triage: Stage 1-pre subsumption check breaks silently at the contents-API size ceiling

[yiliang114]

Summary

Stage 1-pre's subsumption check in .qwen/skills/triage/references/pr-workflow.md is prescribed as one contents-API call per production file (gh api "repos/$REPO/contents/<path>?ref=$DEFAULT_BRANCH"), each downloading the entire file as base64-in-JSON. The endpoint has a silent ceiling: measured against the live API, a 1,017,923-byte file returns content_len: 1,379,853 base64 (~1.36x raw), while files at 1,199,685 / 1,244,804 / 4,025,780 / 5,728,000 bytes all return HTTP 200 with content_len: 0, encoding: "none", and no error. Any production file at or above ~1 MiB therefore can never be judged subsumed, and the comparison silently breaks down exactly on large files.

On a multi-file production diff (Stage 0 explicitly contemplates "10+ files" sweeps) the stage also issues 10+ serial requests against the shared CI PAT's rate limit and transits every full blob through the agent's context.

Proposed scope

Replace the per-file downloads with one constant-cost comparison, e.g. gh pr diff "$PR_NUMBER" vs gh pr diff "$MERGED_PR" (two calls for any N), or fetch the default branch once and diff locally (note the triage checkout is refs/pull/N/merge at fetch-depth: 1, so git fetch --depth 1 --filter=blob:none origin <default-branch> first). This also makes the verdict atomic with respect to base-branch movement during the check.

Source

Review thread PRRT_kwDOPB-92c6c3VLc on #10292 (Stage 1-pre spec review). Deferred from that PR to keep its diff bounded.

[qwen-code-ci-bot]

✅ Qwen Triage finished — view run. See the stage comments in this thread for the result.

✅ Qwen Triage 已完成 —— 查看运行。结果见本线程中的各阶段评论。

[qwen-code-ci-bot]

Triage

• Type: bug
• Labels: type/bug, category/development, scope/ci-cd, priority/P2
• Next: fix belongs in feat(triage): add duplicate / already-fixed gate (Stage 1-pre) #10292 (the Stage 1-pre spec is still unmerged) — replace the per-file contents-API downloads with a constant-cost diff comparison

中文说明

• 类型: bug
• 标签: type/bug, category/development, scope/ci-cd, priority/P2
• 下一步: 修复应落在 feat(triage): add duplicate / already-fixed gate (Stage 1-pre) #10292（Stage 1-pre 规范尚未合并）——将逐文件 contents-API 下载替换为恒定开销的 diff 比较

Stage 2 — Analysis

Evidence carried: static review of the pending spec + read-only live-API probes. No repository code was built or executed (unattended CI).

• Reproduced: yes, against the live API —
  • contents/package-lock.json?ref=main (1,244,804 B — one of the exact sizes measured in this issue): HTTP 200, content_len: 0, encoding: "none" — silent empty response, no error
  • contents/README.md?ref=main (9,841 B): normal base64 content
• Affected area: the Stage 1-pre subsumption check added by feat(triage): add duplicate / already-fixed gate (Stage 1-pre) #10292 (.qwen/skills/triage/references/pr-workflow.md) — the per-file gh api "repos/$REPO/contents/<path>?ref=$DEFAULT_BRANCH" prescription. feat(triage): add duplicate / already-fixed gate (Stage 1-pre) #10292 is still OPEN, so nothing on main is affected yet.
• Root cause: the contents endpoint silently returns empty content above its ~1 MiB ceiling, so a per-file comparison can never confirm subsumption once any production file is that large — the check breaks exactly on the files where a duplicate is most expensive. N serial downloads also spend the shared CI PAT's rate limit and transit every full blob through the agent context.
• Fix direction: replace per-file downloads with one constant-cost comparison. Two options, with trade-offs:
  • gh pr diff $PR_NUMBER vs gh pr diff $MERGED_PR — two calls for any N, but a merged PR's diff is frozen against its original merge base: this judges "subsumed by the merged fix" rather than "present on the current default branch", so later edits/reverts of the same lines stay invisible.
  • Shallow-fetch the default branch and diff locally — exact against current branch state and atomic w.r.t. base movement; the triage checkout is refs/pull/N/merge at fetch-depth: 1, so the spec would first git fetch --depth 1 --filter=blob:none origin <default-branch> (blobless fetch lazy-loads only the blobs git diff touches — raw bytes, no base64 ceiling).
  • Either option must preserve the semantics feat(triage): add duplicate / already-fixed gate (Stage 1-pre) #10292's tests pin: subsumption = every added production line present there AND every deleted production line absent there; a diff with no production changes is never "fully subsumed".
• Not verified: end-to-end Stage 1-pre behavior (spec unmerged; static review only per unattended-CI rules). No user-visible CLI behavior is involved, so no tmux reproduction applies.

--- Qwen Code