alissa-tools-github-revloop 0.16.3__tar.gz → 0.16.5__tar.gz

{alissa_tools_github_revloop-0.16.3/src/main/alissa_tools_github_revloop.egg-info → alissa_tools_github_revloop-0.16.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.16.3
+Version: 0.16.5
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_revloop-0.16.3 → alissa_tools_github_revloop-0.16.5}/src/main/alissa/tools/github/revloop/config.py

@@ -23,6 +23,10 @@ from typing import Any, Mapping
 # A POSIX-ish environment variable name -- what `reviewer_token_env` must be.
 _ENV_NAME_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
 
+# The per-character half of the same rule, used to name the offending
+# characters in an error without echoing the value (see _describe).
+_ENV_CHAR_RE = re.compile(r"[A-Za-z0-9_]")
+
 # ...which, on its own, accepts every GitHub credential format: `ghp_`, `gho_`,
 # `ghu_`, `ghs_`, `ghr_` and `github_pat_` tokens are `[A-Za-z0-9_]` throughout
 # and therefore valid identifiers. So the shape has to be rejected explicitly,
@@ -30,9 +34,13 @@ _ENV_NAME_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
 # its variable's NAME belongs -- sails through.
 _TOKEN_SHAPE_RE = re.compile(r"^(gh[pousr]_|github_pat_)", re.IGNORECASE)
 
-# No environment variable name comes close (`REVLOOP_REVIEWER_GH_TOKEN` is 25);
-# every GitHub token, including the 40-character legacy hex ones, exceeds it.
-MAX_ENV_NAME_LENGTH = 32
+# Generous on purpose. A tighter ceiling (32 was tried) rejects names an
+# operator can plausibly write -- `REVLOOP_REVIEWER_GITHUB_TOKEN_ENV` is 33 --
+# and this bound is NOT what catches credentials: MIN_SECRET_RUN_LENGTH is,
+# and it catches a 40-character hex token on its shape whatever the ceiling
+# says. So the ceiling exists only to refuse the obviously absurd, and it is
+# deliberately kept OUT of `_is_credential_shaped` (see there).
+MAX_ENV_NAME_LENGTH = 40
 
 # Length is not the whole discriminator, because a secret can be short enough
 # to fit under the ceiling. The shape is: a long, undifferentiated run of
@@ -47,10 +55,14 @@ def _is_credential_shaped(value: str) -> bool:
     A heuristic, and deliberately one that errs toward accusing: the cost of a
     false positive is renaming a variable, and the cost of a false negative is
     a live credential sitting in a config file on a shared volume.
+
+    Length is deliberately NOT one of the clauses. It was, and it made a merely
+    LONG name get classified as a credential -- rejected, redacted, and told to
+    rotate itself. Over-length is a separate refusal with its own message; only
+    an actual credential SHAPE drives redaction.
     """
     return bool(
         _TOKEN_SHAPE_RE.match(value)
-        or len(value) > MAX_ENV_NAME_LENGTH
         or (
             len(value) >= MIN_SECRET_RUN_LENGTH
             and "_" not in value
@@ -60,18 +72,30 @@ def _is_credential_shaped(value: str) -> bool:
 
 
 def _describe(value: str) -> str:
-    """Name a rejected value in the error -- redacted only when it has to be.
+    """Say what is wrong with a rejected value without reprinting a secret.
 
     `__main__` prints this to stderr as `config error: …`, straight into the
-    container log, so a pasted secret must not be duplicated there: those get
-    length plus a short prefix. But the other way to fail this check is an
-    ordinary typo (`REVLOOP-REVIEWER-GH-TOKEN`), and there the value IS the
-    diagnostic -- redacting it turns a one-glance fix into a puzzle. The two
-    are separable now that credential shapes are identified explicitly.
+    container log, so a pasted credential must never be echoed there. But the
+    other way to fail this check is an ordinary typo
+    (`REVLOOP-REVIEWER-GH-TOKEN`), and there the value IS the diagnostic.
+
+    Redacting everything loses the typo case; echoing whatever the GitHub-shape
+    heuristic does not recognise hands back the container-log disclosure for
+    every non-GitHub secret (`sk-proj-…`, `xoxb-…`, `glpat-…` all carry
+    punctuation and match no clause above). So neither branch prints the value:
+    what an operator needs is WHICH CHARACTERS were rejected, and those can be
+    named with their positions and nothing else.
     """
     if _is_credential_shaped(value):
-        return f'a {len(value)}-character value starting "{value[:4]}…"'
-    return repr(value)
+        return f"a {len(value)}-character value that looks like a credential"
+    offenders = sorted({c for c in value if not _ENV_CHAR_RE.match(c)})
+    if offenders:
+        where = ", ".join(
+            f"{c!r} at {', '.join(str(i) for i, ch in enumerate(value) if ch == c)}"
+            for c in offenders
+        )
+        return f"a {len(value)}-character value containing {where}"
+    return f"a {len(value)}-character value"
 
 
 # What to do when a PR has a pending review request but no matching Alissa
@@ -322,7 +346,11 @@ class Config:
             # rather than exposed. So the check is two-sided: it must LOOK like
             # a name, and it must not look like a credential. The value itself
             # is never echoed back (see _redact).
-            if not _ENV_NAME_RE.match(token_env) or _is_credential_shaped(token_env):
+            if (
+                not _ENV_NAME_RE.match(token_env)
+                or _is_credential_shaped(token_env)
+                or len(token_env) > MAX_ENV_NAME_LENGTH
+            ):
                 rotate = (
                     " If that is a credential, rotate it: it is now in a config file."
                     if _is_credential_shaped(token_env)
@@ -330,7 +358,8 @@ class Config:
                 )
                 raise ValueError(
                     f"reviewer_token_env must be an environment variable NAME "
-                    f"(e.g. 'REVLOOP_REVIEWER_GH_TOKEN'), not a value or a "
+                    f"(e.g. 'REVLOOP_REVIEWER_GH_TOKEN') of at most "
+                    f"{MAX_ENV_NAME_LENGTH} characters, not a value or a "
                     f"token — got {_describe(token_env)}.{rotate}"
                 )
 

{alissa_tools_github_revloop-0.16.3 → alissa_tools_github_revloop-0.16.5}/src/main/alissa/tools/github/revloop/ghclient.py

@@ -15,6 +15,7 @@ without it the client inherits, exactly as it always did.
 
 from __future__ import annotations
 
+import json
 import logging
 import os
 import re
@@ -41,11 +42,15 @@ SUBMITTED_STATES = {"APPROVED", "CHANGES_REQUESTED", "COMMENTED", "DISMISSED"}
 PER_PAGE = 100
 COMMENT_PAGE_LIMIT = 20
 
-# Same bound for the PR's commit list. Read only when a review POST was
-# rejected (see pull_request_commits), and a partial answer there is worse than
-# none -- so unlike the comment list, exceeding this raises rather than
-# returning a truncated list a caller could misread as "the SHA is gone".
-COMMIT_PAGE_LIMIT = 20
+# GitHub's OWN cap on the pull-request commits endpoint: it "lists a maximum of
+# 250 commits" and refers callers with more to the repository commits endpoint.
+# That, not a page count of ours, is where absence stops being provable -- a
+# 250-entry answer looks complete (the last page is short) while saying nothing
+# about commit 251. And the direction is hostile: the endpoint returns commits
+# OLDEST first, so on a longer PR the 250 returned are the oldest and a recent
+# `judged` head is absent from every read. Unguarded, the "is the pinned commit
+# gone?" probe would answer yes on every large PR and abandon real verdicts.
+PR_COMMIT_CAP = 250
 
 # Environment variables `gh` reads a token from. Both are cleared before an
 # explicitly-routed call, so an inherited implementer credential cannot win by
@@ -92,6 +97,12 @@ class PullRequest:
     # "open" or "closed"; merged PRs report state "closed" AND merged True.
     state: str = "open"
     merged: bool = False
+    # Logins GitHub currently holds a pending review request against. Read off
+    # the same PR payload as everything else here, so knowing whether this
+    # daemon's own request is still dangling costs no extra call. USERS only:
+    # `requested_teams` is a separate field and is deliberately not carried,
+    # because nothing in the loop may ever withdraw a team's request.
+    requested_reviewers: tuple[str, ...] = ()
 
     @property
     def full_name(self) -> str:
@@ -327,9 +338,23 @@ class GitHub:
             )
         return actual
 
-    def _api(self, *args: str, timeout: int = 60, forbidden_is_rate_limit: bool = True):
+    def _api(
+        self,
+        *args: str,
+        timeout: int = 60,
+        forbidden_is_rate_limit: bool = True,
+        body: "dict | None" = None,
+    ):
         """One `gh api` call, with GitHub's throttling mapped to RateLimited.
 
+        `body` is for requests whose payload must have a particular JSON SHAPE.
+        `gh`'s `-f` fields cannot express one portably: `-f 'k[]=v'` is encoded
+        as the array `{"k": ["v"]}` only by modern `gh`, and as a string field
+        NAMED `k[]` by the 2.4.0 this client targets -- silently, so the
+        request goes out well-formed and simply missing the key the endpoint
+        wants. Passing the body on stdin through `--input -` (which 2.4.0 does
+        support) takes every `gh` version out of the encoding decision.
+
         `forbidden_is_rate_limit` is about one ambiguity: GitHub answers a
         secondary rate limit with 403, so a bare "403" in stderr is read as
         throttling by default, and `run_forever` backs off. That default is
@@ -344,8 +369,13 @@ class GitHub:
         that pass False: an explicit throttling marker still raises
         RateLimited, and everything else stays a CommandError they can handle.
         """
+        argv = ["gh", "api", *args]
+        stdin = None
+        if body is not None:
+            argv += ["--input", "-"]
+            stdin = json.dumps(body)
         try:
-            return run_json(["gh", "api", *args], timeout=timeout, env=self._env())
+            return run_json(argv, timeout=timeout, env=self._env(), stdin=stdin)
         except CommandError as exc:
             blob = exc.stderr.lower()
             throttled = any(marker in blob for marker in RATE_LIMIT_MARKERS)
@@ -398,6 +428,11 @@ class GitHub:
             url=data.get("html_url", ""),
             state=data.get("state") or "open",
             merged=bool(data.get("merged")),
+            requested_reviewers=tuple(
+                str((u or {}).get("login") or "")
+                for u in (data.get("requested_reviewers") or [])
+                if (u or {}).get("login")
+            ),
         )
 
     def reviews(self, owner: str, repo: str, number: int) -> list[Review]:
@@ -432,14 +467,15 @@ class GitHub:
         this" from "this can never succeed", so it is worth a call, but only
         there; nothing on the common path reads it.
 
-        Paged like `issue_comments`, and bounded the same way. Truncation is
-        logged and matters here in one direction only: a SHA missing from a
-        truncated list would read as "gone" when it is merely on a later page.
-        The caller must therefore treat an empty/short read conservatively --
-        see loop._abandon_verdict, which only abandons on a complete read.
+        Raises `TruncatedListing` rather than returning a possibly-incomplete
+        list, because the caller uses ABSENCE as evidence and a short answer
+        cannot support that. The bound is GitHub's own 250 (PR_COMMIT_CAP), not
+        a page count of ours: at 250 the last page is short and the listing
+        looks complete while saying nothing about the commits past it.
         """
         out: list[str] = []
-        for page in range(1, COMMIT_PAGE_LIMIT + 1):
+        page = 1
+        while True:
             data = (
                 self._api(
                     "-X",
@@ -453,16 +489,20 @@ class GitHub:
                 or []
             )
             out.extend(str(c.get("sha") or "") for c in data)
+            if len(out) >= PR_COMMIT_CAP:
+                log.warning(
+                    "%s/%s#%d reached GitHub's %d-commit listing cap — the "
+                    "commit list is not complete, so a missing SHA cannot be "
+                    "read as absent",
+                    owner, repo, number, PR_COMMIT_CAP,
+                )
+                raise TruncatedListing(
+                    f"{owner}/{repo}#{number} reached GitHub's {PR_COMMIT_CAP}-commit "
+                    f"listing cap; absence cannot be proven from it"
+                )
             if len(data) < PER_PAGE:
                 return out
-        log.warning(
-            "%s/%s#%d has more than %d commits — the list is truncated, so a "
-            "missing SHA cannot be read as absent",
-            owner, repo, number, COMMIT_PAGE_LIMIT * PER_PAGE,
-        )
-        raise TruncatedListing(
-            f"{owner}/{repo}#{number} has more than {COMMIT_PAGE_LIMIT * PER_PAGE} commits"
-        )
+            page += 1
 
     def my_reviews(self, owner: str, repo: str, number: int) -> list[Review]:
         """My substantive submitted reviews, oldest first -- one per round.
@@ -538,6 +578,38 @@ class GitHub:
         data = self._api(*argv, forbidden_is_rate_limit=False) or {}
         return str(data.get("html_url") or "")
 
+    def remove_review_request(
+        self, owner: str, repo: str, number: int, login: str
+    ) -> None:
+        """Withdraw the pending review request held against ONE login.
+
+        The payload names exactly one reviewer, never the whole list: GitHub's
+        DELETE removes only what it is given, so a human reviewer or a second
+        bot sitting in the same `requested_reviewers` array is untouched. The
+        caller is the round close-out (loop._clear_own_review_request), and the
+        only login it ever passes is the daemon's own.
+
+        The body goes out through `--input` rather than `-f 'reviewers[]=…'`,
+        because that field syntax means different things on different `gh`
+        versions and this client targets 2.4.0, where it produces a string
+        field literally named `reviewers[]` -- no `reviewers` key, a 422, and a
+        feature that never worked. See `_api`.
+
+        `forbidden_is_rate_limit=False` for the same reason `submit_review`
+        passes it: a 403 here is this identity not being allowed to edit the
+        PR's reviewers, which is a fact about the deployment that its caller
+        logs and degrades on -- not a throttle worth backing the whole poll
+        pass off for. Note the permission is `pull_requests: write`, strictly
+        more than reviewing needs.
+        """
+        self._api(
+            "-X",
+            "DELETE",
+            f"repos/{owner}/{repo}/pulls/{number}/requested_reviewers",
+            body={"reviewers": [login]},
+            forbidden_is_rate_limit=False,
+        )
+
     def comment(self, owner: str, repo: str, number: int, body: str) -> None:
         run_json(
             [

{alissa_tools_github_revloop-0.16.3 → alissa_tools_github_revloop-0.16.5}/src/main/alissa/tools/github/revloop/loop.py

@@ -399,6 +399,70 @@ def capout_kind(head_sha: str, granted: int) -> str:
     return f"capout:{head_sha}:{granted}"
 
 
+def identity_drift_kind(requested: str, author: str) -> str:
+    """The ping-ledger kind that dedupes ONE request/author identity-drift warning.
+
+    Scope is once per PR per ordered login pair -- the ledger keys on
+    `(repo, number, kind)`, so folding the pair into the kind narrows the
+    dedupe WITHIN a PR and cannot lift it above one. What the pair buys is that
+    a drift which later becomes a DIFFERENT drift announces itself again
+    instead of staying quiet because this PR once warned about something else.
+
+    Durable rather than in-memory because it is a configuration alarm, not a
+    per-poll observation: a restart re-stating it on every open PR would be a
+    wall of noise. Per-PR is bounded in practice by the withdrawal itself --
+    once the request is gone the PR leaves the poll set, so a drifted
+    deployment emits one block per PR it closes a round on, not one per poll.
+    """
+    return f"reqdrift:{requested}->{author}"
+
+
+def drift_probe_kind(head_sha: str) -> str:
+    """The ping-ledger kind that bounds the drift check's EXTRA read.
+
+    The check needs the unfiltered review list, which `my_reviews` cannot
+    supply -- a review by another identity is exactly what it filters out. That
+    is one more API call, and on a PR whose withdrawal fails permanently (a
+    reviewer identity without `pull_requests: write`) the close-out path runs
+    every poll, so "one extra call on the rare path" would quietly become one
+    per poll forever.
+
+    Keyed on the head so the probe re-runs when the code moves -- a new head
+    means a new round and a new chance for its verdict to land under the wrong
+    login -- and recorded only once the review list has actually been READ, so
+    an unreadable list retries instead of being settled by a failure.
+    """
+    return f"driftprobe:{head_sha}"
+
+
+def withdraw_failed_kind(exc: BaseException) -> str:
+    """The ping-ledger kind that dedupes a failing review-request withdrawal.
+
+    Retrying a failed DELETE is right -- a 403 can be a permission grant away
+    from working. Re-LOGGING it every poll is not: the common failure is
+    permanent and per-PR, so at a 30s poll interval one such PR would emit
+    ~2,880 warning lines a day that never converge on anything.
+
+    Keyed on the exception class, not its message: a message carries the PR
+    and the moment, which would defeat the dedupe, while a 403 that later
+    becomes a 422 is a genuinely different condition and says so once.
+    """
+    return f"withdraw-failed:{type(exc).__name__}"
+
+
+def withdrawn_kind(head_sha: str) -> str:
+    """The ping-ledger kind that marks a review request already withdrawn at
+    this head -- so a request that COMES BACK is distinguishable from the first
+    one.
+
+    Withdrawing is the daemon undoing a state change a human or an automation
+    made on GitHub. Doing it once at a head is routine close-out; doing it
+    again means somebody deliberately asked for another look and the daemon
+    took it away, which is worth a louder line than the first.
+    """
+    return f"withdrawn:{head_sha}"
+
+
 def _now() -> str:
     """The activity comment's timestamp format (UTC, seconds)."""
     return time.strftime("%Y-%m-%d %H:%M:%S UTC", time.gmtime())
@@ -508,6 +572,11 @@ class Action(str, Enum):
     # window, or the post failed and is being retried. Either way the round is
     # NOT closed and nothing downstream of it runs.
     AWAITING_POST = "awaiting-post"
+    # The round's verdict can never be posted -- the head it judged is gone
+    # from the PR. Distinct from AWAITING_POST on purpose: that one retries,
+    # this one has given up, and the poll snapshot and console aggregate the
+    # action rather than the reason.
+    ABANDONED = "abandoned"
 
 
 @dataclass(frozen=True)
@@ -617,16 +686,21 @@ class ReviewWatcher:
         # purpose: an approve envelope with no native APPROVE behind it would
         # otherwise close the loop with no verdict of record on GitHub and the
         # review request still dangling -- the studio #298 failure.
-        # ...unless the post was ABANDONED, which happens only when the head the
-        # round judged is gone from the PR. There is then no commit left to
-        # record that verdict against, and holding the round open would strand
-        # the PR outside the loop forever; the round is released instead and a
-        # fresh one is owed against the new head. See _abandon_verdict.
-        if (
-            task is not None
-            and completed > native
-            and not self.state.verdict_post_abandoned(pr.full_name, number, completed)
-        ):
+        # ...discounting rounds whose post was ABANDONED, which happens only
+        # when the head the round judged is gone from the PR. There is then no
+        # commit left to record that verdict against, and holding the round
+        # open would strand the PR outside the loop forever; the round is
+        # released instead and a fresh one is owed against the new head (see
+        # _abandon_verdict).
+        #
+        # The discount is a SUBTRACTION, not just a check on the newest round.
+        # An abandoned round's envelope stays on the task forever while its
+        # review record never exists, so it leaves a permanent hole between the
+        # two counts -- and an uncorrected hole reads, on the NEXT round, as
+        # "that round has no native verdict", producing a duplicate post over a
+        # session that closed its own round correctly.
+        owed = completed - self.state.abandoned_rounds(pr.full_name, number)
+        if task is not None and owed > native:
             # Terminal for this pass either way. On a landed post the review
             # request it consumed drops the PR out of the search, so
             # convergence and the next round belong to the next pass, decided
@@ -636,6 +710,13 @@ class ReviewWatcher:
 
         converged = self._convergence_reason(my_reviews, task, pr.head_sha)
         if converged is not None:
+            # THE terminal branch: a verdict of record exists at the current
+            # head, so no round k+1 can be owed from here -- every path that
+            # could open one (head moved, non-approve verdict, cap re-entry
+            # ack) is either upstream of this return or unreachable past it.
+            # That is what makes it the only safe place to withdraw a dangling
+            # self review request; see _clear_own_review_request.
+            self._clear_own_review_request(pr, my_reviews, converged)
             return Decision(Action.CONVERGED, converged, completed)
 
         # The effective cap is the configured one plus every re-entry an
@@ -737,6 +818,7 @@ class ReviewWatcher:
             pr.full_name, pr.number, round_, self._judged_head(pr, round_)
         )
         attempts = int(row["attempts"])
+        # `left` decides; `reason` only ever reaches a caller when left > 0.
         if attempts == 0:
             # The grace window: measured from the first observation, because it
             # is about the round's own session getting its chance, not about
@@ -907,7 +989,7 @@ class ReviewWatcher:
             f"A fresh round is owed against `{pr.head_sha[:8]}`.",
         )
         return Decision(
-            Action.AWAITING_POST,
+            Action.ABANDONED,
             f"round {round_}'s native verdict was abandoned — {why}",
             round_,
             task_ref=task.ref,
@@ -1279,6 +1361,193 @@ class ReviewWatcher:
 
         return None
 
+    # -- round close-out ---------------------------------------------------
+
+    def _clear_own_review_request(
+        self, pr: PullRequest, my_reviews: list[Review], why: str
+    ) -> None:
+        """Withdraw this daemon's own dangling review request on a closed round.
+
+        Normally there is nothing to do: GitHub consumes a review request the
+        moment the requested identity submits a review, so a converged PR has
+        no request left and drops straight out of `review_requests`. The
+        request survives when the review that closed the round was NOT posted
+        by the requested identity -- studio #298, where a ready-flip
+        auto-requested `alissa-app` while the round ran under another login.
+        Nothing then ever consumes it, so the PR stays in the search set and
+        every poll pays a full re-verification (PR fetch, reviews, task,
+        envelope count) to reach this same no-op. Removing the request is what
+        ends that: the search is the evaluation set, so the PR leaves it.
+
+        Four properties this must not violate:
+
+        * Only ever OUR login. Human reviewers and any second bot in the same
+          `requested_reviewers` array are somebody else's pending work, and a
+          daemon that withdrew them would silently cancel real reviews.
+        * Only from the terminal branch. The caller is the one return where a
+          verdict of record stands at the current head and no further round can
+          be owed; a request withdrawn while a round could still open would
+          delete the very trigger that surfaces the PR.
+        * Only on a HEAD-BOUND verdict. `_convergence_reason` cannot check a
+          review that carries no `commit_id` and lets it converge anyway; that
+          convergence is not about the current head, so withdrawing on it would
+          take a PR out of the daemon's sight on a verdict that might be about
+          old code. Such a review is not producible today -- `submit_review`
+          always pins a commit and GitHub populates it -- but the terminal
+          argument must hold on its own terms rather than by inheritance, so
+          the check is repeated here.
+        * Never blocking. The removal is a side effect of a decision already
+          made, so any failure -- including a throttled one -- is logged and
+          dropped rather than raised: the pass keeps walking and the next poll
+          retries, which is strictly better than converting a no-op into an
+          aborted pass. (Deliberately unlike the read paths, which let
+          RateLimited reach run_forever's backoff.)
+
+        `my_reviews` is non-empty at every call site -- `_convergence_reason`
+        returns None on an empty one -- so its newest entry IS the verdict of
+        record, read positionally rather than defended against.
+        """
+        mine = self.github.login
+        if mine not in pr.requested_reviewers:
+            return
+
+        verdict = my_reviews[-1]
+        if not verdict.commit_id:
+            log.debug(
+                "%s: not withdrawing the review request — the converged review "
+                "%s carries no commit_id, so convergence is not head-bound",
+                pr.slug, verdict.url or "with no url",
+            )
+            return
+
+        # Above the dry-run guard: the drift check reads, records a ledger row
+        # and logs, but takes nothing on GitHub -- it OBSERVES the pass rather
+        # than acting in it, the same reasoning that writes poll snapshots in
+        # dry-run. Dry-run is also the mode an operator reaches for to diagnose
+        # exactly this, so staying silent about it there is the worst place.
+        self._warn_identity_drift(pr)
+
+        if self.config.dry_run:
+            log.info(
+                "[dry-run] would withdraw the dangling review request for %s on "
+                "%s — the round is closed (%s)",
+                mine, pr.slug, why,
+            )
+            return
+
+        try:
+            self.github.remove_review_request(pr.owner, pr.repo, pr.number, mine)
+        except Exception as exc:
+            kind = withdraw_failed_kind(exc)
+            if self.state.pinged(pr.full_name, pr.number, kind):
+                # Still retried, just not re-announced; see withdraw_failed_kind.
+                log.debug(
+                    "%s: withdrawal still failing for %s (%s)", pr.slug, mine, exc
+                )
+                return
+            self.state.record_ping(pr.full_name, pr.number, kind)
+            log.warning(
+                "%s: could not withdraw the dangling review request for %s (%s) "
+                "— the closed round will be re-evaluated next poll and the "
+                "removal retried. Withdrawing needs `pull_requests: write`, "
+                "which is more than reviewing needs; further failures of this "
+                "kind log at debug",
+                pr.slug, mine, exc,
+            )
+            return
+
+        others = [login for login in pr.requested_reviewers if login != mine]
+        left = ", ".join(others) if others else "no other reviewers"
+        kind = withdrawn_kind(pr.head_sha)
+        if self.state.pinged(pr.full_name, pr.number, kind):
+            # The request came back at a head this daemon already closed out.
+            # Someone asked for another look at code that still carries its
+            # approve -- and the daemon has just taken their request away, so
+            # say so where they will find it.
+            log.warning(
+                "%s round close-out: the review request for %s came back at "
+                "head %s and was withdrawn AGAIN — the approve at that head "
+                "still stands (%s), so no round is owed; only a new commit "
+                "opens one. Verdict of record %s. Left in place: %s",
+                pr.slug, mine, pr.head_sha[:8], why, verdict.url, left,
+            )
+            return
+        self.state.record_ping(pr.full_name, pr.number, kind)
+        log.info(
+            "%s round close-out: withdrew the dangling review request for %s — "
+            "%s; verdict of record %s at head %s. Left in place: %s",
+            pr.slug, mine, why, verdict.url, pr.head_sha[:8], left,
+        )
+
+    def _warn_identity_drift(self, pr: PullRequest) -> None:
+        """Page once when the round's write-up landed under a login GitHub does
+        not hold the request against.
+
+        This is the #298 shape: the request names one identity, the newest
+        review on the PR carries another, and GitHub only ever consumes a
+        request when the REQUESTED login submits. Withdrawing the request
+        cleans up this PR; the config that produced it will produce the next
+        one too, so it is worth one loud line naming both identities.
+
+        Diagnostic only -- it never gates the removal, and an unreadable review
+        list just means no warning, not a stalled close-out.
+
+        The extra read it needs is bounded to once per (PR, head); see
+        drift_probe_kind for why that bound exists at all.
+
+        In `--dry-run` this touches the ping ledger in NEITHER direction: it
+        always probes, always warns, and records nothing. Both halves matter.
+        Writing would let a diagnostic pass durably silence the daemon it was
+        run to diagnose -- `state_db` has no dry-run branch, so the rows land in
+        the same `state.db` production reads, and the alarm is once-per-PR. And
+        reading would silence the DIAGNOSTIC instead: a production pass that
+        already probed this head would make the operator's dry-run print
+        nothing. The cost is one review read per dry-run poll, which is the
+        right trade -- dry-run withdraws nothing, so the PR stays in the poll
+        set regardless, and the probe bound exists to protect the production
+        failure loop, not a run an operator is watching.
+        """
+        record = not self.config.dry_run
+
+        probe = drift_probe_kind(pr.head_sha)
+        if record and self.state.pinged(pr.full_name, pr.number, probe):
+            return
+
+        try:
+            reviews = self.github.reviews(pr.owner, pr.repo, pr.number)
+        except Exception as exc:
+            # Deliberately not recorded: a read that failed settles nothing.
+            log.debug("%s: could not read reviews for the drift check: %s", pr.slug, exc)
+            return
+        if record:
+            self.state.record_ping(pr.full_name, pr.number, probe)
+
+        substantive = [r for r in reviews if r.is_substantive]
+        if not substantive:
+            return
+        newest = max(substantive, key=lambda r: r.submitted_at)
+        if newest.author == self.github.login:
+            return
+
+        kind = identity_drift_kind(self.github.login, newest.author)
+        if record:
+            if self.state.pinged(pr.full_name, pr.number, kind):
+                return
+            self.state.record_ping(pr.full_name, pr.number, kind)
+        log.warning(
+            "IDENTITY DRIFT on %s: the review request is held against %r but "
+            "the round's newest review was submitted by %r (%s). GitHub only "
+            "consumes a review request when the REQUESTED login submits, so "
+            "native review consumption cannot work for this deployment: every "
+            "closed round will leave a dangling request for the daemon to "
+            "withdraw. Point reviewer_login/reviewer_token_env at one identity "
+            "and have that identity post the verdict of record.",
+            pr.slug,
+            self.github.login,
+            newest.author,
+            newest.url or "no url",
+        )
+
     # -- reap sweep --------------------------------------------------------
 
     def sweep_sessions(self) -> int:
@@ -2154,6 +2423,7 @@ class ReviewWatcher:
             reaped=reaped,
             posted=counts[Action.POSTED],
             awaiting_post=counts[Action.AWAITING_POST],
+            abandoned=counts[Action.ABANDONED],
             stages=stages,
         )
 

{alissa_tools_github_revloop-0.16.3 → alissa_tools_github_revloop-0.16.5}/src/main/alissa/tools/github/revloop/proc.py

@@ -36,12 +36,20 @@ def run(
     check: bool = True,
     cwd: "str | os.PathLike[str] | None" = None,
     env: "Mapping[str, str] | None" = None,
+    stdin: "str | None" = None,
 ) -> str:
     """Run a command, return stdout. Never uses shell=True.
 
     `env`, when given, REPLACES the child's environment rather than adding to
     it -- that is what makes it an identity guarantee: a credential the caller
     did not put in the mapping cannot reach the child by inheritance.
+
+    `stdin` feeds the child's standard input. It exists for `gh api --input -`:
+    `gh`'s `-f key=value` fields are encoded differently across `gh` versions
+    (`key[]=v` is a JSON array only on modern builds, a string field named
+    `key[]` on the 2.4.0 this client targets), so a request whose body must
+    have a particular JSON SHAPE is built by the caller and piped in, where no
+    version gets a say in it.
     """
     log.debug("exec: %s", " ".join(argv))
     try:
@@ -52,6 +60,7 @@ def run(
             timeout=timeout,
             cwd=str(cwd) if cwd is not None else None,
             env=dict(env) if env is not None else None,
+            input=stdin,
         )
     except subprocess.TimeoutExpired as exc:
         raise CommandError(argv, -1, f"timed out after {timeout}s") from exc
@@ -66,9 +75,10 @@ def run_json(
     *,
     timeout: int = 60,
     env: "Mapping[str, str] | None" = None,
+    stdin: "str | None" = None,
 ):
     """Run a command whose stdout is JSON."""
-    out = run(argv, timeout=timeout, env=env).strip()
+    out = run(argv, timeout=timeout, env=env, stdin=stdin).strip()
     if not out:
         return None
     try:

{alissa_tools_github_revloop-0.16.3 → alissa_tools_github_revloop-0.16.5}/src/main/alissa/tools/github/revloop/state.py

@@ -128,6 +128,7 @@ CREATE TABLE IF NOT EXISTS poll_snapshots (
     reaped            INTEGER NOT NULL,
     posted            INTEGER NOT NULL DEFAULT 0,
     awaiting_post     INTEGER NOT NULL DEFAULT 0,
+    abandoned         INTEGER NOT NULL DEFAULT 0,
     stages_json       TEXT    NOT NULL
 );
 """
@@ -140,6 +141,7 @@ CREATE TABLE IF NOT EXISTS poll_snapshots (
 _SNAPSHOT_ADDED_COLUMNS = (
     ("posted", "INTEGER NOT NULL DEFAULT 0"),
     ("awaiting_post", "INTEGER NOT NULL DEFAULT 0"),
+    ("abandoned", "INTEGER NOT NULL DEFAULT 0"),
 )
 
 
@@ -509,6 +511,23 @@ class State:
         row = self.get_verdict_post(repo, number, round_)
         return bool(row is not None and row["abandoned_at"])
 
+    def abandoned_rounds(self, repo: str, number: int) -> int:
+        """How many of this PR's rounds will never have a native verdict.
+
+        Each one leaves a permanent hole between the envelope count and the
+        review count -- the envelope is on the task forever, the review record
+        never exists -- so every later comparison of the two has to subtract
+        it. Without that the daemon reads the hole as "the newest round has no
+        native verdict" and posts a redundant one on the round AFTER each
+        abandonment.
+        """
+        row = self._db.execute(
+            "SELECT COUNT(*) AS n FROM verdict_posts "
+            "WHERE repo=? AND number=? AND abandoned_at IS NOT NULL",
+            (repo, number),
+        ).fetchone()
+        return int(row["n"]) if row else 0
+
     def record_verdict_post(
         self, repo: str, number: int, round_: int, review_url: str
     ) -> None:
@@ -551,6 +570,7 @@ class State:
         reaped: int = 0,
         posted: int = 0,
         awaiting_post: int = 0,
+        abandoned: int = 0,
         stages: list[dict],
     ) -> None:
         """Append one poll-pass observation, then prune to the newest
@@ -566,8 +586,8 @@ class State:
             "INSERT INTO poll_snapshots "
             "(ts, duration_ms, candidates, spawned, stale_reenqueued, "
             "in_flight, deferred, converged, capped, escalated, skipped, "
-            "reaped, posted, awaiting_post, stages_json) "
-            "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
+            "reaped, posted, awaiting_post, abandoned, stages_json) "
+            "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
             (
                 int(time.time()),
                 duration_ms,
@@ -583,6 +603,7 @@ class State:
                 reaped,
                 posted,
                 awaiting_post,
+                abandoned,
                 json.dumps(stages, separators=(",", ":")),
             ),
         )

alissa_tools_github_revloop-0.16.5/src/main/alissa/tools/github/revloop/version

@@ -0,0 +1 @@
+0.16.5

{alissa_tools_github_revloop-0.16.3 → alissa_tools_github_revloop-0.16.5}/src/main/alissa/tools/github/revloop/webui/page.py

@@ -208,6 +208,8 @@ section.panel {
   border-color: var(--status-pending); background: var(--status-pending-bg); }
 .pill.converged, .pill.posted { color: var(--status-in-progress);
   border-color: var(--status-in-progress); background: var(--status-in-progress-bg); }
+.pill.abandoned { color: var(--status-cancelled);
+  border-color: var(--status-cancelled); background: var(--status-cancelled-bg); }
 .pill.awaiting-post { color: var(--status-blocked);
   border-color: var(--status-blocked); background: var(--status-blocked-bg); }
 .pill.capped { color: var(--status-cancelled);

{alissa_tools_github_revloop-0.16.3 → alissa_tools_github_revloop-0.16.5/src/main/alissa_tools_github_revloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.16.3
+Version: 0.16.5
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_revloop-0.16.3/src/main/alissa/tools/github/revloop/version

@@ -1 +0,0 @@
-0.16.3