docs(agents): codify protected PR repair workflow #1564
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -50,6 +50,10 @@ mail/calendar/file systems. | |
| auto-merge, and mechanical merge actions run as the target repository's | ||
| `github-actions[bot]` through the central workflow. Pending CodeRabbit or | ||
| required-check evidence is a wait state, not a hard blocker. | ||
| - Local OpenCode contributor runs use contextual-orchestrator's fixed loopback | ||
| OpenAI-compatible endpoint at `http://127.0.0.1:8100/v1`. Set a short-lived | ||
| owner-issued `CONTEXTUAL_ORCHESTRATOR_TOKEN`; do not substitute an upstream | ||
|
Comment on lines
+53
to
+55
There was a problem hiding this comment.
Fresh evidence beyond the earlier setup comment is that a repo-wide search of Docker Compose files, scripts, and documentation finds no service definition or bootstrap command that binds contextual-orchestrator to AGENTS.md reference: AGENTS.md:L778-L781 Useful? React with 👍 / 👎. |
||
| provider key. This value configures OpenCode only, not Naruon. | ||
| - Topic intelligence is not currently a live Naruon capability. The lexical | ||
| `keyword_extractor` is metadata only; Naruon fails closed rather than present | ||
| keyword, embedding, or LLM labels as Structural Topic Modeling. The product, | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -44,6 +44,36 @@ def read_repo_text(relative_path: str) -> str: | |
| return path.read_text(encoding="utf-8") | ||
|
|
||
|
|
||
| def test_agent_lifecycle_governance_artifacts_stay_aligned() -> None: | ||
| """Keep lifecycle policy, model routing, and research evidence consistent.""" | ||
| guidance = read_repo_text("AGENTS.md") | ||
| opencode_config = read_repo_text("opencode.jsonc") | ||
| environment_example = read_repo_text(".env.example") | ||
| readme = read_repo_text("README.md") | ||
| research_artifact = REPO_ROOT / "docs/papers/nist-sp-800-218.pdf" | ||
|
|
||
| assert '"model": "contextual-orchestrator/orchestrator/free"' in opencode_config | ||
| assert '"enabled_providers": ["contextual-orchestrator"]' in opencode_config | ||
| assert '"baseURL": "http://127.0.0.1:8100/v1"' in opencode_config | ||
| assert '"apiKey": "{env:CONTEXTUAL_ORCHESTRATOR_TOKEN}"' in opencode_config | ||
|
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -e
printf '%s\n' '--- relevant files ---'
git ls-files | rg '(^|/)(opencode\.jsonc|package\.json|.*opencode.*|test_release_governance\.py)$' || true
printf '%s\n' '--- config and governance test ---'
cat -n opencode.jsonc 2>/dev/null | sed -n '35,52p' || true
cat -n backend/tests/test_release_governance.py | sed -n '45,65p'
printf '%s\n' '--- OpenCode references and versions ---'
rg -n --glob '!backend/tests/test_release_governance.py' 'OpenCode|opencode|baseURL|apiKey|CONTEXTUAL_ORCHESTRATOR_TOKEN' . | head -160Repository: ContextualWisdomLab/naruon Length of output: 18569 🌐 Web query:
💡 Result: OpenCode is an open-source AI coding agent that allows for extensive configuration of API providers and server networking [1][2]. Below is a summary of the relevant configuration options based on official documentation. Base URL and API Keys To configure AI providers, you can define settings in the OpenCode configuration file (typically config.json) [3][4]. - Base URL: You can customize the API endpoint by setting the baseURL option within a provider's configuration [3][5]. This is useful for proxy services or custom endpoints [3][5]. - API Keys: These are typically set using the apiKey option [3][5]. OpenCode supports environment variable substitution using the {env:VARIABLE_NAME} syntax [4]. Networking (HTTP/HTTPS and Proxies) OpenCode respects standard environment variables for network configuration, including proxy settings [6]. - HTTP/HTTPS Proxies: You can configure proxies by setting the HTTP_PROXY and HTTPS_PROXY environment variables [6]. - Proxy Bypass: It is recommended to set the NO_PROXY environment variable (e.g., NO_PROXY=localhost,127.0.0.1) to ensure the local terminal user interface (TUI) can communicate with the local OpenCode server without routing loops [6]. - Custom Certificates: If your environment requires custom Certificate Authorities (CAs) for HTTPS connections, you can configure OpenCode to trust them by setting the NODE_EXTRA_CA_CERTS environment variable to the path of your CA certificate file [6]. Server Configuration The OpenCode server (accessible via opencode serve) can be configured to manage its network exposure [7][8]. - CORS: You can permit additional origins for browser-based clients by using the --cors flag or the cors server option in your configuration [4][7]. - Auth: You can protect the server with HTTP basic authentication by setting the OPENCODE_SERVER_PASSWORD and OPENCODE_SERVER_USERNAME environment variables [7][8]. - mDNS: You can enable mDNS service discovery (mdns) to allow other devices on the network to discover your OpenCode server, with optional custom domain naming (mdnsDomain) [4][7]. The OpenCode server also exposes an OpenAPI 3.1 specification at the /doc endpoint (e.g., http://localhost:4096/doc) which can be used for inspecting the API or generating custom clients [7][8]. Citations:
🤖 get_repo_knowledge executed:
Length of output: 30626 🌐 Web query:
💡 Result: When working with OpenAI-compatible APIs in environments like OpenCode (which utilizes the Citations:
🏁 Script executed: #!/bin/bash
set -e
printf '%s\n' '--- OpenCode package/source references in repository ---'
rg -n --glob 'package.json' --glob 'pnpm-lock.yaml' --glob 'package-lock.json' --glob 'yarn.lock' \
'`@ai-sdk/openai-compatible`|ai-sdk|opencode' . || true
printf '%s\n' '--- relevant local networking documentation ---'
rg -n -C 3 'loopback|127\.0\.0\.1:8100|CONTEXTUAL_ORCHESTRATOR_TOKEN|HTTPS|HTTP_PROXY|NO_PROXY|redirect' \
README.md AGENTS.md docs opencode.jsonc .env.example 2>/dev/null | head -220Repository: ContextualWisdomLab/naruon Length of output: 25265 🌐 Web query:
💡 Result: In OpenCode, you can configure custom LLM providers by creating or editing an opencode.json configuration file [1][2][3]. This file allows you to define provider-specific settings, including the API key, base URL, and custom HTTP headers [1][2][3]. Configuration Structure You can specify these details within the provider options in your opencode.json file [1][2][3]: { "$schema": "https://opencode.ai/config.json", "provider": { "myprovider": { "npm": " Citations:
Sensitive Data Exposure (CWE-319): Cleartext Transmission of Sensitive Information Reachability: Internal · Exploitability: Difficult Do not bind a credential to plaintext HTTP without a transport guarantee.
🤖 Prompt for AI Agents |
||
| assert "CONTEXTUAL_ORCHESTRATOR_BASE_URL" not in opencode_config | ||
| assert opencode_config.count('"timeout": false') == 1 | ||
| assert "STRIX_GITHUB_MODELS_TOKEN" not in opencode_config | ||
| assert "CONTEXTUAL_ORCHESTRATOR_BASE_URL" not in environment_example | ||
| assert "CONTEXTUAL_ORCHESTRATOR_BASE_URL" not in readme | ||
| assert "CONTEXTUAL_ORCHESTRATOR_TOKEN=" in environment_example | ||
| assert "CONTEXTUAL_ORCHESTRATOR_TOKEN" in readme | ||
| assert "http://127.0.0.1:8100/v1" in readme | ||
| assert "short-lived" in readme | ||
| assert "owner-issued" in readme | ||
| assert "docs/development/merge-gate-policy.md" in guidance | ||
| assert "prove complete-delta succession" in guidance | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
| assert "Do not use administrative merge bypass" in guidance | ||
| assert "stale-context procedure" in guidance | ||
| assert "successor's exact tree, effective diff, tests, and lineage record" in guidance | ||
| assert research_artifact.read_bytes().startswith(b"%PDF-") | ||
|
|
||
|
|
||
| def assert_dockerfile_stage_from(dockerfile: str, image: str, stage_alias: str) -> None: | ||
| pattern = ( | ||
| rf"^FROM {re.escape(image)}@sha256:[0-9a-f]{{64}} AS {re.escape(stage_alias)}$" | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When a contributor supplies this variable so the
{env:CONTEXTUAL_ORCHESTRATOR_TOKEN}interpolation works, the token is part of OpenCode's ambient process environment and is inherited by the local MCP child commands inopencode.jsonc(including three third-partynpxpackages); it is therefore not sent only to the fixed loopback endpoint as this comment claims. A compromised or diagnostic MCP can read and exfiltrate the owner-issued gateway bearer token, so load it through a provider-scoped credential mechanism or explicitly scrub it from every spawned tool/MCP environment.AGENTS.md reference: AGENTS.md:L240-L243
Useful? React with 👍 / 👎.