fix: restore CI self-check gates - #423
Conversation
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
the
size:XL
|
Warning Review limit reached
Next review available in: 38 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughSummaryThe PR restores bounded CI self-check gates and adds fuzz, rootless policy, and eval reproducibility coverage. It also adds public OKF validation and fixes session-ID filename collisions. The reviewed Rust changes meet the stated quality criteria. Must FixNo blocking issues found. Should FixPin the Consider
Approve / Request ChangesApprove, with the workflow pinning note above. WalkthroughThe PR adds public OKF document validation, daemon bundle validation, collision-safe session paths, viewer tab icons, CI smoke and policy jobs, an eval manifest checksum update, portable PowerShell handling, and a session handoff document. ChangesOKF runtime validation
CI and presentation updates
Session handoff
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant CLI as validate command
participant FS as Bundle filesystem
participant Validator as validate_okf_document
CLI->>FS: Read sanitized bundle file
FS-->>CLI: Return OKF document bytes
CLI->>Validator: Validate parsed OkfDocument
Validator-->>CLI: Return validation errors
CLI-->>CLI: Emit JSON and exit status
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 2⚔️ Resolve merge conflicts 💡
🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| for (index, relation) in document.relations.iter().enumerate() { | ||
| if !entity_ids.contains(relation.source.as_str()) { | ||
| errors.push(OkfValidationError { | ||
| field: format!("relations[{index}].source"), | ||
| code: "dangling_relation_source".into(), | ||
| message: format!("relation source {:?} is not an entity id", relation.source), | ||
| }); | ||
| } | ||
| if !entity_ids.contains(relation.target.as_str()) { | ||
| errors.push(OkfValidationError { | ||
| field: format!("relations[{index}].target"), | ||
| code: "dangling_relation_target".into(), | ||
| message: format!("relation target {:?} is not an entity id", relation.target), | ||
| }); | ||
| } |
There was a problem hiding this comment.
Suggestion: Relation-level provenance is never validated. The OKF v1 specification requires every relation's provenance to clone the document-level provenance, so a relation with a forged corpus or source ID passes validation as long as its endpoints exist. Validate both provenance fields for each relation and report the offending relation field. [incomplete implementation]
Severity Level: Major ⚠️
- ❌ `sl-daemon Validate` accepts forged relation provenance.
- ⚠️ Exported graph provenance can become internally inconsistent.
- ⚠️ Downstream consumers may trust incorrect relation origins.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** src/ports/okf.rs
**Line:** 213:227
**Comment:**
*Incomplete Implementation: Relation-level provenance is never validated. The OKF v1 specification requires every relation's provenance to clone the document-level provenance, so a relation with a forged corpus or source ID passes validation as long as its endpoints exist. Validate both provenance fields for each relation and report the offending relation field.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
| for character in id.chars() { | ||
| match character { | ||
| '_' => encoded.push_str("_x5f"), | ||
| '/' => encoded.push_str("_x2f"), | ||
| '\\' => encoded.push_str("_x5c"), | ||
| ':' => encoded.push_str("_x3a"), | ||
| character => encoded.push(character), | ||
| } |
There was a problem hiding this comment.
Suggestion: The function claims to produce a safe filename component, but characters such as ?, *, <, >, |, and control characters remain unchanged and are invalid in Windows filenames. A session containing any of these characters will cause the subsequent file write to fail, and validation will look for a filename that could never be created. Escape or reject all platform-invalid filename characters. [possible bug]
Severity Level: Major ⚠️
- ❌ Windows ETL export fails for invalid session IDs.
- ⚠️ Validation cannot recover the intended output path.
- ⚠️ User-provided exports may be rejected unexpectedly.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** crates/sl-daemon/src/etl.rs
**Line:** 155:162
**Comment:**
*Possible Bug: The function claims to produce a safe filename component, but characters such as `?`, `*`, `<`, `>`, `|`, and control characters remain unchanged and are invalid in Windows filenames. A session containing any of these characters will cause the subsequent file write to fail, and validation will look for a filename that could never be created. Escape or reject all platform-invalid filename characters.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| span { | ||
| dangerous_inner_html: "{icon_svg(tab.icon())}" | ||
| } | ||
| "{tab.label()}" |
There was a problem hiding this comment.
Suggestion: The injected assets are standalone SVG documents with only a viewBox and no explicit dimensions, and the tab stylesheet has no SVG sizing rule. Rendering them inside a span therefore uses the browser's large default replaced-element dimensions, which can expand each tab and distort the tab bar. Give the icon a fixed size through a class or add an appropriate CSS rule, and strip the XML declaration when embedding the asset. [css layout issue]
Severity Level: Major ⚠️
- ❌ Primary tab navigation can expand or overflow.
- ⚠️ Mobile four-column tab layout becomes distorted.
- ⚠️ All eight viewer tabs inject the unstyled SVGs.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** crates/sl-viewer/src/app.rs
**Line:** 906:909
**Comment:**
*Css Layout Issue: The injected assets are standalone SVG documents with only a `viewBox` and no explicit dimensions, and the tab stylesheet has no SVG sizing rule. Rendering them inside a span therefore uses the browser's large default replaced-element dimensions, which can expand each tab and distort the tab bar. Give the icon a fixed size through a class or add an appropriate CSS rule, and strip the XML declaration when embedding the asset.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| let ts_ms = msg.get("create_time").and_then(|v| v.as_f64().map(|f| f as i64)); | ||
| Some(session_ledger::domain::session::Message { role, content, ts_ms }) |
There was a problem hiding this comment.
Suggestion: ChatGPT mapping exports store create_time as Unix seconds, while Message::ts_ms is explicitly Unix milliseconds. Assigning the seconds value directly makes imported messages appear near 1970 and causes session sorting to place these conversations incorrectly relative to millisecond-based sessions. Convert the value to milliseconds before storing it. [logic error]
Severity Level: Major ⚠️
- ❌ Imported activity timestamps are off by 1,000x.
- ⚠️ Merge ordering can place ChatGPT messages incorrectly.
- ⚠️ Worklog last-activity metadata is inaccurate.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** crates/sl-viewer/src/web_exports.rs
**Line:** 214:215
**Comment:**
*Logic Error: ChatGPT mapping exports store `create_time` as Unix seconds, while `Message::ts_ms` is explicitly Unix milliseconds. Assigning the seconds value directly makes imported messages appear near 1970 and causes session sorting to place these conversations incorrectly relative to millisecond-based sessions. Convert the value to milliseconds before storing it.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 16
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 273: Update the checkout step using actions/checkout to reference the
approved full commit SHA already used by the other checkout steps, ensuring it
pins the intended v7.0.1 release instead of the mutable v7 tag.
- Line 212: Disable persisted checkout credentials by adding
persist-credentials: false to the actions/checkout steps at
.github/workflows/ci.yml lines 212, 233, 245, and 273, covering the fuzz,
rootless-matrix, rootless/no-net, and eval-reproducibility jobs before their
repository-controlled Rust or PowerShell steps.
- Around line 209-216: Pin the fuzz gate’s nightly compiler by replacing the
moving `nightly` values in `RUSTUP_TOOLCHAIN` and the `toolchain` input of
`dtolnay/rust-toolchain` with the same dated nightly version. Keep the existing
`rust-src` component and action revisions unchanged.
In `@crates/sl-daemon/src/etl.rs`:
- Around line 149-164: Update sanitize to produce Windows-portable filenames by
encoding all Windows-invalid characters and control characters, and transform
reserved device basenames such as CON and NUL so they cannot resolve as devices.
Document the supported filename alphabet and add Windows regression coverage for
invalid characters and reserved basenames while preserving injective encoding.
- Around line 149-164: Add backward-compatible bundle discovery in the ETL
lookup and validation flow before relying solely on the new sanitize encoding.
Preserve discovery of files produced by the former non-injective substitution,
including collisions that old encoding could create, while writing new bundles
with sanitize’s escaped format. Ensure sl-daemon validate can find and validate
both legacy and newly encoded bundles.
In `@crates/sl-viewer/src/app.rs`:
- Around line 207-230: Update icon_svg to accept a &Tab instead of a string and
match each Tab variant to its corresponding SVG constant, eliminating the
Bundles fallback. Update its caller to pass &tab and ensure every icon-bearing
Tab variant is explicitly covered.
- Around line 906-909: Update the tab markup around tab.icon() and tab.label()
to mark the icon wrapper with aria-hidden="true" and add explicit visual
separation between the icon and label, using a space or CSS gap without changing
the existing tab label behavior.
In `@HANDOFF-session-2026-08-05.md`:
- Around line 117-126: Correct the Phase 6 inventory count in the heading to
match the listed contents: 45 SVG assets, or 47 total entries including the
build script and installed application. Keep the category rows unchanged unless
adding explicitly missing inventory rows.
- Line 1: Add the required blank lines after each flagged Markdown heading in
the handoff document, and insert blank lines immediately before and after the
table around lines 117–118. Resolve the reported markdownlint MD022 and MD058
violations without changing the document content.
- Around line 45-47: Resolve the protected-branch state recorded in the handoff:
move commits 6ae127f4, 61d517b7, and bf4c8e7d from main onto a new worktree
branch based on origin/main, then open or update a pull request. If an approved
exception permits the commits to remain on main, document that exception before
closing the session.
- Line 50: Update the “Local branches still present” entry in the SessionLedger
handoff cross-reference to point to §2.5 instead of §2.4, preserving the
existing wording and formatting.
- Line 225: Separate the PR `#5` task in the handoff from the dependency-cleanup
completion claim: update the item describing “Review/merge/close Grapheon PR `#5`”
to identify it as the CI follow-up, consistent with its “ci: publish recovered
default required gates” title, while keeping dependency cleanup attributed to PR
`#3` merged and PR `#4` closed.
- Around line 91-93: Update the asset-engine status in the Phase 2 section to
reconcile the branch count with Section 2.4: either explicitly exclude
preserve/asset-engine-archive-20260729 from the live-repository count or state
that one branch remains, while preserving the archive-status details.
- Around line 77-79: Update the “Spotlight count” caveat to remove the
suggestion that `lsregister -f` can validate Spotlight entries. Keep the result
explicitly unverified until `mdimport /Applications/SessionLedger.app` is run
and the same `mdfind` query confirms the expected entry count.
In `@src/ports/okf.rs`:
- Around line 195-228: Update the entity ID tracking in the validation loop
around entity_ids so empty entity.id values are not inserted into the set used
for relation resolution. Keep empty-ID validation intact, and add a regression
test covering an empty entity ID with a relation whose source or target is
empty, ensuring the corresponding dangling-endpoint diagnostic is emitted.
In `@tests/alloc_profile.rs`:
- Around line 84-87: Update the error-handling branch around the pwsh spawn
failure in tests/alloc_profile.rs so the existing fallback logic spanning lines
89-101 is enclosed in a #[cfg(not(target_os = "windows"))] block. Keep the
Windows-specific panic in the #[cfg(target_os = "windows")] path, ensuring the
Windows-expanded code excludes the portable fallback and avoids unreachable_code
warnings.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 7a9f8a7f-03d1-49db-9723-bd6f4dbe623c
📒 Files selected for processing (10)
.github/workflows/ci.ymlHANDOFF-session-2026-08-05.mdcrates/sl-daemon/src/etl.rscrates/sl-daemon/src/main.rscrates/sl-viewer/src/app.rscrates/sl-viewer/src/web_exports.rsdocs/ops/eval-manifest.jsonsrc/lib.rssrc/ports/okf.rstests/alloc_profile.rs
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: Summary
- GitHub Check: browser e2e · axe · responsive · visual
⚠️ CI failures not shown inline (2)
GitHub Check: Summary: The current Mergify configuration is invalid
Conclusion: failure
* Invalid condition 'author=dependabot[bot] | renovate[bot]' @ root → pull_request_rules → item 1 → conditions → item 0 → author=dependabot[bot] | renovate[bot]
```
Invalid GitHub login
```
* Invalid condition 'author=trunk-io[bot] | mergify[bot] | github-actions[bot]' @ root → pull_request_rules → item 2 → conditions → item 0 → author=trunk-io[bot] | mergify[bot] | github-actions[bot]
```
Invalid GitHub login
```
* Invalid condition 'age>=30d' @ root → pull_request_rules → item 8 → conditions → item 2 → age>=30d
```
Invalid attribute
```
* Extra inputs are not permitted @ root → pull_request_rules → item 0 → actions → post_merge
* Extra inputs are not permitted @ root → pull_request_rules → item 1 → actions → post_merge
* Extra inputs are not permitted @ root → pull_request_rules → item 3 → actions → request_reviews → github_accounts
GitHub Check: Mergify Merge Queue: The current Mergify configuration is invalid
Conclusion: failure
* Invalid condition 'author=dependabot[bot] | renovate[bot]' @ root → pull_request_rules → item 1 → conditions → item 0 → author=dependabot[bot] | renovate[bot]
```
Invalid GitHub login
```
* Invalid condition 'author=trunk-io[bot] | mergify[bot] | github-actions[bot]' @ root → pull_request_rules → item 2 → conditions → item 0 → author=trunk-io[bot] | mergify[bot] | github-actions[bot]
```
Invalid GitHub login
```
* Invalid condition 'age>=30d' @ root → pull_request_rules → item 8 → conditions → item 2 → age>=30d
```
Invalid attribute
```
* Extra inputs are not permitted @ root → pull_request_rules → item 0 → actions → post_merge
* Extra inputs are not permitted @ root → pull_request_rules → item 1 → actions → post_merge
* Extra inputs are not permitted @ root → pull_request_rules → item 3 → actions → request_reviews → github_accounts
🧰 Additional context used
📓 Path-based instructions (6)
*
📄 CodeRabbit inference engine (AGENTS.md)
*: Perform feature work in a git worktree under.claude/worktrees/, created fromorigin/mainon a branch named<type>/<topic>, rather than working directly onmain.
Do not make direct commits to protectedmain; use a pull request.
Do not usegit reset --hard,git stash, orgit cleanin worktrees.
Do not use--no-verifyor bypass hooks without operator approval.
Do not work on a branch or worktree another actor is using.
Files:
HANDOFF-session-2026-08-05.md
**/*.{rs,toml}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{rs,toml}: Use the Rust toolchain pinned inrust-toolchain.toml; the workspace MSRV is Rust 1.85.
Validate Rust workspace changes with the prescribed locked build, all-features test suite, Clippy, and rustfmt checks where applicable.
Files:
src/lib.rscrates/sl-viewer/src/web_exports.rssrc/ports/okf.rscrates/sl-viewer/src/app.rscrates/sl-daemon/src/main.rscrates/sl-daemon/src/etl.rstests/alloc_profile.rs
**/*.rs
📄 CodeRabbit inference engine (AGENTS.md)
Fix Clippy warnings; do not add
#[allow]unless it includes a tracking-issue comment.
Files:
src/lib.rscrates/sl-viewer/src/web_exports.rssrc/ports/okf.rscrates/sl-viewer/src/app.rscrates/sl-daemon/src/main.rscrates/sl-daemon/src/etl.rstests/alloc_profile.rs
crates/sl-viewer/**/*.{rs,toml}
📄 CodeRabbit inference engine (AGENTS.md)
crates/sl-viewer/**/*.{rs,toml}: Thesl-viewercrate uses Dioxus 0.6; use the Dioxus CLI/toolchain for desktop development and bundling.
Usecargo check -p sl-vieweras the fast inner-loop check for viewer changes.
Files:
crates/sl-viewer/src/web_exports.rscrates/sl-viewer/src/app.rs
crates/sl-viewer/**/*
📄 CodeRabbit inference engine (AGENTS.md)
When packaging the macOS viewer, account for the documented Electrobun/Dioxus code-signing requirements.
Files:
crates/sl-viewer/src/web_exports.rscrates/sl-viewer/src/app.rs
crates/sl-daemon/**/*.{rs,toml}
📄 CodeRabbit inference engine (AGENTS.md)
Use
cargo test --manifest-path crates/sl-daemon/Cargo.tomlas the fast inner-loop test command forsl-daemonchanges.
Files:
crates/sl-daemon/src/main.rscrates/sl-daemon/src/etl.rs
🪛 LanguageTool
HANDOFF-session-2026-08-05.md
[grammar] ~60-~60: Ensure spelling is correct
Context: ...ecovered default required gates` | > Discrepancy vs prior summary: prior summary claim...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
[style] ~137-~137: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...&str) -> &'static strlookup helper. - Addeddangerous_inner_html: "{icon_svg(tab.i...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~182-~182: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...b-pages / per-page additional panels. - No "feed data" affordance — user cannot po...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🪛 markdownlint-cli2 (0.23.2)
HANDOFF-session-2026-08-05.md
[warning] 1-1: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 85-85: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 91-91: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 95-95: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 99-99: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 109-109: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 117-117: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 118-118: Tables should be surrounded by blank lines
(MD058, blanks-around-tables)
[warning] 128-128: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 133-133: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 140-140: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 160-160: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 164-164: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 170-170: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 173-173: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 178-178: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 184-184: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 189-189: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 192-192: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
🪛 zizmor (1.29.0)
.github/workflows/ci.yml
[warning] 212-212: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 233-233: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 245-245: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[info] 213-213: action functionality is already included by the runner (superfluous-actions): use rustup and/or cargo in a script step
(superfluous-actions)
[warning] 273-273: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 273-273: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🔇 Additional comments (12)
crates/sl-daemon/src/etl.rs (2)
269-270: LGTM!
211-236: 📐 Maintainability & Code QualityRun the required daemon checks with the pinned toolchain.
crates/sl-daemonchanges require the pinned Rust toolchain plus the prescribed daemon test, locked workspace build, workspace all-features test suite,clippy, andrustfmtchecks.crates/sl-viewer/src/web_exports.rs (1)
81-81: LGTM!Also applies to: 90-90, 106-107, 118-118, 180-222
src/ports/okf.rs (2)
126-140: LGTM!Also applies to: 167-193
263-346: LGTM!src/lib.rs (1)
65-68: LGTM!crates/sl-daemon/src/main.rs (2)
296-300: LGTM!Also applies to: 1160-1185, 1360-1380
1360-1380: 📐 Maintainability & Code QualityReport validation from a complete Rust build environment.
The checks cannot reach the project tests because
zstd-sysfails to compile:cccannot executecc1.cargo fmtis unavailable. Use Rust 1.96.0 withrustfmtandclippy, plus a working C compiler, then run the required commands.crates/sl-viewer/src/app.rs (3)
97-110: LGTM!
437-437: LGTM!
906-909: 🎯 Functional CorrectnessVerify the viewer build against the repository toolchain and Dioxus version.
Run
cargo check -p sl-viewerwith the Rust toolchain pinned inrust-toolchain.toml. The supplied context is inconsistent: the path instruction says Dioxus 0.6, while the library context says Dioxus 0.7.0. Confirm the declared version inCargo.tomlandCargo.lockbefore relying on this API. The official Dioxus 0.7 documentation listsdangerous_inner_htmlas an RSX escape hatch. (dioxuslabs.com)As per coding guidelines, use the pinned Rust toolchain and
cargo check -p sl-viewerfor viewer changes.Source: Coding guidelines
docs/ops/eval-manifest.json (1)
47-47: 🗄️ Data Integrity & IntegrationManifest hash matches
Cargo.lock.
| RUSTFLAGS: "" | ||
| RUSTUP_TOOLCHAIN: nightly | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | ||
| - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # nightly for fuzz | ||
| with: | ||
| toolchain: nightly | ||
| components: rust-src |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow context =="
if [ -f .github/workflows/ci.yml ]; then
sed -n '1,280p' .github/workflows/ci.yml | cat -n
fi
echo "== search for rust nightly / cargo-fuzz / RUSTUP_TOOLCHAIN =="
rg -n "RUSTUP_TOOLCHAIN|rust-toolchain|cargo-fuzz|nightly|nightly|AddressСанizer|asan|instrument| fuzz" .github . 2>/dev/null | head -200 || trueRepository: KooshaPari/SessionLedger
Length of output: 34427
🌐 Web query:
rustup toolchain nightly behavior moving nightly channel dtolnay rust-toolchain action toolchain nightly
💡 Result:
The nightly release channel in Rust is updated daily [1]. Because nightly builds are experimental, they may occasionally be unavailable or lack certain non-default components (such as clippy or rustfmt) [1][2]. When rustup updates the nightly channel, it attempts to find the most recent version that contains all your currently installed components [3]. If the latest nightly is missing a component, rustup will automatically search for an older, viable nightly release that satisfies your requirements [3]. To force an update to the absolute latest nightly regardless of missing components, you can use the --force flag with rustup toolchain install [1][2]. To pin a project to a specific, stable version of a nightly toolchain, you should use a rust-toolchain.toml file in your project root [4]. This file ensures that everyone working on the project uses the same toolchain [4]: [toolchain] channel = "nightly-2022-01-01" When using the dtolnay/rust-toolchain GitHub Action, you can specify the nightly channel either via the action revision (e.g., uses: dtolnay/rust-toolchain@nightly) or by using the @master revision and providing a toolchain input [5][6]: - uses: dtolnay/rust-toolchain@master with: toolchain: nightly-2022-01-01 If you need to ensure a specific nightly is used in a CI environment, pinning by date is the recommended approach to avoid unexpected breakage from unstable nightly changes [7][2].
Citations:
- 1: https://rust-lang.github.io/rustup/concepts/channels.html
- 2: https://rust-lang.github.io/rustup/devel/concepts/channels.html
- 3: Update to most recent viable nightly rust-lang/rustup#1997
- 4: https://rust-lang.github.io/rustup/overrides.html?highlight=toolchain
- 5: https://github.com/dtolnay/rust-toolchain
- 6: https://cicube.io/workflow-hub/dtolnay-rust-toolchain/
- 7: https://users.rust-lang.org/t/how-to-specify-the-default-nightly-version-ie-nightly-with-rustup/107177
🌐 Web query:
Cargo AddressSanitizer nightly channel rustc AddressSanitizer changes
💡 Result:
As of August 2026, AddressSanitizer (ASan) in Rust continues to be primarily supported via the nightly channel, though work has been ongoing to stabilize it [1][2]. Key points regarding AddressSanitizer and the nightly channel: Usage: To enable AddressSanitizer, you typically use the nightly toolchain and the -Z sanitizer=address compiler flag [1][3]. Because this is an unstable feature, it generally requires -Z build-std to rebuild the standard library with instrumentation, ensuring that both your code and the standard library are compatible [1][4]. Target Requirements: You must specify a target triple when using these flags to avoid instrumenting procedural macros or build scripts, which can cause build failures [1]. Ongoing Changes: There have been significant efforts to stabilize AddressSanitizer and LeakSanitizer [2]. As these features transition toward stability, there has been a shift away from exclusive reliance on the -Zsanitizer flag toward standard codegen options, although -Zunstable-options is often still required during the transition [2]. Specialized Targets: For specific platforms like x86_64-unknown-linux-gnu, there have been dedicated "asan" targets (e.g., x86_64-unknown-linux-gnuasan) intended to allow the use of pre-instrumented standard libraries, reducing the need for build-std [5]. Caveats: ABI Mismatches: Mixing instrumented and non-instrumented code can lead to ABI mismatch errors [4]. Procedural Macros: It is advised to avoid applying sanitizer flags to procedural macros or build scripts by explicitly passing the --target flag to Cargo [1]. For the most up-to-date instructions for your specific environment, refer to the Rust Unstable Book section on compiler flags for sanitizers [1].
Citations:
- 1: https://doc.rust-lang.org/nightly/unstable-book/compiler-flags/sanitizer.html
- 2: sanitizers: Stabilize AddressSanitizer and LeakSanitizer rust-lang/rust#123617
- 3: https://www.rustfaq.org/en/how-to-use-address-sanitizer-asan-with-rust/
- 4: Running sanitizer tests fails with mixed ABI errors rust-lang/rust#147394
- 5: https://doc.rust-lang.org/nightly/rustc/platform-support/x86_64-unknown-linux-gnuasan.html
🌐 Web query:
rustc nightly channel reproducible rustup nightly toolchain cargo fuzz sanitizer
💡 Result:
Using the nightly channel with tools like cargo-fuzz and managing reproducible builds involves several distinct mechanisms in the Rust ecosystem. Nightly Toolchain and Reproducibility The nightly channel provides the latest, experimental compiler features but is not guaranteed to be stable or reproducible by default [1]. While there is ongoing, active development toward making rustc builds more deterministic—including discussions around new flags like --reproducible to manage diagnostic and binary output [2][3]—achieving bit-for-bit reproducibility remains a significant challenge [4][5]. Factors such as the presence of standard library source code on the host can affect build outputs, sometimes resulting in different hash values for the same source code [6]. For high-stakes reproducible needs, some users find that building the compiler from source (bootstrapping) can yield more deterministic results than relying on pre-built nightly binaries [7]. You can pin to a specific nightly release using rustup to ensure consistency across environments [8][1]. Cargo Fuzz and Sanitizers Cargo-fuzz is a toolchain-dependent utility that typically requires the nightly compiler because it relies on unstable command-line flags and LLVM sanitizer support [9][10][11]. 1. Requirements: By default, the standard fuzzing workflow requires a nightly compiler to access features like address sanitization [10]. 2. Sanitizers: Sanitizers (e.g., AddressSanitizer, MemorySanitizer) are enabled via compiler flags in the nightly channel [10][12]. 3. Stable Support: While the default, sanitizer-backed workflow is nightly-only, cargo-fuzz supports a reduced mode using --sanitizer none that can operate on stable Rust, though this mode does not provide sanitizer-based findings [13]. To set up your environment, use rustup to manage the toolchain [10]: $ rustup install nightly $ rustup default nightly If your project requires a specific nightly version for reproducibility, you can create a rust-toolchain.toml file in your project root to pin it [8][1]: [toolchain] channel = "nightly-2026-08-07" Top results: [8], [6], [1], [10], [13], [3], [5]
Citations:
- 1: https://rust-lang.github.io/rustup/concepts/channels.html
- 2: rustc: Support
--reproducibleoption for requesting reproducible output rust-lang/rust#160448 - 3: Add reproducible build verification to bootstrap rust-lang/rust#144669
- 4: Bit-for-bit deterministic / reproducible builds rust-lang/rust#34902
- 5: Tracking Issue for Reproducible Build bugs and challenges rust-lang/rust#129080
- 6: Strict version hash is sensitive to presence of standard library source code on host rust-lang/rust#153898
- 7: Bootstrapped compiler is deterministic in a way that the released compiler is not rust-lang/rust#144715
- 8: https://rust-lang.github.io/rustup/overrides.html?highlight=toolchain
- 9: https://github.com/rust-fuzz/cargo-fuzz
- 10: https://rust-fuzz.github.io/book/cargo-fuzz/setup.html
- 11: https://docs.rs/crate/cargo-fuzz/0.5.2
- 12: https://github.com/rust-fuzz/cargo-fuzz/blob/main/CHANGELOG.md
- 13: Clarify stable support for --sanitizer none rust-fuzz/cargo-fuzz#440
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== rust toolchain pin files =="
for f in rust-toolchain rust-toolchain.toml docs/ops/rustc-toolchain-pin.md rustc-toolchain-pin.json; do
if [ -f "$f" ]; then
echo "--- $f"
cat -n "$f"
fi
done
echo "== selfcheck script relevant sections =="
sed -n '45,185p' scripts/rustc-toolchain-check.ps1 | cat -n
python3 - <<'PY'
from pathlib import Path
import re, json
for p in ['rust-toolchain.toml', 'rust-toolchain']:
s = p.read_text(errors='ignore') if p.exists() else ''
print(f'FILE {p}:')
print(s[:800] if s else '(missing)')
m = re.search(r'(?:^\[toolchain\]\s*$|[\s\n])channel\s*=\s*"([^"]+)"', s, re.M) or re.search(r'(?:^|\s)(nightly-?[^\s,;}]+)', s)
print('derived channel:', m.group(1) if m else 'not found')
for p in ['docs/ops/rustc-toolchain-pin.md', 'rustc-toolchain-pin.json']:
if p.exists():
print(f'--- {p}')
if p.suffix == '.json':
print(json.dumps(json.loads(p.read_text()), indent=2))
else:
print(p.read_text())
PYRepository: KooshaPari/SessionLedger
Length of output: 10495
🌐 Web query:
dtolnay rust-toolchain action RUSTUP_TOOLCHAIN toolchain input environment variable rustup
💡 Result:
The dtolnay/rust-toolchain GitHub Action is designed to install a specified Rust toolchain using rustup [1][2]. It does not natively use the RUSTUP_TOOLCHAIN environment variable as an input; instead, it relies on its own toolchain input parameter or the action's revision (@rev) to determine which toolchain to install [1][3]. However, because rustup itself respects the RUSTUP_TOOLCHAIN environment variable [4][5], users often set this variable in their GitHub Actions workflow to override the default toolchain behavior, particularly when dealing with conflicts between the action's installed toolchain and local project configuration files (like rust-toolchain.toml) [6]. Key points regarding these components: 1. dtolnay/rust-toolchain Action: This action installs a toolchain and executes rustup default [3][7]. It is not configured to read RUSTUP_TOOLCHAIN for its installation logic [1][2]. If you need to install a specific toolchain, use the toolchain input (e.g., with: toolchain: 1.85.0) [1][3]. 2. RUSTUP_TOOLCHAIN Variable: This is a standard rustup environment variable that, when set, overrides all other toolchain selection mechanisms (such as rust-toolchain.toml files or directory overrides) [4][5][8]. 3. Interaction: In complex CI workflows, if you find that rustup is ignoring the toolchain installed by the dtolnay/rust-toolchain action in favor of a local rust-toolchain.toml file, you can explicitly set RUSTUP_TOOLCHAIN in your workflow's env block to the same version installed by the action [6]. This forces rustup to use your desired toolchain regardless of project-level overrides [4][5]. Example of overriding in a workflow: jobs: test: runs-on: ubuntu-latest env: RUSTUP_TOOLCHAIN: stable steps: - uses: actions/checkout@v4 - uses: dtolnay/rust-toolchain@master with: toolchain: stable - run: cargo test In this example, setting RUSTUP_TOOLCHAIN ensures that subsequent cargo commands honor the stable toolchain even if a different one is specified elsewhere in the repository [4][6].
Citations:
- 1: https://github.com/dtolnay/rust-toolchain/
- 2: https://github.com/dtolnay/rust-toolchain/blob/master/README.md
- 3: https://github.com/dtolnay/rust-toolchain/blob/master/action.yml
- 4: https://rust-lang.github.io/rustup/environment-variables.html
- 5: https://rust-lang.github.io/rustup/overrides.html?highlight=toolchain
- 6: https://github.com/payjoin/rust-payjoin/blob/b947de469f8baecac2af814df341a0529cc02888/.github/workflows/rust.yml
- 7: https://github.com/dtolnay/rust-toolchain/blob/ea97cfc50333d3778a5ae44b7cde075ba6610d6d/action.yml
- 8: https://rust-lang.github.io/rustup/devel/overrides.html
Pin the nightly compiler used by the fuzz gate.
RUSTUP_TOOLCHAIN: nightly overrides the rust-toolchain.toml exact pin, and toolchain: nightly installs the moving channel before the test runs. A future nightly can change the compiler, cargo-fuzz, or AddressSanitizer behavior while the action revision stays the same. Use a dated nightly in both the environment and the toolchain input, or use a pinned nightly toolchain configuration for this job.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 212-212: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[info] 213-213: action functionality is already included by the runner (superfluous-actions): use rustup and/or cargo in a script step
(superfluous-actions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 209 - 216, Pin the fuzz gate’s nightly
compiler by replacing the moving `nightly` values in `RUSTUP_TOOLCHAIN` and the
`toolchain` input of `dtolnay/rust-toolchain` with the same dated nightly
version. Keep the existing `rust-src` component and action revisions unchanged.
| RUSTFLAGS: "" | ||
| RUSTUP_TOOLCHAIN: nightly | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== file stats =="
wc -l .github/workflows/ci.yml || true
echo "== relevant checkout sections =="
sed -n '180,285p' .github/workflows/ci.yml
echo "== checkout usages with line numbers =="
nl -ba .github/workflows/ci.yml | sed -n '200,280p' | grep -n 'checkout\|persist-credentials\|permissions:' || true
echo "== repo-controlled Rust/PowerShell context around checkout jobs =="
# Print surrounding step names and shell/action commands after each checkout line, without executing repo code.
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/ci.yml')
lines=p.read_text().splitlines()
checks=[]
for i,l in enumerate(lines,1):
if '- uses: actions/checkout@' in l:
checks.append(i)
for idx in checks:
print(f'-- checkout at line {idx} --')
for j in range(max(1,idx), min(len(lines), idx+25)+1):
if j==idx: continue
if any(tok in lines[j-1].lower() for tok in ['run:', 'shell:', 'rust', 'powershell', 'pwsh']):
print(f'{j}: {lines[j-1]}')
elif j>idx+15:
break
PYRepository: KooshaPari/SessionLedger
Length of output: 7040
🌐 Web query:
actions/checkout v7 persist-credentials default true README
💡 Result:
The default value for the persist-credentials input in actions/checkout v7 is true [1]. When set to true, the action configures the Git credential helper to use the provided token or SSH key, allowing your workflow scripts to run authenticated Git commands (such as git fetch or git push) without manual configuration [2][3]. The action automatically removes these credentials during the post-job cleanup process [2][4]. In recent versions, including v7, security has been improved by persisting credentials in a separate file under the runner's temporary directory ($RUNNER_TEMP) rather than directly in the local.git/config file [5][6]. If you prefer to disable this behavior, you can explicitly set persist-credentials: false in your workflow step [2][3].
Citations:
- 1: https://github.com/actions/checkout/blob/34e114876b0b11c390a56381ad16ebd13914f8d5/action.yml
- 2: https://github.com/actions/checkout
- 3: https://github.com/actions/checkout?tab=readme-ov-file
- 4: https://github.com/actions/checkout/blob/main/README.md
- 5: https://github.com/actions/checkout/tree/v6.0.0
- 6: actions/checkout@v4.2.2...v7
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== .github/workflows/ci.yml checkout tokens with line numbers =="
python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/ci.yml')
for i, line in enumerate(p.read_text().splitlines(), 1):
if 'actions/checkout@' in line:
perm_context = []
for j in range(i - 20, i):
if j > 0:
perm_context.append((j, p.read_text().splitlines()[j-1]))
print(f'line {i}: {line}')
print(f' preceding permissions context:')
for j, l in perm_context[-6:]:
print(f' {j}: {l}')
PY
echo "== pinned commit vs v7 tag for pinned checkout entry =="
git ls-remote https://github.com/actions/checkout.git refs/tags/v7 HEAD 3>/dev/null || true
git ls-remote https://github.com/actions/checkout.git 3d3c42e5aac5ba805825da76410c181273ba90b1 3>/dev/null || true
python3 - <<'PY'
# Read-only local SHA comparison without mutating working tree:
# if local Git metadata is unavailable, this does not block the comment rewrite.
from subprocess import run, PIPE
for ref in ['refs/tags/v7', 'HEAD']:
r = run(['git','ls-remote','https://github.com/actions/checkout.git', ref], stdout=PIPE, stderr=PIPE, text=True)
print(ref, r.returncode, r.stdout.strip()[:120])
PYRepository: KooshaPari/SessionLedger
Length of output: 4715
🌐 Web query:
github actions runner checkouts persist-credentials token $RUNNER_TEMP .git config persist-credentials true
💡 Result:
In recent versions of the actions/checkout action (starting with v6.0.0), the way credentials are persisted has been updated to improve security [1][2]. Instead of writing the authentication token or SSH key directly into the local repository's .git/config file, the action now writes these credentials to a separate temporary file located in the runner's $RUNNER_TEMP directory [3][4][1]. Key aspects of this implementation include: - Mechanism: The action uses Git's includeIf.gitdir configuration feature [2][5]. By adding an includeIf directive to the local .git/config, Git is instructed to conditionally load the credentials from the file in $RUNNER_TEMP only when operating within that specific repository's directory [2][6]. - Purpose: This approach isolates sensitive credentials from the main Git configuration and reduces the risk of accidental exposure [2][5]. - Default Behavior: The persist-credentials input defaults to true, which enables this behavior [3][7]. If you do not want the action to configure these credentials, you can set persist-credentials: false in your workflow step [3][4]. - Cleanup: The sensitive credential file created in $RUNNER_TEMP is removed by the action during the post-job cleanup phase [3][4]. - Requirements: This mechanism requires Actions Runner version v2.329.0 or later to function correctly, particularly for scenarios involving Docker container actions [4][1]. If you examine your .git/config file after a checkout with the default settings, you will see entries similar to [includeIf "gitdir:/path/to/repo/.git"] pointing to a configuration file located in your $RUNNER_TEMP path [6].
Citations:
- 1: https://github.com/actions/checkout/tree/v6.0.0
- 2: Persist creds to a separate file actions/checkout#2286
- 3: https://github.com/actions/checkout
- 4: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 5: https://github.com/actions/checkout/pull/2286/files
- 6: actions/checkout@v6 broken on non-GitHub runners (Forgejo, Gitea, etc.) - hardcoded GitHub paths in includeIf directives break authentication actions/checkout#2321
- 7: https://github.com/actions/checkout/blob/main/action.yml
Disable persisted checkout credentials before running repository-controlled scripts.
actions/checkout persists the workflow token by default, so add persist-credentials: false at each workflow checkout that precedes Rust or PowerShell steps:
.github/workflows/ci.yml#L212fuzz checkout.github/workflows/ci.yml#L233rootless-matrix checkout.github/workflows/ci.yml#L245rootless/no-net checkout.github/workflows/ci.yml#L273eval-reproducibility checkout
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 212-212: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 1 file
.github/workflows/ci.yml#L212-L212(this comment).github/workflows/ci.yml#L233-L233.github/workflows/ci.yml#L245-L245.github/workflows/ci.yml#L273-L273
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 212, Disable persisted checkout credentials
by adding persist-credentials: false to the actions/checkout steps at
.github/workflows/ci.yml lines 212, 233, 245, and 273, covering the fuzz,
rootless-matrix, rootless/no-net, and eval-reproducibility jobs before their
repository-controlled Rust or PowerShell steps.
Source: Linters/SAST tools
| if: github.event_name == 'pull_request' | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## workflow checkout usages"
rg -n "actions/checkout@" .github/workflows/ci.yml || true
echo
echo "## git diff stat/name only"
git diff --stat
git diff --name-only
echo
echo "## relevant ci.yml lines around checkout refs"
sed -n '240,290p' .github/workflows/ci.yml
echo
echo "## all checkout refs with line numbers in workflow"
rg -n --line-number "actions/checkout@" .github/workflows/ci.ymlRepository: KooshaPari/SessionLedger
Length of output: 3554
🌐 Web query:
actions/checkout v7 GitHub commit ref
💡 Result:
As of August 7, 2026, the current major version of actions/checkout is v7 [1][2]. The most recent patch release within this series is v7.0.1, which was published on July 20, 2026 [2]. Regarding your query about the GitHub commit reference, actions/checkout v7 follows the standard versioning and usage patterns for GitHub Actions. When you use the syntax - uses: actions/checkout@v7, GitHub automatically resolves the tag v7 to the latest release within the v7 major version (currently v7.0.1) [3][4]. The v7 release introduced significant security changes, specifically restricting the checkout of fork pull request code when running in pull_request_target or workflow_run events by default [5][6]. If you need to pin to a specific commit for immutable builds, you can use the commit SHA instead of the tag, for example: - uses: actions/checkout@1044a6d # v7.0.0 You can find the specific commit SHAs for any v7.x release on the official GitHub actions/checkout releases page [1].
Citations:
- 1: https://github.com/actions/checkout/releases
- 2: https://github.com/actions/checkout/releases/tag/v7.0.1
- 3: https://github.com/actions/checkout/?tab=readme-ov-file
- 4: https://github.com/actions/checkout
- 5: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/
- 6: https://github.com/marketplace/actions/checkout
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## resolve actions/checkout refs"
python3 - <<'PY'
import json, subprocess
for ref in ["v7", "3d3c42e5aac5ba805825da76410c181273ba90b1"]:
print(f"--- {ref} ---")
try:
r_sub = subprocess.run(
["gh", "api", "repos/actions/checkout/git/refs/tags/" + ref],
timeout=20,
capture_output=True,
text=True,
check=True,
)
r = json.loads(r_sub.stdout)
except Exception as exc:
print("failed", repr(exc))
continue
print("ref_type", r.get("ref"))
print("target_type", r.get("object", {}).get("type"))
print("target_sha", r.get("object", {}).get("sha"))
if r.get("object", {}).get("type") == "tag":
sha = r.get("object", {}).get("sha")
try:
r_tag = subprocess.run(
["gh", "api", f"repos/actions/checkout/git/tags/{sha}"],
timeout=20,
capture_output=True,
text=True,
check=True,
)
except Exception as exc:
print("tag object lookup failed", repr(exc))
continue
print("annotated_tags", "target_sha", json.loads(r_tag.stdout).get("object", {}).get("sha"))
try:
r_ok = subprocess.run(
["gh", "api", f"repos/actions/checkout/commits/{ref}"],
timeout=20,
capture_output=True,
text=True,
check=True,
)
c = json.loads(r_ok.stdout)
print("commit_sha_exists", c.get("sha"))
except Exception as exc:
print("commit lookup failed", repr(exc))
PYRepository: KooshaPari/SessionLedger
Length of output: 532
🌐 Web query:
GitHub actions/checkout v7 commit SHA 3d3c42e5aac5ba805825da76410c181273ba90b1
💡 Result:
The commit SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 corresponds to the commit titled "prep v7.0.1 release (#2531)" in the official actions/checkout repository [1][2]. This commit was authored on July 17, 2026, and served as the final preparation step for the v7.0.1 release [1], which was officially published on July 20, 2026 [3]. This commit included updates to version metadata (bumping the package version to 7.0.1) and finalized the changelog and dependency configurations for that release [2][4]. The v7.0.1 release itself contained several fixes, including updates to how unsafe pull request checks are handled when inputs are set to default, trimming of ASCII whitespace for branches, and escaping values passed to --unset [3].
Citations:
- 1: actions/checkout@3d3c42e
- 2: https://git.velechovsky.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1
- 3: https://github.com/actions/checkout/releases/tag/v7.0.1
- 4: https://git.liteyuki.org/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1
Pin this actions/checkout reference to a commit SHA.
actions/checkout@v7 is mutable and breaks the pinned-action policy. Use the approved full SHA from the other checkout steps to lock this workflow to the intended v7.0.1 release.
Proposed fix
- - uses: actions/checkout@v7
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v7 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 |
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 273-273: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 273-273: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 273, Update the checkout step using
actions/checkout to reference the approved full commit SHA already used by the
other checkout steps, ensuring it pins the intended v7.0.1 release instead of
the mutable v7 tag.
Source: Linters/SAST tools
| /// Encode a session id as one injective, safe filename component. | ||
| /// | ||
| /// Underscores are escaped as well as path separators so an encoded separator | ||
| /// can never collide with an input that already contained the escape marker. | ||
| pub(crate) fn sanitize(id: &str) -> String { | ||
| let mut encoded = String::with_capacity(id.len()); | ||
| for character in id.chars() { | ||
| match character { | ||
| '_' => encoded.push_str("_x5f"), | ||
| '/' => encoded.push_str("_x2f"), | ||
| '\\' => encoded.push_str("_x5c"), | ||
| ':' => encoded.push_str("_x3a"), | ||
| character => encoded.push(character), | ||
| } | ||
| } | ||
| encoded |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Locate file and relevant symbols:\n'
git ls-files | rg '(^|/)etl\.rs$|Cargo\.toml|rust-toolchain\.toml' || true
printf '\nOutline etl.rs:\n'
ast-grep outline crates/sl-daemon/src/etl.rs || true
printf '\nRelevant etl.rs section:\n'
sed -n '1,220p' crates/sl-daemon/src/etl.rs
printf '\nSearch sanitize usage and session.id producers:\n'
rg -n "sanitize\(|session\.id|id:" crates/sl-daemon/src crates/sl-daemon -g '*.rs' -g '*.toml'Repository: KooshaPari/SessionLedger
Length of output: 21606
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Root session_ledger Session and JSONL parsing definitions:\n'
rg -n "struct Session|pub id:|read_jsonl_sessions|fn new\\(" crates/sl-daemon crates -g '*.rs' | head -200
printf '\nCandidate session domain files:\n'
git ls-files 'crates/sl-*/**/*.rs' | rg 'session|domain|bundle|model' | head -100
printf '\nInspect specific session domain files:\n'
for f in $(git ls-files 'crates/sl-*/**/*.rs' | rg 'session|domain' | head -50); do
echo "--- $f"
wc -l "$f"
done
printf '\nSl-daemon worker export write:\n'
sed -n '70,115p' crates/sl-daemon/src/worker.rs
printf '\nSl-daemon tests around pipeline out_path:\n'
sed -n '60,90p' crates/sl-daemon/tests/pipeline.rs
printf '\nSearch for session.id validation/restrictions:\n'
rg -n "session\\.id|Session::new|bundle_id|bundle.*id|valid|reject|reserved|CON|NUL|sanitize|\\.okf\\.json" crates/sl-daemon crates -g '*.rs' -g '*.toml' | head -250Repository: KooshaPari/SessionLedger
Length of output: 30399
Make the ETL session-id filename encoding portable on Windows.
sanitize leaves Windows-invalid characters such as ?, *, ", <, >, |, and control characters unchanged. It also leaves reserved device basenames such as CON and NUL unchanged. Since session.id comes from raw/encoded JSONL content, export can fail on Windows or resolve to a device name at transform_file. Restrict IDs to a documented portable alphabet, or encode all invalid characters and reserved basenames; add Windows regression cases for both.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@crates/sl-daemon/src/etl.rs` around lines 149 - 164, Update sanitize to
produce Windows-portable filenames by encoding all Windows-invalid characters
and control characters, and transform reserved device basenames such as CON and
NUL so they cannot resolve as devices. Document the supported filename alphabet
and add Windows regression coverage for invalid characters and reserved
basenames while preserving injective encoding.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 5 'sanitize\(|okf\.json|validate_on_disk_okf|data_dir' crates/sl-daemon/src || true
git grep -n -C 5 -E 'sanitize\(|okf\.json|validate_on_disk_okf' origin/main -- crates/sl-daemon/src || trueRepository: KooshaPari/SessionLedger
Length of output: 50383
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== git branch/origin availability =="
git branch --show-current
git remote -v || true
echo
echo "== changed files =="
git diff --name-only --diff-filter=ACMRTUXB HEAD origin/main 2>/dev/null || true
echo
echo "== sanitize implementation =="
sed -n '140,165p' crates/sl-daemon/src/etl.rs
echo
echo "== transform_file path =="
sed -n '90,108p' crates/sl-daemon/src/etl.rs
echo
echo "== validate_on_disk_okf implementation =="
rg -n -C 8 'struct ValidateBundle|fn validate_on_disk_okf|run_validate|bundle_id' crates/sl-daemon/src/main.rs
echo
echo "== old sanitize references in current branch and origin/main =="
git diff --unified=0 origin/main -- crates/sl-daemon/src/etl.rs crates/sl-daemon/src/main.rs | rg -n 'sanitize|okf\.json|bundle_id|i?sub|replace' || true
git show origin/main:crates/sl-daemon/src/etl.rs 2>/dev/null | rg -n 'sanitize\(|pub(crate) fn sanitize' || trueRepository: KooshaPari/SessionLedger
Length of output: 11470
Add migration semantics before changing bundle filename encoding.
New bundles are written and validated with escapted filenames, but data_dir files produced by the old sanitize("...") form can become undiscoverable by sl-daemon validate. Add an explicit migration/backward-compatible lookup for existing bundles, and cover old encodings whose former substitution was not injective.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@crates/sl-daemon/src/etl.rs` around lines 149 - 164, Add backward-compatible
bundle discovery in the ETL lookup and validation flow before relying solely on
the new sanitize encoding. Preserve discovery of files produced by the former
non-injective substitution, including collisions that old encoding could create,
while writing new bundles with sanitize’s escaped format. Ensure sl-daemon
validate can find and validate both legacy and newly encoded bundles.
| /// Inline SVG icons for each tab. | ||
| const ICON_SVG_BUNDLES: &str = include_str!("../../../assets/icons/line/bundles.svg"); | ||
| const ICON_SVG_HISTORY: &str = include_str!("../../../assets/icons/line/history.svg"); | ||
| const ICON_SVG_MEMORY: &str = include_str!("../../../assets/icons/line/memory.svg"); | ||
| const ICON_SVG_UNFINISHED: &str = include_str!("../../../assets/icons/line/unfinished.svg"); | ||
| const ICON_SVG_TIMELINE: &str = include_str!("../../../assets/icons/line/timeline.svg"); | ||
| const ICON_SVG_LIVE: &str = include_str!("../../../assets/icons/line/live.svg"); | ||
| const ICON_SVG_SEARCH: &str = include_str!("../../../assets/icons/line/search.svg"); | ||
| const ICON_SVG_REPLAY: &str = include_str!("../../../assets/icons/line/replay.svg"); | ||
|
|
||
| /// Lookup table for tab icon SVGs. | ||
| fn icon_svg(tab_icon: &str) -> &'static str { | ||
| match tab_icon { | ||
| "bundles" => ICON_SVG_BUNDLES, | ||
| "history" => ICON_SVG_HISTORY, | ||
| "memory" => ICON_SVG_MEMORY, | ||
| "unfinished" => ICON_SVG_UNFINISHED, | ||
| "timeline" => ICON_SVG_TIMELINE, | ||
| "live" => ICON_SVG_LIVE, | ||
| "search" => ICON_SVG_SEARCH, | ||
| "replay" => ICON_SVG_REPLAY, | ||
| _ => ICON_SVG_BUNDLES, | ||
| } | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
Do not hide an unmapped icon behind the Bundles fallback.
Tab::icon and icon_svg form two string-based mappings. If a new tab adds an icon name but misses the lookup arm, _ => ICON_SVG_BUNDLES renders the wrong icon without a build failure. Make icon_svg accept &Tab and match every variant, or remove the silent fallback.
Suggested type-safe lookup
-fn icon_svg(tab_icon: &str) -> &'static str {
- match tab_icon {
- "bundles" => ICON_SVG_BUNDLES,
- "history" => ICON_SVG_HISTORY,
- "memory" => ICON_SVG_MEMORY,
- "unfinished" => ICON_SVG_UNFINISHED,
- "timeline" => ICON_SVG_TIMELINE,
- "live" => ICON_SVG_LIVE,
- "search" => ICON_SVG_SEARCH,
- "replay" => ICON_SVG_REPLAY,
- _ => ICON_SVG_BUNDLES,
+fn icon_svg(tab: &Tab) -> &'static str {
+ match tab {
+ Tab::Bundles => ICON_SVG_BUNDLES,
+ Tab::History => ICON_SVG_HISTORY,
+ Tab::Memory => ICON_SVG_MEMORY,
+ Tab::Unfinished => ICON_SVG_UNFINISHED,
+ Tab::Timeline => ICON_SVG_TIMELINE,
+ Tab::LiveFeed => ICON_SVG_LIVE,
+ Tab::Search => ICON_SVG_SEARCH,
+ Tab::Replay => ICON_SVG_REPLAY,
}
}Update the caller to pass &tab.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@crates/sl-viewer/src/app.rs` around lines 207 - 230, Update icon_svg to
accept a &Tab instead of a string and match each Tab variant to its
corresponding SVG constant, eliminating the Bundles fallback. Update its caller
to pass &tab and ensure every icon-bearing Tab variant is explicitly covered.
| ### Phase 2 — Grapheon + asset-engine | ||
| - **Grapheon:** surveyed branches; `feat/tracera-persistent-trace-repository` (597 commits, no shared ancestry with `airlock-recovery` because it wholesale-renamed a separate Tracera repo). Cherry-picked only the canonical lockfile commit `a1e22449a`. Wrote `HANDOFF-tracera-merge.md` with merge strategies. Reset merge branch to safe state. Tag: pre-tracera-merge safety. | ||
| - **asset-engine:** GitHub-archived with tombstone README, description redirected to `phenoDesign`. Zero branches left on the live repo. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate and inspect the relevant handoff handout sections without executing repository code.
fd -a 'HANDOFF-session-2026-08-05\.md' . | while read -r f; do
echo "===== FILE: ${f#"$PWD/"} ====="
wc -l "$f"
echo
done
if [ -f HANDOFF-session-2026-08-05.md ]; then
echo "===== Relevant lines around 2.4 and Phase 2 ====="
nl -ba HANDOFF-session-2026-08-05.md | sed -n '70,105p'
echo
echo "===== asset-engine mentions ====="
rg -n "asset-engine|preserve/asset-engine-archive-20260729|zero branches|branches *left|GitHub-archived" HANDOFF-session-2026-08-05.md
echo
echo "===== Branch-ish mentions (preserve/ and asset-engine) ====="
rg -n "preserve/asset-engine-archive-20260729|preserve/.*archive|asset-engine" HANDOFF-session-2026-08-05.md
fiRepository: KooshaPari/SessionLedger
Length of output: 355
🏁 Script executed:
#!/bin/bash
set -euo pipefail
if [ -f HANDOFF-session-2026-08-05.md ]; then
echo "===== Relevant lines around 2.4 and Phase 2 ====="
awk 'NR>=70 && NR<=105 { printf "%5d\t%s\n", NR, $0 }' HANDOFF-session-2026-08-05.md
echo
echo "===== asset-engine mentions ====="
grep -nE "asset-engine|preserve/asset-engine-archive-20260729|zero branches|branches *left|GitHub-archived" HANDOFF-session-2026-08-05.md || true
echo
echo "===== branch-like preservation mentions ====="
grep -n "preserve/asset-engine-archive-20260729|preserve/.*archive|asset-engine" HANDOFF-session-2026-08-05.md || true
fiRepository: KooshaPari/SessionLedger
Length of output: 4834
Clarify the asset-engine branch count.
Section 2.4 lists preserve/asset-engine-archive-20260729 as the only current branch. Phase 2 says zero branches remain on the live repo; exclude that preserved archive branch or update the count to one.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 91-91: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@HANDOFF-session-2026-08-05.md` around lines 91 - 93, Update the asset-engine
status in the Phase 2 section to reconcile the branch count with Section 2.4:
either explicitly exclude preserve/asset-engine-archive-20260729 from the
live-repository count or state that one branch remains, while preserving the
archive-status details.
| ### Phase 6 — Brand asset suite (53 SVGs + build pipeline) | ||
| | Category | Files | Content | | ||
| |----------|-------|---------| | ||
| | Mascot | 5 | `getta-base/listening/happy/thinking/animated.svg` — rigged poses with `<use>` for state swap | | ||
| | 2.5D icons | 13 | 8 tabs + 5 status (check, x, alert, live-dot, loading) — depth-filled, Lab-Coat palette | | ||
| | Line icons | 13 | Monoline for dense UI | | ||
| | Panels | 6 | `card-bg`, 4 corners, divider | | ||
| | Brand | 8 | hero (1200x630, lc-chip), og-card, twitter/mobile cards, dock tile, dividers | | ||
| | Build script | 1 | `scripts/build_brand_assets.sh` — `magick` SVG→PNG, `iconutil` PNG→icns with @2x | | ||
| | Installed | 1 | `/Applications/SessionLedger.app/Contents/Resources/AppIcon.icns` (174K) | |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Correct the brand asset inventory count.
The heading states 53 SVGs. The listed SVG categories total 45: 5 + 13 + 13 + 6 + 8. The complete table contains 47 counted entries after adding the build script and installed application. Correct the heading or add the missing inventory rows.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 117-117: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 118-118: Tables should be surrounded by blank lines
(MD058, blanks-around-tables)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@HANDOFF-session-2026-08-05.md` around lines 117 - 126, Correct the Phase 6
inventory count in the heading to match the listed contents: 45 SVG assets, or
47 total entries including the build script and installed application. Keep the
category rows unchanged unless adding explicitly missing inventory rows.
| 4. **Add a Raw Sessions tab** (`Tab::Corpus`) showing the underlying `Vec<Session>`. | ||
| 5. **Wire the mascot into the launch splash** (replace the plain-text `SessionLedger` / `Viewer` span). | ||
| 6. **Add design tokens for sidebar/nav** and update `tokens.css` L107 scorecard entry. | ||
| 7. **Review/merge/close Grapheon PR #5** so the dep-cleanup claim is finally complete. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Separate PR #5 from dependency-cleanup completion.
Line 58 identifies PR #5 as ci: publish recovered default required gates. The dependency cleanup is described as PR #3 merged and PR #4 closed. Label PR #5 as CI follow-up, or update the PR reference.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@HANDOFF-session-2026-08-05.md` at line 225, Separate the PR `#5` task in the
handoff from the dependency-cleanup completion claim: update the item describing
“Review/merge/close Grapheon PR `#5`” to identify it as the CI follow-up,
consistent with its “ci: publish recovered default required gates” title, while
keeping dependency cleanup attributed to PR `#3` merged and PR `#4` closed.
| let mut entity_ids = std::collections::HashSet::with_capacity(document.entities.len()); | ||
| for (index, entity) in document.entities.iter().enumerate() { | ||
| if entity.id.is_empty() { | ||
| errors.push(OkfValidationError { | ||
| field: format!("entities[{index}].id"), | ||
| code: "empty_entity_id".into(), | ||
| message: "entity id must not be empty".into(), | ||
| }); | ||
| } | ||
| if !entity_ids.insert(entity.id.as_str()) { | ||
| errors.push(OkfValidationError { | ||
| field: format!("entities[{index}].id"), | ||
| code: "duplicate_entity_id".into(), | ||
| message: format!("entity id {:?} is duplicated", entity.id), | ||
| }); | ||
| } | ||
| } | ||
|
|
||
| for (index, relation) in document.relations.iter().enumerate() { | ||
| if !entity_ids.contains(relation.source.as_str()) { | ||
| errors.push(OkfValidationError { | ||
| field: format!("relations[{index}].source"), | ||
| code: "dangling_relation_source".into(), | ||
| message: format!("relation source {:?} is not an entity id", relation.source), | ||
| }); | ||
| } | ||
| if !entity_ids.contains(relation.target.as_str()) { | ||
| errors.push(OkfValidationError { | ||
| field: format!("relations[{index}].target"), | ||
| code: "dangling_relation_target".into(), | ||
| message: format!("relation target {:?} is not an entity id", relation.target), | ||
| }); | ||
| } | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Do not resolve relation endpoints through empty entity IDs.
Line 204 inserts "" after Line 197 reports it as invalid. A relation with source == "" or target == "" then appears resolved and receives no dangling-endpoint diagnostic.
Track valid entity IDs separately, or skip insertion when entity.id is empty. Add a regression test with an empty entity ID and an empty relation endpoint.
Proposed fix
- let mut entity_ids = std::collections::HashSet::with_capacity(document.entities.len());
+ let mut seen_entity_ids = std::collections::HashSet::with_capacity(document.entities.len());
+ let mut valid_entity_ids = std::collections::HashSet::with_capacity(document.entities.len());
for (index, entity) in document.entities.iter().enumerate() {
if entity.id.is_empty() {
errors.push(OkfValidationError {
field: format!("entities[{index}].id"),
code: "empty_entity_id".into(),
message: "entity id must not be empty".into(),
});
+ } else {
+ valid_entity_ids.insert(entity.id.as_str());
}
- if !entity_ids.insert(entity.id.as_str()) {
+ if !seen_entity_ids.insert(entity.id.as_str()) {
errors.push(OkfValidationError {
field: format!("entities[{index}].id"),
code: "duplicate_entity_id".into(),
message: format!("entity id {:?} is duplicated", entity.id),
});
}
}
for (index, relation) in document.relations.iter().enumerate() {
- if !entity_ids.contains(relation.source.as_str()) {
+ if !valid_entity_ids.contains(relation.source.as_str()) {
// ...
}
- if !entity_ids.contains(relation.target.as_str()) {
+ if !valid_entity_ids.contains(relation.target.as_str()) {
// ...
}
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| let mut entity_ids = std::collections::HashSet::with_capacity(document.entities.len()); | |
| for (index, entity) in document.entities.iter().enumerate() { | |
| if entity.id.is_empty() { | |
| errors.push(OkfValidationError { | |
| field: format!("entities[{index}].id"), | |
| code: "empty_entity_id".into(), | |
| message: "entity id must not be empty".into(), | |
| }); | |
| } | |
| if !entity_ids.insert(entity.id.as_str()) { | |
| errors.push(OkfValidationError { | |
| field: format!("entities[{index}].id"), | |
| code: "duplicate_entity_id".into(), | |
| message: format!("entity id {:?} is duplicated", entity.id), | |
| }); | |
| } | |
| } | |
| for (index, relation) in document.relations.iter().enumerate() { | |
| if !entity_ids.contains(relation.source.as_str()) { | |
| errors.push(OkfValidationError { | |
| field: format!("relations[{index}].source"), | |
| code: "dangling_relation_source".into(), | |
| message: format!("relation source {:?} is not an entity id", relation.source), | |
| }); | |
| } | |
| if !entity_ids.contains(relation.target.as_str()) { | |
| errors.push(OkfValidationError { | |
| field: format!("relations[{index}].target"), | |
| code: "dangling_relation_target".into(), | |
| message: format!("relation target {:?} is not an entity id", relation.target), | |
| }); | |
| } | |
| } | |
| let mut seen_entity_ids = std::collections::HashSet::with_capacity(document.entities.len()); | |
| let mut valid_entity_ids = std::collections::HashSet::with_capacity(document.entities.len()); | |
| for (index, entity) in document.entities.iter().enumerate() { | |
| if entity.id.is_empty() { | |
| errors.push(OkfValidationError { | |
| field: format!("entities[{index}].id"), | |
| code: "empty_entity_id".into(), | |
| message: "entity id must not be empty".into(), | |
| }); | |
| } else { | |
| valid_entity_ids.insert(entity.id.as_str()); | |
| } | |
| if !seen_entity_ids.insert(entity.id.as_str()) { | |
| errors.push(OkfValidationError { | |
| field: format!("entities[{index}].id"), | |
| code: "duplicate_entity_id".into(), | |
| message: format!("entity id {:?} is duplicated", entity.id), | |
| }); | |
| } | |
| } | |
| for (index, relation) in document.relations.iter().enumerate() { | |
| if !valid_entity_ids.contains(relation.source.as_str()) { | |
| errors.push(OkfValidationError { | |
| field: format!("relations[{index}].source"), | |
| code: "dangling_relation_source".into(), | |
| message: format!("relation source {:?} is not an entity id", relation.source), | |
| }); | |
| } | |
| if !valid_entity_ids.contains(relation.target.as_str()) { | |
| errors.push(OkfValidationError { | |
| field: format!("relations[{index}].target"), | |
| code: "dangling_relation_target".into(), | |
| message: format!("relation target {:?} is not an entity id", relation.target), | |
| }); | |
| } | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/ports/okf.rs` around lines 195 - 228, Update the entity ID tracking in
the validation loop around entity_ids so empty entity.id values are not inserted
into the set used for relation resolution. Keep empty-ID validation intact, and
add a regression test covering an empty entity ID with a relation whose source
or target is empty, ensuring the corresponding dangling-endpoint diagnostic is
emitted.
| Err(_error) => { | ||
| #[cfg(target_os = "windows")] | ||
| { | ||
| panic!("failed to spawn pwsh for self-check: {_error}"); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
cargo clippy --test alloc_profile -- -D warnings
cargo test --test alloc_profile --lockedRepository: KooshaPari/SessionLedger
Length of output: 154
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^|/)tests/alloc_profile\.rs$|rust-toolchain\.toml$|Cargo\.toml$|\.cargo/config\.toml$|Cargo\.lock$' | sed -n '1,120p'
echo "== alloc_profile outline/size =="
if [ -f tests/alloc_profile.rs ]; then
wc -l tests/alloc_profile.rs
ast-grep outline tests/alloc_profile.rs || true
echo "== relevant alloc_profile section =="
cat -n tests/alloc_profile.rs | sed -n '1,160p'
fi
echo "== clippy lint config / warnings flags =="
rg -n --hidden --glob '!target/**' -i 'unreachable_code|deny|allow|warnings|cargo clippy|-- -D warnings|all-tests|locked' . | sed -n '1,240p'Repository: KooshaPari/SessionLedger
Length of output: 29270
🏁 Script executed:
#!/bin/bash
set -euo pipefail
if command -v rustc >/dev/null 2>&1; then
rustc --version
echo "== rustc unreachable_code probe =="
mkdir -p /tmp/rust_unreachable_probe
cat > /tmp/rust_unreachable_probe/main.rs <<'RS'
use std::process::Command;
fn main() {
let output = Command::new("pwsh").output();
match output {
Ok(_) => println!("ok"),
Err(_error) => {
#[cfg(target_os = "windows")]
{
panic!("failed to spawn pwsh for self-check: {_error}");
}
#[cfg(not(target_os = "windows"))]=
{
}
},
}
}
RS
cat > /tmp/rust_unreachable_probe/Cargo.toml <<'TOML'
[package]
name = "unreachable_probe"
version = "0.1.0"
edition = "2021"
TOML
cd /tmp/rust_unreachable_probe
rustc --crate-type bin main.rs 2>&1 || true
rustc --crate-type bin main.rs --cfg target_os=windows -D unreachable_code 2>&1 || true
rustc --crate-type bin main.rs --cfg not(target_os=windows) 2>&1 || true
else
rustc_not_found=true
fiRepository: KooshaPari/SessionLedger
Length of output: 216
🏁 Script executed:
#!/bin/bash
set -euo pipefail
if command -v rustc >/dev/null 2>&1; then
rustc --version
mkdir -p /tmp/rust_unreachable_probe
cat > /tmp/rust_unreachable_probe/main.rs <<'RS'
use std::process::Command;
fn main() {
let output = Command::new("pwsh").output();
match output {
Ok(_) => println!("ok"),
Err(_error) => {
#[cfg(target_os = "windows")]
{
panic!("failed to spawn pwsh for self-check: {_error}");
}
let max_bytes: u64 = 0;
assert!(max_bytes > 0);
assert!(false);
},
}
}
RS
cat > /tmp/rust_unreachable_probe/Cargo.toml <<'TOML'
[package]
name = "unreachable_probe"
version = "0.1.0"
edition = "2021"
[profile.dev]
panic = "abort"
[profile.release]
panic = "abort"
TOML
echo "== cfg target_os=windows /warn/error lint with panic mode ==1/0 =="
for panic_mode in in-panic unwind abort abort-panic in; do
rustc --crate-type bin --panic "$panic_mode" --cfg target_os=windows -D unreachable_code /tmp/rust_unreachable_probe/main.rs -o /tmp/rust_unreachable_probe/probe.exe 2>&1 || true
done
echo "== cfg target_os=windows /warn/error lint with panic mode panic=unwind =="
for panic_mode in unwind abort panic-panic; do
rustc --crate-type bin --panic "$panic_mode" --cfg target_os=windows -D unreachable_code /tmp/rust_unreachable_probe/main.rs -o /tmp/rust_unreachable_probe/probe.exe 2>&1 || true
done
echo "== cfg not(target_os = "windows") =="
rustc --crate-type bin --cfg 'not(target_os = "windows")' /tmp/rust_unreachable_probe/main.rs -o /tmp/rust_unreachable_probe/probe.exe 2>&1 || true
else
echo "rustc not found" >&2
fiRepository: KooshaPari/SessionLedger
Length of output: 1058
🏁 Script executed:
#!/bin/bash
set -euo pipefail
if command -v rustc >/dev/null 2>&1; then
rustc --version
mkdir -p /tmp/rust_unreachable_probe
cat > /tmp/rust_unreachable_probe/main.rs <<'RS'
use std::process::Command;
fn main() {
let output = Command::new("pwsh").output();
match output {
Ok(_) => println!("ok"),
Err(_error) => {
#[cfg(target_os = "windows")]
{
panic!("failed to spawn pwsh for self-check: {_error}");
}
let max_bytes: u64 = 0;
assert!(max_bytes > 0);
assert!(false);
},
}
}
RS
echo "== target_os=windows default warnings =="
rustc --crate-type bin --cfg 'target_os="windows"' /tmp/rust_unreachable_probe/main.rs -o /tmp/rust_unreachable_probe/probe.exe 2>&1 || true
echo "== target_os=windows deny lint =="
rustc --crate-type bin --cfg 'target_os="windows"' -D unreachable_code /tmp/rust_unreachable_probe/main.rs -o /tmp/rust_unreachable_probe/probe.exe 2>&1 || true
echo "== not target_os=windows default warnings =="
rustc --crate-type bin --cfg 'not(target_os = "windows")' /tmp/rust_unreachable_probe/main.rs -o /tmp/rust_unreachable_probe/probe.exe 2>&1 || true
else
echo "rustc not found" >&2
fiRepository: KooshaPari/SessionLedger
Length of output: 4111
Guard the fallback block for non-Windows targets.
On Windows, panic! diverges before the portable fallback; keep lines 89-101 in a #[cfg(not(target_os = "windows"))] branch so the Windows-expanded path has no unreachable_code warning.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/alloc_profile.rs` around lines 84 - 87, Update the error-handling
branch around the pwsh spawn failure in tests/alloc_profile.rs so the existing
fallback logic spanning lines 89-101 is enclosed in a #[cfg(not(target_os =
"windows"))] block. Keep the Windows-specific panic in the #[cfg(target_os =
"windows")] path, ensuring the Windows-expanded code excludes the portable
fallback and avoids unreachable_code warnings.
Source: Coding guidelines
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| if: github.event_name == 'pull_request' | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
WARNING: Unpinned actions/checkout@v7 in new eval-reproducibility job
The new eval-reproducibility job uses an unpinned actions/checkout@v7, while the other new jobs added in this PR (fuzz-smoke, rootless-matrix-policy, rootless-nonet-policy) all pin actions to specific commit SHAs. Pin this reference for consistency and supply-chain safety.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (11 files)
Fix these issues in Kilo Cloud Reviewed by step-3.7-flash · Input: 144.2K · Output: 34K · Cached: 5.3M |
|
Closing as superseded. Cannot auto-rebase due to merge conflicts. |
User description
Replacement for closed PR #420.
This branch contains the bounded CI self-check wiring, rustfmt-only cleanup, and clippy manual_assert fix for the alloc-profile test.
Validation: cargo fmt --all -- --check; cargo clippy --test alloc_profile -- -D warnings; cargo test --test alloc_profile --locked; alloc-profile SelfCheck.
CodeAnt-AI Description
Validate exported OKF bundles correctly and keep generated outputs distinct
What Changed
Impact
✅ Clearer OKF validation errors✅ No overwritten bundles from colliding session IDs✅ Broader pull-request safety checks💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.