Azure DevOps Service Hook PR Reviewer — R4 Local Candidate (MC #105847)

Azure DevOps Service Hook PR Reviewer — R4 Local Candidate (MC #105847)

Status

Accepted local candidate; not deployed. No live-operation authorization.

Exact candidate:

• Commit 437e64fd54574e6ff7e6a2665d081c3e6125d080
• Tree 747c83561a71c882f33c042f2094b0a7e4052c45
• Accepted R11 ancestor 925d07206d6e6162adfc80b4a4da3efae1466680

Scope

The candidate implements the validated central boundary for advisory pull-request reviews of only canonical Azure DevOps repositories QODY/QODY and Bilko/Bilko:

1. authenticated, bounded Azure DevOps Service Hook receiver;
2. durable Service Bus handoff with notification GUID as exact messageId;
3. durable Azure Table admission counters capped at 50 per repository and 100 total;
4. strictly sequential worker;
5. accepted R11 diff-only, exact-head-bound, marker-idempotent, comment-only reviewer;
6. default-closed live gate and explicit QODY/Bilko UUID/name/refs/heads/main allowlist.

BasicFakta, LumisCare, GitHub mirrors, client tenants, personal repositories, and inactive repositories are excluded.

Security and infrastructure boundary

• No product-controlled caller YAML or checkout of PR code.
• Dedicated ALAI_AI_REVIEWER_AZURE_TOKEN; never SYSTEM_ACCESSTOKEN.
• Separate explicit receiver and worker managed identities.
• Per-resource RBAC for Service Bus, Table Storage, Key Vault secrets, and ACR pull.
• Immutable image digest guard and pinned Node 25.8 base.
• Service Bus local auth disabled and default-deny firewall restricted to NAT egress.
• Table Storage public/shared-key access disabled with private endpoint/private DNS.
• Bounded, body-free/redacted logging.
• Live deployment parameter defaults closed.

R4 provider-path remediation

R3 was rejected because IaC/live-gate configuration checked a different Gemini executable than accepted runGemini() spawned. R4 resolves this without changing accepted R11 bytes:

• accepted spawn path remains /opt/homebrew/bin/gemini;
• image creates a root-owned symlink from that path to the package-lock-installed Gemini CLI;
• config rejects any path override that differs;
• receiver and worker IaC environments use the same path;
• worker live gate checks the same path;
• actual local image resolves it to Gemini CLI 0.39.1.

Validation

• 154/154 tests passed across 29 suites.
• Lint passed.
• IaC validation and local Bicep compilation passed.
• Production npm audit: zero vulnerabilities.
• Local runtime image: non-root UID 1000, empty provider workspace, Gemini CLI 0.39.1.
• Accepted R11 source blobs remained byte-identical.
• Proveo exact-SHA review: PASS.
• Securion exact-SHA security review: PASS.
• Company Mesh exact-SHA pre-verifier: PASS (mesh-thr-f349f6fb-7108-4bce-be96-4fa3de001d34).

Evidence

• Builder: /Users/makinja/system/evidence/105847/FLOWFORGE-R4-REPORT.md
• Proveo: /Users/makinja/system/evidence/105847/proveo-r4-437e64fd/REPORT.md
• Securion: /Users/makinja/system/evidence/105847/securion-r4-437e64fd/REPORT.md
• Acceptance: /Users/makinja/system/evidence/105847/R4-LOCAL-CANDIDATE-ACCEPTANCE.md
• Candidate README/runbook: tools/ai-pr-reviewer-service-hook/README.md and tools/ai-pr-reviewer-service-hook/RUNBOOK.md at the exact commit.

Deployment boundary

No Azure resources, identities, secrets, Service Hooks, Container Apps, queues, tables, provider calls, comments, package publications, pushes, or merges were created or performed. A separate explicit rollout approval, deployment revision review, and live verification are required before persistent QODY/Bilko coverage can be claimed.