fix(automation): yield completed mention repositories fairly

[seonghobae]

Summary

The five-minute organization agent-mention sweep already used four repository workers and five-minute rotation, but consumed futures in repository-list order. A slow earlier repository could delay a completed sibling and leave a fresh trusted comment behind the bounded dispatch frontier.

This change:

• consumes the existing repository futures with concurrent.futures.as_completed;
• preserves the four-worker ceiling, five-minute rotation, sequential dispatch, exact-head validation, and exact-name artifact ledger;
• adds a RED-to-GREEN slow-first/fast-later regression contract;
• records the operational decision in CHANGELOG.md and the existing APA 7 doctoring record.

No credentials, model/provider, allowlist, workflow permissions, merge authority, or branch-protection behavior changed.

Verification

• uv run coverage erase && uv run coverage run -m pytest tests && uv run coverage report --show-missing --fail-under=100
  • 1,235 passed
  • 7,839 statements, 3,046 branches, 100% statement/branch coverage
• uv run interrogate scripts/ci/agent_mention_router.py scripts/ci/agent_mention_sweep.py --fail-under=100
• uv run python -m compileall -q scripts/ci/agent_mention_sweep.py tests/test_agent_mention_timeout_bounds.py
• git diff --check
• CodeGraph synced and reports an up-to-date index

The full repository interrogate . baseline remains 99.7% because of two pre-existing docstring omissions outside this change. The latest ephemeral Ruff reports three pre-existing issues in the touched sweep file; no new Ruff finding was introduced by this diff.

Current exact-head state

Current exact head: e6838a033a91e7c1a2a22287d5f9922df5a30977.
GitHub reports the PR open, ready-for-review, and mergeable. There are no current review submissions.

Fresh exact-head hosted workflows are queued except the repository quality workflows already terminal GREEN:

• required security workflows are queued
• Organization Commercial Readiness Loop Quality CI — success
• Agent Mention Router Quality CI — success
• Strix Changed Path Quality CI — success

Earlier local/hosted evidence for predecessor heads does not transfer to this head.

Review and merge boundary

Please review this exact head only. The author must not self-approve. Merge requires a current-head independent review, terminal required Checks, unresolved-thread clearance, and the normal protected merge path with a match-head guard.

---

[seonghobae]

@opencode-agent Review only exact current head 941e4bd. This is a bounded fairness fix for the central mention sweep: completed repository futures are observed with as_completed while the four-worker ceiling, rotation, sequential exact-head dispatch, artifact ledger, permissions, and merge authority remain unchanged. Do not self-approve or infer predecessor evidence.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3cb0fef1-8373-48fc-892b-6a430f63f5e2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Review only exact current head 2da6c88.

Normal merge from protected main 6479989 has been applied. The bounded as_completed fairness fix remains the only feature diff; the four-worker ceiling, rotation, sequential dispatch, exact-head validation, artifact ledger, permissions, and merge authority are unchanged.

Exact local verification at this head: 1,235 tests passed; 7,839 statements and 3,046 branches at 100%; Interrogate touched sweep/router at 100%; compileall and git diff --check passed. Do not self-approve or infer predecessor evidence. Merge requires current-head independent review, terminal required Checks, unresolved-thread clearance, and protected match-head validation.

[seonghobae]

Current-head review evidence (38aef06): 37 mention-router/sweep/timeout-bound tests pass; changed sweep source and timeout test now have 100% interrogate coverage, Ruff and Python compilation pass, and diff checks are clean. Completion-order observation preserves the four-worker ceiling and bounded shutdown. Independent approval and protected Checks remain required before merge.

[seonghobae]

@opencode-agent Please review exact current PR head 38aef06. Re-check changed-file scope, current-head findings, unresolved threads, mergeability, and all required checks. Do not approve a stale head.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Current-head review

Reviewed e6838a033a91e7c1a2a22287d5f9922df5a30977:

• as_completed(futures) changes only observation order, allowing a completed fast repository to yield before a blocked sibling;
• the four-worker ceiling, sequential dispatch, cancellation, exact-head validation, and artifact ledger remain unchanged;
• the RED-to-GREEN slow-first/fast-later regression and operator doctoring are present;
• review threads: 0; no qualifying independent approval;
• hosted checks for this exact head currently have no failures, with security/supply-chain checks still queued.

No source correction is required from the current diff. Merge remains gated on terminal protected Checks and independent approval.

[seonghobae]

Current-head review complete at e6838a033a91e7c1a2a22287d5f9922df5a30977 (base 55a8b576725451dfe0a21a57d36a2f1a41619b24). The four-worker fan-out now yields as_completed repositories while preserving bounded shutdown and sequential dispatch; the slow-first/fast-later regression is covered. Focused sweep/router suite: 51 passed; compileall and git diff --check passed. All current workflow runs are successful and no inline threads remain. This PR overlaps the doctoring record changed by #1176, so its exact-head checks must be re-run after that governance change is integrated. Please obtain an independent non-author approval on the applicable exact head; I will not merge before that and all protected gates are current.

[seonghobae]

Exact-head shared security gate triage

• Exact head: 26d713145ee687ca80cb61b95f98fa749f2c1507
• The current completed pip-audit failure and lock content both point to pip==26.1.2, affected by PYSEC-2026-3721, fixed in 26.2.
• This is a source/security failure, not an Actions or runner deadlock. Canonical remediation is PR fix(osv): preserve immutable direct-source provenance #1158, which pins the direct audit requirement and hash lock to pip==26.2.1.
• Do not reuse this predecessor failure as current-head evidence after the shared lock is merged; rerun this PR from a fresh exact head.

Decision: WAIT_AND_REMEDIATE pending the protected shared security fix and fresh exact-head Checks. No bypass or merge performed.

[seonghobae]

Exact-head restack update

• Exact head: 59b6f809ef996a5a36c829ec126169b432971cbf
• Exact base: dd58a88391e44a32fb399f7407f508d8e73cc1c7
• The branch was updated through GitHub normal update-branch; predecessor head evidence is discarded.
• New hosted state: 3 completed successes, 2 in progress, and 16 queued checks plus cancellation records; no completed source failure is currently present.
• Auto-merge is enabled on the protected normal path. No exact-head approval is present, so decision remains WAIT_AND_REMEDIATE; no bypass or force push.

[seonghobae]

Current-head audit — WAIT_AND_REMEDIATE

• Exact head SHA: 59b6f809ef996a5a36c829ec126169b432971cbf
• Exact base SHA: dd58a88391e44a32fb399f7407f508d8e73cc1c7
• Scope: completion-order consumption of the existing four-worker mention sweep, with timeout/cleanup regression coverage and doctoring update.
• Review state: current exact-head unresolved threads 0; Devin review is successful; no qualifying approval yet.
• Local evidence: focused timeout tests 6 passed; full repository suite 1,292 passed with 16 subtests; exact source branch coverage 447 statements / 182 branches at 100%; interrogate 100%; compileall and exact diff check passed.
• Hosted evidence: quality, exact-contract, security, SAST, SBOM, OSV, dependency review, CodeQL prerequisites, Noema, CodeRabbit, and Devin are successful or non-required/skipped. Exact-head CodeQL, Strix, pip-audit, coverage-source-tree, and scheduler checks remain queued/in progress; no completed source failure is being reused.
• Review disposition: both Devin notes were informational. The cleanup/isolation note was confirmed. The dispatch-budget fairness trade-off is explicitly documented; strict budget fairness is a separate scheduler contract, so no unrelated redesign was added.
• Decision: WAIT_AND_REMEDIATE; normal protected auto-merge is enabled below, with no force merge, bypass, fake status, or gate weakening. Merge remains contingent on current-head required checks and an eligible approval.
• Rollback: revert the eventual squash commit through a normal protected PR if a source regression appears.

[seonghobae]

Exact-head audit update\n\nObserved hosted failures on the prior head: pip-audit reported PYSEC-2026-3721 through pip 26.1.2; exact-head-path-policy reported stale scheduler assertions. The Strix failure was infrastructure-only: the scan produced no findings but its Caido guest bootstrap could not connect to 127.0.0.1:48080.\n\nRoot-cause fix: refreshed the hash-locked CI dependency to pip 26.2.1 and aligned the scheduler contract assertion with the current repository-dispatch scope.\n\nExact head: 9ebf6d1\nExact base: 6a79f07\nLocal verification: 69 mention-sweep/scheduler tests passed; pip-audit clean; shell syntax and diff checks passed.\nGitHub currently reports the branch behind; required checks and exact-head approval remain pending. Decision remains WAIT_AND_REMEDIATE.

[seonghobae]

Current-head verification update

• Exact head: a4820686007fba7d3b1ecfc93e409f50b70476de
• Exact base: fce028b4c3bf8e2e5e4819c1c5622e90cfa6ab39
• Normal branch update onto current main completed; predecessor evidence is discarded.
• Review threads: 0 unresolved; no qualifying approval is currently recorded.
• Local exact-head verification: 20 mention-router timeout/isolation tests passed; compileall, interrogate 100%, and diff check passed.
• Hosted required Checks are queued/in progress; no current source failure is evidenced.
• Decision: WAIT_AND_REMEDIATE; normal squash auto-merge remains enabled; no force merge.

[seonghobae]

Exact-head follow-up: pushed c2b81dd4 to restore the missing shared coordinator initializer docstring required by the repository 100% docstring gate. Mention timeout/sweep/router/queue tests passed (88 tests), compileall, interrogate 100%, and git diff --check passed. All review threads are resolved; predecessor checks are invalidated and hosted checks are being recollected.