewed the complete 15-file diff, including the writer credential boundary, gateway URL and authenticated |
|
@OpenCode Please perform an independent substantive review of exact head 01643ac. Read the complete 15-file diff, especially workflow credential scope and Strix fallback severity behavior, and report changed-file walkthrough, test gaps, security impact, residual uncertainty, and explicit verdict. Do not review an older head. |
|
@opencode-agent @cwl-noema-review Current-head review request for #1168. Exact head: 01643ac Please independently read the complete current-head diff and changed-file walkthrough. Verify the contextual-orchestrator gateway boundary, preservation of the independent read-only reviewer credential system, URL and credential scoping, exact-head/write-scope protections, Strix retry classification, workflow and documentation consistency, and focused test coverage. Do not reuse predecessor-head evidence. Report a substantive verdict with path:line evidence, remaining findings, and residual uncertainty; do not edit files or approve based only on this request. |
|
Current-head gate disposition for 01643ac: The failed |
|
Stack audit: this PR merged normally into parent PR #1198's feature branch, not protected main. Merge commit 7005e5c is now the exact #1198 head. The prior hosted pip-audit failure was reproduced from the old base lock (pip 26.1.2 / PYSEC-2026-3721); parent #1198 updates that lock to pip 26.2.1 and the exact current parent tree now passes pip-audit. No bypass or force push was used. |
1 participant
Summary
CONTEXTUAL_ORCHESTRATOR_BASE_URLandCONTEXTUAL_ORCHESTRATOR_TOKENto the two model execution stepsX-Contextual-Orchestrator-Tool-Loop: v1headerActivation prerequisites
8d31fa50cc6de8ddc3e6b91576e7251c5aa7d914against protectedcontextual-orchestrator/main@e226e1197bdfc890c9d8e5b9b648c78857d7e465; it is not yet integrated, and this PR does not claim gateway deployment or credential provisioningCONTEXTUAL_ORCHESTRATOR_BASE_URLand secretCONTEXTUAL_ORCHESTRATOR_TOKENmust be provisioned through the protected operator pathVerification
32415704931: 1,236 passed, 16 subtests passed, owned-helper statement/branch coverage 100%32415704979: 34 passed, statement/branch coverage 100%actionlint .github/workflows/pr-review-autofix.yml .github/workflows/hourly-nvidia-nim-review-repair.yml— passedgit diff --check— passedNo approval, merge, check success, gateway activation, or deployment evidence is manufactured.
Summary by CodeRabbit
새 기능
보안 개선
문서
테스트
Latest exact-head verification
2cc2209d786153c5577a484c327d483be4823ec0;/modelsreadiness now requires at least one non-empty discovered model ID in both writer paths;git diff --check;96616264016: exact SHA checkout, 1,286 tests + 16 subtests, owned helpers 438 statements / 154 branches at 100%;96616316767: exact SHA checkout, 1,286 tests + 16 subtests,test_strix_quick_gate: PASS;96616264006: 34 tests, 380 statements / 88 branches at 100%;96616264357: 49 contracts, 226 statements / 82 branches at 100%;NEW_CASE_EXIT=0,git diff --check,bash -npassed);