Skip to content

feat: implement issue #2046 — dev-lead: unprocessed bot review threads are never retried — review-thread counterpart of #2017 - #2048

Merged
don-petry merged 27 commits into
mainfrom
dev-lead/issue-2046-20261003-1350
Oct 9, 2026
Merged

don-petry merged 27 commits into
mainfrom
dev-lead/issue-2046-20261003-1350

Conversation

@don-petry

@don-petry don-petry commented Oct 3, 2026 •

Copy link
Copy Markdown
Collaborator

Problem

dev-lead: unprocessed bot review threads are never retried — review-thread counterpart of #2017

From the issue: Bot review threads that dev-lead never processes are never retried. They sit with no reply and no resolution, and under required_review_thread_resolution the PR cannot merge. This is the review-thread counterpart of #2017, whose fix (#2022) covers only undispositioned PR issue comments.

Risk

Low — changes automation shell logic under scripts/, covered by shellcheck (--severity=warning) and the bats suite.

Test plan

Tests added/updated: tests/dev-lead/integration/test_prompt_coverage.sh,tests/dev-lead/unit/test_bot_thread_retry.bats. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the bats suite runs in CI.

Rollback

Revert this PR. No non-revertible side effects (no tags, migrations, or external state).

Monitoring

This PR's Lint (shellcheck) and bats checks show pass/fail; watch subsequent dev-lead / pr-review runs for behavioral regressions.

Closes #2046

Review in cubic

…s are never retried — review-thread counterpart of #2017
@qodo-code-review

Copy link
Copy Markdown

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

@coderabbitai

coderabbitai Bot commented Oct 3, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 14 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 240d57cc-1e92-40ad-9ef0-b359efc1598f
📥 Commits

Reviewing files that changed from the base of the PR and between 3679e0e and 1fdbaef.

📒 Files selected for processing (8)
  • .github/workflows/lint.yml
  • scripts/dev-lead-fix-reviews.sh
  • scripts/dev-lead-retry.sh
  • scripts/lib/bot-comment-retry.sh
  • scripts/lib/bot-thread-retry.sh
  • scripts/review-one-pr.sh
  • tests/dev-lead/integration/test_prompt_coverage.sh
  • tests/dev-lead/unit/test_bot_thread_retry.bats
📝 Summary

Summary by CodeRabbit

  • New Features
    • Eligible bot review threads without an automation reply can trigger a deduplicated review retry. Retry limits, waiting periods, and active holds are respected, with a notice when retries are exhausted.
  • Bug Fixes
    • Review scans now check unresolved threads across all pages and reviewers, so eligible feedback is less likely to be missed. Scans stop with an error rather than proceeding with incomplete results.
    • Bot comment retries pause while a review-thread retry is pending, preventing competing retries.
  • Tests
    • Added coverage for retry decisions, pagination, retry limits, and failure handling.

Walkthrough

The PR adds retries for unresolved, unreplied trusted-bot review threads. It also replaces single-page review-thread queries with paginated enumeration and adds coverage for the retry and enumeration paths.

Changes

Bot review-thread handling

Layer / File(s) Summary
Paginated unresolved-thread enumeration
scripts/lib/open-review-threads.sh, scripts/dev-lead-fix-reviews.sh, tests/dev-lead/unit/test_bot_thread_retry.bats, tests/dev-lead/unit/test_fix_reviews.bats, tests/dev-lead/integration/test_prompt_coverage.sh, .github/workflows/lint.yml
The shared helper paginates unresolved review threads. Both fix-reviews and review-changes use it and exit with an error when fetching fails. Tests cover multiple pages and reviewers, query coverage, and fetch errors. The lint workflow runs the new test file.
Thread retry decisions and markers
scripts/lib/bot-thread-retry.sh, tests/dev-lead/unit/test_bot_thread_retry.bats
The library fetches thread pages and evaluates retry eligibility, holds, attempt limits, and exhaustion. It also formats retry and exhaustion markers. Tests cover decision rules and invalid inputs.
Retry scan and dispatch
scripts/dev-lead-retry.sh, scripts/lib/bot-comment-retry.sh, scripts/review-one-pr.sh, tests/dev-lead/unit/test_bot_thread_retry.bats
The scan checks PR eligibility, posts retry or exhaustion markers, and dispatches at most one fix-reviews retry. It runs only when earlier retry scans dispatch nothing. The PR hook scans for unreplied bot threads when no undispositioned bot comments are found. Bot-comment claims also check pending thread-retry markers. Tests cover scan gating, deduplication, dispatch, and exhaustion.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Feature · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant ScanRepo as scan_repo
  participant RetryScan as scan_pr_for_unreplied_bot_threads
  participant ThreadFetcher as btr_fetch_pr_threads
  participant GitHub as GitHub API
  participant Decisions as btr_retry_decisions
  participant FixReviews as fix-reviews dispatch
  ScanRepo->>RetryScan: scan when earlier retry paths dispatched nothing
  RetryScan->>ThreadFetcher: fetch PR review threads
  ThreadFetcher->>GitHub: paginate review-thread queries
  GitHub-->>ThreadFetcher: thread pages
  ThreadFetcher-->>RetryScan: complete thread snapshot
  RetryScan->>Decisions: evaluate threads and comments
  Decisions-->>RetryScan: eligible thread IDs and attempt
  RetryScan->>FixReviews: dispatch after marker claim
Loading

Merge Risk

Merge Risk: 🔵 Low · up to 3679e

A non-progressing review-thread response could delay retries for other PRs. Add a cursor-progress check before merging, or accept this bounded operational risk.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to a9632

Ownership and trusted-bot checks constrain the new retry path, but automated repairs can receive incomplete reviewer context, and a failed coordination read can allow competing retries to replace queued work. These risks are bounded by existing write and execution safeguards; no privilege escalation was established.

Retained concerns

  • Medium · security · inferred: The new shared enumeration contract promises a complete snapshot or failure, but size handling truncates bodies and, above its threshold, silently discards all replies after each thread’s first comment. Both repair paths consume that result as successful context. Reviewer corrections or restrictions can therefore disappear before write-capable automation acts. Existing push and resolution guards limit consequences but do not restore the omitted context.
  • Medium · reliability · inferred: The new bot-comment check for competing thread reservations converts API or parsing failure into an empty result and can proceed to dispatch. If a thread reservation appears after the initial eligibility snapshot, unreadable coordination state can permit competing work in the shared PR lane. Execution serialization protects an active run, but a newer dispatch can supersede pending review remediation. The thread-retry path correctly withdraws on an equivalent API failure.

Security review details

Security Blast Radius

  • inferred — The demonstrated new exposure is review-triggered repair work on eligible dev-lead-owned, same-repository PRs. Downstream repairs inherit existing branch/comment write capability and configured automation credentials. Repository and environment breadth depends on deployed credential scope, which was not supplied; cross-tenant or data-store compromise was not established.

Security Findings and Attack Paths

  • inferred — A reviewer able to contribute substantial thread content can reach the helper’s lossy snapshot branch. Later corrections or constraints may then be absent from the context used for automated edits. This is an input-integrity concern, not a verified credential-exfiltration or privilege-escalation path; downstream write guards remain operative.

Trust Boundaries and Controls

  • observed — Pasted marker text alone does not confer coordination authority: issue-comment markers are filtered by configured automation login and OWNER, MEMBER, or COLLABORATOR association. Thread trigger identity additionally requires the GitHub Bot type. The retry-specific paginator rejects API errors and malformed pagination without returning accumulated partial results.

Resilience and Maintainability Implications

  • inferred — Attempt limits, pending windows, trusted reservations, and per-PR serialization contain retry amplification. They do not make reservation and dispatch atomic. The asymmetric failure handling in the new sibling check weakens recovery coordination, while snapshot loss or oversized exports can obstruct review remediation without granting additional authority.

Hardening Proposals

  • proposed — Preserve the complete-or-fail review-context contract by using a bounded file-backed snapshot or explicitly fetching continuation context instead of silently removing replies. Make unreadable sibling-reservation state withdraw the claim consistently across both retry flows.
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 61.54% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 39 functions across 9 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the main change: retrying unprocessed bot review threads. It is longer than needed, but it is specific and relevant.
Description check ✅ Passed The description covers all five required sections: Problem, Risk, Test plan, Rollback, and Monitoring. It omits the conditional Interaction contract section and the Checklist section, although this PR…
Linked Issues check ✅ Passed [#2046] scripts/lib/bot-thread-retry.sh selects unresolved, non-outdated threads opened by trusted Bot reviewers, excludes threads with an automation reply, applies the grace period and retry limits…
Out of Scope Changes check ✅ Passed The paginated thread helper, fix-reviews wiring, retry-claim coordination in scripts/lib/bot-comment-retry.sh, workflow test registration, and bats updates support [#2046]. No unrelated change is ev…
✨ Finishing Touches 💡 1
⚔️ Resolve merge conflicts 💡
  • Resolve merge conflict in branch dev-lead/issue-2046-20261003-1350
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #2048
No changes were committed, but the PR still can't be marked done: required checks SonarCloud, agent-shield / AgentShield, dependency-audit / Detect ecosystems are still pending. The retry cron will re-attempt automatically. Next attempt after: 2026-10-03T14:37:15Z

@don-petry

Copy link
Copy Markdown
Collaborator Author

Note

@don-petry I reviewed this PR and no code changes were needed, but I can't mark it done yet: required checks SonarCloud, agent-shield / AgentShield, dependency-audit / Detect ecosystems are still pending. I'll re-check automatically.
Next attempt after: 2026-10-03T14:37:15Z

@don-petry
don-petry enabled auto-merge (squash) October 3, 2026 14:07
@don-petry

Copy link
Copy Markdown
Collaborator Author

No description provided.

Comment thread scripts/dev-lead-fix-reviews.sh Outdated
Comment thread scripts/review-one-pr.sh
@donpetry-bot

Copy link
Copy Markdown
Contributor

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-03T15:08:45Z.

Comment thread scripts/dev-lead-retry.sh Outdated
Comment thread scripts/lib/open-review-threads.sh Outdated
Comment thread scripts/lib/open-review-threads.sh Outdated

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request implements a mechanism to automatically retry lost "fix-reviews" passes for unreplied trusted-bot review threads, introducing paginated thread fetching and deduplicated retry logic. Feedback on the changes highlights an issue in the integration tests where guarding "grep -c" with "|| echo 0" causes duplicate output on no matches, and recommends using "|| true" instead. Additionally, for security-sensitive login comparisons in "jq" scripts, it is advised to use explicit string slicing instead of regex replacements and to pass variables as arguments rather than using direct string interpolation.

Comment thread tests/dev-lead/integration/test_prompt_coverage.sh Outdated
Comment thread scripts/dev-lead-retry.sh
Comment thread scripts/dev-lead-retry.sh
@don-petry
don-petry disabled auto-merge October 3, 2026 14:10
@don-petry

Copy link
Copy Markdown
Collaborator Author

Qodo trial-ended notice: acknowledged, no action needed in this PR.

@don-petry

This comment has been minimized.

@don-petry

Copy link
Copy Markdown
Collaborator Author

SonarCloud Quality Gate passed: informational, no action needed.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Dev-Lead — fix-reviews (partial)

A commit was pushed, but not every requested change was applied. Per requested item:

  • scripts/dev-lead-fix-reviews.sh:2586 — not applied
  • scripts/review-one-pr.sh:511 — not applied
  • scripts/dev-lead-retry.sh:876 — not applied
  • scripts/lib/open-review-threads.sh:31 — not applied
  • scripts/lib/open-review-threads.sh:37 — not applied
  • tests/dev-lead/integration/test_prompt_coverage.sh:124 — applied
  • scripts/dev-lead-retry.sh:915 — not applied
  • scripts/dev-lead-retry.sh:920 — not applied

The unaddressed items above still need work.

@don-petry
don-petry enabled auto-merge (squash) October 3, 2026 14:11
@donpetry-bot

donpetry-bot commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor
Superseded by automated re-review at fc27b279389d98e308263b05821bb3de365f065b — click to expand prior review.

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: b0f4d6521598e6a7a3d0a55194930bad7aad403d
Review mode: triage-approved (single reviewer)

Summary

Adds a cron/gate-hook retry for trusted-bot review threads that never got a dev-lead reply (#2046) and paginates OPEN_THREADS_JSON. The design is sound and the dedup and fail-closed paths are well covered, but one jq scoping bug breaks the exhaustion-notice dedup. Unit tests are still running and 7 bot review threads are unresolved.

Linked issue analysis

Closes #2046, the review-thread counterpart of #2017/#2022. The PR covers the issue's root causes:

  • Single-page thread query: lib/open-review-threads.sh now pages through every thread, and both fix-reviews and review-changes builds use it.
  • Lost fix-reviews pass: scan_pr_for_unreplied_bot_threads plus the pure btr_retry_decisions dispatch a deduplicated retry, from the dev-lead-retry cron and from pr-review's gate hook.
  • Silent stall after retries run out: a one-time exhaustion notice. This part is broken for every thread after the first one on a PR (see finding 1).

Findings

1. [MEDIUM · correctness · blocking] Exhaustion-notice dedup is wrong once any notice exists. scripts/lib/bot-thread-retry.sh, last line of the btr_retry_decisions jq program:

.exhausted_unnoticed = [ .exhausted[] | select(($noticed | index(.)) == null) ]

Inside $noticed | index(.), the argument . is evaluated against the pipe input, which is $noticed itself, not the exhausted id. So whenever $noticed is non-empty, index finds the array inside itself at position 0, and every newly exhausted thread counts as already noticed. I checked this with jq 1.7:

  • ["a"] as $noticed | {exhausted:["b"]} | [.exhausted[] | select(($noticed|index(.))==null)] returns []. Expected ["b"].

Effect: after the first exhaustion notice on a PR, any thread that runs out of retries later never gets a notice. The sweep also stops retrying it. That is the silent merge stall this PR is meant to prevent. The bats suite only tests re-noticing the same thread (PRRT_cubic), so the bug isn't caught.

Fix: bind the element first, e.g. [ .exhausted[] as $e | select(($noticed | index($e)) == null) | $e ], or simply (.exhausted - $noticed). Add a test where thread A has already been noticed and thread B is newly exhausted, expecting exhausted_unnoticed == [B].

2. [LOW · non-blocking] Concurrent scans can post duplicate exhaustion notices. post_bot_thread_exhausted_notice runs before, and outside, the claim and settle protocol. The cron and the pr-review gate hook can both see a thread as unnoticed and both post. The only cost is a duplicate visible comment. Accept this or document it (codeant raised it too).

3. [LOW · non-blocking] grep -c ... || echo 0 in tests/dev-lead/integration/test_prompt_coverage.sh. On zero matches this outputs 0\n0, which breaks the later -eq checks (gemini raised this). The pattern predates this PR but was rewritten here, so it's cheap to switch to || true.

Checked and found fine:

  • codeant: _bcr_n picks up diagnostics (review-one-pr.sh). Not reproducible. The inner $(...) captures only stdout, while the outer 2>&1 sends stderr to the outer capture. The scanner writes diagnostics to stderr only.
  • codeant: human-review runs now see unrelated bot threads. The old query also filtered only on isResolved, never on reviewer, so the only change is pagination.
  • codeant: comments(first:5) truncation and ignored GraphQL errors in open-review-threads.sh. Both behave as before for the engine-facing payload. The new retry fetch (btr_fetch_pr_threads) checks errors and totalCount and fails closed.
  • Security: markers must be from an automation login with an OWNER/MEMBER/COLLABORATOR association. Ids and attempt numbers are regex-checked before going into comment bodies. Nothing replies to or resolves threads. No secrets, workflow changes or new dependencies.

Secret scan: the run_secret_scanning MCP tool isn't available in this run. The gitleaks CI check passed.

CI status

Not all green yet:

  • bats and unit are still in progress. These are the checks that exercise the new 532-line bats suite.
  • cubic · AI code reviewer is pending.
  • dev-lead / resume and dev-lead / ci-relay show 1-second fail results. These look like superseded or cancelled automation runs, not code failures.

Passed: shellcheck/ShellCheck, Lint, CodeQL, SonarCloud (quality gate passed, 0 new issues), gitleaks, AgentShield, prompt-coverage and the other standards gates.

Unresolved review threads: 7 bot threads (5 codeant, 2 gemini) have no reply or resolution, and required_review_thread_resolution blocks the merge on them.


Reviewed automatically by the PR-review agent (single-reviewer mode: opus 5.5 [opus 4.8, opus 4.7]). Reply if you need a human review.

Additional tasks

  1. Resolve all unresolved review thread comments from other reviewers
  2. Ensure all CI checks pass after your changes
  3. Rebase on the target branch if behind
  4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

@cubic-dev-ai cubic-dev-ai Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

Comment thread scripts/review-one-pr.sh
Comment thread scripts/lib/open-review-threads.sh Outdated
Comment thread scripts/dev-lead-retry.sh
Comment thread scripts/lib/bot-thread-retry.sh Outdated
Comment thread scripts/lib/bot-thread-retry.sh Outdated
Comment thread scripts/dev-lead-retry.sh Outdated
Comment thread scripts/lib/open-review-threads.sh Outdated
Comment thread scripts/lib/open-review-threads.sh Outdated
Comment thread scripts/dev-lead-fix-reviews.sh Outdated
@donpetry-bot

Copy link
Copy Markdown
Contributor

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-03T15:14:30Z.

@don-petry
don-petry disabled auto-merge October 3, 2026 14:16

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b0f4d65215

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread scripts/lib/open-review-threads.sh Outdated
Comment thread tests/dev-lead/unit/test_bot_thread_retry.bats
Comment thread scripts/review-one-pr.sh
Comment thread scripts/dev-lead-retry.sh
Comment thread scripts/lib/bot-thread-retry.sh Outdated
@don-petry

Copy link
Copy Markdown
Collaborator Author

Dev-Lead — fix-reviews (partial)

A commit was pushed, but not every requested change was applied. Per requested item:

  • scripts/dev-lead-fix-reviews.sh:2586 — not applied
  • scripts/review-one-pr.sh:511 — not applied
  • scripts/dev-lead-retry.sh:876 — not applied
  • scripts/lib/open-review-threads.sh:31 — not applied
  • scripts/lib/open-review-threads.sh:37 — applied
  • scripts/dev-lead-retry.sh:915 — not applied
  • scripts/dev-lead-retry.sh:920 — not applied
  • scripts/review-one-pr.sh:511 — not applied
  • scripts/lib/open-review-threads.sh:39 — applied
  • scripts/dev-lead-retry.sh:821 — not applied
  • scripts/lib/bot-thread-retry.sh:138 — applied
  • scripts/lib/bot-thread-retry.sh:128 — applied
  • scripts/dev-lead-retry.sh:876 — not applied
  • scripts/lib/open-review-threads.sh:38 — applied
  • scripts/lib/open-review-threads.sh:31 — not applied
  • scripts/dev-lead-fix-reviews.sh:2409 — not applied

The unaddressed items above still need work.

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

@don-petry
don-petry enabled auto-merge (squash) October 3, 2026 14:18
@donpetry-bot

donpetry-bot commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor
Superseded by automated re-review at 169adc7c008d3127e376c9e0a7d0177dc7f7b967 — click to expand prior review.

Review — fix requested (cycle 2/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: fc27b279389d98e308263b05821bb3de365f065b
Cascade: triage → deep+duck (triage: haiku 4.5 [sonnet 5.5, sonnet 5] → deep: opus 5.5 [opus 4.8, sonnet 5.5] + duck: gemini-3.8-flash [sonnet 5.5] → audit: opus 5.5 [opus 4.8, opus 4.7])

Summary

Both reviewers rate the PR MEDIUM risk and escalate, so they fully agree. Both found that CI is still queued or in progress at the head SHA and that bot review threads are unresolved. Both also flagged that fetch_open_review_threads is now unbounded, which makes the OPEN_THREADS_JSON env payload and prompt unbounded. The deep reviewer adds that this can exceed the 128KB per-env-var limit and abort the pass. The rubber duck uniquely raised the retry-until-cap cost for silently skipped threads, the '@mention dev-lead' text in the exhaustion notice, and the grep -c duplicate-0 check.

Cross-engine agreement

full

Findings

  • major: fetch_open_review_threads now pages through ALL unresolved threads (each with up to 5 comment bodies), and both callers export OPEN_THREADS_JSON. Once the payload passes the 128KB MAX_ARG_STRLEN limit, every later exec in the pass fails with 'Argument list too long'. The pass aborts and the sweep re-dispatches it until exhaustion. Fix: pass the payload through a file or stdin, or cap and trim the bodies. (The rubber duck independently flagged the same unbounded growth at line 25.) (scripts/lib/open-review-threads.sh:39)
  • minor: fetch_open_review_threads now returns every unresolved thread (the old query returned at most 50). OPEN_THREADS_JSON is passed to the engine as-is, including outdated threads, so a PR with hundreds of threads could produce a very large prompt or environment variable. Consider capping the count or truncating bodies. (scripts/lib/open-review-threads.sh:25)
  • major: bats, shellcheck, unit and about 20 other checks are QUEUED or IN_PROGRESS at the head SHA. The new 532-line bats suite has not run yet. Several dev-lead dispatch, resume and ci-relay runs show CANCELLED. 9 cubic-dev-ai review threads are also unresolved. bats is not installed in the deep reviewer's sandbox, so test_bot_thread_retry.bats was not run there.
  • minor: fetch_open_review_threads still prints '[]' on any API/parse failure. A failed fetch therefore looks like 'no unresolved threads'. It should exit non-zero so the caller skips the pass, as btr_fetch_pr_threads does. (scripts/lib/open-review-threads.sh:40)
  • minor: btr_retry_decisions reads isResolved/isOutdated with // false and comments.totalCount with // ($cs|length). A thread node missing these fields is treated as open, not outdated, and complete, so it dispatches. Require type == "boolean" / type == "number". (scripts/lib/bot-thread-retry.sh:411)
  • minor: scan_pr_for_unreplied_bot_threads dispatches with head_sha taken from .head?.sha // empty but never checks that it is non-empty. scan_pr_for_rate_limits does check this. A partial pulls API response could enqueue a retry with an empty head_sha. (scripts/dev-lead-retry.sh:821)
  • minor: post_bot_thread_exhausted_notice posts its notice without the post→re-list→earliest-wins claim that the retry marker uses. Two concurrent scans can both post duplicate exhaustion comments. (scripts/dev-lead-retry.sh:876)
  • minor: A thread that fix-reviews decides to skip silently, without replying, is retried until it hits the attempt cap (2 per thread, 6 total), costing runs each time. The exhaustion notice bounds this. The claim-then-verify marker is best-effort. (scripts/lib/bot-thread-retry.sh:150)
  • info: The 'replied' check counts any later comment by the automation logins, and dev_lead_identity defaults to don-petry, the account the human maintainer also uses. A maintainer's in-thread reply therefore suppresses the retry even if dev-lead never handled the thread. This is safe, but some lost passes go unrecovered. Consider requiring the dev-lead disposition marker in the reply body. (scripts/lib/bot-thread-retry.sh:419)
  • info: The exhaustion notice interpolates path:line and the bot login into a PR comment body. These come from GitHub's API, and the ids are regex-validated. The notice text contains '@mention dev-lead', which could trigger mention-routing if dev-lead's own comments are not filtered out of the ingress. Worth confirming. (scripts/dev-lead-retry.sh:797)
  • info: Gemini flagged that grep -c ... || echo 0 in the integration test prints a duplicate '0' when nothing matches. Confirm this was addressed. (tests/dev-lead/integration/test_prompt_coverage.sh)

Reviewed by the PR-review cascade (triage: haiku 4.5 [sonnet 5.5, sonnet 5] → deep: opus 5.5 [opus 4.8, sonnet 5.5] + duck: gemini-3.8-flash [sonnet 5.5] → audit: opus 5.5 [opus 4.8, opus 4.7]). Reply if you need a human review.

Additional tasks

  1. Resolve all unresolved review thread comments from other reviewers
  2. Ensure all CI checks pass after your changes
  3. Rebase on the target branch if behind
  4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

…is dispatched (#2046)

A dispatched fix-reviews pass enumerates every unresolved thread, the
exhausted ones included, so a notice posted alongside it could go stale
while its marker suppresses a corrected one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019K6UsD7r25pAcRjJL3G6Kx
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

Copy link
Copy Markdown
Collaborator Author

Maintainer note on the cycle-3/3 review at 169adc7c. Pushed 08a44ef and e861115:


Generated by Claude Code

@cubic-dev-ai cubic-dev-ai Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 4 files (changes from recent commits).

Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic

Comment thread scripts/dev-lead-retry.sh Outdated
Comment thread scripts/dev-lead-retry.sh
Comment thread scripts/dev-lead-retry.sh Outdated
@don-petry

don-petry commented Oct 9, 2026 •

Copy link
Copy Markdown
Collaborator Author
Resolved — the `needs-human-review` hold was lifted; dev-lead has picked this item up. Click to expand the prior hold notice.

dev-lead is withholding action on this item.

It is labeled needs-human-review (flagged for human review — this label is applied by automation as well as by people, so an item can become held without anyone noticing), so dev-lead will not pick it up while that label is present. This notice is posted once so the withhold is visible rather than looking like a stalled run.

To re-enable automated pickup: remove the needs-human-review label.

@don-petry

Copy link
Copy Markdown
Collaborator Author

No description provided.

@donpetry-bot

Copy link
Copy Markdown
Contributor

No description provided.

…ion notice on an aborted dispatch (#2046)

- has_dispatch_guard counts ANY matching guard dated inside
  [now - window, now], not just the first, and ignores future-dated ones.
- The follow-on scans only honour guards our own automation posted, so a
  PR commenter cannot pause retries.
- The bot-thread scan posts the exhaustion notice on every pre-dispatch
  abort path (marker post/read failures, untrusted claim, dispatch failure),
  keeping it suppressed only after a successful dispatch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019K6UsD7r25pAcRjJL3G6Kx
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

@don-petry

Copy link
Copy Markdown
Collaborator Author

No description provided.

@don-petry

don-petry commented Oct 9, 2026 •

Copy link
Copy Markdown
Collaborator Author
Resolved — the `dev-lead:hands-off` hold was lifted; dev-lead has picked this item up. Click to expand the prior hold notice.

dev-lead is withholding action on this item.

It is labeled dev-lead:hands-off (deliberately kept off-limits to dev-lead (e.g. changes to the dev-lead automation itself)), so dev-lead will not pick it up while that label is present. This notice is posted once so the withhold is visible rather than looking like a stalled run.

To re-enable automated pickup: remove the dev-lead:hands-off label.

@donpetry-bot

Copy link
Copy Markdown
Contributor

No description provided.

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

@don-petry

Copy link
Copy Markdown
Collaborator Author

No description provided.

@sonarqubecloud

sonarqubecloud Bot commented Oct 9, 2026

Copy link
Copy Markdown

@don-petry

Copy link
Copy Markdown
Collaborator Author

No description provided.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Acknowledged: this is a Codex usage-limit notice with no review findings; no code change needed.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Acknowledged: this is a Codex usage-limit notice with no review findings; no code change needed.

@don-petry

Copy link
Copy Markdown
Collaborator Author

No description provided.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Acknowledged: this is a Codex usage-limit notice with no review findings; no code change needed.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Acknowledged: this is a Codex usage-limit notice with no review findings; no code change needed.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Acknowledged: this is a Codex usage-limit notice with no review findings; no code change needed.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Acknowledged: CodeRabbit's automated 'Comments resolved and changes approved' reply carries no findings; no action needed.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Acknowledged: the CodeAnt risk summary rates the PR Low Risk and lists no findings; no action needed.

@don-petry

Copy link
Copy Markdown
Collaborator Author

Dev-Lead — fix-reviews (no-changes)

Agent reasoning
- 1 CodeRabbit "Action performed" reply
- 1 CodeAnt Low Risk summary
Tier 1 check:
- No CHANGES_REQUESTED reviews.
- The three `dev-lead / *` checks (ci-relay, dispatch, resume) show `cancelled`. They belong to the dev-lead workflow run itself, and this repo has no code change that would fix them.
- Analyze (actions) and Analyze (python) are still queued.
- Every other check is success or skipped.
Test verification: not run, because I made no code changes.
Files changed: none
```

@donpetry-bot

Copy link
Copy Markdown
Contributor

No description provided.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

dev-lead: unprocessed bot review threads are never retried — review-thread counterpart of #2017

2 participants