docs(reaudit): Wave-44-D closure refresh (396/402 held) - #374
Conversation
…3c974f - SCORECARD.md: header refreshed (date=2026-07-24, auditor=Wave-44-D, commit=13c974f7); Wave-44 Delta section added (W44-B1 loom deepened C00 L7; W44-B6 corpus deepened C08 L73 20 -> 33 fixtures; PERT correction withdrawn R-5); Held (no score) line expanded with #368, #372, #373; Remaining unpaid rewritten to honestly name C04 L36 / C08 L76 / C11 L110 as the 3 unpaid pillars (6 raw pts). - TRACEABILITY.json: updated 2026-07-23 -> 2026-07-24; commit 41829e8 -> 13c974f; wave Wave-43 -> Wave-44; delta_vs_w42 -> delta_vs_w43. CRLF preserved. - GAP_QA_MATRIX.md: C00 row mentions #372 loom HTTP SSE soak; C08 row mentions #368 corpus breadth and L76 residual; PLAN-W8-B row updated with Wave-44 closure refs and Wave-45 candidate lanes. - CHANGELOG.md: Unreleased Changed entry for Wave-44-D reaudit. Score 396/402 (98% A) held conservative; 2 of 3 machine lanes shipped 2026-07-24 (W44-B1 #372, W44-B6 #368). PERT correction #373. Remaining 6 raw pts across C04 L36 (HUMAN 2FA), C08 L76 (Agent-Eval Pipeline), C11 L110 (Tray/Menubar Client) -- the 3 unpaid pillars the rubric actually scores below 3.
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
📝 WalkthroughSummaryDocumentation-only Wave-44-D reaudit updates covering scorecard evidence, traceability, QA gaps, and changelog entries. No Rust or public API changes. Safe to merge. Must FixNone identified. Should FixNone identified. ConsiderThe score remains conservatively held at 396/402, with six points attributed to C04 L36, C08 L76, and C11 L110. The remaining Windows allocator rollout is explicitly human-gated. Approve / Request ChangesApprove. WalkthroughWave-44 reaudit records were updated across the audit scorecard, changelog, QA matrix, and traceability JSON, covering refreshed evidence, corrected PERT scope, remaining points, closure status, and release metadata. ChangesWave-44 audit records
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@audit/SCORECARD.md`:
- Line 71: Correct the `#344` entry in the “Held (no score)” list to match the
Socket.dev supply-chain posture item and its C06 L33 mapping documented in
CHANGELOG.md, replacing the incorrect first-run corpus CTA attribution.
In `@docs/ops/GAP_QA_MATRIX.md`:
- Line 14: Synchronize the status_updated dates for all Wave-44-edited rows:
update C00 at docs/ops/GAP_QA_MATRIX.md lines 14-14, C08 at lines 22-22, and
PLAN-W8-B at lines 56-56 to 2026-07-24.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 29c60069-f1fa-46a4-8157-1c68beb0d85b
📒 Files selected for processing (4)
CHANGELOG.mdaudit/SCORECARD.mddocs/ops/GAP_QA_MATRIX.mddocs/ops/TRACEABILITY.json
📜 Review details
⏰ Context from checks skipped due to timeout. (38)
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: prepare
- GitHub Check: sl-daemon · repository builder image offline build / sl-daemon · repository builder image offline build
- GitHub Check: clean-host smoke · Windows unsigned portable install
- GitHub Check: coverage (85% gate)
- GitHub Check: pipeline perf-budget policy
- GitHub Check: rootless-only matrix policy
- GitHub Check: pipeline perf regression gate
- GitHub Check: fuzz blocking · sustained 30s
- GitHub Check: env.example hygiene
- GitHub Check: rootless-only matrix · SelfCheck
- GitHub Check: jemalloc default-on · windows default build
- GitHub Check: race smoke + channel/cancel model · windows-latest
- GitHub Check: load macro gate · macro routes smoke
- GitHub Check: visual contract · WCAG AA
- GitHub Check: jemalloc hard · feature build
- GitHub Check: tsan permutation · race_model
- GitHub Check: race smoke + channel/cancel model · ubuntu-latest
- GitHub Check: loom permutation · daemon broadcast
- GitHub Check: loom permutation · daemon shutdown
- GitHub Check: loom permutation · core models
- GitHub Check: loom permutation · daemon pipeline
- GitHub Check: daemon graph hard · tokio graph
- GitHub Check: soft loom · loom_model core
- GitHub Check: sl-viewer macOS app · artifact
- GitHub Check: sl-daemon build · windows-latest
- GitHub Check: alloc profile hard · dhat smoke
- GitHub Check: soft loom · daemon broadcast
- GitHub Check: exotic check · aarch64-unknown-linux-gnu
- GitHub Check: update check hard · root SelfCheck wrapper
- GitHub Check: browser e2e · axe · responsive · visual
- GitHub Check: session-ledger build · windows-latest
- GitHub Check: prepare
- GitHub Check: update check hard · sl-daemon tests
- GitHub Check: sl-viewer help · unit tests
- GitHub Check: Mergify Merge Protections
- GitHub Check: browser e2e · axe · responsive · visual
- GitHub Check: prepare
🧰 Additional context used
📓 Path-based instructions (1)
*
📄 CodeRabbit inference engine (AGENTS.md)
*: Perform feature work in a git worktree under.claude/worktrees/, created fromorigin/mainon a branch named<type>/<topic>, rather than working directly onmain.
Do not make direct commits to protectedmain; use a pull request.
Do not usegit reset --hard,git stash, orgit cleanin worktrees.
Do not use--no-verifyor bypass hooks without operator approval.
Do not work on a branch or worktree another actor is using.
Files:
CHANGELOG.md
🪛 LanguageTool
docs/ops/GAP_QA_MATRIX.md
[uncategorized] ~14-~14: The official name of this software platform is spelled with a capital “H”.
Context: ...tion-check.ps1; tests/loom_model.rs; .github/workflows/jemalloc-hard.yml; .github/...
(GITHUB)
[uncategorized] ~14-~14: The official name of this software platform is spelled with a capital “H”.
Context: ... .github/workflows/jemalloc-hard.yml; .github/workflows/alloc-profile-hard.yml; `scr...
(GITHUB)
[uncategorized] ~14-~14: The official name of this software platform is spelled with a capital “H”.
Context: ...ck.ps1; tests/alloc_profile_hard.rs; .github/workflows/loom-permutation.yml; scrip...
(GITHUB)
[uncategorized] ~15-~15: The official name of this software platform is spelled with a capital “H”.
Context: ...n-check.ps1; scripts/i18n-check.ps1; .github/workflows/ci.yml; .github/workflows/s...
(GITHUB)
[uncategorized] ~15-~15: The official name of this software platform is spelled with a capital “H”.
Context: ...check.ps1; .github/workflows/ci.yml; .github/workflows/security.yml` | Migrate viewe...
(GITHUB)
[uncategorized] ~16-~16: The official name of this software platform is spelled with a capital “H”.
Context: ...; scripts/envelope-crypto-check.ps1; .github/workflows/envelope-crypto.yml; docs/o...
(GITHUB)
[uncategorized] ~18-~18: The official name of this software platform is spelled with a capital “H”.
Context: ...e-check.ps1; tests/sbom_validate.rs; .github/workflows/security.yml; docs/ops/main...
(GITHUB)
[uncategorized] ~20-~20: The official name of this software platform is spelled with a capital “H”.
Context: ...ance.md; tests/source_provenance.rs; .github/workflows/reusable-hermetic-build.yml`;...
(GITHUB)
[uncategorized] ~20-~20: The official name of this software platform is spelled with a capital “H”.
Context: ...scripts/slsa-protected-env-check.ps1; .github/workflows/security.yml; `tests/slsa_pr...
(GITHUB)
[uncategorized] ~21-~21: The official name of this software platform is spelled with a capital “H”.
Context: ...est-pyramid.md; tests/properties.rs; .github/workflows/fuzz-blocking.yml; scripts/...
(GITHUB)
[uncategorized] ~21-~21: The official name of this software platform is spelled with a capital “H”.
Context: ...yml; scripts/fuzz-cadence-check.ps1; .github/workflows/bench-gate.yml` | Optional lo...
(GITHUB)
🔇 Additional comments (4)
audit/SCORECARD.md (2)
4-7: LGTM!
53-60: LGTM!CHANGELOG.md (1)
12-12: LGTM!docs/ops/TRACEABILITY.json (1)
3-3: LGTM!Also applies to: 15-17
| - **Wave-42 → Wave-43:** 98% A (396/402) → 98% A (396/402), held | ||
| - **Held (no score):** #340 bounded commit-signing header scan (C04 L34 already pillar max); #341 pinned CycloneDX + SBOM schema validation (C04 L32 residual unpaid); #342 SLSA protected-env blocking on PRs (C06 L53 residual attestation unpaid); #343 blocking alloc-profile / dhat hard gate (C00 L8 already pillar max); #344 first-run corpus CTA (C09 UX polish); #348 load-macro PR gate (C08 L73 production breadth residual); #349 default-on platform allocators (C00 L8 Windows parity residual); #361 sl-viewer CLI help expand (C01 L16 Fluent migration residual); #362 live tokio daemon-graph hard gate (C00 L7 HTTP SSE soak residual) | ||
| - **Remaining unpaid (post-WAVE43):** Authenticode/notarization live keys (C11 L112 residual), live brew/winget publish, human org 2FA attestation (C04 L36), live rootless-only runner matrix (C04 L40 residual), full protected-environment SLSA Build L3 attestation (C06 L53 residual), live branch-protection signed-commits attestation (C06 L59 residual), live Alertmanager webhooks, production Pyroscope profiling push, process-level HTTP SSE soak under loom (C00 L7 residual), Windows allocator parity + always-on production rollout (C00 L8 residual), in-tree KMS (C02 L22 residual), multi-tenant / auto-ETL PII redaction (C02 L24), viewer/CLI Fluent migration (C01 L16 residual), auto-install/rollback updater (C11 L111 residual), production-scale load corpus breadth (C08 L73 residual), phenotype-org-audits org mirror (403/403) | ||
| - **Held (no score):** #340 bounded commit-signing header scan (C04 L34 already pillar max); #341 pinned CycloneDX + SBOM schema validation (C04 L32 residual unpaid); #342 SLSA protected-env blocking on PRs (C06 L53 residual attestation unpaid); #343 blocking alloc-profile / dhat hard gate (C00 L8 already pillar max); #344 first-run corpus CTA (C09 UX polish); #348 load-macro PR gate (C08 L73 production breadth residual); #349 default-on platform allocators (C00 L8 Windows parity residual); #361 sl-viewer CLI help expand (C01 L16 Fluent migration residual); #362 live tokio daemon-graph hard gate (C00 L7 HTTP SSE soak residual); #372 loom HTTP SSE soak (W44-B1) — deepened C00 L7 (already pillar max); #368 OKF conformance 33 fixtures (W44-B6) — deepened C08 L73 (already pillar max); #373 WAVE44 PERT correction — R-5 withdrawn (C01 L16 closed Wave-38) |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Correct the #344 held-item mapping.
CHANGELOG.md Line [35] identifies #344 as the Socket.dev supply-chain posture item (C06 L33), but this line labels it as the first-run corpus CTA. Correct the issue number or description so the audit trail does not misattribute closure evidence.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@audit/SCORECARD.md` at line 71, Correct the `#344` entry in the “Held (no
score)” list to match the Socket.dev supply-chain posture item and its C06 L33
mapping documented in CHANGELOG.md, replacing the incorrect first-run corpus CTA
attribution.
| | ID | Current score / status | Gap | Acceptance test / evidence | Next action | status_updated | | ||
| |---|---|---|---|---|---| | ||
| | C00 | 30/30 · done | Blocking loom/shuttle/Miri/TSan permutation + jemalloc hard gate + blocking alloc-profile / dhat hard gate + partial daemon-graph loom ports + loom CI job split + live tokio daemon-graph hard gate (#362) + default-on platform allocators (#349) landed; process-level HTTP SSE soak under loom + Windows allocator parity + always-on production rollout remain | `audit/.lane-c00/C00.md`; `scripts/loom-permutation-check.ps1`; `tests/loom_model.rs`; `.github/workflows/jemalloc-hard.yml`; `.github/workflows/alloc-profile-hard.yml`; `scripts/alloc-profile-check.ps1`; `tests/alloc_profile_hard.rs`; `.github/workflows/loom-permutation.yml`; `scripts/jemalloc-check.ps1` | Promote default-on jemalloc; add full tokio sl-daemon broadcast/SSE graph ports | 2026-07-21 | | ||
| | C00 | 30/30 · done | Blocking loom/shuttle/Miri/TSan permutation + jemalloc hard gate + blocking alloc-profile / dhat hard gate + partial daemon-graph loom ports + loom CI job split + live tokio daemon-graph hard gate (#362) + default-on platform allocators (#349) + loom HTTP SSE soak (#372 W44-B1) landed; Windows allocator parity + always-on production rollout remain (HUMAN-gated canary) | `audit/.lane-c00/C00.md`; `scripts/loom-permutation-check.ps1`; `tests/loom_model.rs`; `.github/workflows/jemalloc-hard.yml`; `.github/workflows/alloc-profile-hard.yml`; `scripts/alloc-profile-check.ps1`; `tests/alloc_profile_hard.rs`; `.github/workflows/loom-permutation.yml`; `scripts/jemalloc-check.ps1` | Promote default-on jemalloc; add full tokio sl-daemon broadcast/SSE graph ports | 2026-07-21 | |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Synchronize status_updated for all Wave-44-edited rows.
The changed rows still carry older dates, while the Wave-44 audit records use 2026-07-24.
docs/ops/GAP_QA_MATRIX.md#L14-L14: set C00status_updatedto2026-07-24.docs/ops/GAP_QA_MATRIX.md#L22-L22: set C08status_updatedto2026-07-24.docs/ops/GAP_QA_MATRIX.md#L56-L56: set PLAN-W8-Bstatus_updatedto2026-07-24.
As per coding guidelines, agents changing a row must update status_updated in the same change.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~14-~14: The official name of this software platform is spelled with a capital “H”.
Context: ...tion-check.ps1; tests/loom_model.rs; .github/workflows/jemalloc-hard.yml; .github/...
(GITHUB)
[uncategorized] ~14-~14: The official name of this software platform is spelled with a capital “H”.
Context: ... .github/workflows/jemalloc-hard.yml; .github/workflows/alloc-profile-hard.yml; `scr...
(GITHUB)
[uncategorized] ~14-~14: The official name of this software platform is spelled with a capital “H”.
Context: ...ck.ps1; tests/alloc_profile_hard.rs; .github/workflows/loom-permutation.yml; scrip...
(GITHUB)
📍 Affects 1 file
docs/ops/GAP_QA_MATRIX.md#L14-L14(this comment)docs/ops/GAP_QA_MATRIX.md#L22-L22docs/ops/GAP_QA_MATRIX.md#L56-L56
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/ops/GAP_QA_MATRIX.md` at line 14, Synchronize the status_updated dates
for all Wave-44-edited rows: update C00 at docs/ops/GAP_QA_MATRIX.md lines
14-14, C08 at lines 22-22, and PLAN-W8-B at lines 56-56 to 2026-07-24.
Source: Coding guidelines
1 participant
Summary
Wave-44-D reaudit close-out following the merges of #368 (W44-B6 corpus),
#372 (W44-B1 loom HTTP SSE soak), and #373 (W44 PERT correction).
What changed
Total: 4 files, +28/-16 (CRLF-preserving surgical).
Score disposition
396/402 (98% A) held conservative. 2 of 3 machine lanes shipped 2026-07-24. PERT correction withdrew R-5 (C01 L16 closed Wave-38 #312). No fresh independent re-audit pillar lift; deepened evidence at pillar-max pillars (C00 L7, C08 L73).
Evidence chain
Honest remaining raw points
The audit rubric scores pillars 0-3. The actual unpaid pillars are:
Math: 30 - 3 + 3 + 2 + 1 = 33 deducted across clusters; total 402 - 6 = 396.
Predecessors
Refs: WAVE44_SCOPE.md, docs/ops/WAVE44_PERT.md, audit/.lane-c00/C00.md, audit/.lane-c04/C04.md, audit/.lane-c08/C08.md, audit/.lane-c11/C11.md.