Review gate: read CodeRabbit's icon notice and Codex's commit-less receipt

scripts/check-review-threads.sh

@@ -621,7 +621,11 @@ TRIGGER_RE='\A[[:space:]]*@(codex[[:space:]]+(security[[:space:]]+)?review|coder
 # sign-offs, then "**Reviewed commit:** `<sha>`", then a folded "About Codex in GitHub"
 # block. Since 2026-10-15 the comment opens with "<!-- codex-review-receipt:v1 -->", an
 # HTML comment on its own line, which verdict_lines drops like any hidden comment
-# (strip_hidden_comments below). A CodeRabbit review that produces no comments replies
+# (strip_hidden_comments below). That receipt can also name no commit: on #1282
+# (2026-10-25) it was the phrase and sign-off alone, and the summary comment's row read "—"
+# where the commit goes. A receipt in that shape is a verdict that covers nothing, like
+# CodeRabbit's reply below; the marker must be its first line, because the bare phrase
+# without it is not a shape Codex posts (finding 21). A CodeRabbit review that produces no comments replies
 # "Full review finished." (or "Review finished." for an incremental one) folded under
 # "Action performed". Those are verdicts, not findings: they need no disposition. Codex's
 # also covers the commit it names; CodeRabbit's names nothing, and its coverage comes
@@ -860,11 +864,14 @@ def verdict_lines:
              | map(select(length > 0 and . != cr_note))) end;
 def codex_line_re: "^Codex Review: Didn.t find any major issues\\.?( Bravo\\.| Keep it up!| Keep them coming!| Hooray!| Swish!| You.re on a roll\\.| :\\+1:| :rocket:| :tada:| Nice work[.!]| Great job[.!]| Breezy!| 👍| Delightful!| What shall we delve into next\\?| More of your lovely PRs please\\.| Can.t wait for the next one!| Chef.s kiss\\.| Already looking forward to the next diff\\.| Another round soon, please!)?$";
 def reviewed_re: "^\\*\\*Reviewed commit:\\*\\* `(?<sha>[0-9a-f]{7,40})`$";
+def codex_receipt_re: "\\A<!-- codex-review-receipt:v1 -->\n";
 def is_verdict:
-  verdict_lines as $l
+  (. // "") as $b
+  | verdict_lines as $l
   | ($l == ["<details>", "<summary>✅ Action performed</summary>", "Full review finished.", "</details>"])
     or ($l == ["<details>", "<summary>✅ Action performed</summary>", "Review finished.", "</details>"])
-    or (($l | length) == 2 and ($l[0] | test(codex_line_re)) and ($l[1] | test(reviewed_re)));
+    or (($l | length) == 2 and ($l[0] | test(codex_line_re)) and ($l[1] | test(reviewed_re)))
+    or (($l | length) == 1 and ($l[0] | test(codex_line_re)) and ($b | test(codex_receipt_re)));
 def verdict_sha:
   verdict_lines as $l
   | if ($l | length) == 2 and ($l[1] | test(reviewed_re)) then ($l[1] | capture(reviewed_re) | .sha) else "" end;
@@ -939,15 +946,25 @@ def cr_notice_heading_re: "^## (Review limit reached|Review skipped|Reviews paus
 # configuration as "- **Key**: value" (each key with the values it has shown, so a list
 # item holding other text is not a run setting) and links the limits docs at a new path (#1199);
 # every "Review limit reached" notice on ejc3/fcvm PRs on 2026-10-23 matched, except #811,
-# which also carries a Finishing Touches block. A line outside it makes the comment claimable, which is what it was before the
-# exemption existed: the cost of an unlisted shape is one disposition, and the cost of
-# accepting one is a finding nobody has to answer.
+# which also carries a Finishing Touches block. From 2026-10-23 each folded summary opens
+# with an icon, a <picture> of two SVGs from the CodeRabbit icon set (cr_icon_summary_re, one
+# shape per icon and the name it labels). Of the 56 notices without a walkthrough on ejc3/fcvm
+# PRs updated from 2026-10-01 to 2026-10-25, the 31 with icons read as findings until these
+# shapes were listed. A line outside this list makes the comment claimable, which is what it
+# was before the exemption existed: the cost of an unlisted shape is one disposition, and
+# the cost of accepting one is a finding nobody has to answer.
+def cr_icon_summary_re($icon; $name):
+  "^<summary><strong><picture><source media=\"\\(prefers-color-scheme: dark\\)\" srcset=\"https://storage\\.googleapis\\.com/coderabbit_public_assets/review-comment-icons-v1/\($icon)-dark\\.svg\"><img src=\"https://storage\\.googleapis\\.com/coderabbit_public_assets/review-comment-icons-v1/\($icon)\\.svg\" width=\"16\" height=\"16\" align=\"absmiddle\" alt=\"\"></picture> \($name)</strong></summary>$";
 def cr_notice_payload_res:
   [ "^$"
   , "^</?details>$"
   , "^</?(dl|dd)>$"
   , "^<summary><strong>(⚙️ Run configuration|📥 Commits|📒 Files selected for processing: [0-9]+|⛔ Files ignored due to path filters: [0-9]+|View limit details)</strong></summary>$"
   , "^<summary>(⚙️ Run configuration|📥 Commits|📒 Files selected for processing \\([0-9]+\\)|⛔ Files ignored due to path filters \\([0-9]+\\)|How can I continue\\?|How do review limits work\\?|Review details|View limit details)</summary>$"
+  , cr_icon_summary_re("cog"; "Run configuration")
+  , cr_icon_summary_re("git-commit-horizontal"; "Commits")
+  , cr_icon_summary_re("file-plus-corner"; "Files selected for processing: [0-9]+")
+  , cr_icon_summary_re("file-minus-corner"; "Files ignored due to path filters: [0-9]+")
   , "^\\* `[^`]+`( is excluded by `[^`]+`)?$"
   , "^- \\[ \\] <!-- \\{\"checkboxId\": ?\"[0-9a-f-]+\"\\} --> 🔍 Trigger review$"
   , "^\\*\\*(Configuration used|Review profile|Plan)\\*\\*: [A-Za-z0-9 +]+$"

scripts/test-check-review-threads.sh

@@ -2126,6 +2126,152 @@ run_case "a finding inside the Autofix block is claimable" \
 run_case "a finding written as a run-configuration item is claimable" \
   "$(wrap9 "$(cmt coderabbitai Bot 2026-01-01T00:00:00Z "$(jq -n --arg b "$CR_1199" '$b | sub("> - \\*\\*Commit\\*\\*: Unavailable"; "> - **Commit**: P1 this drops the last row")')" 2026-01-02T01:00:00Z)")" 1 "carry no disposition"
 
+echo "== finding 51: the notice and receipt wordings the bots posted from 2026-10-23 =="
+# CodeRabbit's review-limit notice now puts an icon (a <picture> of two SVGs) in front of
+# each folded summary: Run configuration, Commits, Files selected for processing, Files
+# ignored due to path filters. No icon line was a listed shape, so from 2026-10-23 every
+# "Review limit reached" notice on ejc3/fcvm (31 of them by 2026-10-25) read as an
+# unanswered finding. CR_1285 is #1285's notice with its org, run and checkbox ids replaced
+# and the range moved onto this harness's base and head.
+IFS= read -r -d '' CR_1285_RAW <<'CR1285_EOF'
+<!-- coderabbit-ai-generated:v1 -->
+
+<!-- This is an auto-generated comment: summarize by coderabbit.ai -->
+<!-- This is an auto-generated comment: rate limited by coderabbit.ai -->
+
+> [!WARNING]
+> ## Review limit reached
+> 
+> You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.
+> 
+> **Next included review available in 54 minutes.**
+> 
+> [Check out review usage here](https://app.coderabbit.ai/dashboard/review-capacity?orgId=00000000-0000-4000-8000-000000000001).
+> 
+> <details>
+> <summary><strong>View limit details</strong></summary>
+> <dl>
+> <dd>
+> 
+> **Limit details:** You’ve used the included review currently available.
+> 
+> [Learn how review limits work](https://docs.coderabbit.ai/management/rate-limits).
+> 
+> **Review configuration:**
+> 
+> <details>
+> <summary><strong><picture><source media="(prefers-color-scheme: dark)" srcset="https://storage.googleapis.com/coderabbit_public_assets/review-comment-icons-v1/cog-dark.svg"><img src="https://storage.googleapis.com/coderabbit_public_assets/review-comment-icons-v1/cog.svg" width="16" height="16" align="absmiddle" alt=""></picture> Run configuration</strong></summary>
+> <dl>
+> <dd>
+> 
+> - **Source mode**: Auto
+> - **Repository**: Unavailable
+> - **Branch**: Unavailable
+> - **File**: No configuration file from this repository applied
+> - **Commit**: Unavailable
+> - **Layers**: defaults
+> - **Review profile**: CHILL
+> - **Plan**: Advanced
+> - **Run ID**: `00000000-0000-4000-8000-000000000002`
+> 
+> </dd>
+> </dl>
+> </details>
+> 
+> <details>
+> <summary><strong><picture><source media="(prefers-color-scheme: dark)" srcset="https://storage.googleapis.com/coderabbit_public_assets/review-comment-icons-v1/git-commit-horizontal-dark.svg"><img src="https://storage.googleapis.com/coderabbit_public_assets/review-comment-icons-v1/git-commit-horizontal.svg" width="16" height="16" align="absmiddle" alt=""></picture> Commits</strong></summary>
+> <dl>
+> <dd>
+> 
+> Reviewing files that changed from the base of the PR and between @BASE@ and @HEAD@.
+> 
+> </dd>
+> </dl>
+> </details>
+> 
+> <details>
+> <summary><strong><picture><source media="(prefers-color-scheme: dark)" srcset="https://storage.googleapis.com/coderabbit_public_assets/review-comment-icons-v1/file-plus-corner-dark.svg"><img src="https://storage.googleapis.com/coderabbit_public_assets/review-comment-icons-v1/file-plus-corner.svg" width="16" height="16" align="absmiddle" alt=""></picture> Files selected for processing: 2</strong></summary>
+> <dl>
+> <dd>
+> 
+> * `.claude/CLAUDE.md`
+> * `src/uffd/working_set.rs`
+> 
+> </dd>
+> </dl>
+> </details>
+> 
+> </dd>
+> </dl>
+> </details>
+
+<!-- end of auto-generated comment: rate limited by coderabbit.ai -->
+
+<!-- autopilot:start -->
+- [ ] <!-- {"checkboxId":"00000000-0000-4000-8000-000000000003"} --> <strong title="Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts">Autofix</strong> · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
+<!-- autopilot:end -->
+<!-- tips_start -->
+
+
+
+Thanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=ejc3/fcvm&utm_content=1285)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
+
+<details>
+<summary><strong>❤️ Share</strong></summary>
+<dl>
+<dd>
+
+- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)
+- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)
+- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)
+- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)
+
+</dd>
+</dl>
+</details>
+
+
+<sub>Comment `@coderabbitai help` to get the list of available commands.</sub>
+
+<!-- tips_end -->
+CR1285_EOF
+CR_1285=${CR_1285_RAW//@BASE@/$BASE40}; CR_1285=${CR_1285//@HEAD@/$HEAD40}
+cr1285() { jq -n --arg b "$CR_1285" --arg x "${1:-}" '$b + $x'; }
+run_case "the #1285 review-limit notice with icon summaries needs no disposition" \
+  "$(wrap9 "$(cmt coderabbitai Bot 2026-01-01T00:00:00Z "$(cr1285)" 2026-01-02T01:00:00Z)")" 0 "CLEAR"
+# Guards: a notice covers no head; the same body with anything added, or with a finding
+# written where an icon summary's name goes, is a claim; and an icon from anywhere but
+# CodeRabbit's icon set is not a listed shape.
+run_case "the #1285 review-limit notice quoting the head's range covers no head" \
+  "$(wrap7 "[$(cmt coderabbitai Bot 2026-01-01T00:00:00Z "$(cr1285)" 2026-01-02T01:00:00Z)]")" 1 "UNREVIEWED HEAD"
+run_case "the #1285 notice with a finding appended is claimable" \
+  "$(wrap9 "$(cmt coderabbitai Bot 2026-01-01T00:00:00Z "$(cr1285 $'\n\nP1: this drops the last row')" 2026-01-02T01:00:00Z)")" 1 "carry no disposition"
+run_case "a finding written as an icon summary's name is claimable" \
+  "$(wrap9 "$(cmt coderabbitai Bot 2026-01-01T00:00:00Z "$(jq -n --arg b "$CR_1285" '$b | sub("</picture> Commits</strong>"; "</picture> P1: this drops the last row</strong>")')" 2026-01-02T01:00:00Z)")" 1 "carry no disposition"
+run_case "an icon summary whose icon is not CodeRabbit's is claimable" \
+  "$(wrap9 "$(cmt coderabbitai Bot 2026-01-01T00:00:00Z "$(jq -n --arg b "$CR_1285" '$b | sub("icons-v1/cog-dark\\.svg"; "icons-v1/cog-dark.svg?P1-drops-the-last-row")')" 2026-01-02T01:00:00Z)")" 1 "carry no disposition"
+# Codex's receipt can also name no commit: on #1282 (2026-10-25) the receipt was the phrase
+# and its sign-off with no reviewed-commit line, and the summary comment's row for it read
+# "—" where the commit goes. It reports no findings, so it needs no disposition, and it names
+# nothing, so it covers nothing. The receipt marker is what tells it from the bare phrase
+# finding 21 rejects; receipt_nocommit is the #1282 body.
+receipt_nocommit() { jq -n --argjson b "$(receipt_body "$1" 0000000)" '$b | sub("\n\n\\*\\*Reviewed commit:\\*\\* `0000000`"; "")'; }
+run_case "the #1282 receipt that names no commit needs no disposition" \
+  "$(wrap9 "$(cmt "$CODEX" Bot 2026-01-02T01:00:00Z "$(receipt_nocommit " Can't wait for the next one!")")")" \
+  0 "CLEAR"
+run_case "the #1282 receipt that names no commit covers no head" \
+  "$(wrap6 "[$(cmt "$CODEX" Bot 2026-01-02T01:00:00Z "$(receipt_nocommit " Can't wait for the next one!")")]")" \
+  1 "UNREVIEWED HEAD"
+run_case "the #1282 receipt without its marker is claimable" \
+  "$(wrap9 "$(cmt "$CODEX" Bot 2026-01-02T01:00:00Z "$(jq -n --argjson b "$(receipt_nocommit " Can't wait for the next one!")" '$b | sub("<!-- codex-review-receipt:v1 -->\n\n"; "")')")")" \
+  1 "carry no disposition"
+run_case "the #1282 receipt with a finding appended is claimable" \
+  "$(wrap9 "$(cmt "$CODEX" Bot 2026-01-02T01:00:00Z "$(receipt_nocommit $' Can\'t wait for the next one!\n\nP1: the lease is dropped before the rename')")")" \
+  1 "carry no disposition"
+run_case "a human posting the #1282 receipt is claimable" \
+  "$(wrap9 "$(cmt helpful-human User 2026-01-02T01:00:00Z "$(receipt_nocommit " Can't wait for the next one!")")")" \
+  1 "carry no disposition"
+
 echo
 echo "passed=$pass failed=$fail"
 [ "$fail" -eq 0 ]