feat(audit): T1 audit kernel - contract, rubrics, department registry, hospital wiring - #24
Merged
Conversation
…tal wiring - code-intel-audit-report.v1 schema: findings, score dashboard, coverage matrix - department registry with security/ai-safety/supply-chain slots (enabled:false) - rubrics adapted from Fuck_My_Shit_Mountain (MIT, attributed) - audit_report.rs: serde types, registry loader, fail-closed validate() - hospital.v1 additive optional audit block + hospital.md Audit section - artifact_ref: accept optional audit block at persist time (unblocks T2+) Refs #18
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Warning Review limit reached
Next review available in: 44 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughChangesAudit kernel
Adapter conformance refresh
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant AuditReport
participant DepartmentRegistry
participant HospitalDiagnosis
participant HospitalArtifactValidator
AuditReport->>DepartmentRegistry: load and validate registry
AuditReport->>AuditReport: parse and validate report invariants
AuditReport->>HospitalDiagnosis: provide summary and markdown section
HospitalDiagnosis->>HospitalArtifactValidator: validate optional audit block
HospitalDiagnosis-->>HospitalArtifactValidator: hospital JSON and markdown outputs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🧹 Nitpick comments (7)
crates/code-intel-cli/tests/audit_report.rs (1)
127-153: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winAssert the required disabled department slots.
The uniqueness check is vacuous for an empty or unrelated registry, so this test would not catch removal of
security,ai-safety, orsupply-chain. Assert that those IDs exist and haveenabled == false; allow additional future departments.Suggested assertion
assert_eq!(sorted.len(), ids.len(), "department ids must be unique"); + for expected in ["security", "ai-safety", "supply-chain"] { + let department = registry["departments"] + .as_array() + .unwrap() + .iter() + .find(|department| department["id"] == expected) + .unwrap_or_else(|| panic!("missing required department: {expected}")); + assert_eq!(department["enabled"], false); + }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/tests/audit_report.rs` around lines 127 - 153, Extend registry_file_has_unique_department_ids_and_existing_rubric_and_finding_contract_files to assert that the departments collection contains security, ai-safety, and supply-chain entries, and that each corresponding entry has enabled == false. Retain uniqueness validation and allow additional department IDs.orchestration/schemas/code-intel-audit-report.v1.schema.json (1)
16-19: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winConsider constraining
findingsid uniqueness.Neither the schema nor
AuditReport::validate()rejects two findings sharing anid, so a report with duplicatesecurity-001entries is accepted despite the documented "stable id" contract."uniqueItems": truedoes not cover this; a kernel invariant (duplicate finding id) is the cheaper enforcement point.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@orchestration/schemas/code-intel-audit-report.v1.schema.json` around lines 16 - 19, Enforce uniqueness of finding IDs in the report validation path by updating AuditReport::validate() to detect duplicate values across findings and reject the report. Keep the existing findings array schema unchanged, since uniqueItems would not enforce uniqueness of the finding.id field.crates/code-intel-cli/src/audit_report.rs (3)
1497-1505: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a non-ASCII id case here.
The pattern test is ASCII-only, which is why the
split_atpanic flagged at Line 196 goes unnoticed.assert!(!is_finding_id("日日"));pins the fix.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/src/audit_report.rs` around lines 1497 - 1505, Add a non-ASCII input assertion to finding_id_pattern_accepts_and_rejects_expected_shapes, verifying is_finding_id("日日") returns false and covering the split_at boundary panic case.
1209-1233: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winRegistry validation skips
consumesmodalities andfindingContract.
consumesis accepted as any non-empty string even though the kernel already hasModality::parse, so a typo like"xrey"registers silently. Andfinding_contractis a repo-relative path validated for existence nowhere, unlikerubrics.*. Both are cheap to add here and keep the registry fail-closed.♻️ Proposed additions
for (label, relative) in self.rubrics.paths() { if !repo_root.join(relative).is_file() { return Err(format!("rubrics.{label} file does not exist: {relative}")); } } + if !repo_root.join(&self.finding_contract).is_file() { + return Err(format!( + "findingContract file does not exist: {}", + self.finding_contract + )); + } for department in &self.departments { + for modality in &department.consumes { + if Modality::parse(modality).is_none() { + return Err(format!( + "department \"{}\" consumes unknown modality \"{modality}\"", + department.id + )); + } + } if department.enabled && !repo_root.join(&department.prompt).is_file() {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/src/audit_report.rs` around lines 1209 - 1233, Extend Registry::validate to validate each department’s consumes modality using the kernel’s Modality::parse, returning an error for invalid values while preserving valid entries. Also validate each department’s findingContract path as a repo-relative file that exists, alongside the existing rubrics and enabled prompt checks.
455-472: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winNo
line_end >= line_startinvariant.Both bounds are validated independently, so
{"line_start": 90, "line_end": 3}parses clean and renders into evidence output. Consider rejecting inverted ranges (andline_endwithoutline_start) here, alongside the other fail-closed rules.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/src/audit_report.rs` around lines 455 - 472, Update EvidenceRef::from_value to reject an evidence entry with line_end but no line_start, and reject ranges where line_end is less than line_start after parsing both fields. Return the existing String-based validation error through the same fail-closed path used by the other field checks, while preserving valid single-line and ordered ranges.crates/code-intel-cli/src/artifact_ref.rs (1)
3253-3284: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winFixture is accepted by the validator but would be rejected by
code-intel-hospital.v1.
repo,mode,artifacts,state_machine, etc. arenullhere, while the schema requiresrepoto be a non-empty string,modeto be"atom", andsurgery_plan.verification/discharge_criteriato haveminItems: 1. The test therefore passes only becausevalidate_hospital_reportchecks a subset of the schema, and it can't surface validator/schema drift. Consider deriving the fixture from a schema-valid report (or thehospital_diagnosis::diagnoseoutput) so the audit-block assertions sit on a realistic base.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/src/artifact_ref.rs` around lines 3253 - 3284, Update minimal_hospital_report to use a fully schema-valid hospital report as its base, preferably by deriving it from the established schema fixture or hospital_diagnosis::diagnose output. Ensure required fields such as non-empty repo, mode "atom", and non-empty surgery_plan.verification and discharge_criteria are populated, while preserving the existing audit-block assertions that depend on this fixture.orchestration/schemas/code-intel-hospital.v1.schema.json (1)
158-169: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winTwo ways to express "no audit", and
status: "absent"is unconstrained.The producer omits the whole
auditblock when no audit ran (hospital_diagnosis.rsonly assigns it when a report exists), sostatus: "absent"is never emitted —AuditSummaryStatus::Absentis likewise never constructed. Consumers now have to handle both encodings. Either drop"absent"from the enum, or constrain it so an absent audit cannot carry counters:"properties": { "status": { "enum": ["absent", "present"] }, ... - } + }, + "if": { "properties": { "status": { "const": "absent" } } }, + "then": { + "properties": { + "artifact": { "type": "null" }, + "overall": { "type": "null" }, + "findings_total": { "type": "null" }, + "by_severity": { "type": "null" } + } + }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@orchestration/schemas/code-intel-hospital.v1.schema.json` around lines 158 - 169, The audit schema permits an unused and unconstrained status encoding. Update the audit definition and related producer/consumer symbols so “no audit” has one representation: either remove "absent" and retain only "present", or add conditional validation ensuring absent audits cannot include artifact, overall, findings_total, or by_severity; align AuditSummaryStatus and hospital_diagnosis.rs with the chosen contract.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/code-intel-cli/src/audit_report.rs`:
- Around line 466-469: Run cargo fmt -p code-intel-cli and commit the resulting
rustfmt changes in audit_report.rs, including the affected areas around the
evidence-entry fields and the other reported locations. Do not alter behavior.
- Around line 1032-1065: Add a small Markdown table-cell escaping helper in the
report rendering code that replaces newlines with spaces and escapes pipe
characters before interpolation. Apply it to score-dashboard justifications,
coverage-matrix departments and joined evidence/exclusions, and top-finding
titles (and any other free-text table fields), while leaving formatting such as
scores and severity unchanged.
- Around line 192-203: Update is_finding_id to validate and split the input
using byte slices rather than str::split_at, avoiding any UTF-8 boundary panic
for untrusted non-ASCII values. Preserve the existing four-byte numeric suffix
and allowed prefix checks, adapting iterator closures to the byte-reference
types as needed.
- Around line 785-839: Update validate around the score_dashboard and
coverage_matrix checks to require every score entry and coverage row to
reference a department present in self.departments, not only in registry. For
score entries, require a non-null score only when the corresponding registry
department has enabled == true; reject scored entries for absent or disabled
departments while preserving the existing not_assessed/disabled consistency
checks.
In `@crates/code-intel-cli/src/hospital_diagnosis.rs`:
- Around line 511-513: Update the audit report rendering flow around
render_markdown_section and the audit append in hospital diagnosis to escape all
arbitrary audit values before Markdown interpolation, including justifications,
evidence entries, exclusions, and finding titles. Escape pipe characters for
table cells and normalize or escape newlines so generated hospital.md tables and
lists remain structurally valid.
- Line 58: Update execute to parse and validate the optional audit input, then
pass the resulting value instead of None to both diagnose and render_hospital.
Add an execute-level integration test that supplies audit input and verifies the
generated JSON and Markdown audit fields are populated.
In `@crates/code-intel-cli/tests/audit_report.rs`:
- Around line 59-62: Run rustfmt on the registry_value function so its
serde_json::from_slice and file-reading expression match repository formatting
and pass cargo fmt checks across platforms.
In `@docs/audit-report.md`:
- Around line 22-24: Update the contract table entries for severity, confidence,
and status to use the lowercase wire enum values accepted by the schema and
their parse methods, while preserving the existing references and descriptions.
In `@orchestration/audit/departments.v1.json`:
- Around line 12-40: Update AuditReport::validate() to use the registry’s
departments as the authoritative set: require exact ID membership, reject
missing or unknown departments, and validate every registered department rather
than only report-local entries. Enforce that each department’s enabled flag
matches its run status, including rejecting scores for disabled departments and
omissions from overall.
In `@orchestration/audit/rubrics/confidence.md`:
- Line 5: Update the confidence rubric to use the lowercase wire values high,
medium, low, confirmed, and suspected, while preserving the distinction between
confidence and status. Also update orchestration/audit/rubrics/coverage.md at
lines 5-5 to document the lowercase coverage values high, medium, low, and
not_assessed.
---
Nitpick comments:
In `@crates/code-intel-cli/src/artifact_ref.rs`:
- Around line 3253-3284: Update minimal_hospital_report to use a fully
schema-valid hospital report as its base, preferably by deriving it from the
established schema fixture or hospital_diagnosis::diagnose output. Ensure
required fields such as non-empty repo, mode "atom", and non-empty
surgery_plan.verification and discharge_criteria are populated, while preserving
the existing audit-block assertions that depend on this fixture.
In `@crates/code-intel-cli/src/audit_report.rs`:
- Around line 1497-1505: Add a non-ASCII input assertion to
finding_id_pattern_accepts_and_rejects_expected_shapes, verifying
is_finding_id("日日") returns false and covering the split_at boundary panic case.
- Around line 1209-1233: Extend Registry::validate to validate each department’s
consumes modality using the kernel’s Modality::parse, returning an error for
invalid values while preserving valid entries. Also validate each department’s
findingContract path as a repo-relative file that exists, alongside the existing
rubrics and enabled prompt checks.
- Around line 455-472: Update EvidenceRef::from_value to reject an evidence
entry with line_end but no line_start, and reject ranges where line_end is less
than line_start after parsing both fields. Return the existing String-based
validation error through the same fail-closed path used by the other field
checks, while preserving valid single-line and ordered ranges.
In `@crates/code-intel-cli/tests/audit_report.rs`:
- Around line 127-153: Extend
registry_file_has_unique_department_ids_and_existing_rubric_and_finding_contract_files
to assert that the departments collection contains security, ai-safety, and
supply-chain entries, and that each corresponding entry has enabled == false.
Retain uniqueness validation and allow additional department IDs.
In `@orchestration/schemas/code-intel-audit-report.v1.schema.json`:
- Around line 16-19: Enforce uniqueness of finding IDs in the report validation
path by updating AuditReport::validate() to detect duplicate values across
findings and reject the report. Keep the existing findings array schema
unchanged, since uniqueItems would not enforce uniqueness of the finding.id
field.
In `@orchestration/schemas/code-intel-hospital.v1.schema.json`:
- Around line 158-169: The audit schema permits an unused and unconstrained
status encoding. Update the audit definition and related producer/consumer
symbols so “no audit” has one representation: either remove "absent" and retain
only "present", or add conditional validation ensuring absent audits cannot
include artifact, overall, findings_total, or by_severity; align
AuditSummaryStatus and hospital_diagnosis.rs with the chosen contract.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: cee44ee8-8709-4738-93b5-e6cf42ee5c4a
📒 Files selected for processing (30)
CHANGELOG.mdcrates/code-intel-cli/src/artifact_ref.rscrates/code-intel-cli/src/audit_report.rscrates/code-intel-cli/src/hospital_diagnosis.rscrates/code-intel-cli/src/main.rscrates/code-intel-cli/tests/artifact_index.rscrates/code-intel-cli/tests/audit_report.rscrates/code-intel-cli/tests/codenexus_adapter.rscrates/code-intel-cli/tests/decision_port.rscrates/code-intel-cli/tests/decision_record.rscrates/code-intel-cli/tests/fixtures/audit/audit-report.v1.example.jsoncrates/code-intel-cli/tests/graph_adapter.rscrates/code-intel-cli/tests/method_select.rscrates/code-intel-cli/tests/project_orientation.rscrates/code-intel-cli/tests/run_commit.rscrates/code-intel-cli/tests/sentrux_adapter.rscrates/code-intel-cli/tests/survival_scan.rsdocs/artifact-data-contract.mddocs/audit-report.mdorchestration/audit/departments.v1.jsonorchestration/audit/rubrics/confidence.mdorchestration/audit/rubrics/coverage.mdorchestration/audit/rubrics/evidence.mdorchestration/audit/rubrics/scoring.mdorchestration/audit/rubrics/severity.mdorchestration/internalization/codenexus.jsonorchestration/internalization/graph.jsonorchestration/internalization/sentrux.jsonorchestration/schemas/code-intel-audit-report.v1.schema.jsonorchestration/schemas/code-intel-hospital.v1.schema.json
…f-scan gate
Review fixes:
- is_finding_id operates on bytes (no UTF-8 boundary panic on untrusted ids)
- validate() is registry-authoritative: exact department membership,
enabled/status consistency, score+coverage entries must reference a
department run in the report
- escape markdown table cells in rendered audit sections
- docs/rubrics document lowercase wire values; registry slot test asserts
the three disabled department slots
Gate fix:
- split audit_report.rs (1721 nonblank lines, god-file) into
src/audit_report/{enums,json_helpers,model,registry,validate,render}
plus sibling test files; sentrux gate now reports God 29->29,
Coupling 44.78->44.59, Quality 3971->3973, Cycles 0->0
- update test-harness #[path] includes and internalization digests
Refs #18
…_diagnosis integrations.json pins per-file sha256 toolchain evidence; the audit-kernel changes to artifact_ref.rs and hospital_diagnosis.rs made four pinned digests stale, failing the atomic capability contract tests in CI. Refs #18
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
crates/code-intel-cli/src/audit_report/registry.rs (1)
47-83: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win
consumesisn't validated against theModalityenum.
DepartmentEntry.consumesaccepts any non-empty strings.enums::Modality::parsealready models the closed set of valid modality wire values, butregistry.rsnever applies it here, so a typo'd or unsupported modality indepartments.v1.jsonwould pass registry validation silently instead of failing closed — at odds with issue#18's goal of departments declaring "consumed modalities" through a validated contract.♻️ Proposed fix
impl DepartmentEntry { fn from_value(value: &Value) -> Result<Self, String> { let object = closed_object( value, &[ "id", "title", "enabled", "prompt", "consumes", "applicabilityCheck", "trackingIssue", ], &[], "department entry", )?; + let consumes = required_string_array(object, "consumes", "department entry")?; + for modality in &consumes { + if super::enums::Modality::parse(modality).is_none() { + return Err(format!( + "department entry.consumes has an unrecognized modality \"{modality}\"" + )); + } + } Ok(Self { id: required_str(object, "id", "department entry")?, title: required_str(object, "title", "department entry")?, enabled: required_bool(object, "enabled", "department entry")?, prompt: required_str(object, "prompt", "department entry")?, - consumes: required_string_array(object, "consumes", "department entry")?, + consumes, applicability_check: required_str(object, "applicabilityCheck", "department entry")?, tracking_issue: required_str(object, "trackingIssue", "department entry")?, }) } }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/src/audit_report/registry.rs` around lines 47 - 83, Validate each value in DepartmentEntry::from_value field consumes using enums::Modality::parse, rejecting any unknown or unsupported modality during registry parsing while preserving the existing string storage. Replace the current required_string_array-only acceptance with validation that applies the closed Modality set and propagates a clear error for invalid entries.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/code-intel-cli/src/audit_report/validate.rs`:
- Around line 161-198: Extend validate() alongside rule (e) to enforce that
every DepartmentRunStatus::Assessed department has a matching score_dashboard
entry with a non-null score. Return a validation error identifying the
department when no such entry exists, while leaving non-assessed and disabled
handling unchanged.
---
Nitpick comments:
In `@crates/code-intel-cli/src/audit_report/registry.rs`:
- Around line 47-83: Validate each value in DepartmentEntry::from_value field
consumes using enums::Modality::parse, rejecting any unknown or unsupported
modality during registry parsing while preserving the existing string storage.
Replace the current required_string_array-only acceptance with validation that
applies the closed Modality set and propagates a clear error for invalid
entries.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 4fccdb52-6ed9-48e3-99c1-0350479c6f93
📒 Files selected for processing (31)
CHANGELOG.mdcrates/code-intel-cli/src/artifact_ref.rscrates/code-intel-cli/src/audit_report/enums.rscrates/code-intel-cli/src/audit_report/json_helpers.rscrates/code-intel-cli/src/audit_report/mod.rscrates/code-intel-cli/src/audit_report/model.rscrates/code-intel-cli/src/audit_report/model_tests.rscrates/code-intel-cli/src/audit_report/registry.rscrates/code-intel-cli/src/audit_report/registry_tests.rscrates/code-intel-cli/src/audit_report/render.rscrates/code-intel-cli/src/audit_report/render_tests.rscrates/code-intel-cli/src/audit_report/validate.rscrates/code-intel-cli/src/audit_report/validate_tests.rscrates/code-intel-cli/tests/artifact_index.rscrates/code-intel-cli/tests/audit_report.rscrates/code-intel-cli/tests/codenexus_adapter.rscrates/code-intel-cli/tests/decision_port.rscrates/code-intel-cli/tests/decision_record.rscrates/code-intel-cli/tests/graph_adapter.rscrates/code-intel-cli/tests/method_select.rscrates/code-intel-cli/tests/project_orientation.rscrates/code-intel-cli/tests/run_commit.rscrates/code-intel-cli/tests/sentrux_adapter.rscrates/code-intel-cli/tests/survival_scan.rsdocs/audit-report.mdorchestration/audit/rubrics/confidence.mdorchestration/audit/rubrics/coverage.mdorchestration/audit/rubrics/severity.mdorchestration/internalization/codenexus.jsonorchestration/internalization/graph.jsonorchestration/internalization/sentrux.json
🚧 Files skipped from review as they are similar to previous changes (17)
- crates/code-intel-cli/tests/decision_record.rs
- crates/code-intel-cli/tests/codenexus_adapter.rs
- orchestration/audit/rubrics/coverage.md
- orchestration/audit/rubrics/severity.md
- crates/code-intel-cli/tests/project_orientation.rs
- orchestration/audit/rubrics/confidence.md
- crates/code-intel-cli/tests/graph_adapter.rs
- docs/audit-report.md
- crates/code-intel-cli/tests/decision_port.rs
- crates/code-intel-cli/tests/run_commit.rs
- crates/code-intel-cli/tests/artifact_index.rs
- crates/code-intel-cli/tests/survival_scan.rs
- crates/code-intel-cli/tests/sentrux_adapter.rs
- CHANGELOG.md
- orchestration/internalization/sentrux.json
- crates/code-intel-cli/tests/audit_report.rs
- crates/code-intel-cli/src/artifact_ref.rs
…modalities - new validate() rule (i): an assessed department must have a non-null score entry and a coverage row other than not_assessed, so it cannot silently vanish from the recomputed overall - registry: department consumes entries must parse as known modality wire values (fail-closed on typos) - docs: fail-closed rule 9 + modality wire values in registration steps Refs #18
This was referenced Jul 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #18. Part of the audit layer map #17.
What
The shared audit kernel: contract, rubrics, department registry, and hospital wiring. Departments (T2-T4) slot in later by adding a prompt file and flipping
enabled: true— no kernel change.orchestration/schemas/code-intel-audit-report.v1.schema.json— audit artifact contract (closed object, draft 2020-12, mirrors the hospital schema style). Findings carry severity (Critical..Info), confidence, Confirmed/Suspected status, >=1 evidence ref, failure scenario, minimal fix, regression test, effort, redacted flag.orchestration/audit/departments.v1.json— registry withsecurity/ai-safety/supply-chainpre-declared (enabled: false, prompt path, consumed modalities, applicability check, tracking issue each).orchestration/audit/rubrics/{severity,confidence,evidence,coverage,scoring}.md— adapted from Fuck_My_Shit_Mountain (MIT, attributed in each file). Level vocabulary kept exact.crates/code-intel-cli/src/audit_report.rs— serde types (deny_unknown_fields), registry loader, fail-closedvalidate():docs/hospital-mode.md).auditblock incode-intel-hospital.v1+Option<AuditSummary>in the report builder +## Auditsection in hospital.md (score table, coverage matrix, top findings).artifact_ref.rs: persist-time validator now accepts the optionalauditblock and validates its shape — this closes the latent trap where any future audit producer would have been rejected by the fixed 16-key check.docs/audit-report.md(kernel doc: finding contract table, fail-closed rules, department how-to),docs/artifact-data-contract.mdentry, CHANGELOG.Tests
audit_report.rs, 5 integration tests intests/audit_report.rs(fixture, schema validation, unknown-field rejection, registry invariants), 2 hospital wiring tests (audit absent/present), 1 persist-time validator test (valid block accepted; out-of-range score, unknown severity key, extra key rejected).cargo test -p code-intel --no-runcompiles all 43 test binaries clean.capability_execPowerShell-Unicode facade test,internalization_recordr11 stale.cdigest) are pre-existing on clean HEAD — verified by stash/rerun before these changes, identical failures.Notes
tests/*.rsfiles gained#[path]module includes because each is an independent module tree and now transitively referencesaudit_report; 3orchestration/internalization/*.jsonpinned digests updated accordingly (their regression tests pass).