…ability (#65178) The Codex GitHub Actions review pipeline needed stronger guarantees that agents review the intended PR snapshot, use one authoritative diff, pursue high-risk cross-module mechanisms, and expose the work of spawned subagents in Litefuse. This PR: - verifies the checked-out PR head and rechecks the live base/head after context preparation; - prepares an authoritative aggregate PR patch and changed-file list, with atomic bounded retry (`2s`, `4s`, `8s`) for transient GitHub API failures; - directs the main agent to perform an initial risk scan, dispatch focused subagents for suspicious mechanisms, maintain a shared append-only ledger, validate/deduplicate every candidate, and converge for at most three rounds; - requires paths outside the authoritative diff/changed-file context to be confirmed with `rg --files` before reading; - records separate Litefuse traces for each Codex subagent session, including command/tool I/O and non-empty encrypted-reasoning status, instead of mixing subagent activity into the main trace; - makes Litefuse ingestion more resilient to transport timeouts while keeping telemetry upload non-blocking for the review outcome. The repository review skill is kept focused on review invariants; orchestration and completion policy live in the workflow prompt, where they are available to the GitHub Actions invocation. ### Validation and experiment material - Static checks: `python3 -m py_compile .github/scripts/emit_litefuse_otel_io.py` and `git diff --check`. - Litefuse uploader validation: real/synthetic subagent session conversion, payload-limit coverage, and readback of independent subagent traces. - End-to-end replayed review experiments against fresh fork PRs built from the original PR base/head commits: | Replay PR | GitHub Actions run | Result | | --- | --- | --- | | [#136](zclllyybb#136) | [29112823062](https://github.com/zclllyybb/doris/actions/runs/29112823062) | Success; 2 inline comments | | [#137](zclllyybb#137) | [29114260631](https://github.com/zclllyybb/doris/actions/runs/29114260631) | Success; 3 inline comments | | [#138](zclllyybb#138) | [29115946034](https://github.com/zclllyybb/doris/actions/runs/29115946034) | Success; 1 inline comment | | [#139](zclllyybb#139) | [29150372758](https://github.com/zclllyybb/doris/actions/runs/29150372758) | Success; 1 inline comment | | [#140](zclllyybb#140) | [29151057520](https://github.com/zclllyybb/doris/actions/runs/29151057520) | Success; 1 inline comment | The latest replay trace, `86be226391a40e5992bb8d3b4e125eca`, confirms one authoritative `pr.diff` read, two changed-file-list reads, no `gh pr diff` or `git diff` calls from the reviewing agent, and separate subagent sessions. It also exposed one remaining prompt-compliance gap: a guessed adjacent `.cpp` path was read without a preceding `rg --files` lookup; this is documented test evidence rather than hidden by the validation.

Uh oh!

sudo: updatedb：找不到命令 #139

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions