fix(sccm): canonicalize client intake fixture contracts - #344
Conversation
|
Warning Review limit reached
Next review available in: 3 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (11)
📝 WalkthroughWalkthroughSCCM client intake fixtures and documentation now use the synthetic site code ChangesSCCM fixture contract
Estimated code review effort: 2 (Simple) | ~15 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Comment |
|
@coderabbitai full review Please review exact head |
|
✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 20 minutes. |
There was a problem hiding this comment.
Pull request overview
Aligns the synthetic SCCM client-intake fixture corpus (issue #319 prep assets) with documented ConfigMgr conventions, and adds a regression/contract test to prevent the fixture contract from drifting again.
Changes:
- Canonicalizes synthetic site codes to a valid 3-character value (
LAB) across the six client-intake manifests and related fixture content/docs. - Normalizes the standard
.lo_rollover identity (e.g.,AppEnforce.lo_) and updates manifest provenance/path fields accordingly. - Adds a committed Rust contract test that validates site-code format,
.lo_identity, path resolution to a real fixture file, andbytesCopiedintegrity.
Reviewed changes
Copilot reviewed 9 out of 11 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| docs/sccm/preparation/issue-319-client-intake.md | Updates the preparation/spec text and examples to reflect valid site-code and rotation naming contracts. |
| crates/cmtraceopen-parser/tests/sccm_client_intake_fixture_contract.rs | Adds a focused contract test enforcing site-code format, canonical .lo_ rollover naming, fixture presence, and byte-count integrity. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/README.md | Updates fixture privacy/identifier contract documentation to use the canonical synthetic site code. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/rotations/manifest.json | Updates bundle siteCode and canonicalizes the .lo_ rollover artifact’s basename and paths. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/missing-root/manifest.json | Updates bundle siteCode to the canonical 3-character value. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/complete/manifest.json | Updates bundle siteCode and refreshes bytesCopied to match the updated evidence payload. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/collision/manifest.json | Updates bundle siteCode to the canonical 3-character value. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/capped/manifest.json | Updates bundle siteCode to the canonical 3-character value. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/access-denied/manifest.json | Updates bundle siteCode to the canonical 3-character value. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/complete/evidence/client-location-services-shared/current/LocationServices.log | Updates synthetic coverage marker text to reflect the canonical site code. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/rotations/evidence/client-app-enforce/lo/AppEnforce.lo_ | Adds the canonical .lo_ rollover evidence fixture file used by the contract test. |
adamgell
left a comment
adamgell
left a comment
There was a problem hiding this comment.
Independent exact-head review: PASS
No actionable findings at 390733fdb6a81499847992053cfebbd3f7042c73 against base 262a18dedff5934868ed2f89d82795c412935733.
Reviewed against issue #319 and Tasks 1–2 of the client-intake plan, including the official Microsoft contracts for replacement-extension .lo_ rollover and three-character alphanumeric, non-reserved site codes.
Verified:
- exactly six committed intake scenarios; all manifests and expected files are valid and mutually consistent
- every site code is synthetic
LAB, matches^[A-Z0-9]{3}$, and is not a Microsoft-reserved value - the standard rollover is physically renamed to
AppEnforce.lo_; the oldAppEnforce.log.lo_path is absent; manifest basename, relative path, sanitized provenance, physical file, and 176-byte count agree - all captured/capped evidence paths resolve within their scenario;
bytesCopied, limits, artifact IDs, and expected provenance agree; no unreferenced evidence remains - capped evidence is an exact 128-byte incomplete prefix with the expected SHA-256 and cannot form a terminal finding
- collision candidates retain distinct IDs/fingerprints/paths; missing-root and access-denied remain coverage/request states only
- fixtures are synthetic/sanitized and the docs explicitly make this preparation-only, with native Windows/live acceptance still open
- the Rust contract test is cross-platform (
Path::join, no Windows I/O or platform-only dependency)
Fresh verification:
- focused contract: 2 passed
- exact-byte corpus validator: PASS
- full parser: 594 passed (349 unit + 222 ESP + 2 client-intake + 21 SCCM)
- strict parser Clippy: PASS
- wasm32 parser check: PASS
npx tsc --noEmit: PASS- Rust 1.88 formatting, JSON parse, residual
CONTOSO/.log.lo_scan, andgit diff --check: PASS
CodeRabbit remains a separate required gate: its exact-range attempt is currently rate-limited, so this human PASS does not treat the bot status as approval. Issue #319 should remain open for production intake/native manifest work and real Windows validation.
adamgell
left a comment
adamgell
left a comment
There was a problem hiding this comment.
Correction: prior PASS retracted
My earlier review at exact head 390733fdb6a81499847992053cfebbd3f7042c73 scoped the residual scan too narrowly. This head has two blockers:
-
The issue #319 execution-contract plan remains noncanonical:
docs/superpowers/plans/2026-07-30-sccm-client-intake-and-core.md:22still names invalid six-character site codeCONTOSO.- lines 220 and 365 still prescribe
AppEnforce.log.lo_instead of replacement-extensionAppEnforce.lo_.
This contradicts the corrected fixtures and leaves the plan contract capable of reintroducing the defect.
-
The new exact on-disk byte assertion is not cross-platform.
.gitattributesprotects onlysrc-tauri/tests/fixtures/**;crates/cmtraceopen-parser/tests/fixtures/**has no byte-preserving attribute. A simulated Git-for-Windows checkout withcore.autocrlf=truechangesAppEnforce.lo_from 176 bytes to 177 bytes, so the 176-byte manifest/test contract fails for checkout normalization rather than content. Add an appropriate-textrule for the byte-sensitive parser SCCM fixture tree.
Evidence:
git check-attr -areturns no attribute for the fixture.git -c core.autocrlf=true checkout-index ...produced a 177-byte checkout from the 176-byte index fixture.- the residual plan scan returns the three lines above.
The earlier macOS test results remain accurate but do not prove the requested cross-platform contract. Please treat this exact head as blocked; CodeRabbit's rate-limited response is also still not approval.
|
Correction update: exact head is now The execution-plan residual scan is clean: invalid This PR is deliberately held behind #345, which adds the shared parser-fixture |
5cfde4e to
2edee99
Compare
|
Rebased cleanly onto byte-stable parser-family base Fresh post-rebase verification: focused client-intake 2/2; exact-byte corpus validator PASS; full parser 595/595; strict Clippy; wasm32; All reviews attached to the pre-rebase SHA are stale by design. Fresh independent exact-head review is pending/active. @coderabbitai review Review exact head |
|
I will treat all pre-rebase reviews as stale, assess the committed contract test and manifest/path/byte integrity, and will not infer native Windows acceptance or approval from skipped/rate-limited status. ✅ Action performedReview finished.
|
2edee99 to
6f1a0af
Compare
|
Final base refresh: rebased onto current parser-family @coderabbitai review Review exact head |
|
✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 33 minutes. |
adamgell
left a comment
adamgell
left a comment
There was a problem hiding this comment.
Independent exact-head review: PASS
No actionable findings at 6f1a0af5dead462efcc6393f3d1fe507a27b3409 against base 690cb32240a86001fdc4c3acc58e63638814d20e.
Verified:
- exactly six intake scenarios; every manifest pins the synthetic site code
LAB, retainsproposalOnly/syntheticFixture, and has matching expected JSON - standard rollback is physically renamed to
AppEnforce.lo_; manifest basename, relative path, sanitized provenance, physical file, and 176-byte index/worktree length agree; stale.log.lo_is absent - inherited
crates/cmtraceopen-parser/tests/fixtures/** -textmakes byte-sensitive fixture assertions portable - all captured/capped paths are relative, remain inside their scenario, resolve to committed files, include the synthetic marker, and match
bytesCopied; no unreferenced evidence remains - collision artifacts preserve distinct IDs, fingerprints, relative paths, and physical evidence; rotation order remains current,
.lo_, numbered.2 - access-denied, missing-root, and capped sources remain explicit coverage/request states rather than success/failure proof; the 128-byte capped prefix and SHA-256 remain exact and cannot parse as a complete CCM record
- the client README and #319 preparation document retain additive SCCM-only proposal boundaries, safe provenance, deterministic ordering, and no native/live acceptance claim
- the execution plan has no residual
CONTOSO,AppEnforce.log.lo_, or generic.log.lo_example in the corrected client scope - PR body has no closing keyword; issue #319 remains open for production/native work
Fresh verification:
- focused client-intake contract: 2/2 passed
- exact-byte corpus validator: PASS
- full parser: 595/595 (349 unit + 222 ESP + 2 client-intake + 1 server-intake + 21 SCCM)
- strict parser Clippy: PASS
- wasm32 parser check: PASS
npx tsc --noEmit: PASS- owned Rust 1.88 formatting and
git diff --check: PASS
CodeRabbit remains a separate unmet gate, not part of this PASS: exact-head GitHub status says Review rate limited, and the local exact-range CLI attempt also returned rate_limit (32 minutes). Older incremental/rate-limited responses are not substantive approval. Do not merge until CodeRabbit reviews this exact range or an explicitly accepted equivalent gate is recorded. No native Windows acceptance is inferred.
6f1a0af to
26697a4
Compare
|
Current-base refresh: PR #344 is restacked without patch drift onto merged shared interface Fresh gates: focused 2/2; exact 6-scenario/18-physical-file validator with no orphans and exact 128-byte capped digest; full parser 616/616; strict Clippy; wasm32; TypeScript; owned rustfmt; diff check — all green. @coderabbitai review Review exact head |
|
I’ll treat all earlier-SHA review results as stale and assess the six ✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 5 minutes. |
|
Final current-base refresh: PR #344 is restacked without patch drift onto Fresh gates: focused 2/2; exact 6-scenario/18-file validator with no orphans and exact capped digest; full parser 624/624; strict Clippy; wasm32; TypeScript; owned rustfmt; diff check — all green. @coderabbitai review Review exact head |
26697a4 to
64c9744
Compare
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="781fb9c6acb32a60dfa0073953b98e08417fa6c6"
head="64c9744da51d0c842d3a32635b2ed2c80bb45bfc"
printf '%s\n' '== Commit availability =='
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
printf '%s\n' '== Changed paths =='
git diff --name-status "$base" "$head"
printf '%s\n' '== Diff summary =='
git diff --stat "$base" "$head"
printf '%s\n' '== Relevant changed-text matches =='
git diff --unified=40 "$base" "$head" -- \
| rg -n -C 4 'LAB|CONTOSO|AppEnforce\.(log\.lo_|lo_)|native|Windows|capped|collision|orphan|manifest|site.?code' \
|| true
printf '%s\n' '== Changed source/text files (outline, where supported) =='
git diff --name-only --diff-filter=ACMR "$base" "$head" \
| rg '\.(rs|ts|tsx|js|jsx|json|yaml|yml|md|toml)$' \
| while IFS= read -r file; do
echo "-- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
doneLength of output: 57916 🏁 Script executed: #!/bin/bash
set -euo pipefail
test_file="crates/cmtraceopen-parser/tests/sccm_client_intake_fixture_contract.rs"
fixture_root="crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake"
printf '%s\n' '== Complete contract test =='
cat -n "$test_file"
printf '%s\n' '== Static manifest/evidence integrity check =='
python3 - <<'PY'
import hashlib
import json
from pathlib import Path, PurePosixPath
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake")
scenarios = ("complete", "rotations", "collision", "missing-root", "access-denied", "capped")
declared = set()
errors = []
for scenario in scenarios:
scenario_root = root / scenario
manifest_path = scenario_root / "manifest.json"
manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
site_code = manifest.get("bundle", {}).get("siteCode")
print(f"{scenario}: siteCode={site_code!r}, artifacts={len(manifest.get('artifacts', []))}")
if site_code != "LAB":
errors.append(f"{scenario}: expected siteCode LAB, got {site_code!r}")
for artifact in manifest.get("artifacts", []):
artifact_id = artifact.get("artifactId", "<missing>")
relative_path = artifact.get("relativePath")
bytes_copied = artifact.get("bytesCopied")
state = artifact.get("captureState")
if relative_path is None:
if bytes_copied != 0:
errors.append(f"{scenario}/{artifact_id}: null path has bytesCopied={bytes_copied}")
continue
posix = PurePosixPath(relative_path)
if posix.is_absolute() or ".." in posix.parts or posix.parts[:1] != ("evidence",):
errors.append(f"{scenario}/{artifact_id}: unsafe/non-evidence relativePath {relative_path!r}")
continue
full_path = scenario_root / Path(*posix.parts)
key = full_path.resolve()
if key in declared:
errors.append(f"{scenario}/{artifact_id}: duplicate evidence declaration {relative_path}")
declared.add(key)
if not full_path.is_file():
errors.append(f"{scenario}/{artifact_id}: declared evidence missing: {relative_path}")
continue
actual = full_path.stat().st_size
if actual != bytes_copied:
errors.append(
f"{scenario}/{artifact_id}: bytesCopied={bytes_copied}, actual={actual}: {relative_path}"
)
if artifact_id == "fixture-rotations-app-enforce-root-a-lo":
expected = "AppEnforce.lo_"
for field in ("originalBasename", "relativePath", "sanitizedSourcePath"):
value = artifact.get(field)
if not isinstance(value, str) or not value.endswith(expected):
errors.append(f"{scenario}/{artifact_id}: {field} not canonical: {value!r}")
if state == "capped":
digest = hashlib.sha256(full_path.read_bytes()).hexdigest()
print(f" capped {relative_path}: bytes={actual}, sha256={digest}")
if actual != 128:
errors.append(f"{scenario}/{artifact_id}: capped file is {actual} bytes, expected 128")
if digest != "3253f6c4bc7d74bd2dbdadbe2f6543ff61a57161f85f650869b1292556270114":
errors.append(f"{scenario}/{artifact_id}: unexpected capped digest {digest}")
actual_evidence = {path.resolve() for path in root.glob("*/evidence/**/*") if path.is_file()}
orphans = sorted(actual_evidence - declared)
missing = sorted(declared - actual_evidence)
print(f"declared evidence files={len(declared)}; physical evidence files={len(actual_evidence)}")
for path in orphans:
errors.append(f"orphan evidence: {path.relative_to(root.resolve())}")
for path in missing:
errors.append(f"declared path not found by evidence scan: {path.relative_to(root.resolve())}")
if errors:
print("FAIL")
print("\n".join(f"- {error}" for error in errors))
raise SystemExit(1)
print("PASS")
PY
printf '%s\n' '== Residual invalid examples in changed review scope =='
rg -n -i -C 2 'CONTOSO|AppEnforce\.log\.lo_' \
crates/cmtraceopen-parser/tests/fixtures/sccm/client \
docs/sccm/preparation/issue-319-client-intake.md \
docs/superpowers/plans/2026-07-30-sccm-client-intake-and-core.md \
|| trueLength of output: 27852
The independent static corpus check otherwise passed: all six manifests currently use ✅ Action performedFull review finished. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/cmtraceopen-parser/tests/sccm_client_intake_fixture_contract.rs`:
- Around line 64-71: Update the site code validation in the manifest contract
test to require siteCode exactly equals "LAB" for every scenario, replacing the
current three-character uppercase alphanumeric check while preserving the
existing failure reporting.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: bff92dcc-5ae8-47db-99c2-0a18451e1deb
⛔ Files ignored due to path filters (1)
crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/complete/evidence/client-location-services-shared/current/LocationServices.logis excluded by!**/*.log
📒 Files selected for processing (11)
crates/cmtraceopen-parser/tests/fixtures/sccm/client/README.mdcrates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/access-denied/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/capped/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/collision/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/complete/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/missing-root/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/rotations/evidence/client-app-enforce/lo/AppEnforce.lo_crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/rotations/manifest.jsoncrates/cmtraceopen-parser/tests/sccm_client_intake_fixture_contract.rsdocs/sccm/preparation/issue-319-client-intake.mddocs/superpowers/plans/2026-07-30-sccm-client-intake-and-core.md
adamgell
left a comment
adamgell
left a comment
There was a problem hiding this comment.
Exact-head independent review: BLOCKED
Reviewed 64c9744da51d0c842d3a32635b2ed2c80bb45bfc against exact base 781fb9c6acb32a60dfa0073953b98e08417fa6c6. The committed corpus is currently coherent, but four regression-contract gaps leave the stated exact invariants unprotected.
Actionable blockers
-
Line 64 — pin the exact site code, not only its shape. The current
^[A-Z0-9]{3}$logic acceptsABC; it does not enforce the stated six-manifest canonical valueLAB. CodeRabbit independently identified this same gap in exact-head comment 5136711179. Add an exact-value assertion (and preferably an adversarial valid-but-wrong mutation) for every scenario. -
Lines 94–108 — pin both full rollover paths.
ends_with("/AppEnforce.lo_")accepts alternate layout/provenance values. For example,SYNTHETIC://different-root/AppEnforce.lo_passes without any other change; a paired physical-file move letsevidence/other/AppEnforce.lo_pass. Assert exact equality to:evidence/client-app-enforce/lo/AppEnforce.lo_SYNTHETIC://root-a/CCM/Logs/AppEnforce.lo_
Add adversarial same-suffix mutations proving both fail closed.
-
Lines 79–129 — require exact-one rollover cardinality and literal 176-byte identity.
.find(...)silently validates only the first.lo_; appending a second.lo_leaves the test green. Filter allrotation.kind == "lo"entries and fail unless there is exactly one, with a duplicate adversarial mutation. The current byte check only compares manifest value to physical length, so coordinated drift is accepted; pinbytesCopied == actual == 176. -
Lines 12–26 — pin the capped fixture’s exact bytes/SHA. The test checks length, a prefix, one marker, and parser shape, but never the committed SHA-256 or complete 128-byte payload. A one-byte message mutation (
coverage→coveragf) retains all current text predicates while changing the digest from3253f6c4…to7320968f…. Assert the complete expected bytes or verify SHA-2563253f6c4bc7d74bd2dbdadbe2f6543ff61a57161f85f650869b1292556270114, then keep the incomplete-CCM parser assertions.
What independently passed
- Both restacked commits map identically (
=) from the prior stack. - Current corpus validator: 6 scenarios, all 6 manifests presently
LAB, 18 declared/physical evidence files, no missing files or orphans. - Canonical physical rollover currently has the exact basename/full paths, 176-byte size, and byte-identical pre/post-rename Git blob
e34f04d74b9cd22f38121392fa270b142afdfcd8(SHA-2569f3315789657fe70d0a35e241f0c6e2dda12cc2ee792a993c8073d8294761cd5). - Collision preserves two distinct roots, IDs, fingerprints, paths, and contents. Rotation ordering is current/lo/numbered-2. Missing-root remains 11 absent coverage entries. Access-denied remains policy-agent denied plus separately captured policy-state. Capped remains a 128-byte incomplete prefix with the expected current SHA and no terminal diagnosis.
- Additive proposal markers and expected
proposedPending318state remain intact; residualCONTOSO/AppEnforce.log.lo_plan examples are corrected. - No production/native source, Cargo dependency, live-Windows acceptance claim, issue-family overlap, secret, or closing keyword was introduced.
Fresh exact-head gates
- Focused client-intake contract: 2/2 passed
- Independent exact validator: PASS (6 scenarios, 18 files, no orphans, exact current rollover/cap identities and scenario semantics)
- Full parser: 624/624 passed (351 + 222 + 3 + 2 + 1 + 5 + 40)
- Strict parser Clippy, wasm32 check,
npx tsc --noEmit, Rust 1.88/current owned rustfmt,git diff --check, privacy, scope/no-overlap, no-native-production, secret, and no-closing-keyword checks: passed - Exact-head worktree remained clean
CodeRabbit’s response is substantive and exact-head, not skipped/rate-limited/incremental; it confirms current corpus integrity and identifies blocker 1. The additional three gaps above come from independent adversarial inspection. No merge is authorized until all four contracts fail closed and a fresh exact-head review is completed.
|
@coderabbitai full review Please perform a fresh substantive exact-head review of |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="781fb9c6acb32a60dfa0073953b98e08417fa6c6"
head="4f91993115524bfbd3f296145f1f8e7e2bb547dc"
test_file="crates/cmtraceopen-parser/tests/sccm_client_intake_fixture_contract.rs"
fixture_root="crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake"
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
printf '\n== Exact range ==\n'
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
printf '\n== Exact diff ==\n'
git diff --find-renames --find-copies --unified=80 "$base" "$head" -- \
"$test_file" \
"$fixture_root" \
"crates/cmtraceopen-parser/tests/fixtures/sccm/client/README.md" \
"docs/sccm/preparation/issue-319-client-intake.md" \
"docs/superpowers/plans/2026-07-30-sccm-client-intake-and-core.md"
printf '\n== Contract test outline and contents ==\n'
ast-grep outline "$test_file" --items all
cat -n "$test_file"
printf '\n== Independent manifest/evidence contract validation ==\n'
python3 - <<'PY'
import hashlib
import json
from pathlib import Path, PurePosixPath
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake")
scenarios = ("complete", "rotations", "collision", "missing-root", "access-denied", "capped")
errors = []
declared_paths = set()
for scenario in scenarios:
scenario_root = root / scenario
manifest = json.loads((scenario_root / "manifest.json").read_text(encoding="utf-8"))
artifacts = manifest.get("artifacts", [])
site_code = manifest.get("bundle", {}).get("siteCode")
print(f"{scenario}: siteCode={site_code!r}; artifacts={len(artifacts)}")
if site_code != "LAB":
errors.append(f"{scenario}: bundle.siteCode must equal 'LAB', got {site_code!r}")
lo_artifacts = [
artifact for artifact in artifacts
if artifact.get("rotation") == "lo"
or artifact.get("rotationKind") == "lo"
or artifact.get("originalBasename") == "AppEnforce.lo_"
]
if scenario == "rotations":
if len(lo_artifacts) != 1:
errors.append(f"rotations: expected exactly one .lo_ artifact, got {len(lo_artifacts)}")
else:
artifact = lo_artifacts[0]
expected_path = "evidence/client-app-enforce/lo/AppEnforce.lo_"
expected_provenance_suffix = "/AppEnforce.lo_"
for field, expected in (
("originalBasename", "AppEnforce.lo_"),
("relativePath", expected_path),
):
if artifact.get(field) != expected:
errors.append(f"rotations/{artifact.get('artifactId')}: {field}={artifact.get(field)!r}, expected {expected!r}")
source = artifact.get("sanitizedSourcePath")
if not isinstance(source, str) or not source.endswith(expected_provenance_suffix):
errors.append(f"rotations/{artifact.get('artifactId')}: sanitizedSourcePath={source!r} must end with {expected_provenance_suffix!r}")
for artifact in artifacts:
artifact_id = artifact.get("artifactId", "<missing>")
relative_path = artifact.get("relativePath")
copied = artifact.get("bytesCopied")
if relative_path is None:
if copied != 0:
errors.append(f"{scenario}/{artifact_id}: missing relativePath has bytesCopied={copied!r}")
continue
posix_path = PurePosixPath(relative_path)
if posix_path.is_absolute() or ".." in posix_path.parts or posix_path.parts[:1] != ("evidence",):
errors.append(f"{scenario}/{artifact_id}: unsafe relativePath {relative_path!r}")
continue
path = scenario_root.joinpath(*posix_path.parts)
declared_paths.add(path.resolve())
if not path.is_file():
errors.append(f"{scenario}/{artifact_id}: missing physical file {relative_path!r}")
continue
actual = path.stat().st_size
if copied != actual:
errors.append(f"{scenario}/{artifact_id}: bytesCopied={copied!r}, physical={actual} for {relative_path!r}")
if scenario == "rotations" and artifact.get("originalBasename") == "AppEnforce.lo_":
print(f" rollover: bytes={actual}; sha256={hashlib.sha256(path.read_bytes()).hexdigest()}")
if actual != 176:
errors.append(f"rotations/{artifact_id}: rollover must be exactly 176 bytes, got {actual}")
if artifact.get("captureState") == "capped":
digest = hashlib.sha256(path.read_bytes()).hexdigest()
print(f" capped: path={relative_path}; bytes={actual}; sha256={digest}")
if actual != 128:
errors.append(f"{scenario}/{artifact_id}: capped payload must be exactly 128 bytes, got {actual}")
expected_digest = "3253f6c4bc7d74bd2dbdadbe2f6543ff61a57161f85f650869b1292556270114"
if digest != expected_digest:
errors.append(f"{scenario}/{artifact_id}: capped SHA-256={digest}, expected {expected_digest}")
physical_paths = {path.resolve() for path in root.glob("*/evidence/**/*") if path.is_file()}
for path in sorted(physical_paths - declared_paths):
errors.append(f"orphan evidence file: {path.relative_to(root.resolve())}")
for path in sorted(declared_paths - physical_paths):
errors.append(f"declared non-evidence path: {path.relative_to(root.resolve())}")
print(f"declared={len(declared_paths)} physical={len(physical_paths)}")
if errors:
print("FAIL")
print("\n".join(f"- {e}" for e in errors))
raise SystemExit(1)
print("PASS")
PY
printf '\n== Residual noncanonical identifiers and forbidden-scope claims in reviewed files ==\n'
rg -n -i -C 2 'CONTOSO|AppEnforce\.log\.lo_|native (intake|acceptance)|Windows[- ]acceptance|reader|reducer' \
"$test_file" \
"$fixture_root" \
"crates/cmtraceopen-parser/tests/fixtures/sccm/client/README.md" \
"docs/sccm/preparation/issue-319-client-intake.md" \
"docs/superpowers/plans/2026-07-30-sccm-client-intake-and-core.md" \
|| trueLength of output: 112937
Verified in the committed contract test and independently against the fixture corpus:
I did not independently execute the reported Rust/TypeScript/Clippy/wasm test commands in this static-inspection sandbox, but the committed coverage and corpus integrity checks are consistent with the reported green results. ✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 12 minutes. |
Independent corrected-head review: PASSNo actionable findings at exact head All four prior regression blockers are closed:
Independent corpus validation also found 6 scenarios, 30 artifact records, 18 declared/physical evidence files, and zero missing files or orphans. Index/worktree Git blobs agree for the capped and rollover fixtures, and inherited Fresh verification at this exact head:
Count correction: the current aggregate is 625 tests (not the earlier stated 626): 351 unit + 222 ESP + 3 health + 3 client-intake + 1 server-intake + 5 site-core + 40 spine. CodeRabbit is in the completed loop: its original exact-range The range changes only synthetic fixtures, fixture tests, and preparation/plan documentation. It adds no production reader, native collection, parser kind, dependency, or live-Windows acceptance claim. The PR body has no closing keyword; #319 remains open for production/native implementation and eventual Windows acceptance. Review only; I did not merge. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="781fb9c6acb32a60dfa0073953b98e08417fa6c6"
head="4f91993115524bfbd3f296145f1f8e7e2bb547dc"
test_file="crates/cmtraceopen-parser/tests/sccm_client_intake_fixture_contract.rs"
fixture_root="crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake"
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
printf '%s\n' '== Exact range: changed files =='
git diff --name-status "$base" "$head"
printf '%s\n' '== Exact range: whitespace =='
git diff --check "$base" "$head"
printf '%s\n' '== Contract-test outline and source =='
ast-grep outline "$test_file" --items all
cat -n "$test_file"
printf '%s\n' '== Relevant exact diff =='
git diff --find-renames --unified=25 "$base" "$head" -- \
"$test_file" "$fixture_root" \
crates/cmtraceopen-parser/tests/fixtures/sccm/client/README.md \
docs/sccm/preparation/issue-319-client-intake.md \
docs/superpowers/plans/2026-07-30-sccm-client-intake-and-core.md
printf '%s\n' '== Independent fixture-corpus validation =='
python3 - <<'PY'
import hashlib
import json
from pathlib import Path, PurePosixPath
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake")
scenarios = ("complete", "rotations", "collision", "missing-root", "access-denied", "capped")
expected_rollover_path = "evidence/client-app-enforce/lo/AppEnforce.lo_"
expected_provenance = "SYNTHETIC://root-a/CCM/Logs/AppEnforce.lo_"
expected_capped = bytes([
60,33,91,76,79,71,91,83,78,84,72,69,84,73,67,93,76,79,71,93,60,47,33,62,60,116,105,109,101,32,100,
97,116,101,61,34,48,49,45,48,49,45,50,48,50,54,34,32,116,105,109,101,61,34,48,48,58,48,48,58,48,
48,46,48,48,48,43,48,48,48,34,32,99,111,109,112,111,110,101,110,116,61,34,67,97,112,112,101,100,
34,32,99,111,110,116,101,120,116,61,34,83,89,78,84,72,69,84,73,67,34,32,116,121,112,101,61,34,50,
34,32,116,104,114,101,97,100,61,34,49,34,32,102,105,108,101,61,34,99,97,112,112,101,100,46,108,111,
103,34,62,60,47,116,105,109,101,62
])
errors, declared = [], set()
for scenario in scenarios:
scenario_root = root / scenario
manifest = json.loads((scenario_root / "manifest.json").read_text(encoding="utf-8"))
artifacts = manifest.get("artifacts", [])
if manifest.get("bundle", {}).get("siteCode") != "LAB":
errors.append(f"{scenario}: bundle.siteCode is not literal LAB")
lo = [a for a in artifacts if a.get("rotation", {}).get("kind") == "lo"]
if scenario == "rotations":
if len(lo) != 1:
errors.append(f"rotations: expected exactly one rotation.kind=lo, got {len(lo)}")
else:
artifact = lo[0]
for field, expected in (
("originalBasename", "AppEnforce.lo_"),
("relativePath", expected_rollover_path),
("sanitizedSourcePath", expected_provenance),
):
if artifact.get(field) != expected:
errors.append(f"rotations: {field} is {artifact.get(field)!r}, expected {expected!r}")
for artifact in artifacts:
artifact_id = artifact.get("artifactId", "<missing>")
relative_path = artifact.get("relativePath")
copied = artifact.get("bytesCopied")
if relative_path is None:
if copied != 0:
errors.append(f"{scenario}/{artifact_id}: null relativePath has bytesCopied={copied!r}")
continue
posix = PurePosixPath(relative_path)
if posix.is_absolute() or ".." in posix.parts or posix.parts[:1] != ("evidence",):
errors.append(f"{scenario}/{artifact_id}: unsafe evidence path {relative_path!r}")
continue
path = scenario_root.joinpath(*posix.parts)
declared.add(path.resolve())
if not path.is_file():
errors.append(f"{scenario}/{artifact_id}: declared file missing: {relative_path}")
continue
data = path.read_bytes()
if len(data) != copied:
errors.append(f"{scenario}/{artifact_id}: bytesCopied={copied}, actual={len(data)}")
if scenario == "rotations" and artifact.get("rotation", {}).get("kind") == "lo" and len(data) != 176:
errors.append(f"{scenario}/{artifact_id}: rollover length is {len(data)}, expected 176")
if artifact.get("captureState") == "capped":
if data != expected_capped:
errors.append(f"{scenario}/{artifact_id}: capped payload differs from literal expected bytes")
if len(data) != 128:
errors.append(f"{scenario}/{artifact_id}: capped length is {len(data)}, expected 128")
print(f"capped SHA-256: {hashlib.sha256(data).hexdigest()}")
physical = {p.resolve() for p in root.glob("*/evidence/**/*") if p.is_file()}
if physical - declared:
errors.extend(f"orphan: {p.relative_to(root.resolve())}" for p in sorted(physical - declared))
if declared - physical:
errors.extend(f"not in evidence scan: {p.relative_to(root.resolve())}" for p in sorted(declared - physical))
print(f"scenarios={len(scenarios)} records={sum(len(json.loads((root / s / 'manifest.json').read_text())['artifacts']) for s in scenarios)} declared={len(declared)} physical={len(physical)}")
if errors:
print("FAIL")
print("\n".join(f"- {error}" for error in errors))
raise SystemExit(1)
print("PASS")
PY
printf '%s\n' '== Noncanonical identifiers and out-of-scope claims =='
rg -n -i -C 2 'CONTOSO|AppEnforce\.log\.lo_|native (intake|acceptance)|Windows[- ]acceptance|production (reader|intake)|\breader\b|\breducer\b' \
"$test_file" "$fixture_root" \
crates/cmtraceopen-parser/tests/fixtures/sccm/client/README.md \
docs/sccm/preparation/issue-319-client-intake.md \
docs/superpowers/plans/2026-07-30-sccm-client-intake-and-core.md \
|| trueLength of output: 71916 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="781fb9c6acb32a60dfa0073953b98e08417fa6c6"
head="4f91993115524bfbd3f296145f1f8e7e2bb547dc"
test_file="crates/cmtraceopen-parser/tests/sccm_client_intake_fixture_contract.rs"
fixture_root="crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake"
printf '%s\n' '== Decode committed capped literal and compare fixture bytes =='
python3 - <<'PY'
import ast
import hashlib
import re
from pathlib import Path
test = Path("crates/cmtraceopen-parser/tests/sccm_client_intake_fixture_contract.rs").read_text(encoding="utf-8")
fixture = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/capped/evidence/client-content/current/DataTransferService.log").read_bytes()
match = re.search(r'const EXPECTED_CAPPED_CONTENT: &\[u8\] = (b"(?:[^"\\\\]|\\\\.)*");', test)
if not match:
raise SystemExit("FAIL: could not locate EXPECTED_CAPPED_CONTENT byte literal")
expected = ast.literal_eval(match.group(1))
if not isinstance(expected, bytes):
raise SystemExit("FAIL: decoded expected literal is not bytes")
print(f"expected length={len(expected)} actual length={len(fixture)}")
print(f"expected SHA-256={hashlib.sha256(expected).hexdigest()}")
print(f"actual SHA-256={hashlib.sha256(fixture).hexdigest()}")
if fixture != expected:
raise SystemExit("FAIL: committed expected byte literal and capped fixture differ")
if len(fixture) != 128:
raise SystemExit(f"FAIL: capped fixture has {len(fixture)} bytes, expected 128")
print("PASS")
PY
printf '%s\n' '== Full corrected static corpus integrity =='
python3 - <<'PY'
import json
from pathlib import Path, PurePosixPath
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake")
scenarios = ("complete", "rotations", "collision", "missing-root", "access-denied", "capped")
errors, declared = [], set()
for scenario in scenarios:
sr = root / scenario
m = json.loads((sr / "manifest.json").read_text(encoding="utf-8"))
if m["bundle"].get("siteCode") != "LAB":
errors.append(f"{scenario}: siteCode is not LAB")
lo = [a for a in m["artifacts"] if a.get("rotation", {}).get("kind") == "lo"]
if scenario == "rotations":
if len(lo) != 1:
errors.append(f"rotations: expected one lo artifact, got {len(lo)}")
elif (lo[0].get("originalBasename"), lo[0].get("relativePath"), lo[0].get("sanitizedSourcePath")) != (
"AppEnforce.lo_",
"evidence/client-app-enforce/lo/AppEnforce.lo_",
"SYNTHETIC://root-a/CCM/Logs/AppEnforce.lo_",
):
errors.append("rotations: noncanonical rollover contract")
for a in m["artifacts"]:
p = a.get("relativePath")
if p is None:
if a.get("bytesCopied") != 0:
errors.append(f"{scenario}/{a.get('artifactId')}: null path has nonzero bytes")
continue
q = PurePosixPath(p)
if q.is_absolute() or ".." in q.parts or q.parts[:1] != ("evidence",):
errors.append(f"{scenario}/{a.get('artifactId')}: unsafe path {p!r}")
continue
f = sr.joinpath(*q.parts)
declared.add(f.resolve())
if not f.is_file():
errors.append(f"{scenario}/{a.get('artifactId')}: missing file {p}")
elif f.stat().st_size != a.get("bytesCopied"):
errors.append(f"{scenario}/{a.get('artifactId')}: byte count mismatch")
elif scenario == "rotations" and a.get("rotation", {}).get("kind") == "lo" and f.stat().st_size != 176:
errors.append("rotations: rollover is not 176 bytes")
physical = {p.resolve() for p in root.glob("*/evidence/**/*") if p.is_file()}
errors += [f"orphan: {p.relative_to(root.resolve())}" for p in sorted(physical - declared)]
errors += [f"undeclared: {p.relative_to(root.resolve())}" for p in sorted(declared - physical)]
print(f"scenarios={len(scenarios)} artifacts={sum(len(json.loads((root/s/'manifest.json').read_text())['artifacts']) for s in scenarios)} declared={len(declared)} physical={len(physical)}")
if errors:
print("FAIL\n" + "\n".join(errors)); raise SystemExit(1)
print("PASS")
PY
printf '%s\n' '== Exact-head Git blob identity for byte-sensitive fixtures =='
for file in \
crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/capped/evidence/client-content/current/DataTransferService.log \
crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/rotations/evidence/client-app-enforce/lo/AppEnforce.lo_
do
printf '%s: ' "$file"
git rev-parse "${head}:${file}"
git hash-object "$file"
done
printf '%s\n' '== Residual invalid identifiers and prohibited implementation claims =='
rg -n -i -C 2 'CONTOSO|AppEnforce\.log\.lo_|production (reader|intake)|native (intake|acceptance)|Windows[- ]acceptance' \
"$test_file" "$fixture_root" \
crates/cmtraceopen-parser/tests/fixtures/sccm/client/README.md \
docs/sccm/preparation/issue-319-client-intake.md \
docs/superpowers/plans/2026-07-30-sccm-client-intake-and-core.md \
|| trueLength of output: 5411 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="4f91993115524bfbd3f296145f1f8e7e2bb547dc"
test_file="crates/cmtraceopen-parser/tests/sccm_client_intake_fixture_contract.rs"
fixture_root="crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake"
printf '%s\n' '== Decode committed capped literal and compare fixture bytes =='
python3 - <<'PY'
import ast
import hashlib
from pathlib import Path
test_path = Path("crates/cmtraceopen-parser/tests/sccm_client_intake_fixture_contract.rs")
fixture_path = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/capped/evidence/client-content/current/DataTransferService.log")
line = next(
(line.strip() for line in test_path.read_text(encoding="utf-8").splitlines()
if line.strip().startswith("const EXPECTED_CAPPED_CONTENT:")),
None,
)
if line is None:
raise SystemExit("FAIL: EXPECTED_CAPPED_CONTENT declaration missing")
literal = line.split("=", 1)[1].strip().rstrip(";")
expected = ast.literal_eval(literal)
actual = fixture_path.read_bytes()
print(f"expected length={len(expected)} actual length={len(actual)}")
print(f"expected SHA-256={hashlib.sha256(expected).hexdigest()}")
print(f"actual SHA-256={hashlib.sha256(actual).hexdigest()}")
if expected != actual:
raise SystemExit("FAIL: committed expected byte literal differs from capped fixture")
if len(actual) != 128:
raise SystemExit(f"FAIL: capped fixture has {len(actual)} bytes, expected 128")
print("PASS")
PY
printf '%s\n' '== Full static corpus integrity =='
python3 - <<'PY'
import json
from pathlib import Path, PurePosixPath
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake")
scenarios = ("complete", "rotations", "collision", "missing-root", "access-denied", "capped")
errors, declared, records = [], set(), 0
for scenario in scenarios:
sr = root / scenario
manifest = json.loads((sr / "manifest.json").read_text(encoding="utf-8"))
artifacts = manifest["artifacts"]
records += len(artifacts)
if manifest["bundle"].get("siteCode") != "LAB":
errors.append(f"{scenario}: siteCode is not literal LAB")
rollover = [a for a in artifacts if a.get("rotation", {}).get("kind") == "lo"]
if scenario == "rotations":
expected = ("AppEnforce.lo_", "evidence/client-app-enforce/lo/AppEnforce.lo_", "SYNTHETIC://root-a/CCM/Logs/AppEnforce.lo_")
actual = tuple(rollover[0].get(k) for k in ("originalBasename", "relativePath", "sanitizedSourcePath")) if len(rollover) == 1 else ()
if len(rollover) != 1 or actual != expected:
errors.append(f"rotations: rollover contract mismatch: count={len(rollover)}, values={actual!r}")
for artifact in artifacts:
relative = artifact.get("relativePath")
if relative is None:
if artifact.get("bytesCopied") != 0:
errors.append(f"{scenario}/{artifact['artifactId']}: null path has nonzero bytes")
continue
posix = PurePosixPath(relative)
if posix.is_absolute() or ".." in posix.parts or posix.parts[:1] != ("evidence",):
errors.append(f"{scenario}/{artifact['artifactId']}: unsafe path")
continue
physical = sr.joinpath(*posix.parts)
declared.add(physical.resolve())
if not physical.is_file():
errors.append(f"{scenario}/{artifact['artifactId']}: missing declared file")
elif physical.stat().st_size != artifact.get("bytesCopied"):
errors.append(f"{scenario}/{artifact['artifactId']}: byte count mismatch")
elif scenario == "rotations" and artifact.get("rotation", {}).get("kind") == "lo" and physical.stat().st_size != 176:
errors.append(f"{scenario}/{artifact['artifactId']}: rollover is not 176 bytes")
physical_files = {p.resolve() for p in root.glob("*/evidence/**/*") if p.is_file()}
errors.extend(f"orphan {p.relative_to(root.resolve())}" for p in sorted(physical_files - declared))
errors.extend(f"undeclared {p.relative_to(root.resolve())}" for p in sorted(declared - physical_files))
print(f"scenarios={len(scenarios)} artifacts={records} declared={len(declared)} physical={len(physical_files)}")
if errors:
raise SystemExit("FAIL:\n- " + "\n- ".join(errors))
print("PASS")
PY
printf '%s\n' '== Exact-head Git blob identity for byte-sensitive fixtures =='
for file in \
crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/capped/evidence/client-content/current/DataTransferService.log \
crates/cmtraceopen-parser/tests/fixtures/sccm/client/intake/rotations/evidence/client-app-enforce/lo/AppEnforce.lo_
do
printf '%s\n' "$file"
git rev-parse "${head}:${file}"
git hash-object "$file"
done
printf '%s\n' '== Residual invalid identifiers and prohibited implementation claims =='
rg -n -i -C 2 'CONTOSO|AppEnforce\.log\.lo_|production (reader|intake)|native (intake|acceptance)|Windows[- ]acceptance' \
"$test_file" "$fixture_root" \
crates/cmtraceopen-parser/tests/fixtures/sccm/client/README.md \
docs/sccm/preparation/issue-319-client-intake.md \
docs/superpowers/plans/2026-07-30-sccm-client-intake-and-core.md \
|| trueLength of output: 8439
Verified:
I did not execute the reported Rust, Clippy, wasm32, or TypeScript commands in this static-inspection environment. ✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 3 minutes. |
Refs #319. Pins exact client-intake synthetic identity, rotation provenance, and capped payload contracts after independent and CodeRabbit review.
Refs #319.
Corrects the committed client-intake preparation corpus to the documented ConfigMgr contracts.
Scope
LABAppEnforce.logrollback toAppEnforce.lo_, including physical file, full relative path, original basename, and sanitized provenanceVerification at
4f91993115524bfbd3f296145f1f8e7e2bb547dc781fb9c6; both issue-scoped commits map=LABregression)3253f6c4bc7d74bd2dbdadbe2f6543ff61a57161f85f650869b1292556270114Issue #319 remains open for production native intake implementation and later Windows validation.
Summary by CodeRabbit
Tests
AppEnforce.lo_log fragment.Documentation
LABsite code and canonical.lo_rotation naming.