feat: surface privacy-safe Podman reclaim evidence

[seonghobae]

Purpose

Surface privacy-safe Podman reclaim evidence in the desktop without turning logical reclaim candidates into mutation authority or verified host-physical-reclaim claims. This remains the canonical Podman desktop evidence owner.

Exact current state

• exact source head: 0ceca3eb4d4299c689539290de1373cc45f233df
• live protected base: main@79067c1160ddedf7fc962cbf8067ce7e83c4564a
• fresh main -> head: ahead-only, 86 commits ahead / 0 behind, merge base exactly current main
• PR is Draft / mergeable before the Ready transition in this run
• exact Test 33142199026 — SUCCESS
• exact Security Scan 33142199003 — SUCCESS
• exact SAST Semgrep 33142198991 — SUCCESS
• exact Release 33142199001 — FAILURE in the shared release-artifact verifier dependency
• all current inline review threads are resolved
• formal reviews are COMMENTED/advisory only; no qualifying APPROVED review is claimed

Current repair

The destructive dangling-image confirmation field no longer exposes dangling_prune_approval_phrase as its input placeholder. The required phrase is shown outside the input and the input itself carries only generic guidance, preserving deliberate re-entry while retaining the existing exact phrase/rationale gate.

Podman prune failure feedback also remains privacy-safe but actionable: only exact production-owned stable codes receive bounded recovery guidance; unknown, path-bearing, socket-bearing, or otherwise dynamic text falls back to a non-reflecting generic message.

Product/security/accessibility boundary

• read-only desktop evidence does not grant prune/remove/machine lifecycle/VM deletion/TRIM/raw-image mutation authority
• configured capacity, raw logical bytes, host allocation, guest filesystem usage, Podman logical candidates, and physical reclaimability remain distinct
• physically_reclaimable_bytes remains unknown unless a future versioned before/after proof establishes it
• image, stopped-container, and volume review domains remain independent and conservative
• complete exact-image evidence requires exact image-record observation and candidate-set fingerprint
• machine names, paths, image IDs/tags, command output, account-local context, dynamic unsafe text, and malformed assessment fields cannot cross the desktop evidence schema
• loading/error/result states use accessible status/alert/live-region semantics

Dependency boundary

Release 33142199001 is not a Podman desktop source failure. The shared release artifact verifier remains canonically owned by #264. Do not add a Podman-local verifier workaround or duplicate verifier implementation.

Repository-wide exact owned-production coverage remains independently owned by Draft #156 and is materially below the required exact 100%. Feature-local Test/Security/SAST success does not substitute for that global gate.

Required before merge

Ready-for-review is not merge authorization. Merge only after one unchanged exact integration head satisfies the shared Release verifier, repository-wide exact non-vacuous 100% owned-production coverage, every applicable central required workflow, zero valid unresolved findings, fresh ancestry/mergeability, package/SBOM/provenance requirements, and the active ruleset's qualifying approval requirements. Pending, failed, stale, predecessor, synthetic, configuration-only, author-only, no-source, or dependency-bypassed evidence is non-passing.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a0159c4d-d6f8-4b0c-b52d-2fdd700a2a80

📥 Commits

Reviewing files that changed from the base of the PR and between cb3267f and 0568827.

📒 Files selected for processing (8)

• src-tauri/src/podman_desktop.rs
• src-tauri/tests/podman_desktop_branch_coverage.rs
• src-tauri/tests/podman_desktop_candidate_review_consistency.rs
• src-tauri/tests/podman_desktop_issue_privacy.rs
• src-tauri/tests/podman_desktop_physical_reclaim_claim.rs
• src/lib/PodmanEvidence.svelte
• src/lib/podmanEvidence.test.ts
• src/lib/podmanEvidence.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src-tauri/tests/podman_desktop_physical_reclaim_claim.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Podman reclaim 계획을 개인정보 보호형 증거 계약으로 투영합니다. 읽기 전용 Tauri 명령과 프런트엔드 검증을 추가합니다. 후보별 검토 경계를 강화하고, Cleanup 화면에 증거 조회와 승인된 dangling 이미지 정리를 통합합니다.

Changes

Podman 증거 조회

Layer / File(s)	Summary
증거 계약과 개인정보 제거 docs/architecture/podman-desktop-evidence.md, src-tauri/src/podman_desktop.rs, src-tauri/tests/*	PodmanReclaimPlan을 제한된 PodmanDesktopEvidence로 투영합니다. 경로와 식별자를 제거하고, fingerprint·레코드 수·완전성·후보별 검토 경계를 검증합니다.
Tauri 명령 경계 src-tauri/src/lib.rs, src-tauri/src/podman_desktop_bridge.rs, src-tauri/tests/*command*, src-tauri/tests/*regressions*	읽기 전용 inspect_podman_desktop_evidence 명령을 등록합니다. 공개 명령의 스키마와 비파괴 probe 조건을 검증합니다.
프런트엔드 증거 검증 src/lib/podmanEvidence.ts, src/lib/podmanEvidenceError.ts, src/lib/podmanEvidence*.test.ts, vitest.config.ts	Tauri 반환값을 검증하고 null 관측값, SHA-256 fingerprint, 상태와 오류 코드를 처리합니다. 오류 메시지와 커버리지 계약을 추가합니다.
Cleanup 화면 통합 src/lib/Cleanup.svelte, src/lib/PodmanEvidence.svelte, src/routes/+page.svelte, src/lib/*PrivacyContract.test.ts, src/lib/*CustomerCopyContract.test.ts	Podman 증거 조회를 화면에 표시합니다. 승인 문구와 사유를 확인한 뒤 dangling 이미지 정리를 실행하고 결과를 다시 조회합니다. 캐시와 개발 아티팩트 정리 흐름도 분리합니다.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🟡 Moderate · up to 05688

The PR adds a privacy-safe, read-only Podman evidence view, but the older desktop route can still expose sensitive machine and filesystem details, so the new privacy boundary is not exclusive. The image-cleanup confirmation also presents the approval phrase only as placeholder text, and parallel Podman views may drift. These bounded security and UX-safety risks require owner follow-up or explicit acceptance before merge.

Sequence Diagram(s)

sequenceDiagram
  participant Cleanup
  participant PodmanEvidence
  participant Tauri
  participant Podman
  Cleanup->>PodmanEvidence: load evidence
  PodmanEvidence->>Tauri: invoke inspect_podman_desktop_evidence
  Tauri->>Podman: run read-only probe
  Podman-->>Tauri: reclaim plan
  Tauri-->>PodmanEvidence: privacy-safe evidence
  PodmanEvidence-->>Cleanup: validated status and review labels
  Cleanup->>Tauri: execute approved dangling-image cleanup
  Tauri-->>Cleanup: cleanup result

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 96.72% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 61 functions across 18 files. (1 skipped: 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 개인정보 보호형 Podman reclaim evidence를 읽기 전용 경로로 노출하는 변경의 주요 목적을 정확하고 간결하게 설명합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 96.72% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 61 functions across 18 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/podman-desktop-evidence-v3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 53b7d53481f3375bd58013bc181ceb9b6971c07d.

• Head SHA: 53b7d53481f3375bd58013bc181ceb9b6971c07d

• Workflow run: 31357301155

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 3

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (18 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (18 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs: podman-desktop-evidence.md"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs: podman-desktop-evidence.md"]
  R2 --> V2["docs review"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 53b7d53481f3375bd58013bc181ceb9b6971c07d
• Workflow run: 31357301155
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 53b7d53481f3375bd58013bc181ceb9b6971c07d.

• Head SHA: 53b7d53481f3375bd58013bc181ceb9b6971c07d

• Workflow run: 31357301155

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 3

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (18 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (18 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs: podman-desktop-evidence.md"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs: podman-desktop-evidence.md"]
  R2 --> V2["docs review"]

Loading

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

📝 Info: Dead always-true assessment-status guard

assessmentStatus throws unless the value equals unverified, so the subsequent assessment_status === "unverified" test in parsePodmanDesktopEvidence is always true and its false branch is unreachable. No runtime effect.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

Supersession audit at exact heads:

• feat: surface privacy-safe Podman reclaim evidence #150: 6990d8d0064bc4f3ec9629576b65f70015f2093d
• feat: runtime-agnostic container orphan reclamation (docker/podman/colima) #267: 26339648cc848228ec38803568c491b40f8782fb
• feat: repair Podman storage before orphan reclaim #282: 1a16e041e84df9b5748a67594524a24f8fb316d5

#150 is not fully superseded, so I am leaving it open.

The current stack covers runtime-agnostic orphan audit/prune (#267) and Podman native storage repair/trim receipts (#282), but it does not contain #150's distinct read-only desktop contract:

1. a privacy-safe Podman capacity/candidate projection that keeps configured capacity, raw logical size, host allocation, guest usage, logical candidates, and verified physical reclaimability separate;
2. a dedicated IPC command returning that projection rather than the detailed PodmanReclaimPlan;
3. the PodmanEvidence customer consumer and its schema/privacy/contradiction tests.

CodeGraph confirms #150's consumer path is +page -> PodmanEvidence -> inspect_podman_desktop_evidence -> podman_desktop::inspect_podman_reclaim. At #282, commands::inspect_podman_reclaim still returns the detailed plan directly; #282's public wrapper is specific to storage-repair receipts. #267's container_orphan_public sanitizes the separate container-orphan contract and does not replace the VM/store capacity projection.

Exact integration gap before #150 could be closed: port the projection + dedicated IPC schema + customer consumer/contracts into the lowest active runtime-orphan stack (#267), then carry it normally into #282 and prove API/consumer parity. No Podman/container/volume mutation was performed during this audit.

[seonghobae]

Superseded by the lower active container-reclaim stack in #267 at exact head 392f07aea31ed4e74e9385497f36565944c0e448.

Parity evidence:

• the privacy-safe Rust projection, dedicated read-only IPC bridge, schema/documentation, candidate-consistency/privacy/physical-claim/branch/command tests, frontend parser/error mapping, and customer-copy/privacy contracts were ported;
• +page.svelte now consumes PodmanEvidence directly, while detailed internal reclaim-plan rendering was deliberately removed from the customer surface;
• configured capacity, raw logical allocation, host allocation, guest usage, store evidence, candidate evidence, and verified physical reclaim remain separate optional fields; incomplete or contradictory evidence remains unavailable/fail-closed and is never summed into an invented total;
• focused Rust tests passed, the full frontend suite passed (220 tests) with exact 100% statement/branch/function/line coverage, and Svelte check passed with 0 errors/0 warnings;
• the UI was inspected at 1280 px with the read-only next action and a 44 px minimum keyboard-focusable control.

The only #150-only frontend helper mapped internal recommended-action kinds for the old detailed plan surface; it has no independent consumer after that internal surface was removed, so it is intentionally not carried forward. PR #282 still points to the predecessor #267 base and must normally merge the latest #267 head to inherit this contract.