Skip to content

feat(review): guard-review waive — decoy-minting waives with rationale capture - #302

Merged
norvalbv merged 1 commit into
mainfrom
bench/waive-command
Aug 2, 2026
Merged

feat(review): guard-review waive — decoy-minting waives with rationale capture#302
norvalbv merged 1 commit into
mainfrom
bench/waive-command

Conversation

@norvalbv

@norvalbv norvalbv commented Aug 1, 2026

Copy link
Copy Markdown
Owner

Capture point 2 of the corpus-growth charter (docs/benchmarks/corpus-growth.md) — the loop's decoy mint, fully CodeRabbit-independent.

guard-review waive <reviewer>[:<lens>] <fingerprint> "<rationale>" records a persistent, audited waive; --list shows active ones. The fingerprint printed in FAIL output is the item id, so the gate needed zero consumption changes — reconcile() picks the entry up on the next run. Rationale is required (≥15 chars, placeholders refused): a waive without a reason is a bypass, not a label.

Telemetry: a fired waive's lens item carries disposition: 'waived' + the rationale (capped 500 chars in the event, full text in the store) — that pair is the decoy-minting signal the benchmark loop consumes.

Concurrency hardening — every finding below was caught by the commit gate's own correctness reviewer across three rounds, none waived:

  1. CLI writer had an unlocked read-modify-write (two concurrent waives lose one) → shared withOverridesLock.
  2. My first lock's stale-steal had a TOCTOU (two stealers both unlink+recreate → dual holders) → atomic rename-to-unique steal.
  3. reconcile()'s env write-through also raced the CLI → the lock moved into overrides.mts and now guards every writer of the store; env writes merge onto existing entries instead of clobbering CLI audit fields.

Scope guard: cascade reviewers are refused (the valve only governs the model-pinned single-pass reviewers; loosening that is a separate decision). Lives in gate-engine/review/valve/ (review root was at the 12-file fan-out cap; overrides.mts joins it when run-review.mts next changes substantively — moving it now would drift the published implementation hash over an import line).

465 tests green; tsc/biome clean.

🤖 Generated with Claude Code

…e capture

Capture point 2 of the corpus-growth charter (docs/benchmarks/corpus-growth.md):
guard-review waive <reviewer>[:<lens>] <fingerprint> "<rationale>" records a
persistent waive into .devkit/correctness-overrides.json with a durable audit
trail ({reviewer, lens, itemId, rationale, author, at, by:'cli'}); --list shows
active waives. Rationale is required (>=15 chars, placeholders refused) — a
waive without a reason is a bypass, not a label.

- The fingerprint printed in FAIL output IS the item id — zero gate-side
  consumption changes; reconcile()/applyOverrideValve pick the entry up on the
  next run. Cascade reviewers are refused (the valve only governs the pinned
  single-pass reviewers; loosening that is a separate decision).
- Telemetry: a fired waive's lens item now carries disposition 'waived' AND the
  rationale (capped 500 chars in the event; full text stays in the file) — the
  decoy-minting signal the benchmark loop consumes.
- Concurrency (all reviewer-caught across three gate rounds): every writer of
  the store — reconcile()'s env write-through AND the waive CLI — now runs
  inside a shared withOverridesLock (cross-process wx lockfile; in-process
  overlap impossible since both RMWs are synchronous); the stale-lock steal is
  atomic via rename-to-unique; env-channel writes merge onto existing entries
  instead of clobbering CLI audit fields.
- FAIL-output hint names the command beside the OVERRIDE_ env line.
- Lives in gate-engine/review/valve/ (root folder was at the 12-file fan-out
  cap; overrides.mts joins valve/ when run-review.mts next changes for
  substantive reasons).

465 tests green; tsc/biome clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

@norvalbv, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 51 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: cf0def54-fc35-4259-8209-9ac71e048df7

📥 Commits

Reviewing files that changed from the base of the PR and between 38c4b91 and 912d093.

📒 Files selected for processing (8)
  • gate-engine/review/__tests__/overrides.test.mts
  • gate-engine/review/__tests__/run-review.test.mts
  • gate-engine/review/__tests__/waive.test.mts
  • gate-engine/review/cli.mts
  • gate-engine/review/evidence/items.mts
  • gate-engine/review/overrides.mts
  • gate-engine/review/runtime.mts
  • gate-engine/review/valve/waive.mts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@norvalbv
norvalbv merged commit 41348e6 into main Aug 2, 2026
1 of 2 checks passed
norvalbv added a commit that referenced this pull request Aug 2, 2026
…clone-gate ruling (#310)

benchmarks-grow-from-telemetry gains its convergence record before the release
that ships it: capture loop closed end-to-end (#295/#302/#303/#309, first 8
pure-telemetry rows, corpus 128), label-trust precondition met (#304: κ 0.735
post-triage, 4.2% noise floor; cleanlab floor still pending bench pred_probs),
and the Target's c-CRAB/CR-Bench known-answer path recorded as falsified
(#307) with the replacement candidates awaiting ratification.

New axis clone-gate-non-import-code ([VALIDATED]): clones are measured over
non-import code, excluded at the jscpd tokenizer — with the six-hole failure
of post-hoc fragment classification recorded as the rejected road so a future
simplifier can't silently re-vacuous the gate (#305/#308).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant