Repository navigation
Conversation
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
… traces truncate An eligibility probe that throws (e.g. a blocked-model redirect cycle) now skips that fallback candidate instead of selecting it and dead-ending the retry. Redirect membership uses the full policy evaluation result carried on the request context, so an eligible destination truncated out of the bounded trace can still receive a hop. Eligibility probes run through previewRouteModel so they never write combo selection state.
…d scope The dev merge made policy fallback authorization request-owned: the retry's resolved route must sit inside the eligibility captured from the real first route, and the candidate probe resolves each trace row concretely. Synthetic traces can no longer authorize candidates the real evaluation never admitted, so the fixtures now declare them for real: the second candidate joins the native-hop profile, and opencode-go-2 joins the provider map. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…ied fallback logging
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 20 minutes. View limit detailsLimit details: You’ve used all 10 included reviews currently available. Review configuration: ⚙️ Run configurationConfiguration used: Repository: lidge-jun/opencodex/.coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (25)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Deterministic PR hygiene checks passed. |
|
Follow-up verification for Fix two deterministic source-oracle regressions: register policy-request-scope.ts in the exact Responses owner inventory; anchor shadow combo option inspection at the actual dispatcher call and assert valid ordered slice boundaries. Existing graph equality, size/cycle constraints and isolation marker assertions remain intact. No runtime, policy membership, attempt budget or role behavior changed. Both exact CI assertions failed before the test-only corrections. The two complete fixture files and affected source-inventory consumers then passed 53 tests with 511 assertions. Runtime, policy eligibility and attempt budgets are unchanged. Executed focused commands:
Required typecheck, structure, privacy and file-size checks passed. Full local suite and unfiltered Cross-platform CI succeeded for this exact HEAD. Checkout Independent maintainer approval, explicit security review and any required sponsorship remain pending before merge. |
|
Carried to #6396 so it can land in the next release. Your commits are kept as they are and the squash will carry An independent security review of |
…(carry #6380) (#6396) Policy fallback could authorize a redirect from a bounded diagnostic trace or reselect a public alias, letting a retry escape the original eligible provider/model set. Keep the first policy evaluation's complete membership as request-owned state, evaluate retries as concrete candidates, and check the final destination before dispatch. Subagent selection, recovery, alias collisions and virtual wire models stay inside that membership. The shadow-intercept target is probed without capturing that scope and is captured only when interception is accepted, so a declined policy target never scopes the request's own route. Carried from #6380. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
2 participants
Summary
Policy fallback could authorize a redirect from a bounded diagnostic trace or reselect a public alias, allowing a retry to escape the original eligible provider/model set. Preserve the first policy evaluation's complete membership as request-owned state, evaluate retries as concrete candidates, and check the final destination before dispatch. Subagent selection, recovery, alias collisions, virtual wire models, and redirects retain that original authorization boundary.
Skip already-attempted physical destinations without losing the last actual upstream failure, route identity, usage, active attempt, or spend tracker. The accounting regression reproduces lost usage before the fix. Affinity fixtures now declare both permitted candidates in the actual policy instead of forging trace eligibility; their original identity-isolation assertions remain intact.
Source history is preserved through commit
2c34217881b072ba618595d1ca57a16e56f814c5, including bot commit8176e729921290f8544b8a6044bf0ad8e5129dbd. The focused validation used the integration withdevat0328373fb88fe0d019b29ae278e153d7fed4bcc7. The final bot integration retained the tested runtime and added one separately tested provider-fixture line.Verification
Current follow-up
Follow-up verification for
05bc47d728dd791ffe796c2356d74d266e752bae:Fix two deterministic source-oracle regressions: register policy-request-scope.ts in the exact Responses owner inventory; anchor shadow combo option inspection at the actual dispatcher call and assert valid ordered slice boundaries. Existing graph equality, size/cycle constraints and isolation marker assertions remain intact. No runtime, policy membership, attempt budget or role behavior changed.
Both exact CI assertions failed before the test-only corrections. The two complete fixture files and affected source-inventory consumers then passed 53 tests with 511 assertions. Runtime, policy eligibility and attempt budgets are unchanged.
Executed focused commands:
bun test ./tests/responses/responses-core-modules.test.ts ./tests/responses/responses-shadow-intercept.test.ts— passed.bun test ./tests/lab/lab-passive-production-evidence.test.ts ./tests/lib/reasoning-replay-scope-source.test.ts ./tests/oauth/generic-oauth-failover.test.ts ./tests/server/passive-route-linker.test.ts -t 'production request path only links|reasoning replay scope propagation|sidecar on429 wiring|Responses owners do not import'— passed.Required typecheck, structure, privacy and file-size checks passed. Full local suite and unfiltered
test:changedwere not run; the documented focused/resource exception and remaining coverage limitations remain in effect. No blocked broad Kiro/SOCKS transport test or real-provider validation is claimed.Cross-platform CI succeeded for this exact HEAD. Checkout
ea3280ca8b909d365e87bde6e9a833b93330edbfand the PR HEAD share tree9b30ee9971a91cd796bf53f1a0b428dfad103d17. Skipped jobs remain skipped.Independent maintainer approval, explicit security review and any required sponsorship remain pending before merge.
Earlier integration evidence
Current upstream integration:
a6114b62ed1b65dede802359ccd373d913979b24; published HEAD2acbf20e48d6ab6356639bcb03dd7faeb290afae. The source history through2c34217881b072ba618595d1ca57a16e56f814c5is retained without rewriting authors or commits. The PR-specific change was checked again after this integration; typecheck, structure, privacy and file-size gates passed. CI was pending when this earlier integration checkpoint was published; the current follow-up is verified above.Windows, Bun 1.4.0, isolated test temporary directory:
bun test ./tests/routing/routing-policy-dispatch-scope.test.ts ./tests/routing/routing-policy-fallback.test.ts ./tests/routing/policy-execution.test.ts ./tests/routing/router-blocked-cross-provider.test.ts ./tests/responses/responses-compaction-recovery-policy.test.ts: 83 passed, 0 failed, 363 assertions. The accounting regression failed before the fix and passed afterward.bun test ./tests/claude-integration/claude-native-affinity.test.ts ./tests/server/spend-instrumentation-log.test.ts ./tests/responses/responses-spend-ledger-wiring.test.ts: 26 passed, 0 failed, 168 assertions. The previous fixture failed with an undeclared candidate; the corrected real policy preserves the original isolation assertions.bun test ./tests/providers/opencode-go-session-header.test.ts -t "affinity across the policy fallback retry": 3 passed, 0 failed, 12 assertions for the additional bot fixture change.bun node_modules/typescript/bin/tsc --noEmit: passed, including after bot integration.bun scripts/structure-ssot.ts: passed; bot integration changed no structure source or documentation.bun scripts/privacy-scan.ts: passed, including after bot integration.bun scripts/file-size-ratchet.ts: passed; the bot integration adds only one fixture line to the previously checked tree.git diff --cached --check 0328373fb88fe0d019b29ae278e153d7fed4bcc7and the final staged diff check: passed.The full local suite and
test:changedwere not run under the focused-validation exception because concurrent isolated worktrees made the full suite impractical. These tests use synthetic dispatch and do not verify a real provider connection. Documentation-site build verification remains incomplete: the available local build and its baseline comparison both fail while loading Astro withrequire is not definedin the dependency/module loader. This is not a successful documentation build, and no separate successful build is claimed for this change.Required upstream CI on the final published HEAD is pending; results from another HEAD are not its verification. Applicable documentation CI and independent authorization/accounting review remain required before merge.
Checklist
05bc47d728dd791ffe796c2356d74d266e752bae, known correct findings are addressed, and exact-HEAD CI is complete; author review readiness is confirmed.Independent maintainer approval, explicit security review, and any required
maintainer-sponsoreddecision remain pending before merge. These are separate from author review readiness; no approval or sponsorship is claimed.