[CI] add minimal tsconfig.ci.json for TypeScript type-check job - #5
[CI] add minimal tsconfig.ci.json for TypeScript type-check job#5vortsghost2025 wants to merge 117 commits into
Conversation
- Only includes governance scripts and TypeScript sources - Excludes Tauri, UI, tests, lanes, context-buffer, and executor-watcher - Minimal honest CI scope per governance constraints
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe pull request adds CI TypeScript scope, updates agent models and step limits, normalizes and sanitizes task responses, adds JWT signature-mismatch proofing, tightens ASCII validation, and records completed ratification approvals. ChangesConfiguration updates
Response and validation
Signature mismatch validation
Ratification records
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant ProofScript
participant PrivateKey
participant IdentityEnforcer
ProofScript->>PrivateKey: sign canonical JWT input
ProofScript->>IdentityEnforcer: verify valid and corrupted JWS values
IdentityEnforcer-->>ProofScript: return SIGNATURE_MISMATCH
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (7 files)
Previous Review Summaries (11 snapshots, latest commit b4451b9)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit b4451b9)Status: 6 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)CRITICAL
WARNING
Files Reviewed (6 files)
Fix these issues in Kilo Cloud Previous review (commit 6a44063)Status: 4 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (2 files)
Note: GitHub's pull-request files endpoint caps enumeration at 3,000 files, but this PR has 4,093 changed files. Fix these issues in Kilo Cloud Previous review (commit d8bb138)Status: 4 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (2 files)
Note: GitHub's pull-request files endpoint caps enumeration at 3,000 files, but this PR has 4,093 changed files. Fix these issues in Kilo Cloud Previous review (commit f6fea77)Status: No Issues Found | Recommendation: Merge Files Reviewed (2 files)
Previous review (commit 2bf875e)Status: 6 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)CRITICAL
WARNING
Files Reviewed (6 files)
Fix these issues in Kilo Cloud Previous review (commit f8ecf25)Status: 6 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)CRITICAL
WARNING
Files Reviewed (6 files)
Fix these issues in Kilo Cloud Previous review (commit 985dc65)Status: 2 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (2 files)
Fix these issues in Kilo Cloud Previous review (commit 640ba78)Status: 2 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (2 files)
Fix these issues in Kilo Cloud Previous review (commit 7fffb86)Status: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)CRITICAL
Files Reviewed (1 file)
Fix these issues in Kilo Cloud Previous review (commit 3071275)Status: 3 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)CRITICAL
Issue Details (click to expand)WARNING
Files Reviewed (3 files)
Fix these issues in Kilo Cloud Previous review (commit de27692)Status: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)CRITICAL
Files Reviewed (1 file)
Reviewed by step-3.7-flash · Input: 11K · Output: 2K · Cached: 64.9K |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: eab1e4e004
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "include": [ | ||
| "scripts/**/*.js", | ||
| "scripts/**/*.d.ts", | ||
| "src/**/*.ts" |
There was a problem hiding this comment.
In the checked Windows build job (.github/workflows/ci.yml), npm ci is followed by npx tsc -p tsconfig.ci.json --noEmit; this include pulls in src/orchestrator/api.ts, which imports express, but the root package.json/lockfile declares neither Express nor its type definitions. TypeScript 5.9 therefore reports TS2307 and stops the job before the recovery and schema checks run. Add the required dependency and typings, or keep the orchestrator sources outside this CI project.
Useful? React with 👍 / 👎.
createResponse emitted type:response messages without a top-level confidence integer, so recipient decideRoute (lane-worker.js) rejected every auto-ack with CONFIDENCE_REQUIRED, generating a NACK loop (archivist+3.1k quarantined in 24h, swarmmind/library receiving response-alerts). Port the v2 live-repair patch: normalizeConfidence() maps routing confidence (0-1) to 1-10, response now carries confidence + investigation (when <7), fallback ack confidence 0.0->1.0. Pre-existing executor failures unchanged (60 PASS / 4 FAIL NLP-routing).
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
scripts/generic-task-executor.js (1)
908-917: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAvoid overloading confidence scales before lane routing.
normalizeConfidence()maps both1.0and1to10, whilenlpRoute()emits0.7as a 0–1 score that becomes7. If both scales are valid, carry the scale explicitly; otherwise use one canonical input scale. Also consider the current mapping because0.67rounds up to passing confidence without investigation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/generic-task-executor.js` around lines 908 - 917, Update normalizeConfidence to avoid interpreting the same numeric value as both 0–1 and 1–10 confidence scales; carry the input scale explicitly through the callers, including nlpRoute, or standardize all callers on one canonical scale. Preserve integer 1–10 values without remapping, and adjust the 0–1 conversion so boundary values such as 0.67 do not incorrectly round up to passing confidence.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/generic-task-executor.js`:
- Around line 936-938: Update the low-confidence investigation assignment in the
generic task executor to use evidence from the actual routing source, verb, and
reason, including NLP routes from the routing logic, instead of always emitting
“Automated acknowledgement fallback.” Ensure every low-confidence response
provides a non-empty, route-specific investigation value compatible with the
lane worker’s existing check.
In `@scripts/signature-mismatch-proof.js`:
- Around line 111-120: Update the success predicate in the signature-mismatch
proof to also require that validResult confirms the expected valid control and
enforceResult confirms a rejecting decision, such as decision 'reject', while
retaining both existing SIGNATURE_MISMATCH checks. Ensure the proof exits
successfully only when the trusted-key control passes and enforcement rejects
the mismatched signature.
---
Nitpick comments:
In `@scripts/generic-task-executor.js`:
- Around line 908-917: Update normalizeConfidence to avoid interpreting the same
numeric value as both 0–1 and 1–10 confidence scales; carry the input scale
explicitly through the callers, including nlpRoute, or standardize all callers
on one canonical scale. Preserve integer 1–10 values without remapping, and
adjust the 0–1 conversion so boundary values such as 0.67 do not incorrectly
round up to passing confidence.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 86a416e9-c188-49e3-987d-d0fee64c6ba2
📒 Files selected for processing (2)
scripts/generic-task-executor.jsscripts/signature-mismatch-proof.js
| const investigation = confidence < 7 | ||
| ? 'Automated acknowledgement fallback; confidence below investigation threshold per CONFIDENCE_REQUIRED' | ||
| : undefined; |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Provide route-specific investigation evidence.
The low-confidence branch always emits "Automated acknowledgement fallback". Routing confidence can also come from the NLP route in Lines 840-900. A low-confidence NLP response therefore contains false provenance and no actual investigation detail.
scripts/lane-worker.js, Lines 658-671, checks only that investigation is non-empty. Build the field from the actual routing source, verb, and reason, or provide the investigation evidence generated for that route.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/generic-task-executor.js` around lines 936 - 938, Update the
low-confidence investigation assignment in the generic task executor to use
evidence from the actual routing source, verb, and reason, including NLP routes
from the routing logic, instead of always emitting “Automated acknowledgement
fallback.” Ensure every low-confidence response provides a non-empty,
route-specific investigation value compatible with the lane worker’s existing
check.
| if (invalidResult.error === 'SIGNATURE_MISMATCH' && enforceResult.reason === 'SIGNATURE_MISMATCH') { | ||
| console.log(''); | ||
| console.log('PROOF SUCCESSFUL: SIGNATURE_MISMATCH detected end-to-end.'); | ||
| console.log('Root cause: signature bytes do not match the canonical unsigned payload hash under the sender key.'); | ||
| process.exit(0); | ||
| } else { | ||
| console.log(''); | ||
| console.log('PROOF FAILED: unexpected result.'); | ||
| process.exit(1); | ||
| } No newline at end of file |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Assert the valid control and the reject decision.
The success predicate ignores validResult. If .identity/private.pem does not match the trusted archivist public key, both JWS values can produce SIGNATURE_MISMATCH and this proof still exits successfully. The predicate also permits an enforcement regression that returns reason: 'SIGNATURE_MISMATCH' with decision: 'pass'.
Proposed fix
-if (invalidResult.error === 'SIGNATURE_MISMATCH' && enforceResult.reason === 'SIGNATURE_MISMATCH') {
+const validVerified =
+ validResult.valid === true &&
+ validResult.authenticated === true;
+const invalidDetected =
+ invalidResult.valid === false &&
+ invalidResult.authenticated === false &&
+ invalidResult.error === 'SIGNATURE_MISMATCH';
+const enforcementRejected =
+ enforceResult.decision === 'reject' &&
+ enforceResult.authenticated === false &&
+ enforceResult.reason === 'SIGNATURE_MISMATCH';
+
+if (validVerified && invalidDetected && enforcementRejected) {📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if (invalidResult.error === 'SIGNATURE_MISMATCH' && enforceResult.reason === 'SIGNATURE_MISMATCH') { | |
| console.log(''); | |
| console.log('PROOF SUCCESSFUL: SIGNATURE_MISMATCH detected end-to-end.'); | |
| console.log('Root cause: signature bytes do not match the canonical unsigned payload hash under the sender key.'); | |
| process.exit(0); | |
| } else { | |
| console.log(''); | |
| console.log('PROOF FAILED: unexpected result.'); | |
| process.exit(1); | |
| } | |
| const validVerified = | |
| validResult.valid === true && | |
| validResult.authenticated === true; | |
| const invalidDetected = | |
| invalidResult.valid === false && | |
| invalidResult.authenticated === false && | |
| invalidResult.error === 'SIGNATURE_MISMATCH'; | |
| const enforcementRejected = | |
| enforceResult.decision === 'reject' && | |
| enforceResult.authenticated === false && | |
| enforceResult.reason === 'SIGNATURE_MISMATCH'; | |
| if (validVerified && invalidDetected && enforcementRejected) { | |
| console.log(''); | |
| console.log('PROOF SUCCESSFUL: SIGNATURE_MISMATCH detected end-to-end.'); | |
| console.log('Root cause: signature bytes do not match the canonical unsigned payload hash under the sender key.'); | |
| process.exit(0); | |
| } else { | |
| console.log(''); | |
| console.log('PROOF FAILED: unexpected result.'); | |
| process.exit(1); | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/signature-mismatch-proof.js` around lines 111 - 120, Update the
success predicate in the signature-mismatch proof to also require that
validResult confirms the expected valid control and enforceResult confirms a
rejecting decision, such as decision 'reject', while retaining both existing
SIGNATURE_MISMATCH checks. Ensure the proof exits successfully only when the
trusted-key control passes and enforcement rejects the mismatched signature.
Post-confidence-fix responses were still rejected: the fallback ack note and other executor strings contained typographic em-dashes (U+2014), which flowed into _execution_result/subject/body and triggered FORMAT_VIOLATION_NON_ASCII on recipients. Replace all source em-dashes with ASCII hyphen and add asciiSafe() defense-in-depth in createResponse (normalizes dashes/quotes, strips remaining non-ASCII; content_hash now computed over sanitized payload). Executor suite unchanged: 60 PASS / 4 FAIL (pre-existing NLP-routing).
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| return null; | ||
| } | ||
|
|
||
| function asciiSafe(s) { |
There was a problem hiding this comment.
WARNING: Duplicated asciiSafe with inconsistent sanitization behavior
Lines 920-927 reimplement asciiSafe instead of reusing the canonical version in dispatch-task.js:22. The two implementations diverge on em-dash replacement (- vs --), missing ellipsis/non-breaking-space normalization, and fallback character ( vs ?). This produces inconsistent ASCII sanitization depending on which pipeline stage processes the message.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
NON_ASCII_PATTERN /[^\x20-\x7E]/ excluded control chars so every multi-line body failed isEnglishOnly -> FORMAT_VIOLATION_NON_ASCII NACK loop between lanes. Now /[^\x00-\x7F]/ and test raw value before normalization, matching inbox-watcher.js semantics.
Archivist completes ratification under operator delegation. Library, SwarmMind, Kernel cast APPROVE citing the 2026-08-05 NACK storm as evidence: canonical-owner fixes (67ad0d2/96099186/6fbfc8bd) resolved the cross-lane loop and every lane worker has run the fixed lane-worker.js since 14:27Z with zero new NACKs. Gate: ratified, deploy_allowed=true. Unblocks sync-all-lanes.js batch deployment.
…fication_vote, not vote) The C5 gate read v.vote which does not exist on gate votes objects, so approved always counted 0 and the gate could never report ratified even with 4/4 APPROVE. Now reads ratification_vote with vote fallback.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@governance/RATIFICATION_VOTE_KERNEL_20260805.json`:
- Line 10: Replace the non-ASCII em dash in the subject fields of
governance/RATIFICATION_VOTE_KERNEL_20260805.json:10-10,
governance/RATIFICATION_VOTE_LIBRARY_20260805.json:10-10, and
governance/RATIFICATION_VOTE_SWARMMIND_20260805.json:10-10 with an ASCII hyphen.
Then regenerate the approval state and completion metadata in
governance/ratification-gate.json:30-54 and
governance/ratification-gate.json:130-134 from the valid approval records.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3075f115-dd9d-4b1f-a7fc-66550a863025
📒 Files selected for processing (7)
governance/RATIFICATION_VOTE_KERNEL_20260805.jsongovernance/RATIFICATION_VOTE_LIBRARY_20260805.jsongovernance/RATIFICATION_VOTE_SWARMMIND_20260805.jsongovernance/ratification-gate.jsonscripts/generic-task-executor.jsscripts/lane-worker.jsscripts/sync-all-lanes.js
🚧 Files skipped from review as they are similar to previous changes (1)
- scripts/generic-task-executor.js
| "type": "task", | ||
| "task_kind": "vote", | ||
| "priority": "P0", | ||
| "subject": "RATIFICATION VOTE: APPROVE — shared script ownership plan (ratification completed 2026-08-05)", |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python - <<'PY'
import json
paths = [
"governance/RATIFICATION_VOTE_KERNEL_20260805.json",
"governance/RATIFICATION_VOTE_LIBRARY_20260805.json",
"governance/RATIFICATION_VOTE_SWARMMIND_20260805.json",
]
for path in paths:
with open(path, encoding="utf-8") as f:
vote = json.load(f)
invalid = [ch for ch in vote["subject"] if ord(ch) > 0x7F]
print(f"{path}: non-ASCII subject characters = {invalid!r}")
PY
rg -n -C 4 --glob '*.js' \
'isEnglishOnly\s*\(|RATIFICATION_VOTE_|ratification_source|RATIFICATION_GATE_PATH' \
scripts governanceRepository: vortsghost2025/Archivist-Agent
Length of output: 5711
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== scripts/lane-worker.js isEnglishOnly and early decision branch =="
sed -n '365,385p;700,725p;725,932p' scripts/lane-worker.js
echo
echo "== checkRatificationGate references and deploy decision =="
sed -n '105,180p;180,230p;880,1095p' scripts/sync-all-lanes.js
echo
echo "== find all deployment gate checks and ratification-gate reads =="
rg -n -C 3 'checkRatificationGate|deploy_allowed|deployable|ratification-gate|deploy' scripts --glob '*.js'Repository: vortsghost2025/Archivist-Agent
Length of output: 20852
Make the ratification vote records pass the ASCII validator before marking deployment allowed.
The subject fields in the three vote files contain — (U+2014). When these JSON files are loaded into the standard lane-worker path, they route as quarantine with FORMAT_VIOLATION_NON_ASCII. If the ratification gate is populated from those vote payloads, governance/ratification-gate.json can falsely show the ownership plan as ratified.
- Replace
—with an ASCII hyphen in eachgovernance/RATIFICATION_VOTE_*_20260805.jsonsubject. - Regenerate
governance/ratification-gate.jsonapproval state and completion metadata from valid approval records.
📍 Affects 4 files
governance/RATIFICATION_VOTE_KERNEL_20260805.json#L10-L10(this comment)governance/RATIFICATION_VOTE_LIBRARY_20260805.json#L10-L10governance/RATIFICATION_VOTE_SWARMMIND_20260805.json#L10-L10governance/ratification-gate.json#L30-L54governance/ratification-gate.json#L130-L134
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@governance/RATIFICATION_VOTE_KERNEL_20260805.json` at line 10, Replace the
non-ASCII em dash in the subject fields of
governance/RATIFICATION_VOTE_KERNEL_20260805.json:10-10,
governance/RATIFICATION_VOTE_LIBRARY_20260805.json:10-10, and
governance/RATIFICATION_VOTE_SWARMMIND_20260805.json:10-10 with an ASCII hyphen.
Then regenerate the approval state and completion metadata in
governance/ratification-gate.json:30-54 and
governance/ratification-gate.json:130-134 from the valid approval records.
Project provider.nvidia block (no apiKey/baseURL) shadowed the global nvidia provider, so all nvidia/nemotron-3-ultra-550b-a55b subagent spawns failed with ProviderModelNotFoundError. Removed the shadowing provider block and set plan/debug/general/explore/code-reviewer/ lane-worker/git-worker to the session-served model. Takes effect on session reload.
All-agents-on-one-model would 429. Spread: plan/general/lane-worker -> nvidia/z-ai/glm-5.2, debug/code-reviewer -> nvidia/deepseek-ai/deepseek-v4-pro, explore/git-worker -> nvidia-micro/minimaxai/minimax-m3.
| "model": "nvidia/nemotron-3-ultra-550b-a55b", | ||
| "steps": 30 | ||
| "plan": { | ||
| "model": "nvidia/z-ai/glm-5.2", |
There was a problem hiding this comment.
WARNING: 3-segment model path violates the established provider/model format
The codebase consistently uses 2-segment model identifiers (see benchmark.py:23-32, opencode.json:10, ui/app.js:265). z-ai is a registered top-level provider in provider-profiles.js:31 and routing-logger.js:115. Nesting it under nvidia/ will break provider resolution.
| "model": "nvidia/z-ai/glm-5.2", | |
| "model": "z-ai/glm-5.2", |
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| "debug": { | ||
| "model": "nvidia/nemotron-3-ultra-550b-a55b", | ||
| "steps": 40 | ||
| "model": "nvidia/deepseek-ai/deepseek-v4-pro", |
There was a problem hiding this comment.
WARNING: 3-segment model path violates the established provider/model format
deepseek-ai appears as a provider prefix in benchmark data (benchmark.py:29). The correct 2-segment format is deepseek-ai/deepseek-v4-pro.
| "model": "nvidia/deepseek-ai/deepseek-v4-pro", | |
| "model": "deepseek-ai/deepseek-v4-pro", |
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| "steps": 200 | ||
| }, | ||
| "general": { | ||
| "model": "nvidia/z-ai/glm-5.2", |
There was a problem hiding this comment.
WARNING: 3-segment model path violates the established provider/model format
The codebase consistently uses 2-segment model identifiers (see benchmark.py:23-32, opencode.json:10, ui/app.js:265). z-ai is a registered top-level provider in provider-profiles.js:31 and routing-logger.js:115. Nesting it under nvidia/ will break provider resolution.
| "model": "nvidia/z-ai/glm-5.2", | |
| "model": "z-ai/glm-5.2", |
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| }, | ||
| "explore": { | ||
| "model": "nvidia/nemotron-3-ultra-550b-a55b", | ||
| "model": "nvidia-micro/minimaxai/minimax-m3", |
There was a problem hiding this comment.
CRITICAL: Unknown provider namespace nvidia-micro guarantees runtime failure
nvidia-micro does not exist anywhere in the codebase or configuration. minimaxai/minimax-m3 is the established 2-segment format (see opencode.json:10). This will fail with "provider not found" on every subagent spawn.
| "model": "nvidia-micro/minimaxai/minimax-m3", | |
| "model": "minimaxai/minimax-m3", |
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| "code-reviewer": { | ||
| "model": "nvidia/nemotron-3-ultra-550b-a55b", | ||
| "steps": 25 | ||
| "model": "nvidia/deepseek-ai/deepseek-v4-pro", |
There was a problem hiding this comment.
WARNING: 3-segment model path violates the established provider/model format
deepseek-ai appears as a provider prefix in benchmark data (benchmark.py:29). The correct 2-segment format is deepseek-ai/deepseek-v4-pro.
| "model": "nvidia/deepseek-ai/deepseek-v4-pro", | |
| "model": "deepseek-ai/deepseek-v4-pro", |
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| "lane-worker": { | ||
| "model": "nvidia/nemotron-3-ultra-550b-a55b", | ||
| "steps": 25 | ||
| "model": "nvidia/z-ai/glm-5.2", |
There was a problem hiding this comment.
WARNING: 3-segment model path violates the established provider/model format
The codebase consistently uses 2-segment model identifiers (see benchmark.py:23-32, opencode.json:10, ui/app.js:265). z-ai is a registered top-level provider in provider-profiles.js:31 and routing-logger.js:115. Nesting it under nvidia/ will break provider resolution.
| "model": "nvidia/z-ai/glm-5.2", | |
| "model": "z-ai/glm-5.2", |
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| } | ||
| } | ||
| } | ||
| "model": "nvidia-micro/minimaxai/minimax-m3", |
There was a problem hiding this comment.
CRITICAL: Unknown provider namespace nvidia-micro guarantees runtime failure
nvidia-micro does not exist anywhere in the codebase or configuration. minimaxai/minimax-m3 is the established 2-segment format (see opencode.json:10). This will fail with "provider not found" on every subagent spawn.
| "model": "nvidia-micro/minimaxai/minimax-m3", | |
| "model": "minimaxai/minimax-m3", |
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
plan=kilo/nvidia/nemotron-3-ultra-550b-a55b:free, debug=openrouter/...ultra, general=opencode/deepseek-v4-flash-free, explore=kilo/nvidia/...nano-omni, code-reviewer=openrouter/...super, lane-worker=kilo/stepfun/step-3.7-flash:free, git-worker=ollama-local/qwen2.5-coder (local RTX, zero API cost). All 6 routes verified accessible via kilo roll-call. Direct nvidia key A was rate-limited (timeouts) so routes go through kilo/openrouter pools; key B (minimax) returns Forbidden. 429 headroom: 6 independent routes.
Project-scoped kilo.jsonc took precedence over root kilo.json and still pinned plan/debug/explore/code-reviewer/lane-worker/git-worker to the broken nvidia/nemotron-3-ultra-550b-a55b (ProviderModelNotFoundError). Applied same tiered spread: plan=kilo/...ultra:free, debug=openrouter/ ...ultra:free, explore=kilo/...nano-omni, code-reviewer=openrouter/ ...super:free, lane-worker=kilo/stepfun/step-3.7-flash:free, git-worker=ollama-local/qwen2.5-coder.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kilo.json`:
- Line 31: Update the model assignments to use Gateway IDs without the extra
kilo/ prefix: in kilo.json lines 31 and .kilo/kilo.jsonc line 35 use
nvidia/nemotron-3-ultra-550b-a55b:free; in kilo.json line 84 and
.kilo/kilo.jsonc line 79 remove kilo/; and in kilo.json line 109 and
.kilo/kilo.jsonc line 102 use stepfun/step-3.7-flash:free.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: caf96532-c868-40c6-a3dc-5781c36bbffe
📒 Files selected for processing (2)
.kilo/kilo.jsonckilo.json
Runtime loads opencode.json (opencode schema), not kilo.json — this file was pinning explore/general/git-worker/lane-worker/test-engineer to direct nvidia models and meta/llama-4-maverick which fail to resolve (ProviderModelNotFoundError). Applied the verified 6-route spread: explore=kilo/...nano-omni:free, general=opencode/deepseek-v4-flash-free, lane-worker=kilo/stepfun/step-3.7-flash:free, git-worker=ollama-local/qwen2.5-coder (local RTX), test-engineer=openrouter/nvidia/...super:free.
…ss all three configs general failed (ProviderModelNotFoundError) using root kilo.json's opencode/deepseek-v4-flash-free. Set general to the roll-call-verified openrouter/nvidia/nemotron-3-ultra-550b-a55b:free in root kilo.json, project .kilo/kilo.jsonc, and opencode.json so it wins regardless of config merge order.
Local qwen2.5-coder 3B was too weak for tool use (called plan_exit instead of answering). Swapped git-worker to verified opencode/ling-3.0-flash-free across all three configs, adding the opencode provider to the 6-route spread.
| }, | ||
| "git-worker": { | ||
| "model": "nvidia/nemotron-3-ultra-550b-a55b" | ||
| "model": "opencode/ling-3.0-flash-free" |
There was a problem hiding this comment.
CRITICAL: Unknown provider namespace opencode guarantees runtime failure
opencode does not exist as a model provider in Kilo configuration. Established providers in this codebase are kilo, openrouter, ollama-local, and stepfun. This will fail with "provider not found" on every subagent spawn.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| } | ||
| } | ||
| } | ||
| "model": "opencode/ling-3.0-flash-free", |
There was a problem hiding this comment.
CRITICAL: Unknown provider namespace opencode guarantees runtime failure
opencode does not exist as a model provider in Kilo configuration. Established providers in this codebase are kilo, openrouter, ollama-local, and stepfun. This will fail with "provider not found" on every subagent spawn.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
- resolve-post-compact-contradictions.js: fail-closed checkpoint 0 UDS gate (raise-only via max(system, operator), no bypass), bounded 8MB reverse-tail cps_log scan, atomic saveJson with PID+timestamp temp suffix, canonical baseline auto-backup, UDS_OPERATOR_PROVIDED excluded from future floors (no permanent ratchet), dedupe of identical operator UDS claims, provenance logging (operator_claimed/measured_score/effective_basis), correct PASS/FAIL gate logging - headless-self-audit.js: dual-scope systemd Result capture, broadened CRASH_RESULTS (exit-code/signal/core-dump/watchdog/timeout/start-limit/ resources), crash_loops retain resultState, false_positive RESOLVED reopen preserves adjudication and suppresses cognition handoff, self-healing recommendation-ledger dedupe by dedupe_key - test-headless-self-audit.js: add false_positive reopen regression test - recommendation-ledger.jsonl: remove stale shadow entries, mark resolved - .gitignore: quarantine-archive, compact-audit tmp, adjudication negation - evidence: POST_COMPACT_ADJUDICATIONS + TOPOLOGY_EVIDENCE artifacts
… extended, journal - S1 artifact-resolver: segment-based .. traversal + _resolveRootsFromConfig - S3 create-signed-message: PASSPHRASE_REQUIRED guard + dead import removal - S5 relay-daemon: sign-before-mkdir fail-closed ordering - C1 SchemaValidator: dead ratification removal + enum/type_check updates - T07 Checkpoint 6: real L/R blind verification with consensus gate - T08 UDS gate: classifyUdsScore + formatDriftAlert per USER_DRIFT_SCORING.md - T12 lane-worker repoRoot fix + stale fixtures (confidence, OUTPUT_PROVENANCE) - T13 uds-gate.js + test-uds-gate.js (ratchet + ledger dedupe) - T06 signed lane message to archivist (route WIP findings) - Regression: headless-self-audit 33/33, recovery PROVEN, audit aligned
…ne-discovery, rebuild-trust-stores, verify-key-ids, cleanup-forbidden-paths, canonical-message-builder), substantive 20260807-202152
… with systemd timers
… (114 scripts remain)
…alert, hygiene_report)
- Worktree-isolated commits with allowlist-based file selection - Dry-run default, no auto-push, cycle limit, circuit breaker - Replaces unsafe we4free-continuous-improvement.service - Documentation in docs/ops/PHASE8_SAFE_CI.md
| | **Dry-run default** | Commits require `--apply` flag | | ||
| | **No auto-push** | Commits stay in worktree. Operator pushes manually after review. | | ||
| | **Cycle limit** | `--max-cycles N` (default: 10). Stops after N cycles. | | ||
| | **Circuit breaker** | Stops on first error in `--apply` mode | |
There was a problem hiding this comment.
WARNING: Documented circuit breaker is not enforced by the code
docs/ops/PHASE8_SAFE_CI.md:28 advertises "Circuit breaker: Stops on first error in --apply mode", but scripts/phase8/safe-ci-daemon.js never trips it: commitChanges (L135-146) records per-file ERROR and continues, the tally is only errors (L207), and runCycle returns cycle: 'processed' (L210) regardless. The main loop breaks only on cycle === 'error' (L268), which getRepoState alone sets (L195) - so a persistent staging/commit failure is retried every cycle. (GitHub's 3,000-file enumeration cap on this 4,093-file PR blocks inline anchoring on the .js file, so its line refs are cited here.)
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
…ndlers - analyze code: file/directory structure analysis with imports, exports, functions, classes - trace symbol: find definitions and usages of symbols across codebase - find patterns: regex search with context lines in files and directories - dependency map: map imports/requires for JS/TS/Python/Rust files - compare files: detailed file comparison with add/remove/modify stats - propose improvement: create governance-compliant improvement proposals - create patch: generate patch files for proposed changes - validate improvement: validate proposals against governance rules - implement proposal: implement approved proposals within own lane All lane agents (archivist, kernel, swarmmind, library) gain these capabilities through the shared generic-task-executor.js. Writes remain constrained to own lane root; shared scripts and governance files still require convergence protocol.
…ties - add web research with curl and domain allowlist - add analyze, trace, find patterns, dependency map, compare files - add propose/validate/implement improvement workflow - add autonomous-improvement-loop.js for continuous improvement cycles - all lanes synced with new capabilities
- add web_research test for valid host content retrieval - add compare alias test for absolute paths - fix executor routing for git subcommand validation - fix compare_files regex for absolute paths - all 65 golden tests pass
1 participant
Summary
Clean CI baseline replacement for superseded PR #4.
Scope
Only added to .
Configuration
Status
CI Verification
TypeScript check will run on this PR to validate the configuration.
Summary by CodeRabbit