[irvingpop]

Summary

• Summary comment now shows ignored /oc-review override comments with the reason (verdict and risk unchanged). Before, rejected overrides were silent.
• Graph-off setting match no longer fires on conditional or negated text before the phrase (display only).
• eval.yml workflow lint now reads workflow-level and job-level defaults.run.shell.
• Docs: eval-test environment has prevent self-review off (sole reviewer is the run actor); stale evals.py docstring and release.py comment fixed.
• harden-runner pinned to v2.22.4 (1d88384) in all 7 steps; egress stays in audit mode, allowlists unchanged. v2.22.4 carries the upstream fix for Allowed domains blocked on westus2 runners: agent records one A record per domain, drops the others step-security/harden-runner#708. The owner approved pinning before the 2-day release age (recorded as K-16). Issue Deferred: re-test harden-runner v2.22.3 in block mode (phase 5) #24 stays open for the soak and the block-mode switch.

Test plan

• cd review && uv run pytest tests/unit: 3033 passed (3016 before)
• Independent review: pass, no Critical or Important findings
• After merge: release (make release) to move the review rulesets to the new SHA

🤖 Generated with Claude Code

[github-actions]

🔴 Hold deployment: Claude of Duty identified 1 item requiring attention

Mission: Review the code. Protect the branch. Deploy the future.

Caution

Out of range. This change is too large for the model review. File checks ran, but model checks did not. A maintainer can waive this.
Next step for the author: split the change, or ask a maintainer for a waiver (under "Waiver" below).

Severity	Effect	Where	Finding	Found by
⚠️ Not run	Blocks, waivable	Model passes	Too large for automatic review. File checks ran, model checks did not.	Workflow (code, no model)

File checks	Review	Security	Supply chain	Dependency review	Coverage
✅ ok, 5 signals	⚠️ skipped, too large	⚠️ skipped, too large	⚠️ skipped, too large	✅ ok	✅ complete

_{Run 42313321619, attempt 1 for head 80d0827 into main. The required workflow in the merge box is the result that counts.}

Claude of Duty never approves a PR. A human reviewer gives the final approval.

🔑 Waiver: how a maintainer clears this

This PR fails for waivable reasons only. A person with write or admin access, who is not the PR author, posts this exact line as a new comment and replaces <reason> with the reason. Then they re-run the newest run of the required workflow through the GitHub REST API (POST .../actions/runs/{run_id}/rerun). Do not edit the comment afterwards. Do not close and reopen the PR to apply the waiver.

/oc-review override 80d082749698ef6a7ea7ebed7fba12f2e55db90a 08aa87215d27bf75a5bb78ef75ab559d861e4b4e <reason>

A waiver covers the code at this exact head and merge base. Any new push needs a new waiver.

📋 Full review record: reasons, checks, signals, finding details, model summaries, token usage

Reviewed snapshot

Head SHA	Merge base SHA	Base branch	Run
80d082749698ef6a7ea7ebed7fba12f2e55db90a	08aa87215d27bf75a5bb78ef75ab559d861e4b4e	main	42313321619, attempt 1

Reasons the gate failed

Reason	Waivable?	Detail
Change too large for the model review	✅ yes	too large for automatic review

Checks (code, no model)

Check	Result	Detail
Hard blocks	✅ none
Coverage	✅ complete	files in comparison 13, files collected 13, trees complete
Dependency changes	✅ none
Dependency review job	✅ success

Signals (context only, never block)

• ⚠️ Sensitive path changed: change to workflow, in .github/workflows/claude-review.yml
• ⚠️ Sensitive path changed: change to workflow, in .github/workflows/eval.yml
• ⚠️ Sensitive path changed: change to workflow, in .github/workflows/test.yml
• ℹ️ Very long line: lines longer than 500 characters, in docs/build-plan.md, lines 109 225
• ℹ️ Very long line: lines longer than 500 characters, in docs/claude-review-design.md, lines 43 199 508 615 713 714 880 1033 1035

Dependency changes

None.

Finding details

Model output from untrusted input. Check it before you act on it. Verified means only that the quoted text is at that place. It does not mean the claim is true.

Blocking is decided by code from category and severity, never by the model. A finding in a blocking category blocks only at high or critical severity.

No findings from the passes that ran. The Review, Security, Supply chain pass did not run, so this is not a clean result.

Model summaries

Model output from untrusted input. Check it before you act on it. Verified means only that the quoted text is at that place. It does not mean the claim is true.

Pass	Status	Model	Summary
Review	❌ skipped-size		No summary. Reason: bundle status skipped-size
Security	❌ skipped-size		No summary. Reason: bundle status skipped-size
Supply chain	❌ skipped-size		No summary. Reason: bundle status skipped-size

Token usage

No token usage was recorded for any pass.