[hyperpolymath]

Summary

CodeRabbit posted two findings on #125 that arrived as it merged. This PR fixes both.

Changes

• docs/vclt-gate-contract.adoc: the contract said the consumer "passes the path as argv[1]". The actual invocation is argv[1] = --input and argv[2] = the path, and a bare path is bad_invocation. A consumer written from the old wording would fail on every call.
• tests/gate_transport.rs: the parity test compared stdin with --input but never checked the verdict itself, so it would still pass if both transports were wrong in the same way. Each case now pins its expected exit code, checked against the built binary: admitted 0, rejected 1, bad version 2. The bad-version case also asserts unsupported_version.

RSR Quality Checklist

Required

• Tests pass: cargo test --test gate_transport passes 5/5.
• Code is formatted: my change is fmt-clean. rustfmt --check on gate_transport.rs still reports one diff, at line 135 in the schema test that docs,test(schema): clarify fixed OctadSchema contract and add VCLS/gate tests (#118) #128 added. It is on main and outside this change.
• Linter is clean: cargo clippy --all-targets produced no warnings.
• No banned language patterns
• No unsafe blocks
• No banned functions
• REUSE / licence check: not run. No new files.
• No secrets

As Applicable

• Documentation updated

Testing

cargo test --test gate_transport and cargo clippy --all-targets in src/interface/parse. asciidoctor -w is clean on the contract.

---

Generated by Claude Code

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7c9ae19a-0bd2-4f87-8f13-78c78390f94b

Commits

Reviewing files that changed from the base of the PR and between 19a923c and cd67522.

Files selected for processing: 2

• docs/vclt-gate-contract.adoc
• src/interface/parse/tests/gate_transport.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 23

• GitHub Check: attest — clippy / tests
• GitHub Check: Hypatia neurosymbolic scan
• GitHub Check: Dependency audit
• GitHub Check: ffi/zig — fmt / header / zig build test
• GitHub Check: analyze (actions, none)
• GitHub Check: recompute-wasm — clippy / tests
• GitHub Check: Validate eclexiaiser manifest
• GitHub Check: idris2 0.8.0 --build vclut-core
• GitHub Check: panic-attack assail
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Groove manifest check
• GitHub Check: Validate DEED manifests
• GitHub Check: idris2 0.8.0 --build vclut-abi
• GitHub Check: vcltotal-parse — panic-free / clippy / tests
• GitHub Check: Validate K9 contracts
• GitHub Check: semgrep-cloud-platform/scan
• GitHub Check: openssf-compliance
• GitHub Check: Aspect tests
• GitHub Check: Root workspace tests
• GitHub Check: Derive matrix from echidna provers.a2ml
• GitHub Check: E2E structural validation
• GitHub Check: license-policy
• GitHub Check: license-policy

CI failures not shown inline: 4

GitHub Actions: Static Analysis Gate / 1_Hypatia neurosymbolic scan.txt: fix(vclt-gate): state the --input argv positions; pin per-verdict exits

Conclusion: failure

View job details

##[group]Run set +e
 �[36;1mset +e�[0m
 �[36;1mHYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json�[0m
 �[36;1mHYP_EXIT=$?�[0m
 �[36;1mset -e�[0m
 �[36;1m�[0m
 �[36;1m# --exit-zero is Hypatia's own documented CI recipe (lib/hypatia/cli.ex),�[0m
 �[36;1m# for exactly this case: "use in CI when a downstream step gates on�[0m
 �[36;1m# severity counts". Findings go to stdout, the one-line summary to�[0m
 �[36;1m# stderr, and the process exits 0 unless the SCANNER itself failed.�[0m
 �[36;1m#�[0m
 �[36;1m# Do NOT redirect stderr into the payload with `2>&1`: that folds the�[0m
 �[36;1m# summary line into the JSON, so every parse fails, the old `[]`�[0m
 �[36;1m# fallback substituted a clean result, CRITICAL was always 0, and the�[0m
 �[36;1m# gate below could never fire on any input. Keep stderr on the log.�[0m
 �[36;1mif [ "$HYP_EXIT" -ne 0 ]; then�[0m
 �[36;1m  echo "::error::Hypatia scanner execution failed with exit ${HYP_EXIT}"�[0m
 �[36;1m  exit "$HYP_EXIT"�[0m
 �[36;1mfi�[0m
 �[36;1m# `jq empty` is NOT sufficient -- it succeeds on any valid JSON,�[0m
 �[36;1m# including a bare string, object or null. Assert the array.�[0m
 �[36;1mif [ ! -s hypatia-findings.json ] || ! jq -e 'type == "array"' hypatia-findings.json >/dev/null; then�[0m
 �[36;1m  echo "::error::Hypatia did not produce a valid JSON findings array"�[0m
...
 ##[group]Run # Findings carry no `.message` (keys: action,file,line,reason,rule_module,
...
 �[36;1m# workspace-relative here.�[0m
 �[36;1mjq -r --arg ws "$GITHUB_WORKSPACE" '.[] | select(.file != null) |�[0m
 �[36;1m  (.file | ltrimstr($ws + "/")) as $f |�[0m
 �[36;1m  (.reason // .message // .type // "finding") as $m |�[0m
 �[36;1m  if .severity == "critical" then�[0m
 �[36;1m    "::error file=\($f),line=\(.line // 1)::[hypatia] \($m)"�[0m
 �[36;1m  elif .severity == "high" then�[0m
 �[36;1m    "::error file=\($f),line=\(.line // 1)::[hypatia] \($m)"�[0m
...
   INSTALL_DIR_FOR_OTP: /home/runner/work/_t...

GitHub Actions: Static Analysis Gate / Hypatia neurosymbolic scan: fix(vclt-gate): state the --input argv positions; pin per-verdict exits

Conclusion: failure

View job details

##[group]Run set +e
 �[36;1mset +e�[0m
 �[36;1mHYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json�[0m
 �[36;1mHYP_EXIT=$?�[0m
 �[36;1mset -e�[0m
 �[36;1m�[0m
 �[36;1m# --exit-zero is Hypatia's own documented CI recipe (lib/hypatia/cli.ex),�[0m
 �[36;1m# for exactly this case: "use in CI when a downstream step gates on�[0m
 �[36;1m# severity counts". Findings go to stdout, the one-line summary to�[0m
 �[36;1m# stderr, and the process exits 0 unless the SCANNER itself failed.�[0m
 �[36;1m#�[0m
 �[36;1m# Do NOT redirect stderr into the payload with `2>&1`: that folds the�[0m
 �[36;1m# summary line into the JSON, so every parse fails, the old `[]`�[0m
 �[36;1m# fallback substituted a clean result, CRITICAL was always 0, and the�[0m
 �[36;1m# gate below could never fire on any input. Keep stderr on the log.�[0m
 �[36;1mif [ "$HYP_EXIT" -ne 0 ]; then�[0m
 �[36;1m  echo "::error::Hypatia scanner execution failed with exit ${HYP_EXIT}"�[0m
 �[36;1m  exit "$HYP_EXIT"�[0m
 �[36;1mfi�[0m
 �[36;1m# `jq empty` is NOT sufficient -- it succeeds on any valid JSON,�[0m
 �[36;1m# including a bare string, object or null. Assert the array.�[0m
 �[36;1mif [ ! -s hypatia-findings.json ] || ! jq -e 'type == "array"' hypatia-findings.json >/dev/null; then�[0m
 �[36;1m  echo "::error::Hypatia did not produce a valid JSON findings array"�[0m

GitHub Actions: Static Analysis Gate / Hypatia neurosymbolic scan: fix(vclt-gate): state the --input argv positions; pin per-verdict exits

Conclusion: failure

View job details

##[group]Run # Findings carry no `.message` (keys: action,file,line,reason,rule_module,
 �[36;1m# Findings carry no `.message` (keys: action,file,line,reason,rule_module,�[0m
 �[36;1m# severity,type), so every annotation read "null". `.file` is an absolute�[0m
 �[36;1m# runner path, which GitHub cannot anchor to the diff, so it is made�[0m
 �[36;1m# workspace-relative here.�[0m
 �[36;1mjq -r --arg ws "$GITHUB_WORKSPACE" '.[] | select(.file != null) |�[0m
 �[36;1m  (.file | ltrimstr($ws + "/")) as $f |�[0m
 �[36;1m  (.reason // .message // .type // "finding") as $m |�[0m
 �[36;1m  if .severity == "critical" then�[0m
 �[36;1m    "::error file=\($f),line=\(.line // 1)::[hypatia] \($m)"�[0m
 �[36;1m  elif .severity == "high" then�[0m
 �[36;1m    "::error file=\($f),line=\(.line // 1)::[hypatia] \($m)"�[0m
...
   INSTALL_DIR_FOR_OTP: /home/runner/work/_temp/.setup-beam/otp
   INSTALL_DIR_FOR_ELIXIR: /home/runner/work/_temp/.setup-beam/elixir
 ##[endgroup]
 ##[warning][hypatia] Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
 ##[warning][hypatia] Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
 ##[error][hypatia] Step uses `peter-evans/repository-dispatch` with `***REDACTED_SECRET_ASSIGNMENT*** secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.
...
 ##[warning][hypatia] workflow .github/workflows/labels.yml:33 job `sync` has no `timeout-minutes:` — defaults to 360 min on hang
 ##[warning][hypatia] workflow .github/workflows/label-triage.yml:47 job `tr...

GitHub Actions: Static Analysis Gate / Hypatia neurosymbolic scan: fix(vclt-gate): state the --input argv positions; pin per-verdict exits

Conclusion: failure

View job details

##[group]Run echo "::error::Hypatia found 6 critical security issue(s) — blocking merge"
 �[36;1mecho "::error::Hypatia found 6 critical security issue(s) — blocking merge"�[0m
...
 env:
   REPO_OWNER: hyperpolymath
   INSTALL_DIR_FOR_OTP: /home/runner/work/_temp/.setup-beam/otp
   INSTALL_DIR_FOR_ELIXIR: /home/runner/work/_temp/.setup-beam/elixir
 ##[endgroup]
 ##[error]Hypatia found 6 critical security issue(s) — blocking merge
 ##[error]Process completed with exit code 1.

Additional comments: 2

docs/vclt-gate-contract.adoc: 1

81-83: LGTM!

src/interface/parse/tests/gate_transport.rs: 1

69-73: LGTM!

Also applies to: 78-79, 81-83

📝 Summary

Summary by CodeRabbit

• Documentation
  • Clarified that file-based requests must use --input <path>; passing a file path alone is an invalid invocation.
• Bug Fixes
  • Improved checks that stdin and file-based requests produce matching results for admitted, rejected and unsupported-version requests.

The file-input contract now requires --input followed by a request-file path. The transport test checks expected exit codes for admitted, rejected and unsupported-version requests, and checks the unsupported-version error kind.

Changes: File input transport

Layer / File(s)	Summary
Invocation contract and transport validation docs/vclt-gate-contract.adoc, src/interface/parse/tests/gate_transport.rs	The contract specifies --input <path> and defines a bare path as bad_invocation. The test checks both transports against expected exit codes and verifies the file-input error kind for an unsupported version.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related PRs

• hyperpolymath/vcl-ut#125: Introduced the --input <path> transport and its initial gate_transport.rs coverage.

Merge Risk: Minimal · previous review cd675

No merge-blocking issue is identified in this change.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies both primary changes: correcting the --input argument positions and pinning per-verdict exit codes.
Description check		The description follows the required structure and explains the changes, testing, documentation update, formatting limitation, and unrun REUSE check. It is sufficiently complete, although the unchecke…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description follows the required structure and explains the changes, testing, documentation update, formatting limitation, and unrun REUSE check. It is sufficiently complete, although the unchecked REUSE item and existing rustfmt diff remain documented limitations.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

✅ Coding task complete — no changes needed

[coderabbitai]

✅ Coding Agent task started: View task and status

The task will inspect the CI failures, validate its fix, and commit the fix to this branch automatically.

Note: Fixing CI failures is a beta feature and may encounter errors. Expect some limitations and changes as we gather feedback and continue to improve it.

⏭️ Checks skipped: 1 · already failing on `main` (not caused by this PR)

• GitHub Check: Hypatia neurosymbolic scan

[coderabbitai]

Add Carrot credits or activate Agent usage billing to use Autofix

[hyperpolymath]

Hypatia neurosymbolic scan fails here with "Hypatia found 6 critical security issue(s)". The cause is not this diff:

• The Static Analysis Gate and Hypatia Security Scan runs on main at this PR's base commit (19a923c) fail too, as does the scheduled run at a8d31ff.
• This PR changes only docs/vclt-gate-contract.adoc and one test file.

No fix exists yet to port. The six findings are already present on main, and fixing them belongs in its own change.

Note for the owner: CodeRabbit has started a docstring-generation task and a "fix CI" task that both say they will commit to this branch. Nobody here asked for either. If they push, I'll review what lands before this merges.

---

Generated by Claude Code

[hyperpolymath]

I reverted b20c60d in 5a0c9ba. CodeRabbit's CI-fix agent pushed that commit to this branch unasked. Reasons for the revert:

• It moves .machine_readable/6a2/ to descriptiles/ across 14 files, which is outside this PR's scope.
• It adds content to 0-AI-MANIFEST.a2ml, ai/AI.a2ml and policies/MAINTENANCE-AXES.a2ml. The A2ML retirement rule forbids that.
• Auto-merge was on, so it would have landed without review.

After the revert, the branch tree is identical to cd67522. If the 6a2 move is wanted (it may be what the base-red Hypatia scan is flagging), it belongs in its own PR.

---

Generated by Claude Code