fix(sms-bridge): classify OpenCode error categories - #43
Merged
Conversation
Image CI passedPre-commit validation passed. View the workflow run. |
14 tasks
xnoto
added a commit
to makeitworkcloud/kustomize-cluster
that referenced
this pull request
Sep 5, 2026
## Summary Select the published `opencode-sms-bridge` image tag `35572992f220a0b378bb76283befd1000a0751d6`, produced by [images PR #43](makeitworkcloud/images#43). The image classifies valid OpenCode V1 error turns using a closed PII-safe category, retaining only named-error category and, for API errors, finite HTTP status/retryability. Fixes # None — owner-authorized image-selection follow-up; no driving issue supplied. ## Type of change - [x] Bug fix - [ ] Feature / enhancement - [ ] Documentation - [ ] Infrastructure (OpenTofu root or module) - [x] GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets) - [ ] Container image - [ ] CI / reusable workflow - [ ] Refactor / cleanup - [ ] Breaking change ## Validation - [ ] Required pull-request checks pass — pending; `kustomize-cluster` PR CI is the validation authority. - [x] Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — none apply; the canonical child Application pin is changed directly. Producer evidence: [images `main` build/push run `33979838233`](https://github.com/makeitworkcloud/images/actions/runs/33979838233) succeeded, including the registry push step for the immutable source commit tag. No local Kubernetes, SOPS, OpenTofu, or live-system operation was run or claimed. ## Impact and rollout **Producer:** `makeitworkcloud/images/opencode-sms-bridge` published the selected immutable tag after PR #43 merged. **Consumer:** this PR changes only `workloads/apps/opencode-sms-bridge-app.yaml`; chart version `0.1.2`, Secrets, routing, Service, PVC, TunnelBinding, and OpenCode/provider configuration remain unchanged. **Delivery stages:** this PR authors GitOps desired state only. After an explicitly approved merge and successful `main` test, the automatic `sync` workflow submits root reconciliation. Then verify root revision, child source revisions and health, Pod image/digest/readiness, and one approved-sender text-only SMS separately. **Rollback:** select the prior reviewed immutable bridge tag through a focused GitOps PR; do not retag images or patch the live Deployment. ## Safety and secrets - [x] Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints - [x] No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks - [x] Breaking or irreversible effects are described above with rollback notes AI-assisted change: an OpenCode agent materially produced this change. Reviewers should verify the one-line immutable image selection, producer build/push evidence, and post-merge rollout gates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Classify a structurally valid OpenCode V1
info.errorenvelope into a closed, PII-safe bridge error-code taxonomy. The bridge retains only the OpenCode named-error category and, forAPIError, a numeric HTTP status in the finite 100–599 range plus retryability. It never carries error messages, response bodies, headers, metadata, IDs, or credentials into logs, persisted job detail, or exceptions.This follows the approved-sender test that reached the healthy bridge and returned the bounded
opencode-response-errorresult. It is a diagnostic repair, not a provider/configuration change and does not claim to resolve the underlying OpenCode execution failure.Fixes #
None — owner-authorized diagnostic remediation; no driving issue supplied.
Type of change
Validation
imagespull-request workflow is the validation authority.Added regression coverage for malformed JSON error names, named OpenCode error categories, API status/retryability bounds, and static-code-only behavior. The repository PR workflow runs pre-commit, Gitleaks, hadolint, and actionlint; it does not run the Python unit tests, so no local test execution is claimed. GitHub Advanced Security targeted scanning is unavailable for this repository; CI Gitleaks remains pending.
Impact and rollout
Producer:
makeitworkcloud/images/opencode-sms-bridgeis the canonical source. After an explicitly approved merge, themainbuild automatically publishes a new immutable image tag.Consumer:
kustomize-clusteris unchanged. Selecting any published tag requires a separate reviewed GitOps PR and explicit merge authorization. Argo reconciliation, workload health, and a new approved-sender SMS test are separate downstream gates.Behavior: V1 routes, request bodies, agent routing, model/provider selection, Secrets, and Twilio outbound behavior are unchanged. A valid OpenCode error turn becomes a bounded category such as
provider-auth,context-overflow, or a finite API status/retryability code. The exact provider/runtime cause remains unknown until a post-rollout test yields that category.Rollback: select the previously reviewed immutable bridge tag through canonical GitOps; do not retag an image or patch the live Deployment.
Safety and secrets
AI-assisted change: an OpenCode agent materially produced this change. Independent review identified and verified the malformed-error-name regression guard before PR creation.