feat(af02): add deterministic surface scanner - #61
Conversation
|
Warning Review limit reachedNext included review available in 40 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
@coderabbitai review Please review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Checked-out commit and requested commit =='
git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' HEAD
printf '%s\n' '== Diff paths from main =='
git diff --name-status main...HEAD
printf '%s\n' '== Relevant tracked paths =='
fd -HI -t f . | rg '(^|/)(Cargo\.toml|Cargo\.lock|surface\.rs|surface-policy\.json|source-universe|finding|evidence)'
printf '%s\n' '== Rust manifest dependency declarations =='
rg -n -C 3 '(^|\s)(syn|serde_json)\s*=' --glob 'Cargo.toml' --glob 'Cargo.lock'
printf '%s\n' '== Scanner outline =='
scanner="$(fd -HI -t f '^surface\.rs$' | head -n 1)"
if [ -n "${scanner:-}" ]; then
printf 'scanner=%s\n' "$scanner"
ast-grep outline "$scanner" --items all --view expanded
fi
printf '%s\n' '== Evidence-like changed paths =='
git diff --name-only main...HEAD | rg -i '(source[-_]?universe|finding|evidence|surface-policy)' || trueLength of output: 2198 🏁 Script executed: #!/bin/bash
set -u
scanner='tools/af02-verifier/src/surface.rs'
printf '%s\n' '== Tool manifest =='
cat -n tools/af02-verifier/Cargo.toml
printf '%s\n' '== Locked syn packages =='
rg -n -C 2 'name = "syn"|version = "3\.0\.3"' tools/af02-verifier/Cargo.lock || true
printf '%s\n' '== Scanner symbols =='
ast-grep outline "$scanner" --items all --view expanded || true
printf '%s\n' '== Focused scanner terms =='
rg -n -C 5 \
'git|tracked|ls-files|discover|source.*universe|UseTree|glob|alias|METHOD_CALL|MethodCall|receiver|constructor|duplicate|identity|HashSet|BTreeSet|parse.*policy|duplicate.*key|serde_json|PATH_CALL|TYPE_CONSTRUCTOR|MACRO_TOKEN' \
"$scanner" || true
printf '%s\n' '== Scanner first section =='
sed -n '1,260p' "$scanner"
printf '%s\n' '== Scanner middle section =='
sed -n '261,620p' "$scanner"
printf '%s\n' '== Scanner final section =='
sed -n '621,1100p' "$scanner"
printf '%s\n' '== Scanner test outline and contents =='
ast-grep outline crates/commandf-pkg/tests/af02_surface_scanner.rs --items all --view expanded || true
cat -n crates/commandf-pkg/tests/af02_surface_scanner.rs
printf '%s\n' '== Scanner integration diff =='
git diff main...HEAD -- tools/af02-verifier/Cargo.toml tools/af02-verifier/src/lib.rs tools/af02-verifier/src/main.rs
printf '%s\n' '== Direct T013 boundary check =='
git diff --name-status main...HEAD -- \
specs/016-af-02-adversarial-test-strength/surface-policy.json \
specs/016-af-02-adversarial-test-strength \
':!specs/016-af-02-adversarial-test-strength/surface-policy.json' || true
git diff --name-only main...HEAD | rg -i '(source[-_]?universe|findings?|dependent.*evidence|evidence.*(json|md|yaml|yml))' || trueLength of output: 78874 🏁 Script executed: #!/bin/bash
set -u
printf '%s\n' '== Import collection and visitor lines =='
nl -ba tools/af02-verifier/src/surface.rs | sed -n '500,830p'
printf '%s\n' '== Alias and glob test coverage =='
rg -n -C 4 'alias|glob|use std::fs|use .* as ' \
tools/af02-verifier/src/surface.rs \
crates/commandf-pkg/tests/af02_surface_scanner.rs || true
printf '%s\n' '== Block-scoped use declarations in scanned roots =='
rg -n -U -P --glob '*.rs' \
'(?s)\bfn\b[^{}]*\{[^{}]*\buse\s+[^;]+;' \
crates tools || true
printf '%s\n' '== Canonical policy lineage and evidence fields =='
python3 - <<'PY'
import json
path = "specs/016-af-02-adversarial-test-strength/surface-policy.json"
with open(path, encoding="utf-8") as f:
policy = json.load(f)
print(json.dumps({
"source_roots": policy.get("source_roots"),
"scanner_tool_id": policy.get("scanner_tool_id"),
"lineage": policy.get("lineage"),
}, indent=2, sort_keys=True))
PY
printf '%s\n' '== Tests for duplicate finding identity and source discovery =='
rg -n -C 3 'duplicate finding|identit|discover_tracked|closed Rust|source_order|NonRegularSource|SourcePath' \
tools/af02-verifier/src/surface.rs \
crates/commandf-pkg/tests/af02_surface_scanner.rs || true
printf '%s\n' '== Commit diff stat and T013-like changed files =='
git diff --stat main...HEAD
git diff --name-only main...HEAD | rg -i '(universe|finding|evidence|t013|policy)' || trueLength of output: 24191
Finding
Confirmed checks
|
|
Please compute and report the exact identities of the canonical surface policy at merged main git rev-parse 'd7d75b46de4df3cf58023d6245712feddb338afb:specs/016-af-02-adversarial-test-strength/surface-policy.json'
git show 'd7d75b46de4df3cf58023d6245712feddb338afb:specs/016-af-02-adversarial-test-strength/surface-policy.json' | sha256sumReturn only the resolved Git blob SHA and SHA-256, and flag any command failure. This is for the dedicated policy-only REBASE lineage before T013. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -o pipefail
commit='d7d75b46de4df3cf58023d6245712feddb338afb'
path='specs/016-af-02-adversarial-test-strength/surface-policy.json'
if ! git rev-parse "${commit}:${path}"; then
printf 'COMMAND_FAILURE: git rev-parse\n' >&2
fi
if ! git show "${commit}:${path}" | sha256sum; then
printf 'COMMAND_FAILURE: git show | sha256sum\n' >&2
fiLength of output: 603
Git blob SHA: You are interacting with an AI system. |
|
On canonical merged main set -euo pipefail
git checkout --detach d7d75b46de4df3cf58023d6245712feddb338afb
cargo run --quiet --locked --manifest-path tools/af02-verifier/Cargo.toml -- scan-surface specs/016-af-02-adversarial-test-strength/surface-policy.json .Report:
Do not modify files. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
commit='d7d75b46de4df3cf58023d6245712feddb338afb'
policy='specs/016-af-02-adversarial-test-strength/surface-policy.json'
manifest='tools/af02-verifier/Cargo.toml'
scanner='tools/af02-verifier/src/surface.rs'
git cat-file -e "${commit}^{commit}"
printf 'commit=%s\n' "$(git rev-parse "${commit}^{commit}")"
for path in "$policy" "$manifest" "$scanner"; do
printf '%s blob=%s\n' "$path" "$(git rev-parse "${commit}:${path}")"
doneLength of output: 916
I still cannot run You are interacting with an AI system. |
1 participant
AF-02 Stack A0 — T012 scanner infrastructure
Canonical predecessor:
This replacement PR exists only because the connected GitHub GraphQL ready-for-review mutation is broken. It preserves the exact branch/head/tree and does not rewrite history.
This A0 infrastructure candidate implements T012 only. It does not alter
surface-policy.json, does not commit source-universe/finding evidence, and does not claim T013.T012 implementation
syn = 3.0.3withfullandvisit, matching the planning-frozensyn-af02-scanneridentity;tools/af02-verifier/src/surface.rsas the plannedSURFACE_SCANNER/SURFACE_POLICY_PARSERimplementation path;synand scan cfg-disabled/dead syntax without scanning comments or literal contents;usealiases deterministically and emit uncertain findings for relevant glob ambiguity;PATH_CALL,TYPE_CONSTRUCTOR,METHOD_CALL, andMACRO_TOKENmatching with exact identities;parse-surface-policyandscan-surfaceCLI entrypoints while leavingverify-prfail-closed.Temporal/lineage boundary
The canonical surface policy remains the earlier BOOTSTRAP policy. This candidate intentionally does not rebase that policy and does not carry dependent source-universe/finding evidence.
dependent_evidence_allowed_in_same_candidateremains false. A dedicated policy-only REBASE is required before T013 dependent evidence.Qualification boundary
All CI/review evidence for this replacement must be fresh in this PR context and tied to exact head
2fbbae7055aa963878148aaf742c2c5e5b446ed0. No result from superseded PR #59 is inherited as qualification evidence.Summary by cubic
Implements the T012 deterministic surface scanner with new
parse-surface-policyandscan-surfaceCLI entrypoints. Scans Git-tracked Rust sources undercrates/andtools/usingsyn3.0.3, resolving imports and matching boundary categories without changing the existing surface policy.New Features
usealiases, emitting definite or uncertain findings based on glob ambiguity.syn's version and checksum and runs both entrypoints.Context
Written for commit 2fbbae7. Summary will update on new commits.