The live mention review on PR 7126 published two suspected hypotheses as concerns despite recording that surrounding code was unavailable. The separate publisher now requires reproduced/traced evidence with nonempty detail, requires introduced authorship for inline comments, and collapses pre-existing findings. Model summaries, risk assessments and unlinked suggestions stay in the analysis artifact so they cannot repeat a withheld allegation. An empty result remains advisory and links to analysis/coverage. This is an evidence-record boundary, not independent reproduction or proof of accuracy; the Engine remains the review authority.
Validation: existing Action checks 8 passed, 0 failed; Node syntax checks and diff whitespace check passed. Offline replay of actual run 40835017974 artifact withheld both suspected claims and emitted zero inline comments. Direct local variations covered empty/missing evidence, introduced/preexisting/unknown attribution, escaping and deduplication; a mocked publisher run reported 0 eligible and 2 withheld findings without network/provider calls or GitHub writes. No new tests, Rust build or hosted CI. Legacy post:true retains its pinned CLI policy. Refs CW-7503.
Live run 40832077629 completed a full DeepSeek review (4387 input, 544 output, zero reasoning tokens), then correctly stopped publication because the existing App was not installed on codewhale-hq/Codewhale. Generated App workflows now validate installation in a separate credential-isolated job before admitting model usage. Reuse one installation-token step template; the analysis job still receives only a read-only GitHub token and its selected provider key. Local verification: actionlint passes for both App and default-token generated workflows; Node syntax and whitespace checks pass. Existing review runtime source/evidence is unchanged. Installation approval is pending; no App permission was granted by this source commit.
The installed v0.10.2 binary identifies source 3400ebb5c9, whose review triage caps small reviews at 4000 output tokens regardless of the environment ceiling. Live runs 40830663408 and 40831324211 exhausted all 4000 tokens as reasoning and correctly published nothing. Current Engine source already removes that fixed cap, but unreleased source is not a substitute for a checksummed release. Add a validated reasoning-effort input, applied through a fresh secret-free isolated Engine configuration. Generated workflows default to off for this released compatibility boundary; users can select an explicit level or auto. Local verification: existing Action tests 8 passed, 0 failed; syntax, generated workflow actionlint and whitespace checks pass. No new tests or code comments; next live acceptance is on the newly pinned source.
Live run 40830663408 reached DeepSeek but used all 4000 automatically allowed output tokens and returned no review. Publication was skipped. Generate an explicit 16384-token allowance, configurable with --max-output-tokens, and retain sanitized reasoning counts. Recognize the released CLI infrastructure/not_produced envelope as incomplete without logging raw provider/model errors. Local verification: existing review checks 8 passed, 0 failed; direct failure-envelope classification and actionlint pass. The running workflow still references the prior reviewed Action commit; the next source pin update carries this repair.
Generate a workflow with immutable Action refs, exact release/model selection,
separate read-only analysis and credential-isolated publication, and optional
existing GitHub App identity. Reuse the Engine review command and installer.
Accept exact review mentions from current write/maintain/admin users; recheck
original and rerunning actors, comment identity/body and current revisions.
Opt-in inert fork diffs only through trusted default-branch manual or issue
comment triggers. Mentions require the separate publisher. No candidate code,
hooks or project configuration is executed. Share provider-key metadata with
the generator and redact every supported key, including OrcaRouter.
Local verification: existing node review tests 8 passed, 0 failed; Node syntax
checks and actionlint pass for default-token and App workflows. Direct offline
execution completed mention -> findings -> inline publisher, refused 10 unsafe
request cases, refused fork analysis without opt-in and cross-attempt findings,
and confirmed provider-key isolation/redaction. No new tests or code comments.
Live GitHub/provider acceptance follows separately; no release or moving tag.
action.yml defaulted `provider` to `codewhale`, the account machine-key
relay, while docs/GITHUB_ACTION.md says to use explicit BYOK unless the
account route has been separately verified. `provider` is now a required
input with no default, and scripts/github-action/review.mjs no longer
falls back to `codewhale`: an empty provider stops with
configuration_missing / provider_required before any release download
or model call. The OrcaRouter and other BYOK key handling from
6f92f0d5e2 is unchanged; `codewhale` remains selectable explicitly.
.github/workflows/codewhale-review.yml (disabled_manually on GitHub)
falls back to CLI v0.10.2, the current release, instead of v0.10.0. It
still names the account provider explicitly. No secret, variable or
workflow state was changed.
Docs: the BYOK section is no longer labelled optional and the bounds
table lists `provider` as required.
Verification: node --test scripts/github-action/review.test.mjs -> 8
pass, 0 fail. Direct settings() call with no CW_PROVIDER stopped with
{"outcome":"configuration_missing","reason":"provider_required"}.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The explicit provider allowlist omitted OrcaRouter. Pass only ORCAROUTER_API_KEY to its existing Engine route and keep no-key failure closed. The setup example uses our existing public referral and orcarouter/free, with required authentication and rate/runner limits disclosed. No provider or credential fallback.
Validation:8 existing Action cases pass, expanded existing assertions cover missing Orca key, exact route, selected-secret isolation and receipt redaction. Actual unauthenticated POST orcarouter/free returned401 Invalid API key on2026-10-26; no authenticated provider completion. Whitespace pass. No workflow enabled or deployed.
GitHub Action exports validated structured findings for a separate trusted publisher with current-head checks and dedupe. Telegram persists prompt identity before cursor advancement, reconciles the same Engine operation and retains uncertain final replies for explicit status recovery. DingTalk internal-app Stream adapter reuses bridge-core admission, approvals and question parsing. Extracted existing Weixin question helpers into shared core; no second turn loop.
Local evidence:168 existing bridge/Telegram/Weixin/Feishu/WeCom checks pass,1existing skip;9 actual local HTTP bridge-process scenarios pass including restart/identity/question/uncertain-final delivery. Action8 existing tests plus30 injected publisher/contract scenarios pass. DingTalk20 injected transport scenarios pass plus syntax/SDK import; no live connection. Feature derivation/whitespace pass. Staged shared registry/changelog/facts exclude concurrent instruction-budget work. No new tests/comments, native build, provider completion, workflow activation or deploy. Refs CW-6864.
Replace per-PR Rust builds and green provider non-runs with the released CLI,
account relay configuration, immutable Git objects and bounded JSON receipts.
Preserve advisory findings while failing missing/incomplete execution visibly.
Add manual recovery, reusable setup docs and the thin in-repo caller.
Validation: Action + existing installer tests 31 passed, 0 failed. Workflow
contract checks passed; actionlint syntax passed with shellcheck disabled
(existing ci.yml shellcheck warnings remain). npm test passed: 68 + 16 + 54
Node tests and 536 web tests (674 total), 0 failed. npm run check:web passed.
Last receipt-only change covered by the 31 focused tests; broad gates were
not repeated. No live provider, workflow enablement, release or publication.
CodeWhale Bot