[hyperpolymath]

Summary

Follow-up to #426. That pull request merged while the fixes for its last 6 review threads were in work. This pull request has those fixes, and a reviewed copy of the Actions allow-list.

Code generation (src/ephapax-wasm)

• Arm binders have a scope. The binder of a case arm, and the names that a match arm binds, are now in scope in that arm only. let already did this. Before, a binder stayed bound after the case:

  data Opt = Yes(I32) | No
  fn main(): I32 =
    let x = 5
    let r = match Yes(7) of
      | Yes(x) => x
      | No => 0
      end
    r + x
  

  ephapax run printed 14 and run --interp printed 12. With a binder of another wasm type (Yes(I64)), the module was invalid. This defect is older than feat: one front end (E3), wasm runner (E4) and typed code generation (E5) #426.

• Tuple patterns. A tuple pattern reads the 8-byte slots of the tuple, each at its own type. It followed pair pointers, which a tuple of three or more does not have. A tuple pattern inside a constructor pattern has no types to use, so the typed validation refuses it.

• compile_module_with_main. An unsupported-construct error from the typed validation of the module is returned. Before, the function took the fallback and compiled only the main body.

Driver

• qualify_functions is now three functions (SonarCloud cognitive complexity 32, limit 30). No change in behaviour.

Documents

• TEST-NEEDS.adoc has one test count (600) in its three places.
• .github/actions-allowlist.txt is a reviewed copy of the Actions allow-list of this repository (Settings, Actions, General). It has what the workflows here and the pinned standards workflows use, plus two entries that the owner keeps. GitHub does not read the file.

Review threads of #426 that this closes

Thread	Result
Codex P2: restore the outer binding before the other case arm	Fixed
Codex P2: clear pattern bindings before the next match arm	Fixed
CodeRabbit Major: tuple patterns against the flat tuple layout	Fixed; a tuple pattern inside a constructor pattern is refused
CodeRabbit Minor: return typed codegen refusals from compile_module_with_main	Fixed
CodeRabbit Trivial: split qualify_functions	Done
CodeRabbit Minor: one test total in TEST-NEEDS.adoc	Done

Tests

• tests/run_wasm.rs: an_arm_binder_does_not_replace_an_outer_variable (I32 and I64 binder, run and run --interp).
• tests/wasm_e2e.rs: e2e_tuple_pattern_reads_the_tuple_slots and e2e_match_arm_binder_ends_with_its_arm. Each builds a core module, runs it, and checks the result of main.
• ephapax-wasm unit tests: pattern_lowering_coverage; module_with_main_fallback_checks_the_body has the new error case.

Validation (local, same tree as the head)

• cargo test --workspace: 603 passed, 0 failed.
• cargo fmt --all --check: clean.
• cargo clippy --workspace --all-targets: no warnings.
• scripts/status-gate.sh: test count 600 matches.
• scripts/probe-battery.sh: 53 SAME, 5 SKIP (no wasmtime CLI).
• No file under formal/ is changed.

Notes for the owner

• Rust CI, Governance, Secret Scanner and Hypatia Security Scan failed at startup on every commit of feat: one front end (E3), wasm runner (E4) and typed code generation (E5) #426, and on main, because the Actions policy refused the reusable workflows of metadatastician/standards. The Rust tests therefore did not run in CI for feat: one front end (E3), wasm runner (E4) and typed code generation (E5) #426. If the allow-list is now saved, this pull request is the first one where they can run.
• The commits carry the session SSH signature, not the owner GPG key.

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 28 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: cb8ab343-4859-431c-b7a4-651c765bf64a

Commits

Reviewing files that changed from the base of the PR and between df6883e and 35aa73b.

Files selected for processing: 6

• .github/actions-allowlist.txt
• TEST-NEEDS.adoc
• src/ephapax-cli/tests/run_wasm.rs
• src/ephapax-cli/tests/wasm_e2e.rs
• src/ephapax-driver/src/qualify.rs
• src/ephapax-wasm/src/lib.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-10T14:08:17.097410Z	35aa73b	Draft marked ready
🔒 Security Review	❌ Failed 2026-11-10T14:05:42.132448Z We couldn’t complete this review. Comment @codex security review to try again.	35aa73b	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins.