test: align release and risk documentation contracts

[mohanagy]

Closes #163
Closes #164

Why

A fresh CodeRabbit review of promotion PR #140 found two release-review gaps: the v0.3.2 contract did not protect the #142 release note, and docs/config.md listed trusted annotations before the fixed PostHog adapter despite runtime precedence being the reverse.

Change

• Adds a bug: give PostHog command metadata precedence over static read-only hints #142 changelog assertion to the existing v0.3.2 release contract.
• Adds a focused documentation-order contract.
• Corrects only the documented order to match classifyToolRisk(); no runtime policy behavior changes.

TDD evidence

• The existing focused suites passed after a controlled removal of trusted from the bug: give PostHog command metadata precedence over static read-only hints #142 release note and with the incorrect documentation order.
• The new tests failed exactly on the missing release assertion and reversed docs step.
• Restoring canonical changelog text and reordering docs makes the focused suite pass.

Validation

• npx vitest run tests/release-version.test.ts tests/risk-classification-docs-contract.test.ts tests/risk-classifier.test.ts --reporter=dot
• npm run lint
• npm run typecheck

Summary by CodeRabbit

• Documentation

  • Updated risk-classification guidance so trusted PostHog command handling takes precedence over generic MCP tool annotations.

• Tests

  • Added coverage to verify the documented classification order remains aligned with runtime behavior.
  • Enhanced release artifact checks for trusted PostHog command metadata.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 21 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a6609e9e-df02-4a78-8cb3-ca8613fd7fda

📥 Commits

Reviewing files that changed from the base of the PR and between 4d37e5b and 3ff8855.

📒 Files selected for processing (1)

• tests/release-version.test.ts

📝 Walkthrough

Walkthrough

The documentation now places fixed PostHog command classification before trusted MCP annotations. Contract tests verify this ordering and require the corresponding trusted command metadata wording in the v0.3.2 release notes.

Changes

Risk precedence contracts

Layer / File(s)	Summary
Documented precedence and release contracts docs/config.md, tests/risk-classification-docs-contract.test.ts, tests/release-version.test.ts	The PostHog adapter precedes trusted MCP annotations in the documented order, with tests validating that order and the corresponding v0.3.2 release-note entry.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• mohanagy/miftah#146: Verifies the same risk-classification precedence between trusted PostHog metadata and MCP annotations.
• mohanagy/miftah#155: Adds the related v0.3.2 release-note entry for the precedence change.
• mohanagy/miftah#133: Updates v0.3.2 release-note expectations for PostHog command metadata.

Poem

A rabbit hops through docs so neat,
PostHog takes its proper seat.
Tests guard the order bright,
Release notes shine just right.
“Sniff!” says Bun, “What a treat!”

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers the change and validation, but it omits the required Security impact section and does not follow the repository template.	Add the template's Summary and Security impact sections, and expand Validation with the required commands/results and checklist items.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately describes the main change set around release and risk documentation contracts.
Linked Issues check	✅ Passed	The PR adds the release-note assertion for #163 and reorders/docs-tests the risk-classification sequence for #164 without changing runtime behavior.
Out of Scope Changes check	✅ Passed	The changes stay within the linked documentation and test-contract updates and do not introduce unrelated code changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-163-164-release-review

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/release-version.test.ts`:
- Line 75: Update the release-notes assertion in the relevant test to verify
that “trusted PostHog command metadata” is explicitly described as taking
precedence over “generic static annotations,” rather than merely checking that
both phrases occur in order. Preserve the existing case-insensitive matching
behavior and assert the release contract’s precedence relationship directly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 17eeb3fe-8fc8-4085-809e-49f05bf641eb

📥 Commits

Reviewing files that changed from the base of the PR and between 3b8a682 and 4d37e5b.

📒 Files selected for processing (3)

• docs/config.md
• tests/release-version.test.ts
• tests/risk-classification-docs-contract.test.ts