Repository navigation
fix: harden cognition validation and release readiness - #165
Conversation
Scope's helper returns a SpokeReject value with a fixed message and a field detail; cognition's helper returns a generic SpokeResult<T> with a caller-supplied message and no field. Both carry the same unsupported_cognition_requirement wire reason, so the distinction is intentional and stays unconsolidated.
…st wording The remote module doc claimed default connect builds stay lean without a spoke-operations dependency, while Cargo declares that dependency unconditionally. State the feature gate and the unconditional dependency affirmatively, preserving the TypeScript ./remote subpath note. Rename the memory-engine measure test to the normalize-path byte equality it asserts and trim the stale direct-serialization comment. Wording only; no behavior change.
The C ABI gate could see record sizes, alignments and offsets, and every callback signature, but not a same-size member retype: an int64_t to uint64_t swap or a dropped const kept all of those assertions green. The carrier test report now prints SPOKE_CONNECT_ABI_FIELD_TYPE <record>.<field> <rust type> for every non-callback member, behind a coerced field accessor so the line states the field's own type, and the gate renders that Rust type back into the C type the header must declare (both coverage directions fail). Callback members stay on the existing signature axis. runLayoutCheck is split into buildLayoutProbe (writes the probe TU, returns its compile entry) and a thin wrapper, so the self-test can compile a probe built from a report with one offset perturbed and prove that fails; a same-size struct field retype joins the mutations as well.
The common MindDelta pattern accepted any non-empty token under /modules/mental/, so /modules/mental/temperament and other unknown fields validated even though both validateMindState guards already enforced the nine-name vocabulary. Narrow the schema token to the verbatim guard names, leaving the cognition arm, description and RFC 6901 tail unchanged. Add a shared fixtures/mental-field-cases.json and assert the same accept/reject paths in the JSON Schema leg, the TypeScript guard and the Rust guard so the three layers cannot drift again. Regenerate the generated trees; typify embeds the pattern in the generated Rust.
A pinned selection or cognition_filter that cannot be decoded degraded to a fresh verdict. Both now report stale through the existing reflections.state stale member, with a stored-state regression covering each arm.
Keep one why-only line per helper explaining why the two reject constructors stay separate (raw SpokeReject vs generic result, field-aware vs caller-message), and drop the assertion-site line numbers that go stale as the files change.
… comments Both helper comments now record the shared unsupported_cognition_requirement reason while keeping the practical split: scope needs the raw reject with a field path and fixed message, cognition needs a generic result with a caller-supplied message and no field.
Report each non-callback member from its accessor's inferred type instead of an expected return type, so a mutable pointer can never be reported as const. Assert exact type identity and cover both the producer inference and the pointer-constness comparison with negative controls.
Mirror the smoke's disabled/enabled configuration table in probeCommands, adding an exceptions-enabled C++17 inclusion probe beside the unchanged disabled one on both toolchains. Select the planted .hpp exception mutation by the exact disabled label, since the planted throw only fails under a no-exception configuration.
|
Additional evidence for the current nonblocking Cargo/Go audit findings at Cargo attribution. Go producer and byte identity. Both committed Darwin carriers were built from
This publishes the existing attributed producer/byte record; it does not add an automatic Go-side provenance/verifier contract. These are ordinary Git objects, not LFS pointers. Same-host/source/SDK/options/full-path equality is not universal reproducibility or a consumer-runtime claim. Final current-head CI and review gates remain mandatory. |
…he demo The current connect-demo server carries no canonicalize dependency; it orchestrates the public ConnectResponder, whose library dependency supplies the pinned canonicalize@5.1.0. Narrowly correct the responder knowledge paragraph and its index summary to distinguish the library's real pin and the third-party recipe pin from the demo's ownership.
|
@greptile review |
![wood-s-inspector[bot]](https://avatars.githubusercontent.com/in/4803300?s=60&v=4){kind=small}
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Correct the verify-version runtime in the release spec to Node 24, list git-lfs among the apply script's header prerequisites, and distinguish the root dev-tool Node range from the published consumer floor.
Replace the static Node patch-version thresholds with the actual capability-probe contract on the advertised Node >= 22 floor; comment and prose only.
Dismissed because a newer commit was pushed; Greptile will re-review the current head.
|
@greptile review |
Convert inline frontmatter arrays to block sequences, keep eight SDK tags, record last_updated, and state the current SDK role and shipped public responder orchestration.
Describe the custom serialized gate without the removed demo path and state that the demo exercises the shipped connectResponder integration, not the manual low-level recipe.
…claims The Ed25519 backend is chosen by the runtime probe that imports this host's required keys, not by an asserted version cutoff. Replace the absolute cutoff wording in the module header, the probe docstring and the SDK knowledge doc with that implementation contract; probe behaviour, exports and package floors are unchanged.
…y network or tree mutation
…rce branch Merge docs track ref a22d6dc (probe-precision: two knowledge docs + crypto.ts JSDoc-only) into fix/maintenance-016-swift-carriers alongside the LFS preflight root fix.
Dismissed because a newer commit was pushed; Greptile will re-review the current head.
|
@greptile review |
…d sidecar facts Current-fact prose pass over five existing paths; no runtime, API, wire, or schema change: - spoke-remote-adapter.md D10: the exclusive enforcement sentence is now scoped to the dialer/client pipeline and cross-references the existing public responder faces (D14 connectResponder; serving/FFI faces D13/D16), preserving module-internal/crate-private visibility and all reject/D7 wording. - connect-ts-responder-from-public-exports.md: the Context parenthetical and the Why-This-Matters sentence drop the 'only through the RemoteAdapter surface' claim for the helper-visibility fact; factory name/subpath, demo ownership, and every example stay unchanged. - connect-ts-client-sdk.md and crypto.ts JSDoc: the WebCrypto probe is described exactly as implemented — one PKCS8 Ed25519 private/sign-key import (['sign'] only) whose cached result selects the backend for both sign and verify; verification's SPKI import is not itself probed. - apply-xcframework-artifact.sh: the stale sidecar comment no longer claims the compiler banner is 'deliberately not recorded'; it states the producer record's rustcVersion (full producer rustc -Vv output, required non-empty) is copied verbatim into the sidecar observedRustc.
|
@greptile review Please review current head |
|
Current head |
Changes
02983eee9e6b0bdb7838c7bf40a8fe16489cc098.Package versions remain 0.15.2. A separately authorized New release 0.16.0 uses the existing signed-bump, annotated-tag and Trusted Publishing workflows.
Verification
Merged source and post-merge validation
PR165 was verified normally merged at2026-11-08T20:18:56Z as
b9a9d713a1aa1ef772b4d05c82cc5c27034f3ba1. Its valid GitHub signature, parents and tree41217c451eaa213ac8aae5959035dcc28903a5d6match tested head7e6abd92508569315f427f3f464de53e77664497. All11required checks succeeded; all30settled28success/1PagesSkip/1CodeQLneutral with no failure or in-flight work. Strict Swift consumer/rebuild/freshness passed, both Kotlin lanes executed19JUnit cases with0failures/errors/skips, Greptile5/5 and Inspector77% bind that head, and all16threads were resolved. Native workflow completion revision53 and root unregister committed atomically; fresh status and Phase6 gate pass. Two actualmerged-main knowledge catalog rows now match final H1/hash via CAS1→2; exactlytwo final-file CLI checks and independent all-six-AC remaining QA passed, then I167 closed. R6's4unverified/13invalid-output/8omitted limits and low I170 remain explicit, not zeroed. Source versions remain0.15.2; separately authorized New release0.16.0 is the publishing action.Merge policy:
reviewed-bot. Require latest-head required CI, every attached bot's own passing bar (Greptile5/5; Inspector success with complete head-bound overall/inline evidence), and resolved threads/blocking findings. Earlier-head approvals authorize nothing here.Prior test/trust/ABI findings have source fixes; SQLite evidence is explicitly reference-provider scoped. Strict freshness remains exact, with original drift explained by different effective Cargo inputs. Optional self-contained failed-step metadata was not added: truthful failure/run references and application outcome/source/hash gates remain. Previous unverified/omitted tallies are retained as evidence limitations, not invented verified or closed findings.
Inspector's internal manual-responder recipe suggestion is retained as I170: consumer-local error/seed bindings remain implicit in the preserved worked excerpts, and no standalone-compilation claim is made. It is separate from the shipped public
connectResponder; owner architect handles it on scoped recipe maintenance or demonstrated consumer demand. The compiler nit compares JSON fields, not raw stdout: actual recovered producerrustcVersionand committed sidecarobservedRustcare equal191-character strings with no trailing LF. The producer already shell-captures stdout before JSON; arbitrary edited records/raw-stdout terminator fidelity are not asserted.Residuals
All15 original selected source records and seventeen subsequent accepted corrections are resolved with their complete applicable acceptance retained. These three project followups remain open and unwaived:
New platforms and UE engine-internal verification retain their existing demand/environment gates. Publication is separate. The owner explicitly retained exactly three local cleanup resources; all other owned-resource guarded post-merge cleanup remains required.