Repository navigation
fix(noema): refresh reviewer App token before publication - #1616
Merged
Merged
Conversation
Loading
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RCA
Closes #1614.
ContextualWisdomLab/naruon#1497@152d1998c4e8024be9dc7026c8789d343c884fd0ran the trusted central Noema workflow source5686de41660d51a7a7f22b8840dfa6ccfe5ff3f1. The workflow minted the repository-scopedcwl-noema-reviewGitHub App installation token around 10:44:52Z, then spent more than an hour in contextual-orchestrator-backed model review. At 12:01:43Z the next GitHub operation failedgh: Bad credentials (HTTP 401); post-job cleanup independently reportedToken expired, skipping token revocation. Repository-owned deterministic CI/security checks on the same Naruon head were otherwise successful. This is a central reviewer credential-lifetime defect, not a Naruon product failure.Current protected
main@7ffb7715bd0caac4a931785262f3a265935531ecstill mints only one App token before model work and runs model review plus exact-head re-fetch/publication in one Python invocation, so the causal boundary remains present.Test-first state
Commit
8edf9a7c0da809bfc27ff73ade0892e746ccaffaadds a deterministic RED workflow contract. It requires the trusted Noema path to separate model verdict preparation from publication, mint a second repository-scoped least-privilege App token after model work, re-bind publication to the same exact head, and keep model routing oncontextual-orchestratormodelorchestrator/free.Required repair
Implement the smallest production change that turns this contract GREEN while preserving fail-closed semantics. Prefer an action-backed post-model App-token remint rather than broad/long-lived credentials. A refreshed credential must not transfer predecessor evidence: publication must independently re-fetch the live PR and reject a moved/closed head before submitting a review. Do not weaken review, security, coverage, provenance, or exact-head gates. Keep PAT/OIDC compatibility explicitly fail-closed; do not silently substitute author or
GITHUB_TOKENreview authority.Also record the RCA, affected consumer, fix, verification, and any remaining blocker in
docs/product-technical-gap-baseline.mdplus relevant CHANGELOG/doctoring documentation when present.Verification target
After the branch is GREEN, rerun Required Noema Review on unchanged
naruon#1497@152d1998c4e8024be9dc7026c8789d343c884fd0and verify its exact-head check completes with a current-head schema-valid review or a typed review-unavailable result, never opaque expired-token 401 and never stale-head publication.