fix: comprehensive audit remediation (2026-08-05) — flaky tests, export validation, agent tool gating, storage pane - #236
Closed
appergb wants to merge 197 commits into
Closed
fix: comprehensive audit remediation (2026-08-05) — flaky tests, export validation, agent tool gating, storage pane#236appergb wants to merge 197 commits into
appergb wants to merge 197 commits into
Conversation
added 30 commits
July 29, 2026 16:01
added 28 commits
August 2, 2026 02:48
Consolidates the Beta-2 working-tree state (advanced AI workflows, security hardening, per-turn MCP binding, redaction, safe asset protocol, path policy, process tree, media catalog) with the audit remediation: - fmt: format media_bridge/project_root/codex (CI fmt gate was failing) - tests: harden 2 load-sensitive ffprobe tests (capture-limit + availability probe); remove dead ripple_delete test, add real validate_shifts coverage - CI: serialize Linux workspace tests (--test-threads=1), wire provisioner unit tests, frozen-lockfile web install - export: ffprobe-validate produced files (streams/codec/duration); fail closed on fontless text export - agent: gate smart_reframe behind VisionBridge capability (was advertised but always failing; ALL 39->38, KNOWN 54 unchanged) - media: log LibraryStore::remove cleanup failures; panic-free cache_key - core/web: wire project_saved event; add read-only generation_log command + Home generation activity UI (upstream semantic port) - web: real view/sort/filter in MediaPanel; i18n SaveAsProgress/AiEditTab; AiEdit heuristic disclosure; 24px AgentPanel close target - settings: new Storage pane (usage + guarded clear) - upstream StoragePane semantic port - docs: tool counts 44/54, secret whitelist, project deps, search model status, storage/project overviews
- dispatch-tools.md: ALL 38, add VISION constant, 13 advertised extensions - README.md: 44 compatible tools (was 45)
…nformationByHandle project_root.rs and home.rs used MetadataExt::volume_serial_number/file_index (std issue rust-lang/rust#63010, nightly-only) in their Windows identity branches — never compiled on macOS, broke all 4 Windows CI jobs with E0658. Mirror the proven safe_asset_protocol.rs pattern (BY_HANDLE_FILE_INFORMATION). Verified: opentake-project cargo check --target x86_64-pc-windows-msvc passes.
…test - safe_asset_protocol.rs: DRIVE_FIXED/DRIVE_REMOVABLE are not exported from Win32::Storage::FileSystem in windows-sys 0.61 (E0432) — define locally, matching safe_fs/windows.rs. - project_root.rs test: on Windows cap-std opens retained dir handles without FILE_SHARE_DELETE, so the namespace cannot be rebound while open (rename fails closed with sharing violation). Split the rebind test: Unix asserts stays-bound-after-rebind; Windows asserts the stronger fail-closed property (rename blocked while retained, works after drop).
- process_tree.rs: Job Object HANDLE is *mut c_void (not Send); codex/chat commands hold ProcessTree across await -> 9 E0277 errors on Windows only. Add justified unsafe impl Send (exclusive ownership, close-once). - codex.rs:11: std::process::Command test import is unix-only -> cfg(all(test, unix)) - fs_availability.rs: drop unused CloudFilters/FileSystem constants (bit masks are hardcoded with explicit values) - safe_asset_protocol.rs: parent-identity test helpers are non-Windows-only - home.rs: metadata fetch moved into the unix branch (unused on Windows)
- domain/media.rs to_manifest_entry: stripped project-relative path used the
host separator ('\' on Windows), rejected by path_policy -> 6 library test
failures. Normalize to forward slashes (bundle paths travel platforms);
add cfg(windows) regression test.
- fs_availability.rs: needless_return in Windows-only branch (clippy -D).
- codex.rs: run_agent_turn_with_executable is unix-test-only -> cfg(all(test, unix)).
The round-4 restructure renamed the cfg(not(macos)) param to ; on Linux the Windows-only usage is compiled out -> unused-variable warning -> clippy -D warnings failure. Keep the underscore name.
TestTurnGate and turn_context are only used by unix shell-script tests; after gating run_agent_turn_with_executable to unix they are dead on Windows test builds (clippy -D dead_code).
After gating TestTurnGate/turn_context to unix, AppCoreHandle/CoreHandle, ToolResult and AppCore imports are unused on Windows test builds.
…tability - ff.rs: availability-probe and cancellable-ffprobe tests asserted immediate pid death; SIGKILLed orphans linger as zombies until init reaps them, so kill -0 still succeeds under loaded CI (2 Linux failures). Poll with a bounded deadline, mirroring assert_capture_limit_kills_tree. Also relax the nonreturning_wait elapsed bound (2s->5s) — the deadline-fires assertion is unchanged. - Windows rebind tests (prepared_project_detects..., mcp inspect_project_media ..., safe_asset_protocol project_helper_rejects...) renamed bundles while retained handles were open — cap-std strips FILE_SHARE_DELETE so Windows fails those renames closed. Split each into cfg(unix) (original rebind assertion) + cfg(windows) (fail-closed rename-blocked assertion).
Only the cfg(unix) project_helper_rejects_an_ambient_bundle_replacement test uses it; on Windows test builds the cfg(test) import was unused.
… loaded CI) Two consecutive windows-product failures hit the two documented environment-flaky chromium tests (audit G): virtual_time_... Timeout(20s) at chromium.rs:80 and sandbox_progress_... render timed out after 90s. Both pass in the fresh-state dedicated steps minutes earlier, then time out inside the workspace sequence on a loaded runner. - chromium.rs test helper timeouts 20s -> 60s (timeout SEMANTICS are still asserted by the deliberate 500ms timeout test) - production motion sandbox deadline 90s -> 180s (complex renders on slow or loaded machines; still fail-closed)
cargo test --workspace stops at the first failing target, so security_config never ran on Windows CI until the motion-timeout fix let the workspace step reach it. The include_str!(lib.rs) assertion searched for '\n "opentake-asset",' but Windows git materializes CRLF (no .gitattributes) — normalize line endings before matching.
Owner
Author
|
Superseded by #237, which contains the final reviewed fixes, exact-SHA CI/release workflow, updated Windows logic contracts, and current v1.0.0-beta.2 verification evidence. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Comprehensive evidence-driven audit remediation batch produced from 8 module audits (domain/ops, persistence/media, render/playback/export, agent/gen, core/tauri, web, tests/CI/release, upstream comparison).
Local validation (all green)
Key fixes
Notes