fix(automation): cover the full BandScope review queue

[seonghobae]

Root cause

The BandScope hourly caller capped the central oldest-first scheduler at 50 open PRs. The live repository currently has 136 open PRs, so the 2026-08-29 heartbeat inspected only PRs #731 through #925 and never reached current non-draft work such as #1052 and #1053.

Repair

• raise only the BandScope caller bound to 200, covering the current queue while retaining one writer and the two-hour same-head retry floor;
• document the observed queue-size assumption and the deliberate operator recheck if the queue approaches the bound;
• update the caller contract test and Unreleased changelog.

This changes queue coverage only. It does not broaden workflow permissions, credentials, dispatch allowlists, merge authority, or fail-closed review gates.

Verification

• python3 -m pytest -q --cov=scripts/ci --cov-report=term-missing --cov-fail-under=100: 1731 passed, 1 skipped, 17 subtests passed; 100% statements and branches
• interrogate -q --fail-under=100 scripts/ci
• python3 -m compileall -q scripts/ci
• actionlint .github/workflows/bandscope-hourly-review-repair.yml
• git diff --check

Security Notes

The caller retains contents: read and id-token: write only, maps the existing two scheduler secrets, and continues to deny secrets: inherit, NVIDIA_NIM_API_KEY, COPILOT_GITHUB_TOKEN, and mutation permissions. The scheduler remains bounded at one writer and fail-closed on review evidence.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 4 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b45e0649-7a9a-4790-a857-0c9dfecfcfeb

📥 Commits

Reviewing files that changed from the base of the PR and between 3a7941a and 02487b4.

📒 Files selected for processing (4)

• .github/workflows/bandscope-hourly-review-repair.yml
• CHANGELOG.md
• docs/doctoring/bandscope-hourly-review-caller.md
• tests/test_bandscope_hourly_review_caller.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[seonghobae]

@opencode-agent review

[seonghobae]

@opencode-agent review

[seonghobae]

@opencode-agent review

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 02487b4490b195c91752ba7a2d78e6d6849e1e8f.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33241009930/job/99070304859)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33241009930/job/99070304859)
• strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33241024964)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: bandscope-hourly-review-repair.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: bandscope-hourly-review-repair.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Repository file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: bandscope-hourly-review-caller.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: bandscope-hourly-review-caller.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["Test: test_bandscope_hourly_review_caller.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_bandscope_hourly_review_caller.py"]
  R4 --> V4["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 02487b4490b195c91752ba7a2d78e6d6849e1e8f
• Workflow run: 33241706925
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES
• Coverage gate: success
• Model pool: exhausted
• Verdict: REQUEST_CHANGES
• Formal review: fix(automation): cover the full BandScope review queue #1397 (review)

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 02487b4490b195c91752ba7a2d78e6d6849e1e8f.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33241009930/job/99070304859)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33241009930/job/99070304859)
• strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33241024964)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: bandscope-hourly-review-repair.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: bandscope-hourly-review-repair.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Repository file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: bandscope-hourly-review-caller.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: bandscope-hourly-review-caller.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["Test: test_bandscope_hourly_review_caller.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_bandscope_hourly_review_caller.py"]
  R4 --> V4["targeted test run"]

Loading

[seonghobae]

Current-head gate update for SHA 02487b4:

• The Strix scan made three bounded attempts against openai/orchestrator/free; each returned HTTP 500 internal_error, and no vulnerability report artifact was produced.
• The fail-closed result is therefore provider/backend-unavailability evidence, not a finding in this PR's four changed files.
• A same-head rerun was attempted, but GitHub Actions cancelled it while pending with no jobs because the central Strix concurrency queue was occupied.
• The OpenCode CHANGES_REQUESTED verdict is consequently waiting on the failed same-head Strix check. No security gate or review control is being bypassed.