vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: harden the review classifier's real reviews

Browse source 
Follow-ups from the review of #5142.

A `Done` answer with fewer or more rows than the classifications sent, or
none, now posts the no-verdict comment instead of the classifier's overall
verdict, so a short answer can't approve.

Requests are accepted per repo, PR and head into a set bounded at the two
running plus eight waiting. A request for a key already running or waiting
starts nothing and logs at info; a request with every place taken starts no
run and posts a no-verdict comment saying so. Before, every delivery spawned
a task waiting on the semaphore, so toggling the review request queued one
paid run per toggle.

Table cells get a zero-width space after `#`, `!`, `://` and `www.`, so a
model's reason can't render an issue or PR reference or a bare URL as a link.

The secret publisher's policy denies the classifier's forge token leaf, the
way #5139 denied Grafana's admin password, with a module-eval-bao-grants arm
pinning it. The controller posts reviews with whatever token is there, so a
publisher write picked the account reviews come from.

Closes #5143, part of #5096.
This commit is contained in:
atlas 2026-10-12 17:33:45 +02:00 • committed by mara
commit 60ea7fdc04
10 changed files with 447 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/swarm/review-classifier.md
View file

@ -96,8 +96,11 @@ the earlier one. A repo whose branch protection also dismisses stale approvals (
[PR review gate](../process/pr-review-gate.md)) stops counting an approval
on an older commit even without a re-request.
At most two requested reviews run at once. More wait in the controller's
memory, so a controller restart drops them, and nothing gets posted for them.
At most two requested reviews run at once, and up to eight more wait in the
controller's memory, so a controller restart drops them, and nothing gets
posted for them. A request for a PR and head that's already running or
waiting starts nothing. A request with all ten places taken starts no run:
the account posts a `**No verdict:**` comment saying so.
## Components
@ -241,16 +244,18 @@ Repos that rely on it typically raise their required approval count to
account for it.
A run with no clean verdict never approves. When the PR or the rules don't
load, the run fails, or **any** classification has no answer, the account
posts a **comment** instead, starting with `**No verdict:**` and the reason,
load, the run fails, the classifier answers a different number of
classifications than the controller sent it, or **any** classification has no answer,
the account posts a **comment** instead, starting with `**No verdict:**` and the reason,
followed by the table when there is one. A comment neither approves nor
blocks the merge: nine timeouts and one pass post a comment, not an
approval.
The controller flattens every cell to one line, with `|`, backticks, brackets, `<`, `>`,
`&`, `#` and other markup characters escaped, and a zero-width space after
each `@`, so a model's `reason` can't break the table, embed markup, or
mention anyone.
each `@`, `#`, `!`, `://` and `www.`, so a model's `reason` can't break the
table, embed markup, mention anyone, reference an issue or PR, or carry a
link.
## Runtimes