fix(broker): allow term-llm-reviewer image tag in build policy

[echobt]

Summary

Adds term-llm-reviewer: prefix to the allowed image tags list in the container broker's build policy.

Problem

The LLM reviewer image build was failing with:

Policy violation: Image tag not allowed: term-llm-reviewer:latest

Solution

Updated the image tag whitelist in broker.rs to allow:

• term-compiler: (existing)
• term-llm-reviewer: (new)
• ghcr.io/ (existing)

Testing

• Code compiles: cargo check -p secure-container-runtime passes

Summary by CodeRabbit

• New Features
  • Image build policy now supports an additional container image tag prefix, expanding validation coverage for build operations.

[coderabbitai]

📝 Walkthrough

Walkthrough

The image build policy in broker.rs is expanded to allow a third image tag prefix, term-llm-reviewer:, alongside the existing term-compiler: and ghcr.io/ prefixes. The comment describing the allowed prefixes is updated accordingly.

Changes

Cohort / File(s)	Summary
Image Build Policy crates/secure-container-runtime/src/broker.rs	Expanded allowed image tag prefixes from two to three by adding term-llm-reviewer: to the policy allowlist. Updated contextual comment to reflect the new allowances. Control flow and error handling remain unchanged.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A new prefix hops into the pen,
Where reviewers of language now play,
The broker says "yes!" to term-llm-reviewer,
Alongside the compiler, they've come to stay,
And ghcr.io too, in this expanded way!

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately describes the main change: adding term-llm-reviewer image tag support to the build policy.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/llm-reviewer-image-policy

---

No actionable comments were generated in the recent review. 🎉

🧹 Recent nitpick comments

crates/secure-container-runtime/src/broker.rs (1)

879-884: Consider consolidating the build-image allowlist into SecurityPolicy.

pull_image (line 824) delegates validation to self.policy.validate_image(), but build_image uses a hardcoded inline check. As the number of allowed prefixes grows, keeping them in sync will become error-prone. Moving this list into SecurityPolicy (or a shared constant) would give you a single source of truth.

Not blocking — the comment on line 880 already acknowledges this.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}