feat: add secure Covencat autoreview and repair loop#12
Merged
Conversation
romgenie
marked this pull request as ready for review
July 15, 2026 00:25
![covencat[bot]](https://avatars.githubusercontent.com/in/4224630?s=60&v=4){kind=small}
There was a problem hiding this comment.
Coven review
Status: success
The runtime review output was downgraded because its publication evidence was incomplete or contradictory.
Evidence
- PR: #12
- Base:
main@658e542ad469bc5c3acf7ce603440e70bc3f7b92 - Head:
agent/covencat-autorepair@e205f255c06e7bd153354beac4f3b75249f727a1 - Checked-out workspace HEAD:
e205f255c06e7bd153354beac4f3b75249f727a1 - Changed files supplied to agent: 17
- Review context SHA-256:
d83f06bbc2cb9e9ea564a6f6ee3a24fec244fd886fc80270e1def04010b5d4ee - Files:
.gitignore,README.md,config/example-policy.json,deploy/Containerfile,deploy/covencat-ingress-tunnel.service.example,deploy/covencat-state-volume.service.example,deploy/covencat-worker.service.example,deploy/ingress-relay.mjs,deploy/probe-runtime.mjs,deploy/resolve-egress.mjs,deploy/verify-github-app.mjs,deploy/worker-entrypoint.sh,docs/coven-github-connection.md,src/adapter.ts,src/server.ts,src/task-worker.ts,tests/webhook-adapter.test.ts
Structured review
- Mode:
pull_request - Evidence status:
partial - Reviewed files: 17
- Reviewed file list:
.gitignore,README.md,config/example-policy.json,deploy/Containerfile,deploy/covencat-ingress-tunnel.service.example,deploy/covencat-state-volume.service.example,deploy/covencat-worker.service.example,deploy/ingress-relay.mjs,deploy/probe-runtime.mjs,deploy/resolve-egress.mjs,deploy/verify-github-app.mjs,deploy/worker-entrypoint.sh,docs/coven-github-connection.md,src/adapter.ts,src/server.ts,src/task-worker.ts,tests/webhook-adapter.test.ts - Supporting files inspected: 1
- Supporting file list:
AGENTS.md - Findings: 0
- No-findings reason: I inspected the changed files most relevant to the PR’s behavior changes, especially
src/adapter.ts,src/server.ts,src/task-worker.ts, andtests/webhook-adapter.test.ts, and found the new retry/publication plumbing to be internally consistent. Insrc/server.ts:76-116, worker messages are read defensively and the newretry_not_before,failure_category, andfollowup_task_idfields are handled without breaking existing success/error paths. Insrc/task-worker.ts:15-25, the emitted IPC payload matches those expectations. Insrc/adapter.ts:2407-2410,2548-2566, and3404-3421, the publication and revision-reconciliation failure states are assigned coherently, with retry deadlines persisted and cleared in the expected branches. The documentation updates inREADME.mdanddocs/coven-github-connection.mdare aligned with the implementation, and the test file includes cases for the new blocked/retry states. The only trusted validation evidence provided,git diff --check, passed cleanly. - Tests reported by runtime: 1
git diff --check:passed- Command completed successfully with no output.
- Limitations: 0
Files changed: 0
Commits: 1
Task autoreview-ed9912e9b84262d440a44e1e559f90f12c407109c36cd97b.
Publication validation
- captured diff evidence is incomplete or truncated
Evidence was incomplete or contradictory, so this is a COMMENT review rather than an approval or change request.
There was a problem hiding this comment.
Coven review
Status: success
The runtime review output was downgraded because its publication evidence was incomplete or contradictory.
Evidence
- PR: #12
- Base:
main@658e542ad469bc5c3acf7ce603440e70bc3f7b92 - Head:
agent/covencat-autorepair@3a5f83f1c4141009a6d79b240c9b6f623a9e4d2f - Checked-out workspace HEAD:
3a5f83f1c4141009a6d79b240c9b6f623a9e4d2f - Changed files supplied to agent: 17
- Review context SHA-256:
0dbab44b097639c2e10eab049c60b7661b389e5de702512c5ce4b9b44a627181 - Files:
.gitignore,README.md,config/example-policy.json,deploy/Containerfile,deploy/covencat-ingress-tunnel.service.example,deploy/covencat-state-volume.service.example,deploy/covencat-worker.service.example,deploy/ingress-relay.mjs,deploy/probe-runtime.mjs,deploy/resolve-egress.mjs,deploy/verify-github-app.mjs,deploy/worker-entrypoint.sh,docs/coven-github-connection.md,src/adapter.ts,src/server.ts,src/task-worker.ts,tests/webhook-adapter.test.ts
Structured review
- Mode:
pull_request - Evidence status:
partial - Reviewed files: 17
- Reviewed file list:
.gitignore,README.md,config/example-policy.json,deploy/Containerfile,deploy/covencat-ingress-tunnel.service.example,deploy/covencat-state-volume.service.example,deploy/covencat-worker.service.example,deploy/ingress-relay.mjs,deploy/probe-runtime.mjs,deploy/resolve-egress.mjs,deploy/verify-github-app.mjs,deploy/worker-entrypoint.sh,docs/coven-github-connection.md,src/adapter.ts,src/server.ts,src/task-worker.ts,tests/webhook-adapter.test.ts - Supporting files inspected: 1
- Supporting file list:
AGENTS.md - Findings: 0
- No-findings reason: The reviewed changes are internally consistent across the new deployment scripts, adapter, server, worker, and tests.
src/server.tsschedules only queued/runnable tasks and also enqueues follow-up tasks emitted by the worker, whilesrc/task-worker.tspreserves thefollowup_task_id, publication retry metadata, and retry deadline fields thatsrc/server.tsconsumes. Insrc/adapter.ts, the recovery and scheduling helpers align with the new retry states (publication_failed,revision_reconciliation_retry_pending) and the existing publication recovery gates, so the new orchestration does not appear to strand tasks or violate the repo’s deployment invariants fromAGENTS.md. The deployment utilities (deploy/ingress-relay.mjs,deploy/resolve-egress.mjs,deploy/worker-entrypoint.sh,deploy/probe-runtime.mjs) also match the intended safety checks: bounded request forwarding, public IPv4 allowlisting, and runtime-isolation validation. - Tests reported by runtime: 1
git diff --check:passed- Command completed successfully with no output.
- Limitations: 0
Files changed: 0
Commits: 1
Task autoreview-37573322d75b5d5fd102dafcfe4fac1d738e2890e6ddd876.
This review follows the prior covencat publication. A decisive submission replaces its state; a COMMENT does not.
Publication validation
- captured diff evidence is incomplete or truncated
Evidence was incomplete or contradictory, so this is a COMMENT review rather than an approval or change request.
There was a problem hiding this comment.
Coven review
Status: success
The runtime review output was downgraded because its publication evidence was incomplete or contradictory.
Evidence
- PR: #12
- Base:
main@658e542ad469bc5c3acf7ce603440e70bc3f7b92 - Head:
agent/covencat-autorepair@bb3091e63e58ca554e640275f709535f7e484dad - Checked-out workspace HEAD:
bb3091e63e58ca554e640275f709535f7e484dad - Changed files supplied to agent: 17
- Review context SHA-256:
92cf934f6aa7f17d6df627e7e56201fd3a85a14da24af11d9a4136ac67f27a46 - Files:
.gitignore,README.md,config/example-policy.json,deploy/Containerfile,deploy/covencat-ingress-tunnel.service.example,deploy/covencat-state-volume.service.example,deploy/covencat-worker.service.example,deploy/ingress-relay.mjs,deploy/probe-runtime.mjs,deploy/resolve-egress.mjs,deploy/verify-github-app.mjs,deploy/worker-entrypoint.sh,docs/coven-github-connection.md,src/adapter.ts,src/server.ts,src/task-worker.ts,tests/webhook-adapter.test.ts
Structured review
- Mode:
pull_request - Evidence status:
partial - Reviewed files: 17
- Reviewed file list:
.gitignore,README.md,config/example-policy.json,deploy/Containerfile,deploy/covencat-ingress-tunnel.service.example,deploy/covencat-state-volume.service.example,deploy/covencat-worker.service.example,deploy/ingress-relay.mjs,deploy/probe-runtime.mjs,deploy/resolve-egress.mjs,deploy/verify-github-app.mjs,deploy/worker-entrypoint.sh,docs/coven-github-connection.md,src/adapter.ts,src/server.ts,src/task-worker.ts,tests/webhook-adapter.test.ts - Supporting files inspected: 1
- Supporting file list:
AGENTS.md - Findings: 0
- No-findings reason: The reviewed patch set appears internally consistent across the touched webhook, worker, deploy, and documentation files. The core routing and handling changes in
src/adapter.ts,src/server.ts, andsrc/task-worker.tsare supported by the updated test coverage intests/webhook-adapter.test.ts, and the deployment/runtime scripts (deploy/verify-github-app.mjs,deploy/resolve-egress.mjs,deploy/probe-runtime.mjs,deploy/ingress-relay.mjs,deploy/worker-entrypoint.sh) align with the documented setup changes inREADME.mdanddocs/coven-github-connection.md. The only trusted execution evidence provided wasgit diff --checkpassing, which also supports the absence of patch-formatting issues. - Tests reported by runtime: 1
git diff --check:passed- Command completed successfully with no output.
- Limitations: 0
Files changed: 0
Commits: 1
Task autoreview-0f41a3a7226e8b52229b9cbf5762dcc65f740e0ed650637e.
This review follows the prior covencat publication. A decisive submission replaces its state; a COMMENT does not.
Publication validation
- captured diff evidence is incomplete or truncated
Evidence was incomplete or contradictory, so this is a COMMENT review rather than an approval or change request.
There was a problem hiding this comment.
Coven review
Status: success
The runtime review output was downgraded because its publication evidence was incomplete or contradictory.
Evidence
- PR: #12
- Base:
main@658e542ad469bc5c3acf7ce603440e70bc3f7b92 - Merge base:
undefined - Head:
agent/covencat-autorepair@ad4247b34036cec0492eb64734bb4438591cb2c3 - Checked-out workspace HEAD:
ad4247b34036cec0492eb64734bb4438591cb2c3 - Changed files supplied to agent: 17
- Review context SHA-256:
65e3ff6a59b9ff81acf77c8fef4307dec40ee6fa1b3046d7fa8c9bc22a98867b - Files:
.gitignore,README.md,config/example-policy.json,deploy/Containerfile,deploy/covencat-ingress-tunnel.service.example,deploy/covencat-state-volume.service.example,deploy/covencat-worker.service.example,deploy/ingress-relay.mjs,deploy/probe-runtime.mjs,deploy/resolve-egress.mjs,deploy/verify-github-app.mjs,deploy/worker-entrypoint.sh,docs/coven-github-connection.md,src/adapter.ts,src/server.ts,src/task-worker.ts,tests/webhook-adapter.test.ts
Structured review
- Mode:
pull_request - Evidence status:
partial - Reviewed files: 17
- Reviewed file list:
.gitignore,README.md,config/example-policy.json,deploy/Containerfile,deploy/covencat-ingress-tunnel.service.example,deploy/covencat-state-volume.service.example,deploy/covencat-worker.service.example,deploy/ingress-relay.mjs,deploy/probe-runtime.mjs,deploy/resolve-egress.mjs,deploy/verify-github-app.mjs,deploy/worker-entrypoint.sh,docs/coven-github-connection.md,src/adapter.ts,src/server.ts,src/task-worker.ts,tests/webhook-adapter.test.ts - Supporting files inspected: 1
- Supporting file list:
AGENTS.md - Findings: 0
- No-findings reason: I inspected the changed implementation files and the relevant supporting context, and the reviewed changes are internally consistent with the repository’s documented and tested contract:
src/adapter.tscaptures review evidence withchanged_file_count,expected_changed_file_count,changed_files,changed_file_lines, andincomplete_patch_files, andnormalizeReviewPublication(...)rejects incomplete or stale review publications when the captured PR head/base or file coverage do not match.src/server.tsschedules worker execution and retries in a way that matches the task-worker follow-up/retry signaling observed in the adapter path.config/example-policy.json,README.md, anddocs/coven-github-connection.mdconsistently document the requiredpull_request.synchronize,pull_request.edited,pull_request.reopened, andpushsafety triggers forpublication.mode: comment.tests/webhook-adapter.test.tscontains fixture coverage for complete review evidence and publication normalization, matching the reviewed implementation. The only trusted validation receipt provided,git diff --check, passed with no whitespace or patch-format issues. - Tests reported by runtime: 1
git diff --check:passed- Command completed successfully with no output.
- Limitations: 0
Files changed: 0
Commits: 1
Task autoreview-fc75ba73f9e43b1ef28e6627be4fc70536d9add61ad6478c.
This review follows the prior covencat publication. A decisive submission replaces its state; a COMMENT does not.
Publication validation
- PR merge-base revision is missing
- PR head changed after review evidence was captured
- captured diff evidence is incomplete or truncated
Evidence was incomplete or contradictory, so this is a COMMENT review rather than an approval or change request.
The PR head or base changed before this review was submitted, so stale evidence was published as COMMENT.
The PR head or base changed during submission; this COMMENT must not supersede prior decisive review state.
There was a problem hiding this comment.
Coven review
Status: success
The runtime review output was downgraded because its publication evidence was incomplete or contradictory.
Evidence
- PR: #12
- Base:
main@658e542ad469bc5c3acf7ce603440e70bc3f7b92 - Merge base:
658e542ad469bc5c3acf7ce603440e70bc3f7b92 - Head:
agent/covencat-autorepair@aa73327d62358afe8b9f699111a94a2168be7aaf - Checked-out workspace HEAD:
aa73327d62358afe8b9f699111a94a2168be7aaf - Changed files supplied to agent: 17
- Review context SHA-256:
4f2e07ad5d634e79103e1596bf26a703d3c5799ac37fd98691cca3ba9a7a93fb - Files:
.gitignore,README.md,config/example-policy.json,deploy/Containerfile,deploy/covencat-ingress-tunnel.service.example,deploy/covencat-state-volume.service.example,deploy/covencat-worker.service.example,deploy/ingress-relay.mjs,deploy/probe-runtime.mjs,deploy/resolve-egress.mjs,deploy/verify-github-app.mjs,deploy/worker-entrypoint.sh,docs/coven-github-connection.md,src/adapter.ts,src/server.ts,src/task-worker.ts,tests/webhook-adapter.test.ts
Structured review
- Mode:
pull_request - Evidence status:
partial - Reviewed files: 17
- Reviewed file list:
.gitignore,README.md,config/example-policy.json,deploy/Containerfile,deploy/covencat-ingress-tunnel.service.example,deploy/covencat-state-volume.service.example,deploy/covencat-worker.service.example,deploy/ingress-relay.mjs,deploy/probe-runtime.mjs,deploy/resolve-egress.mjs,deploy/verify-github-app.mjs,deploy/worker-entrypoint.sh,docs/coven-github-connection.md,src/adapter.ts,src/server.ts,src/task-worker.ts,tests/webhook-adapter.test.ts - Supporting files inspected: 1
- Supporting file list:
AGENTS.md - Findings: 0
- No-findings reason: The reviewed changes appear internally consistent across the webhook adapter, server wiring, worker execution, deployment scripts, and documentation. The updated tests in
tests/webhook-adapter.test.tscover the adapter behavior that changed insrc/adapter.ts, and the runtime/deployment files underdeploy/align with the worker-oriented flow reflected insrc/task-worker.tsandsrc/server.ts. I did not find any concrete mismatch, regression, or missing safeguard in the inspected files that rose to a verifiable issue. - Tests reported by runtime: 1
git diff --check:passed- Command completed successfully with no output.
- Limitations: 0
Files changed: 0
Commits: 1
Task autoreview-ffb1b34f0c8d85b16bbe54cac1a1960138ffccae7769b6b4.
This review follows the prior covencat publication. A decisive submission replaces its state; a COMMENT does not.
Publication validation
- captured diff evidence is incomplete or truncated
Evidence was incomplete or contradictory, so this is a COMMENT review rather than an approval or change request.
There was a problem hiding this comment.
Coven review
Status: success
Files inspected
Files inspected
src/server.tssrc/adapter.tssrc/task-worker.tstests/webhook-adapter.test.tsREADME.mddocs/coven-github-connection.md
Supporting context used
AGENTS.md— repository-wide review/contribution constraints and bounded-review expectations.src/adapter.ts— needed to verify the new task recovery/publication state transitions and scheduler behavior.src/server.ts— needed to inspect how queued tasks are scheduled and retried after webhook handling.src/task-worker.ts— needed to confirm the worker reports the fields the scheduler now relies on.tests/webhook-adapter.test.ts— needed to check the intended behavior asserted by the new tests.README.md— needed to confirm the documented webhook/publication safety requirements match the implementation.docs/coven-github-connection.md— needed to verify the operational guidance for comment publication and trigger configuration.
Findings
None
No-findings justification
The inspected changes are internally consistent across the task lifecycle and review publication flow. In src/server.ts:41-149, the worker scheduler now routes tasks into maintenance vs. compute lanes and correctly reenqueues follow-up and retryable tasks using the worker-reported followup_task_id, publication_state, and retry_not_before fields. In src/adapter.ts:2377-2577, revision-reconciliation failures are explicitly persisted as revision_reconciliation_retry_pending, publication recovery is gated on verified runtime isolation and comment mode, and failed publication retries persist and honor retry_not_before. The worker-side message contract in src/task-worker.ts:20-25 exposes the exact fields the scheduler consumes. The documentation updates in README.md:159-213 and docs/coven-github-connection.md:35-114 align the required GitHub App/webhook triggers with comment publication safety constraints. The trusted validation receipt also confirms git diff --check passed with no whitespace or patch-formatting issues.
Tests/commands considered
git diff --check- passed: no whitespace or patch formatting errors.- Review-time source inspection only; no additional commands were run beyond the trusted receipt.
Confidence/limitations
None
Evidence
- PR: #12
- Base:
main@658e542ad469bc5c3acf7ce603440e70bc3f7b92 - Merge base:
658e542ad469bc5c3acf7ce603440e70bc3f7b92 - Head:
agent/covencat-autorepair@8d909105c6efc5384af7aa4f9a7c3ce3bfbbf453 - Checked-out workspace HEAD:
8d909105c6efc5384af7aa4f9a7c3ce3bfbbf453 - Changed files supplied to agent: 17
- Review context SHA-256:
589c1e835a79e9222cceb8a54e2247c003f77add044308e72fdc62f369b74cba - Files:
.gitignore,README.md,config/example-policy.json,deploy/Containerfile,deploy/covencat-ingress-tunnel.service.example,deploy/covencat-state-volume.service.example,deploy/covencat-worker.service.example,deploy/ingress-relay.mjs,deploy/probe-runtime.mjs,deploy/resolve-egress.mjs,deploy/verify-github-app.mjs,deploy/worker-entrypoint.sh,docs/coven-github-connection.md,src/adapter.ts,src/server.ts,src/task-worker.ts,tests/webhook-adapter.test.ts
Structured review
- Mode:
pull_request - Evidence status:
complete - Reviewed files: 17
- Reviewed file list:
.gitignore,README.md,config/example-policy.json,deploy/Containerfile,deploy/covencat-ingress-tunnel.service.example,deploy/covencat-state-volume.service.example,deploy/covencat-worker.service.example,deploy/ingress-relay.mjs,deploy/probe-runtime.mjs,deploy/resolve-egress.mjs,deploy/verify-github-app.mjs,deploy/worker-entrypoint.sh,docs/coven-github-connection.md,src/adapter.ts,src/server.ts,src/task-worker.ts,tests/webhook-adapter.test.ts - Supporting files inspected: 1
- Supporting file list:
AGENTS.md - Findings: 0
- No-findings reason: The inspected changes are internally consistent across the task lifecycle and review publication flow. In
src/server.ts:41-149, the worker scheduler now routes tasks into maintenance vs. compute lanes and correctly reenqueues follow-up and retryable tasks using the worker-reportedfollowup_task_id,publication_state, andretry_not_beforefields. Insrc/adapter.ts:2377-2577, revision-reconciliation failures are explicitly persisted asrevision_reconciliation_retry_pending, publication recovery is gated on verified runtime isolation andcommentmode, and failed publication retries persist and honorretry_not_before. The worker-side message contract insrc/task-worker.ts:20-25exposes the exact fields the scheduler consumes. The documentation updates inREADME.md:159-213anddocs/coven-github-connection.md:35-114align the required GitHub App/webhook triggers with comment publication safety constraints. The trusted validation receipt also confirmsgit diff --checkpassed with no whitespace or patch-formatting issues. - Tests reported by runtime: 1
git diff --check:passed- Command completed successfully with no output.
- Limitations: 0
Files changed: 0
Commits: 1
Task autoreview-1afe1abdbef32243bce3d4145e9b1c5b361d6e6afcee51c9.
This review follows the prior covencat publication. A decisive submission replaces its state; a COMMENT does not.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security model
The model receives the Codex credential and a sandboxed workspace only. It never receives GitHub tokens. Repair sessions have file tools only; trusted validation runs credential-free with network disabled. The host performs diff inspection, commit, exact-head verification, and non-force push using a fresh repository-scoped token.
Verification
npm run buildnpm test(113 tests)git diff --checkenabled: falseafter probe cleanupRuntime dependency
Depends on OpenCoven/coven-code#163 for
--hosted-repairand contract-v2-compatible file-only execution. Merge #163 before this PR.Review status
The deployment and live-loop gates are complete. This PR is ready for review and should be merged after OpenCoven/coven-code#163.