pr-review

{
  "repo": "Levanto/Levanto-Aion",
  "review": {
    "summary": "The PR genuinely improves the review-agent (per-file diff inlining + an UNTRUSTED-PR-DATA prompt-injection boundary), webhook change-file scoping, and docs, but it folds substantial unannounced logic changes into a self-declared 'docs + 3 fixes / zero findings' PR. Blocking issue: the build-agent now reports the merge-gating build check as passed without building anything whenever BUILD_AGENT_HOST_REPO is unset (the default), producing a false-green gate; several smaller operational/security gaps (unverified docker-binary download, untimed GitHub call in the webhook path, silent mypy skip, state rename) accompany it. Moderate-to-high confidence; a few findings rest on truncated patches.",
    "verdict": "changes_requested",
    "findings": [
      {
        "file": "agents/build-agent/agent.py",
        "lens": "operational",
        "line": 110,
        "finding": "When BUILD_AGENT_HOST_REPO is unset (the documented Phase-1 default), the agent returns BuildReport(passed=True) for every target without building anything, so the merge-gating `aion/build` check reports green even though no image was built — a false-positive CI signal that lets a broken Dockerfile merge under the appearance of a passing build.",
        "severity": "major"
      },
      {
        "file": "apps/worker-runtime/Dockerfile",
        "lens": "security",
        "line": 56,
        "finding": "The static `docker` binary is curl-piped into the image and installed with no SHA256 checksum or signature verification; since this client later drives the bind-mounted host docker socket (effectively host-root), an integrity check on the download would be warranted defense-in-depth.",
        "severity": "minor"
      },
      {
        "file": "apps/orchestrator-api/app/api/routes/webhooks.py",
        "lens": "performance",
        "line": 108,
        "finding": "list_pull_request_files is awaited synchronously inside the webhook handler before enqueueing with no timeout, so a slow or rate-limited GitHub API delays the webhook acknowledgement that GitHub expects to return quickly.",
        "severity": "minor"
      },
      {
        "file": "agents/ci-quality-agent/agent.py",
        "lens": "operational",
        "line": 110,
        "finding": "Whole-repo mode (empty changed_files, e.g. manual submissions) skips mypy entirely and reports it as passed=True, silently dropping type-check coverage rather than surfacing that the gate ran degraded.",
        "severity": "minor"
      },
      {
        "file": "workflows/ci-pipeline/workflow.py",
        "lens": "operational",
        "line": 50,
        "finding": "Renaming the state-machine state `ci-quality` to `ci_quality` is potentially breaking for any in-flight or persisted run, dashboard timeline, or external reference keyed on the old state name, and ships with no migration note.",
        "severity": "minor"
      },
      {
        "file": "agents/review-agent/agent.py",
        "lens": "operational",
        "line": 48,
        "finding": "The PR is described and self-reviewed as a docs-plus-3-line-fix with '0 Critical, 0 Major, 0 Minor', but the actual changeset includes substantive behavioral changes to build-agent, ci-quality-agent, review-agent, the webhook handler, and the Dockerfile that the description neither lists nor reviews — the self-review claim does not cover the shipped code.",
        "severity": "minor"
      }
    ]
  },
  "base_ref": "main",
  "head_sha": "8e32b3d76514e510ff0417883f851443e12a0b42",
  "pr_number": 16,
  "post-comment": {
    "posted": {
      "posted": true,
      "pr_number": 16,
      "body_chars": 3178,
      "comment_id": 4529862590
    }
  },
  "changed_files": [
    "agents/build-agent/agent.py",
    "agents/ci-quality-agent/agent.py",
    "agents/ci-quality-agent/tests/test_agent.py",
    "agents/review-agent/agent.py",
    "agents/review-agent/prompts/system.md",
    "apps/orchestrator-api/app/api/routes/webhooks.py",
    "apps/worker-runtime/Dockerfile",
    "docs/MODEL_ROUTING.md",
    "docs/QUICKSTART.md",
    "docs/README.md",
    "infra/scripts/sync-claude-credentials.sh",
    "workflows/ci-pipeline/workflow.py"
  ],
  "dashboard_url": "http://aion.levanto.in/runs/cc282e8a-de3e-48c8-ab36-ba9efba55a8e",
  "status-failure-review": {
    "posted": {
      "sha": "8e32b3d76514e510ff0417883f851443e12a0b42",
      "state": "failure",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/cc282e8a-de3e-48c8-ab36-ba9efba55a8e"
    }
  },
  "status-pending-review": {
    "posted": {
      "sha": "8e32b3d76514e510ff0417883f851443e12a0b42",
      "state": "pending",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/cc282e8a-de3e-48c8-ab36-ba9efba55a8e"
    }
  }
}