codna 0.2.56__tar.gz → 0.2.57__tar.gz

{codna-0.2.56 → codna-0.2.57}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.56
+Version: 0.2.57
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.56 → codna-0.2.57}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.56"
+__version__ = "0.2.57"

{codna-0.2.56 → codna-0.2.57}/codna/agent-core/CLINE_SDK_AZ_INTEGRATION_PLAN.md

@@ -2,7 +2,7 @@
 
 > Status: **proposal for review** (no code yet). Principle: drive the agent loop with the
 > vendored Apache-2.0 Cline SDK end to end; plug the Algenta engine (250-language repo
-> intelligence + the Mojo decision engine + the capability plane) **behind** it as tools,
+> intelligence + the Mojo runtime + the capability plane) **behind** it as tools,
 > hooks, and MCP — not a re-implementation. Boundary stays self-hosted HTTP
 > (see `project_sdk_transport_boundary`): Cline (Node head) calls the Algenta engine over
 > the local `/v1/repositories` + capability-plane API; no cloud.

{codna-0.2.56 → codna-0.2.57}/codna/review.py

@@ -9,6 +9,7 @@ triage (suspect files/symbols + context reduction).
 from __future__ import annotations
 
 import os
+import re
 import shutil
 import subprocess
 
@@ -55,6 +56,30 @@ def _env_check_run_id() -> int | None:
     return int(raw) if raw.isdigit() else None
 
 
+_SHA_RE = re.compile(r"[0-9a-f]{7,40}")
+
+
+def _env_check_run_head_sha() -> str | None:
+    """``CODNA_CHECK_RUN_HEAD_SHA``: the commit the caller anchored that Check Run to, reported back
+    in ``--json`` (``posted.check_head_sha``) next to the head this review actually read, so a
+    caller can see the two disagree (thyn-ai/codna#569). Unset or not a SHA -> None."""
+    raw = os.environ.get("CODNA_CHECK_RUN_HEAD_SHA", "").strip().lower()
+    return raw if _SHA_RE.fullmatch(raw) else None
+
+
+def _pr_head_now(repo_slug: str | None, pr_number: int | None, token: str | None) -> str | None:
+    """The pull request's head at this moment, or None when it cannot be read. Read right before
+    posting: a head that moved while the review ran must not receive the review's approval."""
+    if not (repo_slug and pr_number):
+        return None
+    from . import review_github as rg
+
+    try:
+        return rg.fetch_pr(repo_slug, pr_number, token).get("head_sha") or None
+    except Exception:  # noqa: BLE001 -- best-effort; an unreadable head is reported as unknown, never as moved
+        return None
+
+
 def _wrapped_details(exc: BaseException) -> dict[str, object]:
     """Structured detail carried by a wrapped error, if it has any.
 
@@ -294,7 +319,9 @@ def run_findings_review(args) -> dict:
                 _fail("--post needs a write token: pass --github-token or set GITHUB_TOKEN.")
             try:
                 out["posted"] = rg.post_review(result, repo_slug=repo_slug, pr_number=pr_number, token=token,
-                                               check_run_id=_env_check_run_id(), approve=cfg.approve_clean)
+                                               check_run_id=_env_check_run_id(), approve=cfg.approve_clean,
+                                               check_head_sha=_env_check_run_head_sha(),
+                                               pr_head_sha=_pr_head_now(repo_slug, pr_number, token))
             except Exception as exc:  # noqa: BLE001
                 _fail(f"posting the review failed: {exc}")
         return out

{codna-0.2.56 → codna-0.2.57}/codna/review_github.py

@@ -431,9 +431,16 @@ def parse_pr_arg(value: str, repo_dir: str) -> tuple[str | None, int | None]:
     return repo_slug_from_git(repo_dir), None
 
 
+def head_moved_note(reviewed: str, current: str) -> str:
+    """The approval line when the pull request's head is no longer the one this review read."""
+    return (f"⏸ Not approved: the pull request head moved from {reviewed[:8]} to {current[:8]} while this "
+            f"review ran; the current head gets a review of its own.")
+
+
 def post_review(
     result: ReviewResult, *, repo_slug: str, pr_number: int, token: str, dedup: bool = True,
     check_run_id: int | None = None, approve: bool = True,
+    check_head_sha: str | None = None, pr_head_sha: str | None = None,
 ) -> dict:
     """Post ONE review (+ the "codna review" check) to the PR. Returns a small status dict.
 
@@ -441,6 +448,14 @@ def post_review(
     APPROVE -- see :func:`review_event` for exactly when. A PR the App itself authored cannot be
     approved by the App (GitHub answers 422); that case falls back to a COMMENT.
 
+    ``pr_head_sha`` is the pull request's head as the caller read it right before posting. When it
+    differs from ``result.head_sha`` the head moved while the review ran: the review is still posted
+    against the commit it read, but never as an APPROVE -- a pull request approval counts for the
+    whole pull request, and nobody reviewed the new head (thyn-ai/codna#569). ``check_head_sha`` is
+    the commit the caller's ``check_run_id`` is anchored to. Both are returned as they are (None =
+    unknown), next to the reviewed head, so a caller of ``codna review --json`` can see the three
+    disagree; when this function creates the check itself, it is anchored to the reviewed head.
+
     ``dedup`` fetches existing PR review comments and skips fingerprints Codna already posted, so a
     re-run on the same head does not duplicate threads. ``check_run_id`` (the webhook passes it as
     ``CODNA_CHECK_RUN_ID``) is a Check Run the caller already opened for this review: it is
@@ -484,6 +499,15 @@ def post_review(
     # body is still a finding of this pass.
     event = review_event(result, unresolved_blocking=unresolved, approve=approve)
     note = approval_note(event, result, unresolved, approve=approve)
+    head_moved = bool(pr_head_sha and result.head_sha and pr_head_sha != result.head_sha)
+    if head_moved:
+        # The verdict is about the commit this review read; the pull request's head is another one.
+        # Findings still go up (they are anchored to the reviewed commit), an approval does not.
+        moved = head_moved_note(str(result.head_sha), str(pr_head_sha))
+        if event == "APPROVE":
+            event, note = "COMMENT", moved
+        else:
+            note = f"{note} {moved}"
 
     inline_found = len(result.inline_findings)
     demoted = 0
@@ -565,4 +589,8 @@ def post_review(
         "skipped_duplicates": inline_found - len(payload["comments"]) - demoted,
         "demoted_to_summary": demoted,
         "check": check,
+        # The three commits a caller needs to compare: what the check is on, what was reviewed
+        # (``head_sha`` in the enclosing result) and where the pull request stands now.
+        "check_head_sha": check_head_sha if check_run_id is not None else result.head_sha,
+        "pr_head_sha": pr_head_sha,
     }

{codna-0.2.56 → codna-0.2.57}/codna/webhook_control.py

@@ -137,6 +137,19 @@ class JobHandle:
             self._token = token or self._token
             self._check_run_id = check_run_id if check_run_id is not None else self._check_run_id
 
+    def retarget(self, ref: str) -> None:
+        """Record the head this job actually works on, once the worker has resolved it.
+
+        A review job is registered with the head its EVENT carried, but it reviews the pull
+        request's head as of its start (``review._materialize_pr`` fetches ``pull/N/head``), and
+        the worker anchors its Check Run there (thyn-ai/codna#569). Superseding compares against
+        this ref, so it has to be the reviewed head: otherwise the late-delivered event for that
+        very head would cancel the job already reviewing it, and ``/healthz`` would name a commit
+        the job is not looking at.
+        """
+        with self._lock:
+            self.ref = ref
+
     def finalize(self) -> bool:
         """True for exactly one caller: whoever gets it owns writing this job's terminal queue row.
 

{codna-0.2.56 → codna-0.2.57}/codna/webhook_github.py

@@ -268,17 +268,21 @@ def complete_check_run_if_open(repo_full_name: str, token: str, check_run_id: in
 
 
 def complete_stale_check_runs(
-    repo_full_name: str, token: str, *, head_sha: str, name: str, summary: str
+    repo_full_name: str, token: str, *, head_sha: str, name: str, summary: str,
+    conclusion: str = "cancelled",
 ) -> int:
-    """Complete (as ``cancelled``) every still-``in_progress`` Check Run named ``name`` on
-    ``head_sha``. Returns how many were closed. Best-effort hygiene: never raises.
+    """Complete (as ``conclusion``, default ``cancelled``) every still-``in_progress`` Check Run
+    named ``name`` on ``head_sha``. Returns how many were closed. Best-effort hygiene: never raises.
 
     A run this worker opened and then lost -- killed mid-job by a redeploy, or a crash before
     update_check_run -- stays "in progress" on that commit forever, because only the App that
     created a Check Run may complete it and nothing else ever will. Observed live:
     thyn-ai/algenta@cc26ddd6 `codna fix` in_progress from 2026-09-17 04:49 onward. Called right
     before a fresh run is created for the same (sha, name), so a retry supersedes its dead
-    predecessor instead of stacking a second spinner next to it.
+    predecessor instead of stacking a second spinner next to it -- and, as ``neutral``, on the
+    event SHA of a review whose pull request head had already moved when the job started
+    (thyn-ai/codna#569): a run left ``in_progress`` on a commit nobody is merging still strands
+    automation that waits for "all checks complete".
     """
     try:
         import httpx
@@ -306,7 +310,7 @@ def complete_stale_check_runs(
             continue
         try:
             update_check_run(
-                repo_full_name, token, run_id, conclusion="cancelled", summary=summary, name=name
+                repo_full_name, token, run_id, conclusion=conclusion, summary=summary, name=name
             )
             closed += 1
         except Exception:  # noqa: BLE001 — someone else's run, already completed, or a transport error

{codna-0.2.56 → codna-0.2.57}/codna/webhook_pool.py

@@ -226,6 +226,9 @@ class WorkerPool:
             self._queue.complete(qjob.row_id, status="done" if result.ok else "failed",
                                  result={"summary": result.summary, "attempt": qjob.attempts},
                                  retry=result.retryable, retry_after_s=result.retry_after_s)
+            # A review whose pull request head moved while it ran: the head it did NOT review is
+            # queued now, after this row is terminal, so nothing about it can hold the row open.
+            webhook_worker.requeue_moved_head(qjob, result, self._queue)
         except WebhookError as exc:
             webhook_worker._log_worker_failure(qjob, code=exc.code, message=str(exc))
             if self._may_finalize(handle):

{codna-0.2.56 → codna-0.2.57}/codna/webhook_queue.py

@@ -155,11 +155,17 @@ class WebhookQueue:
             )
         return ids
 
-    def enqueue(self, job: WebhookJob, *, delivery_id: str | None, priority: int = 0) -> bool:
+    def enqueue(self, job: WebhookJob, *, delivery_id: str | None, priority: int = 0,
+                unless_pending: bool = False) -> bool:
         """Insert a job. Returns False if this delivery_id was already enqueued (dedup), or if it
         is a CI-failure fix for a (repo, ref) that already has one queued, running, or finished in
         the last 24 h -- every red check_suite on a PR head fires its own delivery, and one fix
-        attempt per head is all that can ever be useful."""
+        attempt per head is all that can ever be useful.
+
+        ``unless_pending`` also returns False when a job of this kind for exactly this pull request
+        head is already queued, retrying or running -- decided INSIDE the insert's own transaction,
+        so a delivery for that head landing between the check and the insert cannot slip a second
+        row in (the worker's requeue of a head that moved under a review, thyn-ai/codna#569)."""
         if job.reason == "check_suite_failure" and job.ref:
             cutoff = (datetime.now(timezone.utc) - timedelta(hours=24)).isoformat()
             with self._conn() as conn:
@@ -176,6 +182,10 @@ class WebhookQueue:
             # forever, and the pool would work through commits that no longer exist.
             conn.execute("BEGIN IMMEDIATE")
             try:
+                if unless_pending and self._pending_within(conn, repo=job.repo_full_name, pr_number=job.pr_number,
+                                                           ref=job.ref, kind=job.kind):
+                    conn.execute("COMMIT")
+                    return False
                 cur = conn.execute(
                     "INSERT OR IGNORE INTO jobs "
                     "(delivery_id, kind, repo, ref, installation_id, issue_number, pr_number, context, "
@@ -207,6 +217,27 @@ class WebhookQueue:
                 raise
         return inserted
 
+    @staticmethod
+    def _pending_within(conn: sqlite3.Connection, *, repo: str, pr_number: int | None, ref: str | None,
+                        kind: str) -> bool:
+        """The ``has_pending`` predicate inside a transaction the CALLER owns (see ``enqueue``)."""
+        if not repo or pr_number is None or not ref:
+            return False
+        row = conn.execute(
+            "SELECT 1 FROM jobs WHERE repo=? AND pr_number=? AND kind=? AND ref=? "
+            "AND status IN ('queued','retry','running') LIMIT 1",
+            (repo, pr_number, kind, ref),
+        ).fetchone()
+        return row is not None
+
+    def has_pending(self, *, repo: str, pr_number: int | None, ref: str | None, kind: str) -> bool:
+        """Whether a job of ``kind`` for exactly this pull request head is already waiting or
+        running (thyn-ai/codna#569: one review of a head is all that is ever useful). A read for
+        diagnostics and tests; a caller about to INSERT uses ``enqueue(unless_pending=True)``, which
+        asks the same question inside the insert's transaction."""
+        with self._conn() as conn:
+            return self._pending_within(conn, repo=repo, pr_number=pr_number, ref=ref, kind=kind)
+
     def claim(self, *, reserve_priority: bool = False) -> QueuedJob | None:
         """Atomically claim the next runnable job (retryable rows included). None if empty.
 

{codna-0.2.56 → codna-0.2.57}/codna/webhook_worker.py

@@ -26,7 +26,7 @@ import socket
 import subprocess
 import sys
 import tempfile
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from pathlib import Path
 from typing import Any, Callable
 
@@ -117,6 +117,9 @@ class JobResult:
     check_completed: bool = False  # the CLI already completed the job's Check Run (a review's findings)
     neutral: bool = False  # settled non-run (the sandbox cannot run the repo's tests): ok, check ends neutral
     cancelled: bool = False  # stopped from outside (head moved, or the job deadline): never a failure
+    # A review found the pull request head had moved while it ran: the check on the reviewed
+    # commit stands, and this head needs a review of its own. The pool queues it (requeue_moved_head).
+    requeue_head: str | None = None
 
     @property
     def conclusion(self) -> str:
@@ -281,7 +284,7 @@ def _job_env(
     token: str | None, engine_key: str | None,
     provider: str | None = None, provider_key: str | None = None,
     *, tmp: str | None = None, git_identity: tuple[str, str] | None = None,
-    check_run_id: int | None = None,
+    check_run_id: int | None = None, check_head_sha: str | None = None,
 ) -> dict[str, str]:
     """Minimal allowlisted env + the scoped GitHub token, per-org Codna key, and (when the
     linked org has configured one) their own BYOK provider key — set consistently regardless of
@@ -316,6 +319,10 @@ def _job_env(
         # The Check Run this job opened. `codna review --post` completes THAT run with its findings
         # instead of opening a second one, so a review shows as ONE "codna review" check.
         env["CODNA_CHECK_RUN_ID"] = str(check_run_id)
+    if check_head_sha:
+        # The commit that run is anchored to, so the CLI's `--json` output can say whether the
+        # check, the reviewed head and the pull request's head agree (review_github.post_review).
+        env["CODNA_CHECK_RUN_HEAD_SHA"] = check_head_sha
     return env
 
 
@@ -323,6 +330,7 @@ def run_codna_job(job: WebhookJob, *, token: str | None, engine_key: str | None,
                   provider: str | None = None, provider_key: str | None = None,
                   codna_bin: str = "codna", git_identity: tuple[str, str] | None = None,
     check_run_id: int | None = None, control: JobHandle | None = None,
+    check_head_sha: str | None = None,
 ) -> JobResult:
     """Default runner: run packaged codna for the job in an isolated, scrubbed workspace.
 
@@ -379,7 +387,7 @@ def run_codna_job(job: WebhookJob, *, token: str | None, engine_key: str | None,
             try:
                 proc = _run_job_process(
                     argv, env=_job_env(token, engine_key, provider, provider_key, tmp=tmp, git_identity=git_identity,
-                                   check_run_id=check_run_id),
+                                   check_run_id=check_run_id, check_head_sha=check_head_sha),
                     cwd=tmp, timeout=_JOB_TIMEOUT_S,
                     on_process=control.attach_process if control is not None else None,
                 )
@@ -422,6 +430,103 @@ def run_codna_job(job: WebhookJob, *, token: str | None, engine_key: str | None,
                          check_completed=completed)
 
 
+def _current_pr_head(job: WebhookJob, token: str, github: Any) -> str | None:
+    """The pull request's head right now, or None when the client cannot say (no helper, an API
+    error). Never raises: the caller falls back to the head the event carried."""
+    lookup = getattr(github, "pull_request_head_sha", None)
+    if not callable(lookup) or not job.pr_number:
+        return None
+    try:
+        head = lookup(job.repo_full_name, token, job.pr_number)
+    except Exception:  # noqa: BLE001 -- a lookup hiccup must not fail the job; the event head still works
+        return None
+    return str(head) if head else None
+
+
+def _review_head_at_start(qjob: QueuedJob, token: str, github: Any, control: JobHandle | None) -> str | None:
+    """Resolve the head a review job is about to review, so its Check Run is anchored THERE.
+
+    The review reads the pull request's CURRENT head (``review._materialize_pr`` fetches
+    ``pull/N/head``), not the SHA the queued event carried; when the head moved between the event
+    and this job starting -- a rebase while the queue was saturated, or a late delivery -- a check
+    created on the event SHA lands on a commit that is no longer the head. The branch ruleset then
+    sees the required `codna review` as ABSENT and an approved pull request stays BLOCKED
+    (thyn-ai/algenta#1085: event head 7679ecbe, reviewed head 5a3ba5ff, check on 7679ecbe;
+    thyn-ai/codna#569). Superseding covers the case where the NEW head's event arrives; this
+    covers the case where it does not.
+
+    When the head moved, any run this App still has ``in_progress`` on the event SHA is completed
+    ``neutral`` -- left open it would strand automation waiting for "all checks complete" on a
+    commit nobody is merging -- and the job's cancellation handle is retargeted so the late event
+    for the resolved head does not supersede the job already reviewing it. Returns None when the
+    head cannot be read: the caller keeps the event head, which is today's behaviour.
+    """
+    job = qjob.job
+    head = _current_pr_head(job, token, github)
+    if not head:
+        return None
+    name = check_run_name(job.kind)
+    if job.ref and head != job.ref:
+        _log_worker_phase(qjob, "head_moved_before_start", event_head=job.ref, head=head)
+        complete_stale = getattr(github, "complete_stale_check_runs", None)
+        if callable(complete_stale):
+            try:
+                complete_stale(
+                    job.repo_full_name, token, head_sha=job.ref, name=name, conclusion="neutral",
+                    summary=f"{name}: head moved to {head[:8]} before the review started; "
+                            f"see the check on that commit.",
+                )
+            except Exception:  # noqa: BLE001 -- hygiene on the stale commit must never block this job's own run
+                pass
+    if control is not None:
+        control.retarget(head)
+    return head
+
+
+def _review_head_at_end(qjob: QueuedJob, token: str, github: Any, reviewed: str) -> str | None:
+    """The pull request's head if it moved away from ``reviewed`` during the turn, else None.
+
+    The review just posted is valid evidence for ``reviewed`` and its check stays there; the new
+    head needs a review of its own, which the pool queues from the returned value. Only a head the
+    lookup could read counts: an unreadable head is not a moved one.
+    """
+    head = _current_pr_head(qjob.job, token, github)
+    if not head or head == reviewed:
+        return None
+    _log_worker_phase(qjob, "head_moved_during_turn", reviewed_head=reviewed, head=head)
+    return head
+
+
+def requeue_moved_head(qjob: QueuedJob, result: JobResult, queue: Any) -> bool:
+    """Queue a review of the head a review job found had moved under it. True when a row was added.
+
+    Priority 1 within the merge-gating class, like the boot reconciler's requeue: that head is
+    already waiting on a check the ruleset requires. Skipped when a job for exactly that head is
+    already queued or running -- the new head's own event may have arrived meanwhile -- decided by
+    the queue inside the insert's own transaction (``enqueue(unless_pending=True)``), so a delivery
+    landing in between cannot make it two; the enqueue's supersede retires whatever older heads are
+    still waiting. Best-effort: never raises.
+    """
+    head = result.requeue_head
+    job = qjob.job
+    if not head or job.kind != "review" or not job.pr_number or queue is None:
+        return False
+    enqueue = getattr(queue, "enqueue", None)
+    if not callable(enqueue):
+        return False
+    try:
+        added = bool(enqueue(
+            WebhookJob("review", job.repo_full_name, ref=head, pr_number=job.pr_number,
+                       installation_id=job.installation_id, reason="head_moved_during_review"),
+            delivery_id=f"head-moved-{qjob.row_id}-{head}", priority=1, unless_pending=True,
+        ))
+    except Exception as exc:  # noqa: BLE001 -- the review that just posted must not fail over this
+        _log_worker_phase(qjob, "head_moved_requeue_failed", head=head, error=type(exc).__name__)
+        return False
+    _log_worker_phase(qjob, "head_moved_requeued" if added else "head_moved_requeue_skipped", head=head)
+    return added
+
+
 def _inherit_review_for_merge_group(job: WebhookJob, token: str | None, github: Any) -> JobResult:
     """Post the PR head's completed ``codna review`` verdict as the merge group's own check.
 
@@ -645,7 +750,12 @@ def process_job(
 
     ci_note: str | None = None
     check_id = None
-    if token and job.ref:
+    # The commit this job's Check Run is anchored to: the head the event carried -- except for a
+    # review, which reads the pull request's CURRENT head and must report there (#569).
+    check_sha = job.ref
+    if token and job.kind == "review" and job.pr_number:
+        check_sha = _review_head_at_start(qjob, token, github, control) or job.ref
+    if token and check_sha:
         # A retry (recover_stale after a restart, or attempt 2/3 after a crash) must supersede the
         # run its predecessor left "in progress" on this commit -- only this App can complete it,
         # so otherwise it spins forever next to the new one (thyn-ai/algenta@cc26ddd6 `codna fix`,
@@ -657,14 +767,14 @@ def process_job(
             # run of this name on the commit would be a concurrent sibling job's LIVE one.
             try:
                 complete_stale(
-                    job.repo_full_name, token, head_sha=job.ref, name=check_run_name(job.kind),
+                    job.repo_full_name, token, head_sha=check_sha, name=check_run_name(job.kind),
                     summary=f"{check_run_name(job.kind)}: an earlier attempt was interrupted (worker restart); "
                             f"superseded by a new run ({job.reason}).",
                 )
             except Exception:  # noqa: BLE001 — hygiene must never block creating this job's own run
                 pass
         check_id = github.create_check_run(
-            job.repo_full_name, token, name=check_run_name(job.kind), head_sha=job.ref,
+            job.repo_full_name, token, name=check_run_name(job.kind), head_sha=check_sha,
             summary=f"{check_run_name(job.kind)} started ({job.reason})",
         )
         if check_id and on_check_run:
@@ -691,7 +801,8 @@ def process_job(
         identity_fn = getattr(github, "app_bot_identity", None)
         git_identity = identity_fn(app_id, private_key) if callable(identity_fn) else None
         result = runner(job, token=token, engine_key=engine_key, provider=provider, provider_key=provider_key,
-                        git_identity=git_identity, check_run_id=check_id, control=control)
+                        git_identity=git_identity, check_run_id=check_id, control=control,
+                        check_head_sha=check_sha if check_id else None)
     except Exception as exc:  # noqa: BLE001 — a check-run this function opened must always be
         # completed, even on a crash the runner itself didn't turn into a JobResult (run_codna_job
         # only catches subprocess.TimeoutExpired). Without this, check_id is created above but
@@ -705,13 +816,26 @@ def process_job(
         # GitHub refused it and the failure was swallowed. Close it here, through the same
         # never-clobber helper, so a cancelled job can never leave a required check `in_progress`.
         webhook_control.close_check_run(control, summary=result.summary, github=github)
+    moved_note: str | None = None
+    if job.kind == "review" and token and check_sha and not result.cancelled:
+        # Did the head move while the review ran? The check on the reviewed commit stands -- the
+        # review is evidence for THAT commit -- and the new head gets a review of its own, queued
+        # by the pool from ``requeue_head``. Never an approval carried onto a head nobody reviewed:
+        # the CLI's own post-time head check downgrades one (review_github.post_review). A cancelled
+        # job is left alone: whatever superseded it is already driving the new head.
+        moved_to = _review_head_at_end(qjob, token, github, check_sha)
+        if moved_to:
+            result = replace(result, requeue_head=moved_to)
+            moved_note = (f"The pull request head has since moved to {moved_to[:8]}; that head is queued "
+                          f"for its own {check_run_name(job.kind)} run.")
     if check_id and token and not result.check_completed:
         # A review's CLI already completed this run with its findings (see _job_env): overwriting it
         # here would replace the findings with a one-line wrapper summary.
         github.update_check_run(
             job.repo_full_name, token, check_id,
             conclusion=result.conclusion,
-            summary=result.summary + (f"\n\n{ci_note}" if ci_note else ""), name=check_run_name(job.kind),
+            summary=result.summary + "".join(f"\n\n{note}" for note in (ci_note, moved_note) if note),
+            name=check_run_name(job.kind),
         )
     # An issue-label fix has neither a commit (no check_id: job.ref is never set for this trigger)
     # nor a comment thread (no reply_to) to report through, so the issue itself is the ONLY place it
@@ -821,15 +945,17 @@ def _log_worker_failure(qjob: QueuedJob, *, code: str, message: str) -> None:
     print(json.dumps(payload, sort_keys=True), file=sys.stderr, flush=True)
 
 
-def _log_worker_phase(qjob: QueuedJob, phase: str) -> None:
+def _log_worker_phase(qjob: QueuedJob, phase: str, **fields: object) -> None:
     """One stderr JSON line per job phase, so a stalled job is locatable from `fly logs`.
 
     Until now a job only ever logged its FAILURE. A job that wedged (or was killed) between claim
     and its first visible action left no trace at all: on 2026-09-17 two `@codna fix` jobs sat
     silent for hours with `/ready` green, and there was nothing to grep for. `event` differs from
-    the failure line's so the two never get confused in a filter.
+    the failure line's so the two never get confused in a filter. ``fields`` are extra keys a
+    phase wants on record (the two heads of a move, for one).
     """
     payload = _job_log_context(qjob)
+    payload.update(fields)
     payload["event"] = "job_phase"
     payload["phase"] = phase
     print(json.dumps(payload, sort_keys=True), file=sys.stderr, flush=True)

{codna-0.2.56 → codna-0.2.57}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.56
+Version: 0.2.57
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.56 → codna-0.2.57}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.56"
+version = "0.2.57"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.2.56 → codna-0.2.57}/tests/test_review_findings.py

@@ -1255,3 +1255,124 @@ def test_post_review_retry_does_not_repeat_a_finding_already_threaded_on_the_pr(
     assert "already threaded" not in posts[-1]["body"] and threaded.fingerprint not in posts[-1]["body"]
     assert out["event"] == "COMMENT"                                        # the medium finding still counts
     assert (out["inline_posted"], out["skipped_duplicates"], out["demoted_to_summary"]) == (0, 1, 1)
+
+
+# ---- codna#569: the check's anchor, the reviewed head and the PR's head, side by side -------------
+_REVIEWED = "h" * 40          # _ar().head_sha
+_MOVED_TO = "5a3ba5ff" + "0" * 32
+
+
+def _capture_check_summaries(monkeypatch):
+    from codna import webhook_github
+    summaries = []
+    monkeypatch.setattr(webhook_github, "create_check_run", lambda *a, **k: 777)
+    monkeypatch.setattr(webhook_github, "update_check_run", lambda *a, **k: summaries.append(k["summary"]))
+    monkeypatch.setattr(rg, "fetch_pr_files", lambda *a, **k: None)
+    return summaries
+
+
+def test_post_review_reports_the_check_anchor_and_the_pr_head_next_to_the_reviewed_head(monkeypatch):
+    """The three commits automation needs to compare (algenta#1085 had check != reviewed head)."""
+    import httpx
+    _stub_checks(monkeypatch)
+    monkeypatch.setattr(rg, "unresolved_blocking_findings", lambda *a, **k: 0)
+    class _Ok:
+        status_code, text = 200, ""
+    monkeypatch.setattr(httpx, "post", lambda url, **k: _Ok())
+    # the webhook's run: the anchor is whatever the caller says, the PR head is what it read at post time
+    out = rg.post_review(_ar(), repo_slug="o/r", pr_number=5, token="t", dedup=False, check_run_id=9001,
+                         check_head_sha=_REVIEWED, pr_head_sha=_REVIEWED)
+    assert out["check_head_sha"] == _REVIEWED and out["pr_head_sha"] == _REVIEWED and out["event"] == "APPROVE"
+    # the standalone CLI: post_review opens the run itself, on the reviewed head
+    out = rg.post_review(_ar(), repo_slug="o/r", pr_number=5, token="t", dedup=False)
+    assert out["check_head_sha"] == _REVIEWED and out["pr_head_sha"] is None
+    # a caller that knows neither: unknown is reported as unknown, never guessed
+    out = rg.post_review(_ar(), repo_slug="o/r", pr_number=5, token="t", dedup=False, check_run_id=9001)
+    assert out["check_head_sha"] is None and out["pr_head_sha"] is None
+
+
+def test_post_review_never_approves_a_head_that_moved_while_the_review_ran(monkeypatch):
+    """An approval counts for the whole pull request, and nobody reviewed the new head: a clean
+    review of the old one is posted as a COMMENT (or, with nothing else to say, not at all) and
+    the check says why. Findings still go up -- they are anchored to the commit that was reviewed."""
+    import httpx
+    summaries = _capture_check_summaries(monkeypatch)
+    monkeypatch.setattr(rg, "unresolved_blocking_findings", lambda *a, **k: 0)
+    posts = []
+    class _Ok:
+        status_code, text = 200, ""
+    monkeypatch.setattr(httpx, "post", lambda url, **k: posts.append(k["json"]) or _Ok())
+    moved = dict(repo_slug="o/r", pr_number=5, token="t", dedup=False, check_run_id=9001,
+                 check_head_sha=_REVIEWED, pr_head_sha=_MOVED_TO)
+    # clean: would have been an APPROVE
+    out = rg.post_review(_ar(), **moved)
+    assert out["event"] == "COMMENT" and out["posted_review"] is False and posts == []
+    assert out["pr_head_sha"] == _MOVED_TO and out["check_head_sha"] == _REVIEWED
+    assert f"head moved from {_REVIEWED[:8]} to {_MOVED_TO[:8]}" in summaries[-1] and "✅ Approved" not in summaries[-1]
+    # low-only: still no approval, the finding is posted as a COMMENT that says why
+    out = rg.post_review(_ar([_af("low")]), **moved)
+    assert out["event"] == "COMMENT" and out["posted_review"] is True
+    assert posts[-1]["event"] == "COMMENT" and f"moved from {_REVIEWED[:8]}" in posts[-1]["body"]
+    assert posts[-1]["commit_id"] == _REVIEWED                               # the review is about the commit it read
+    # medium: not approved anyway; the move is still on record next to the reason
+    out = rg.post_review(_ar([_af("medium")]), **moved)
+    assert out["event"] == "COMMENT" and "1 medium/high finding(s)" in posts[-1]["body"]
+    assert f"moved from {_REVIEWED[:8]}" in posts[-1]["body"]
+    # the same head at post time: nothing changes
+    out = rg.post_review(_ar(), **{**moved, "pr_head_sha": _REVIEWED})
+    assert out["event"] == "APPROVE" and posts[-1]["event"] == "APPROVE"
+
+
+def test_env_check_run_head_sha_parses_only_a_sha(monkeypatch):
+    from codna import review
+
+    monkeypatch.delenv("CODNA_CHECK_RUN_HEAD_SHA", raising=False)
+    assert review._env_check_run_head_sha() is None
+    monkeypatch.setenv("CODNA_CHECK_RUN_HEAD_SHA", _MOVED_TO.upper())
+    assert review._env_check_run_head_sha() == _MOVED_TO
+    monkeypatch.setenv("CODNA_CHECK_RUN_HEAD_SHA", "not-a-sha")
+    assert review._env_check_run_head_sha() is None
+
+
+def test_run_findings_review_hands_post_review_the_head_at_post_time_and_the_checks_anchor(monkeypatch, tmp_path):
+    """`codna review <url> --pr N --post --json`: the PR head is read AGAIN right before posting (the
+    turn is minutes long), the check's anchor comes from the worker's env, and the JSON result carries
+    what post_review reported."""
+    from codna import review
+
+    heads = iter([_REVIEWED, _MOVED_TO])          # at turn start, then at post time
+    monkeypatch.setattr(rg, "fetch_pr",
+                        lambda slug, n, tok: {"base_ref": "main", "head_sha": next(heads), "head_ref": "f", "is_fork": False})
+    monkeypatch.setattr(rg, "fetch_review_context", lambda *a, **k: {"last_reviewed_head": None, "prior_feedback": None})
+    monkeypatch.setattr(review, "_materialize_pr",
+                        lambda url, n, base, tok, incremental_base=None: (str(tmp_path), "origin/main...codna-pr-head", _REVIEWED, None))
+    monkeypatch.setattr(rf, "run_diff_review", lambda local, **kw: _ar())
+    posted = {}
+
+    def fake_post_review(result, **kw):
+        posted.update(kw)
+        return {"event": "COMMENT", "check": {"id": kw["check_run_id"], "updated_existing": True},
+                "check_head_sha": kw["check_head_sha"], "pr_head_sha": kw["pr_head_sha"]}
+
+    monkeypatch.setattr(rg, "post_review", fake_post_review)
+    anchor = "7679ecbe" + "0" * 32                # what the worker anchored CODNA_CHECK_RUN_ID to
+    monkeypatch.setenv("CODNA_CHECK_RUN_ID", "9001")
+    monkeypatch.setenv("CODNA_CHECK_RUN_HEAD_SHA", anchor)
+    args = SimpleNamespace(repo="https://github.com/o/r.git", pr="o/r#5", diff=None, base=None, post=True,
+                           model=None, github_token="t", min_confidence=None, max_findings=None, blocking=False)
+    out = review.run_findings_review(args)
+    assert posted["check_run_id"] == 9001 and posted["check_head_sha"] == anchor
+    assert posted["pr_head_sha"] == _MOVED_TO                              # the head at POST time, not at start
+    assert out["head_sha"] == _REVIEWED
+    assert out["posted"]["check_head_sha"] == anchor and out["posted"]["pr_head_sha"] == _MOVED_TO
+
+
+def test_pr_head_now_is_best_effort(monkeypatch):
+    from codna import review
+
+    def boom(*a, **k):
+        raise RuntimeError("fetch PR #5 failed: 502")
+
+    monkeypatch.setattr(rg, "fetch_pr", boom)
+    assert review._pr_head_now("o/r", 5, "t") is None
+    assert review._pr_head_now(None, 5, "t") is None and review._pr_head_now("o/r", None, "t") is None