Skip to content

claw: sarif_feed -- a spec that does not parse becomes a code-scanning alert on the pull request (Closes #10356) - #10358

Merged
gHashTag merged 1 commit into
masterfrom
claw-sarif-feed
Oct 18, 2026
Merged

claw: sarif_feed -- a spec that does not parse becomes a code-scanning alert on the pull request (Closes #10356)#10358
gHashTag merged 1 commit into
masterfrom
claw-sarif-feed

Conversation

@gHashTag

@gHashTag gHashTag commented Oct 18, 2026

Copy link
Copy Markdown
Owner

Closes #10356

Wires the merged SARIF law (specs/claw/sarif.t27, #10288) to pull requests: a changed .t27 spec that does not parse, or declares functions with no body, becomes a code-scanning alert from the TRI CLAW App.

What changes

  • specs/claw/sarif_feed.t27 (new, 12 tests) is the adapter. Input is one record per changed spec: path, the word t27c spec-status prints, and the first stderr line of t27c parse. NOPARSE becomes T27C001 (error, at the line:col t27c names), UNWRITTEN becomes T27C004 (warning, line 1). An unknown status word or a short record is refused by sarif_render, so the run is emitted with executionSuccessful: false and never reads as clean. It adds no JSON; the document is sarif_render.
  • gen/c/claw/sarif_feed.c is its gen-c lowering. spec-guards.yml regenerates it and diffs it, next to the two claw files already there.
  • claw-sarif job in gate-topology.yml, on pull_request: mints the token with actions/create-github-app-token and exactly the scopes of the code-scanning-sarif row of specs/claw/github_surface.t27 (permission-security-events: write, permission-contents: read, repositories: t27), runs the cosign-verified t27o-v0.1.0 t27c over the changed specs, runs the generated C, and calls github/codeql-action/upload-sarif with that token. It always uploads, so a fixed spec closes its alert. Without CLAW_APP_PRIVATE_KEY / CLAW_APP_ID (a fork) it uploads nothing and says so in the step summary.
  • The row code-scanning-sarif goes PLANNED to LIVE (census test 11/0 to 10/1).
  • Docs: docs/claw/README.md and AGENTS.md section 8.

Verified on the Railway lab

  • sarif_feed.t27: spec-status IMPLEMENTED, test-report 12/12, 0 vacuous; github_surface.t27 10/10; sarif.t27 15/15.
  • gen-c of gates.t27 and t27f_gate.t27 is byte-identical to the committed C with the lab binary, so the new file's lowering is comparable; the new C compiles.
  • End to end: a spec with a syntax error and a good spec went through the same spec-status + parse loop and the built C; the output is valid JSON (jq), one result, ruleId T27C001, startLine 3, startColumn 1, executionSuccessful true.
  • tools/dupe_scan.py: no new duplicate body. Own-language budget and shrink pass in the pre-commit hook.

Own-language offset

The job adds 32 foreign (YAML) lines to gate-topology.yml and one to spec-guards.yml. The same diff deletes scripts/ultra_engine_v70_ultimate.py and scripts/gen_w{660,669,670}.py (609 lines): each is ported under specs/port/scripts/ and nothing in .github/, tools/ or scripts/ calls it.

Not in this PR

  • Rules T27C002 (test-failed) and T27C003 (vacuous-test) need the zig-backed test runner, which the job does not install. The rule table keeps them; the document does not claim them.
  • Needs owner steps to show alerts: the App permission security_events: write (and its acceptance on the installation), code scanning enabled on the repository, the secret and the variable of docs/claw/README.md.
  • The suggestion review and the preview deployment are separate lanes.

🤖 Generated with Claude Code

@gHashTag @claude
claw: sarif_feed -- a spec that does not parse becomes a code-scannin…
b5453af 
…g alert on the pull request (Closes #10356)

specs/claw/sarif_feed.t27 maps what `t27c spec-status` and `t27c parse` print for a
changed .t27 file onto the six-field findings sarif.t27 renders, and
gen/c/claw/sarif_feed.c is its lowering. The new claw-sarif job of
gate-topology.yml mints the TRI CLAW token with exactly the code-scanning-sarif
row of github_surface.t27 (security_events write, contents read), runs the signed
t27o-v0.1.0 t27c over the changed specs and uploads the document with
github/codeql-action/upload-sarif. That row moves PLANNED -> LIVE.

NOPARSE -> T27C001 error at the line:col t27c names; UNWRITTEN -> T27C004
warning; an unknown status or a short record marks the run partial
(executionSuccessful false) instead of reading as clean. T27C002/T27C003 need
the zig-backed test runner and are not fed yet.

spec-guards regenerates and diffs the committed C. Shrink offset: spent
scripts/ultra_engine_v70_ultimate.py and scripts/gen_w{660,669,670}.py, all ported
under specs/port/scripts/ and called by nothing.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@gHashTag
gHashTag enabled auto-merge (squash) October 18, 2026 09:24
@github-actions

github-actions Bot commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-10-18 09:25:22 UTC

Summary

Status Count
Total Open PRs 50
PRs with Failing Checks 49
PRs with All Checks Green 1
READY 0
FAILING 49
PENDING 0
NO CHECKS YET 0

These columns do not partition: 0 + 49 + 0 + 0 = 49, and there are 50 open PRs. A PR is being counted twice or not at all.

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=fad12492937a != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@gHashTag
gHashTag merged commit 98fc959 into master Oct 18, 2026
29 of 32 checks passed
This was referenced Oct 18, 2026
Draft
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

claw: wire sarif.t27 to pull requests -- a spec that does not parse becomes a code-scanning alert (row code-scanning-sarif)

1 participant

@gHashTag