Self-dogfood release gates: built-in structural engine, cycle removal, actionable Hospital

[2233admin]

Implements the v0.5.1 slice of #14 — verified against a live reproduction of the reported failure, not just the issue text.

Root causes established (full analysis in the #14 comment)

1. CI/release never executed the product path: every pipeline smoke ran with -SkipSentruxGate, and run execute appeared nowhere in CI. Release green proved only that a gate-skipping pipeline doesn't crash.
2. The gate verdict was not a function of the snapshot: the installed sentrux.cmd is a forwarder hardcoded to one dev checkout; sentrux-lite hardcodes cycle_count = 0; the committed baseline was produced by a different engine on a different scale (quality 0.547 float vs 4213 int) with no engine identity recorded.
3. Evidence was amputated twice before the Hospital: the adapter rule contract forbade failure details (failure must be {kind:"none"} even on verdict:"fail"), then Hospital reduced rules to booleans — while the full failing output sat unused in sentrux-command-observation.json in the same run directory.
4. process_failed was aux-node noise (doctor bootstrap contract, worktree .git handling) outranking the real domain verdict (exit 10) in the run outcome.

What this branch does

• Cycle removal, twice: dag_run <-> execution_kernel (run CLI front-end → run_cli.rs, RunError → run_error.rs) and the previously invisible artifact_ref <-> capability (shared primitives → content_contract.rs), found by the new engine's real cycle detection.
• sentrux-native engine in the binary (code-intel sentrux --operation scan|health|check|gate|save_baseline): deterministic metrics, structured violations with target files, resolved-import cycle detection for Rust. evidence.sentrux runs it in-process by default; options.toolPathPrefix still injects an external Sentrux (test seam / V overlay).
• Baseline v2 with engine id/version + source commit; gate fail-closes on engine mismatch.
• Actionable Hospital: failing rules with messages and target files flow through adapter → admission → Hospital JSON/Markdown; surgery is planned whenever an actionable target exists; execution results carry a failures block separating process from domain failures.
• Kernel self-sufficiency: native doctor bootstrap fallback; built-in engine satisfies the Sentrux requirement (a present-but-nonconforming external overlay still fails conformance on purpose); linked-worktree .git pointer files no longer break inventory.
• Ratcheted rules + fresh baseline under the new engine; max_cycles = 0 stays absolute.

Verification (local, Windows)

• cargo fmt --check clean; 973 tests pass; the only failure is advisory_workflow_recommend_… which fails identically on the unmodified tree (local pwsh unicode issue — CI should arbitrate).
• Hospital trust contract: 16/16.
• run execute self-scan on this tree: exit 0.
• Seeded cycle fixture: exit 10 with hospital.md naming cycles exceeded: 1 > 0 (targets: src/a.rs, src/b.rs), the rerun command, and surgery: planned | target: src/a.rs.

Pending: workflow files (token scope)

A second commit (ci(release): release-blocking self-scan and verifiable stable packaging) adds the self-scan job to ci.yml/release.yml and hardens stable packaging (git archive HEAD, .sha256 + release manifest, packaged-binary check/gate). It exists locally but the active OAuth token lacks the workflow scope to push workflow file changes. To land it:

gh auth refresh -h github.com -s workflow
git push origin agent/issue-14-self-dogfood-gates

Refs #14

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

Warning

Review limit reached

@2233admin, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 17 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b056f40d-40e4-4a51-88a8-1265a811aadc

📥 Commits

Reviewing files that changed from the base of the PR and between ddf1cf1 and af1aa3a.

📒 Files selected for processing (7)

• .github/workflows/ci.yml
• .github/workflows/release.yml
• .sentrux/rules.toml
• check-code-intel-tools.ps1
• crates/code-intel-cli/tests/internalization_record.rs
• orchestration/schemas/code-intel-hospital.v1.schema.json
• scripts/tests/test-stable-wrapper-e2e.ps1

📝 Walkthrough

Walkthrough

This PR adds a built-in Sentrux structural gate, introduces Baseline v2 identity checks, restructures CLI execution and content validation, propagates structured failures into Hospital diagnosis, supports native doctor fallback, and updates repository inventory and implementation evidence.

Changes

Native Sentrux execution

Layer / File(s)	Summary
Content contracts and CLI execution crates/code-intel-cli/src/content_contract.rs, crates/code-intel-cli/src/run_cli.rs, crates/code-intel-cli/src/run_error.rs, crates/code-intel-cli/src/main.rs, crates/code-intel-cli/src/dag_run.rs, crates/code-intel-cli/src/capability.rs, crates/code-intel-cli/src/artifact_ref.rs	Shared JSON, artifact-reference, and digest validation is extracted into content_contract; CLI parsing, dispatch, routing, and typed run errors are reorganized.
Native gate metrics and baselines crates/code-intel-cli/src/sentrux_gate.rs, .sentrux/baseline.json, .sentrux/rules.toml	The built-in engine measures repository metrics, evaluates constraints, detects Rust cycles, writes Baseline v2 records, and rejects mismatched baseline identity.
Sentrux evidence and bootstrap integration crates/code-intel-cli/src/builtin_provider_evidence.rs, crates/code-intel-cli/src/sentrux_adapter.rs, crates/code-intel-cli/src/sentrux.rs, crates/code-intel-cli/src/doctor_adapter.rs, check-code-intel-tools.ps1, orchestration/integrations.json	Native and external Sentrux runs use structured commands and violations; rule details are validated, doctor bootstrap can fall back natively, and built-in availability affects tool checks and conformance.
Failure propagation and Hospital reporting crates/code-intel-cli/src/execution_kernel.rs, crates/code-intel-cli/src/main.rs, crates/code-intel-cli/src/hospital_diagnosis.rs	Execution output separates process and domain failures, while structural rule violations flow into diagnosis targets, treatment plans, triage JSON, and Hospital markdown.
Inventory and integration evidence updates crates/code-intel-cli/src/capability_inventory.rs, crates/code-intel-cli/tests/internalization_record.rs, CHANGELOG.md, orchestration/internalization/*.json	Linked-worktree .git pointers are excluded, release behavior is documented, tests reflect the added native gate evidence, and implementation/source digest records are repinned.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related issues

• Issue 14 — Covers the same native Sentrux gating, cycle removal, Hospital diagnostics, and self-scan objectives.

Possibly related PRs

• 2233admin/code-intel-pipeline#7 — Adds the related provider integration and native-gate orchestration surface.
• 2233admin/code-intel-pipeline#8 — Covers adjacent Hospital structural-evidence and surgery-target handling.
• 2233admin/code-intel-pipeline#13 — Reworks the compiled CLI primary execution path used here.

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant SentruxGate
  participant ProviderEvidence
  participant SentruxAdapter
  participant Hospital
  CLI->>SentruxGate: Run check or gate
  SentruxGate-->>ProviderEvidence: Return metrics and violations
  ProviderEvidence->>SentruxAdapter: Emit authoritative rules
  SentruxAdapter-->>Hospital: Provide validated failing-rule details
  Hospital->>Hospital: Derive targets and treatment plan

Loading

Poem

A rabbit hops through gates of code,
With native checks along the road.
Baselines bloom, violations speak,
Hospital plans grow clear and sleek.
Cycles vanish, errors align—
“Ship it,” whispers this hare divine.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title matches the main changes: built-in engine, cycle removals, and improved Hospital reporting.
Description check	✅ Passed	Description is clearly aligned with the code changes and objectives in the pull request.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 12

🧹 Nitpick comments (6)

.sentrux/rules.toml (1)

3-19: 📐 Maintainability & Code Quality | 🔵 Trivial

Ratchet significantly loosens gates — confirm it's tracked.

max_coupling B→D, max_cc 70→162, and no_god_files disabled entirely are large relaxations. The comments frame this as tracked "modernization debt" enforced against further regression only via the baseline no-degradation gate — worth confirming there's a linked issue/ticket to actually tighten these back, since absolute-threshold ratchets have a tendency to become permanent once the baseline is refreshed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.sentrux/rules.toml around lines 3 - 19, The relaxed thresholds in the
[constraints] block need an explicit tracked modernization reference. Add a
linked issue or ticket identifier to the existing comments documenting the
max_coupling, max_cc, and no_god_files relaxations, and ensure it describes the
planned tightening back toward the intended quality gates.

crates/code-intel-cli/src/builtin_provider_evidence.rs (1)

22-25: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Import cycles are broken by re-including files as private modules, which duplicates them. Both sites use #[path = "…"] mod …; for a file that is also (or could be) a crate-root module, so the file is compiled once per parent. Consequences: duplicated code in the binary, per-copy dead-code analysis (the sentrux_gate.rs copy is why Clippy reports scan_json, metrics_json, Violation::rule, Violation::to_json, and EngineRun::violations as never used), and nominally distinct types if any of these helpers ever exposes a struct across the seam. Declaring each of these as a single leaf module in main.rs and importing via crate::… breaks the same cycles without duplication, because a leaf module with no crate-internal imports cannot participate in a cycle.

• crates/code-intel-cli/src/builtin_provider_evidence.rs#L22-L25: drop the #[path] declaration and use crate::sentrux_gate::{self, Violation}, since sentrux.rs already reaches the engine that way.
• crates/code-intel-cli/src/artifact_ref.rs#L6-L10: drop the #[path] declaration, declare mod content_contract; once at the crate root, and import the three helpers via crate::content_contract.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/code-intel-cli/src/builtin_provider_evidence.rs` around lines 22 - 25,
Eliminate duplicated private module inclusion at both affected sites: in
crates/code-intel-cli/src/builtin_provider_evidence.rs:22-25, remove the #[path]
declaration and import sentrux_gate and Violation through crate::sentrux_gate;
in crates/code-intel-cli/src/artifact_ref.rs:6-10, remove the #[path]
declaration, declare content_contract once in the crate root, and import its
three helpers through crate::content_contract.

Source: Linters/SAST tools

crates/code-intel-cli/src/hospital_diagnosis.rs (1)

416-453: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Violation rendering is implemented twice.

treatment and render_hospital both walk details.violations, read message, join targets, and branch on whether the target list is empty — differing only in the bullet prefix and the take(3) caps. Extract one helper (e.g. fn violation_lines(rule: &Value, limit: Option<usize>) -> Vec<String>) so the two views cannot drift, and so the target/violation caps are stated once.

Also applies to: 477-505

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/code-intel-cli/src/hospital_diagnosis.rs` around lines 416 - 453,
Extract the duplicated details.violations traversal from treatment and
render_hospital into a shared violation_lines helper that accepts the rule and
an optional limit, centralizing message extraction, target joining, empty-target
formatting, and violation/target caps. Update both callers to use the helper
while preserving their existing bullet prefixes and output behavior.

crates/code-intel-cli/src/sentrux_gate.rs (2)

485-497: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Every .rs file is read twice per engine run.

measure_project reads all collected files, then rust_import_cycles re-reads each .rs file from disk. sentrux_admission calls run_gate and run_check, so a single provider run performs four full repository reads. Passing the already-decoded contents into rust_import_cycles removes half of the I/O with no behavior change.

♻️ Sketch

-    let mut files = Vec::new();
-    for relative in &paths {
-        let content = fs::read(repo.join(relative)).unwrap_or_default();
-        let content = String::from_utf8_lossy(&content);
-        files.push(measure_file(relative, &content));
-    }
+    let mut files = Vec::new();
+    let mut contents: BTreeMap<String, String> = BTreeMap::new();
+    for relative in &paths {
+        let bytes = fs::read(repo.join(relative)).unwrap_or_default();
+        let content = String::from_utf8_lossy(&bytes).into_owned();
+        files.push(measure_file(relative, &content));
+        if relative.ends_with(".rs") {
+            contents.insert(relative.clone(), content);
+        }
+    }

Then change rust_import_cycles(repo, &paths) to rust_import_cycles(&contents) and read the text from the map instead of the filesystem.

Also applies to: 731-760

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/code-intel-cli/src/sentrux_gate.rs` around lines 485 - 497, Update
measure_project and rust_import_cycles so collected file contents are reused
instead of rereading .rs files from the repository. Store the decoded text
alongside each relative path while building files, then change
rust_import_cycles to accept that contents collection and consume it directly;
update all callers, including run_gate/run_check flows, while preserving
existing cycle-detection behavior.

---

997-1018: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Fixture directories leak when an assertion fails.

fs::remove_dir_all only runs on the success path, so any failing assertion leaves a sentrux-native-* tree in the system temp directory. A drop guard (or a small struct TempFixture(PathBuf) with impl Drop) keeps cleanup unconditional and also removes the duplicated fixture-path construction between both tests.

Also applies to: 1020-1062

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/code-intel-cli/src/sentrux_gate.rs` around lines 997 - 1018, The
temporary fixture directories created by the affected tests leak when assertions
fail. Refactor the shared fixture-path setup around
gate_rejects_legacy_baseline_without_engine_identity and the test at the
referenced neighboring range to use a drop-based cleanup guard, such as a
TempFixture wrapper implementing Drop, and remove the explicit success-path
cleanup while preserving each test’s existing assertions and fixture contents.

crates/code-intel-cli/src/sentrux_adapter.rs (1)

372-392: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

exact is now a special case of exact_with_optional.

Both functions build the same key set; the only difference is the empty optional list. Delegating keeps one definition of "unexpected field".

♻️ Proposed refactor

 fn exact(value: &Value, fields: &[&str], label: &str) -> Result<(), String> {
-    let actual = value
-        .as_object()
-        .ok_or_else(|| format!("{label} must be an object"))?
-        .keys()
-        .map(String::as_str)
-        .collect::<BTreeSet<_>>();
-    let expected = fields.iter().copied().collect::<BTreeSet<_>>();
-    if actual == expected {
-        Ok(())
-    } else {
-        Err(format!("{label} fields are invalid"))
-    }
+    exact_with_optional(value, fields, &[], label)
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/code-intel-cli/src/sentrux_adapter.rs` around lines 372 - 392,
Refactor the existing exact validation function to delegate to
exact_with_optional, passing an empty optional-field list while preserving its
current required fields and label arguments. Keep exact_with_optional as the
single implementation of missing and unexpected field validation.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CHANGELOG.md`:
- Around line 28-33: Update the CHANGELOG release objective bullets to avoid
asserting that authoritative CI/release self-scanning or stable packaging
validation is already implemented. Since those workflow changes remain pending,
defer or narrow the claims to describe the current state accurately; only retain
release-blocking and pre-publication validation language if the corresponding
workflows were added.

In `@check-code-intel-tools.ps1`:
- Around line 303-304: Update the text-mode summary’s $coreMark and $proMark
calculations to treat $builtinSentrux as satisfying sentrux core and pro,
matching the existing $missing logic. Preserve the current found-based marks
when the builtin fallback is not active so non-JSON output reflects the actual
doctor result.

In `@crates/code-intel-cli/src/builtin_provider_evidence.rs`:
- Around line 136-152: The effect declarations in the native evidence
construction must distinguish external Sentrux execution from in-process
gate/check execution. Update the static effect arrays near the native object and
related evidence entries to include process_spawn only when
tool_path_prefix.is_some(), while always retaining repo_read because git_head()
runs unconditionally; apply this consistently to the arrays around the native,
execution, and observational declarations.
- Around line 309-334: Update from_external’s violation extraction to cap the
collected violations at the adapter’s maximum of 32 and truncate each violation
message to at most 1024 characters. Preserve the existing rule, trimming, and
success behavior while ensuring external output cannot produce contract-invalid
details.

In `@crates/code-intel-cli/src/doctor_adapter.rs`:
- Around line 183-204: Update the native observation builder around the
graphProvider and sentrux.builtin fields to use actual availability probes
instead of hardcoded true values. Check cargo with tool_available("cargo",
prefix), and derive graph source and binary presence from their corresponding
paths; derive the builtin Sentrux result from its actual availability check.
Preserve the existing observation schema while ensuring every reported field
reflects the probed environment.
- Around line 160-166: Update the fallback match around run_script_bootstrap so
only AdapterError::Unavailable triggers native_bootstrap(options). Propagate
AdapterError::Contract and all other errors unchanged, preserving native
fallback solely for missing or unavailable script prerequisites.

In `@crates/code-intel-cli/src/execution_kernel.rs`:
- Around line 66-85: Update failures() to classify "domain_unknown" nodes
alongside "domain_failed" in the domain array, preserving the existing node and
verdict fields and fallback behavior so structured failure output matches
first_failure() and reports unknown-domain failures.

In `@crates/code-intel-cli/src/hospital_diagnosis.rs`:
- Line 355: Update the JSON Schema for the code-intel-hospital.v1 triage object
to declare failing_rules while retaining its existing additionalProperties
restriction. Ensure the schema’s failing_rules definition matches the emitted
value from the hospital diagnosis output so documents containing
triage.failing_rules validate successfully.

In `@crates/code-intel-cli/src/sentrux_gate.rs`:
- Line 16: Remove the unused PathBuf import from the std::path use declaration
in sentrux_gate.rs, retaining only Path.

In `@crates/code-intel-cli/src/sentrux.rs`:
- Around line 61-67: Update finish so unsuccessful runs return an error
describing the sentrux operation as failed without claiming a fabricated exit
code; preserve the existing success path and caller-controlled process exit
behavior.

In `@orchestration/integrations.json`:
- Around line 566-571: Update orchestration/integrations.json at lines 566-571
to include crates/code-intel-cli/src/sentrux_gate.rs among the matching evidence
inputs and regenerate the five-digest list; update
orchestration/internalization/sentrux.json at lines 15-18 to add the native gate
source and conformance evidence to operationTrace and bind its digest in
ownedModifications.

In `@orchestration/internalization/rg.json`:
- Around line 5-9: Update the production registry entry for inventory.rg.compat
in integrations.json to use the current capability_inventory.rs digest f8af3e1a…
instead of 43ced9ef…, and refresh any dependent evidence or identity fields that
embed the old digest. Keep the registry and this rg.json record consistent for
the required inventory.rg capability.

---

Nitpick comments:
In @.sentrux/rules.toml:
- Around line 3-19: The relaxed thresholds in the [constraints] block need an
explicit tracked modernization reference. Add a linked issue or ticket
identifier to the existing comments documenting the max_coupling, max_cc, and
no_god_files relaxations, and ensure it describes the planned tightening back
toward the intended quality gates.

In `@crates/code-intel-cli/src/builtin_provider_evidence.rs`:
- Around line 22-25: Eliminate duplicated private module inclusion at both
affected sites: in crates/code-intel-cli/src/builtin_provider_evidence.rs:22-25,
remove the #[path] declaration and import sentrux_gate and Violation through
crate::sentrux_gate; in crates/code-intel-cli/src/artifact_ref.rs:6-10, remove
the #[path] declaration, declare content_contract once in the crate root, and
import its three helpers through crate::content_contract.

In `@crates/code-intel-cli/src/hospital_diagnosis.rs`:
- Around line 416-453: Extract the duplicated details.violations traversal from
treatment and render_hospital into a shared violation_lines helper that accepts
the rule and an optional limit, centralizing message extraction, target joining,
empty-target formatting, and violation/target caps. Update both callers to use
the helper while preserving their existing bullet prefixes and output behavior.

In `@crates/code-intel-cli/src/sentrux_adapter.rs`:
- Around line 372-392: Refactor the existing exact validation function to
delegate to exact_with_optional, passing an empty optional-field list while
preserving its current required fields and label arguments. Keep
exact_with_optional as the single implementation of missing and unexpected field
validation.

In `@crates/code-intel-cli/src/sentrux_gate.rs`:
- Around line 485-497: Update measure_project and rust_import_cycles so
collected file contents are reused instead of rereading .rs files from the
repository. Store the decoded text alongside each relative path while building
files, then change rust_import_cycles to accept that contents collection and
consume it directly; update all callers, including run_gate/run_check flows,
while preserving existing cycle-detection behavior.
- Around line 997-1018: The temporary fixture directories created by the
affected tests leak when assertions fail. Refactor the shared fixture-path setup
around gate_rejects_legacy_baseline_without_engine_identity and the test at the
referenced neighboring range to use a drop-based cleanup guard, such as a
TempFixture wrapper implementing Drop, and remove the explicit success-path
cleanup while preserving each test’s existing assertions and fixture contents.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: afe5ee66-6f01-4b2d-bd8e-bf02be5a019c

📥 Commits

Reviewing files that changed from the base of the PR and between 372dd83 and e746956.

📒 Files selected for processing (23)

• .sentrux/baseline.json
• .sentrux/rules.toml
• CHANGELOG.md
• check-code-intel-tools.ps1
• crates/code-intel-cli/src/artifact_ref.rs
• crates/code-intel-cli/src/builtin_provider_evidence.rs
• crates/code-intel-cli/src/capability.rs
• crates/code-intel-cli/src/capability_inventory.rs
• crates/code-intel-cli/src/content_contract.rs
• crates/code-intel-cli/src/dag_run.rs
• crates/code-intel-cli/src/doctor_adapter.rs
• crates/code-intel-cli/src/execution_kernel.rs
• crates/code-intel-cli/src/hospital_diagnosis.rs
• crates/code-intel-cli/src/main.rs
• crates/code-intel-cli/src/run_cli.rs
• crates/code-intel-cli/src/run_error.rs
• crates/code-intel-cli/src/sentrux.rs
• crates/code-intel-cli/src/sentrux_adapter.rs
• crates/code-intel-cli/src/sentrux_gate.rs
• orchestration/integrations.json
• orchestration/internalization/graph.json
• orchestration/internalization/rg.json
• orchestration/internalization/sentrux.json

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.sentrux/rules.toml:
- Around line 7-8: Restore the prior release-gate thresholds and re-enable the
god-file rule in the policy values consumed by sentrux_gate.rs, keeping the
header documentation consistent with the enforced limits. Do not relax the gate
unless measured ratchet evidence, the baseline, and policy documentation are
updated together.

In `@crates/code-intel-cli/tests/internalization_record.rs`:
- Around line 849-855: Extend the test assertions around the owned entry for
sentrux_gate.rs to verify its local:b03:native-gate-source-sha256 evidence ID
contains the recomputed expected source digest, not merely the path. Reuse the
test’s existing digest computation and expected-value symbols, preserving the
owned count and path checks.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 04fee9d8-7145-4906-9df6-88e4f754b74d

📥 Commits

Reviewing files that changed from the base of the PR and between e746956 and ddf1cf1.

📒 Files selected for processing (13)

• .sentrux/baseline.json
• .sentrux/rules.toml
• CHANGELOG.md
• check-code-intel-tools.ps1
• crates/code-intel-cli/src/builtin_provider_evidence.rs
• crates/code-intel-cli/src/doctor_adapter.rs
• crates/code-intel-cli/src/execution_kernel.rs
• crates/code-intel-cli/src/sentrux.rs
• crates/code-intel-cli/src/sentrux_gate.rs
• crates/code-intel-cli/tests/internalization_record.rs
• orchestration/integrations.json
• orchestration/internalization/graph.json
• orchestration/internalization/sentrux.json

🚧 Files skipped from review as they are similar to previous changes (9)

• check-code-intel-tools.ps1
• .sentrux/baseline.json
• orchestration/internalization/graph.json
• CHANGELOG.md
• crates/code-intel-cli/src/doctor_adapter.rs
• crates/code-intel-cli/src/sentrux.rs
• crates/code-intel-cli/src/execution_kernel.rs
• crates/code-intel-cli/src/sentrux_gate.rs
• crates/code-intel-cli/src/builtin_provider_evidence.rs