~23% of reviews were failing open with `diff fetch failed: gitea GET
/{owner}/{repo}/compare/{before}...{after}.diff -> 404`. Probing the live
forge (Gitea 1.27.1) showed the web compare route answers 404 for ALL refs
on private repos — it does not honor `Authorization: token` and resolves as
anonymous — while the API compare (JSON) and per-commit
/git/commits/{sha}.diff endpoints succeed for the exact same sha pairs.
It also 404s legitimately when `before` is unknown (force-push, rebase).
fetchDiff now walks a fallback chain instead of failing open on the first
404 (any non-404 error still propagates immediately):
PR job: pulls/{n}.diff -> git/commits/{head}.diff
range push: web compare {before}...{after}.diff
-> web compare {defaultBranch}...{after}.diff
-> API compare commit list (falls back to the webhook's
commitShas) -> concatenated per-commit git/commits/{sha}.diff,
stopping past maxDiffBytes so the existing truncation cap
(verdict capped at 'warn') kicks in
-> git/commits/{after}.diff alone
new branch: git/commits/{after}.diff (unchanged)
Only when every source is exhausted does the review fail open, and the log
line now lists every URL tried. Webhook jobs carry the repo default_branch
so the fallback needs no extra API call; getRepo() covers recovered jobs
persisted before this change.
Verified against the live forge for the exact failing pair from today's
service.log (Nirlabinc/shreai 481d8663...46696b50): the chain recovers a
full-range 8,993-byte diff via 2/2 per-commit diffs.
Co-Authored-By: Claude Fable 5 <[email protected]>
- push reviews now fetch ONE compare diff (before...after) instead of
slicing to the first 20 commits under a head-sha status; new-branch
pushes (zero before-sha) fall back to the head commit diff
- truncated diffs can no longer yield a clean pass: verdict capped at
warn and status description prefixed 'partial review (diff truncated)'
- any diff-fetch failure (throw / empty body on a non-empty push or PR)
short-circuits to status 'warning' ('review unavailable — diff fetch
failed (not blocking)') with a ledger row; a diffless prompt is never
sent to the model
- accepted jobs persist to sqlite (queue_jobs) before the pending status
posts; startup re-enqueues rows that never reached a final state, so
restarts no longer strand shas at 'pending'
- 403 on status/comment posts self-heals: admin-scoped token (config
admin_token) adds shre-reviewer as collaborator (write), retries once
- scripts/wire-repos.mjs: idempotent estate-wide webhook + collaborator
wiring over GET /repos/search
- tests: 32 -> 51 (truncation cap, persisted-queue reconciliation,
collab-retry stubs, fetchDiff routing)
Co-Authored-By: Claude Fable 5 <[email protected]>
Webhook-driven central review service for Granthi forges: HMAC-verified
push/pull_request webhooks, per-repo serialization with global LLM
concurrency 1, shre-router powered rubric review (8 axes, strict JSON,
tolerant extractor + retry), commit statuses + PR scorecard comments,
sqlite attribution ledger with Co-Authored-By trailer parsing, per-repo
HTML history dashboard, nightly per-agent digests, fail-open-with-
visibility when the router is unavailable.
Posture: BLOCK on confirmed critical/high correctness+security findings;
admin merge is the human override.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude