Dark-Alex-17
4555af8299
verdict_gate.py: the code-review critical count is read from render.py's deterministic summary line (full-shape regex, LAST match wins — a 🔴 quoted inside a finding body or Changes-table row is not a finding); the raw 🔴 count remains the fail-closed fallback when the line is absent. A code-review lane whose own rendered verdict line records a pipeline fault (degraded nested run) now BLOCKS instead of passing as GREEN (attention), and fault + reds append both blockers. A non-string lane result item is BLOCKED as malformed, never routed to GREEN. default_lanes.py: the crash handler now emits the WIDEST safe selection (code-review ∪ adversary ∪ security) and records a PIPELINE-FAULT in signals_error so the gate blocks — previously it repaired malformed state into a NARROWER passable selection with no fault. Probe is added only when consumer_surface AND a probe_context (local-run recipe) are present, mirroring build_items' guard, so degraded selection cannot spawn an INCONCLUSIVE-by-construction probe. graph.yaml: re-derive the timeout envelope. Agent-node retries each get a fresh per-attempt budget (agent.rs retry_transient/bounded_attempt) and the child's "Graph … timed out" matches the transient anchor, so lanes exceed their child graph's settings.timeout (code-review 11400 > 10800, adversary 9600 > 9000) and the gauntlet's own timeout covers max_attempts × lane timeout + margin (2 × 11400 + 1200 = 24000). The child graphs' internal retry envelopes are deliberately not derived here (tracked as a follow-up). README/descriptions updated and pinned. Tests: summary-count/quoted-🔴/fallback/last-match/nested-fault/both- blockers/malformed-lane, crash-widens-and-records-fault, probe guard, ALIASES parity with build_items, and e2e render.py → verdict_gate runs.
106 lines
3.9 KiB
Python
106 lines
3.9 KiB
Python
#!/usr/bin/env python3
|
||
"""Deterministic lane-selection fallback for the review gauntlet.
|
||
|
||
Reached ONLY via select_lanes' `fallback:` route, when the additive LLM
|
||
judgment dies after retries. Emits `forced_lanes` — code-review + adversary,
|
||
plus probe when the deterministic signals flagged a consumer-facing surface
|
||
AND a local-run recipe exists (build_items gates probe the same way — a
|
||
probe without a recipe is INCONCLUSIVE by construction),
|
||
plus security when the attack-surface signals (auth/deps/exec) or a hardened
|
||
posture demand it, unioned with any lanes the caller forced (canonicalized
|
||
with the same aliases build_items uses) — which build_items honors exactly,
|
||
so selection degrades WIDER, never narrower. The degradation note goes into
|
||
`lanes_degraded`; build_items folds it into lanes_summary so the final
|
||
report names the degradation.
|
||
|
||
Fail-closed: if the fallback itself crashes it emits the widest safe
|
||
selection (defaults ∪ security) plus a PIPELINE-FAULT in signals_error so
|
||
verdict_gate blocks — a crashed fallback never narrows selection silently.
|
||
"""
|
||
|
||
import json
|
||
import os
|
||
|
||
MAX_DETAIL_CHARS = 500
|
||
|
||
# Keep in sync with build_items.ALIASES — a caller-forced lane must
|
||
# canonicalize the same way here as it would on the non-degraded path.
|
||
ALIASES = {
|
||
"code-review": "code-review",
|
||
"code_review": "code-review",
|
||
"code-reviewer": "code-review",
|
||
"adversary": "adversary",
|
||
"adversarial": "adversary",
|
||
"adversarial-review": "adversary",
|
||
"security": "security",
|
||
"security-review": "security",
|
||
"security-reviewer": "security",
|
||
"probe": "probe",
|
||
"usage": "probe",
|
||
"usage-pattern": "probe",
|
||
"usage-pattern-testing": "probe",
|
||
}
|
||
|
||
# Stable emission order keeps the fallback deterministic.
|
||
LANE_ORDER = ["code-review", "adversary", "security", "probe"]
|
||
|
||
|
||
def load_state():
|
||
if path := os.environ.get("GRAPH_STATE_FILE"):
|
||
with open(path) as f:
|
||
return json.load(f)
|
||
return json.loads(os.environ.get("GRAPH_STATE", "{}"))
|
||
|
||
|
||
def main():
|
||
state = load_state()
|
||
lanes = {"code-review", "adversary"}
|
||
probe_context = state.get("probe_context")
|
||
if (
|
||
state.get("consumer_surface")
|
||
and isinstance(probe_context, str)
|
||
and probe_context.strip()
|
||
):
|
||
lanes.add("probe")
|
||
# The deterministic security signals are already in state when this
|
||
# fallback runs; a degraded selection must never drop the security lane
|
||
# build_items' hard rules would have selected.
|
||
if (
|
||
state.get("touches_auth")
|
||
or state.get("touches_deps")
|
||
or state.get("touches_exec")
|
||
or state.get("security_posture") == "hardened"
|
||
):
|
||
lanes.add("security")
|
||
# Caller-forced lanes survive degradation — union, never overwrite.
|
||
for lane in state.get("forced_lanes") or []:
|
||
if canon := ALIASES.get(str(lane).strip().lower()):
|
||
lanes.add(canon)
|
||
forced = [lane for lane in LANE_ORDER if lane in lanes]
|
||
raw = state.get("select_lanes_failure")
|
||
detail = raw.strip().replace("\n", " ") if isinstance(raw, str) else ""
|
||
if len(detail) > MAX_DETAIL_CHARS:
|
||
detail = detail[: MAX_DETAIL_CHARS - 1] + "…"
|
||
note = "lane selection degraded to deterministic defaults"
|
||
if detail:
|
||
note += f" — {detail}"
|
||
print(json.dumps({"forced_lanes": forced, "lanes_degraded": note}))
|
||
|
||
|
||
try:
|
||
main()
|
||
except Exception as e: # noqa: BLE001 — the fallback itself must never crash
|
||
print(
|
||
json.dumps(
|
||
{
|
||
"forced_lanes": ["code-review", "adversary", "security"],
|
||
"lanes_degraded": "lane selection degraded to deterministic "
|
||
f"defaults (fallback script error: {e})",
|
||
"signals_error": (
|
||
f"PIPELINE-FAULT: lane-selection fallback crashed — {e}; "
|
||
"lanes widened to defaults ∪ security"
|
||
),
|
||
}
|
||
)
|
||
)
|