chore: pre-submission cleanup — honesty, secrets, hygiene#92
Merged
Conversation
Follow-ups from a 5-agent pre-submission audit. Honesty (grep-exposable overclaims removed): - README + Devpost text: the "the audit changes who wins" rank-flip claim -> honest "recalibration board" framing (on the golden set the audit recalibrated without reordering the top-13, delta=0; it does not fake a flip). The deck already disavowed this; README/Devpost now match. - README sample correction 9.0 -> 7.84 corrected to 9.0 -> 7.6 (matches brief.json _facts_verified and the deck's on-screen SSE value). Accuracy: - README min-instances=0 -> min-instances=1 (matches infra/deploy.sh; one warm instance for the first judge click). - README test-count standardized to "323 Python + 74 web". Security (pre-public): - Redact the GCP billing account id + owner email from HANDOFF.md, docs/gcp-setup.md, three claudedocs session handoffs, and the onboarding HTML. - .gitignore hardening: *.log, *.pem, *.p12, *.pfx, *-key.json, *-credentials.json, *service-account*.json. Repo hygiene: - Drop "(Panelyst)" from the .env.example header. - Stop tracking the 45 MB gemini3_dataset.json + 42 MB projects.json raw Devpost scrape (now gitignored; nothing in the codebase imports them, verified by grep). The hit@13 golden set (winners.json + submissions.json) stays tracked for reproducibility; data/devpost-gemini3/README.md documents the provenance. Presentation: - README: CI + license + live-demo badges, a 3D self-correction screenshot, a demo-video placeholder, and a security-posture callout near the top. - Devpost text: fill the public repo link. Verified out-of-band: reasoningEngines/7480191458771730432 is the only serving Agent Engine resource (docs are correct). The GitHub Pages stale-onboarding landmine is handled separately by replacing the gh-pages content with a redirect to the live demo. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
워크스루이 PR은 GCP 결제 계정 ID 및 이메일 주소를 여러 문서에서 마스킹하고, 배포 구성과 보안 범위를 명확히 하며, 재캘리브레이션 보드 용어를 정확하게 갱신합니다. Phoenix MCP V2 배포 및 검증 현황을 세션 핸드오프에 반영합니다. 변경 사항문서 보안 및 정확성 업데이트
추정 코드 리뷰 난이도🎯 2 (단순) | ⏱️ ~12분 관련 PR
시
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request primarily redacts sensitive information (emails and billing IDs) across several documentation and handoff files, updates the .gitignore to exclude large scraped datasets and credentials, and updates project documentation to reflect the live Phoenix-MCP deployment, warm instance configurations, and realistic recalibration behaviors. Feedback on the changes includes correcting a typo in the onboarding report where /handon should be changed to /handoff.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
|
||
| <p style="color:var(--text-muted);font-size:.85rem;text-align:center;margin-top:48px"> | ||
| 질문이 있으면 사용자(app.2weeks@gmail.com)에게 직접 또는 새 세션에서 <code>cd ~/Documents/GitHub/glasshat && /handon</code>으로 이어가세요. | ||
| 질문이 있으면 사용자([REDACTED-EMAIL])에게 직접 또는 새 세션에서 <code>cd ~/Documents/GitHub/glasshat && /handon</code>으로 이어가세요. |
There was a problem hiding this comment.
The command /handon appears to be a typo for /handoff, which is the standard Claude Code command used to hand off the session. Consider correcting it to /handoff.
Suggested change
| 질문이 있으면 사용자([REDACTED-EMAIL])에게 직접 또는 새 세션에서 <code>cd ~/Documents/GitHub/glasshat && /handon</code>으로 이어가세요. | |
| 질문이 있으면 사용자([REDACTED-EMAIL])에게 직접 또는 새 세션에서 <code>cd ~/Documents/GitHub/glasshat && /handoff</code>으로 이어가세요. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@claudedocs/2026-06-06-session-handoff.md`:
- Line 35: The document still uses the old term (e.g., "rank-flip") in the
session handoff line; replace all occurrences of previous terminology with the
canonical term "recalibration" across this file (2026-06-06-session-handoff.md)
and the referenced "101-101" doc so the messaging is consistent—search for
strings like "rank-flip" (and any other legacy variants) and update them to
"recalibration" while preserving surrounding context (timestamps, voice/cover
notes, and bracketed details).
- Line 131: The 253 untriaged gitleaks findings must be classified before
merging: run gitleaks and triage each hit into one of false positive / accepted
risk / remediated, record each finding's final status and any remediation notes
into the existing memory/record named "glasshat-spikes-secret-findings", and
produce a static report file (e.g., gitleaks-report.json/html) saved to a
tracked location; then update the session handoff entry for OQ6 to include the
report path and a summary of counts per classification and ensure the PR merge
gate requires this classification step to be completed.
In `@data/devpost-gemini3/README.md`:
- Around line 29-34: Update the README's "Files" table to indicate that
gemini3_dataset.json and projects.json are gitignored/local-only by adding a
status column or annotating their entries as "optional (local-only, gitignored)"
so it matches the earlier paragraph that states the raw scrape is gitignored;
specifically edit the Files table rows referencing "gemini3_dataset.json" and
"projects.json" to include that status and ensure the phrasing mirrors the
sentence "The raw scrape is gitignored" to avoid confusion.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: cefde728-5568-4f27-9e14-aba387bada83
📒 Files selected for processing (14)
.env.example.gitignoreHANDOFF.mdREADME.mdclaudedocs/2026-05-14-session-handoff.mdclaudedocs/2026-05-15-glasshat-onboarding-report.htmlclaudedocs/2026-05-21-session-handoff.mdclaudedocs/2026-05-22-session-handoff.mdclaudedocs/2026-06-02-devpost-text.mdclaudedocs/2026-06-06-session-handoff.mddata/devpost-gemini3/README.mddata/devpost-gemini3/gemini3_dataset.jsondata/devpost-gemini3/projects.jsondocs/gcp-setup.md
| **E4. 덱 재타이밍 + 정직 F10 (#89–#91)** — 덱을 녹음 내러티브 비트에 맞춤(#89). **F10을 "recalibration, not a fake flip"으로 정직화**: 내레이션(#90) + 덱 슬라이드(#91) 모두 — 라이브 `/judge` footage가 "no rank change · ±0 pts · Δ=0"이라 "audit changes who wins" 과대주장을 제거하고 실제 코호트(Glasshat 54.3→52.8 등, 순위 유지)로 교체. | ||
|
|
||
| **E5. 시연 영상 조립 (ffmpeg) — 산출물 = `glasshat-final-v2.mp4`** | ||
| - 내레이션 11비트(MiniMax, voice KimSejun, Speed 1.2; **F10=정직 27초**, cover=F4 재사용→V2에서 교체) + 화면녹화 3개(라이브 감사 / Arize 트레이스 / `/judge` rank-flip) + 덱 영상(Playwright 자동캡처, 2:12). |
There was a problem hiding this comment.
세션 문서 내 용어를 recalibration으로 완전히 통일해 주세요.
이번 코호트 목표가 rank-flip 제거/정정인데, 해당 구간에 이전 용어가 남아 있어 전달 메시지가 흔들립니다.
Also applies to: 101-101
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@claudedocs/2026-06-06-session-handoff.md` at line 35, The document still uses
the old term (e.g., "rank-flip") in the session handoff line; replace all
occurrences of previous terminology with the canonical term "recalibration"
across this file (2026-06-06-session-handoff.md) and the referenced "101-101"
doc so the messaging is consistent—search for strings like "rank-flip" (and any
other legacy variants) and update them to "recalibration" while preserving
surrounding context (timestamps, voice/cover notes, and bracketed details).
| - **OQ3 — 프로드 데모 보안:** 라이브 Cloud Run = `SCORING_MODE=legacy`(주입가능) + judge 엔드포인트 오픈(`JUDGE_API_TOKEN` 미설정). 하드닝 ship됨, 프로드 플립 유저-게이트. README 정직 공개. | ||
| - **OQ4 — Agent Engine vs Cloud Run:** 라이브 Cloud Run = python parity 경로 + 라이브 Phoenix-MCP 보정. genuine ADK 2.0 Workflow deep-trace = 별도 Agent Engine(`7480…`). README가 명확화. | ||
| - **OQ5 — gcloud 풋건:** active project `ss-v2-prod`. `--project` 누락시 프로드(8080 social-seeding) 위험. | ||
| - **OQ6 — 90MB scraped corpus + spikes/ gitleaks ~253 hits** 공개 전 triage 미완(메모리 `glasshat-spikes-secret-findings`). |
There was a problem hiding this comment.
공개 전 gitleaks 미분류 253건은 머지 게이트로 처리해야 합니다.
이 상태로는 민감정보 노출 리스크를 배제할 수 없습니다. 최소한 false positive/accepted risk/remediated로 분류 완료하고, 결과 위치(리포트 경로)를 이 문서에 고정해 추적 가능하게 해주세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@claudedocs/2026-06-06-session-handoff.md` at line 131, The 253 untriaged
gitleaks findings must be classified before merging: run gitleaks and triage
each hit into one of false positive / accepted risk / remediated, record each
finding's final status and any remediation notes into the existing memory/record
named "glasshat-spikes-secret-findings", and produce a static report file (e.g.,
gitleaks-report.json/html) saved to a tracked location; then update the session
handoff entry for OQ6 to include the report path and a summary of counts per
classification and ensure the PR merge gate requires this classification step to
be completed.
Comment on lines
+29
to
+34
| > **The raw scrape is gitignored.** `gemini3_dataset.json` (45 MB) and `projects.json` | ||
| > (42 MB) are the full Devpost-gallery scrape. They are **gitignored** (see `.gitignore`) | ||
| > to respect Devpost's terms on redistributing scraped submissions and to keep the repo | ||
| > lean — nothing in the codebase imports them (verified by `grep`). They were derived from | ||
| > the public gallery at the URLs above; **re-fetch from those pages** if you need the raw | ||
| > dump. The experiment and tests do **not** need them — they run on the tracked golden set. |
There was a problem hiding this comment.
gitignored 안내와 파일 목록 표의 상태 표기를 맞춰주세요.
여기서는 raw scrape 파일이 gitignored/비추적이라고 명시했는데, 아래 Files 표에서는 일반 추적 파일처럼 읽힐 수 있습니다. optional (local-only) 같은 상태를 함께 표기해 혼선을 줄이는 게 좋겠습니다.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@data/devpost-gemini3/README.md` around lines 29 - 34, Update the README's
"Files" table to indicate that gemini3_dataset.json and projects.json are
gitignored/local-only by adding a status column or annotating their entries as
"optional (local-only, gitignored)" so it matches the earlier paragraph that
states the raw scrape is gitignored; specifically edit the Files table rows
referencing "gemini3_dataset.json" and "projects.json" to include that status
and ensure the phrasing mirrors the sentence "The raw scrape is gitignored" to
avoid confusion.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-ups from the 5-agent pre-submission audit (honesty/compliance/security/presentation/live).
Honesty (grep-exposable overclaims): README L25 + Devpost L41/L88
the audit changes who wins→ honest recalibration board (golden-set Δ=0, no fake flip; the deck already disavowed it). README sample9.0 → 7.84→7.6(matches brief + deck SSE).Accuracy: README
min-instances=0→1(matches deploy.sh). Test-count standardized.Security (pre-public): redact GCP billing account id + owner email from 6 tracked files.
.gitignorehardening (*.log *.pem *-key.json …).Hygiene: drop
(Panelyst)from.env.example. Untrack the 87 MB raw Devpost scrape (gemini3_dataset.json+projects.json, gitignored, no code imports them; golden setwinners.json+submissions.jsonstays for hit@13 reproducibility).Presentation: README badges (CI/license/demo) + 3D self-correction screenshot + video placeholder + security callout; fill Devpost repo link.
Verified:
reasoningEngines/7480…is the only serving Agent Engine (docs correct). GitHub Pages landmine handled separately (gh-pages → redirect).Summary by CodeRabbit
릴리스 노트
Documentation
Chores