docs: define acquisition-ready architecture contract - #137
Conversation
|
Caution Review failedThe pull request is closed. Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (12)
📝 WalkthroughWalkthroughDiskSage의 아키텍처, 권한, 개인정보, 운영 및 릴리스 계약을 문서화했다. 클라우드 리뷰와 전송에 조직 테넌트 권한 검증을 적용했다. 문서 회귀 테스트와 전체 TypeScript 커버리지 게이트를 빌드 및 CI에 연결했다. Changes아키텍처 및 운영 계약
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ARCHITECTURE.md`:
- Around line 202-217: Align the exact-head required workflow entry points in
.github/workflows/test.yml and .github/workflows/release.yml with the documented
100% production coverage gate: run npm run coverage rather than only npm test,
and ensure the configured coverage scope includes all production files instead
of being limited to the current five-file set such as src/lib/api.ts.
- Around line 121-135: Update the authorization section in ARCHITECTURE.md to
define authoritative contracts separately for read-only and each mutating
operation, replacing ambiguous terms such as “can include,” “where material,”
and “short-lived” with required inputs, fingerprint and scope constraints,
freshness requirements, the clock used for expiry, and the explicit rejection
state after expiry. Extend the documented 15-minute rule beyond cloud-copy and
existing-copy adoption where required, and specify each operation’s applicable
expiry behavior without changing unrelated guidance.
- Around line 229-233: Update the standards references in the architecture
evidence model around the WCAG citation: record WCAG 2.2 separately with the
fixed W3C URL https://www.w3.org/TR/2023/REC-WCAG22-20231005/, and record
ISO/IEC 40500:2025 as a distinct ISO standard based on that recommendation.
Ensure each APA citation’s date matches its corresponding standard and URL.
In `@src/lib/architectureDocumentation.test.ts`:
- Around line 19-60: Strengthen the architecture documentation tests around the
existing requiredHeadings and buyer-facing claims test: add “## Architecture
change control” and “## Reference verification note”, validate the exact-head
statements with an ordered regex enforcing continuity, verify each evidence path
is present in ARCHITECTURE.md and exists in the repository, and assert the
essential snake_case database-naming condition remains documented.
- Around line 12-14: Update readRepositoryDocument to resolve paths from the
module-based repository root rather than process.cwd(). Derive that root using
import.meta.url and fileURLToPath, then resolve relativePath against it so
ARCHITECTURE.md remains accessible regardless of the test runner’s working
directory.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e03eae3a-747e-4c22-a3fe-3745a641f01b
📒 Files selected for processing (3)
ARCHITECTURE.mdCHANGELOG.mdsrc/lib/architectureDocumentation.test.ts
|
@coderabbitai review |
|
|
@opencode-agent review Review exact current head |
|
@cwl-noema-review Perform an independent formal review of exact current head |
|
@opencode-agent review Perform an independent formal review of exact current head |
|
@coderabbitai review Review exact current head |
|
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
87ac0e08cceed3d1a766da13a8f8123912178192. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/disksage/actions/runs/31070906439/job/92518518830)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/disksage/actions/runs/31070906439/job/92518518830)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: test.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: test.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (7 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (7 files)"]
R2 --> V2["required checks"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (11 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (11 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: cloud-review-tenant-authority.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: cloud-review-tenant-authority.md"]
R3 --> V3["docs review"]
|
|
@opencode-agent @cwl-noema-review Perform a formal independent review of exact current head |
There was a problem hiding this comment.
Actionable comments posted: 12
🧹 Nitpick comments (1)
src-tauri/tests/cloud_transfer_tenant_authority_gate.rs (1)
151-176: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win조직 전송의 허용 경로를 추가하십시오.
현재 이 테스트는 attestation이 없는 rejected 경로를만 다룹니다. attested rationale이 있는 승인
CloudReviewDecision으로CloudAccountScope::Organization과ORGANIZATION_TENANT_AUTHORITY_REVIEW_REASON케이스를 확인하고,organization-tenant-authority-attestation-requiredblocker가 없도록 하십시오. 필요하면 실제 receipt 경로까지 함께 검증하십시오.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src-tauri/tests/cloud_transfer_tenant_authority_gate.rs` around lines 151 - 176, Extend organization_signals_require_tenant_authority_even_without_ordinary_review with an approved CloudReviewDecision containing an attested rationale for both CloudAccountScope::Organization and ORGANIZATION_TENANT_AUTHORITY_REVIEW_REASON cases. Assert that candidate_blockers_with_review does not contain organization-tenant-authority-attestation-required, and validate the actual receipt path as well if required by the surrounding APIs.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Line 35: Update CHANGELOG.md and AGENTS.md to align the npm lockfile
publication job with the repository’s write-authority policy: place publication
under the DiskSage writer loop, or document and implement an explicit writer
lease with same-run artifact/CAS or blob-SHA validation and unchanged-head
checks before committing. In CHANGELOG.md line 35 and AGENTS.md lines 27-31,
ensure the recorded policy matches the implemented workflow and grants contents:
write only to the validated publication step.
In `@docs/adr/0002-evidence-authorization-separation.md`:
- Line 44: Update the approval-lifetime statement in the ADR to require exactly
15 minutes from issuance for every mutation approval, replacing the “default”
wording and explicitly stating that no longer lifetime or per-operation
exception is permitted.
In `@docs/adr/0003-exact-head-repository-evidence.md`:
- Around line 35-45: Update the merge/release evidence requirements in the ADR
so they use separate commit contracts: merge must validate the PR source head
with the independently resolved live base, while release must validate the exact
protected integrated head. Require release checks and artifacts to be tied to
that same integrated commit, and replace the ambiguous “exact current source
head” wording with explicit symbols for each flow.
In `@docs/adr/0004-model-artifact-integrity.md`:
- Line 5: Update the status on line 5 of
docs/adr/0004-model-artifact-integrity.md,
docs/adr/0001-local-first-runtime-authority.md, and
docs/adr/0002-evidence-authorization-separation.md from Proposed to either
active or planned, preserving the rest of each ADR content.
- Line 50: Update the model-loading contract described in the ADR so llama
initialization consumes the already validated FileHandle/bytes rather than
reopening the artifact by path, or explicitly define equivalent OS-level
identity protection. Extend the test requirements near the existing line 77
coverage to verify the validated handle/bytes remain bound through
initialization and detect replacement attempts.
In `@docs/adr/0005-central-control-plane-boundary.md`:
- Around line 3-5: Update the ADR status in 0005-central-control-plane-boundary
to use the required vocabulary, replacing “Proposed in PR `#137`” with an explicit
active_pr status referencing PR `#137`; keep this status until protected
integration.
- Around line 60-64: Update the “Security and governance impact” section to
explicitly require an immutably pinned OpenCode Agent for autonomous
model-backed development, matching the requirement documented in docs/TRD.md.
Keep the existing credential and workflow-reference requirements unchanged, and
state agent pinning as mandatory for privileged automation.
In `@docs/API_CONTRACT.md`:
- Around line 67-81: Update the mutation contract in docs/API_CONTRACT.md lines
67-81 to require a maximum authorization age of 15 minutes, reject the expiry
boundary and clock inconsistencies, and fail closed on plan drift. Update the
FR-003 acceptance requirement in docs/PRD.md lines 92-99 with the same 15-minute
freshness limit and fail-closed conditions; both documented sites require direct
changes.
- Around line 65-81: Update the mutation contract in docs/API_CONTRACT.md lines
65-81 to define tenant-authority evidence as a separate gate when
destination_account_scope is "organization" or the canonical
organization-authority reason is used; require valid, known, correctly
formatted, non-contradictory proof and fail closed otherwise, while stating
personal-cloud approval does not require it. Update PRD-FR-006 in docs/PRD.md
lines 104-106 with the same evidence and authorization requirement. Update the
cloud technical contract state list in docs/TRD.md lines 71-86 to include
tenant-authority evidence and fail-closed handling, and state that Rust owns
security authorization validation and external observations cannot grant
authority.
In `@docs/PRD.md`:
- Around line 152-155: Update docs/PRD.md lines 152-155, docs/TRD.md lines
154-159, and docs/TRACEABILITY.md lines 63-78 to consistently define frontend
coverage and release-build binding: include all production TypeScript under
src/lib and src/routes, exact statement/branch/function/line thresholds, the
prohibition on exclusions for authority-bearing logic, the test command, the
Tauri release-build entry point, and evidence mapping. In TRD.md explicitly
state that both the test workflow and Tauri release build execute the same
production coverage gate; in TRACEABILITY.md map the actual globs, thresholds,
command, and workflow/build evidence.
In `@docs/TRACEABILITY.md`:
- Around line 99-113: Register docs/API_CONTRACT.md in the canonical
documentation graph: update docs/TRACEABILITY.md lines 99-113 with an
API/IPC/evidence contract row and its implementation and test paths; add
docs/API_CONTRACT.md to the coverage matrix in docs/DOCUMENTATION_ASSESSMENT.md
lines 13-32; and remove the corresponding future-gap entry at lines 83-94, or
document clearly why it is not canonical.
In `@docs/UML.md`:
- Around line 100-113: Update the VerifyInstall label in the Mermaid flowchart
to replace the ambiguous “sync” term with terminology that explicitly denotes
artifact file durability, such as “fsync” or “durable flush,” or race-safe
publication if that is the intended evidence. Keep the installation verification
scope limited to exact size, SHA-256, and the clarified artifact-level
operation.
---
Nitpick comments:
In `@src-tauri/tests/cloud_transfer_tenant_authority_gate.rs`:
- Around line 151-176: Extend
organization_signals_require_tenant_authority_even_without_ordinary_review with
an approved CloudReviewDecision containing an attested rationale for both
CloudAccountScope::Organization and ORGANIZATION_TENANT_AUTHORITY_REVIEW_REASON
cases. Assert that candidate_blockers_with_review does not contain
organization-tenant-authority-attestation-required, and validate the actual
receipt path as well if required by the surrounding APIs.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d4a863ec-80e5-42a6-a656-d0d01f7b9425
📒 Files selected for processing (22)
AGENTS.mdCHANGELOG.mdCLAUDE.mdSECURITY.mddocs/API_CONTRACT.mddocs/DATA_MODEL.mddocs/DOCUMENTATION_ASSESSMENT.mddocs/OPERABILITY.mddocs/PRD.mddocs/README.mddocs/TEST_STRATEGY.mddocs/THREAT_MODEL.mddocs/TRACEABILITY.mddocs/TRD.mddocs/UML.mddocs/adr/0001-local-first-runtime-authority.mddocs/adr/0002-evidence-authorization-separation.mddocs/adr/0003-exact-head-repository-evidence.mddocs/adr/0004-model-artifact-integrity.mddocs/adr/0005-central-control-plane-boundary.mddocs/adr/README.mdsrc-tauri/tests/cloud_transfer_tenant_authority_gate.rs
|
|
||
| ## Status | ||
|
|
||
| Proposed. The implementation is split across active PR #141 (installation integrity) and stacked PR #142 (load-time integrity); neither is protected-main authority until merged and revalidated. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
세 ADR의 활성 상태 표기를 저장소 지침에 맞추세요.
세 파일 모두 활성 제안인데 상태를 Proposed로 기록합니다. 보호된 통합 전에는 active 또는 planned를 사용해야 합니다.
docs/adr/0004-model-artifact-integrity.md#L5-L5: 상태를active또는planned로 변경하세요.docs/adr/0001-local-first-runtime-authority.md#L5-L5: 상태를active또는planned로 변경하세요.docs/adr/0002-evidence-authorization-separation.md#L5-L5: 상태를active또는planned로 변경하세요.
As per coding guidelines: docs/adr/**: Keep active proposals labeled as active or planned until protected integration proves them.
📍 Affects 3 files
docs/adr/0004-model-artifact-integrity.md#L5-L5(this comment)docs/adr/0001-local-first-runtime-authority.md#L5-L5docs/adr/0002-evidence-authorization-separation.md#L5-L5
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/adr/0004-model-artifact-integrity.md` at line 5, Update the status on
line 5 of docs/adr/0004-model-artifact-integrity.md,
docs/adr/0001-local-first-runtime-authority.md, and
docs/adr/0002-evidence-authorization-separation.md from Proposed to either
active or planned, preserving the rest of each ADR content.
Source: Coding guidelines
| ### Quality | ||
|
|
||
| Owned production code targets exact 100% statement and branch coverage and, where tooling exposes them, function and line coverage. Public APIs require beginner-readable documentation. Coverage exclusions cannot be used to hide production behavior that carries authority. | ||
|
|
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift
Frontend coverage와 release-build binding을 세 문서에서 동일하게 구체화하세요.
현재 문구는 100% coverage와 configured gates를 요구하지만, PR objective의 정확한 범위와 실행 경로를 보장하지 않습니다. src/lib 및 src/routes의 모든 production TypeScript, 각 threshold, coverage exclusion 금지, test 명령, Tauri release-build entry point를 같은 계약으로 기록하세요.
docs/PRD.md#L152-L155: 제품 품질 요구사항에 정확한 경로와 threshold를 추가하세요.docs/TRD.md#L154-L159: test workflow와 Tauri release-build가 동일한 production coverage gate를 실행한다고 명시하세요.docs/TRACEABILITY.md#L63-L78: 실제 glob, threshold, command, workflow/build evidence를 매핑하세요.
코딩 가이드라인은 적용 가능한 production coverage를 완전하게 측정하고 authority-bearing production logic을 exclusion으로 숨기지 않도록 요구합니다.
📍 Affects 3 files
docs/PRD.md#L152-L155(this comment)docs/TRD.md#L154-L159docs/TRACEABILITY.md#L63-L78
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/PRD.md` around lines 152 - 155, Update docs/PRD.md lines 152-155,
docs/TRD.md lines 154-159, and docs/TRACEABILITY.md lines 63-78 to consistently
define frontend coverage and release-build binding: include all production
TypeScript under src/lib and src/routes, exact statement/branch/function/line
thresholds, the prohibition on exclusions for authority-bearing logic, the test
command, the Tauri release-build entry point, and evidence mapping. In TRD.md
explicitly state that both the test workflow and Tauri release build execute the
same production coverage gate; in TRACEABILITY.md map the actual globs,
thresholds, command, and workflow/build evidence.
Source: Coding guidelines
| ## Documentation traceability | ||
|
|
||
| | Question | Authoritative document | | ||
| | --- | --- | | ||
| | What product/problem/outcomes are we building? | `docs/PRD.md` | | ||
| | What technical constraints and evidence semantics apply? | `docs/TRD.md` | | ||
| | Where are trust/deployment/authority boundaries? | `ARCHITECTURE.md` | | ||
| | Why were material architecture decisions made? | `docs/adr/` | | ||
| | How do components and state transitions interact? | `docs/UML.md` | | ||
| | What are the conceptual/persisted data entities? | `docs/DATA_MODEL.md` | | ||
| | What can attack the product and how is it mitigated? | `docs/THREAT_MODEL.md` and `SECURITY.md` | | ||
| | How is correctness proven? | `docs/TEST_STRATEGY.md` | | ||
| | How is the product operated/recovered/released? | `docs/OPERABILITY.md` | | ||
| | Are the documentation families complete and current? | `docs/DOCUMENTATION_ASSESSMENT.md` | | ||
| | What changed in an integrated/released version? | `CHANGELOG.md` | |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift
새 API contract를 canonical documentation graph에 포함하세요.
docs/API_CONTRACT.md는 이미 추가되었지만 traceability map과 assessment matrix가 이를 등록하지 않습니다. Assessment는 동일 contract를 미래 gap으로도 설명합니다.
docs/TRACEABILITY.md#L99-L113: API/IPC/evidence contract 행과 관련 구현·테스트 경로를 추가하세요.docs/DOCUMENTATION_ASSESSMENT.md#L13-L32: coverage matrix에docs/API_CONTRACT.md를 추가하세요.docs/DOCUMENTATION_ASSESSMENT.md#L83-L94: 해당 future gap을 제거하거나, 현재 파일이 canonical contract가 아닌 명확한 이유를 기록하세요.
코딩 가이드라인은 material API, authority, schema 변경을 같은 PR의 canonical documentation과 docs/TRACEABILITY.md에 반영하도록 요구합니다.
📍 Affects 2 files
docs/TRACEABILITY.md#L99-L113(this comment)docs/DOCUMENTATION_ASSESSMENT.md#L13-L32docs/DOCUMENTATION_ASSESSMENT.md#L83-L94
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/TRACEABILITY.md` around lines 99 - 113, Register docs/API_CONTRACT.md in
the canonical documentation graph: update docs/TRACEABILITY.md lines 99-113 with
an API/IPC/evidence contract row and its implementation and test paths; add
docs/API_CONTRACT.md to the coverage matrix in docs/DOCUMENTATION_ASSESSMENT.md
lines 13-32; and remove the corresponding future-gap entry at lines 83-94, or
document clearly why it is not canonical.
Source: Coding guidelines
| ```mermaid | ||
| flowchart TD | ||
| Spec[Immutable model specification] | ||
| Download[Bounded HTTPS stream] | ||
| Stage[Create-new staging file] | ||
| VerifyInstall[Exact size + SHA-256 + sync] | ||
| Publish[No-clobber publication] | ||
| Installed[Installed artifact] | ||
| VerifyLoad[Load-time non-following metadata + exact size + SHA-256] | ||
| Llama[llama.cpp initialization] | ||
|
|
||
| Spec --> Download --> Stage --> VerifyInstall --> Publish --> Installed | ||
| Spec --> VerifyLoad | ||
| Installed --> VerifyLoad --> Llama |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | sed -n '1,200p'
echo "== docs UML relevant =="
if git ls-files | grep -qx docs/UML.md; then
nl -ba docs/UML.md | sed -n '1,150p'
fi
echo "== search sync sync_evidence durable fsync model install =="
rg -n --hidden --glob '!target/**' --glob '!node_modules/**' \
'\bsync_evidence\b|fsync|durable flush|sync proof|VerifyInstall|VerifyLoad|model specification|model integrity|model installation' .Repository: ContextualWisdomLab/disksage
Length of output: 8257
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== docs/UML.md lines 1-140 =="
awk '{printf "%6d %s\n", NR, $0}' docs/UML.md | sed -n '1,140p'
echo "== docs/TRD.md sync-related lines =="
awk '{printf "%6d %s\n", NR, $0}' docs/TRD.md | rg -n "sync|evidence|provider|item|install|model|fsync|durable|install|VerifyInstall|VerifyLoad"Repository: ContextualWisdomLab/disksage
Length of output: 14961
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== source docs relevant terms =="
rg -n --hidden --glob '!target/**' --glob '!node_modules/**' \
'\bsync_evidence\b|sync proof|provider sync|item sync|fsync|durable flush|VerifyInstall|VerifyLoad|model installation|model integrity' .
echo "== rust fsync references if any =="
rg -n --hidden --glob '!target/**' --glob '!node_modules/**' \
'fsync\(|StandardOpenOption::DURATION|DATASYNC|metadata().length|sha256|sha_256|VerifyInstall|VerifyLoad' .Repository: ContextualWisdomLab/disksage
Length of output: 28202
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== DATA_MODEL.md sync_evidence section =="
awk '{printf "%6d %s\n", NR, $0}' docs/DATA_MODEL.md | sed -n '1,220p'
echo "== llm.model implementation =="
awk '{printf "%6d %s\n", NR, $0}' src-tauri/src/llm/model.rs | sed -n '1,120p'
echo "== docs evidence docs mentioning fsync/model artifact =="
rg -n --hidden --glob '!target/**' --glob '!node_modules/**' \
'\bfsync\b|durable flush|flush|receipt|model artifact|installation integrity|race-safe|create_new|rename|VerifyInstall|VerifyLoad' docs src-tauri/src/llm src-tauri/src | sed -n '1,220p'Repository: ContextualWisdomLab/disksage
Length of output: 46622
VerifyInstall의 sync 용어를 분리하세요.
sync_evidence는 storage provider/item synchronization evidence를 뜻하지만, 모델 설치 단계는 provider sync가 아니라 모델 artifact 파일의 내구화/race-safe publication 검증 단계입니다. 의도가 파일 내구화라면 fsync 또는 durable flush로, race-safe publication이라면 해당 term으로 변경해 evidence 범위를 명확히 하세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/UML.md` around lines 100 - 113, Update the VerifyInstall label in the
Mermaid flowchart to replace the ambiguous “sync” term with terminology that
explicitly denotes artifact file durability, such as “fsync” or “durable flush,”
or race-safe publication if that is the intended evidence. Keep the installation
verification scope limited to exact size, SHA-256, and the clarified
artifact-level operation.
|
Implement the exact-current-head test-fixture repair on These six tests exercise local source-eviction approval, staging, control-path, interruption, idempotency, and changed-source behavior; they are not organization-tenant-governance tests. Existing Run Rust formatting, the six previously failing |
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/adr/0004-model-artifact-integrity.md (1)
36-50: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win모델 무결성 요구사항의 근거를 APA 7th 형식으로 기록하세요.
SHA-256, 파일 정체성 바인딩,
fsync, TOCTOU 방지 요구사항은 보안에 중요한 기술 주장입니다. ADR 또는 연결된 doctoring 기록에 현재의 1차 표준 및 기술 문서 인용을 추가하세요. 코딩 가이드라인에 따라 중요한 문서 주장은 권위 있는 근거와 APA 7th 인용을 기록해야 합니다.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/adr/0004-model-artifact-integrity.md` around lines 36 - 50, Update ADR 0004’s integrity requirements with APA 7th citations to authoritative primary standards and technical documentation supporting SHA-256, file identity binding, fsync durability, and TOCTOU prevention. Add the references in the ADR or a linked supporting record, and associate each security-critical claim with its relevant source.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/architectureDocumentation.test.ts`:
- Line 189: Update the documentation contract assertion around
architectureDocumentation.test.ts so it checks a string that exists in the
canonical docs/DOCUMENTATION_ASSESSMENT.md, or add the expected “API / IPC /
evidence contract” entry to that assessment document. Preserve the existing
file-existence assertion.
- Around line 220-224: Update docs/API_CONTRACT.md to explicitly document the
fail-closed tenant-authority contract: reject missing, stale, invalid, or
contradictory tenant-authority evidence, consistent with the organization tenant
authorization goal. Ensure the wording includes “15 minutes”, “organization”,
and “fail closed” so the assertions in architectureDocumentation.test.ts pass.
---
Outside diff comments:
In `@docs/adr/0004-model-artifact-integrity.md`:
- Around line 36-50: Update ADR 0004’s integrity requirements with APA 7th
citations to authoritative primary standards and technical documentation
supporting SHA-256, file identity binding, fsync durability, and TOCTOU
prevention. Add the references in the ADR or a linked supporting record, and
associate each security-critical claim with its relevant source.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: c7c92a79-1b85-4db8-9784-242d26da2628
📒 Files selected for processing (10)
docs/API_CONTRACT.mddocs/adr/0002-evidence-authorization-separation.mddocs/adr/0003-exact-head-repository-evidence.mddocs/adr/0004-model-artifact-integrity.mddocs/adr/0005-central-control-plane-boundary.mdsrc-tauri/src/cloud_eviction.rssrc-tauri/src/cloud_transfer.rssrc/lib/architectureDocumentation.test.tssrc/lib/cloudReviewQueue.authorization.test.tssrc/lib/cloudReviewQueue.ts
🚧 Files skipped from review as they are similar to previous changes (5)
- src/lib/cloudReviewQueue.authorization.test.ts
- docs/adr/0002-evidence-authorization-separation.md
- docs/adr/0003-exact-head-repository-evidence.md
- docs/adr/0005-central-control-plane-boundary.md
- docs/API_CONTRACT.md
|
Superseded after current-main convergence revalidation. Exact stale head |
|
@opencode-agent fix Continue the autonomous merge loop on the exact live state of PR #137. Refetch the current head SHA, current For every failed, missing, cancelled, skipped-required, queued-too-long, or stale check: perform RCA, identify the primary and at least one alternative hypothesis, define falsifying evidence, generate materially distinct remedies, apply the realism gate (authority, capability, exact target, effective outcome, policy, operational/scientific feasibility, reversibility, dependency order, verification), then execute the smallest safe Preserve these product contracts:
After each repair, rerun only the repository-supported exact-current-head mechanism and verify that the intended required job and step actually executed. Resolve only addressed current-head threads. Merge or enable auto-merge only when the live policy, independent approval, security gates, and all exact-head required checks are satisfied. Then immediately refetch the PR queue and continue. |
|
@coderabbitai review Review only the exact current head after all repair commits. Verify the buyer-visible behavior, read-only/privacy boundaries, logical-versus-verified physical reclaim wording, stable reason codes, bounded subprocess behavior, Rust/TypeScript contracts, real-world tests, 100% production coverage/docstrings, packaging, and absence of unrelated drift. Do not reuse predecessor-head reviews or checks. |
|
|
|
@opencode-agent address Continue the existing PR branch. Refetch exact current head/base, formal reviews, unresolved threads, commit statuses, workflow runs, security gates, and every required GitHub Check; fix all valid current-head defects directly and keep working while central prerequisites run. After central Do not open a competing PR, create temporary branch writers, synthesize approval, or bypass protection. Merge only after all exact-head checks pass, actionable threads are zero, and a qualifying non-author approval exists. |
2 participants
Summary
ContextualWisdomLab/.github, Naruon, contextual-orchestrator, and other CWL servicessrc/libandsrc/routeswith 100% statement, branch, function, and line thresholdsCanonical documentation graph
This PR now makes the product understandable without reconstructing chat history or feature PR bodies:
docs/PRD.mddocs/TRD.mdARCHITECTURE.mddocs/adr/README.mdand ADR-0001 through ADR-0005docs/UML.mddocs/DATA_MODEL.mdwith conceptual-versus-persisted status and ERDdocs/API_CONTRACT.mddocs/THREAT_MODEL.mddocs/TEST_STRATEGY.mddocs/OPERABILITY.mddocs/TRACEABILITY.mddocs/DOCUMENTATION_ASSESSMENT.mddocs/README.mdAGENTS.md,CLAUDE.md, andCHANGELOG.mdsrc/lib/architectureDocumentation.test.tsnow fails if the canonical document families or critical authority/data-model markers disappear. Active PR capabilities remain labeledactive_pr; the documentation does not promote #138-#142 or #133/#139/#140 to protected-main truth.Documentation assessment
Before this expansion, Architecture was comparatively strong but was being asked to substitute for PRD, TRD, ADR lifecycle, UML, ERD/data model, threat model, testing, operability, and traceability. README and detailed Superpowers/doctoring documents were useful feature evidence but not a discoverable canonical acquisition graph.
docs/DOCUMENTATION_ASSESSMENT.mdrecords that gap and the remaining rule: this documentation becomes protected-source authority only after this PR is integrated and exact-head gates pass.Standards evidence
The existing architecture/doctoring references retain current publisher-verified NIST SP 800-218 SSDF 1.1, NIST SP 800-53 Rev. 5 / Release 5.2.0 material, ISO/IEC 27001:2022 and Amendment 1:2024, ISO/IEC 27040:2024, OWASP ASVS 5.0.0, SLSA 1.2, WCAG 2.2, and ISO/IEC 40500:2025, with APA 7th references. Feature-specific primary evidence remains in the relevant doctoring records. Citations do not imply certification or blanket conformance.
Current exact-head gate
Current exact source head:
5097ce12ebc01ca00ca40e946cc15e17ae9aa0daIndependently rechecked protected
maintip:9bcb14ff9719029411591036b249537b22d2f3fd.Fresh exact-head workflow state after the documentation expansion:
31309562293: queued31309562270: queued31309562284: queued31309562294: pendingThe local container could not independently clone GitHub because its environment currently cannot resolve
github.com; therefore no local full-suite pass is claimed for this head. GitHub exact-head workflows remain authoritative.Merge only after the unchanged exact head satisfies all actual required Test/Release/security/SAST/coverage/packaging/provenance gates, no valid unresolved human/automated finding remains, qualifying independent non-author approval is present where required by live repository policy or explicit DiskSage/CWL governance, and branch protection/rulesets/repository policy pass without bypass. Pending, queued, cancelled, skipped-required, neutral-required, missing, failed, rate-limited, or stale-head evidence is not passing.
Summary by CodeRabbit