Feature/basuruk/nu 008 schema llm path extractor with provenance enrichment

.github/workflows/ocr_review.yml

@@ -30,7 +30,10 @@ jobs:
                 || github.event.comment.author_association == 'MEMBER'
                 || github.event.comment.author_association == 'COLLABORATOR'
               )
-              && startsWith(github.event.comment.body, '/open-code-review')
+              && (
+                github.event.comment.body == '/open-code-review'
+                || startsWith(github.event.comment.body, '/open-code-review ')
+              )
             )
           )
           && format('ocr-{0}', github.event.pull_request.number || github.event.issue.number)
@@ -48,7 +51,10 @@ jobs:
           || github.event.comment.author_association == 'MEMBER'
           || github.event.comment.author_association == 'COLLABORATOR'
         )
-        && startsWith(github.event.comment.body, '/open-code-review')
+        && (
+          github.event.comment.body == '/open-code-review'
+          || startsWith(github.event.comment.body, '/open-code-review ')
+        )
       )
     steps:
       - name: Get GitHub App Token
@@ -57,6 +63,7 @@ jobs:
         with:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Resolve comment PR refs
         id: pr-context
@@ -73,18 +80,42 @@ jobs:
               ;;
           esac
           pr="$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}")"
+          state="$(jq -er .state <<<"$pr")"
+          if [[ "$state" != "open" ]]; then
+            echo "Pull request is not open (state=${state})" >&2
+            exit 1
+          fi
           base_ref="$(jq -er .base.ref <<<"$pr")"
           head_sha="$(jq -er .head.sha <<<"$pr")"
+          if ! git check-ref-format "refs/heads/${base_ref}"; then
+            echo "Pull request base ref has an unexpected shape" >&2
+            exit 1
+          fi
+          if [[ ! "$head_sha" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "Pull request head SHA has an unexpected shape" >&2
+            exit 1
+          fi
           echo "base_ref=${base_ref}" >> "$GITHUB_OUTPUT"
           echo "head_sha=${head_sha}" >> "$GITHUB_OUTPUT"
 
+      - name: Require LLM token
+        env:
+          OCR_LLM_TOKEN: ${{ secrets.OCR_LLM_TOKEN }}
+        run: |
+          if [ -z "$OCR_LLM_TOKEN" ]; then
+            echo "::error::OCR_LLM_TOKEN secret is empty; the review cannot authenticate against the LLM endpoint (fork pull requests never receive secrets)"
+            exit 1
+          fi
+
       - uses: alibaba/open-code-review@bccbc15f785269400735d5255540c231e6c02b6d # v1.12.9
         with:
           github_token: ${{ steps.app-token.outputs.token }}
           ocr_version: "1.12.9"
           base_ref: ${{ steps.pr-context.outputs.base_ref }}
           head_sha: ${{ steps.pr-context.outputs.head_sha }}
           llm_url: ${{ secrets.OCR_LLM_URL }}
-          llm_auth_token: ${{ secrets.OCR_LLM_AUTH_TOKEN }}
+          llm_auth_token: ${{ secrets.OCR_LLM_TOKEN }}
           llm_model: ${{ vars.OCR_LLM_MODEL }}
-          llm_use_anthropic: ${{ vars.OCR_LLM_USE_ANTHROPIC }}
+          llm_protocol: openai
+          llm_use_anthropic: "false"
+          llm_extra_body: '{"reasoning":{"enabled":true}}'

schema/schema.sql

@@ -97,6 +97,7 @@ CREATE TABLE nuron_ai.documents (
     document_date        DATE,
     tags                 TEXT[] NOT NULL DEFAULT '{}',
     body                 TEXT,
+    compiled_graph       JSONB,
 
     created_at           TIMESTAMPTZ NOT NULL DEFAULT now()
 );
@@ -107,6 +108,8 @@ COMMENT ON COLUMN nuron_ai.documents.content_hash IS
     'sha256(bytes), hex-encoded. Document identity and the RustFS object key {hash[0:2]}/{hash} (ADR-0005) -- never a UUID.';
 COMMENT ON COLUMN nuron_ai.documents.lease_token IS
     'Incremented on every claim. The state-transition UPDATE is conditioned on (claimed_by, lease_token) so a reclaimed lease cannot advance the row out from under its new holder.';
+COMMENT ON COLUMN nuron_ai.documents.compiled_graph IS
+    'Compiler output: {"nodes": [...], "relations": [...], "decisions": [node_key, ...]}, each node/relation carrying its enrichment (author/author_source/timestamp on Decision nodes, evidence_span on Evidence nodes, a provenance ref on every node).';
 
 -- Immutable, versioned snapshot frozen at review-gate-1 approval. This, not the raw
 -- file, is the Evidence root that evidence_span offsets resolve into (CONTEXT.md).

services/nuron-ai/pyproject.toml

@@ -11,6 +11,9 @@ dependencies = [
     "defusedxml>=0.7.1",
     "fsspec>=2026.7.0",
     "llama-cloud>=1.0",
+    "llama-index-core==0.14.23",
+    "llama-index-llms-openai-like==0.8.0",
+    "openai>=2.54.0,<3",
     "psycopg[binary]>=3.3.5",
     "s3fs>=2026.7.0",
 ]
@@ -27,7 +30,7 @@ dev = [
 
 [[tool.mypy.overrides]]
 # These libraries ship no py.typed marker; nothing to check against.
-module = ["defusedxml.*", "fsspec.*"]
+module = ["defusedxml.*", "fsspec.*", "llama_index.llms.openai_like.*"]
 ignore_missing_imports = true