[esnible]

Summary

projected_secret_reads_preserve_non_utf8_canonical_paths was gated on #[cfg(unix)], which includes macOS. APFS rejects non-UTF-8 filenames with EILSEQ (os error 92), so the test's setup (std::fs::write of target-\xff) panics before the filter is exercised, and make test-unit-filters fails on every Mac.

Kubernetes projected secrets only exist on Linux nodes, so this narrows the gate to #[cfg(target_os = "linux")] and adds a comment explaining why. Linux coverage is unchanged.

Related issue

Closes #1835

Validation

• Unit tests: cargo test -p praxis-ai-filters --lib routing::credential_inject on macOS 15.7.9. The non-UTF-8 test is no longer compiled there; before this change it failed with Illegal byte sequence.
• Integration or functional tests: not applicable (test-only change)
• make lint: the nightly toolchain install failed locally (rustup 502), so I ran cargo +nightly fmt --all -- --check and cargo clippy -p praxis-ai-filters --all-targets -- -D warnings instead; both pass.

Note: watcher_shutdown_wakes_without_receive_timeout in the same module can also fail on macOS under load. It asserts teardown in under 100ms and takes about 90–110ms locally. That's a separate timing issue and isn't addressed here.

Checklist

• I reviewed every changed line and can explain the change.
• New capabilities include an example config and functional example test. (N/A)
• User-facing behavior and generated documentation are updated. (N/A)
• Performance-sensitive changes include appropriate benchmark or load-test evidence. (N/A)
• Commits are signed and include a Signed-off-by trailer.

Breaking changes

None.

---

Assisted by Claude.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Restricted coverage for non-UTF-8 canonical paths to Linux. The test no longer runs on other Unix platforms, where filesystem support for such filenames differs. No user-facing behavior or public interfaces changed.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: praxis-proxy/ai
• Branch: main
• File: .coderabbit.yaml
• Commit: 02883e8
• Layers: Repository YAML (base), Central YAML (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: a79af0b9-2a0c-4ea2-bdfd-78f4692cc3e3

Commits

Reviewing files that changed from the base of the PR and between 02883e8 and 8aeae72.

Files selected for processing: 1

• filters/src/routing/credential_inject.rs

Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• praxis-proxy/praxis (manual)
• praxis-proxy/conventions (manual)

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The non-UTF-8 canonical-path test now runs only on Linux. Its comment notes that APFS does not support non-UTF-8 filenames.

Changes: Credential injection test

Layer / File(s)	Summary
Restrict test platform filters/src/routing/credential_inject.rs	The test’s platform guard changes from unix to target_os = "linux". A comment notes APFS’s non-UTF-8 filename limitation.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix · Severity of issue fixed: Low

Possibly related PRs

• praxis-proxy/ai#1737: Adds the shared credential-source reader and watcher used by projected credential files, which this test exercises.
• praxis-proxy/ai#1794: Updates the credential-injection watcher and adds projected-subdirectory rotation coverage in the same component.

Suggested reviewers: leseb

Merge Risk: Minimal · up to 8aeae

The test adjustment should allow the macOS unit-test workflow to pass without reducing Linux coverage.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: limiting the non-UTF-8 projected secret test to Linux.
Linked Issues check		Issue #1835 requires macOS test execution to pass or skip. The changed test projected_secret_reads_preserve_non_utf8_canonical_paths now uses #[cfg(target_os = "linux")], so macOS skips it. The co…
Out of Scope Changes check		The pull request changes only the platform gate and adds a supporting comment for the failing test identified in issue #1835. The change stays within the linked issue scope.

Full details: Linked Issues check

Explanation

Issue #1835 requires macOS test execution to pass or skip. The changed test projected_secret_reads_preserve_non_utf8_canonical_paths now uses #[cfg(target_os = "linux")], so macOS skips it. The comment documents the APFS limitation. Linux coverage remains enabled.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files.

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}