test(sccm): prepare Distribution Point corpus - #374
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThis change adds a synthetic SCCM distribution-point fixture corpus, expected scenario outputs, a preparation contract, and Rust tests for provenance, topology, coverage, transactions, evidence, ordering, and fail-closed mutations. ChangesSCCM distribution-point corpus
Estimated code review effort: 4 (Complex) | ~45 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
Comment |
|
@coderabbitai review Please perform a substantive exact-head review of |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='25b37333affde22b4ef8a19f4a5f3d89c082b599'
head='15b3474f8721a3453e8732e264e0d20464e37288'
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
echo '=== exact range ==='
git diff --stat "$base" "$head"
echo '=== changed files ==='
git diff --name-status "$base" "$head"
echo '=== fixture and document inventory ==='
git diff --name-only "$base" "$head" | grep -E '\.(rs|json|md|log|txt)$' || true
echo '=== changed Rust outlines ==='
git diff --name-only "$base" "$head" | grep -E '\.rs$' | while IFS= read -r file; do
echo "--- $file"
ast-grep outline "$file" --items all || true
done
echo '=== diff (all, no color) ==='
git diff --no-ext-diff --unified=80 "$base" "$head"Length of output: 184074 🏁 Script executed: #!/bin/bash
set -euo pipefail
contract='crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs'
root='crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point'
echo '=== contract: manifest topology and normalization ==='
sed -n '243,697p' "$contract"
echo '=== contract: expected-output validation ==='
sed -n '758,1417p' "$contract"
echo '=== locate SCCM normalization implementation ==='
rg -n -C 4 --type rust '\bnormalize_ccm_artifact\s*\(' crates
rg -n -C 3 --type rust 'enum SccmRole|struct SccmArtifact|enum SccmCoverageState|enum SccmRotation|enum SccmTimeOrderingState' crates/cmtraceopen-parser
echo '=== source outlines for likely SCCM modules ==='
fd -e rs . crates/cmtraceopen-parser/src | while IFS= read -r file; do
if rg -q --type rust '\bnormalize_ccm_artifact\b' "$file"; then
echo "--- $file"
ast-grep outline "$file" --items all
fi
done
echo '=== corpus JSON, paths, byte counts, and record field audit ==='
python3 - <<'PY'
import json, re
from pathlib import Path
from datetime import datetime
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
issues = []
for scenario_dir in sorted(p for p in root.iterdir() if p.is_dir()):
scenario = scenario_dir.name
try:
manifest = json.loads((scenario_dir / "manifest.json").read_text())
expected = json.loads((scenario_dir / "expected.json").read_text())
except Exception as e:
issues.append(f"{scenario}: JSON error: {e}")
continue
captured = datetime.fromisoformat(manifest["bundle"]["capturedUtc"].replace("Z","+00:00"))
seen_rel, seen_fingerprint = set(), set()
artifacts = {a["artifactId"]: a for a in manifest["artifacts"]}
for a in manifest["artifacts"]:
aid = a["artifactId"]
if a["pathFingerprint"] in seen_fingerprint:
issues.append(f"{scenario}/{aid}: duplicate pathFingerprint")
seen_fingerprint.add(a["pathFingerprint"])
if a["captureState"] in {"captured","capped","parseFailed"}:
rel = a.get("relativePath")
if rel in seen_rel:
issues.append(f"{scenario}/{aid}: duplicate relativePath {rel}")
seen_rel.add(rel)
data = (scenario_dir / rel).read_bytes()
if len(data) != a.get("bytesCopied"):
issues.append(f"{scenario}/{aid}: byte count {len(data)} != {a.get('bytesCopied')}")
if "SYNTHETIC FIXTURE" not in data.decode("utf-8", "replace"):
issues.append(f"{scenario}/{aid}: missing marker")
for txn in expected["transactions"]:
key = txn["key"]
for obs in txn["observations"]:
for ev in obs["evidence"]:
a = artifacts[ev["artifactId"]]
data = (scenario_dir / a["relativePath"]).read_text()
line = data.splitlines()[ev["startLine"]-1]
msg = re.search(r'<!\[LOG\[(.*?)\]LOG\]!>', line)
if not msg:
issues.append(f"{scenario}/{obs['observationId']}: cited line has no CCM envelope")
continue
fields = dict(x.strip().split("=", 1) for x in msg.group(1).split(";")[1:])
expected_fields = {
"PackageId": key["packageId"], "ContentId": key["contentId"],
"ContentVersion": str(key["contentVersion"]), "SiteCode": key["siteCode"],
"DpHandle": key["distributionPointHandle"], "ProfileId": key["extractionProfileId"],
"Phase": obs["phase"], "Disposition": obs["disposition"],
"Terminal": str(obs["terminal"]).lower(),
}
for n, v in expected_fields.items():
if fields.get(n) != v:
issues.append(f"{scenario}/{obs['observationId']}: {n}={fields.get(n)!r}, expected {v!r}")
stamp = re.search(r'<time="([^"]+)" date="([^"]+)"', line)
if stamp:
t = datetime.strptime(f"{stamp.group(2)}T{stamp.group(1)}", "%m-%d-%YT%H:%M:%S.%f%z")
if t > captured:
issues.append(f"{scenario}/{obs['observationId']}: evidence is after bundle capture")
print("audit issues:", len(issues))
print("\n".join(issues) if issues else "none")
PYLength of output: 71484 🏁 Script executed: #!/bin/bash
set -euo pipefail
contract='crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs'
echo '=== numbered topology validation ==='
nl -ba "$contract" | sed -n '425,620p'
echo '=== numbered source-local validation ==='
nl -ba "$contract" | sed -n '1210,1325p'
echo '=== normalizer implementation ==='
nl -ba crates/cmtraceopen-parser/src/sccm/ingest.rs
echo '=== artifact model ==='
nl -ba crates/cmtraceopen-parser/src/sccm/models.rs | sed -n '370,410p'
echo '=== corrected corpus audit ==='
python3 - <<'PY'
import json, re
from pathlib import Path
from datetime import datetime
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
issues = []
for scenario_dir in sorted(p for p in root.iterdir() if p.is_dir()):
scenario = scenario_dir.name
manifest = json.loads((scenario_dir / "manifest.json").read_text())
expected = json.loads((scenario_dir / "expected.json").read_text())
captured = datetime.fromisoformat(manifest["bundle"]["capturedUtc"].replace("Z","+00:00"))
artifacts = {a["artifactId"]: a for a in manifest["artifacts"]}
rel_paths, fingerprints = set(), set()
for a in manifest["artifacts"]:
aid = a["artifactId"]
if not fingerprints.add(a["pathFingerprint"]) if False else False:
pass
if a["pathFingerprint"] in fingerprints:
issues.append(f"{scenario}/{aid}: duplicate pathFingerprint")
fingerprints.add(a["pathFingerprint"])
if a["captureState"] in {"captured", "capped", "parseFailed"}:
data = (scenario_dir / a["relativePath"]).read_bytes()
if a["relativePath"] in rel_paths:
issues.append(f"{scenario}/{aid}: duplicate relativePath")
rel_paths.add(a["relativePath"])
if len(data) != a["bytesCopied"]:
issues.append(f"{scenario}/{aid}: byte count mismatch")
for txn in expected["transactions"]:
for obs in txn["observations"]:
for ev in obs["evidence"]:
a = artifacts[ev["artifactId"]]
line = (scenario_dir / a["relativePath"]).read_text().splitlines()[ev["startLine"] - 1]
message = re.search(r'<!\[LOG\[(.*?)\]LOG\]!>', line).group(1)
fields = dict(x.strip().split("=", 1) for x in message.split(";")[1:])
required = {
"PackageId": txn["key"]["packageId"],
"ContentId": txn["key"]["contentId"],
"ContentVersion": str(txn["key"]["contentVersion"]),
"SiteCode": txn["key"]["siteCode"],
"DpHandle": txn["key"]["distributionPointHandle"],
"ProfileId": txn["key"]["extractionProfileId"],
"Phase": obs["phase"], "Disposition": obs["disposition"],
"Terminal": str(obs["terminal"]).lower(),
}
if any(fields.get(k) != v for k, v in required.items()):
issues.append(f"{scenario}/{obs['observationId']}: field mismatch")
stamp = re.search(r'<time="([^"]+)" date="([^"]+)"', line)
if stamp:
raw = f"{stamp.group(2)}T{stamp.group(1)}"
raw = raw[:-4] + raw[-4:-2] + ":" + raw[-2:]
if datetime.fromisoformat(raw) > captured:
issues.append(f"{scenario}/{obs['observationId']}: after capture")
print("audit issues:", len(issues))
print("\n".join(issues) if issues else "none")
PY
echo '=== static mutation conditions for the candidate gaps ==='
python3 - <<'PY'
import json
from pathlib import Path
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
manifest = json.loads((root/"healthy-package/manifest.json").read_text())
site = manifest["artifacts"][0]
print("site artifact role:", site["producerRole"])
print("site producer host:", site["producerHostHandle"])
print("site workflow subject:", site["workflowSubjectHandle"])
print("validator checks an exact site-server host:", False)
expected = json.loads((root/"client-only-looking-request/expected.json").read_text())
obs = expected["sourceLocalObservations"][0]
print("source-local classification:", obs["classification"])
print("source-local validator requires cited artifact role to be client:", False)
print("source-local validator requires ignoredClientEvidence to cite logical evidence:", False)
PYLength of output: 4861 🏁 Script executed: #!/bin/bash
set -euo pipefail
contract='crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs'
echo '=== numbered topology validation ==='
cat -n "$contract" | sed -n '425,620p'
echo '=== numbered source-local validation ==='
cat -n "$contract" | sed -n '1210,1325p'
echo '=== normalizer implementation ==='
cat -n crates/cmtraceopen-parser/src/sccm/ingest.rs
echo '=== artifact model ==='
cat -n crates/cmtraceopen-parser/src/sccm/models.rs | sed -n '370,410p'
echo '=== corpus consistency audit ==='
python3 - <<'PY'
import json, re
from pathlib import Path
from datetime import datetime
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
issues = []
for scenario_dir in sorted(p for p in root.iterdir() if p.is_dir()):
scenario = scenario_dir.name
manifest = json.loads((scenario_dir / "manifest.json").read_text())
expected = json.loads((scenario_dir / "expected.json").read_text())
captured = datetime.fromisoformat(manifest["bundle"]["capturedUtc"].replace("Z", "+00:00"))
artifacts = {a["artifactId"]: a for a in manifest["artifacts"]}
rel_paths, fingerprints = set(), set()
for a in manifest["artifacts"]:
aid = a["artifactId"]
if a["pathFingerprint"] in fingerprints:
issues.append(f"{scenario}/{aid}: duplicate pathFingerprint")
fingerprints.add(a["pathFingerprint"])
if a["captureState"] in {"captured", "capped", "parseFailed"}:
rel = a["relativePath"]
if rel in rel_paths:
issues.append(f"{scenario}/{aid}: duplicate relativePath")
rel_paths.add(rel)
data = (scenario_dir / rel).read_bytes()
if len(data) != a["bytesCopied"]:
issues.append(f"{scenario}/{aid}: byte count mismatch")
for txn in expected["transactions"]:
for obs in txn["observations"]:
for ev in obs["evidence"]:
a = artifacts[ev["artifactId"]]
line = (scenario_dir / a["relativePath"]).read_text().splitlines()[ev["startLine"] - 1]
message = re.search(r'<!\[LOG\[(.*?)\]LOG\]!>', line).group(1)
fields = dict(x.strip().split("=", 1) for x in message.split(";")[1:])
required = {
"PackageId": txn["key"]["packageId"],
"ContentId": txn["key"]["contentId"],
"ContentVersion": str(txn["key"]["contentVersion"]),
"SiteCode": txn["key"]["siteCode"],
"DpHandle": txn["key"]["distributionPointHandle"],
"ProfileId": txn["key"]["extractionProfileId"],
"Phase": obs["phase"],
"Disposition": obs["disposition"],
"Terminal": str(obs["terminal"]).lower(),
}
if any(fields.get(key) != value for key, value in required.items()):
issues.append(f"{scenario}/{obs['observationId']}: field mismatch")
stamp = re.search(r'<time="([^"]+)" date="([^"]+)"', line)
if stamp:
raw = f"{stamp.group(2)}T{stamp.group(1)}"
normalized = raw[:-4] + raw[-4:-2] + ":" + raw[-2:]
if datetime.fromisoformat(normalized) > captured:
issues.append(f"{scenario}/{obs['observationId']}: after bundle capture")
print(f"audit issues: {len(issues)}")
print("\n".join(issues) if issues else "none")
PYLength of output: 21292 🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 - <<'PY'
import json, re
from pathlib import Path
from datetime import datetime
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
issues = []
for scenario_dir in sorted(p for p in root.iterdir() if p.is_dir()):
scenario = scenario_dir.name
manifest = json.loads((scenario_dir / "manifest.json").read_text())
expected = json.loads((scenario_dir / "expected.json").read_text())
captured = datetime.fromisoformat(manifest["bundle"]["capturedUtc"].replace("Z", "+00:00"))
artifacts = {a["artifactId"]: a for a in manifest["artifacts"]}
rel_paths, fingerprints = set(), set()
for a in manifest["artifacts"]:
aid = a["artifactId"]
if a["pathFingerprint"] in fingerprints:
issues.append(f"{scenario}/{aid}: duplicate pathFingerprint")
fingerprints.add(a["pathFingerprint"])
if a["captureState"] in {"captured", "capped", "parseFailed"}:
rel = a["relativePath"]
if rel in rel_paths:
issues.append(f"{scenario}/{aid}: duplicate relativePath")
rel_paths.add(rel)
data = (scenario_dir / rel).read_bytes()
if len(data) != a["bytesCopied"]:
issues.append(f"{scenario}/{aid}: byte count mismatch")
for txn in expected["transactions"]:
for obs in txn["observations"]:
for ev in obs["evidence"]:
a = artifacts[ev["artifactId"]]
line = (scenario_dir / a["relativePath"]).read_text().splitlines()[ev["startLine"] - 1]
message = re.search(r'<!\[LOG\[(.*?)\]LOG\]!>', line).group(1)
fields = dict(x.strip().split("=", 1) for x in message.split(";")[1:])
required = {
"PackageId": txn["key"]["packageId"],
"ContentId": txn["key"]["contentId"],
"ContentVersion": str(txn["key"]["contentVersion"]),
"SiteCode": txn["key"]["siteCode"],
"DpHandle": txn["key"]["distributionPointHandle"],
"ProfileId": txn["key"]["extractionProfileId"],
"Phase": obs["phase"],
"Disposition": obs["disposition"],
"Terminal": str(obs["terminal"]).lower(),
}
if any(fields.get(key) != value for key, value in required.items()):
issues.append(f"{scenario}/{obs['observationId']}: field mismatch")
stamp = re.search(r'<time="([^"]+)" date="([^"]+)"', line)
if stamp:
timestamp = f"{stamp.group(2)}T{stamp.group(1)}".replace("+000", "+00:00")
if datetime.fromisoformat(timestamp) > captured:
issues.append(f"{scenario}/{obs['observationId']}: after bundle capture")
print(f"audit issues: {len(issues)}")
print("\n".join(issues) if issues else "none")
PYLength of output: 3432 🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 - <<'PY'
import json, re
from pathlib import Path
from datetime import datetime
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
issues = []
for scenario_dir in sorted(p for p in root.iterdir() if p.is_dir()):
scenario = scenario_dir.name
manifest = json.loads((scenario_dir / "manifest.json").read_text())
expected = json.loads((scenario_dir / "expected.json").read_text())
captured = datetime.strptime(
manifest["bundle"]["capturedUtc"], "%Y-%m-%dT%H:%M:%SZ"
).replace(tzinfo=None)
artifacts = {a["artifactId"]: a for a in manifest["artifacts"]}
rel_paths, fingerprints = set(), set()
for a in manifest["artifacts"]:
aid = a["artifactId"]
if a["pathFingerprint"] in fingerprints:
issues.append(f"{scenario}/{aid}: duplicate pathFingerprint")
fingerprints.add(a["pathFingerprint"])
if a["captureState"] in {"captured", "capped", "parseFailed"}:
rel = a["relativePath"]
if rel in rel_paths:
issues.append(f"{scenario}/{aid}: duplicate relativePath")
rel_paths.add(rel)
if len((scenario_dir / rel).read_bytes()) != a["bytesCopied"]:
issues.append(f"{scenario}/{aid}: byte count mismatch")
for txn in expected["transactions"]:
for obs in txn["observations"]:
for ev in obs["evidence"]:
a = artifacts[ev["artifactId"]]
line = (scenario_dir / a["relativePath"]).read_text().splitlines()[ev["startLine"] - 1]
message = re.search(r'<!\[LOG\[(.*?)\]LOG\]!>', line).group(1)
fields = dict(x.strip().split("=", 1) for x in message.split(";")[1:])
required = {
"PackageId": txn["key"]["packageId"],
"ContentId": txn["key"]["contentId"],
"ContentVersion": str(txn["key"]["contentVersion"]),
"SiteCode": txn["key"]["siteCode"],
"DpHandle": txn["key"]["distributionPointHandle"],
"ProfileId": txn["key"]["extractionProfileId"],
"Phase": obs["phase"],
"Disposition": obs["disposition"],
"Terminal": str(obs["terminal"]).lower(),
}
if any(fields.get(key) != value for key, value in required.items()):
issues.append(f"{scenario}/{obs['observationId']}: field mismatch")
stamp = re.search(r'<time="([^"]+)" date="([^"]+)"', line)
if stamp:
evidence_time = datetime.strptime(
f"{stamp.group(2)}T{stamp.group(1)}",
"%m-%d-%YT%H:%M:%S.%f%z",
).replace(tzinfo=None)
if evidence_time > captured:
issues.append(f"{scenario}/{obs['observationId']}: after bundle capture")
print(f"audit issues: {len(issues)}")
print("\n".join(issues) if issues else "none")
PYLength of output: 3834 🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 - <<'PY'
import json, re
from pathlib import Path
from datetime import datetime
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
issues = []
for scenario_dir in sorted(p for p in root.iterdir() if p.is_dir()):
scenario = scenario_dir.name
manifest = json.loads((scenario_dir / "manifest.json").read_text())
expected = json.loads((scenario_dir / "expected.json").read_text())
captured = datetime.strptime(manifest["bundle"]["capturedUtc"], "%Y-%m-%dT%H:%M:%SZ")
artifacts = {a["artifactId"]: a for a in manifest["artifacts"]}
rel_paths, fingerprints = set(), set()
for a in manifest["artifacts"]:
aid = a["artifactId"]
if a["pathFingerprint"] in fingerprints:
issues.append(f"{scenario}/{aid}: duplicate pathFingerprint")
fingerprints.add(a["pathFingerprint"])
if a["captureState"] in {"captured", "capped", "parseFailed"}:
rel = a["relativePath"]
if rel in rel_paths:
issues.append(f"{scenario}/{aid}: duplicate relativePath")
rel_paths.add(rel)
if len((scenario_dir / rel).read_bytes()) != a["bytesCopied"]:
issues.append(f"{scenario}/{aid}: byte count mismatch")
for txn in expected["transactions"]:
for obs in txn["observations"]:
for ev in obs["evidence"]:
a = artifacts[ev["artifactId"]]
line = (scenario_dir / a["relativePath"]).read_text().splitlines()[ev["startLine"] - 1]
message = re.search(r'<!\[LOG\[(.*?)\]LOG\]!>', line).group(1)
fields = dict(x.strip().split("=", 1) for x in message.split(";")[1:])
required = {
"PackageId": txn["key"]["packageId"],
"ContentId": txn["key"]["contentId"],
"ContentVersion": str(txn["key"]["contentVersion"]),
"SiteCode": txn["key"]["siteCode"],
"DpHandle": txn["key"]["distributionPointHandle"],
"ProfileId": txn["key"]["extractionProfileId"],
"Phase": obs["phase"],
"Disposition": obs["disposition"],
"Terminal": str(obs["terminal"]).lower(),
}
if any(fields.get(key) != value for key, value in required.items()):
issues.append(f"{scenario}/{obs['observationId']}: field mismatch")
stamp = re.search(r'<time="([^"]+)" date="([^"]+)"', line)
if stamp:
raw = f"{stamp.group(2)}T{stamp.group(1)}"
if not raw.endswith("+000"):
issues.append(f"{scenario}/{obs['observationId']}: unexpected nonzero offset")
else:
evidence_time = datetime.strptime(raw[:-4], "%m-%d-%YT%H:%M:%S.%f")
if evidence_time > captured:
issues.append(f"{scenario}/{obs['observationId']}: after bundle capture")
print(f"audit issues: {len(issues)}")
print("\n".join(issues) if issues else "none")
PYLength of output: 3336
I found two contract gaps.
The read-only fixture audit found no inconsistencies in copied byte counts, physical-path or fingerprint collisions, cited exact key fields, or evidence timestamps after the canonical bundle capture. I could not execute the Rust test suite in this sandbox. ✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs`:
- Around line 660-668: Update the non-physical artifact validation branch in the
fixture contract test to reject artifacts containing collectionLimit, alongside
the existing physical-capture fields. Add a mutation case that injects
collectionLimit into an artifact with a non-captured state and assert that the
contract reports the violation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 28cc4e38-f892-47ab-b985-aa21015983c9
⛔ Files ignored due to path filters (24)
crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/client-only-looking-request/evidence/client-content-control/current/DataTransferService.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/evidence/server-dp-distribution/dp-02/current/SMSDPProv.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/evidence/server-dp-distribution/dp/current/SMSDPProv.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/evidence/server-dp-distribution/site/current/PkgXferMgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/evidence/server-dp-distribution/site/current/distmgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/evidence/server-dp-distribution/site/dp-02/current/PkgXferMgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/evidence/server-dp-distribution/site/dp-02/current/distmgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/distribution-failure/evidence/server-dp-distribution/site/current/distmgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/healthy-package/evidence/server-dp-distribution/dp/current/SMSDPProv.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/healthy-package/evidence/server-dp-distribution/site/current/PkgXferMgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/healthy-package/evidence/server-dp-distribution/site/current/distmgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/incomplete/evidence/server-dp-distribution/site/current/distmgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/rotation-boundary/evidence/server-dp-distribution/dp/malformed/SMSDPProv.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/rotation-boundary/evidence/server-dp-distribution/site/current/distmgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/rotation-boundary/evidence/server-dp-distribution/site/lo_/distmgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/serve-observed/evidence/server-dp-distribution/dp/current/SMSDPProv.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/serve-observed/evidence/server-dp-distribution/site/current/PkgXferMgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/serve-observed/evidence/server-dp-distribution/site/current/distmgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/serve-observed/evidence/server-dp-serve/dp/current/SMSdpmon.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/transfer-retry/evidence/server-dp-distribution/site/current/PkgXferMgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/transfer-retry/evidence/server-dp-distribution/site/current/distmgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/validation-failure/evidence/server-dp-distribution/dp/current/SMSDPProv.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/validation-failure/evidence/server-dp-distribution/site/current/PkgXferMgr.logis excluded by!**/*.logcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/validation-failure/evidence/server-dp-distribution/site/current/distmgr.logis excluded by!**/*.log
📒 Files selected for processing (23)
crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/README.mdcrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/absent-dp/expected.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/absent-dp/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/client-only-looking-request/expected.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/client-only-looking-request/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/expected.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/distribution-failure/expected.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/distribution-failure/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/healthy-package/expected.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/healthy-package/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/incomplete/expected.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/incomplete/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/rotation-boundary/expected.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/rotation-boundary/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/serve-observed/expected.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/serve-observed/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/transfer-retry/expected.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/transfer-retry/manifest.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/validation-failure/expected.jsoncrates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/validation-failure/manifest.jsoncrates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rsdocs/sccm/preparation/issue-329-distribution-point-corpus.md
|
@coderabbitai review Please perform a fresh substantive exact-head review of |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='25b37333affde22b4ef8a19f4a5f3d89c082b599'
head='d07ab1575d2d5a4360dc0f606064b8dbc6525170'
contract='crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs'
root='crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point'
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
echo '=== exact changed files ==='
git diff --name-status "$base" "$head"
echo '=== diffstat ==='
git diff --stat "$base" "$head"
echo '=== Rust contract outline ==='
ast-grep outline "$contract" --items all
echo '=== prior-finding and invariant locations ==='
rg -n -C 5 --type rust \
'producerHostHandle|workflowSubjectHandle|collectionLimit|sourceLocalObservations|ignoredClientEvidence|malformedEvidence|rotationSplit|distributionPointHandle|pathFingerprint|relativePath|artifactRequests|causal' \
"$contract"
echo '=== contract sections: manifest and topology ==='
cat -n "$contract" | sed -n '400,760p'
echo '=== contract sections: expected records and output ==='
cat -n "$contract" | sed -n '760,1250p'
echo '=== contract sections: source-local and mutation tests ==='
cat -n "$contract" | sed -n '1250,1900p'
echo '=== exact diff for contract and preparation document ==='
git diff --no-ext-diff --unified=40 "$base" "$head" -- \
"$contract" \
docs/sccm/preparation/issue-329-distribution-point-corpus.md
echo '=== static fixture corpus audit ==='
python3 - <<'PY'
import json, re
from pathlib import Path
from collections import defaultdict
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
problems = []
for d in sorted(p for p in root.iterdir() if p.is_dir()):
scenario = d.name
try:
manifest = json.loads((d / "manifest.json").read_text())
expected = json.loads((d / "expected.json").read_text())
except Exception as exc:
problems.append(f"{scenario}: JSON load failed: {exc}")
continue
artifacts = {a["artifactId"]: a for a in manifest.get("artifacts", [])}
rels, fps = set(), set()
host_subject_by_physical = defaultdict(set)
for a in manifest.get("artifacts", []):
aid = a["artifactId"]
role = a.get("producerRole")
host = a.get("producerHostHandle", "")
subject = a.get("workflowSubjectHandle", "")
state = a.get("captureState")
limit = a.get("collectionLimit")
expected_prefix = {
"siteServer": "safe:server:",
"client": "safe:client:",
"distributionPoint": "safe:dp:",
}.get(role)
if expected_prefix and not host.startswith(expected_prefix):
problems.append(f"{scenario}/{aid}: {role} host {host!r} lacks {expected_prefix!r}")
if role == "distributionPoint" and host != subject:
problems.append(f"{scenario}/{aid}: DP host/subject differ")
if not isinstance(limit, dict) and limit is not None:
problems.append(f"{scenario}/{aid}: collectionLimit is not an object")
if isinstance(limit, dict) and state in {"absent", "accessDenied"} and any(
key in limit for key in ("maxBytes", "bytesCopied", "lineCount")
):
problems.append(f"{scenario}/{aid}: nonphysical {state} has physical limit fields")
fp = a.get("pathFingerprint")
if fp in fps:
problems.append(f"{scenario}/{aid}: duplicate pathFingerprint")
fps.add(fp)
if state in {"captured", "capped", "parseFailed"}:
rel = a.get("relativePath")
if rel in rels:
problems.append(f"{scenario}/{aid}: duplicate relativePath")
rels.add(rel)
if not isinstance(rel, str) or rel.startswith("/") or ".." in Path(rel).parts:
problems.append(f"{scenario}/{aid}: unsafe relativePath")
else:
path = d / rel
if not path.is_file():
problems.append(f"{scenario}/{aid}: missing physical evidence")
elif a.get("bytesCopied") != len(path.read_bytes()):
problems.append(f"{scenario}/{aid}: copied byte count mismatch")
# Validate cited transaction evidence against the raw CCM envelope and its artifact.
for txn in expected.get("transactions", []):
key = txn.get("key", {})
for obs in txn.get("observations", []):
for ev in obs.get("evidence", []):
aid = ev.get("artifactId")
a = artifacts.get(aid)
if not a:
problems.append(f"{scenario}/{obs.get('observationId')}: unknown evidence artifact")
continue
if a.get("producerRole") == "client":
problems.append(f"{scenario}/{obs.get('observationId')}: transaction cites client artifact")
try:
line = (d / a["relativePath"]).read_text().splitlines()[ev["startLine"] - 1]
message = re.search(r'<!\[LOG\[(.*?)\]LOG\]!>', line).group(1)
fields = dict(part.strip().split("=", 1) for part in message.split(";")[1:])
except Exception as exc:
problems.append(f"{scenario}/{obs.get('observationId')}: unreadable CCM evidence: {exc}")
continue
required = {
"PackageId": key.get("packageId"),
"ContentId": key.get("contentId"),
"ContentVersion": str(key.get("contentVersion")),
"SiteCode": key.get("siteCode"),
"DpHandle": key.get("distributionPointHandle"),
"ProfileId": key.get("extractionProfileId"),
"Phase": obs.get("phase"),
"Disposition": obs.get("disposition"),
"Terminal": str(obs.get("terminal")).lower(),
}
for name, value in required.items():
if fields.get(name) != value:
problems.append(
f"{scenario}/{obs.get('observationId')}: {name}={fields.get(name)!r}, expected {value!r}"
)
# Validate source-local classification binding from fixture values.
for obs in expected.get("sourceLocalObservations", []):
cls = obs.get("classification")
cited = [artifacts.get(aid) for aid in obs.get("artifactIds", [])]
if not cited or any(a is None for a in cited):
problems.append(f"{scenario}/{cls}: missing source-local artifact")
continue
if cls == "ignoredClientEvidence" and any(a.get("producerRole") != "client" for a in cited):
problems.append(f"{scenario}/{cls}: non-client artifact")
if cls == "malformedEvidence" and any(a.get("captureState") != "parseFailed" for a in cited):
problems.append(f"{scenario}/{cls}: artifact is not parseFailed")
if cls == "rotationSplit":
lineages = {a.get("rotation", {}).get("lineageId") for a in cited}
if len(lineages) != 1 or None in lineages:
problems.append(f"{scenario}/{cls}: artifacts lack one rotation lineage")
print(f"fixture audit problems: {len(problems)}")
print("\n".join(problems) if problems else "none")
PYLength of output: 193978 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='25b37333affde22b4ef8a19f4a5f3d89c082b599'
head='d07ab1575d2d5a4360dc0f606064b8dbc6525170'
contract='crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs'
root='crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point'
echo '=== all exact-range pathFingerprint references ==='
git grep -n -E 'pathFingerprint|fingerprint' "$head" -- \
crates/cmtraceopen-parser/tests \
docs/sccm/preparation/issue-329-distribution-point-corpus.md || true
echo '=== validator region before artifact loop ==='
cat -n "$contract" | sed -n '330,430p'
echo '=== fixture artifact identity rows ==='
python3 - <<'PY'
import json
from pathlib import Path
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
for scenario_dir in sorted(p for p in root.iterdir() if p.is_dir()):
manifest = json.loads((scenario_dir / "manifest.json").read_text())
print(f"[{scenario_dir.name}]")
for artifact in manifest["artifacts"]:
print(
" | ".join([
artifact["artifactId"],
artifact["pathFingerprint"],
artifact["sanitizedSourcePath"],
artifact["producerHostHandle"],
artifact["rotation"]["kind"],
str(artifact["rotation"].get("value", "")),
])
)
PY
echo '=== structural mutation model for pathFingerprint acceptance ==='
python3 - <<'PY'
import json
from pathlib import Path
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
manifest = json.loads((root / "healthy-package" / "manifest.json").read_text())
def current_contract_fingerprint_check(artifact):
# This matches the pathFingerprint predicate at contract Lines 493-498.
value = artifact.get("pathFingerprint")
return isinstance(value, str) and value.startswith("synthetic:")
first, second = manifest["artifacts"][:2]
duplicate = json.loads(json.dumps(manifest))
duplicate["artifacts"][1]["pathFingerprint"] = duplicate["artifacts"][0]["pathFingerprint"]
detached = json.loads(json.dumps(manifest))
detached["artifacts"][1]["pathFingerprint"] = "synthetic:unrelated-opaque-fingerprint"
print("baseline individual predicates:", [current_contract_fingerprint_check(a) for a in manifest["artifacts"]])
print("duplicate fingerprint predicates:", [current_contract_fingerprint_check(a) for a in duplicate["artifacts"]])
print("detached fingerprint predicates:", [current_contract_fingerprint_check(a) for a in detached["artifacts"]])
print("duplicate value:", duplicate["artifacts"][0]["pathFingerprint"])
print("detached value:", detached["artifacts"][1]["pathFingerprint"])
print("The shown contract stores no pathFingerprint set and derives physical identity without pathFingerprint.")
PYLength of output: 182201
I found no new actionable findings. The prior findings are structurally closed.
I also verified these controls:
The static corpus audit found no byte-count, physical-path, fingerprint, exact-field, or timestamp violations. I could not run the Rust test suite because this sandbox does not execute repository code. You are interacting with an AI system. |
adamgell
added
test
adamgell
left a comment
adamgell
left a comment
There was a problem hiding this comment.
Independent exact-head review — BLOCKED
Reviewed exact 25b37333affde22b4ef8a19f4a5f3d89c082b599..d07ab1575d2d5a4360dc0f606064b8dbc6525170 in detached review worktree .worktrees/review-374-d07-exact. Keep PR #374 draft/open.
A permanent external-consumer mutation probe is RED with seven accepted fail-open states:
- duplicate
pathFingerprint; - dot-segment physical evidence alias;
- unsafe identity-bearing
sanitizedSourcePath; - unknown
5.00.TEST.*version retaining Exact profile output; - non-string topology role silently discarded;
- noncanonical value on a Current rotation;
- duplicate observation reusing the same physical evidence.
Five line-level P1 threads group those into path/provenance, version selection, typed topology, canonical rotation, and unique evidence-consumption fixes. The prior CodeRabbit corrections for producer role, source-local classifications, and nonphysical capture provenance do verify. CodeRabbit also produced a substantive exact-head no-new-findings result at #374 (comment), but the reproduced red probe supersedes it.
Independent gates at the committed exact head: focused 8/8, full parser, server intake, spine, default strict Clippy, Rust 1.88 wasm32, TypeScript, owned rustfmt, and diff checks pass. No production reducer, native collection, correlation, or live Windows acceptance is claimed.
Require permanent regressions for every accepted mutation, all exact-head gates, fresh substantive CodeRabbit, and a different independent PASS before readiness or merge.
#329 executable-probe review fixes — exact headCommit: Scope: prep-only fixture-validator hardening. No production reducer, shared SCCM model, parser kind, native collector, correlator, or live Windows claim changed. The ten-scenario / 27-artifact / 22-evidence synthetic corpus is unchanged. RED → GREEN: the new focused probes first failed 5 tests and reproduced every reviewed acceptance: duplicate fingerprint, dot-segment destination alias, unsafe sanitized path, unknown/malformed/prefix-collision version retaining Exact, non-string/unknown role, noncanonical rotation shapes, duplicate observation ID, and reused physical evidence. The exact correction is now 13/13 green. Verification:
Repository-wide All five exact-head independent review threads were answered with permanent regression evidence and resolved. The PR remains draft/unmerged pending fresh substantive exact-head CodeRabbit and the #318-first dependency gate. |
|
@coderabbitai review Please perform a fresh substantive review of exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='98a72fe8db7315497935d7382a5572e1f63a3f61'
git cat-file -e "${head}^{commit}"
base="$(git rev-parse "${head}^")"
contract='crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs'
echo "=== range ==="
printf '%s..%s\n' "$base" "$head"
echo '=== commit ==='
git show -s --format=fuller "$head"
echo '=== changed files ==='
git diff --name-status "$base" "$head"
echo '=== diffstat ==='
git diff --stat "$base" "$head"
echo '=== changed Rust outlines ==='
git diff --name-only "$base" "$head" | while IFS= read -r path; do
case "$path" in
*.rs)
echo "--- $path"
ast-grep outline "$path" --items all
;;
esac
done
echo '=== relevant validator and mutation-test locations ==='
rg -n -C 4 --type rust \
'pathFingerprint|sanitizedSourcePath|relativePath|collectionLimit|producerHostHandle|workflowSubjectHandle|sourceLocalObservations|Exact|version|rotation|observationId|physical|mutation|assert.*err|assert.*fail' \
"$contract"
echo '=== exact patch ==='
git diff --no-ext-diff --unified=80 "$base" "$head"Length of output: 110834 🏁 Script executed: #!/bin/bash
set -euo pipefail
contract='crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs'
echo '=== validator helpers and manifest validation ==='
sed -n '88,810p' "$contract"
echo '=== transaction and source-local validation ==='
sed -n '1000,1628p' "$contract"
echo '=== complete new executable probes ==='
sed -n '1960,2160p' "$contract"
echo '=== SccmRotation definition and serde attributes ==='
rg -n -C 10 --type rust 'enum SccmRotation|SccmRotation::Timestamped|SccmRotation::Numbered' crates
echo '=== static strengthened-corpus audit ==='
python3 - <<'PY'
import json, re
from pathlib import Path
from collections import Counter, defaultdict
from datetime import datetime
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
errors = []
all_paths = []
all_fingerprints = []
def safe_segments(path):
return bool(path) and "\\" not in path and all(
part not in ("", ".", "..") and re.fullmatch(r"[A-Za-z0-9._-]+", part)
for part in path.split("/")
)
for directory in sorted(p for p in root.iterdir() if p.is_dir()):
manifest = json.loads((directory / "manifest.json").read_text())
expected = json.loads((directory / "expected.json").read_text())
scenario = directory.name
artifacts = {a["artifactId"]: a for a in manifest["artifacts"]}
seen_paths = set()
seen_fingerprints = set()
physical = set()
for artifact in manifest["artifacts"]:
aid = artifact["artifactId"]
if artifact.get("sourceVersion") != "5.00.TEST.0001":
errors.append(f"{scenario}/{aid}: sourceVersion is not exact")
fingerprint = artifact.get("pathFingerprint", "")
if not re.fullmatch(r"synthetic:[A-Za-z0-9._-]+", fingerprint):
errors.append(f"{scenario}/{aid}: unsafe fingerprint")
if fingerprint in seen_fingerprints:
errors.append(f"{scenario}/{aid}: duplicate fingerprint")
seen_fingerprints.add(fingerprint)
all_fingerprints.append(fingerprint)
source_path = artifact.get("sanitizedSourcePath", "")
if not source_path.startswith("SYNTHETIC://") or not safe_segments(source_path[12:]):
errors.append(f"{scenario}/{aid}: unsafe sanitized path")
rotation = artifact.get("rotation", {})
identity = (
artifact.get("producerHostHandle"), source_path,
artifact.get("originalBasename"), rotation.get("kind"),
str(rotation.get("value", "")),
)
if identity in physical:
errors.append(f"{scenario}/{aid}: duplicate physical identity")
physical.add(identity)
state = artifact.get("captureState")
if state in {"captured", "capped", "parseFailed"}:
relative = artifact.get("relativePath", "")
if not relative.startswith("evidence/") or not safe_segments(relative[9:]):
errors.append(f"{scenario}/{aid}: unsafe evidence path")
if relative.split("/")[-1:] != [artifact.get("originalBasename")]:
errors.append(f"{scenario}/{aid}: evidence basename mismatch")
if relative in seen_paths:
errors.append(f"{scenario}/{aid}: duplicate destination")
seen_paths.add(relative)
file_path = directory / relative
if not file_path.is_file():
errors.append(f"{scenario}/{aid}: no fixture file")
elif len(file_path.read_bytes()) != artifact.get("bytesCopied"):
errors.append(f"{scenario}/{aid}: bytesCopied mismatch")
elif any(key in artifact for key in ("relativePath", "bytesCopied", "encoding", "collectionLimit")):
errors.append(f"{scenario}/{aid}: nonphysical capture facts")
all_paths.extend((scenario, p) for p in seen_paths)
for txn in expected.get("transactions", []):
consumed = set()
observation_ids = set()
for observation in txn.get("observations", []):
oid = observation.get("observationId")
if oid in observation_ids:
errors.append(f"{scenario}: duplicate observationId {oid}")
observation_ids.add(oid)
for reference in observation.get("evidence", []):
key = (reference.get("artifactId"), reference.get("startLine"), reference.get("endLine"))
if key in consumed:
errors.append(f"{scenario}/{oid}: reused evidence")
consumed.add(key)
print(f"static audit errors: {len(errors)}")
print("\n".join(errors) if errors else "none")
print(f"scenario-local unique fingerprint rows: {len(all_fingerprints)}")
PYLength of output: 83902
I found one actionable issue. P1 — Reject non-string values in
|
|
I will treat all earlier approvals as stale. I will verify the three corrected boundaries and the full final-head diff. ✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 33 minutes. |
Independent-review correction pushed — exact
|
CodeRabbit correction-range resultAuthenticated CodeRabbit CLI 0.7.1 completed a fresh review of exact range The hosted request was also acknowledged at #374 (comment), but it is fair-usage rate-limited for 33 minutes. That hosted status is not counted as approval. The draft stays blocked on a fresh hosted substantive final-head result plus a different independent exact-head PASS. |
adamgell
left a comment
adamgell
left a comment
There was a problem hiding this comment.
Independent exact-head review — BLOCKED
Reviewed exact ee168cc against foundation a8a367c in clean isolated branch codex/review-329-ee16-independent. This is a semantic block on the #329 preparation contract; no production reducer, native capture, correlation, merge, readiness, or live Windows acceptance is being reviewed or claimed.
The three prior blockers verify at this head: all normalized CCM records must be consumed, non-client producer roles must occur in rolesObserved, and distributionPointObserved is a required Boolean exact topology projection. The committed #329 suite is 41/41 green.
A disposable external exact-head probe is nevertheless RED in two same-root cases. First, healthy-package can append and explicitly cite a later same-key serveOrReport/retrying/nonterminal record after the terminal success while retaining succeeded/success/high. Second, transfer-retry can append and cite a later same-key transfer/succeeded/nonterminal record while retaining deferred/blockedOrDeferred/medium. In both cases the validator returned Ok, so the negative probe assertions failed. The state guards aggregate whether a success, failure, or retry occurred anywhere, rather than requiring the reported outcome to agree with the latest normalized observation. This leaves stale high success and stale deferred outcomes possible.
Fresh exact-head gates: focused #329 41/41; server intake 1/1; spine 136/136; full parser pass; strict all-target Clippy pass; Rust 1.88 wasm32 check pass; TypeScript pass; 20/20 JSON files valid; scoped Rust formatting pass; range/worktree diff checks pass and status is clean. Repository-wide formatting reports 17 inherited non-#329 files. Hosted CodeRabbit and the local CLI are currently rate-limited, so neither is counted as approval.
GitHub does not allow the authenticated repository owner to submit REQUEST_CHANGES on the owner PR, so this COMMENTED review records the formal blocking disposition. Add permanent red-to-green regressions for latest-observation outcome selection, rerun exact-head gates, obtain substantive final-head CodeRabbit, then request a different independent PASS. Keep PR #374 draft/open and keep #333 content-to-DP blocked.
Active correction owner — exact ee168ccI own the isolated round-two #329 correction from exact
PR stays draft/open. #333 remains blocked. No production reducer, native capture, merge readiness, or live Windows acceptance is claimed. |
|
@coderabbitai review Please perform a fresh substantive review of exact head |
Latest-observation correction pushed — exact
|
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='4f8bd3b6e89ab208932446756ed6a29596f8da4c'
contract='crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs'
root='crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point'
doc='docs/sccm/preparation/issue-329-distribution-point-corpus.md'
git cat-file -e "${head}^{commit}"
echo '=== exact head ==='
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
echo '=== candidate PR bases and ancestry ==='
for base in \
'a8a367c661cd17bd1e73b87724c143ec8565ffc7' \
'ee168ccfb05c926b95b8c0cef6d97bc53262da13' \
'9a63b6bd9494882c1006c17ec6b9e9af0bef91d9'
do
if git cat-file -e "${base}^{commit}" 2>/dev/null; then
if git merge-base --is-ancestor "$base" "$head"; then
printf '%s is an ancestor of exact head\n' "$base"
else
printf '%s is not an ancestor of exact head\n' "$base"
fi
fi
done
base='a8a367c661cd17bd1e73b87724c143ec8565ffc7'
echo '=== full feature-range changed files ==='
git diff --name-status "$base" "$head"
echo '=== full feature-range diffstat ==='
git diff --stat "$base" "$head"
echo '=== correction-range changed files ==='
git diff --name-status 'ee168ccfb05c926b95b8c0cef6d97bc53262da13' "$head"
echo '=== changed paths outside declared scope ==='
git diff --name-only "$base" "$head" |
awk -v contract="$contract" -v root="$root" -v doc="$doc" '
$0 == contract || $0 == doc || index($0, root "/") == 1 { next }
{ print }
'
echo '=== contract map ==='
ast-grep outline "$contract" --items all
echo '=== latest-observation, evidence, coverage, topology, privacy, ordering controls ==='
rg -n -C 8 --type rust \
'latest|newest|observation|terminal|ServeOrReport|retrying|blockedOrDeferred|confidence|normalized|record.*consum|rolesObserved|distributionPointObserved|evidence_for|physical_evidence_for|coverageGapArtifactIds|artifactRequests|nextSourceId|rotationSplit|parseFailed|ClientHandle|RequestId|identity|sort|determin' \
"$contract"
echo '=== exact correction diff ==='
git diff --no-ext-diff --unified=60 \
'ee168ccfb05c926b95b8c0cef6d97bc53262da13' "$head" -- "$contract"
echo '=== targeted contract regions ==='
cat -n "$contract" | sed -n '900,1900p'
cat -n "$contract" | sed -n '2850,3600p'Length of output: 232298 🏁 Script executed: #!/bin/bash
set -euo pipefail
contract='crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs'
root='crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point'
echo '=== request, source-local, and final projection validation ==='
cat -n "$contract" | sed -n '1900,2185p'
echo '=== manifest topology, physical identity, and path validation ==='
cat -n "$contract" | sed -n '470,900p'
echo '=== schema-aligned raw fixture audit ==='
python3 - <<'PY'
import json
import re
from collections import Counter, defaultdict
from datetime import datetime
from pathlib import Path
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
problems = []
state_chain = ["receiveContent", "distribute", "transfer", "validate", "makeAvailable", "serveOrReport"]
physical_states = {"captured", "capped", "parseFailed"}
request_reason = {
"absent": "coverageAbsent",
"accessDenied": "coverageAccessDenied",
"capped": "coverageCapped",
"parseFailed": "coverageMalformed",
}
envelope = re.compile(r'<!\[LOG\[(.*?)\]LOG\]!>')
stamp = re.compile(r'<time="([^"]+)" date="([^"]+)"')
def incomplete(artifact):
return (
artifact["captureState"] != "captured"
or artifact["rotation"].get("fragmentComplete") is False
)
def reason(artifact):
if artifact["captureState"] in request_reason:
return request_reason[artifact["captureState"]]
if artifact["rotation"].get("fragmentComplete") is False:
return "coverageRotationSplit"
return None
def ccm_fields(line):
match = envelope.search(line)
if not match:
return None
parts = [part.strip() for part in match.group(1).split(";")]
if not parts or parts[0] != "SYNTHETIC FIXTURE":
return None
try:
return dict(part.split("=", 1) for part in parts[1:])
except ValueError:
return None
for directory in sorted(path for path in root.iterdir() if path.is_dir()):
scenario = directory.name
manifest = json.loads((directory / "manifest.json").read_text())
expected = json.loads((directory / "expected.json").read_text())
artifacts = {item["artifactId"]: item for item in manifest["artifacts"]}
captured = datetime.strptime(manifest["bundle"]["capturedUtc"], "%Y-%m-%dT%H:%M:%SZ")
if expected["stateChain"] != state_chain or not all(isinstance(x, str) for x in expected["stateChain"]):
problems.append(f"{scenario}: invalid stateChain")
handles = manifest["topology"]["distributionPointHandles"]
if handles != sorted(handles) or len(handles) != len(set(handles)):
problems.append(f"{scenario}: unordered or duplicate DP topology")
paths = set()
fingerprints = set()
raw_logical = set()
for aid, artifact in artifacts.items():
if artifact["pathFingerprint"].casefold() in fingerprints:
problems.append(f"{scenario}/{aid}: fingerprint collision")
fingerprints.add(artifact["pathFingerprint"].casefold())
if artifact["captureState"] in physical_states:
rel = artifact["relativePath"]
if rel.casefold() in paths:
problems.append(f"{scenario}/{aid}: evidence destination collision")
paths.add(rel.casefold())
data = (directory / rel).read_bytes()
if len(data) != artifact["bytesCopied"]:
problems.append(f"{scenario}/{aid}: bytesCopied mismatch")
lines = data.decode("utf-8").splitlines()
if artifact["captureState"] in {"captured", "capped"} and artifact["rotation"]["fragmentComplete"]:
for n, line in enumerate(lines, 1):
if ccm_fields(line) is not None:
raw_logical.add((aid, n, n))
consumed = set()
seen_obs = set()
for transaction in expected["transactions"]:
key = transaction["key"]
if key["distributionPointHandle"] not in handles:
problems.append(f"{scenario}/{transaction['transactionId']}: DP outside topology")
previous_time = None
for observation in transaction["observations"]:
oid = observation["observationId"]
if oid in seen_obs:
problems.append(f"{scenario}: duplicate observation ID {oid}")
seen_obs.add(oid)
for ref in observation["evidence"]:
marker = (ref["artifactId"], ref["startLine"], ref["endLine"])
if marker in consumed:
problems.append(f"{scenario}: reused transaction evidence {marker}")
consumed.add(marker)
artifact = artifacts.get(ref["artifactId"])
if artifact is None or artifact["producerRole"] == "client":
problems.append(f"{scenario}/{oid}: invalid transaction artifact")
continue
line = (directory / artifact["relativePath"]).read_text().splitlines()[ref["startLine"] - 1]
fields = ccm_fields(line)
if fields is None:
problems.append(f"{scenario}/{oid}: non-CCM transaction reference")
continue
required = {
"PackageId": key["packageId"],
"ContentId": key["contentId"],
"ContentVersion": str(key["contentVersion"]),
"SiteCode": key["siteCode"],
"DpHandle": key["distributionPointHandle"],
"ProfileId": key["extractionProfileId"],
"Phase": observation["phase"],
"Disposition": observation["disposition"],
"Terminal": str(observation["terminal"]).lower(),
}
if any(fields.get(name) != value for name, value in required.items()):
problems.append(f"{scenario}/{oid}: exact evidence-field mismatch")
match = stamp.search(line)
if match:
event_time = datetime.strptime(
f"{match.group(2)}T{match.group(1)[:-4]}",
"%m-%d-%YT%H:%M:%S.%f",
)
if event_time > captured:
problems.append(f"{scenario}/{oid}: evidence after bundle capture")
if previous_time is not None and event_time < previous_time:
problems.append(f"{scenario}/{transaction['transactionId']}: evidence time regressed")
previous_time = event_time
for observation in expected["sourceLocalObservations"]:
oid = observation["observationId"]
if oid in seen_obs:
problems.append(f"{scenario}: duplicate source-local ID {oid}")
seen_obs.add(oid)
cited = set()
for ref in observation["evidence"]:
marker = (ref["artifactId"], ref["startLine"], ref["endLine"])
if marker in consumed:
problems.append(f"{scenario}: cross-class evidence reuse {marker}")
consumed.add(marker)
cited.add(ref["artifactId"])
if cited != set(observation["artifactIds"]):
problems.append(f"{scenario}/{oid}: source-local artifact/evidence mismatch")
if raw_logical != consumed:
problems.append(
f"{scenario}: normalized logical consumption mismatch "
f"unconsumed={sorted(raw_logical-consumed)!r} nonlogical={sorted(consumed-raw_logical)!r}"
)
actual_requests = [(row["sourceId"], row["reasonCode"]) for row in expected["artifactRequests"]]
expected_requests = sorted({
(artifact["sourceId"], reason(artifact))
for artifact in artifacts.values()
if artifact["producerRole"] != "client" and reason(artifact) is not None
})
if actual_requests != expected_requests:
problems.append(f"{scenario}: artifact-request projection mismatch")
for transaction in expected["transactions"]:
gaps = transaction["coverageGapArtifactIds"]
dp = transaction["key"]["distributionPointHandle"]
required_gaps = sorted(
aid for aid, artifact in artifacts.items()
if artifact["sourceId"] == "server-dp-distribution"
and incomplete(artifact)
and (
artifact.get("workflowSubjectHandle") == dp
or (
artifact.get("workflowSubjectHandle") is None
and artifact.get("workflowSubjectBasis") == "manifestTopology"
and artifact["producerRole"] == "siteServer"
)
)
)
if sorted(gaps) != required_gaps:
problems.append(f"{scenario}/{transaction['transactionId']}: exact DP gap mismatch")
if expected["clientCausalClaims"] != []:
problems.append(f"{scenario}: client causal claims present")
print(f"scenarios={len([p for p in root.iterdir() if p.is_dir()])}")
print(f"problems={len(problems)}")
print("\n".join(problems) if problems else "none")
PY
echo '=== latest-outcome regression test definitions ==='
sed -n '3315,3390p' "$contract"Length of output: 46072 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='4f8bd3b6e89ab208932446756ed6a29596f8da4c'
contract='crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs'
root='crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point'
echo '=== corrected normalized-versus-physical evidence audit ==='
python3 - <<'PY'
import json, re
from pathlib import Path
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
ccm = re.compile(r'<!\[LOG\[(.*?)\]LOG\]!>')
problems = []
def is_ccm(line):
match = ccm.search(line)
return bool(match and match.group(1).split(";", 1)[0].strip() == "SYNTHETIC FIXTURE")
for directory in sorted(path for path in root.iterdir() if path.is_dir()):
manifest = json.loads((directory / "manifest.json").read_text())
expected = json.loads((directory / "expected.json").read_text())
artifacts = {item["artifactId"]: item for item in manifest["artifacts"]}
normalized = set()
physical = set()
for aid, artifact in artifacts.items():
if artifact["captureState"] not in {"captured", "capped", "parseFailed"}:
continue
lines = (directory / artifact["relativePath"]).read_text().splitlines()
for line_no, line in enumerate(lines, 1):
physical.add((aid, line_no, line_no))
if (
artifact["captureState"] in {"captured", "capped"}
and artifact["rotation"]["fragmentComplete"] is True
and is_ccm(line)
):
normalized.add((aid, line_no, line_no))
transaction_refs = {
(ref["artifactId"], ref["startLine"], ref["endLine"])
for txn in expected["transactions"]
for obs in txn["observations"]
for ref in obs["evidence"]
}
source_local_refs = {
(ref["artifactId"], ref["startLine"], ref["endLine"])
for obs in expected["sourceLocalObservations"]
for ref in obs["evidence"]
}
if transaction_refs - normalized:
problems.append(f"{directory.name}: transaction references outside normalized evidence")
if normalized - transaction_refs:
problems.append(f"{directory.name}: normalized evidence lacks a transaction reference")
if source_local_refs - physical:
problems.append(f"{directory.name}: source-local references outside physical evidence")
if transaction_refs & source_local_refs:
problems.append(f"{directory.name}: evidence is reused across output classes")
print(f"scenarios={len([p for p in root.iterdir() if p.is_dir()])}")
print(f"problems={len(problems)}")
print("\n".join(problems) if problems else "none")
PY
echo '=== raw fixture boundary scan ==='
if rg -n -i \
-e 'realuser|realrequest|real\.user@example\.com|secret=|C:\\\\Users|/home/|@[^ ]+' \
"$root" -g '*.log' -g '*.json' -g '*.md'
then
exit 1
else
echo 'no prohibited identity, secret, or local-path marker found'
fi
echo '=== exact-head whitespace check ==='
git diff --check 'a8a367c661cd17bd1e73b87724c143ec8565ffc7' "$head"
echo '=== correction commit metadata ==='
git show -s --format='commit=%H%nparent=%P%nsubject=%s' "$head"Length of output: 3782
I found no new actionable issues. The latest-observation correction is structurally closed.
I rechecked the full contract boundary.
The schema-aligned audit covered all ten scenarios. The only intermediate audit note was expected: I could not execute Rust tests, Clippy, WASM, TypeScript, or formatting commands in this sandbox. ✅ Action performedReview finished.
|
CodeRabbit exact-head gate passedHosted CodeRabbit completed a substantive static review of exact It specifically verified both latest-observation guards, the two permanent regressions, exact key/evidence binding, normalized-record consumption, coverage and bounded requests, rotation, privacy, deterministic ordering, and the ten-scenario corpus. The local executable gates remain 43/43 focused and 772/772 parser-wide. PR stays draft/open. The remaining gate is a different independent exact-head PASS. #333 remains blocked. |
|
Independent exact-head review is active for draft PR #374 at 4f8bd3b against a8a367c in fresh detached worktree .worktrees/review-329-4f8b-exact. This is review/probe-only: no implementation edits, commits, or pushes. Scope covers latest same-key outcome semantics in both directions, terminal evidence, exact keys/profile/topology, coverage non-outcomes, deterministic evidence and observation identities, privacy/bounds, synthetic-only provenance, parser purity/wasm, and #333 counterpart readiness without time-only causation. Focused 43 tests plus aggregate/static/adversarial probes and a formal exact-head PASS or BLOCK will follow. |
adamgell
left a comment
adamgell
left a comment
There was a problem hiding this comment.
Independent exact-head review — BLOCKED
Reviewed exact 4f8bd3b against a8a367c in a fresh clean detached worktree. GitHub does not permit the authenticated repository owner to request changes on the owner PR, so this COMMENTED review records the same semantic BLOCK disposition.
One disposable executable probe remains RED. Starting from healthy-package, it appends a physically later same-key serveOrReport/retrying/nonterminal line after the terminal success but gives it the exact same normalized UTC. By assigning the safe ID 05-report-retry, inserting it before 06-report, and citing every normalized record, the validator returns Ok while retaining succeeded/success/high. The order check accepts equal UTC, and latest_outcome therefore follows caller-controlled observation-ID order instead of immutable evidence provenance. This violates the documented timestamp-order contract and lets stale high success survive a later physical retry.
Fresh exact-head gates are otherwise green: focused #329 43/43; server intake 1/1; spine 136/136; full parser pass; strict all-target Clippy; Rust 1.88.0 wasm32; frontend TypeScript/Vite build; 20/20 JSON files; 22/22 synthetic logs with the privacy-marker scan clean; scoped rustfmt; feature-range diff check; detached status clean. Repository-wide cargo fmt check reports 17 inherited files with zero #329 range overlap.
Hosted CodeRabbit posted a substantive exact-head CLEAN at #374 (comment), but its static analysis did not exercise this equal-time physical-order mutation. Keep PR #374 draft/open. Add a permanent red-to-green regression and a fail-closed immutable tie-order rule, rerun all gates, obtain fresh final-head CodeRabbit, then request a different independent review. #333 content-to-DP remains blocked; this review claims no production reducer, native collection, merge readiness, or live Windows acceptance.
Correction claim — equal-UTC ordering P1I am implementing the isolated TDD correction from exact 4f8bd3b on codex/sccm-329-4f8-equal-utc-fix. Owned file is the #329 distribution-point fixture contract only; fixtures will be temporary unless a permanent synthetic scenario addition is required. Order: commit permanent failing same-artifact retry/recovery and cross-artifact ambiguity regressions; implement the smallest immutable provenance ordering or fail-closed ambiguity rule; run focused plus aggregate Rust/Clippy/wasm/frontend/static gates; guard remote exact head; push non-force; reply and resolve the P1; request fresh substantive CodeRabbit. This does not authorize production reducer/correlation/native code or #333 advancement. |
Equal-UTC ordering correction pushed — exact b45c4b6The P1 executable blocker is corrected with an issue-scoped red/green pair:
The remote branch and PR head were guarded at exact 4f8bd3b before a non-force push. The P1 thread was replied to and resolved: #374 (comment). Fresh verification at exact b45c4b6:
Local CodeRabbit CLI 0.7.1 was authenticated but rate-limited for three minutes and is not counted as approval. A fresh substantive hosted exact-head review is being requested separately. Keep this PR draft/open; no production reducer, native collection, correlation, merge readiness, or live Windows validation is claimed. #333 content-to-DP remains blocked pending fresh CodeRabbit and a different independent exact-head PASS. |
|
@coderabbitai review Please perform a fresh substantive exact-head review of b45c4b6. Review the correction range 4f8bd3b..b45c4b6 in the context of the full #329 range from a8a367c. Focus on the permanent RED/GREEN contract: equal normalized UTC must use immutable same-artifact forward line provenance; caller-controlled observation IDs must not choose the latest outcome; cross-artifact and current/rollback ties must fail closed; later retry cannot retain stale high success; later recovery cannot retain stale high failure; and valid same-artifact forward ties remain usable. Recheck exact package/content/version/site/DP/profile binding, terminal proof, coverage non-outcomes, deterministic identity/order, privacy/synthetic-only boundaries, parser purity/wasm compatibility, and #333 handoff without time-only causal claims. Please report actionable issues against this exact SHA. A skipped, status-only, or prior-head review is not approval. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='a8a367c661cd17bd1e73b87724c143ec8565ffc7'
previous='4f8bd3b6e89ab208932446756ed6a29596f8da4c'
head='b45c4b610d001f6f0540d722212643cdc66b0a4e'
contract='crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs'
root='crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point'
doc='docs/sccm/preparation/issue-329-distribution-point-corpus.md'
for commit in "$base" "$previous" "$head"; do
git cat-file -e "${commit}^{commit}"
done
echo '=== exact commits ==='
git show -s --format='base=%H%nsubject=%s' "$base"
git show -s --format='previous=%H%nparents=%P%nsubject=%s' "$previous"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
echo '=== ancestry ==='
git merge-base --is-ancestor "$base" "$head" && echo 'base is an ancestor of head'
git merge-base --is-ancestor "$previous" "$head" && echo 'previous head is an ancestor of head'
echo '=== correction range ==='
git diff --name-status "$previous" "$head"
git diff --stat "$previous" "$head"
git diff --no-ext-diff --unified=70 "$previous" "$head" -- "$contract"
echo '=== full feature range ==='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo '=== full-range paths outside declared scope ==='
git diff --name-only "$base" "$head" |
awk -v contract="$contract" -v root="$root" -v doc="$doc" '
$0 == contract || $0 == doc || index($0, root "/") == 1 { next }
{ print }
'
echo '=== contract outline ==='
ast-grep outline "$contract" --items all
echo '=== ordering and contract control locations ==='
rg -n -C 10 --type rust \
'equal|timestamp|collectedUtc|ordered|order|latest|newest|observationId|evidence_for|physical_evidence_for|startLine|endLine|terminal|ServeOrReport|retrying|blockedOrDeferred|coverageGapArtifactIds|artifactRequests|nextSourceId|rotationSplit|distributionPointHandle|extractionProfileId|rolesObserved|distributionPointObserved|ClientHandle|RequestId|identity|synthetic|mutation' \
"$contract"
echo '=== targeted validation sections ==='
cat -n "$contract" | sed -n '850,2300p'
echo '=== targeted regression sections ==='
cat -n "$contract" | sed -n '3000,3800p'
echo '=== source normalizer references ==='
rg -n -C 4 --type rust '\bnormalize_ccm_artifact\s*\(' crates/cmtraceopen-parserLength of output: 135586 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='a8a367c661cd17bd1e73b87724c143ec8565ffc7'
previous='4f8bd3b6e89ab208932446756ed6a29596f8da4c'
head='b45c4b610d001f6f0540d722212643cdc66b0a4e'
contract='crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs'
root='crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point'
echo '=== concise correction diff ==='
git diff --no-ext-diff --unified=35 "$previous" "$head" -- "$contract"
echo '=== helper definitions and evidence-reference validation ==='
rg -n -C 8 --type rust \
'^fn (required_bool|required_array|required_string|required_nonempty_string|evidence_reference_key|artifact_has_incomplete_coverage|artifact_applies_to_distribution_point|coverage_request_reason|phase_allowed_for_artifact|raw_fixture_bytes_are_sanitized)' \
"$contract"
cat -n "$contract" | sed -n '1,180p'
cat -n "$contract" | sed -n '360,850p'
cat -n "$contract" | sed -n '1450,1725p'
echo '=== observation evidence cardinality in committed fixtures ==='
python3 - <<'PY'
import json
from pathlib import Path
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
for directory in sorted(path for path in root.iterdir() if path.is_dir()):
expected = json.loads((directory / "expected.json").read_text())
for transaction in expected["transactions"]:
for observation in transaction["observations"]:
refs = observation["evidence"]
if len(refs) != 1:
print(directory.name, transaction["transactionId"], observation["observationId"], len(refs))
PY
echo '=== schema-aligned fixture audit ==='
python3 - <<'PY'
import json, re
from collections import defaultdict
from datetime import datetime
from pathlib import Path
root = Path("crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point")
ccm = re.compile(r'<!\[LOG\[(.*?)\]LOG\]!>')
timestamp = re.compile(r'<time="([^"]+)" date="([^"]+)"')
problems = []
synthetic_marker = "SYNTHETIC FIXTURE"
def fields_for(line):
match = ccm.search(line)
if not match:
return None
parts = [part.strip() for part in match.group(1).split(";")]
if not parts or parts[0] != synthetic_marker:
return None
try:
return dict(part.split("=", 1) for part in parts[1:])
except ValueError:
return None
def utc_for(line):
match = timestamp.search(line)
if not match or not match.group(1).endswith("+000"):
return None
return datetime.strptime(
f"{match.group(2)}T{match.group(1)[:-4]}", "%m-%d-%YT%H:%M:%S.%f"
)
def incomplete(artifact):
return artifact["captureState"] != "captured" or artifact["rotation"].get("fragmentComplete") is False
def reason(artifact):
return {
"absent": "coverageAbsent",
"accessDenied": "coverageAccessDenied",
"capped": "coverageCapped",
"parseFailed": "coverageMalformed",
}.get(artifact["captureState"]) or (
"coverageRotationSplit"
if artifact["captureState"] in {"captured", "capped"}
and artifact["rotation"].get("fragmentComplete") is False
else None
)
for directory in sorted(path for path in root.iterdir() if path.is_dir()):
manifest = json.loads((directory / "manifest.json").read_text())
expected = json.loads((directory / "expected.json").read_text())
artifacts = {item["artifactId"]: item for item in manifest["artifacts"]}
capture = datetime.strptime(manifest["bundle"]["capturedUtc"], "%Y-%m-%dT%H:%M:%SZ")
used, normalized, seen_ids = set(), set(), set()
for aid, artifact in artifacts.items():
if artifact["captureState"] not in {"captured", "capped", "parseFailed"}:
continue
path = directory / artifact["relativePath"]
raw = path.read_text()
if "SYNTHETIC FIXTURE" not in raw:
problems.append(f"{directory.name}/{aid}: missing synthetic marker")
for line_no, line in enumerate(raw.splitlines(), 1):
parsed = fields_for(line)
if parsed and artifact["captureState"] in {"captured", "capped"} and artifact["rotation"].get("fragmentComplete") is True:
normalized.add((aid, line_no, line_no))
for txn in expected["transactions"]:
key = txn["key"]
last_utc = None
last_ref = None
for obs in txn["observations"]:
oid = obs["observationId"]
if oid in seen_ids:
problems.append(f"{directory.name}: duplicate observation ID {oid}")
seen_ids.add(oid)
for ref in obs["evidence"]:
marker = (ref["artifactId"], ref["startLine"], ref["endLine"])
if marker in used:
problems.append(f"{directory.name}: reused evidence {marker}")
used.add(marker)
artifact = artifacts.get(ref["artifactId"])
if not artifact:
problems.append(f"{directory.name}/{oid}: unknown artifact")
continue
try:
line = (directory / artifact["relativePath"]).read_text().splitlines()[ref["startLine"] - 1]
except (KeyError, IndexError):
problems.append(f"{directory.name}/{oid}: unreadable cited line")
continue
fields = fields_for(line)
current = utc_for(line)
if fields is None or current is None:
problems.append(f"{directory.name}/{oid}: invalid cited CCM line")
continue
required = {
"PackageId": key["packageId"], "ContentId": key["contentId"],
"ContentVersion": str(key["contentVersion"]), "SiteCode": key["siteCode"],
"DpHandle": key["distributionPointHandle"], "ProfileId": key["extractionProfileId"],
"Phase": obs["phase"], "Disposition": obs["disposition"],
"Terminal": str(obs["terminal"]).lower(),
}
if any(fields.get(name) != value for name, value in required.items()):
problems.append(f"{directory.name}/{oid}: exact key or outcome mismatch")
if current > capture:
problems.append(f"{directory.name}/{oid}: evidence after capture")
if last_utc is not None and current < last_utc:
problems.append(f"{directory.name}/{txn['transactionId']}: timestamp regresses")
if last_utc == current and (
ref["artifactId"] != last_ref[0] or ref["startLine"] <= last_ref[2]
):
problems.append(f"{directory.name}/{txn['transactionId']}: equal UTC lacks forward same-artifact provenance")
last_utc, last_ref = current, marker
for obs in expected["sourceLocalObservations"]:
oid = obs["observationId"]
if oid in seen_ids:
problems.append(f"{directory.name}: duplicate source-local ID {oid}")
seen_ids.add(oid)
cited = set()
for ref in obs["evidence"]:
marker = (ref["artifactId"], ref["startLine"], ref["endLine"])
if marker in used:
problems.append(f"{directory.name}: reused source-local evidence {marker}")
used.add(marker)
cited.add(ref["artifactId"])
if cited != set(obs["artifactIds"]):
problems.append(f"{directory.name}/{oid}: source-local artifact closure mismatch")
if normalized != {ref for ref in used if ref in normalized}:
problems.append(f"{directory.name}: normalized records are not consumed exactly")
expected_requests = sorted({
(artifact["sourceId"], reason(artifact))
for artifact in artifacts.values()
if artifact["producerRole"] != "client" and reason(artifact) is not None
})
actual_requests = [(item["sourceId"], item["reasonCode"]) for item in expected["artifactRequests"]]
if actual_requests != expected_requests:
problems.append(f"{directory.name}: artifact request projection mismatch")
for txn in expected["transactions"]:
dp = txn["key"]["distributionPointHandle"]
expected_gaps = sorted(
aid for aid, artifact in artifacts.items()
if artifact["sourceId"] == "server-dp-distribution"
and incomplete(artifact)
and (
artifact.get("workflowSubjectHandle") == dp
or (
artifact.get("workflowSubjectHandle") is None
and artifact.get("workflowSubjectBasis") == "manifestTopology"
and artifact["producerRole"] == "siteServer"
)
)
)
if txn["coverageGapArtifactIds"] != expected_gaps:
problems.append(f"{directory.name}/{txn['transactionId']}: DP-bound gap mismatch")
if expected["clientCausalClaims"] != []:
problems.append(f"{directory.name}: client causal claims exist")
print(f"scenarios={len([p for p in root.iterdir() if p.is_dir()])}")
print(f"problems={len(problems)}")
print("\n".join(problems) if problems else "none")
PY
echo '=== raw synthetic-fixture boundary scan ==='
if rg -n -i \
-e 'realuser|realrequest|real\.user@example\.com|secret=|C:\\Users|/home/|@[^ ]+' \
"$root" -g '*.log' -g '*.json' -g '*.md'
then
exit 1
else
echo 'no prohibited identity, secret, local-path, or email marker found'
fi
echo '=== exact-head diff whitespace check ==='
git diff --check "$base" "$head"Length of output: 80840
I found no new actionable issues. The equal-UTC correction is structurally closed.
The permanent regressions cover the requested cases.
I also rechecked the full fixture-contract boundary.
The schema-aligned audit covered all 10 scenarios. It reported zero problems. I could not run Rust tests, Clippy, WASM, TypeScript, or formatting commands in this sandbox. ✅ Action performedReview finished.
|
Hosted CodeRabbit exact-head gate — CLEANCodeRabbit completed a substantive static review of exact b45c4b6 and found no new actionable issues: #374 (comment). It checked the full a8a367c..b45c4b6 feature range and the 4f8bd3b..b45c4b6 correction range, including all five equal-UTC provenance cases, latest-outcome behavior, exact keys/profile/topology, terminal proof, coverage/request boundaries, synthetic/privacy constraints, and the noncausal #333 handoff. CodeRabbit could not execute Rust/wasm/frontend commands; the separately reported local gate supplies those passing results. This satisfies the hosted-review request, not final readiness. Keep the PR draft/open and #333 blocked until a different independent reviewer posts an exact-head PASS or BLOCK. |
|
Independent no-edit exact-head review active for I verified PR #374 is OPEN/draft and still points to this exact SHA. Review owns no implementation files and will not edit, commit, or push. Scope: full #329 DP/content contract plus the equal-UTC provenance correction; exact keys, identity collisions, rotation splits, topology/version/timestamp provenance, terminal evidence, coverage conservatism, privacy, deterministic serialization/reordering, pure Rust/wasm boundaries, focused/aggregate gates, and hosted CodeRabbit state. A formal exact-SHA PASS or BLOCK will follow. |
adamgell
left a comment
adamgell
left a comment
There was a problem hiding this comment.
INDEPENDENT EXACT-HEAD REVIEW: PASS
Reviewed fresh detached head b45c4b610d001f6f0540d722212643cdc66b0a4e against base a8a367c661cd17bd1e73b87724c143ec8565ffc7; local, fetched remote, and PR head all matched immediately before this result. No edits or pushes were made.
Findings: none actionable.
Substantive checks:
- full #329 DP/content source contract, role/topology provenance, coverage ceilings, deterministic expected output, and synthetic fixture safety;
- corrected equal-UTC logic: a later physical line range is accepted only within the same artifact, while cross-artifact and cross-rotation ties fail closed;
- absent, incomplete, capped, malformed, client-only-looking, content-version mismatch, rotation-boundary, transfer-retry, validation-failure, distribution-failure, healthy, and serve-observed cases;
- no time-only or cross-side causal correlation is implemented or claimed.
Reproduced verification: focused #329 48/48; server intake 1/1; spine 136/136; parser aggregate 777/777; strict Clippy; Rust 1.88 wasm32; TypeScript; production build; 20/20 JSON; 22 synthetic logs; scoped rustfmt; git diff --check; sanitized fixture/preparation privacy scan. The production build emitted only the inherited ineffective dynamic-import warning. Global workspace fmt remains inherited outside this issue. Hosted CodeRabbit substantive exact-head review is also clean: #374 (comment)
Residual gates: this remains a preparation/source-contract PR. Production reducer work waits on stable #318/#335 interfaces; #333 correlation remains gated on stable source facts. Native Windows/lab acceptance has not been exercised and is not claimed. Keep the PR draft/open until those dependency and owner merge gates are intentionally handled.
There was a problem hiding this comment.
Pull request overview
This PR adds a synthetic SCCM Server Distribution Point (DP) fixture corpus and a focused Rust fixture-contract test to validate provenance, topology, keying, coverage states, deterministic ordering, and conservative outcome rules for Issue #329 preparation (without adding any production reducer or collector logic).
Changes:
- Added a 10-scenario synthetic DP/content evidence corpus (manifests, expected labels, and synthetic CCM log evidence).
- Added a Rust fixture-contract test that normalizes evidence through the existing CCM logical-record envelope and fail-closes on adversarial mutations.
- Added preparation documentation describing the intended contract boundaries and semantics.
Reviewed changes
Copilot reviewed 22 out of 45 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| docs/sccm/preparation/issue-329-distribution-point-corpus.md | Documents the intended DP corpus contract, boundaries, and semantics for #329 preparation. |
| crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs | Fixture-contract test validating DP corpus inputs/outputs, provenance, and fail-closed mutations. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/README.md | Describes the DP synthetic fixture corpus and its interpretation. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/absent-dp/expected.json | Expected output label for the absent-dp scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/absent-dp/manifest.json | Manifest describing declared artifacts/topology for the absent-dp scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/client-only-looking-request/expected.json | Expected output label for the client-only-looking-request scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/client-only-looking-request/manifest.json | Manifest describing declared artifacts/topology for the client-only-looking-request scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/client-only-looking-request/evidence/client-content-control/current/DataTransferService.log | Synthetic client control evidence used to ensure client-only lookalikes are ignored server-side. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/expected.json | Expected output label for the content-version-mismatch multi-DP/multi-version scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/manifest.json | Manifest describing multi-DP topology and artifact provenance for content-version-mismatch. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/evidence/server-dp-distribution/dp-02/current/SMSDPProv.log | Synthetic DP02 provider evidence for content-version-mismatch. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/evidence/server-dp-distribution/dp/current/SMSDPProv.log | Synthetic DP01 provider evidence for content-version-mismatch. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/evidence/server-dp-distribution/site/current/PkgXferMgr.log | Synthetic site transfer evidence for content-version-mismatch. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/content-version-mismatch/evidence/server-dp-distribution/site/current/distmgr.log | Synthetic site receive/distribute evidence for content-version-mismatch. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/distribution-failure/expected.json | Expected output label for the distribution-failure scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/distribution-failure/manifest.json | Manifest describing declared artifacts/topology for the distribution-failure scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/distribution-failure/evidence/server-dp-distribution/site/current/distmgr.log | Synthetic site evidence for the distribution-failure scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/healthy-package/expected.json | Expected output label for the healthy-package scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/healthy-package/manifest.json | Manifest describing declared artifacts/topology for the healthy-package scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/healthy-package/evidence/server-dp-distribution/dp/current/SMSDPProv.log | Synthetic DP provider evidence for the healthy-package scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/healthy-package/evidence/server-dp-distribution/site/current/PkgXferMgr.log | Synthetic site transfer evidence for the healthy-package scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/healthy-package/evidence/server-dp-distribution/site/current/distmgr.log | Synthetic site receive/distribute evidence for the healthy-package scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/incomplete/expected.json | Expected output label for the incomplete scenario (coverage-gap driven). |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/incomplete/manifest.json | Manifest describing incomplete coverage states for the incomplete scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/incomplete/evidence/server-dp-distribution/site/current/distmgr.log | Synthetic site evidence for the incomplete scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/rotation-boundary/expected.json | Expected output label for the rotation-boundary scenario (fragments/malformed). |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/rotation-boundary/manifest.json | Manifest describing rotation fragment/malformed capture states for rotation-boundary. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/rotation-boundary/evidence/server-dp-distribution/dp/malformed/SMSDPProv.log | Synthetic malformed DP provider evidence for rotation-boundary. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/rotation-boundary/evidence/server-dp-distribution/site/current/distmgr.log | Synthetic current fragment evidence for rotation-boundary. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/rotation-boundary/evidence/server-dp-distribution/site/lo_/distmgr.log | Synthetic .lo_ fragment evidence for rotation-boundary. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/serve-observed/expected.json | Expected output label for the serve-observed scenario (supplemental serve evidence). |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/serve-observed/manifest.json | Manifest describing supplemental bounded serving source for serve-observed. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/serve-observed/evidence/server-dp-distribution/dp/current/SMSDPProv.log | Synthetic DP provider evidence for serve-observed. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/serve-observed/evidence/server-dp-distribution/site/current/PkgXferMgr.log | Synthetic site transfer evidence for serve-observed. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/serve-observed/evidence/server-dp-distribution/site/current/distmgr.log | Synthetic site receive/distribute evidence for serve-observed. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/serve-observed/evidence/server-dp-serve/dp/current/SMSdpmon.log | Synthetic bounded DP serving/status evidence for serve-observed. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/transfer-retry/expected.json | Expected output label for the transfer-retry scenario (deferred/retrying). |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/transfer-retry/manifest.json | Manifest describing declared artifacts/topology for the transfer-retry scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/transfer-retry/evidence/server-dp-distribution/site/current/PkgXferMgr.log | Synthetic transfer evidence for the transfer-retry scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/transfer-retry/evidence/server-dp-distribution/site/current/distmgr.log | Synthetic receive/distribute evidence for the transfer-retry scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/validation-failure/expected.json | Expected output label for the validation-failure scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/validation-failure/manifest.json | Manifest describing declared artifacts/topology for the validation-failure scenario. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/validation-failure/evidence/server-dp-distribution/dp/current/SMSDPProv.log | Synthetic provider validation-failure evidence for validation-failure. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/validation-failure/evidence/server-dp-distribution/site/current/PkgXferMgr.log | Synthetic transfer evidence for validation-failure. |
| crates/cmtraceopen-parser/tests/fixtures/sccm/server/distribution_point/validation-failure/evidence/server-dp-distribution/site/current/distmgr.log | Synthetic receive/distribute evidence for validation-failure. |
| - `manifest.json` records physical producer, workflow subject, coverage, | ||
| rotation, bounded path, encoding, and exact byte-count provenance. |
| - rotation kind, nonempty typed lineage, and typed fragment completeness for | ||
| physical captures; | ||
| - capture state, collection timestamp, encoding, byte policy, exact copied | ||
| byte count, and bounded relative evidence path; and |
Issue
Preparation slice for #329 under epic #317. This PR intentionally does not close the issue.
Scope
No production reducer, native collector, shared SCCM model edit, new parser kind, IIS tree scan, cross-side correlation, or live Windows claim is included.
TDD evidence
collectionLimitprovenance;Fixture matrix
Corpus totals: 10 scenarios, 27 physical artifacts, 22 synthetic evidence files, 13,934 evidence bytes.
Verification at exact head
cargo test --locked -p cmtraceopen-parser --test sccm_server_distribution_point_fixture_contract— 8/8cargo test --locked -p cmtraceopen-parser --test sccm_server_intake_fixture_contract— 1/1cargo test --locked -p cmtraceopen-parser— 662/662cargo clippy --locked -p cmtraceopen-parser --all-targets -- -D warnings— passcargo +1.88.0 check --locked -p cmtraceopen-parser --target wasm32-unknown-unknown— passnpx tsc --noEmit— passrustfmt +1.88.0 --check crates/cmtraceopen-parser/tests/sccm_server_distribution_point_fixture_contract.rs— passjq empty— passgit diff --check— passRepository-wide
cargo fmt --check --allcontinues to report only pre-existing ESP/Tauri formatting drift outside this exact diff; no unrelated file is retained in the branch.Dependency and review state
The production reducer remains gated on the corrected/reviewed #318 finding API in draft PR #353, the applicable #335/#319 intake contracts, restacking to the live base, and eventual native Windows validation. This PR remains draft.
Prior substantive CodeRabbit findings for producer-host/subject separation, source-local classification semantics, and nonphysical collection-limit provenance are now covered by permanent tests. Fresh substantive exact-head CodeRabbit and independent adversarial review are required before this preparation slice can advance.
Exact head submitted:
d07ab1575d2d5a4360dc0f606064b8dbc6525170.Summary by CodeRabbit
Documentation
Tests