fix: 29 verified defects — git hardening, Rust correctness, dead routing/facades, CI gates that gate, docs drift - #60
Merged
Conversation
…ng scripts Extend run-code-intel.ps1's GitHardening pattern (core.fsmonitor, core.hooksPath, core.sshCommand, diff.external, core.pager pinned empty + GIT_CONFIG_NOSYSTEM=1) to every git invocation in Invoke-ScopedRepowise.ps1 (incl. the worktree-mutating checkout/reset/clean path), Invoke-CodeNexusLite.ps1, OpenSpec-Detector.ps1, and Invoke-SentruxAgentTool.ps1. Booby-trapped fixture in the scoped-repowise security test proves fsmonitor/hooksPath no longer fire. Closes the security-001 residual documented in #33.
- structured_edit/providers: resolve ast-grep and repowise through tool_path to absolute paths (with .cmd/.bat shim wrapping) instead of bare-name spawns with cwd inside the scanned repo - tool_path: skip relative PATH entries so locate() only returns absolute paths - hardened_git: inject -c core.quotepath=false so non-ASCII paths are emitted verbatim (fixes silent drops in audit scope and sentrux git signals) - change_impact/artifact_ref: replace element-shape unwrap panics with exit-65 contract errors; validate_native_array_artifact now validates element fields - capability_inventory: resolve the workflow-recommendation facade via discover_manifest instead of compile-time CARGO_MANIFEST_DIR - main: add four missing routes to FULL_HELP_TEXT (audit, compatibility retirement-ticket, provider codenexus-adapt, repository survival-scan) - sentrux_gate: require gated metric keys present+numeric in baselines instead of silently comparing against 0.0 - artifact_index: replace remove-then-rename with bak-swap so index.json is recoverable at every instant - audit_report tests: adversarial fixtures now assert the specific rejection reason, not just exit 65 - orchestration records: re-sync toolchain/conformance digest pins to the edited sources
- run-code-intel.ps1: model-routing adoption was dead code (provider normalized to non-empty before the intake guard checked for emptiness) - routed provider/model now win unless the operator explicitly overrode them - update-code-intel-index.ps1: resolve the binary via CODE_INTEL_RUST_CLI, target/release, target/debug, then PATH instead of requiring a debug build that no installer or release ever produces - invoke-code-intel.ps1: load the default pipeline.config.json for the plain -RepoPath shape (artifactRoot was silently dropped); stop rejecting PowerShell common parameters as unsupported options - check-code-intel-tools.ps1: CODE_INTEL_HOME check compared the env var against itself; now checks the directory exists and flags divergence from the default derivation - install-code-intel-pipeline.ps1: pin repowise (==0.36.0) instead of unpinned --upgrade (supply-chain-003 in #35)
- ci.yml: execute the ten previously never-run PS1 suites (incl. the PR #44 model-delegate ai-safety regression suite and the conformance-evidence suites); add the two large PS1 entry points to both parser-check lists; pin choco ripgrep to 14.1.0 in both install sites (supply-chain-002) - parity-observe.yml: provision sentrux + PATH before the parity harness (its only evidenced comparison was structurally vacuous without it); pin actions to commit SHAs and ripgrep to 14.1.0 (restores #43 hardening) - skill-check.yml: link check now actually fails on broken relative links; darwin score gains the missing checkpoint_design scoring branch and drops the unused ANTHROPIC_API_KEY test-run-commit-contract.ps1 is wired continue-on-error: it fails at HEAD with 'facade published an incoherent A07 marker' - pre-existing defect, tracked separately.
- README: the un-flagged run-code-intel.ps1 default is the legacy scanner (Rust DAG is opt-in via -DagCoordinate), not the inverse; artifact/read-flow sections now distinguish primary-entry DAG outputs from legacy-path artifacts; document the 0.6.0 'code-intel audit' command - follow-up-automation: emission and policy reading happen only on the legacy runner; the compiled primary entry does neither - code-intel-architecture: sentrux Pro activation is SENTRUX_AUTO_PRO=1 opt-in, not automatic - public-beta: document release attestation verification with gh attestation verify (supply-chain-007 in #35)
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Warning Review limit reached
Next review available in: 43 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (38)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes 29 adversarially-verified defects: 27 from a fresh 6-lens sweep (Rust core correctness, live PS1 path, CI gate honesty, contract drift, test-suite honesty, security fresh-eyes) plus the two remaining residuals from the self-audit issues.
Every finding was independently discovered, then adversarially re-verified against HEAD before being fixed.
Security (closes #33)
Invoke-ScopedRepowise.ps1(including the worktree-mutating checkout/reset/clean path wherecore.hooksPath/core.fsmonitorfired),Invoke-CodeNexusLite.ps1,OpenSpec-Detector.ps1, andInvoke-SentruxAgentTool.ps1(the previously unreported fourth instance on the live agent path). Regression test boobytraps a fixture repo with fsmonitor/hooksPath canaries.tool_pathabsolute resolution instead of bare names with cwd inside the scanned repo;tool_path::locateskips relative PATH entries.Supply chain (closes #35)
==0.36.0), plan text updated (supply-chain-003)ci.ymlsites (supply-chain-002 residual)gh attestation verifydocumented in docs/public-beta.md (supply-chain-007 residual)Correctness (Rust core)
hardened_gitnow injects-c core.quotepath=false; real-git regression test with a测试.txtfixturechange impactpanicked (unwrap) on committed artifacts that passed validation — now exit-65 contract errors, andvalidate_native_array_artifactvalidates element shapeadvisory.workflow-recommend.compatwas dead for any relocated/CI-built binary (compile-timeCARGO_MANIFEST_DIRonly) — now resolves viadiscover_manifestindex.jsonreplacement crash window removed (bak-swap instead of remove-then-rename)--help --allgained the four unlisted routes (audit,compatibility retirement-ticket,provider codenexus-adapt,repository survival-scan)Live PS1 path
-ModelRoutingResultcould never be adopted (provider was normalized to non-empty before the emptiness guard). Routed values now win unless the operator explicitly overrode them.update-code-intel-index.ps1required atarget\debugbuild no installer/release produces — proper resolution chain (CODE_INTEL_RUST_CLI→ release → debug → PATH)invoke-code-intel.ps1honoredpipeline.config.jsonartifactRoot only for-Repo/-Configshapes; and rejected-Verbose/-ErrorActionas "unsupported"CI gates now gate
test-primary-launchers.ps1(tamper-rejection E2E), and the four conformance-evidence suites pinned by internalization recordsInvoke-ModelChannelDelegate.ps1/Invoke-SentruxAgentTool.ps1added to parser-check listsANTHROPIC_API_KEYremovedDocs drift
-DagCoordinate); artifact/read-flow sections distinguish primary-entry outputs from legacy-path artifacts;code-intel auditdocumentedVerification
cargo test -p code-intel --all-targets: all green (incl. all 40 internalization-record digest tests after final re-sync)test-run-commit-contract.ps1, which fails identically at unmodified HEAD (facade published an incoherent A07 marker) — pre-existing defect, wiredcontinue-on-errorwith a comment, tracked in a follow-up issueNot fixed (deliberate)
sentrux dsmandgate/check— strict behavior is test-pinned as intended; needs a design decisiondocs/artifact-data-contract.mdneeds the same treatmenttest-run-commit-contract.ps1A07 marker incoherence at HEAD — separate issueRefs #33, #35. Sweep and fix executed by a multi-agent workflow (6 finder lenses → adversarial verification → 10 disjoint fix agents → central digest re-sync and full verification).