feat(ops): macro load-smoke blocking PR gate (W43-B2, C08 L73) - #348
Conversation
…2, C08 L73) Add load-macro-gate SSOT, -RouteTier macro on load-smoke.ps1, hermetic SelfCheck, blocking load-macro-gate-hard.yml workflow, and cargo test wrapper. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
Warning Review limit reached
Next review available in: 50 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdds tiered macro-route load testing with policy-driven thresholds, PowerShell SelfCheck and smoke execution, local daemon seeding, documentation, a Rust wrapper test, and a blocking GitHub Actions workflow. ChangesLoad macro gate
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant GitHubActions
participant GateScript as load-macro-gate-check.ps1
participant Daemon as sl-daemon
participant LoadSmoke as load-smoke.ps1
PullRequest->>GitHubActions: Trigger hard gate
GitHubActions->>GateScript: Run -SelfCheck
GitHubActions->>GateScript: Run -RunSmoke
GateScript->>Daemon: Start and poll /readyz
GateScript->>Daemon: POST seeded bundle to /api/ingest
GateScript->>LoadSmoke: Run with RouteTier macro and policy thresholds
LoadSmoke->>Daemon: Send macro-route requests
GateScript->>Daemon: Stop daemon
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Co-authored-by: Cursor <cursoragent@cursor.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/load-macro-gate-hard.yml:
- Line 26: Update both actions/checkout steps in
.github/workflows/load-macro-gate-hard.yml at lines 26-26 and 36-36 by adding a
with block that sets persist-credentials to false.
- Line 5: Quote the top-level GitHub Actions trigger key by changing the visible
`on` mapping key to `"on"` in the workflow, preserving all existing trigger
configuration beneath it.
In `@docs/ops/load-macro-gate.json`:
- Around line 17-21: Make the load-macro policy fields effective: in
docs/ops/load-macro-gate.json lines 17-21 retain the configurable write_route
settings, update Invoke-MacroSeedIngest in scripts/load-macro-gate-check.ps1
lines 83-107 to use $policy.write_route.path and method, and guard the call at
lines 266-278 with $policy.write_route.seed_before_macro_tier. Ensure the
manifest and consumer behavior remain consistent.
- Line 33: Update the verify_command value in load-macro-gate.json to invoke the
script through pwsh, matching the documented command used in load-macro-gate.md
and runbook.md.
In `@scripts/load-macro-gate-check.ps1`:
- Line 57: Rename the Test-DocContains function to use a singular noun, such as
Test-DocContain, and update every reference to the function so callers remain
consistent.
- Around line 183-190: Update the policy validation near the route_tiers.macro
count check to verify that the macro tier contains /api/bundles, /api/search,
and /api/stream, not merely at least three entries. Keep the existing count
validation and Write-Check behavior, and ensure SelfCheck validates these
required routes from the JSON policy used by -RunSmoke.
In `@scripts/load-smoke.ps1`:
- Around line 66-75: Update the request logic in the load-smoke worker around
the Invoke-WebRequest call so /api/stream is not probed with Invoke-WebRequest.
Move that route to a separate bounded stream check or use another probe that
reliably limits connection/read duration under pwsh 7.6, while preserving the
existing request flow for non-stream endpoints.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 8766664c-0f59-4220-9ef8-fe9a09d67d18
📒 Files selected for processing (9)
.github/workflows/load-macro-gate-hard.ymlCHANGELOG.mddocs/ops/load-macro-gate.jsondocs/ops/load-macro-gate.mddocs/ops/runbook.mddocs/ops/test-pyramid.mdscripts/load-macro-gate-check.ps1scripts/load-smoke.ps1tests/load_macro_gate.rs
📜 Review details
⏰ Context from checks skipped due to timeout. (28)
- GitHub Check: gitleaks
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: load macro gate · macro routes smoke
- GitHub Check: soft loom · loom_model core
- GitHub Check: soft loom · daemon broadcast
- GitHub Check: update check hard · root SelfCheck wrapper
- GitHub Check: update check hard · sl-daemon tests
- GitHub Check: shuttle permutation · cargo test shuttle_permutation
- GitHub Check: coverage (85% gate)
- GitHub Check: reproducible build · sl-daemon
- GitHub Check: durable schema migration scaffold
- GitHub Check: loom permutation · hermetic wrappers
- GitHub Check: tsan permutation · race_model
- GitHub Check: rootless-only matrix scaffold
- GitHub Check: cargo audit
- GitHub Check: OpenAPI route drift · sl-daemon
- GitHub Check: SBOM policy SelfCheck
- GitHub Check: trufflehog
- GitHub Check: jemalloc hard · feature build
- GitHub Check: gitleaks
- GitHub Check: alloc profile hard · dhat smoke
- GitHub Check: fuzz blocking · sustained 30s
- GitHub Check: loom permutation · daemon broadcast
- GitHub Check: loom permutation · core models
- GitHub Check: miri permutation · SelfCheck
- GitHub Check: visual contract · WCAG AA
- GitHub Check: race smoke + channel/cancel model · windows-latest
- GitHub Check: sl-daemon build · windows-latest
🧰 Additional context used
📓 Path-based instructions (3)
*
📄 CodeRabbit inference engine (AGENTS.md)
*: Perform feature work in a git worktree under.claude/worktrees/, created fromorigin/mainon a branch named<type>/<topic>, rather than working directly onmain.
Do not make direct commits to protectedmain; use a pull request.
Do not usegit reset --hard,git stash, orgit cleanin worktrees.
Do not use--no-verifyor bypass hooks without operator approval.
Do not work on a branch or worktree another actor is using.
Files:
CHANGELOG.md
**/*.{rs,toml}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{rs,toml}: Use the Rust toolchain pinned inrust-toolchain.toml; the workspace MSRV is Rust 1.85.
Validate Rust workspace changes with the prescribed locked build, all-features test suite, Clippy, and rustfmt checks where applicable.
Files:
tests/load_macro_gate.rs
**/*.rs
📄 CodeRabbit inference engine (AGENTS.md)
Fix Clippy warnings; do not add
#[allow]unless it includes a tracking-issue comment.
Files:
tests/load_macro_gate.rs
🪛 LanguageTool
docs/ops/load-macro-gate.md
[uncategorized] ~12-~12: The official name of this software platform is spelled with a capital “H”.
Context: ...e.ps1](../../scripts/load-smoke.ps1), [.github/workflows/load-macro-gate-hard.yml`](.....
(GITHUB)
[uncategorized] ~13-~13: The official name of this software platform is spelled with a capital “H”.
Context: ...b/workflows/load-macro-gate-hard.yml),
[.github/workflows/ops-load.yml](../../.github/...
(GITHUB)
[uncategorized] ~71-~71: The official name of this software platform is spelled with a capital “H”.
Context: ...acro-gate-hard CI workflow | done | .github/workflows/load-macro-gate-hard.yml |
...
(GITHUB)
docs/ops/test-pyramid.md
[uncategorized] ~115-~115: The official name of this software platform is spelled with a capital “H”.
Context: ... macro routes (-RouteTier macro) |
| [.github/workflows/load-macro-gate-hard.yml](.....
(GITHUB)
[uncategorized] ~117-~117: The official name of this software platform is spelled with a capital “H”.
Context: ...macro gate docs + workflow anchors |
| [.github/workflows/ops-load.yml](../../.github/...
(GITHUB)
🪛 PSScriptAnalyzer (1.25.0)
scripts/load-smoke.ps1
[warning] Missing BOM encoding for non-ASCII encoded file 'load-smoke.ps1'
(PSUseBOMForUnicodeEncodedFile)
[warning] Missing BOM encoding for non-ASCII encoded file 'load-smoke.ps1'
(PSUseBOMForUnicodeEncodedFile)
[warning] Missing BOM encoding for non-ASCII encoded file 'load-smoke.ps1'
(PSUseBOMForUnicodeEncodedFile)
scripts/load-macro-gate-check.ps1
[warning] 57-57: The cmdlet 'Test-DocContains' uses a plural noun. A singular noun should be used instead.
Suggested fix: Singularized correction of 'Test-DocContains'
(PSUseSingularNouns)
🪛 YAMLlint (1.37.1)
.github/workflows/load-macro-gate-hard.yml
[error] 1-1: wrong new line character: expected \n
(new-lines)
[warning] 5-5: truthy value should be one of [false, true]
(truthy)
🪛 zizmor (1.26.1)
.github/workflows/load-macro-gate-hard.yml
[warning] 26-26: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 36-36: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[info] 37-37: action functionality is already included by the runner (superfluous-actions): use rustup and/or cargo in a script step
(superfluous-actions)
🔇 Additional comments (7)
tests/load_macro_gate.rs (1)
14-34: LGTM!CHANGELOG.md (1)
17-18: LGTM!docs/ops/load-macro-gate.json (1)
1-16: LGTM!Also applies to: 22-36
scripts/load-smoke.ps1 (1)
6-20: LGTM!Also applies to: 45-57
docs/ops/load-macro-gate.md (1)
1-84: LGTM!docs/ops/runbook.md (1)
112-120: LGTM!docs/ops/test-pyramid.md (1)
114-117: 📐 Maintainability & Code Quality | ⚡ Quick winConsider adding the new macro-gate artifacts to
test-pyramid-check.ps1's tracked paths.The pyramid SelfCheck's
layerPaths/anchor list (inscripts/test-pyramid-check.ps1, not touched by this PR) doesn't yet includescripts/load-macro-gate-check.ps1or.github/workflows/load-macro-gate-hard.yml, so this new "Load" tier documentation isn't machine-verified bytest-pyramid-check.ps1 -SelfCheckthe way the other rows are.
| # SelfCheck + live macro routes on ubuntu PRs; soft ops-load probe tier retained. | ||
| name: load-macro gate hard | ||
|
|
||
| on: |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
Quote the on keyword to prevent YAML parsing ambiguities.
In YAML 1.1, on evaluates to the boolean true. While GitHub Actions explicitly supports unquoted on:, quoting it as "on": complies with strict YAML parsing and resolves static analysis warnings.
♻️ Proposed refactor
-on:
+"on":📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| on: | |
| "on": |
🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 5-5: truthy value should be one of [false, true]
(truthy)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/load-macro-gate-hard.yml at line 5, Quote the top-level
GitHub Actions trigger key by changing the visible `on` mapping key to `"on"` in
the workflow, preserving all existing trigger configuration beneath it.
Source: Linters/SAST tools
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Disable credential persistence in checkout steps.
By default, actions/checkout persists the GITHUB_TOKEN in the repository's .git/config. Adding persist-credentials: false is a security best practice that prevents downstream scripts, build tools, or malicious dependencies from accessing or exfiltrating the token from the local git configuration.
.github/workflows/load-macro-gate-hard.yml#L26-L26: add awith:block containingpersist-credentials: falseto the checkout step..github/workflows/load-macro-gate-hard.yml#L36-L36: add awith:block containingpersist-credentials: falseto the checkout step.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 26-26: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 1 file
.github/workflows/load-macro-gate-hard.yml#L26-L26(this comment).github/workflows/load-macro-gate-hard.yml#L36-L36
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/load-macro-gate-hard.yml at line 26, Update both
actions/checkout steps in .github/workflows/load-macro-gate-hard.yml at lines
26-26 and 36-36 by adding a with block that sets persist-credentials to false.
Source: Linters/SAST tools
| "write_route": { | ||
| "method": "POST", | ||
| "path": "/api/ingest", | ||
| "seed_before_macro_tier": true | ||
| }, |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
write_route policy fields are declared in the JSON SSOT but never read by the consumer script. The manifest advertises method/path/seed_before_macro_tier as configurable, but the seeding call is fully hardcoded, so editing the JSON has no effect on this behavior.
docs/ops/load-macro-gate.json#L17-L21: either wire these fields through, or drop them if seeding is intentionally fixed/unconditional to avoid implying they're configurable.scripts/load-macro-gate-check.ps1#L83-L107:Invoke-MacroSeedIngestshould read$policy.write_route.path/methodinstead of hardcoding/api/ingest/Post, if the field is meant to be honored.scripts/load-macro-gate-check.ps1#L266-L278: the unconditional call toInvoke-MacroSeedIngestshould respect$policy.write_route.seed_before_macro_tierif that flag is meant to gate seeding.
📍 Affects 2 files
docs/ops/load-macro-gate.json#L17-L21(this comment)scripts/load-macro-gate-check.ps1#L83-L107scripts/load-macro-gate-check.ps1#L266-L278
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/ops/load-macro-gate.json` around lines 17 - 21, Make the load-macro
policy fields effective: in docs/ops/load-macro-gate.json lines 17-21 retain the
configurable write_route settings, update Invoke-MacroSeedIngest in
scripts/load-macro-gate-check.ps1 lines 83-107 to use $policy.write_route.path
and method, and guard the call at lines 266-278 with
$policy.write_route.seed_before_macro_tier. Ensure the manifest and consumer
behavior remain consistent.
| "load macro gate · SelfCheck", | ||
| "load macro gate · macro routes smoke" | ||
| ], | ||
| "verify_command": "./scripts/load-macro-gate-check.ps1 -SelfCheck", |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
verify_command is missing the pwsh prefix used elsewhere.
Every other reference (load-macro-gate.md, runbook.md) documents this as pwsh ./scripts/load-macro-gate-check.ps1 -SelfCheck. The bare ./scripts/... form here has no shebang backing it, so it won't run as-is from a POSIX shell.
📝 Proposed fix
- "verify_command": "./scripts/load-macro-gate-check.ps1 -SelfCheck",
+ "verify_command": "pwsh ./scripts/load-macro-gate-check.ps1 -SelfCheck",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "verify_command": "./scripts/load-macro-gate-check.ps1 -SelfCheck", | |
| "verify_command": "pwsh ./scripts/load-macro-gate-check.ps1 -SelfCheck", |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/ops/load-macro-gate.json` at line 33, Update the verify_command value in
load-macro-gate.json to invoke the script through pwsh, matching the documented
command used in load-macro-gate.md and runbook.md.
| return $Ok | ||
| } | ||
|
|
||
| function Test-DocContains { |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
Test-DocContains uses a plural noun; approved PowerShell verb-noun convention prefers singular.
Static analysis (PSScriptAnalyzer PSUseSingularNouns) flags this. Cosmetic, but cheap to fix before this becomes a public function name other scripts reference.
🧰 Tools
🪛 PSScriptAnalyzer (1.25.0)
[warning] 57-57: The cmdlet 'Test-DocContains' uses a plural noun. A singular noun should be used instead.
Suggested fix: Singularized correction of 'Test-DocContains'
(PSUseSingularNouns)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/load-macro-gate-check.ps1` at line 57, Rename the Test-DocContains
function to use a singular noun, such as Test-DocContain, and update every
reference to the function so callers remain consistent.
Source: Linters/SAST tools
| if ($policy.route_tiers.macro.Count -lt 3) { | ||
| throw "load-macro-gate.json must list at least three macro routes." | ||
| } | ||
| [void](Write-Check -Label "macro route tier count" -Ok $true) | ||
| if ($policy.pr_smoke.route_tier -ne "macro") { | ||
| throw "load-macro-gate.json pr_smoke.route_tier must be macro." | ||
| } | ||
| [void](Write-Check -Label "pr_smoke.route_tier macro" -Ok $true) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
Macro route count check doesn't verify the required routes.
This only asserts route_tiers.macro.Count -ge 3, not that /api/bundles, /api/search, /api/stream are actually the members. The specific route strings are checked against the .md doc (lines 165-170), not the JSON policy that -RunSmoke actually drives — so the policy could silently list unrelated routes and SelfCheck would still pass.
🛡️ Proposed tightening
- if ($policy.route_tiers.macro.Count -lt 3) {
- throw "load-macro-gate.json must list at least three macro routes."
- }
- [void](Write-Check -Label "macro route tier count" -Ok $true)
+ $requiredMacroRoutes = @("/api/bundles", "/api/search?limit=1", "/api/stream")
+ foreach ($route in $requiredMacroRoutes) {
+ if ($policy.route_tiers.macro -notcontains $route) {
+ throw "load-macro-gate.json route_tiers.macro must include '$route'."
+ }
+ }
+ [void](Write-Check -Label "macro route tier membership" -Ok $true)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if ($policy.route_tiers.macro.Count -lt 3) { | |
| throw "load-macro-gate.json must list at least three macro routes." | |
| } | |
| [void](Write-Check -Label "macro route tier count" -Ok $true) | |
| if ($policy.pr_smoke.route_tier -ne "macro") { | |
| throw "load-macro-gate.json pr_smoke.route_tier must be macro." | |
| } | |
| [void](Write-Check -Label "pr_smoke.route_tier macro" -Ok $true) | |
| $requiredMacroRoutes = @("/api/bundles", "/api/search?limit=1", "/api/stream") | |
| foreach ($route in $requiredMacroRoutes) { | |
| if ($policy.route_tiers.macro -notcontains $route) { | |
| throw "load-macro-gate.json route_tiers.macro must include '$route'." | |
| } | |
| } | |
| [void](Write-Check -Label "macro route tier membership" -Ok $true) | |
| if ($policy.pr_smoke.route_tier -ne "macro") { | |
| throw "load-macro-gate.json pr_smoke.route_tier must be macro." | |
| } | |
| [void](Write-Check -Label "pr_smoke.route_tier macro" -Ok $true) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/load-macro-gate-check.ps1` around lines 183 - 190, Update the policy
validation near the route_tiers.macro count check to verify that the macro tier
contains /api/bundles, /api/search, and /api/stream, not merely at least three
entries. Keep the existing count validation and Write-Check behavior, and ensure
SelfCheck validates these required routes from the JSON policy used by
-RunSmoke.
…-B2) Co-authored-by: Cursor <cursoragent@cursor.com>
Parallel SSE GETs hung CI; stream gets one 2s connect probe outside the pool. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(macos): add safe local app installer * fix(daemon): fail fast when HTTP bind is unavailable * fix(viewer): open inbox detail and make sessions keyboard accessible * fix(macos): make packaging scripts executable * feat(daemon): auto-discover native session roots * fix(viewer): make detail scroll region keyboard accessible * fix(ci): include make in hermetic allocator builder * feat(macos): add opt-in auto-discovery launch agent * docs(macos): print auto-discovery daemon command * docs(packaging): make auto-discovery the default * fix(ci): pin published hermetic builder digest * docs(reaudit): Wave-43-D closure (#362 merge) refresh at commit 41829e8 - SCORECARD.md: header refreshed (date/auditor/commit), Wave-43 Delta section added, Wave-41/42/43 line, Held (no score) expansion incl #348/#349/#361/#362, Remaining unpaid rewrite. - TRACEABILITY.json: updated 2026-07-21 -> 2026-07-23; commit d5f999f -> 41829e8; wave Wave-42 -> Wave-43; +delta_vs_w42 note. CRLF preserved. - GAP_QA_MATRIX.md: C00 row + PLAN-W8-B row updated. - CHANGELOG.md: Unreleased Changed entry for Wave-43-D reaudit. Score 396/402 (98% A) held conservative; WAVE43 impl lanes deepened residual evidence only (per WBS-8.3/8.5/8.7 pattern). --------- Co-authored-by: KooshaPari <koosha@example.com>
1 participant
Summary
Test plan
Wave-43 lane w43-load-macro-gate (B2 of 5).