Gitea setup and live acceptance

Use a dedicated bot token with write:repository, write:issue, and read:user; include read:organization when discovering organization repositories. Grant the bot repository admin on selected repositories if follow-ups are enabled. Gitea 28 requires repository admin to inspect another author's native repository permissions; repository write alone returns HTTP 403. Instance administrator access is unnecessary. See the native permission handler.

Authorize the HTTPS instance host in SCM_ALLOWED_HOSTS on both the web server and Convex backend. Connect through Settings → Code providers, select repositories, and enable indexing/reviews. Credentials are encrypted with CREDENTIAL_ENCRYPTION_KEY and scoped to the workspace and provider.

Allow the exact OpenReview callback hostname in Gitea’s [webhook] ALLOWED_HOST_LIST when outbound delivery is restricted; retain any existing required hosts and restart Gitea after configuration changes. Do not use a wildcard to solve delivery failures.

Create a native Gitea repository webhook using the connection's displayed URL and the same secret supplied during connection. Subscribe to pull requests (including synchronization), reviews, comments, and push events. The receiver verifies the exact body HMAC and records the native delivery identity before dispatching durable work.

Gitea 28 sends submitted comment reviews with the generic pull_request_comment header and review.type: pull_request_review_comment; both identifiers are validated. Direct inline replies arrive as issue_comment with is_pull: true. Native timeline responses omit code comments, so these replies are looked up by exact comment ID, body and author in the PR's scoped review records. Replies use the native /pulls/{index}/comments/{id}/replies endpoint; unsupported server versions fail visibly rather than publishing a general comment as a thread reply. Discussion lookup is bounded to 100 reviews.

Verified on 2026-10-02

An isolated, real Gitea 28.0.0 rootless container was pinned to sha256:c168e7ccb767164793a67e1e874639488260795567337452b06292d1515bea12. A temporary HTTPS tunnel exposed only the disposable provider fixture. Native discovery/selection, three-file durable indexing, signed PR delivery, live model review, one verified inline finding, native thread questions/answers, a submitted-review question/answer, fixed-revision delivery and automatic finding resolution all passed. The fixture author committed the fix through Gitea's native contents API; this did not test a native agent launch or a human Git push.

The defect divided integer cents by 100 in src/price.ts while src/checkout.ts consumed its result. The reviewed buggy commit was 25e92d1a06b62220ce6a5c37c8c0bb97ae7fa340; the fixed commit was 56a4318e8572c84d094acd6d55362a19883599a8. A regression check fetched from that exact fixed commit passed (199 × 3 === 597). That operator-run check was not attached as sandbox runtime evidence; published review summaries continue to report tests as not executed by OpenReview.

Local evidence is retained under ignored output/setup/gitea/: native API probe, persisted reviews/findings/conversations/events/usage, exact-commit regression output and computer-use screenshots. An initial manually supplied adapter finding is explicitly labeled separately from the later real model finding. The first inline event failed before the corrected adapter was deployed; durable retry subsequently completed it. This is one tested self-managed instance, not evidence for every Gitea version or the full provider/OS/agent acceptance matrix.

Computer use found an unsupported “passing test” phrase in the first fixed-revision summary. The shared validator now rejects that phrase without runtime evidence, and the summary prompt describes source assertions separately from execution. The portal's Re-review button launched a new real review; its validated summary explicitly states that no execution evidence was supplied. Historical outputs are retained for diagnosis. The exact old phrase is a runnable regression, and acceptance-result.json checks the old summary is rejected and the new one validates. This acceptance loop used $0.098576 in recorded inference; lint, typecheck, 48 Node checks, 26 Convex checks, production build and ten evaluation-fixture validations passed.

Publisher replay guards

GitHub Cloud/Enterprise and Gitea publication now check the current open head before both new publication and replay. Reuse requires the installing App/dedicated token publisher, the exact head commit, the completed comment-review state, and the terminal run marker. New finding anchors must be added lines in the current native diff and belong to the reviewed commit. Returned review identities are validated; finding mapping rejects human markers, wrong commits/review IDs/locations, quoted markers from bot replies, and missing native findings. The head is checked again after native comment retrieval, so a revision change cannot be reported as a successful current review. Native publication and a simultaneous push cannot be one transaction; already-sent requests may leave an older-commit comment, which fails the final current-head check.

Reply deduplication also requires the actual publisher and thread location. GitHub uses native in_reply_to_id; Gitea binds review ID, path and position. A marker copied into a human comment or quoted inside another bot response is not replay evidence.

The real Gitea fixture's current head 56a4318e8572c84d094acd6d55362a19883599a8 passed a separately labeled native API security check: human review 6 copied the run/finding markers, bot review 7 published independently, replay reused review 7, human finding mapping was rejected, and the old buggy head was rejected before a write. This manually supplied finding tests publication binding; it is not a model finding or application defect. Its fixture comment carries no agent-launch link. Existing Gitea thread answer 14 replayed without a reply write. The existing GitHub PR #4 review 5395058863 and finding comment 4168397552 passed native lookup and replay, and the existing PR #3 general answer replayed without a reply write. No GitHub review writes, commits or inference were used. Evidence and screenshot are in ignored output/setup/publisher-native-check.*; runnable native-contract regressions are tests/publication.test.ts.

Organization-owned repositories discovered through native owner ID/type map to workspace teams when selected. Personal owners stay at workspace scope. Existing connected repositories retain their assignments and review settings on reselection; use Teams & Inheritance to change assignment. Native Gitea membership is not imported into OpenReview. Workspace admins assign members explicitly, and a workspace member without team access cannot read that team's repositories. A private Gitea 28 organization/repository was selected twice in live acceptance without duplicate teams or changes to existing assignments.

Hosted runtime and approval acceptance, 2026-10-03

Gitea now has its own authenticated exact-commit .tar.gz archive adapter, rejecting branch references, invalid repository identities, redirects, missing/oversized streamed bodies (20 MB compressed) and non-gzip responses. Runtime uses the existing digest-pinned, no-network, read-only Docker sandbox. Native individual commit statuses use status, not GitHub's state; ingestion now reads Gitea's combined latest statuses so earlier failed attempts cannot obscure a newer result. Approval reads effective branch checks, preserves human objections, maps native review states, publishes native APPROVED, and verifies bot-scoped dismissal. Automatic approval and runtime remain disabled by default.

The old ephemeral tunnel was confirmed stopped. A new connection was created for https://consolidation-tunnel-explosion-analog.trycloudflare.com rather than overwriting the original provider instance identity. Hosted connection q57a8pnj54w57wc7gak2mt6g7n8fkwrf discovered and selected the existing synthetic repository as m97d0qmej3ptddjenfe4grm7zh8fkm6z; indexing reached ready. Historical connection evidence remains separate. This temporary fixture and local worker are not permanent provider or worker hosting.

Hosted review mx7e8xrfdn6tfj9hywaz1vrkv98fkpz5 fetched native head 56a4318e8572c84d094acd6d55362a19883599a8, ran node --test tests/price.test.mjs through authenticated durable job qh7chgtwwsb3gz1a0ga7qs5btd8fjjcb, recorded actual execution/exit 0/no network and published the source-backed runtime summary. The temporary worker was revoked and its prior repository policy restored. The real approval job was blocked because its low-risk assessment had confidence 0.99, below the required 1. No gate was lowered, assessment changed, approval published or merge performed. Temporary approval/runtime policies were restored and verified. Computer use verified the rendered execution and held approval with no browser warnings/errors.

Native effective-check acceptance created a temporary main protection rule with openreview-acceptance/* and posted explicitly synthetic pending, failure and success statuses. The adapter read each native state and matching pattern correctly. It restored and verified the prior empty branch-protection configuration. These native status fixtures are not executed CI checks; the separate runtime command is execution evidence. This live check exposed and fixed the pre-existing state/status ingestion mismatch.

Evidence is in ignored output/setup/gitea: cloud-state.json, runtime-durable-evidence.json, approval-live-evidence.json, approval-checks-live-evidence.json and approval-runtime-portal.png. Positive native approval/dismissal publication, complex status globs, live human-objection transitions and the full native-agent/provider matrix remain unverified. Other providers keep their unsupported approval state until implemented.

Hosted automatic approval proof (October 4, 2026 UTC)

The disposable native documentation PR #2 at d42a587ba10bec685c0fe08f3fe24f5c44734573 produced hosted review mx78njfdtegf18jefe920v57ws8fny3w from a real signed reopened delivery. The separate Docker worker executed the approved integer-cent regression at that exact revision with no network, exit 0 and one passing test. Six review agents and the summary call produced zero findings, no recorded coverage limitations, low risk and confidence 1 without changing the assessment or lowering gates. The native required status was published only after the actual worker result. Approval job qx79pmzre0wnr573kte7085sed8fmbrq published native bot approval 11 bound to that commit. Restoring the original disabled policy invalidated the job and native review 11 was read back as dismissed. Nothing was merged.

The prior fixture hook still targeted a local app and its outbound allowlist excluded the production hostname. Its URL was repaired, but Gitea 28’s hook-edit implementation does not update the webhook secret. A replacement hook was created with the existing hosted connection secret and identical event subscriptions; the old hook was disabled with history retained. Delivery then triggered the real automatic review. For a changed connection/secret, create a correctly signed replacement and disable the old hook; a successful URL edit alone does not verify signatures.

The test harness’s immediate final assertion preceded asynchronous dismissal and exited nonzero. Subsequent independent native/backend readback confirmed zero active bot approvals, revoked temporary worker, original policies restored, original PR #1 unchanged and PR #2 retained open at its reviewed head. The recorded positive approval and later withdrawal are verified; explicit author-exclusion and replay completion are not claimed. Seven model calls cost $0.017922, bringing cumulative inference to $2.468400 / $5. Evidence: ignored output/setup/gitea/approval-docs-final-evidence.json, approval-positive-live.png and approval-withdrawn-live.png. Computer-use inspection matched the executed test, confidence, approval and final invalidation with no browser warnings/errors.

Immediate approval rechecks (October 4, 2026 UTC)

Signed PR lifecycle/synchronization and review events now schedule the existing revision-bound approval worker before optional review/conversation handling. This does not depend on automatic-review settings or a successful PR ingestion call. The worker re-reads native revisions, decisions and trusted policies; webhook contents never supply approval authority. The five-minute sweep remains recovery for missed or unsupported events. A backend regression covers signed duplicate delivery, disabled automatic reviews, synchronization, human review decisions, unrelated repositories/PRs, native read failure and disabled repository isolation.

Production dpl_F4uV9pXaSJcaNWJ9R93hnUWtU3jk is Ready. Lint, typecheck, 156 Node + 112 Convex tests and local/production builds passed; Convex deployment removed no indexes. A fresh authenticated re-review of the existing documentation PR at its unchanged head ran another actual Docker regression and completed with zero findings/low risk but confidence .98. Job qx75r7qavnvyetft8ynjbdakph8fmb6p correctly stayed blocked; the assessment and maximum-confidence gate were not changed. Original runtime/approval policies were restored, the worker revoked, and zero active bot approvals confirmed.

A real native title edit delivered event q976wsf5mvw5bze61t0y6725818fnmv3; the completed signed event rechecked the existing blocked job, advancing its update timestamp and recording disabled-policy and maximum-confidence reasons. Model calls remained seven before/after; no additional model review was launched. The title was restored through the native API. This establishes the immediate live event path for a blocked job; positive replay, human-objection withdrawal and stale-revision dismissal remain unverified live cases. The new review cost $0.025758; cumulative inference is $2.494158 / $5. Evidence: ignored approval-events-live-evidence.json, approval-native-event-recheck-evidence.json, check/deployment logs and approval-events-blocked-live.png. Computer-use inspection showed passed runtime and correctly blocked approval with no browser warnings/errors.