Skip to content

fix(verifier): retain artifact and review-comment evidence destinations - #3836

Merged
stranske merged 8 commits into
mainfrom
codex/issue-3835
Oct 12, 2026
Merged

stranske merged 8 commits into
mainfrom
codex/issue-3835

Conversation

@stranske

@stranske stranske commented Oct 11, 2026 •

Copy link
Copy Markdown
Owner

Tasks

  • Repair the active negative-governor finding using shared grammar in source and consumer template, with manifest/documentation coverage.
  • Replace unsafe replay XML parsing with declaration-rejecting Expat and a deliberate entity-expansion security regression.
  • Preserve the runtime-file cleanup and original implementation/proof history; do not enable a second keepalive writer.

Acceptance Criteria

  • Original code fails deliberate negative-governor/security regressions; fixed code passes focused channel/options and actual prompt-floor controls, including independent mandatory clauses.
  • The full relevant regression suite passes and exact-head hosted review/CI findings are adjudicated before merge.

The campaign lane owns this local follow-up to #3835. The original implementation and evidence follow below. Post-merge regeneration and campaign reconciliation are coordination, not implementation tasks.

Closes #3835.

The verifier discarded mandatory artifact delivery, PR/inline review-comment destinations, and validation-output checklist evidence, allowing a model PASS despite missing named evidence. This change retains those destinations through the existing polarity/product/literal and destination-OR grammar, with the source and consumer template kept byte-identical.

Tasks

  • Extend scripts/langchain/pr_verifier.py::_required_evidence_channels shared artifact operation/destination grammar to recognize active evidence delivery using as an artifact.
  • Extend scripts/langchain/pr_verifier.py::_required_evidence_channels shared review destination vocabulary for PR review comments and inline review comments.
  • Extend scripts/langchain/pr_verifier.py::_required_evidence_channels checklist noun handling using existing common-proof/polarity vocabulary so Validation output/results retain the named comment destination.
  • Add direct RED/GREEN cases to tests/scripts/test_pr_verifier_delivery_destinations.py for the three original examples and bounded positive/negative/optional/product/literal controls.
  • Add destination-specific coverage-floor regressions to tests/scripts/test_pr_verifier_prompt_coverage.py with body present but comments absent/unavailable, and body present but artifacts absent/unavailable.
  • Synchronize templates/consumer-repo/scripts/langchain/pr_verifier.py with the source fix.
  • Update the existing verifier entry in .github/sync-manifest.yml and the boundary contract in docs/ops/CONSUMER_REPO_MAINTENANCE.md.

Acceptance Criteria

  • python -m pytest tests/scripts/test_pr_verifier_delivery_destinations.py tests/scripts/test_pr_verifier_prompt_coverage.py -q passes on the fixed bytes; deliberate restoration of each original grammar defect makes its named regression fail, followed by byte-identical restoration and GREEN.
  • Attach evidence as an artifact and Upload the coverage report as an artifact require artifacts, and missing/unavailable artifacts block a model PASS even with a present PR body.
  • Evidence must be posted in a PR review comment and the inline-review-comment variant require comments; absent/unavailable comments cannot be masked by a present PR body.
  • - [x] Validation output in a PR comment requires comments; negative, optional, quoted-literal and product-capability controls remain nongating unless a separate mandatory delivery exists.
  • Source and templates/consumer-repo/scripts/langchain/pr_verifier.py are byte-identical for the changed verifier, with manifest/docs coverage and retained RED/GREEN commands/results in the ready implementation PR.

Validation

  • Complete two-module gate: python -m pytest tests/scripts/test_pr_verifier_delivery_destinations.py tests/scripts/test_pr_verifier_prompt_coverage.py -q -o addopts= -n 4: 92,822 passed, zero failures/errors/skips.
  • Original focused reproduction: 14 failed, 14 passed; fixed focused gate: 28 passed.
  • Three independent production-rule reversals: each gives 3 failures, followed by exact byte restoration and 3 passes on the same direct/floor nodes. Both source copies restore to SHA256 a743cbfed0bdd653a2a33ee3061650b75175d84ded1031604908343c12fc9c53.
  • Black, Ruff, diff check, source/template comparison and template-completeness validation passed. Manifest/docs gate: 2 passed, 1 existing skip.
  • docs/evidence/issue-3835-evidence-destinations/ retains the replay, exact commands/process receipts, full raw logs/JUnit and SHA256 manifest; all 28 archive-member hashes and five current input hashes verified.

This proves the bounded local grammar and coverage-floor contract. Native-provider acceptance, #3820/#3831 capture partitioning and downstream promotion/reconciliation remain separate work. The initial serial run was intentionally interrupted and then replaced by the complete four-worker run; its partial logs are retained without a full-gate claim.

Source: Issue #3835

Closes #3835

Automated Status Summary

Scope

Current delivered Workflows source 49286cc28411f1efb5545866ed0f278e6c680fdb, scripts/langchain/pr_verifier.py in _required_evidence_channels (consumer lines 3886/4037), still loses three mandatory evidence destinations. Actual trip-planner #1885 head b28e40427fe68fb9848d0a988a9149463e10058c findings stranske/trip-planner#1885 (comment) and stranske/trip-planner#1885 (comment) reproduce: Attach evidence as an artifact returns no channel; Evidence must be posted in a PR review comment returns overall instead of comments. Independently reproduced - [ ] Validation output in a PR comment also returns no channel. This is a current deterministic completeness defect, not optional stylistic coverage. Required evidence can be missing while a model PASS survives the floor.

Context for Agent

Related Issues/PRs

Tasks

  • Extend scripts/langchain/pr_verifier.py::_required_evidence_channels shared artifact operation/destination grammar to recognize active evidence delivery using as an artifact.
  • Extend scripts/langchain/pr_verifier.py::_required_evidence_channels shared review destination vocabulary for PR review comments and inline review comments.
  • Extend scripts/langchain/pr_verifier.py::_required_evidence_channels checklist noun handling using existing common-proof/polarity vocabulary so Validation output/results retain the named comment destination.
  • Add direct RED/GREEN cases to tests/scripts/test_pr_verifier_delivery_destinations.py for the three original examples and bounded positive/negative/optional/product/literal controls.
  • Add destination-specific coverage-floor regressions to tests/scripts/test_pr_verifier_prompt_coverage.py with body present but comments absent/unavailable, and body present but artifacts absent/unavailable.
  • Synchronize templates/consumer-repo/scripts/langchain/pr_verifier.py with the source fix.
  • Update the existing verifier entry in .github/sync-manifest.yml and the boundary contract in docs/ops/CONSUMER_REPO_MAINTENANCE.md.

Acceptance criteria

  • python -m pytest tests/scripts/test_pr_verifier_delivery_destinations.py tests/scripts/test_pr_verifier_prompt_coverage.py -q passes on the fixed bytes; deliberate restoration of each original grammar defect makes its named regression fail, followed by byte-identical restoration and GREEN.
  • Attach evidence as an artifact and Upload the coverage report as an artifact require artifacts, and missing/unavailable artifacts block a model PASS even with a present PR body.
  • Evidence must be posted in a PR review comment and the inline-review-comment variant require comments; absent/unavailable comments cannot be masked by a present PR body.
  • - [ ] Validation output in a PR comment requires comments; negative, optional, quoted-literal and product-capability controls remain nongating unless a separate mandatory delivery exists.
  • Source and templates/consumer-repo/scripts/langchain/pr_verifier.py are byte-identical for the changed verifier, with manifest/docs coverage and retained RED/GREEN commands/results in the ready implementation PR.

Head SHA: e252bbc
Latest Runs: ✅ success — Gate
Required: gate: ✅ success

Workflow / Job Result Logs
Gate ✅ success View run
Health 40 Sweep ✅ success View run
Health 44 Gate Branch Protection ✅ success View run
Health 45 Agents Guard ✅ success View run
Health 50 Security Scan ✅ success View run
Health 52 Semgrep Scan ✅ success View run
Health 69 Consumer Sync Shadow Evidence ✅ success View run
Health 72 Template Sync ✅ success View run
Health 73 Template Completeness ✅ success View run
Maint 52 Validate Workflows ✅ success View run
PR 11 - Minimal invariant CI ✅ success View run
PR 46 Dependency Repair Contract ⏭️ skipped Last completed result; current run in PR checks
Selftest CI ✅ success View run
Validate Sync Manifest ✅ success View run

@stranske stranske added agent:codex Agent-created issues from Codex agents:keepalive Use to initiate keepalive functionality with agents autofix Opt-in automated formatting & lint remediation codex codex-automation agent:auto Delegates agent routing to the auto-delegation policy labels Oct 11, 2026
@stranske
stranske deployed to agent-standard October 11, 2026 19:24 — with GitHub Actions Active
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 11, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-11T22:04:25.829220Z e252bbc Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@stranske stranske added the agent:retry Add to trigger agent retry after rate limit or pause label Oct 11, 2026
@coderabbitai

coderabbitai Bot commented Oct 11, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Warning

Review limit reached

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Next included review available in 8 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 69 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Repository: stranske/Workflows/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Essentials
  • Run ID: 70828ae3-ce15-41c6-874f-90ee8fa29d7b

📥 Commits

Reviewing files that changed from the base of the PR and between 907f822 and e252bbc.


📒 Files selected for processing (11)
  • .github/sync-manifest.yml
  • docs/evidence/issue-3835-evidence-destinations/README.md
  • docs/evidence/issue-3835-evidence-destinations/follow-up-20261011.json
  • docs/evidence/issue-3835-evidence-destinations/replay.py
  • docs/evidence/issue-3835-evidence-destinations/review-follow-up-20261011.json
  • docs/ops/CONSUMER_REPO_MAINTENANCE.md
  • scripts/langchain/pr_verifier.py
  • templates/consumer-repo/scripts/langchain/pr_verifier.py
  • tests/scripts/test_evidence_destination_replay_security.py
  • tests/scripts/test_pr_verifier_delivery_destinations.py
  • tests/scripts/test_pr_verifier_prompt_coverage.py

📝 Summary

Summary by CodeRabbit

  • New Features
    • Evidence requirements now recognize named workflow artifacts and PR review comments, including inline comments. Checklist items also accept common test, validation, build, and execution proof.
    • Alternative destinations joined by “or” are handled as separate evidence options, while quoted text remains literal.
  • Bug Fixes
    • A PR body no longer satisfies a requirement for comments or artifacts when that evidence is missing or unavailable.
    • Evidence requirements remain enforced regardless of capacity, and receipt I/O warnings do not affect capacity outcomes.
  • Documentation
    • Updated guidance clarifies evidence destinations and checklist proof requirements.
📝 Summary
📝 Summary
📝 Summary

Walkthrough

[!WARNING]
Review details and warnings were omitted to fit the comment limit.








Pre-merge checks | Passed 4 | Failed 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 43.75% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 16 functions across 5 files. (2 skipped: … Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check Passed The PR addresses the coding requirements in active issue #3835. The verifier adds bounded artifact and PR or inline review-comment destination handling, checklist proof-noun handling, and quoted-liter…
Out of Scope Changes check Passed The changed files have a direct connection to issue #3835. Verifier changes implement the required destination grammar. Test changes validate the required channels and controls. The replay script, evi…
Title check Passed The title clearly and concisely describes the main change: preserving artifact and review-comment evidence destinations in the verifier.
Description check Passed The description directly explains the verifier changes, affected destinations, tests, synchronization, and validation results.



Full details: Docstring Coverage

Explanation

Docstring coverage is 43.75% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 16 functions across 5 files. (2 skipped: 2 unsupported.)







Comment @coderabbitai help to get the list of available commands.

@stranske-automation-bot

Copy link
Copy Markdown
Collaborator

Runner dispatch state for codex on PR #3836. Do not edit.

@stranske
stranske deployed to agent-standard October 11, 2026 19:25 — with GitHub Actions Active
@stranske
stranske deployed to agent-standard October 11, 2026 19:25 — with GitHub Actions Active
@stranske-keepalive

stranske-keepalive Bot commented Oct 11, 2026 •

Copy link
Copy Markdown
Contributor

🤖 Keepalive Loop Status

PR #3836 | Agent: Codex | Iteration 3/12

Current State

Metric Value
Iteration progress [###-------] 3/12
Action fix (force-retry-fix-test)
Agent status ✅ ALL TASKS COMPLETE
Gate unknown
Tasks 24/24 complete
Timeout 45 min (default)
Timeout usage 5m elapsed (13%, 40m remaining)
Keepalive ✅ enabled
Autofix ❌ disabled

Agent Delegation (auto mode)

Field Value
Selected agent Codex
Reason effective (2 commits, 1 tasks)
Delegation source static

🔍 Failure Classification

| Error type | infrastructure |
| Error category | unknown |
| Suggested recovery | Capture logs and context; retry once and escalate if the issue persists. |

🧠 Task Analysis

| Provider | 🔶 Regex (fallback) |
| Model | regex-patterns |
| Confidence | 30% |

⚠️ Primary provider (GitHub Models) was unavailable; used Regex (fallback) instead.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 85f990cfca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread scripts/langchain/pr_verifier.py
Comment thread docs/evidence/issue-3835-evidence-destinations/replay.py Fixed
@stranske

Copy link
Copy Markdown
Owner Author

Post-push review checkpoint on unchanged head 85f990cfcac9d44d537d35a4e14eadeda5183a42: both new active threads were read in full. The existing matching Codex worker38167899759 is active; the opener has finished materialization and is leaving a queued review-recovery request for that same owner, without a competing branch writer.

  1. fix(verifier): retain artifact and review-comment evidence destinations #3836 (comment) (scripts/langchain/pr_verifier.py:3915): independently reproduced No need to attach evidence as an artifact and No requirement to upload the coverage report as an artifact both incorrectly return artifacts, while Attach evidence as an artifact correctly returns artifacts. Reuse the shared negative-governor grammar for the new as-artifact operation match. Add direct and actual destination-floor negative controls, preserve positive and independent positive-clause requirements, and mirror source/template. Re-run the exact two-module gate plus focused new cases and retain RED/exact-restored-GREEN on the new behavior. The earlier92,822PASS evidence is a truthful snapshot of its selected tests, not proof that these new counterexamples pass.

  2. fix(verifier): retain artifact and review-comment evidence destinations #3836 (comment) (docs/evidence/issue-3835-evidence-destinations/replay.py:103): Semgrep flags native ElementTree parsing. The current replay parses locally generated fresh pytest JUnit; review that input boundary and use the repository-supported hardened parser (with declared dependency if required), or document a justified scoped finding disposition. Do not blindly suppress the scanner or claim it resolved without current-source evidence. Preserve exact replay proof/input hashes when changing the replay.

Keeper owns this coherent review-recovery pass, current CI and thread resolution; closer requires fresh complete expected topology, unchanged head, zero active threads, elapsed420s floor and actual compare before acceptance. No human/product hold or CodeRabbit-cap blocker is asserted.

@stranske-keepalive stranske-keepalive Bot removed the agent:retry Add to trigger agent retry after rate limit or pause label Oct 11, 2026
@stranske-keepalive

stranske-keepalive Bot commented Oct 11, 2026 •

Copy link
Copy Markdown
Contributor
Keepalive Work Log (click to expand)
# Time (UTC) Agent Action Result Files Tasks Progress Commit Gate
1 2026-10-11 19:48:58 Codex run (force-retry-gate) retry success 37 file(s) 0 23/24 907f822 —
2 2026-10-11 20:02:31 Codex run (force-retry-gate) retry success 34 file(s) +1 24/24 430d1b4 —
2 2026-10-11 20:03:37 Codex wait (gate-cancelled-transient) skipped — 0 24/24 — cancelled
2 2026-10-11 20:04:23 Codex wait (gate-cancelled-transient) skipped — 0 24/24 — cancelled
2 2026-10-11 20:50:44 Codex fix (agent-run-cancelled) retry cancelled 1 file(s) 0 24/24 — —
2 2026-10-11 20:51:42 Codex wait (gate-cancelled-transient) skipped — 0 24/24 — cancelled
3 2026-10-11 21:05:32 Codex fix (force-retry-fix-test) retry success 3 file(s) 0 24/24 — —

@github-actions

Copy link
Copy Markdown
Contributor

Runner dispatch state for codex on PR #3836. Do not edit.

@stranske-automation-bot

Copy link
Copy Markdown
Collaborator

Runner dispatch state for codex on PR #3836. Do not edit.

@agents-workflows-bot

Copy link
Copy Markdown
Contributor

✅ Codex Completion Checkpoint

Iteration: 1
Commit: 430d1b4
Recorded: 2026-10-11T20:02:03.365Z

Tasks Completed

  • Extend scripts/langchain/pr_verifier.py::_required_evidence_channels shared artifact operation/destination grammar to recognize active evidence delivery using as an artifact.
  • Extend scripts/langchain/pr_verifier.py::_required_evidence_channels shared review destination vocabulary for PR review comments and inline review comments.
  • Extend scripts/langchain/pr_verifier.py::_required_evidence_channels checklist noun handling using existing common-proof/polarity vocabulary so Validation output/results retain the named comment destination.
  • Add direct RED/GREEN cases to tests/scripts/test_pr_verifier_delivery_destinations.py for the three original examples and bounded positive/negative/optional/product/literal controls.
  • Add destination-specific coverage-floor regressions to tests/scripts/test_pr_verifier_prompt_coverage.py with body present but comments absent/unavailable, and body present but artifacts absent/unavailable.
  • Synchronize templates/consumer-repo/scripts/langchain/pr_verifier.py with the source fix.
  • Update the existing verifier entry in .github/sync-manifest.yml and the boundary contract in docs/ops/CONSUMER_REPO_MAINTENANCE.md.

Acceptance Criteria Met

  • python -m pytest tests/scripts/test_pr_verifier_delivery_destinations.py tests/scripts/test_pr_verifier_prompt_coverage.py -q passes on the fixed bytes; deliberate restoration of each original grammar defect makes its named regression fail, followed by byte-identical restoration and GREEN.
  • Attach evidence as an artifact and Upload the coverage report as an artifact require artifacts, and missing/unavailable artifacts block a model PASS even with a present PR body.
  • Evidence must be posted in a PR review comment and the inline-review-comment variant require comments; absent/unavailable comments cannot be masked by a present PR body.
  • Source and templates/consumer-repo/scripts/langchain/pr_verifier.py are byte-identical for the changed verifier, with manifest/docs coverage and retained RED/GREEN commands/results in the ready implementation PR.
About this comment

This comment is automatically generated to track task completions.
The Automated Status Summary reads these checkboxes to update PR progress.
Do not edit this comment manually.

@github-actions

Copy link
Copy Markdown
Contributor

Runner dispatch state for codex on PR #3836. Do not edit.

@stranske-automation-bot

Copy link
Copy Markdown
Collaborator

Runner dispatch state for codex on PR #3836. Do not edit.

@stranske

Copy link
Copy Markdown
Owner Author

Recovered campaign checkpoint for the existing source owner, not a second worker request: keepalive run 38170641097 is already actively implementing on current head 430d1b4. Adopt current Codex finding discussion_r4242906490 (No need/no requirement to attach evidence as an artifact) and explicitly disposition Semgrep discussion_r4242907764 on the new XML proof parser; do not waive the failing Semgrep check. New generated TPP finding stranske/Travel-Plan-Permission#1647 (comment) adds the exact destination-first regression - [ ] PR comment with test evidence. Ensure direct and absent/unavailable-comments floor controls cover it, then request originating exact-head disposition after the fix. Generated TPP head remains 18c24879e80bdddc9bc45cf00ba79283a994366c; Maint71 alone owns its eventual disposition after accepted source regeneration. Keep #3831 native capture/proof recovery separate. No additional writer, general review or generated mutation is dispatched by this comment.

@github-actions

Copy link
Copy Markdown
Contributor

Runner dispatch state for codex on PR #3836. Do not edit.

@stranske

Copy link
Copy Markdown
Owner Author

Opener drain audit on current head 21182b04bc0cf38358e68b07f138feea32c958ea. Full active review findings were read. Matching keepalive owns the following concrete recovery; a checked task summary does not resolve these findings.

  • fix(verifier): retain artifact and review-comment evidence destinations #3836 (comment) (scripts/langchain/pr_verifier.py:3915; chatgpt-codex-connector):

    P2 Badge Honor negative governors for as-artifact clauses

    When acceptance text uses noun-form negation, such as No need to attach evidence as an artifact, this new unconditional operation/object match makes _required_evidence_channels return {"artifacts"}; the parent implementation returned no required channel. Consequently, an absent artifact can now downgrade a model PASS to CONCERNS even though the criterion explicitly says the delivery is unnecessary. Route this match through the shared negative-governor handling or exclude no need/no requirement contexts.

    Useful? React with 👍 / 👎.

  • fix(verifier): retain artifact and review-comment evidence destinations #3836 (comment) (docs/evidence/issue-3835-evidence-destinations/replay.py:103; github-advanced-security):

    Semgrep OSS / Semgrep Finding: python.lang.security.use-defused-xml-parse.use-defused-xml-parse

    The native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using defusedxml.

    Show more details

Current JavaScript Tests/github scripts tests/test-quality/Semgrep failures also require the actual failing logs and focused validation. Preserve root/template parity and original raw proof history.

After recovery, closer rechecks the full current-head topology, all active threads and a fresh seven-minute review floor before merge/actual comparison. No merge is armed by this audit.

@stranske-automation-bot

Copy link
Copy Markdown
Collaborator

Runner dispatch state for codex on PR #3836. Do not edit.

@github-actions

Copy link
Copy Markdown
Contributor

Runner dispatch state for codex on PR #3836. Do not edit.

@stranske stranske removed agent:codex Agent-created issues from Codex agent:auto Delegates agent routing to the auto-delegation policy labels Oct 11, 2026
@agents-workflows-bot

agents-workflows-bot Bot commented Oct 11, 2026 •

Copy link
Copy Markdown
Contributor

Automated Status Summary

Head SHA: fe15da5
Latest Runs: ⏳ pending — Gate
Required contexts: summary
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job Result Logs
(no jobs reported) ⏳ pending —

Coverage Overview

  • Coverage history entries: 1

Coverage Trend

Metric Value
Current 81.38%
Baseline 85.00%
Delta -3.62%
Minimum 70.00%
Status ✅ Pass

Top Coverage Hotspots (lowest coverage)

File Coverage Missing
scripts/issue_dedup_smoke.py 0.0% 4
scripts/runner_lib/__main__.py 0.0% 3
scripts/prune_agent_stubs.py 39.7% 26
tools/ensure_workflow_timeout_variables.py 42.1% 74
scripts/sync_label_docs.py 42.9% 64
scripts/repo_review_round2_runner.py 44.3% 348
scripts/validate_template_sync.py 45.1% 51
scripts/repo_review_backlog_scan.py 45.3% 116
tools/codex_session_analyzer.py 47.9% 59
scripts/create_verifier_labels.py 48.3% 58
scripts/stage_agent_changes.py 48.3% 12
tools/ci_failure_triage.py 49.7% 113
scripts/langchain/verdict_extract.py 54.1% 21
scripts/langsmith_observability_health.py 55.3% 83
scripts/select_consumer_sync_phase.py 55.6% 62

Low Coverage Files (<50.0%)

File Coverage Missing
scripts/issue_dedup_smoke.py 0.0% 4
scripts/runner_lib/__main__.py 0.0% 3
scripts/prune_agent_stubs.py 39.7% 26
tools/ensure_workflow_timeout_variables.py 42.1% 74
scripts/sync_label_docs.py 42.9% 64
scripts/repo_review_round2_runner.py 44.3% 348
scripts/validate_template_sync.py 45.1% 51
scripts/repo_review_backlog_scan.py 45.3% 116
tools/codex_session_analyzer.py 47.9% 59
scripts/create_verifier_labels.py 48.3% 58
scripts/stage_agent_changes.py 48.3% 12
tools/ci_failure_triage.py 49.7% 113

Updated automatically; will refresh on subsequent CI/Docker completions.


Keepalive checklist

Scope

Current delivered Workflows source 49286cc28411f1efb5545866ed0f278e6c680fdb, scripts/langchain/pr_verifier.py in _required_evidence_channels (consumer lines 3886/4037), still loses three mandatory evidence destinations. Actual trip-planner #1885 head b28e40427fe68fb9848d0a988a9149463e10058c findings stranske/trip-planner#1885 (comment) and stranske/trip-planner#1885 (comment) reproduce: Attach evidence as an artifact returns no channel; Evidence must be posted in a PR review comment returns overall instead of comments. Independently reproduced - [ ] Validation output in a PR comment also returns no channel. This is a current deterministic completeness defect, not optional stylistic coverage. Required evidence can be missing while a model PASS survives the floor.

Context for Agent

Related Issues/PRs

Tasks

  • Extend scripts/langchain/pr_verifier.py::_required_evidence_channels shared artifact operation/destination grammar to recognize active evidence delivery using as an artifact.
  • Extend scripts/langchain/pr_verifier.py::_required_evidence_channels shared review destination vocabulary for PR review comments and inline review comments.
  • Extend scripts/langchain/pr_verifier.py::_required_evidence_channels checklist noun handling using existing common-proof/polarity vocabulary so Validation output/results retain the named comment destination.
  • Add direct RED/GREEN cases to tests/scripts/test_pr_verifier_delivery_destinations.py for the three original examples and bounded positive/negative/optional/product/literal controls.
  • Add destination-specific coverage-floor regressions to tests/scripts/test_pr_verifier_prompt_coverage.py with body present but comments absent/unavailable, and body present but artifacts absent/unavailable.
  • Synchronize templates/consumer-repo/scripts/langchain/pr_verifier.py with the source fix.
  • Update the existing verifier entry in .github/sync-manifest.yml and the boundary contract in docs/ops/CONSUMER_REPO_MAINTENANCE.md.

Acceptance criteria

  • python -m pytest tests/scripts/test_pr_verifier_delivery_destinations.py tests/scripts/test_pr_verifier_prompt_coverage.py -q passes on the fixed bytes; deliberate restoration of each original grammar defect makes its named regression fail, followed by byte-identical restoration and GREEN.
  • Attach evidence as an artifact and Upload the coverage report as an artifact require artifacts, and missing/unavailable artifacts block a model PASS even with a present PR body.
  • Evidence must be posted in a PR review comment and the inline-review-comment variant require comments; absent/unavailable comments cannot be masked by a present PR body.
  • - [ ] Validation output in a PR comment requires comments; negative, optional, quoted-literal and product-capability controls remain nongating unless a separate mandatory delivery exists.
  • Source and templates/consumer-repo/scripts/langchain/pr_verifier.py are byte-identical for the changed verifier, with manifest/docs coverage and retained RED/GREEN commands/results in the ready implementation PR.

@stranske
stranske deployed to agent-standard October 11, 2026 21:09 — with GitHub Actions Active
@stranske stranske removed the agents:keepalive Use to initiate keepalive functionality with agents label Oct 11, 2026
@stranske

Copy link
Copy Markdown
Owner Author

@codex review

Please review exact head 99f4fdd. The active nominal negative-governor finding is repaired through the shared governor and body predicate classifier, not an artifact-only exception; source/template are identical. Original regressions: 34 failed; fixed focused gate: 220 passed; full relevant suite: 93,014 passed. The replay security finding is repaired with Expat handlers rejecting DTD/entity declarations; ordinary JUnit plus internal/external declaration controls pass (4 tests). Original three-rule reversal/restoration replay still gives 3 RED assertion failures and 3 GREEN passes per rule. See committed docs/evidence/issue-3835-evidence-destinations/follow-up-20261011.json and README for scope and proof bindings. Preserve the runtime-file cleanup. No generated PR mutation or merge authority is requested.

@stranske
stranske deployed to agent-standard October 11, 2026 21:41 — with GitHub Actions Active

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 99f4fddd22

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread scripts/langchain/pr_verifier.py Outdated
Comment thread scripts/langchain/pr_verifier.py
@stranske stranske mentioned this pull request Oct 11, 2026
16 tasks done
@stranske

Copy link
Copy Markdown
Owner Author

@codex review

Review exact head e252bbc. Both new findings were adopted: shared nominal exists-negation and review-comment UI/API/renderer product subjects. Deliberate RED 45 failures / 225 tests; focused GREEN 285; broader two-module GREEN 93,075. Immutable source/test/proof hashes are in docs/evidence/issue-3835-evidence-destinations/review-follow-up-20261011.json; source/template parity preserved, docs/manifest updated. Original finding-only assessment at prior head 99f4fdd was completed PASS but explicitly not whole-PR acceptance, and cannot authorize this new head. No edits or merge actions requested.

@stranske
stranske deployed to agent-standard October 11, 2026 22:02 — with GitHub Actions Active
@stranske
stranske merged commit fe15da5 into main Oct 12, 2026
59 checks passed
@stranske
stranske deleted the codex/issue-3835 branch October 12, 2026 00:23
@agents-workflows-bot agents-workflows-bot Bot mentioned this pull request Oct 12, 2026
2 tasks done
@stranske stranske added the verify:compare Compare multiple LLM evaluations label Oct 12, 2026
@stranske
stranske deployed to agent-high-privilege October 12, 2026 00:29 — with GitHub Actions Active
@github-actions

Copy link
Copy Markdown
Contributor

Provider Comparison Report

Provider Summary

Provider Model Verdict Confidence Summary
openai gpt-5.6-terra CONCERNS 84% The visible code is readable and largely consistent with the acceptance criteria. It preserves source/template parity, adds artifact and PR/inline-review-comment destination handling, retains valid...
anthropic claude-sonnet-5-5 CONCERNS 60% The code changes appear to implement the three required destination fixes. They extend the shared artifact, review-comment and checklist grammar, and keep the source and consumer template byte-iden...
📋 Full Provider Details (click to expand)

openai

  • Model: gpt-5.6-terra
  • Verdict: CONCERNS
  • Confidence: 84%
  • Scores:
    • Correctness: 8.0/10
    • Completeness: 6.0/10
    • Quality: 8.0/10
    • Testing: 8.0/10
    • Risks: 7.0/10
  • Summary: The visible code is readable and largely consistent with the acceptance criteria. It preserves source/template parity, adds artifact and PR/inline-review-comment destination handling, retains validation-output/results checklist destinations, and supplies direct parser and coverage-floor tests including present/absent/unavailable channel states and nongating controls. However, the required retained RED/GREEN proof artifacts are unavailable for complete inspection and two changed binary archives are omitted from the review input. Therefore acceptance completeness cannot be verified and the appropriate post-merge verdict is CONCERNS rather than PASS.
  • Concerns:
    • A PASS is not supportable because required review/artifact acceptance evidence is unavailable for complete inspection, and two changed archive files are omitted entirely. The acceptance criteria explicitly require retained RED/GREEN commands and results; the included documentation and JSON describe them, but the referenced archives cannot be verified from the supplied evidence. This is an unverifiable-deliverable concern, not a finding that the evidence is absent.
    • The implementation and source/template diff appear to address the stated grammar defects: review-comment destination normalization is applied before channel/options classification, checklist recognition includes the existing common-proof aliases, and active ' ... as an artifact' recognition is added. Tests cover the original examples plus absent/unavailable destination-floor cases.
    • The PR also includes follow-up changes beyond the three original destination defects (nominal negative-governor handling and review-comment UI/API/renderer product-subject handling). These appear bounded and tested in the visible regression matrix, but the full changed evidence set is incomplete, so their broader regression proof cannot be independently confirmed here.
    • The replay utility mutates both production verifier copies in place. It contains restoration checks and a finally block, which reduces risk, but it remains operationally sensitive to concurrent edits or test processes, as its own documentation notes.

anthropic

  • Model: claude-sonnet-5-5
  • Verdict: CONCERNS
  • Confidence: 60%
  • Scores:
    • Correctness: 8.0/10
    • Completeness: 7.0/10
    • Quality: 7.0/10
    • Testing: 8.0/10
    • Risks: 7.0/10
  • Summary: The code changes appear to implement the three required destination fixes. They extend the shared artifact, review-comment and checklist grammar, and keep the source and consumer template byte-identical. The sync manifest and docs are updated, and direct and coverage-floor regressions cover absent, unavailable and present states plus negative, optional, product and literal controls. I could not fully verify the retained RED/GREEN archives (two omitted, one truncated) or the PR comment and workflow-artifact evidence. The linked issue also has one acceptance item unchecked that the PR checks. Because evidence coverage is incomplete, I am returning CONCERNS rather than PASS.
  • Concerns:
    • Evidence coverage is incomplete, so this cannot be a PASS. Two changed files (followup-validation.tar.gz and raw-validation.tar.gz) were omitted from the prompt, and follow-up-20261011.json was truncated. The acceptance criteria require retained RED/GREEN receipts, and the PR relies on these archives for them, so I could not verify them.
    • PR comment and workflow-artifact retrieval is marked 'unavailable' because of comment-count/character limits and run-record limits. Review-finding adjudication and the exact-head evidence therefore cannot be confirmed as complete.
    • Issue fix(verifier): retain artifact and review-comment evidence destinations #3835 leaves the acceptance item '- [ ] Validation output in a PR comment requires comments; negative, optional, quoted-literal and product-capability controls remain nongating' unchecked. The PR body checks it, so the two sources disagree. The code and tests do appear to cover it.
    • The PR body leaves one criterion unchecked: 'The full relevant regression suite passes and exact-head hosted review/CI findings are adjudicated before merge'. The PR body lists local runs of 92,822 and 93,075 passing tests. The hosted adjudication could not be verified from the inspected evidence.
    • The three headline fixes look correct as implemented. (1) as an artifact delivery is added to the artifact operation grammar. (2) PR/inline review comments are normalized to the shared PR-comment destination, with quoted literals preserved. (3) Checklist nouns are extended with the common-proof alias noun. The no-need/requirement/obligation (exists) negative governor and the review-comment product-subject guard also look sound. The source and consumer template diffs are identical. The tests include nongating controls and floor tests with present/absent/unavailable states. These are residual regex-grammar risks, not demonstrated defects.
    • The replay evidence script rewrites production files in place during its run. It is guarded by exact-byte restoration and an Expat parser that rejects DTDs. This is acceptable for evidence tooling, but it is a hazard if run concurrently.

Agreement

  • Verdict: CONCERNS (all providers)
  • Correctness: scores within 1 point (avg 8.0/10, range 8.0-8.0)
  • Completeness: scores within 1 point (avg 6.5/10, range 6.0-7.0)
  • Quality: scores within 1 point (avg 7.5/10, range 7.0-8.0)
  • Testing: scores within 1 point (avg 8.0/10, range 8.0-8.0)
  • Risks: scores within 1 point (avg 7.0/10, range 7.0-7.0)

Disagreement

No major disagreements detected.

Unique Insights

  • openai: A PASS is not supportable because required review/artifact acceptance evidence is unavailable for complete inspection, and two changed archive files are omitted entirely. The acceptance criteria explicitly require retained RED/GREEN commands and results; the included documentation and JSON describe them, but the referenced archives cannot be verified from the supplied evidence. This is an unverifiable-deliverable concern, not a finding that the evidence is absent.; The implementation and source/template diff appear to address the stated grammar defects: review-comment destination normalization is applied before channel/options classification, checklist recognition includes the existing common-proof aliases, and active ' ... as an artifact' recognition is added. Tests cover the original examples plus absent/unavailable destination-floor cases.; The PR also includes follow-up changes beyond the three original destination defects (nominal negative-governor handling and review-comment UI/API/renderer product-subject handling). These appear bounded and tested in the visible regression matrix, but the full changed evidence set is incomplete, so their broader regression proof cannot be independently confirmed here.; The replay utility mutates both production verifier copies in place. It contains restoration checks and a finally block, which reduces risk, but it remains operationally sensitive to concurrent edits or test processes, as its own documentation notes.
  • anthropic: Evidence coverage is incomplete, so this cannot be a PASS. Two changed files (followup-validation.tar.gz and raw-validation.tar.gz) were omitted from the prompt, and follow-up-20261011.json was truncated. The acceptance criteria require retained RED/GREEN receipts, and the PR relies on these archives for them, so I could not verify them.; PR comment and workflow-artifact retrieval is marked 'unavailable' because of comment-count/character limits and run-record limits. Review-finding adjudication and the exact-head evidence therefore cannot be confirmed as complete.; Issue fix(verifier): retain artifact and review-comment evidence destinations #3835 leaves the acceptance item '- [ ] Validation output in a PR comment requires comments; negative, optional, quoted-literal and product-capability controls remain nongating' unchecked. The PR body checks it, so the two sources disagree. The code and tests do appear to cover it.; The PR body leaves one criterion unchecked: 'The full relevant regression suite passes and exact-head hosted review/CI findings are adjudicated before merge'. The PR body lists local runs of 92,822 and 93,075 passing tests. The hosted adjudication could not be verified from the inspected evidence.; The three headline fixes look correct as implemented. (1) as an artifact delivery is added to the artifact operation grammar. (2) PR/inline review comments are normalized to the shared PR-comment destination, with quoted literals preserved. (3) Checklist nouns are extended with the common-proof alias noun. The no-need/requirement/obligation (exists) negative governor and the review-comment product-subject guard also look sound. The source and consumer template diffs are identical. The tests include nongating controls and floor tests with present/absent/unavailable states. These are residual regex-grammar risks, not demonstrated defects.; The replay evidence script rewrites production files in place during its run. It is guarded by exact-byte restoration and an Expat parser that rejects DTDs. This is acceptable for evidence tooling, but it is a hazard if run concurrently.

🔍 LangSmith Traces

This branch was successfully deployed

2 active deployments
agent-high-privilege — e252bbc2 Deployed Oct 12, 2026 by stranske via privilege environment gate #15734
agent-standard — e252bbc2 Deployed Oct 11, 2026 by stranske via privilege environment gate #15704
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

autofix Opt-in automated formatting & lint remediation codex codex-automation verify:compare Compare multiple LLM evaluations

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(verifier): retain artifact and review-comment evidence destinations

3 participants