[codex] Recent unresolved review feedback

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-07
• Minimum severity: high
• Findings: 1

• p1 evalops/deploy#2390 pr_comment
  • PR: https://github.com/evalops/deploy/pull/2390
  • Feedback: https://github.com/evalops/deploy/pull/2390#issuecomment-4414505603
  • Parse real CLI flags instead of substring matching

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-07
• Minimum severity: high
• Findings: 2

• high evalops/cerebro#1172 scripts/check-workflow-security.py:81
  • PR: https://github.com/evalops/cerebro/pull/1172
  • Feedback: https://github.com/evalops/cerebro/pull/1172#discussion_r3214797263

  • Regex misses step-level - uses: action references

• high evalops/fathom#89 macos/FathomCore/Sources/FathomCore/ContextSnapshotVisualDigest.swift:39
  • PR: https://github.com/evalops/fathom/pull/89
  • Feedback: https://github.com/evalops/fathom/pull/89#discussion_r3214786781

  • Hash domain separator rename silently breaks receipt hash compatibility

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-07
• Minimum severity: high
• Findings: 2

• high evalops/cerebro#1172 scripts/check-workflow-security.py:81
  • PR: https://github.com/evalops/cerebro/pull/1172
  • Feedback: https://github.com/evalops/cerebro/pull/1172#discussion_r3214797263

  • Regex misses step-level - uses: action references

• high evalops/fathom#89 macos/FathomCore/Sources/FathomCore/ContextSnapshotVisualDigest.swift:39
  • PR: https://github.com/evalops/fathom/pull/89
  • Feedback: https://github.com/evalops/fathom/pull/89#discussion_r3214786781

  • Hash domain separator rename silently breaks receipt hash compatibility

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-07
• Minimum severity: high
• Findings: 2

• high evalops/cerebro#1172 scripts/check-workflow-security.py:81
  • PR: https://github.com/evalops/cerebro/pull/1172
  • Feedback: https://github.com/evalops/cerebro/pull/1172#discussion_r3214797263

  • Regex misses step-level - uses: action references

• high evalops/fathom#89 macos/FathomCore/Sources/FathomCore/ContextSnapshotVisualDigest.swift:39
  • PR: https://github.com/evalops/fathom/pull/89
  • Feedback: https://github.com/evalops/fathom/pull/89#discussion_r3214786781

  • Hash domain separator rename silently breaks receipt hash compatibility

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-07
• Minimum severity: high
• Findings: 2

• high evalops/cerebro#1172 scripts/check-workflow-security.py:81
  • PR: https://github.com/evalops/cerebro/pull/1172
  • Feedback: https://github.com/evalops/cerebro/pull/1172#discussion_r3214797263

  • Regex misses step-level - uses: action references

• high evalops/fathom#89 macos/FathomCore/Sources/FathomCore/ContextSnapshotVisualDigest.swift:39
  • PR: https://github.com/evalops/fathom/pull/89
  • Feedback: https://github.com/evalops/fathom/pull/89#discussion_r3214786781

  • Hash domain separator rename silently breaks receipt hash compatibility

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-07
• Minimum severity: high
• Findings: 7

• high evalops/fathom#115 macos/FathomCore/Sources/FathomCore/DesktopAppApprovalState.swift:184
  • PR: https://github.com/evalops/fathom/pull/115
  • Feedback: https://github.com/evalops/fathom/pull/115#discussion_r3215272459

  • Persistent-disabled check shadows valid session grants

• high evalops/ensemble#856 src/channels/slack/provisioning.ts:83
  • PR: https://github.com/evalops/ensemble/pull/856
  • Feedback: https://github.com/evalops/ensemble/pull/856#discussion_r3215242438

  • Case-sensitive mismatch with existing workspace mapping logic

• p1 evalops/platform#1747 internal/fermata/http/rest_dataset_promotion.go:426
  • PR: https://github.com/evalops/platform/pull/1747
  • Feedback: https://github.com/evalops/platform/pull/1747#discussion_r3215207336
  • Accept camelCase approval fields in golden filter
• p1 evalops/platform#1746 internal/fermata/http/rest_batch_evaluation.go:107
  • PR: https://github.com/evalops/platform/pull/1746
  • Feedback: https://github.com/evalops/platform/pull/1746#discussion_r3215181231
  • Validate workspace_id before executing batch items
• p1 evalops/platform#1745 internal/fermata/http/rest_eval_comparisons.go:117
  • PR: https://github.com/evalops/platform/pull/1745
  • Feedback: https://github.com/evalops/platform/pull/1745#discussion_r3215171402
  • Require org scope before listing comparison artifacts
• p1 evalops/platform#1745 internal/fermata/http/rest_eval_comparisons.go:433
  • PR: https://github.com/evalops/platform/pull/1745
  • Feedback: https://github.com/evalops/platform/pull/1745#discussion_r3215171403
  • Enforce tenant scope on comparison artifact loads
• high evalops/deploy#2446 .github/workflows/sync-production-runtime-images.yml:308
  • PR: https://github.com/evalops/deploy/pull/2446
  • Feedback: https://github.com/evalops/deploy/pull/2446#discussion_r3215177436

  • $? after if without else is always zero

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-08
• Minimum severity: high
• Findings: 5

• high evalops/platform#1767 internal/fermata/http/rest_agent_runtime.go:798
  • PR: https://github.com/evalops/platform/pull/1767
  • Feedback: https://github.com/evalops/platform/pull/1767#discussion_r3215591869

  • Loop breaks early, running status shadows failed tools

• p1 evalops/platform#1766 internal/fermata/http/rest_agent_runtime.go:517
  • PR: https://github.com/evalops/platform/pull/1766
  • Feedback: https://github.com/evalops/platform/pull/1766#discussion_r3215571311
  • Preserve rejected sessions when later approvals are accepted
• p1 evalops/platform#1766 internal/fermata/http/rest_agent_runtime.go:560
  • PR: https://github.com/evalops/platform/pull/1766
  • Feedback: https://github.com/evalops/platform/pull/1766#discussion_r3215571315
  • Preserve tenant scope when updating runtime records
• p1 evalops/platform#1760 internal/fermata/http/rest_review_operations.go:954
  • PR: https://github.com/evalops/platform/pull/1760
  • Feedback: https://github.com/evalops/platform/pull/1760#discussion_r3215396446
  • Reject pass status when rubric validation fails
• p1 evalops/platform#1758 internal/fermata/http/rest_review_operations.go:464
  • PR: https://github.com/evalops/platform/pull/1758
  • Feedback: https://github.com/evalops/platform/pull/1758#discussion_r3215372460
  • Require reviewer_id before marking items assigned

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-08
• Minimum severity: high
• Findings: 3

• p1 evalops/platform#1798 internal/fermata/http/quality_gates_connect.go:137
  • PR: https://github.com/evalops/platform/pull/1798
  • Feedback: https://github.com/evalops/platform/pull/1798#discussion_r3216726861
  • Persist batch evaluations when persist is omitted
• high evalops/ensemble#860 src/channels/slack/adapter.ts:152
  • PR: https://github.com/evalops/ensemble/pull/860
  • Feedback: https://github.com/evalops/ensemble/pull/860#discussion_r3216357990

  • Rich text quotes silently drop content from real Slack payloads

• high evalops/fathom#151 macos/FathomCore/Sources/FathomCore/NativeActionExecutor.swift:73
  • PR: https://github.com/evalops/fathom/pull/151
  • Feedback: https://github.com/evalops/fathom/pull/151#discussion_r3215916564

  • Text silently truncated beyond 20 characters by CGEvent

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-08
• Minimum severity: high
• Findings: 4

• p1 evalops/platform#1816 internal/agentruntime/agentruntime/slack_schedule_operation_materialization.go:127
  • PR: https://github.com/evalops/platform/pull/1816
  • Feedback: https://github.com/evalops/platform/pull/1816#discussion_r3220572663
  • Enforce Slack visibility before mutating explicit schedule IDs
• high evalops/platform#1806 internal/vfs/vfs/service.go:813
  • PR: https://github.com/evalops/platform/pull/1806
  • Feedback: https://github.com/evalops/platform/pull/1806#discussion_r3219551408

  • Empty principal fields generate overly broad actor candidates

• p1 evalops/platform#1798 internal/fermata/http/quality_gates_connect.go:137
  • PR: https://github.com/evalops/platform/pull/1798
  • Feedback: https://github.com/evalops/platform/pull/1798#discussion_r3216726861
  • Persist batch evaluations when persist is omitted
• high evalops/ensemble#860 src/channels/slack/adapter.ts:152
  • PR: https://github.com/evalops/ensemble/pull/860
  • Feedback: https://github.com/evalops/ensemble/pull/860#discussion_r3216357990

  • Rich text quotes silently drop content from real Slack payloads

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-09
• Minimum severity: high
• Findings: 5

• p1 evalops/platform#1847 internal/slackingress/slack/renderer_actions.go:302
  • PR: https://github.com/evalops/platform/pull/1847
  • Feedback: https://github.com/evalops/platform/pull/1847#discussion_r3222455734
  • Avoid tagging fanout controls as fanout commands
• p1 evalops/platform#1846 scripts/local-agent-dev-lab.py:541
  • PR: https://github.com/evalops/platform/pull/1846
  • Feedback: https://github.com/evalops/platform/pull/1846#discussion_r3222438490
  • Treat undeclared expected evidence keys as optional
• p1 evalops/platform#1816 internal/agentruntime/agentruntime/slack_schedule_operation_materialization.go:127
  • PR: https://github.com/evalops/platform/pull/1816
  • Feedback: https://github.com/evalops/platform/pull/1816#discussion_r3220572663
  • Enforce Slack visibility before mutating explicit schedule IDs
• high evalops/platform#1806 internal/vfs/vfs/service.go:813
  • PR: https://github.com/evalops/platform/pull/1806
  • Feedback: https://github.com/evalops/platform/pull/1806#discussion_r3219551408

  • Empty principal fields generate overly broad actor candidates

• p1 evalops/platform#1798 internal/fermata/http/quality_gates_connect.go:137
  • PR: https://github.com/evalops/platform/pull/1798
  • Feedback: https://github.com/evalops/platform/pull/1798#discussion_r3216726861
  • Persist batch evaluations when persist is omitted

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-09
• Minimum severity: high
• Findings: 5

• p1 mirror: sync pairwise Fermata eval surface maestro#393 scripts/headless-protocol-codegen.mjs:475
  • PR: mirror: sync pairwise Fermata eval surface maestro#393
  • Feedback: mirror: sync pairwise Fermata eval surface maestro#393 (comment)
  • Regenerate Rust protocol constants after enum removal
• high evalops/fathom#209 sdk/ts/fathom-cua/src/index.js:2541
  • PR: https://github.com/evalops/fathom/pull/209
  • Feedback: https://github.com/evalops/fathom/pull/209#discussion_r3223787191

  • Verifier matching changed from AND to OR semantics

• p1 evalops/platform#1871 internal/traces/traces/service.go:65
  • PR: https://github.com/evalops/platform/pull/1871
  • Feedback: https://github.com/evalops/platform/pull/1871#discussion_r3223378574
  • Move trace OTLP export off the ingest request path
• p1 evalops/platform#1847 internal/slackingress/slack/renderer_actions.go:302
  • PR: https://github.com/evalops/platform/pull/1847
  • Feedback: https://github.com/evalops/platform/pull/1847#discussion_r3222455734
  • Avoid tagging fanout controls as fanout commands
• p1 evalops/platform#1846 scripts/local-agent-dev-lab.py:541
  • PR: https://github.com/evalops/platform/pull/1846
  • Feedback: https://github.com/evalops/platform/pull/1846#discussion_r3222438490
  • Treat undeclared expected evidence keys as optional

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-09
• Minimum severity: high
• Findings: 4

• high evalops/deploy#2529 release-trains/prod-continuous/train.yaml:37
  • PR: https://github.com/evalops/deploy/pull/2529
  • Feedback: https://github.com/evalops/deploy/pull/2529#discussion_r3225582914

  • Previously boarded PR #2306 silently dropped from train

• p1 mirror: sync pairwise Fermata eval surface maestro#393 scripts/headless-protocol-codegen.mjs:475
  • PR: mirror: sync pairwise Fermata eval surface maestro#393
  • Feedback: mirror: sync pairwise Fermata eval surface maestro#393 (comment)
  • Regenerate Rust protocol constants after enum removal
• high evalops/fathom#209 sdk/ts/fathom-cua/src/index.js:2541
  • PR: https://github.com/evalops/fathom/pull/209
  • Feedback: https://github.com/evalops/fathom/pull/209#discussion_r3223787191

  • Verifier matching changed from AND to OR semantics

• p1 evalops/platform#1871 internal/traces/traces/service.go:65
  • PR: https://github.com/evalops/platform/pull/1871
  • Feedback: https://github.com/evalops/platform/pull/1871#discussion_r3223378574
  • Move trace OTLP export off the ingest request path

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-09
• Minimum severity: high
• Findings: 6

• p1 evalops/platform#1920 internal/agentruntime/agentruntime/vfs_service.go:364
  • PR: https://github.com/evalops/platform/pull/1920
  • Feedback: https://github.com/evalops/platform/pull/1920#discussion_r3228906286
  • Continue search when external file content read fails
• p1 evalops/platform#1918 internal/agentruntime/agentruntime/vfs_service.go:2473
  • PR: https://github.com/evalops/platform/pull/1918
  • Feedback: https://github.com/evalops/platform/pull/1918#discussion_r3228597078
  • Reject injected workspace VFS refs from proposal metadata
• p1 evalops/platform#1909 internal/fermata/fermata/agent_trajectory_assertion.go:262
  • PR: https://github.com/evalops/platform/pull/1909
  • Feedback: https://github.com/evalops/platform/pull/1909#discussion_r3227646992
  • Require typed trajectory evidence before accepting payload
• high evalops/deploy#2529 release-trains/prod-continuous/train.yaml:37
  • PR: https://github.com/evalops/deploy/pull/2529
  • Feedback: https://github.com/evalops/deploy/pull/2529#discussion_r3225582914

  • Previously boarded PR #2306 silently dropped from train

• p1 mirror: sync pairwise Fermata eval surface maestro#393 scripts/headless-protocol-codegen.mjs:475
  • PR: mirror: sync pairwise Fermata eval surface maestro#393
  • Feedback: mirror: sync pairwise Fermata eval surface maestro#393 (comment)
  • Regenerate Rust protocol constants after enum removal
• high evalops/fathom#209 sdk/ts/fathom-cua/src/index.js:2541
  • PR: https://github.com/evalops/fathom/pull/209
  • Feedback: https://github.com/evalops/fathom/pull/209#discussion_r3223787191

  • Verifier matching changed from AND to OR semantics

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-10
• Minimum severity: high
• Findings: 2

• p1 evalops/deploy#2573 scripts/enforce-sync-staleness.py:170
  • PR: https://github.com/evalops/deploy/pull/2573
  • Feedback: https://github.com/evalops/deploy/pull/2573#discussion_r3230076853
  • Propagate image-tag lookup failures in staleness guard
• p1 evalops/platform#1928 internal/agentruntime/agentruntime/vfs_service.go:2123
  • PR: https://github.com/evalops/platform/pull/1928
  • Feedback: https://github.com/evalops/platform/pull/1928#discussion_r3229606165
  • Preserve source security metadata on implicit rename copy

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-11
• Minimum severity: high
• Findings: 3

• p0 evalops/hopper#172 pr_review
  • PR: https://github.com/evalops/hopper/pull/172
  • Feedback: https://github.com/evalops/hopper/pull/172#pullrequestreview-4286254118
• p1 chore: sync public mirror from internal maestro#397 src/agent/providers/scripted.ts:522
  • PR: chore: sync public mirror from internal maestro#397
  • Feedback: chore: sync public mirror from internal maestro#397 (comment)
  • Preserve retryability for transient scripted errors
• p1 evalops/deploy#2710 .github/workflows/sync-production-runtime-images.yml:91
  • PR: https://github.com/evalops/deploy/pull/2710
  • Feedback: https://github.com/evalops/deploy/pull/2710#discussion_r3236775061
  • Keep scheduled sync runs from self-canceling

[haasonsaas]

Recent unresolved review feedback

• Owner: evalops
• Merged since: 2026-05-11
• Minimum severity: high
• Findings: 5

• p1 evalops/hopper#183 pr_review
  • PR: https://github.com/evalops/hopper/pull/183
  • Feedback: https://github.com/evalops/hopper/pull/183#pullrequestreview-4287562796
• p1 evalops/hopper#181 pr_review
  • PR: https://github.com/evalops/hopper/pull/181
  • Feedback: https://github.com/evalops/hopper/pull/181#pullrequestreview-4287262907
• p0 evalops/hopper#172 pr_review
  • PR: https://github.com/evalops/hopper/pull/172
  • Feedback: https://github.com/evalops/hopper/pull/172#pullrequestreview-4286254118
• p1 chore: sync public mirror from internal maestro#397 src/agent/providers/scripted.ts:522
  • PR: chore: sync public mirror from internal maestro#397
  • Feedback: chore: sync public mirror from internal maestro#397 (comment)
  • Preserve retryability for transient scripted errors
• p1 evalops/deploy#2710 .github/workflows/sync-production-runtime-images.yml:91
  • PR: https://github.com/evalops/deploy/pull/2710
  • Feedback: https://github.com/evalops/deploy/pull/2710#discussion_r3236775061
  • Keep scheduled sync runs from self-canceling