Repository navigation
fix(review): harden cross-language offline coverage sandbox #686
Description
Problem
The central OpenCode coverage sandbox can reject repository-native green pull requests for infrastructure-only reasons:
- Git ownership isolation can make the copied source tree unsafe to Git.
- JavaScript coverage may need a trusted base lock that is not already materialized in the fixed image, while network access is intentionally unavailable.
- R testthat collection can fail only because the package under test or a declared
Suggestshelper is absent from the central image, even when the exact-head repository-native R CMD check succeeds.
Observed blockers include ContextualWisdomLab/scopeweave#386 and ContextualWisdomLab/aFIPC#193.
Acceptance criteria
- Scope Git safe-directory configuration to the unprivileged sandbox user without weakening host/global Git policy.
- Prefetch trusted base JavaScript locks and permit only hash-bounded lock transitions before offline install; reject symlink, traversal, hook, integrity, or undeclared transition paths fail closed.
- Defer R package-not-found failures only for the package under test or strictly parsed base
Suggests, using a root-owned immutable DESCRIPTION snapshot and exact-head successful R CMD check evidence. - Preserve offline execution, unprivileged sandboxing, current-head provenance, and required repository-native checks.
- Keep the full central Python suite, line coverage, docstring coverage, Actionlint, Ruff, and shell syntax gates green.
- Redispatch the affected pull requests and confirm the central coverage result on their exact current heads.
Phase: Ops
Component: dot-github
Agent: Codex
Started: 2026-08-01T06:20:00+09:00
Activity
seonghobae commentedon Sep 3, 2026
Fresh aFIPC canary for the same central R coverage-evidence class:
ContextualWisdomLab/aFIPC#169current exact head:5fa554962b87c284977ed849758a988ee4303b92.32079858918, Security Audit32079858858, Code Quality32079858861, Security Scan32079859169, SAST32079858867.CHANGES_REQUESTEDon that same head becausecoverage-evidencefailed in run32122434624; the review explicitly reports that test/docstring evidence was not proven.Do not repair this by changing
aFIPCproduction source, fabricating approval, or accepting the native R CMD result as a silent substitute for central evidence. This is owner-path evidence for the bounded R-package peer/deferral contract tracked here.GREEN acceptance for this canary: after the central fix reaches protected
.githubsource, redispatch review for unchangedaFIPC#169@5fa5549...; central coverage must either execute the supported R evidence successfully or take the explicitly bounded R-package deferral path backed by exact-head successful R CMD check, then produce a new current-head review verdict. Missing/unsupported dependencies, stale/predecessor checks, or unrelated R failures remain fail-closed.