pr-review

{
  "repo": "Levanto/Levanto-Aion",
  "review": {
    "summary": "This PR makes the CI/review pipeline correct end-to-end: scoping ci-quality to changed files with explicit skip semantics, fixing cache-dir/hyphenated-dir mypy crashes, wiring changed_files in the webhook with truncation guards, gating builds on a host-repo env var, and hardening the review-agent against prompt injection with a per-request nonce-delimited data boundary plus marker scrubbing. I verified the high-risk claims directly against the source (pagination, skip-routing in the state machine, logger/platform references) and found them sound; the prompt-injection defense is a genuine improvement. Only minor operational/code-quality items remain (a no-op-by-default build gate, mypy whole-repo skip, Dockerfile cruft and cross-arch checksum), none blocking — confidence high.",
    "verdict": "approved",
    "findings": [
      {
        "file": "agents/build-agent/agent.py",
        "lens": "architecture",
        "line": 85,
        "finding": "Stale comment 'see module-level _REPO_PATH' references the constant this PR deleted (renamed to _HOST_REPO_PATH_ENV); update the dangling reference.",
        "severity": "minor"
      },
      {
        "file": "workflows/ci-pipeline/workflow.py",
        "lens": "operational",
        "line": 228,
        "finding": "When BUILD_AGENT_HOST_REPO is unset (the documented Phase-1 default) the build stage posts aion/build = success, so if aion/build is a required status check a broken Dockerfile still merges green; the gate is effectively a no-op until the operator wires the env var.",
        "severity": "minor"
      },
      {
        "file": "agents/ci-quality-agent/agent.py",
        "lens": "operational",
        "line": 152,
        "finding": "mypy is skipped entirely in whole-repo mode (manual submissions and >20-commit pushes), so type errors go uncaught on those runs while the report still reports passed=True — coverage gap is only visible via the skipped flag.",
        "severity": "minor"
      },
      {
        "file": "apps/worker-runtime/Dockerfile",
        "lens": "operational",
        "line": 62,
        "finding": "The static docker client is downloaded to /usr/local/bin/docker, but the heavyweight docker.io package (the daemon, never run since the host socket is bind-mounted) is still apt-installed alongside it — now dead weight bloating the image.",
        "severity": "minor"
      },
      {
        "file": "apps/worker-runtime/Dockerfile",
        "lens": "operational",
        "line": 60,
        "finding": "DOCKER_CLI_SHA256 is the x86_64 hash but the download URL uses $(uname -m); an arm64 build would fetch the aarch64 tarball and fail the checksum verification — a latent cross-arch build break.",
        "severity": "minor"
      }
    ]
  },
  "base_ref": "main",
  "head_sha": "b2e682275800bfe967152e3649a51579649040cc",
  "pr_number": 16,
  "post-comment": {
    "posted": {
      "posted": true,
      "pr_number": 16,
      "body_chars": 2608,
      "comment_id": 4529937995
    }
  },
  "changed_files": [
    "agents/build-agent/agent.py",
    "agents/ci-quality-agent/agent.py",
    "agents/ci-quality-agent/tests/test_agent.py",
    "agents/review-agent/agent.py",
    "agents/review-agent/prompts/system.md",
    "apps/orchestrator-api/app/api/routes/webhooks.py",
    "apps/worker-runtime/Dockerfile",
    "docs/MODEL_ROUTING.md",
    "docs/QUICKSTART.md",
    "docs/README.md",
    "infra/scripts/sync-claude-credentials.sh",
    "pyproject.toml",
    "workflows/ci-pipeline/workflow.py"
  ],
  "dashboard_url": "http://aion.levanto.in/runs/72e08e22-cc9a-4d8a-88c0-0e066caf7883",
  "status-pending-review": {
    "posted": {
      "sha": "b2e682275800bfe967152e3649a51579649040cc",
      "state": "pending",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/72e08e22-cc9a-4d8a-88c0-0e066caf7883"
    }
  },
  "status-success-review": {
    "posted": {
      "sha": "b2e682275800bfe967152e3649a51579649040cc",
      "state": "success",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/72e08e22-cc9a-4d8a-88c0-0e066caf7883"
    }
  }
}