AI Re-review (round 3)
Previous Findings\n\n- Secrets injected as literal *** → FIXED: cmd+=(-e "${secret}") (no…
AI Re-review (round 3): APPROVE — All previous findings addressed; dispatcher is correct, secure, and ready to merge
AI Re-review (round 2)
Previous Findings\n\n- Secret values leaked in logs → FIXED: cmd[*] now shows =*** for all…
AI Re-review (round 2): REQUEST_CHANGES — One critical regression introduced by the fix: runner container receives literal '***' as secret values instead of real tokens, so all vault actions will fail with auth errors
AI Review
Summary\n\nImplements the dispatcher loop: polls a local copy of the ops repo for approved action JSON files and…
AI Review: REQUEST_CHANGES — Four functional bugs and one critical security issue: secrets logged in plaintext, wrong clone URL, ops repo never re-polled, and -e flags built in wrong position for docker compose run
AI Review
Summary\n\nAdds a custom Dockerfile for the edge container with dispatcher dependencies, and a no-op placeholder…
AI Review: APPROVE — Correct placeholder infrastructure; Docker socket exposure in internet-facing container is worth tracking
AI Review
Summary\n\nAdds shellcheck to the agents Dockerfile apt-get install list, fixing #48.\n\n- Package name is correct…
AI Review: APPROVE — Correct one-line fix: adds shellcheck to apt-get install in the agents Dockerfile
AI Review
Summary\n\nSmall, correct safety fix. Before this change, would remove the plaintext even if encryption had failed…
AI Review: APPROVE — Adds missing post-encrypt verification to migrate-vault, correctly mirroring the existing pattern in migrate
AI Review: APPROVE — Correctly replaces hardcoded label name string with numeric ID lookup, matching the established pattern in issue-lifecycle.sh
AI Review
Summary
The bug: Forgejo's DELETE /issues/{n}/labels/{id} endpoint requires a numeric label ID, not a label name…
AI Re-review (round 2): APPROVE — Both previous findings fixed: tea CLI restored with checksum, sops checksum verification added
AI Re-review (round 2)
Previous Findings
- tea CLI removed → FIXED: The
teainstallation block is restored with its…
AI Review
Summary
This PR introduces Forgejo issue assignee as a distributed lock to prevent concurrent agent claims. The…
AI Review: APPROVE — Assignee-as-lock is sound and a clear improvement; minor issues are low-severity or self-mitigating.
AI Review
Summary
This PR correctly adds age and sops to the agents Dockerfile to support SOPS-encrypted secrets (AD-005).…
AI Review: REQUEST_CHANGES — Removes tea CLI that is actively used by agents, and installs sops without checksum verification