fix(reviewer): fail closed on empty CodeGraph semantics

[seonghobae]

Defect

Noema strict reviewer must preserve exact current-head changed-file identity as untrusted data across the first CodeGraph explore and bounded empty-result recovery path. This lane owns reviewer semantic evidence only; provider/model routing, quarantine/security verdicts, outbound authority and central runner capacity remain with their canonical owners.

Retained RED → causal repair

• a785cd4e536b84cd4bf7e4d6a0e1b9aff71d057f restores exact canonical-JSON changed-scope parsing and complete bounded symbol recovery.
• RED 244a0294ab5d8fc1df0352c4b02b258a11938a39 proves newline-bearing filenames and instruction-shaped symbol output remain JSON data in retry seeds; production b6c370255e92491d4eac0cc9ec9c5c6b6f909fab serializes [{"path":...,"symbols":...}] as untrusted retrieval data.
• RED 3328f7ba97bc4575665c5e539369951cb21ccd60 proves a leading backslash is a legal Linux Git filename byte; production 04376e279c61a7491cb311589b28dc643bf65837 removes only the Windows-specific rejection while retaining POSIX absolute/traversal/NUL/bounded admission and no-follow sandbox boundaries.

Hosted reviewer RED → causal repairs — 2026-09-06 KST

Exact 04376e279c61a7491cb311589b28dc643bf65837 obtained a real GitHub-hosted runner in reviewer-ci 33979574209, job 101342258628: 549 tests executed, 548 passed, one stale same-path/same-severity dedup assertion failed, and coverage was 99.29%. b84f0e5a99f09e54d30b2e42fb03dcb5566cc717 converts that fixture to exact deterministic finding identity, 6e5df50cd2c0f45dc454e849d781477de0a31b45 adds fail-closed admission edge coverage, and 95144d5bcf8f1cb4b9a7c552ede66737c23d6bca removes one logically unreachable empty-candidate branch. No threshold/exclusion/gate weakening was used.

Exact 95144d5bcf8f1cb4b9a7c552ede66737c23d6bca then obtained another real hosted runner in reviewer-ci 33986014642, job 101359520394. Exact checkout, hash-pinned install, and the 100% line+branch pytest gate all succeeded. The sole failure moved to docstring coverage (100% gate): the newly introduced nested semantic_runner inside build_semantic_codegraph_runner had no docstring, so later CodeGraph/image steps correctly did not run.

Minimal causal repair 7d3de5a859be96b953927201d9ba782673f4bb8e adds only the missing behavioral docstring to that nested runner. Runtime semantics, CodeGraph admission, provider routing, sandbox authority, coverage thresholds and workflow gates are unchanged.

Current exact authority

• protected Noema base: main@e1ac9d50f6c646f04be8c137c8acdc7200182fcd;
• exact PR head: 7d3de5a859be96b953927201d9ba782673f4bb8e;
• lifecycle: open / Draft / mergeable;
• exact-head reviewer-ci 33991772403, ci 33991772454, required Security Scan 33991772437, and patch-validator-image 33991772389 are queued/non-passing.

The hosted failures above remain RED evidence only; predecessor successes do not transfer. Keep Draft until this unchanged exact head has terminal current CI/reviewer/Security/coverage/package/image/SBOM/vulnerability/provenance evidence and every valid current finding is resolved. Runner/control-plane allocation remains owned by ContextualWisdomLab/.github#712; do not use leaf runs-on changes, no-op source churn, rerun storms or required-gate suppression as substitutes.

Merge discipline

After #546 reaches protected semantic-review truth, affected open heads need regenerated semantic evidence. Do not self-approve, force-push/destructively rebase, or accept raw/truncated/partial/cached-wrong-prompt evidence.

[coderabbitai]

📝 Walkthrough

Walkthrough

CodeGraph 탐색 출력에 wrapper 소유 provenance marker를 추가한다. 엄격한 게이트는 의미론적 탐색 컨텍스트만 검토 증거로 인정한다. Smoke test와 문서는 빈 결과, 모호한 provenance, 종료 코드 변경을 반영한다.

Changes

CodeGraph 의미론적 증거

Layer / File(s)	Summary
탐색 출력 라벨링 및 매니페스트 연결 reviewer/noema_reviewer/cli.py, reviewer/tests/test_cli.py	explore 출력에서 기존 marker를 중화하고 wrapper 소유 marker를 추가한다. _load_manifest가 해당 러너를 사용한다. 러너와 연결 동작을 테스트한다.
의미론적 컨텍스트 게이트 reviewer/noema_reviewer/gating.py, reviewer/tests/test_codegraph_semantic_evidence.py, reviewer/tests/test_codegraph_status_sections.py, reviewer/tests/test_gating.py, reviewer/tests/test_truncated_diff_gate.py	단일 explore 섹션과 의미론적 라인을 검증한다. 빈 결과, 중복 marker, 배너, 주석, 잘림, 제어 문자, 비라벨 출력을 누락 증거로 처리한다.
Smoke test 및 엄격 모드 계약 .github/workflows/reviewer-ci.yml, reviewer/README.md, test/reviewer-ci-action-runtime-integrity.test.ts	Smoke test가 commercialReadiness 심볼과 소스 라인을 확인한다. 문서와 런타임 무결성 테스트가 의미론적 결과 조건과 blocked 종료 코드 3을 반영한다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: 🟡 Moderate · up to e064e

Malformed CodeGraph output can be treated as trusted semantic evidence, potentially allowing strict reviewer runs to proceed without wrapper-owned provenance. Require standalone-marker parsing before merge.

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant fetch_manifest
  participant _semantic_codegraph_runner
  participant missing_evidence
  CLI->>fetch_manifest: codegraph_runner 전달
  fetch_manifest->>_semantic_codegraph_runner: explore 실행
  _semantic_codegraph_runner->>_semantic_codegraph_runner: raw marker 중화 및 wrapper marker 추가
  _semantic_codegraph_runner-->>fetch_manifest: 라벨링된 CodeGraph 상태 반환
  fetch_manifest-->>missing_evidence: ReviewManifest 전달
  missing_evidence->>missing_evidence: marker와 semantic context 검증
  missing_evidence-->>CLI: 누락 증거 사유 반환

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 94.59% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 37 functions across 8 files. (2 skipped: 2 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 제목은 빈 CodeGraph 의미론적 출력에 대해 reviewer가 fail closed하도록 수정하는 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/codegraph-smoke-semantic-gate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}