audit: Wave-40 re-score (post #324-#328) - #329
Conversation
📝 WalkthroughSummaryThis PR performs a Wave-40 audit re-score, updating audit records and traceability documentation. The overall score increases from 394/402 to 396/402, with C11 improving from 41/45 to 43/45 based on update-check and signing-hard evidence. The changes are documentation-only and do not affect Rust code. Approve for merge. Must FixNone identified. Should FixNone identified. ConsiderCI remains pending; confirm it completes successfully before merging. Evidence for L79, L40, and L7 remains held without score changes. Approve / Request ChangesApprove WalkthroughWave-40 audit records add lane changelog entries, revise C11 auto-update and signing evidence, increase aggregate scores, and synchronize the scorecard, QA matrix, traceability JSON, and WBS documentation. ChangesWave-40 audit re-audit
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the project's audit documentation, scorecard, traceability matrix, and work breakdown structure (WBS) to reflect the completion of Wave-40 milestones, including updates to the packaging and distribution scores. The reviewer noted that docs/ops/eval-reproducibility.md and scripts/rootless-matrix-check.ps1 were incorrectly listed under the PLAN-P6 row in docs/ops/GAP_QA_MATRIX.md since they do not align with its focus on concurrency safety and performance, and provided a suggestion to remove them.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| | PLAN-P4 | partial | context-mode FTS recall and explicit TUI scope decision remain | `docs/DESIGN.md` §3, §7; recall E2E or accepted `na` decision | Human decides TUI; machine implements approved recall boundary | 2026-07-12 | | ||
| | PLAN-P6 | partial | Coverage, property (incl. lifecycle FSM), fuzz (blocking sustained cadence), loom-lite race_model, blocking loom/shuttle/Miri/TSan permutation, partial daemon-graph loom ports, enforced perf-budget, and enforced p95 latency gates landed; full tokio broadcast graph remains | `tests/properties.rs`; `fuzz/`; `.github/workflows/fuzz-blocking.yml`; `tests/loom_model.rs`; `.github/workflows/loom-permutation.yml`; `.github/workflows/bench-gate.yml`; `docs/ops/perf-baseline.json` | Add full tokio sl-daemon broadcast/SSE graph permutation in WBS-6.2 | 2026-07-18 | | ||
| | PLAN-W8-B | done | Wave-39 result is 394/402 (98% A), meeting the A threshold | Independent audit-v38 result is at least 362/402 and >=90% | Wave-40: human org gates + packaging/signing creds | 2026-07-18 | | ||
| | PLAN-P6 | partial | Coverage, property (incl. lifecycle FSM), fuzz (blocking sustained cadence), loom-lite race_model, blocking loom/shuttle/Miri/TSan permutation, partial daemon-graph + tokio broadcast loom ports, enforced perf-budget, and enforced p95 latency gates landed; full live tokio broadcast graph remains | `tests/properties.rs`; `fuzz/`; `.github/workflows/fuzz-blocking.yml`; `tests/loom_model.rs`; `.github/workflows/loom-permutation.yml`; `.github/workflows/bench-gate.yml`; `docs/ops/perf-baseline.json`; `docs/ops/eval-reproducibility.md`; `scripts/rootless-matrix-check.ps1` | Add full live tokio sl-daemon broadcast/SSE graph in WBS-6.2 | 2026-07-18 | |
There was a problem hiding this comment.
The evidence files docs/ops/eval-reproducibility.md and scripts/rootless-matrix-check.ps1 have been added to the PLAN-P6 row. However, PLAN-P6 is focused on concurrency safety, performance budgets, and fuzzing (WBS-6.2). These two files are unrelated to PLAN-P6's scope and instead belong to C08 (Eval Coverage) and C04 (Security) respectively. They should be removed from the evidence list for PLAN-P6 to keep the matrix accurate.
| | PLAN-P6 | partial | Coverage, property (incl. lifecycle FSM), fuzz (blocking sustained cadence), loom-lite race_model, blocking loom/shuttle/Miri/TSan permutation, partial daemon-graph + tokio broadcast loom ports, enforced perf-budget, and enforced p95 latency gates landed; full live tokio broadcast graph remains | `tests/properties.rs`; `fuzz/`; `.github/workflows/fuzz-blocking.yml`; `tests/loom_model.rs`; `.github/workflows/loom-permutation.yml`; `.github/workflows/bench-gate.yml`; `docs/ops/perf-baseline.json`; `docs/ops/eval-reproducibility.md`; `scripts/rootless-matrix-check.ps1` | Add full live tokio sl-daemon broadcast/SSE graph in WBS-6.2 | 2026-07-18 | | |
| | PLAN-P6 | partial | Coverage, property (incl. lifecycle FSM), fuzz (blocking sustained cadence), loom-lite race_model, blocking loom/shuttle/Miri/TSan permutation, partial daemon-graph + tokio broadcast loom ports, enforced perf-budget, and enforced p95 latency gates landed; full live tokio broadcast graph remains | `tests/properties.rs`; `fuzz/`; `.github/workflows/fuzz-blocking.yml`; `tests/loom_model.rs`; `.github/workflows/loom-permutation.yml`; `.github/workflows/bench-gate.yml`; `docs/ops/perf-baseline.json` | Add full live tokio sl-daemon broadcast/SSE graph in WBS-6.2 | 2026-07-18 | |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/ops/GAP_QA_MATRIX.md`:
- Around line 55-56: Correct the rootless-matrix traceability across all listed
records: in docs/ops/GAP_QA_MATRIX.md, remove scripts/rootless-matrix-check.ps1
and docs/ops/eval-reproducibility.md from PLAN-P6, add the script to C04 with
scaffold-reflecting gap text, and add the document to C08; in
audit/.lane-c04/C04.md, append scripts/rootless-matrix-check.ps1,
tests/rootless_matrix.rs, and .github/workflows/rootless-matrix.yml to the L40
evidence; in docs/ops/TRACEABILITY.json, propagate those WBS-8.60
rootless-matrix files into the C04 cluster evidence array.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: f7739c37-e2d6-4c50-a557-87e3323a33c6
📒 Files selected for processing (8)
audit/.lane-c00/C00.mdaudit/.lane-c04/C04.mdaudit/.lane-c08/C08.mdaudit/.lane-c11/C11.mdaudit/SCORECARD.mddocs/ops/GAP_QA_MATRIX.mddocs/ops/TRACEABILITY.jsondocs/ops/WBS.md
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: jemalloc hard · feature build
- GitHub Check: race smoke + channel/cancel model · windows-latest
- GitHub Check: fuzz blocking · sustained 30s
🧰 Additional context used
🪛 LanguageTool
docs/ops/WBS.md
[uncategorized] ~106-~106: The official name of this software platform is spelled with a capital “H”.
Context: ...e | docs/ops/eval-reproducibility.md; .github/workflows/signing-hard.yml; `docs/ops/...
(GITHUB)
docs/ops/GAP_QA_MATRIX.md
[uncategorized] ~25-~25: The official name of this software platform is spelled with a capital “H”.
Context: ....md; scripts/update-check-check.ps1; .github/workflows/update-check-hard.yml; .git...
(GITHUB)
[uncategorized] ~25-~25: The official name of this software platform is spelled with a capital “H”.
Context: ...ithub/workflows/update-check-hard.yml; .github/workflows/signing-hard.yml; tests/sig...
(GITHUB)
[uncategorized] ~25-~25: The official name of this software platform is spelled with a capital “H”.
Context: ...d.rs; docs/ops/signing-readiness.md; .github/workflows/release.yml` | Publish brew/w...
(GITHUB)
[uncategorized] ~55-~55: The official name of this software platform is spelled with a capital “H”.
Context: ...mains | tests/properties.rs; fuzz/; .github/workflows/fuzz-blocking.yml; `tests/lo...
(GITHUB)
[uncategorized] ~55-~55: The official name of this software platform is spelled with a capital “H”.
Context: ...z-blocking.yml; tests/loom_model.rs; .github/workflows/loom-permutation.yml; .gith...
(GITHUB)
[uncategorized] ~55-~55: The official name of this software platform is spelled with a capital “H”.
Context: ...github/workflows/loom-permutation.yml; .github/workflows/bench-gate.yml; docs/ops/pe...
(GITHUB)
audit/.lane-c11/C11.md
[uncategorized] ~53-~53: The official name of this software platform is spelled with a capital “H”.
Context: ...ate-check docs + CI anchors (#328) - .github/workflows/update-check-hard.yml — block...
(GITHUB)
[uncategorized] ~70-~70: The official name of this software platform is spelled with a capital “H”.
Context: ...ning-readiness anchors (#245/#326) - .github/workflows/signing-hard.yml — blocking P...
(GITHUB)
[uncategorized] ~72-~72: The official name of this software platform is spelled with a capital “H”.
Context: ... for signing-hard SelfCheck (#326) - .github/workflows/release.yml — `signing-readin...
(GITHUB)
[uncategorized] ~73-~73: The official name of this software platform is spelled with a capital “H”.
Context: ... job blocks Release publish (#326) - .github/workflows/release.yml — tagged Release ...
(GITHUB)
[uncategorized] ~74-~74: The official name of this software platform is spelled with a capital “H”.
Context: ...ort GitHub OIDC build attestations - .github/workflows/release.yml — best-effort key...
(GITHUB)
🪛 markdownlint-cli2 (0.23.0)
audit/.lane-c11/C11.md
[warning] 64-64: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
🔇 Additional comments (6)
audit/.lane-c08/C08.md (1)
152-152: LGTM!audit/.lane-c11/C11.md (1)
48-79: LGTM!Also applies to: 223-224
audit/SCORECARD.md (1)
6-7: LGTM!Also applies to: 26-47
docs/ops/GAP_QA_MATRIX.md (1)
25-25: LGTM!docs/ops/TRACEABILITY.json (1)
12-16: LGTM!Also applies to: 1290-1305
docs/ops/WBS.md (1)
106-107: LGTM!
| | PLAN-P6 | partial | Coverage, property (incl. lifecycle FSM), fuzz (blocking sustained cadence), loom-lite race_model, blocking loom/shuttle/Miri/TSan permutation, partial daemon-graph + tokio broadcast loom ports, enforced perf-budget, and enforced p95 latency gates landed; full live tokio broadcast graph remains | `tests/properties.rs`; `fuzz/`; `.github/workflows/fuzz-blocking.yml`; `tests/loom_model.rs`; `.github/workflows/loom-permutation.yml`; `.github/workflows/bench-gate.yml`; `docs/ops/perf-baseline.json`; `docs/ops/eval-reproducibility.md`; `scripts/rootless-matrix-check.ps1` | Add full live tokio sl-daemon broadcast/SSE graph in WBS-6.2 | 2026-07-18 | | ||
| | PLAN-W8-B | done | Wave-40 target is 396/402 (98% A); Wave-39 result 394/402 met the A threshold | Independent audit-v38 result is at least 362/402 and >=90% | Wave-41: human org gates + packaging/signing creds | 2026-07-18 | |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Misplaced and omitted rootless-matrix evidence across traceability records.
The Wave-40 rootless-only matrix scaffold evidence (PR #325) was incorrectly appended to the PLAN-P6 testing row and completely omitted from the C04 security records.
docs/ops/GAP_QA_MATRIX.md#L55-L56: Removescripts/rootless-matrix-check.ps1anddocs/ops/eval-reproducibility.mdfrom thePLAN-P6row's evidence. Add the rootless matrix script to theC04row's evidence and update its gap text to reflect the scaffold. Also add the eval-reproducibility document to theC08row's evidence.audit/.lane-c04/C04.md#L163-L163: Appendscripts/rootless-matrix-check.ps1,tests/rootless_matrix.rs, and.github/workflows/rootless-matrix.ymlto theL40evidence list above this changelog entry.docs/ops/TRACEABILITY.json#L956-L982: Propagate therootless-matrixfiles listed here inWBS-8.60into theC04cluster'sevidencearray.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~55-~55: The official name of this software platform is spelled with a capital “H”.
Context: ...mains | tests/properties.rs; fuzz/; .github/workflows/fuzz-blocking.yml; `tests/lo...
(GITHUB)
[uncategorized] ~55-~55: The official name of this software platform is spelled with a capital “H”.
Context: ...z-blocking.yml; tests/loom_model.rs; .github/workflows/loom-permutation.yml; .gith...
(GITHUB)
[uncategorized] ~55-~55: The official name of this software platform is spelled with a capital “H”.
Context: ...github/workflows/loom-permutation.yml; .github/workflows/bench-gate.yml; docs/ops/pe...
(GITHUB)
📍 Affects 3 files
docs/ops/GAP_QA_MATRIX.md#L55-L56(this comment)audit/.lane-c04/C04.md#L163-L163docs/ops/TRACEABILITY.json#L956-L982
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/ops/GAP_QA_MATRIX.md` around lines 55 - 56, Correct the rootless-matrix
traceability across all listed records: in docs/ops/GAP_QA_MATRIX.md, remove
scripts/rootless-matrix-check.ps1 and docs/ops/eval-reproducibility.md from
PLAN-P6, add the script to C04 with scaffold-reflecting gap text, and add the
document to C08; in audit/.lane-c04/C04.md, append
scripts/rootless-matrix-check.ps1, tests/rootless_matrix.rs, and
.github/workflows/rootless-matrix.yml to the L40 evidence; in
docs/ops/TRACEABILITY.json, propagate those WBS-8.60 rootless-matrix files into
the C04 cluster evidence array.
1 participant
Summary
Test plan
pwsh ./docs/ops/traceability_lint.ps1Audited main:
ec38d21