Skip to content

Fix workspace-lint violations across support crates - #365

Draft
leynos wants to merge 51 commits into
mainfrom
harden-lint-support-crates
Draft

leynos wants to merge 51 commits into
mainfrom
harden-lint-support-crates

Conversation

@leynos

@leynos leynos commented Aug 28, 2026 •

Copy link
Copy Markdown
Owner

Summary

This PR clears workspace-lint violations across common/, whitaker_sarif,
whitaker_clones_core, the ten lint crates, suite/, and the root crate. The
changes preserve behaviour while replacing panic-prone indexing and unwraps
with checked forms and descriptive errors, borrowing inputs where ownership is
unneeded, clarifying shadowed names, documenting interfaces, and consolidating
Dylint registration behind the support macro. Shared cfg_attr parsing now
handles delimiters inside quoted and raw strings, and test environment changes
use scoped temp_env helpers.

The UI harness retains the configured compiler wrapper and compiler-admission
path. The focused dylint_testing patch recognises wrapper-prefixed rustc
commands, while nextest serialises UI tests that launch nested Cargo builds.

The Kani AST checks are split into a full-domain KindId round trip, a fixed-
kind five-node depth/count property, and a four-value symbolic equality/order
property. A per-proof runner caps the whole process tree at 8 GiB, disables
swap, and stops after ten minutes; timeout or resource exhaustion fails closed
as an unsuccessful or inconclusive proof. The production BTreeMap is covered
by runtime and property tests, not by the depth-only Kani proof.

This is the support-crate lint-fix PR in the lint-hardening stack; installer
lint fixes remain in the following PR.

Review walkthrough

Validation

  • On candidate commit 15a29bcebc26ccf87b62792f9aaf6848a19f6eae,
    make check-fmt, make lint, make typecheck, make test,
    make markdownlint, make nixie, make spelling,
    make test-workflow-contracts, and make install-smoke all passed.
    The workspace suite reported 1,871/1,871 tests passed, with 5 tests and
    11 binaries skipped; the additional dylint_testing suite passed 11/11.
    Markdown lint checked 86 files with 0 errors, and workflow contracts passed
    667/667.
  • Bounded Kani checks passed with Kani 0.67.0, CBMC 6.8.0, and CaDiCaL 2.0.0.
    Each proof runs under an 8 GiB process-tree memory cap with swap disabled and
    a 600-second timeout; resource exhaustion is reported as unsuccessful or
    inconclusive, never as a pass.
    • Before the full group, standalone verify_missing_cover_returns_none
      passed in 68 seconds with a 124 MiB peak.
    • The fresh full group passed all 15 harnesses. Reported harness execution
      times sum to 281 seconds; verify_lsh_index_is_insertion_order_independent
      took 99 seconds and peaked at 4,836 MiB.
    • verify_kind_id_round_trips_full_u16_domain: 5 seconds, 67 MiB peak.
    • verify_kind_counts_stop_at_max_depth: unwind 6 passed 569 checks with
      9 unreachable, in 10 seconds at 151 MiB peak. The unwind-5 negative
      control failed at the loop-termination assertion; unwinding assertions
      remain enabled.
    • The four-value symbolic equality/order proof passed 39 checks in
      4 seconds at 67 MiB. The full-group invocation of
      verify_missing_cover_returns_none took 2 seconds at 67 MiB.
    • The full transcript, standalone focused transcript, and unwind-5 negative
      control are archived in the
      proof-run record.
  • make verus-clone-detector verified 27 proofs (9, 10, and 8 across the
    three groups) with 0 errors on this candidate; the Verus proof sources are
    unchanged by this PR.

Notes

  • The 7.3.1 ExecPlan
    records the implementation milestones, proof inventory, and assumptions;
    Stage G remains open pending current-head review and the roadmap tick. The final Kani changes
    refine verification harnesses; they do not alter production clone-detection
    semantics.
  • The macro-related lint expectations each have a documented reason for
    third-party macro expansions that have no documentable source location.
  • The stored fingerprint and hashing semantics are unchanged. The Kani work
    narrows each property to its relevant domain; the Verus count-accumulator
    proof remains unchanged.
  • The external Cargo environment variable CARGO_TERM_COLOR retains its
    spelling; the exact source line remains the narrow spelling exception.

References

@coderabbitai

coderabbitai Bot commented Aug 28, 2026 •

Copy link
Copy Markdown

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

codescene-access[bot]

This comment was marked as outdated.

codescene-access[bot]

This comment was marked as outdated.

codescene-access[bot]

This comment was marked as outdated.

codescene-access[bot]

This comment was marked as outdated.

leynos and others added 21 commits October 15, 2026 04:47
Rename code symbols and prose to Oxford spelling (-ize/-yze for the
-ise pairs; analyse-family words correctly keep -yse): normalize,
localize, summarize, recognized, serialize, and the SARIF domain terms
Artifact -> Artefact across whitaker_sarif and its consumers.

The SARIF 2.1.0 wire format spells its properties `artifactLocation`
and `artifacts`, so those fields carry explicit `#[serde(rename)]`
pins with doc comments explaining that the wire name is fixed by the
schema rather than derived from the field name. External identifiers
(`CompilerArtifact`, cargo metadata types, GitHub Actions flags) keep
the external system's spelling.

Feature files and step definitions are renamed together, and the typos
configuration is pruned from 255 ignore patterns to the residual set
the corrected tree still needs, so the spelling gate now enforces the
convention.

A handful of self-named module files move to mod.rs form here because
the renames were entangled with those moves.
Update the current installer dependency-module paths and record why
`deps/mod.rs` owns the colocated fallback-policy implementation.
Guide library consumers through renamed public APIs and explain that
SARIF wire keys retain their schema spelling.
Remove unconsumed usage-category state and inspect PATH candidates through
capability-scoped filesystem metadata. Clarify module and guide documentation
while retaining intentional cleanup and client-disconnect behaviour.
Resolve dependencies from the rebased manifests after keeping the
target-side lockfile during conflict resolution. Format the accompanying
0.3.0 migration tables to satisfy the documentation formatter.
Keep both Unix permission cases while sharing their capability-scoped
fixture setup. This removes the CodeScene duplication without suppressing
the code-health rule.
Add direct serialization assertions for the SARIF 2.1.0 wire keys that
the serde renames pin: PhysicalLocation must serialize artifactLocation
and a populated Run must serialize artifacts. The existing round-trip
tests are key-agnostic, so only these assertions catch a dropped
rename.

Caption the settings mapping table in the 0.3.0 migration guide to
match the other mapping tables.

Scan non-UTF-8 PATH entries when locating dependency binaries by
opening cap_std::fs::Dir directly on each entry instead of routing
through Utf8Path::from_path, which silently dropped such directories.

Gate the cap-std test import behind cfg(unix) so Windows test builds
stay free of unused-import warnings, and drop the camino import the
new Dir-based helper no longer needs.

Extend the typos exemptions for the two positive wire-key assertions
the new tests introduce; the negative assertions reuse the existing
pattern.
Local agent tooling writes a memories/ progress file into the worktree. Rename the convention to .memories/ and ignore it so session scratch never shows up as an untracked change.
Pin SARIF 2.1.0 wire names with fixed and generated JSON tests, and
compile-check renamed public APIs from downstream fixtures. Exercise
numeric saturation and span-conversion boundaries. Document changed
helpers and capability-based installer PATH scanning, including bounded
failure categories.

Keep Markdown lint discovery aligned with formatting so ignored local
agent scratch cannot fail repository gates.
Keep legacy API spellings in compile-fail contracts and SARIF 2.1.0 wire
keys exempt from the Oxford spelling gate. Remove the obsolete checkbox
exemption and correct the inherited ExecPlan heading.
Describe callback filtering, diagnostic fallback behavior, and SARIF
result construction so changed production functions have accurate
Rustdoc contracts.
Give the new API compile-contract tests the existing serialized ten-minute
allowance in both nextest profiles, and keep the workflow contract aligned
with those complete filters. Scope the `Utf8Path` test import to Unix, where
the executable-permission test uses it, so Windows builds avoid an
unused-import failure.
Add SARIF wire-contract and conversion-boundary documentation,
classify installer PATH scan failures for bounded tracing, and
document the resulting capability and usage contracts.
Treat absent PATH candidates as routine, while preserving classification
of other metadata failures. Configure verbose CLI output for bounded
debug events and test first-match ordering across generated layouts.

Document the lookup contract and review-scope Rustdoc omissions.
Combine the missing-candidate and first-match examples to avoid
duplicated fixture setup while retaining explicit coverage for both
behaviours. Keep the generated ordering property for broader coverage.
Replace the broad SARIF wire-key exemption with precise spelling cases.
Add isolated tests for tracing output and document its stderr contract.
Simplify the HTTP fixture connection checks to clear the CodeScene
findings.
Cover renamed API compatibility and SARIF wire contracts in the compile-fail and pass fixtures. Validate installer diagnostics and tracing, document user-visible behavior, and bound stale UI harness lock recovery so abandoned owners cannot stall later builds. Refresh spelling exceptions and document the Markdown linter executable override contract.
Split the child-process tracing probe from its parent orchestration and
keep assertions direct. Document why the helper stays test-private and
why the child boundary isolates tracing and PATH state.
Update the workspace lock data for the rebased manifests and
restrict the CLI PATH-scan probe to Unix, where its process and
PATH contract applies.
Exercise default, verbose, and quiet tracing through `whitaker-installer`
itself. Keep PATH, home directories, dependencies, and the expected rustup
failure inside a temporary child environment while preserving Cargo's runtime
library path for dynamically linked test builds.
Document the six discovered trybuild tests and distinguish the three
`ui` binary names from their individual test function names. Keep the
nextest timeout rationale grounded in the current discovery set.
Capture candidate-bound Kani and Verus evidence, including resource use,
unreachable-check classification, the unwind negative control, and the
capped full-group outcome. Keep the full Kani gate explicitly inconclusive.
codescene-access[bot]

This comment was marked as outdated.

Separate the full-u16 KindId round trip from depth traversal, and use fixed kinds in the five-node depth proof. Check equality and ordering over a four-value alphabet that preserves every comparison pattern among the four labels.

Replace full-signature symbolic MinHash obligations with bounded production lane and normalization proofs. Record per-harness resource limits and fail closed on timeout or exhaustion.
codescene-access[bot]

This comment was marked as outdated.

Call the production lane-minimum helper directly from the Kani
harness and preserve its typed seed boundary. Record the successful
bounded Kani and Verus reruns in the ExecPlan.
codescene-access[bot]

This comment was marked as outdated.

@pandalump

Copy link
Copy Markdown
Collaborator

@coderabbitai please assess the implementation in this PR for completeness and correctness against the execplan:

docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md

Published head: c0ef8c2; comparison base: 61a101d.
Acceptance evidence: On this exact published candidate, local sequential gates passed: make lint, make typecheck, make test (1,860 passed, 5 configured skips; Dylint unit suite 11/11), make check-fmt, make markdownlint, make nixie, make spelling; make kani-clone-detector passed all 15 harnesses with per-proof 8 GiB process-tree caps, swap disabled and 600-second timeouts (362 seconds total; 4,842 MiB peak); make verus-clone-detector verified 27 proof obligations. Hosted evidence: CI run 39168775439 (attempt 1) completed success on c0ef8c2: linux-full, windows-compat and coverage-check all passed. CodeScene passed all six quality gates with zero annotations at https://codescene.io/projects/71836/delta/results/8007655.
Known limitations: Kani proves bounded properties over synthetic lowered trees and finite LSH scenarios; its depth proof does not prove production BTreeMap internals or general traversal fidelity. Verus proves accumulator algebra for a supplied contribution multiset, not that Rust traversal emits that multiset. Runtime/property tests cover production traversal and full-signature behavior. No unrestricted rerun was made after the earlier 68 GiB resource exhaustion.
Assessment-ID: whitaker-365-plan-c0ef8c2-20261018-8e26d271.

Please echo the Assessment-ID and assessed base/head in your substantive reply.
This is an assessment conversation, not a request to start a formal PR review.

Identify remaining in-scope omissions or correctness defects and any access
or inspection limitations. Assess the implementation, not just the plan text.

@coderabbitai

coderabbitai Bot commented Oct 18, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -uo pipefail
base=61a101dd2eaa62059ed0152249bceda85ece3ac1
head=c0ef8c2074127a3083b6907b16474f819e77ddea
git rev-parse HEAD
git cat-file -t "$base"
git cat-file -t "$head"
git diff --stat "$base" "$head"
ast-grep outline docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md --items all
nl -ba docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md | sed -n '1,260p'
fd -t f . crates/whitaker_clones_core/src crates/whitaker_clones_core/tests
gh api repos/leynos/whitaker/actions/runs/39168775439 --jq '{head_sha,run_attempt,status,conclusion,html_url}'
gh api repos/leynos/whitaker/actions/runs/39168775439/jobs --paginate --jq '.jobs[] | {name,status,conclusion,head_sha}'

Length of output: 33208


🏁 Script executed:

#!/bin/bash
set -uo pipefail
p=docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
sed -n '259,378p;563,767p;856,1082p;1141,1311p;1347,1387p;1409,1584p' "$p"
ast-grep outline crates/whitaker_clones_core/src/ast --items all
ast-grep outline crates/whitaker_clones_core/tests/ast_boundary.rs --items all
ast-grep outline crates/whitaker_clones_core/tests/ast_feature_extraction_behaviour.rs --items all
fd -i 'verus|histogram|accumul|rust-toolchain|Cargo.toml' . --exclude vendor --exclude .git
git diff 61a101dd2eaa62059ed0152249bceda85ece3ac1 c0ef8c2074127a3083b6907b16474f819e77ddea -- crates/whitaker_clones_core/src/ast crates/whitaker_clones_core/src/index/kani.rs crates/whitaker_clones_core/src/index/minhash.rs

Length of output: 104018


🏁 Script executed:

#!/bin/bash
set -uo pipefail
for f in crates/whitaker_clones_core/src/ast/cover.rs crates/whitaker_clones_core/src/ast/tree.rs crates/whitaker_clones_core/src/ast/features.rs crates/whitaker_clones_core/src/ast/hash.rs crates/whitaker_clones_core/src/ast/lowering.rs crates/whitaker_clones_core/src/ast/mod.rs; do
echo "=== $f"; nl -ba "$f"; done
fd -t f . verus
ast-grep outline verus/clone_detector_ast_features.rs --items all
ast-grep outline scripts/run-kani.sh --items all
ast-grep outline scripts/run-kani-limited.sh --items all
ast-grep outline scripts/run-verus.sh --items all
ast-grep outline crates/whitaker_clones_core/build.rs --items all
ast-grep outline crates/whitaker_clones_core/build_support.rs --items all
rg -n -C3 '7\.3\.1|ra_ap_syntax|nightly-2026-05-28' rust-toolchain.toml Cargo.toml crates/whitaker_clones_core/Cargo.toml docs/roadmap.md

Length of output: 48923


🏁 Script executed:

#!/bin/bash
set -uo pipefail
for f in crates/whitaker_clones_core/src/ast/tests.rs crates/whitaker_clones_core/src/ast/lowering_tests.rs crates/whitaker_clones_core/src/ast/kani.rs verus/clone_detector_ast_features.rs scripts/run-kani.sh scripts/run-kani-limited.sh; do
echo "=== $f"; nl -ba "$f"; done
echo '=== proof wiring'
rg -n -C4 'clone.detector|ast_features' scripts/run-verus.sh Makefile
echo '=== plan selection and limits'
rg -n -C4 'covering|budget|token|u128|red|Red|mutation' docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md | head -240

Length of output: 77140


🏁 Script executed:

#!/bin/bash
set -uo pipefail
for f in crates/whitaker_clones_core/build.rs crates/whitaker_clones_core/build_support.rs crates/whitaker_clones_core/src/hashing.rs crates/whitaker_clones_core/src/ast/error.rs crates/whitaker_clones_core/src/ast/metrics.rs crates/whitaker_clones_core/tests/ast_boundary.rs; do
echo "=== $f"; nl -ba "$f"; done
ast-grep outline crates/whitaker_clones_core/tests/build_script_integration.rs --items all
ast-grep outline crates/whitaker_clones_core/tests/build_script_parsing.rs --items all
nl -ba crates/whitaker_clones_core/tests/build_script_integration.rs | sed -n '1,230p'
nl -ba crates/whitaker_clones_core/tests/ast_feature_extraction_behaviour.rs | sed -n '17,73p;90,100p;128,178p;193,235p'
cat crates/whitaker_clones_core/tests/features/ast_feature_extraction.feature
sed -n '468,562p' docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
rg -n -C3 'proptest|leaf.normal|determin|saturat|u128|smallest.cover|10,000|10_000|node budget' docs/developers-guide.md docs/whitaker-clone-detector-design.md
fd -H -t f '.*' crates/whitaker_clones_core | grep -E 'regress|snap'
rg -n -C2 '\bselect_smallest_covering\s*\(' crates/whitaker_clones_core
git show 61a101dd2eaa62059ed0152249bceda85ece3ac1:crates/whitaker_clones_core/src/ast/lowering.rs | sed -n '190,325p'

Length of output: 96231


🏁 Script executed:

#!/bin/bash
set -uo pipefail
nl -ba crates/whitaker_clones_core/tests/build_script_parsing.rs | sed -n '60,100p;185,245p'
cat crates/whitaker_clones_core/proptest-regressions/ast/tests.txt
rg -n -C3 'proptest!|fn .*determin|fn .*normal|fn .*hash|fn .*order|fn .*ident|fn .*literal' crates/whitaker_clones_core/src/ast crates/whitaker_clones_core/tests/ast_feature_extraction_behaviour.rs
rg -n -C2 'runbook|re-pinn|re-pin|toolchain bump|precise|escalat' docs/developers-guide.md | tail -110
nl -ba docs/developers-guide.md | sed -n '1847,1870p;2025,2045p'
nl -ba docs/whitaker-clone-detector-design.md | sed -n '613,640p;663,726p'
rg -n -C2 'red failure|failed before|red transcript|assertion.*failed|Red:|red:' docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
git diff 61a101dd2eaa62059ed0152249bceda85ece3ac1 c0ef8c2074127a3083b6907b16474f819e77ddea -- crates/whitaker_clones_core/build_support.rs
gh api repos/leynos/whitaker/commits/c0ef8c2074127a3083b6907b16474f819e77ddea/check-runs --paginate --jq '.check_runs[] | {name,conclusion,details_url}'
gh api repos/leynos/whitaker/commits/c0ef8c2074127a3083b6907b16474f819e77ddea/status --jq '{state,statuses:[.statuses[]|{context,state,target_url}]}'
git diff --check 61a101dd2eaa62059ed0152249bceda85ece3ac1 c0ef8c2074127a3083b6907b16474f819e77ddea

Length of output: 35730


🤖 web_search executed:

Cargo official reference semver version requirement partial equality "=1.2" "=1" matches patch releases vs "=1.2.3" exact pin https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html

Length of output: 639


@pandalump Treat the implementation as substantially delivered, but not yet complete against the ExecPlan. Close two implementation gaps and one production-proof correspondence gap before claiming full acceptance.

Assessment-ID: whitaker-365-plan-c0ef8c2-20261018-8e26d271
Assessed base: 61a101dd2eaa62059ed0152249bceda85ece3ac1
Assessed head: c0ef8c2074127a3083b6907b16474f819e77ddea

I verified that the checkout matches the requested head. I inspected production lowering, feature extraction, hashing, parser-version generation, test definitions, proof harnesses, the Verus sidecar, and proof-runner wiring. I checked the earlier proof-scope learning against the current source.

Close these substantive gaps

1. Bound token-leaf allocation, not only parser syntax nodes

Priority: P2 — bounded-cost correctness gap.

In crates/whitaker_clones_core/src/ast/lowering.rs, Line 291–304 charges the node budget when LoweringLimits::lower receives a SyntaxNode. Line 318–319 creates a NormalizedNode for each non-trivia token without charging that budget.

A flat macro token tree can contain many tokens but few syntax nodes. Such input can allocate far more than MAX_AST_NODES normalized nodes without returning TreeTooLarge. The subsequent feature walks process those token nodes too.

The existing oversized-input test uses many let statements. That fixture exercises syntax-node exhaustion, not token-heavy allocation.

Charge each emitted normalized node to the budget. Add a flat macro-token fixture that exceeds the budget. Keep the existing small-candidate-in-a-large-file test.

This gap already exists at the comparison base. It is not a regression introduced by this lint-hardening diff. It remains relevant to acceptance against the plan’s bounded per-candidate cost requirement.

2. Enforce a complete exact parser version

Priority: P2 — parser-schema guard gap.

In crates/whitaker_clones_core/build_support.rs, Line 30–34 accepts any non-empty text after =. This checks a prefix, not an exact version requirement.

For example, =0.0 is a partial Cargo equality requirement, not a single-version pin. The guard would accept it and export 0.0 as the parser-version component. A later dependency resolution could then select another parser patch without changing that component. See Cargo’s version-requirement documentation.

The property test in crates/whitaker_clones_core/tests/build_script_parsing.rs, Line 194–204, repeats the same prefix-based definition. It therefore cannot detect this defect.

Require one equality comparator with a complete major/minor/patch version. Reject partial versions and additional comparators. Test those cases through both the parser helper and the isolated Cargo fixture.

The current =0.0.334 declaration is valid. This is a defect in the promised future re-pin protection, not evidence that this candidate uses the wrong parser. The guard also predates the comparison base.

3. Connect the selection proof to production selection

Priority: P2 — verification correspondence gap, not a demonstrated selection failure.

The Kani selection harnesses call select_smallest_covering in crates/whitaker_clones_core/src/ast/cover.rs.

Production lower_span does not call that helper. It calls select_covering_node, which implements covering checks and minimum-width selection separately in crates/whitaker_clones_core/src/ast/lowering.rs, Line 170–239.

Consequently:

  • The Kani results establish properties of the domain helper.
  • The recorded mutation matrix validates that helper’s predicates.
  • Neither result detects a mutation confined to the adapter’s separate predicates.

The production algorithm appears consistent with the documented covering-range contract. The inspected runtime tests exercise representative mappings. I found no concrete wrong-node result. However, those facts do not close the proof correspondence gap.

Share the parser-independent selection decision with production. Preserve the pruned traversal. Alternatively, document the separate algorithm as a trusted boundary and supply explicit correspondence tests. Do not describe the current Kani results as verification of the adapter’s actual selection implementation.

This separation also exists at the comparison base.

Complete the remaining acceptance work

Area Remaining work
Stage E property coverage Add the promised generated-tree determinism checks and generated source-payload normalization checks, or record an explicit scope adjustment. The current AST properties check sibling reversal, adjacent-kind hash distinction, and weight arithmetic. The identifier-normalization BDD fixture is useful, but it does not supply the promised property coverage.
MinHash proof documentation Update docs/developers-guide.md, Line 1857–1861 and Line 2036–2041, plus docs/whitaker-clone-detector-design.md, Line 614–627. These passages still describe successful non-empty full-signature Kani checks. The current harnesses instead check a fixed lane-minimum case and fixed input normalization.
Completion record Reconcile Status: COMPLETED with the unticked Stage G entry. Fill the empty Outcomes & retrospective section. Supply the required red-failure transcripts, or identify them as unavailable historical evidence. The recorded Kani mutations are not substitutes for the per-function red-green evidence.
Verus-to-Rust arithmetic bridge State the representability boundary explicitly. The sidecar uses mathematical nat; production uses saturating u32 counts and saturating u16 depth. A correctly enforced lowered-tree budget makes saturation irrelevant for parser-produced trees. Do not extend that argument without qualification to arbitrary publicly constructed trees.

The Verus induction is substantive within its model. It proves that the accumulator fold equals the matching-contribution count, then derives equality for equal contribution multisets. The arithmetic bridge does not invalidate that algebraic result.

Retain these positive conclusions

The inspected implementation delivers the main 7.3.1 building blocks:

  • An owned, parser-independent tree and a parser adapter behind the default parser feature.
  • Span validation, source-specific revalidation, typed errors, parser-recovery reporting, and selected-subtree ERROR rejection.
  • Deterministic ordered count and production maps.
  • Dyadic weighting with a u128 accumulator and explicit zero weights beyond depth 63.
  • Iterative feature traversal and order-sensitive canonical hashing.
  • Explicit little-endian hash mixing and parser-plus-Whitaker schema seeding.
  • BDD scenarios, named-kind snapshot assertions, a regression-file location, and isolated build-script fixtures.
  • Registered Kani and Verus proof groups, maintenance runbooks, and a completed roadmap entry.

The inspected feature and hash changes preserve their previous algorithms. I found no additional concrete defect in their ordinary bounded-tree behaviour.

Separate confirmed evidence from reported evidence

Confirmed through GitHub:

  • CI run 39168775439, attempt 1, succeeded at the exact requested head.
  • linux-full, windows-compat, and coverage-check succeeded.
  • The CodeScene check succeeded and points to result 8007655.
  • git diff --check passed.

Not independently reproduced or fully audited:

  • The local test totals, five skip reasons, Kani executions, and Verus executions.
  • The raw proof logs referenced under /tmp.
  • CodeScene’s six individual gate results and zero-annotation count.
  • The historical Stage 0 atomic-commit gate sequence and fixture-review history.
  • Every unrelated support-crate change across the 150-file diff.

I did not build, test, or execute repository code in this inspection environment.

Accept the reported 15-harness pass as evidence for the current, narrower harness inventory. Do not equate that inventory with the removed full-signature MinHash obligations. Do not treat the earlier resource exhaustion as a counterexample to the current proofs.

Close the budget, parser-pin, and selection-correspondence gaps before declaring the ExecPlan fully satisfied. Keep the remaining test and documentation omissions explicit.


🧠 Learnings used
Learnt from: buzzybee-df12
URL: https://github.com/leynos/whitaker/pull/365

Timestamp: 2026-10-18T19:15:13.789Z
Learning: In leynos/whitaker, the Rust AST Kani harness verify_kind_counts_stop_at_max_depth in crates/whitaker_clones_core/src/ast/kani.rs verifies the shared production for_each_node_at_depth traversal on one fixed five-node tree using a fixed-array depth tally. It does not symbolically verify kind_counts or KindCounts' BTreeMap accumulator. Production accumulation and sibling-order behaviour are exercised by runtime and property tests. Assess focused AST proof results separately from an unsuccessful or inconclusive full clone-detector Kani group run.

You are interacting with an AI system.

Count emitted token leaves against the AST node budget and share
the candidate-selection predicate between parsing and Kani.
Require full exact parser versions in the build guard, with
regression coverage.

Record the bounded proof evidence and resource limits.
codescene-access[bot]

This comment was marked as outdated.

@wafflecat-df12

Copy link
Copy Markdown
Collaborator

@coderabbitai please assess the implementation in this PR for completeness and correctness against the execplan:

docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md

This is a candidate-bound follow-up to your request at #365 (comment) and response at #365 (comment).

Published head: d3e62ec; comparison base: 61a101d.
Acceptance evidence: The follow-up charges every emitted non-trivia token leaf to the normalized-node budget and adds an oversized flat macro-token regression; shares candidate_covers_target and should_select_covering_candidate between the parser-independent selector and the production pruned traversal; parses and validates a complete exact major/minor/patch parser requirement and adds partial/comparator integration cases; adds generated source-payload normalization and independent-tree determinism coverage; and updates the proof-scope and Verus representation-boundary documentation. Sequential local gates passed: make check-fmt, make lint, make typecheck, make test (1,871 passed, 5 skipped, plus 11 dylint_testing tests), make markdownlint, and make nixie. make kani-clone-detector passed all 15 harnesses under a per-process-tree 8 GiB memory cap, swap disabled, and 600-second timeout; make verus-clone-detector passed 9, 10, and 8 obligations with zero errors. The bounded Kani peak was 4,835 MiB; the recorded unwind-5 negative control failed its unwinding assertion and unwind 6 passed. The full proof and gate logs are in the ExecPlan. Current-head hosted CI run 39182218490 and CodeScene result 8008611 are green.
Known limitations: The Kani depth harness proves the fixed five-node traversal with a fixed array tally; it does not verify production BTreeMap operations or general traversal fidelity. Kani does not prove full MinHash signatures. The Verus lemma assumes equal per-(kind, depth) contribution multisets; Rust tests and proptest cover production traversal. Historical red-failure transcripts are unavailable and are labelled as such.

Please echo the Assessment-ID and assessed base/head in your substantive reply.
This is an assessment conversation, not a request to start a formal PR review.

Identify remaining in-scope omissions or correctness defects and any access or inspection limitations. Assess the implementation, not just the plan text. In particular, confirm whether the previously raised token-leaf budget, exact parser pin, selection-correspondence, generated-property, proof-scope documentation, and Verus arithmetic-boundary concerns are resolved on this candidate.

Assessment-ID: WHITAKER-PR365-PLAN-d3e62ec1-20261019-01.

@coderabbitai

coderabbitai Bot commented Oct 19, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -uo pipefail
base=61a101dd2eaa62059ed0152249bceda85ece3ac1
head=d3e62ec1966b1eae87f46a3ece325955064e401a
git rev-parse HEAD
git cat-file -t "$head"
git diff --stat "$base" "$head"
git diff --stat c0ef8c2074127a3083b6907b16474f819e77ddea "$head"
ast-grep outline crates/whitaker_clones_core/src/ast --items all
ast-grep outline crates/whitaker_clones_core/build_support.rs --items all
ast-grep outline crates/whitaker_clones_core/tests/build_script_parsing.rs --items all
ast-grep outline crates/whitaker_clones_core/tests/build_script_integration.rs --items all
rg -n -C3 'Status:|^\s*- \[[ x]\]|^##|^###|red.failure|transcript|4,835|4835|1871|1,871|representation|multiset|saturat' docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
gh api repos/leynos/whitaker/actions/runs/39182218490 --jq '{head_sha,run_attempt,status,conclusion,html_url}'
gh api repos/leynos/whitaker/actions/runs/39182218490/jobs --paginate --jq '.jobs[] | {name,status,conclusion,head_sha}'
gh api repos/leynos/whitaker/commits/"$head"/check-runs --paginate --jq '.check_runs[] | {name,conclusion,details_url}'
git diff --check "$base" "$head"

Length of output: 36171


🏁 Script executed:

#!/bin/bash
set -uo pipefail
git fetch --no-tags --depth=1 origin 61a101dd2eaa62059ed0152249bceda85ece3ac1 c0ef8c2074127a3083b6907b16474f819e77ddea
git diff --stat c0ef8c2074127a3083b6907b16474f819e77ddea HEAD
git diff c0ef8c2074127a3083b6907b16474f819e77ddea HEAD -- crates/whitaker_clones_core/src/ast crates/whitaker_clones_core/build_support.rs crates/whitaker_clones_core/tests/build_script_parsing.rs crates/whitaker_clones_core/tests/build_script_integration.rs crates/whitaker_clones_core/Cargo.toml
nl -ba crates/whitaker_clones_core/src/ast/lowering.rs | sed -n '1,385p'
nl -ba crates/whitaker_clones_core/src/ast/cover.rs
nl -ba crates/whitaker_clones_core/build_support.rs | sed -n '1,140p'
sed -n '56,167p;776,793p;1211,1320p;1383,1424p;1560,1676p' docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
git diff c0ef8c2074127a3083b6907b16474f819e77ddea HEAD -- docs/developers-guide.md docs/whitaker-clone-detector-design.md verus/clone_detector_ast_features.rs
git diff --check 61a101dd2eaa62059ed0152249bceda85ece3ac1 HEAD

Length of output: 81218


🏁 Script executed:

#!/bin/bash
set -uo pipefail
git diff --stat 61a101dd2eaa62059ed0152249bceda85ece3ac1 HEAD
nl -ba crates/whitaker_clones_core/src/ast/features.rs | sed -n '1,60p;155,330p'
nl -ba crates/whitaker_clones_core/src/ast/hash.rs | sed -n '1,185p'
nl -ba crates/whitaker_clones_core/src/ast/tests.rs | sed -n '245,370p'
nl -ba crates/whitaker_clones_core/src/ast/lowering_tests.rs | sed -n '1,107p;125,170p;228,270p;300,395p'
nl -ba crates/whitaker_clones_core/src/ast/kani.rs | sed -n '1,260p'
ast-grep outline verus/clone_detector_ast_features.rs --items all
nl -ba verus/clone_detector_ast_features.rs | sed -n '1,270p'
ast-grep outline scripts/run-kani.sh --items all
ast-grep outline scripts/run-kani-limited.sh --items all
ast-grep outline scripts/run-verus.sh --items all
nl -ba scripts/run-kani.sh | sed -n '1,170p'
nl -ba scripts/run-kani-limited.sh | sed -n '1,185p'
rg -n -C3 'clone_detector_ast_features|clone-detector|run_clone' scripts/run-verus.sh
ast-grep outline crates/whitaker_clones_core/tests/ast_boundary.rs --items all
nl -ba crates/whitaker_clones_core/tests/ast_boundary.rs | sed -n '1,220p'
rg -n -C3 '7\.3\.1|adjacent two|nat|saturat|representab' docs/roadmap.md docs/developers-guide.md docs/whitaker-clone-detector-design.md verus/clone_detector_ast_features.rs
sed -n '1321,1347p' docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
fd -H -t f . crates/whitaker_clones_core/proptest-regressions
ast-grep outline crates/whitaker_clones_core/build.rs --items all
nl -ba crates/whitaker_clones_core/build.rs | sed -n '1,150p'
gh api repos/leynos/whitaker/actions/runs/39182218490/artifacts --jq '{total_count,artifacts:[.artifacts[]|{name,expired}]}'

Length of output: 140590


@wafflecat-df12 Accept the implementation fixes for five of the six concerns. Keep the proof-scope documentation concern open because one passage still describes removed MinHash proofs. I found no remaining production correctness defect in the inspected 7.3.1 implementation.

Assessment-ID: WHITAKER-PR365-PLAN-d3e62ec1-20261019-01
Assessed base: 61a101dd2eaa62059ed0152249bceda85ece3ac1
Assessed head: d3e62ec1966b1eae87f46a3ece325955064e401a

I verified the checkout against the requested head. I inspected the follow-up diff, production lowering and selection, feature extraction, hashing, regression tests, generated properties, proof bodies, runner wiring, and ExecPlan acceptance requirements. I also checked the earlier proof-scope learning against the current source.

Disposition of the six concerns

Concern Assessment on this candidate
Token-leaf budget Resolved. LoweringLimits::lower reserves each syntax node through claim_node. It also reserves each non-trivia token leaf before construction. The same method checks depth. The flat macro-token regression expects TreeTooLarge. The small-candidate-in-a-large-file regression remains present.
Complete exact parser pin Resolved. exact_version requires = followed by a value accepted by semver::Version::parse. Partial versions and additional comparators fail. Unit tests cover both cases. Temporary-workspace integration tests check that the build fails with the parser-pin diagnostic.
Selection correspondence Resolved for the previously identified duplicated decision logic. Both selectors now use candidate_covers_target and should_select_covering_candidate. Production retains its pruned traversal. Kani therefore exercises the same covering and replacement rules. It still does not verify parser traversal or candidate enumeration.
Generated properties Resolved. Generated trees now check counts, weighted histograms, production multisets, and hashes across separately owned equivalent trees. Generated Rust source varies identifier and integer-literal payloads before production lowering and hash comparison. Sibling-reversal coverage remains separate from the deliberately order-sensitive hash.
Proof-scope documentation Partly resolved. The design document, ExecPlan, and one developers’ guide passage now state the narrower MinHash scope correctly. Another developers’ guide passage still contradicts them. See below.
Verus arithmetic boundary Resolved as a documented correspondence argument, not a machine-checked refinement proof. Every parser-produced tree has at most 10,000 normalized nodes and depth at most 256. These bounds prevent the relevant u32 count and u16 depth operations from saturating. The documentation explicitly excludes arbitrary caller-constructed trees from this argument.

The inspected Verus induction establishes that the accumulator fold equals the matching-contribution count. It then derives fold equality from equal contribution multisets. That is substantive algebraic verification. It does not establish that Rust traversal emits those multisets.

Close the remaining documentation defect

Correct docs/developers-guide.md, Line 2045–2050.

This passage still says that Kani executes real MinHasher::sketch calls for deterministic output and duplicate retained hashes. It also describes symbolic signature-lane proofs that are no longer in the harness inventory.

Replace that description with the current obligations:

  • Empty-input rejection through MinHasher::sketch.
  • A fixed boundary-hash lane-minimum check through minimum_mixed_hash.
  • Fixed-input sorting and deduplication through unique_hashes.
  • Runtime coverage for non-empty full-signature properties.

The correct description at Line 1857–1862 does not remove this contradiction.

Also update the Verus summary at Line 2076–2080. It describes only adjacent two-item commutativity and says tests are responsible for “proving” traversal correspondence. Name the general equal-multiset fold lemma and describe runtime/property tests as testing traversal correspondence. This passage understates the sidecar theorem and overstates the assurance supplied by tests.

Complete the acceptance record

Distinguish delivered behaviour from historical process evidence.

  • The ExecPlan correctly uses IN PROGRESS and leaves Stage D, Stage E, and Stage G open pending assessment and hosted checks. The inspected implementation closes the identified Stage D and Stage E gaps.
  • Historical per-function red-failure transcripts remain unavailable. Labelling them unavailable is accurate. It does not satisfy the unchanged acceptance requirement to provide them. Record an explicit acceptance exception rather than claim that requirement passed.
  • Update the completion record after correcting the remaining documentation. Preserve the stated proof limitations.

Do not expand the implementation merely to remove the acknowledged proof boundaries. The fixed five-node depth tally, unverified map internals, unverified general parser traversal, and runtime-only full-signature MinHash coverage are explicit limits, not newly discovered correctness defects.

Evidence and inspection limits

Confirmed independently:

  • CI run 39182218490, attempt 1, completed successfully at the exact assessed head.
  • linux-full, windows-compat, and coverage-check succeeded.
  • The CodeScene check succeeded and links to result 8008611.
  • Base-to-head git diff --check passed after I retrieved the initially missing comparison commits.
  • The scripts register all 15 Kani harnesses and include the AST Verus sidecar in both required groups.

Keep these limits explicit:

  • I did not build, test, or execute repository code.
  • The ExecPlan contains proof summaries, check counts, resource measurements, and local /tmp log references. It does not contain the complete referenced raw logs.
  • I did not independently reproduce the 1,871-test result, five skip reasons, 11 Dylint tests, Kani runs, Verus runs, or mutation controls.
  • The queried CI artefacts contain cache statistics, not proof logs. Provide durable raw proof logs to complete an independent execution audit.
  • I did not re-audit every unrelated support-crate change across the 158-file base-to-head diff, or reconstruct the historical Stage 0 commit sequence.

Treat the 7.3.1 implementation as substantively complete within the inspected scope. Keep final ExecPlan acceptance conditional on the remaining proof-scope documentation correction and an explicit disposition for unavailable historical evidence.


🧠 Learnings used
Learnt from: buzzybee-df12
URL: https://github.com/leynos/whitaker/pull/365

Timestamp: 2026-10-18T19:15:13.789Z
Learning: In leynos/whitaker, the Rust AST Kani harness verify_kind_counts_stop_at_max_depth in crates/whitaker_clones_core/src/ast/kani.rs verifies the shared production for_each_node_at_depth traversal on one fixed five-node tree using a fixed-array depth tally. It does not symbolically verify kind_counts or KindCounts' BTreeMap accumulator. Production accumulation and sibling-order behaviour are exercised by runtime and property tests. Assess focused AST proof results separately from an unsuccessful or inconclusive full clone-detector Kani group run.

You are interacting with an AI system.

Update the MinHash and Verus summaries to match the current
harnesses and lemma. Record the unavailable historical red-run
transcripts as an explicit evidence exception.
codescene-access[bot]

This comment was marked as outdated.

@pandalump

Copy link
Copy Markdown
Collaborator

@coderabbitai

I addressed your response at #365 (comment) on the corrected documentation commit.

docs/developers-guide.md now describes the current Kani obligations: empty-input rejection through MinHasher::sketch, the fixed boundary-hash lane minimum through minimum_mixed_hash, and fixed-input sorting/deduplication through unique_hashes. It states that full-signature behaviour remains covered by runtime tests. The Verus summary now names lemma_fold_count_is_permutation_invariant, states its equal-multiset count result, and describes Rust tests as exercising traversal correspondence rather than proving it.

The ExecPlan now records the unavailable historical per-function red-failure transcripts as an explicit acceptance exception. It does not claim that the historical-evidence requirement was met. Please confirm whether this is a sufficient and transparent disposition, or whether owner action is still required, and whether the proof-scope documentation concern is resolved on this candidate.

The docs-only gates (make check-fmt, make markdownlint, make nixie, make spelling, and git diff --check) passed on this commit. Hosted run 39184288492 completed successfully on this exact head: linux-full, coverage-check, and windows-compat all passed. CodeScene also passed on this head: result 8008849.

Assessment-ID: WHITAKER-PR365-PLAN-eabfe1ba-20261019-03
Assessed base: 61a101dd2eaa62059ed0152249bceda85ece3ac1
Assessed head: eabfe1ba0306ac9eee1cc7cd29f1fe38bc84ca20

This is a candidate-bound assessment follow-up, not a request to start a formal PR review. Please echo the Assessment-ID and assessed base/head in your substantive reply and identify any remaining issue with the updated disposition.

@coderabbitai

coderabbitai Bot commented Oct 19, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -uo pipefail
head=eabfe1ba0306ac9eee1cc7cd29f1fe38bc84ca20
previous=d3e62ec1966b1eae87f46a3ece325955064e401a
base=61a101dd2eaa62059ed0152249bceda85ece3ac1
git rev-parse HEAD
git cat-file -t "$head"
git show --format=fuller --stat "$head"
git diff "$previous" "$head" -- docs/developers-guide.md docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
ast-grep outline docs/developers-guide.md --match 'Kani|Verus|proof'
ast-grep outline docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md --items all
rg -n -C7 'minimum_mixed_hash|unique_hashes|lemma_fold_count_is_permutation_invariant|full.signature|adjacent two|traversal correspondence|acceptance exception|historical|owner|Status:|Stage G' docs/developers-guide.md docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
ast-grep outline crates/whitaker_clones_core/src/index/kani.rs --items all
ast-grep outline verus/clone_detector_ast_features.rs --items all
rg -n -C5 'MinHasher::|minimum_mixed_hash|unique_hashes|fn verify_|lemma_fold_count_is_permutation_invariant' crates/whitaker_clones_core/src/index/kani.rs verus/clone_detector_ast_features.rs
git diff --check "$previous" "$head"
gh api repos/leynos/whitaker/actions/runs/39184288492 --jq '{head_sha,run_attempt,status,conclusion,html_url}'
gh api repos/leynos/whitaker/actions/runs/39184288492/jobs --paginate --jq '.jobs[] | {name,status,conclusion,head_sha}'
gh api repos/leynos/whitaker/commits/"$head"/check-runs --paginate --jq '.check_runs[] | {name,conclusion,details_url}'

Length of output: 134840


🏁 Script executed:

#!/bin/bash
set -euo pipefail
base=61a101dd2eaa62059ed0152249bceda85ece3ac1
previous=d3e62ec1966b1eae87f46a3ece325955064e401a
head=eabfe1ba0306ac9eee1cc7cd29f1fe38bc84ca20
git fetch --no-tags --depth=1 origin "$base" "$previous"
git diff --stat "$previous" "$head"
git diff "$previous" "$head" -- docs/developers-guide.md docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
git diff --check "$base" "$head"
printf '\n=== Exception authority and acceptance requirements ===\n'
sed -n '124,167p;787,813p;1403,1443p' docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
printf '\n=== Verus contract ===\n'
sed -n '161,190p' verus/clone_detector_ast_features.rs

Length of output: 15213


@pandalump Treat the proof-scope documentation concern as resolved on this candidate. Accept the historical-evidence paragraph as a transparent disclosure, but distinguish disclosure from owner approval of the exception.

Assessment-ID: WHITAKER-PR365-PLAN-eabfe1ba-20261019-03
Assessed base: 61a101dd2eaa62059ed0152249bceda85ece3ac1
Assessed head: eabfe1ba0306ac9eee1cc7cd29f1fe38bc84ca20

Documentation assessment

The corrected descriptions match the inspected proof sources:

  • docs/developers-guide.md, Line 2045–2050, lists the three current MinHash obligations. It explicitly excludes non-empty full-signature determinism and general duplicate-hash insensitivity.
  • Line 2076–2081 names lemma_fold_count_is_permutation_invariant. Its description matches the lemma’s equal-contribution-multiset precondition and equal-count postcondition.
  • The Verus summary now states that Rust tests exercise, rather than prove, traversal correspondence.

The previous candidate-to-head diff changes only the developers’ guide and ExecPlan. No further proof-scope correction is required for these passages.

Historical-evidence disposition

The exception at ExecPlan Line 803–812 is sufficient and transparent as an evidence record. It identifies the missing transcripts, states the inspected retention locations, and does not claim exhaustive absence. It also distinguishes current validation from historical red-green evidence.

For final plan acceptance, obtain or identify the plan owner’s explicit acceptance of this exception. The inspected paragraph declares the exception but does not identify an approving owner. If your comment represents the authorized owner’s acceptance, record that fact with a link. No separate approval mechanism is needed for this assessment.

Do not reconstruct present-day failures and present them as original red runs. The missing historical evidence is not a newly identified implementation defect.

Remaining completion-record issue

Correct the candidate attribution at ExecPlan Line 286–289. It still describes CI run 39182218490 and CodeScene result 8008611 as passing on “the current head”. Those results belong to the previous candidate.

Use the verified current-head results instead:

Keep Stage G’s separate formal-review requirement distinct from this assessment. I have not started a formal review.

Verification limits

I verified the exact checkout, the documentation-only follow-up diff, the relevant proof sources, hosted check status, and base-to-head git diff --check. The initial comparison failed because the shallow checkout lacked the previous commit; retrieving that commit resolved the failure.

I did not execute repository code, reproduce local gates or proofs, or inspect CodeScene’s individual gate details. This follow-up does not repeat the earlier production-code assessment.

Close the proof-scope documentation finding. Retain only the owner-acceptance record and stale hosted-evidence attribution as remaining disposition work.


🧠 Learnings used
Learnt from: buzzybee-df12
URL: https://github.com/leynos/whitaker/pull/365

Timestamp: 2026-10-18T19:15:13.789Z
Learning: In leynos/whitaker, the Rust AST Kani harness verify_kind_counts_stop_at_max_depth in crates/whitaker_clones_core/src/ast/kani.rs verifies the shared production for_each_node_at_depth traversal on one fixed five-node tree using a fixed-array depth tally. It does not symbolically verify kind_counts or KindCounts' BTreeMap accumulator. Production accumulation and sibling-order behaviour are exercised by runtime and property tests. Assess focused AST proof results separately from an unsuccessful or inconclusive full clone-detector Kani group run.

You are interacting with an AI system.

codescene-access[bot]

This comment was marked as outdated.

@buzzybee-df12

Copy link
Copy Markdown
Collaborator

@coderabbitai

This follows up on the plan assessment at #365 (comment) and your response at #365 (comment).

I corrected the ExecPlan in commit a20569eabd350954f639bed5b8307a2435e16070. It now labels run 39184288492 and CodeScene result 8008849 as evidence for the earlier exact head eabfe1ba0306ac9eee1cc7cd29f1fe38bc84ca20, rather than attributing them to the current head. The same plan records the unavailable historical per-function red-failure transcripts as an acceptance exception and explicitly says that this historical evidence requirement remains unmet.

The owner has accepted that exception for this delivery: the user explicitly instructed me to merge this PR once it reaches equilibrium. The PR’s current head a20569eabd350954f639bed5b8307a2435e16070 is now covered by successful linux-full, windows-compat, and coverage-check jobs in run 39186687988, plus passing CodeScene result 8009004.

Please confirm that the stale-evidence attribution concern and owner-acceptance item are resolved on this candidate, and that no plan-assessment concern remains.

Assessment-ID: WHITAKER-PR365-PLAN-a20569ea-20261019-05
Assessed base: 61a101dd2eaa62059ed0152249bceda85ece3ac1
Assessed head: a20569eabd350954f639bed5b8307a2435e16070

This is a candidate-bound assessment follow-up, not a request to start a formal PR review. Please echo the Assessment-ID and assessed base/head in your substantive reply.

@coderabbitai

coderabbitai Bot commented Oct 19, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
head=a20569eabd350954f639bed5b8307a2435e16070
previous=eabfe1ba0306ac9eee1cc7cd29f1fe38bc84ca20
base=61a101dd2eaa62059ed0152249bceda85ece3ac1
git rev-parse HEAD
for revision in "$head" "$previous" "$base"; do
  if ! git cat-file -e "$revision^{commit}" 2>/dev/null; then
    git fetch --no-tags --depth=1 origin "$revision"
  fi
done
git diff --stat "$previous" "$head"
git diff "$previous" "$head" -- docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
ast-grep outline docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md --items all
git show "$head:docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md" | rg -n -C5 '39184288492|8008849|eabfe1ba|acceptance exception|historical.*transcript|remains unmet|owner|current head|Status:'
git diff --check "$base" "$head"
gh api repos/leynos/whitaker/actions/runs/39186687988 --jq '{head_sha,run_attempt,status,conclusion,html_url}'
gh api repos/leynos/whitaker/actions/runs/39186687988/jobs --paginate --jq '.jobs[] | {name,status,conclusion,head_sha}'
gh api repos/leynos/whitaker/commits/"$head"/check-runs --paginate --jq '.check_runs[] | {name,conclusion,details_url}'

Length of output: 11172


@buzzybee-df12 Treat both remaining plan-assessment items as resolved on this candidate. No concern from this plan-assessment follow-up remains open.

Assessment-ID: WHITAKER-PR365-PLAN-a20569ea-20261019-05
Assessed base: 61a101dd2eaa62059ed0152249bceda85ece3ac1
Assessed head: a20569eabd350954f639bed5b8307a2435e16070

  • Stale-evidence attribution: resolved. The ExecPlan now binds CI run 39184288492 and CodeScene result 8008849 to the earlier exact head eabfe1ba0306ac9eee1cc7cd29f1fe38bc84ca20. The introductory phrase “current-head evidence” is imprecise, but the explicit commit attribution removes the substantive ambiguity.
  • Owner acceptance: resolved for this assessment. The ExecPlan records owner acceptance of the disclosed exception. Your comment explicitly confirms that acceptance. The historical-evidence requirement remains excepted, not satisfied. No further owner action is required for this item.

I verified the exact checkout and the documentation-only follow-up diff. I also confirmed:

  • CI run 39186687988 succeeded at the assessed head. All three named jobs passed.
  • The CodeScene check succeeded at that head and links to result 8009004.
  • Base-to-head git diff --check passed.

Keep formal review and Stage G separate from this conclusion. They remain open in the ExecPlan. This reply does not start a formal review, approve the PR, or authorize a merge.

This follow-up verifies the two remaining disposition items. It does not repeat the production-code assessment or reproduce local tests and proofs. I relied on your explicit confirmation of owner acceptance; I did not inspect the private delivery instruction.

You are interacting with an AI system.

@wafflecat-df12

Copy link
Copy Markdown
Collaborator

@coderabbitai are you satisfied that the introduced proofs (crates/whitaker_clones_core/src/ast/kani.rs::verify_smallest_covering_node_selects_minimal_range, verify_smallest_covering_root_fallback, verify_kind_id_round_trips_full_u16_domain, verify_kind_counts_stop_at_max_depth, and verify_kind_id_equality_and_order_cover_small_alphabet; crates/whitaker_clones_core/src/index/kani.rs::verify_lsh_config_new_smoke, verify_lsh_config_new_symbolic, verify_lsh_config_new_overflow_product, verify_min_hasher_sketch_rejects_empty_input, verify_min_hasher_lane_minimum_for_boundary_hashes, verify_min_hasher_unique_hashes_sorts_and_deduplicates, verify_lsh_index_rejects_self_pairs, verify_lsh_index_canonicalizes_pair_order, verify_lsh_index_deduplicates_repeated_band_collisions, verify_lsh_index_is_insertion_order_independent; and verus/clone_detector_ast_features.rs::lemma_fold_count_is_permutation_invariant) are substantive, rigorous, and well-founded?

This is a candidate-bound follow-up to the earlier AST proof assessment at #365 (comment) and response at #365 (comment).

Published head: a20569e; proof execution source head: d3e62ec; comparison base: 61a101d.
Proof inventory and claims: The two covering-range harnesses check minimal covering selection and root fallback over bounded symbolic ranges. The full-range KindId harness checks all u16 values. The depth-only harness checks depth counts and absence beyond the maximum for one fixed five-node tree. Equality/order checks exhaust all 256 assignments of four independent labels from {0,1,2,3}. The ten index harnesses cover configuration, bounded MinHash helper behaviour, and LSH candidate-pair properties. The Verus lemma proves permutation invariance for equal multisets of (kind, depth) contributions.
Production correspondence: The AST selector harnesses call select_smallest_covering; the production pruned parser traversal now shares its covering/minimum-width decision predicates from ast/cover.rs. The depth harness calls the production for_each_node_at_depth but substitutes a fixed-array tally for the BTreeMap sink. The fixture checks its depth tally, not a production maximum-depth cutoff, node identity, exactly-once visitation, preorder, map operations, or arbitrary traversal fidelity. The MinHash harnesses verify empty-input rejection and fixed lane/hash-normalization helpers, not complete signatures. The Verus sidecar models count algebra; Rust tests and proptest exercise production NormalizedTree traversal.
Assumptions, trusted boundaries, domain, and bounds: The u16 round-trip has no input restriction. The depth proof uses fixed kinds and five nodes, with #[kani::unwind(6)]; Kani reported zero failed checks and nine explicitly unreachable checks in that run. The documented four-value symbolic alphabet preserves all equality partitions and relative orderings among the four roles, but is not a full-width comparator proof. Kani's default unwind is 4; harness attributes override it. The depth proof at unwind 5 failed the for_each_node_at_depth loop-termination unwinding assertion; no unwinding assertions were disabled. Parser-produced counts/depths fit the Verus u32/u16 representation under the 10,000-node and depth-256 lowering limits; this claim does not extend to arbitrary publicly constructed trees. Verus assumes equal contribution multisets and proves exact count equality; it does not prove Rust emits those multisets.
Verifier evidence: Kani 0.67.0 with pinned nightly-2025-11-21/rustc 1.93, CBMC 6.8.0, and CaDiCaL 2.0.0. make kani-clone-detector passed all 15 harnesses; each ran in a separate process-tree cgroup capped at 8 GiB, swap disabled, timeout 600 seconds. Timeout, OOM, missing peak-memory evidence, or nonzero exit fails closed. Total harness durations were 936 seconds; the maximum peak was 4,835 MiB. make verus-clone-detector passed 9, 10, and 8 verified obligations with zero errors using Verus 0.2026.03.17.a96bad0 and toolchain 1.94. The Kani and Verus logs were captured on source head d3e62ec1966b1eae87f46a3ece325955064e401a; the assessed head a20569eabd350954f639bed5b8307a2435e16070 adds only documentation, and the proof sources and runners are unchanged between those heads. Logs: /tmp/kani-clone-detector-pr365-equilibrium-final.out, /tmp/kani-depth-unwind5-pr365-equilibrium.out, and /tmp/verus-clone-detector-pr365-equilibrium-final.out.
Non-vacuity and limitations: Kani symbolic inputs are unconstrained except for the stated range-domain assumptions in covering selection. The four-label proof enumerates all 256 assignments. The depth-5 negative control demonstrates that the unwind bound is material; the passing unwind-6 run checks loop termination and reports 0 of 569 failed (9 unreachable). Prior mutation checks show the covering proof detects a strict-boundary mutation and the fallback proof detects dropping the coverage predicate. The proofs remain bounded/model-checked, and their stated trust bridges do not imply complete production traversal or full-signature MinHash correctness.
Assessment-ID: WHITAKER-PR365-PROOF-a20569ea-20261019-06.

Please echo the Assessment-ID and assessed base/head in your substantive reply.
This is an assessment conversation, not a request to start a formal PR review.

Check substance, rigour, foundations, and correspondence to production code. Identify each unresolved concern or missing inspection explicitly.

@coderabbitai

coderabbitai Bot commented Oct 19, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -uo pipefail
head=a20569eabd350954f639bed5b8307a2435e16070
source=d3e62ec1966b1eae87f46a3ece325955064e401a
base=61a101dd2eaa62059ed0152249bceda85ece3ac1
git rev-parse HEAD
for revision in "$head" "$source" "$base"; do
  git cat-file -e "$revision^{commit}" 2>/dev/null || git fetch --no-tags --depth=1 origin "$revision"
done
git diff --stat "$source" "$head"
git diff --stat "$base" "$head" -- crates/whitaker_clones_core/src/ast crates/whitaker_clones_core/src/index verus scripts/run-kani.sh scripts/run-kani-limited.sh scripts/run-verus.sh
ast-grep outline crates/whitaker_clones_core/src/ast --items all
ast-grep outline crates/whitaker_clones_core/src/index --items all
ast-grep outline verus/clone_detector_ast_features.rs --items all
ast-grep outline scripts/run-kani.sh --items all
ast-grep outline scripts/run-kani-limited.sh --items all
ast-grep outline scripts/run-verus.sh --items all
ast-grep outline docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md --match 'proof|Kani|Verus'
rg -n -C3 '936|4,835|4835|569|unreachable|unwind.5|equilibrium-final|mutation|0\.67\.0|a96bad0' docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
for log in /tmp/kani-clone-detector-pr365-equilibrium-final.out /tmp/kani-depth-unwind5-pr365-equilibrium.out /tmp/verus-clone-detector-pr365-equilibrium-final.out; do
  if test -f "$log"; then printf '\n=== %s ===\n' "$log"; tail -100 "$log"; else printf 'Unavailable in sandbox: %s\n' "$log"; fi
done

Length of output: 30792


🤖 web_search executed:

Check official Kani documentation for kani 0.67: harness #[kani::unwind] precedence over --default-unwind, unwinding assertions, unreachable verification checks, and kani::assume vacuity. Check official Verus documentation on mathematical nat specification proofs and trusted external_body boundaries.

Length of output: 2965


🏁 Script executed:

#!/bin/bash
set -uo pipefail
for file in crates/whitaker_clones_core/src/ast/kani.rs crates/whitaker_clones_core/src/ast/cover.rs crates/whitaker_clones_core/src/index/kani.rs crates/whitaker_clones_core/src/index/types.rs crates/whitaker_clones_core/src/index/minhash.rs crates/whitaker_clones_core/src/index/lsh.rs verus/clone_detector_ast_features.rs; do
 printf '\n=== %s ===\n' "$file"
 nl -ba "$file"
done
printf '\n=== Production AST correspondence ===\n'
nl -ba crates/whitaker_clones_core/src/ast/features.rs | sed -n '155,235p'
nl -ba crates/whitaker_clones_core/src/ast/tree.rs | sed -n '1,155p'
nl -ba crates/whitaker_clones_core/src/ast/lowering.rs | sed -n '155,250p;275,365p'
printf '\n=== Proof runners ===\n'
nl -ba scripts/run-kani.sh
nl -ba scripts/run-kani-limited.sh
nl -ba scripts/run-verus.sh | sed -n '1,245p'
printf '\n=== Recorded final results ===\n'
sed -n '1605,1679p' docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
printf '\n=== Proof bypasses and conditional compilation ===\n'
rg -n -C3 'external_body|admit\(|assume\(|cfg\(kani\)|cfg\(not\(kani\)\)|stub|unwind|kani::assume' crates/whitaker_clones_core/src/ast crates/whitaker_clones_core/src/index verus/clone_detector_ast_features.rs

Length of output: 146783


🏁 Script executed:

#!/bin/bash
set -uo pipefail
printf '\n=== Proof-related base diff ===\n'
git diff 61a101dd2eaa62059ed0152249bceda85ece3ac1 a20569eabd350954f639bed5b8307a2435e16070 -- crates/whitaker_clones_core/src/index/kani.rs crates/whitaker_clones_core/src/index/lsh.rs crates/whitaker_clones_core/src/ast/kani.rs
printf '\n=== Runtime index assertions ===\n'
nl -ba crates/whitaker_clones_core/src/index/tests.rs | sed -n '1,340p'
printf '\n=== Model boundary documentation ===\n'
rg -n -C4 'proof seam|proof-only|fixed.array|bounded.*LSH|LSH.*bounded|cfg\(kani\)|candidate_pair_summary_for_kani|root.fallback|symbolic.*range' docs/developers-guide.md docs/whitaker-clone-detector-design.md docs/execplans/7-3-1-map-candidate-spans-and-extract-ast-feature-vectors.md
printf '\n=== AST limits and count update ===\n'
nl -ba crates/whitaker_clones_core/src/ast/features.rs | sed -n '1,55p'
rg -n -C2 'MAX_AST_NODES|MAX_AST_DEPTH' crates/whitaker_clones_core/src/ast/lowering.rs
printf '\n=== Tool installation configuration ===\n'
ast-grep outline scripts/install-kani.sh --items all
ast-grep outline scripts/install-verus.sh --items all
rg -n -C3 'VERSION|version|sha256|SHA256|0\.67|a96bad0|1\.94' scripts/install-kani.sh scripts/install-verus.sh
printf '\n=== Fragment identifier ===\n'
ast-grep outline crates/whitaker_clones_core/src/index/fragment_id.rs --items all
nl -ba crates/whitaker_clones_core/src/index/fragment_id.rs | sed -n '1,145p'

Length of output: 63320


@wafflecat-df12 Accept these as well-founded checks of narrow propositions, with different levels of assurance. Do not accept the complete inventory as direct verification of production LSH or as equivalent coverage to the removed accumulation and full-signature obligations.

I found no unsound proof step in the inspected harnesses or Verus sidecar. Correct three scope statements in the assessment request. Keep the independent execution audit open.

Assessment-ID: WHITAKER-PR365-PROOF-a20569ea-20261019-06
Assessed base: 61a101dd2eaa62059ed0152249bceda85ece3ac1
Assessed head: a20569eabd350954f639bed5b8307a2435e16070
Reported proof execution source head: d3e62ec1966b1eae87f46a3ece325955064e401a

I verified the exact checkout. Only two documentation files changed between the execution source head and the assessed head. The proof sources, production sources, and runners are unchanged across that interval.

Assess the propositions separately

Proof or group Assessment
verify_smallest_covering_node_selects_minimal_range Substantive bounded symbolic verification. It checks three non-empty candidate ranges and one target within offsets 0..=16. Given at least one covering candidate, it checks coverage and minimum width against a separate oracle. Production shares the covering and replacement predicates. Parser candidate enumeration and pruning remain outside the proof.
verify_smallest_covering_root_fallback Useful concrete regression verification, not symbolic fallback verification. It checks an empty candidate array and one fixed three-range non-covering array against target 4..8. It establishes None for those fixtures. It does not execute parser-root selection.
verify_kind_id_round_trips_full_u16_domain Exhaustive but elementary. It checks the production constructor and accessor for every u16 value.
verify_kind_counts_stop_at_max_depth Useful verification of one concrete production traversal. It checks [1, 2, 2, 0] for the fixed five-node tree. Retain all the traversal and map exclusions stated in your request.
verify_kind_id_equality_and_order_cover_small_alphabet Exhaustive within the stated alphabet, but elementary. Eight independent bits cover 256 assignments. The harness checks all six role pairs. Do not extend this result to full-width comparisons without the separate source-level argument from derived Eq and Ord.
Three LshConfig::new harnesses Substantive constructor coverage overall. The symbolic harness covers [0,128]², including typed error conditions and accepted values. The overflow harness covers rows = 2 and symbolic bands > usize::MAX / 2. The smoke harness adds one concrete accepted case. These call the production constructor.
Three MinHash harnesses Rigorous, narrow implementation checks. Empty-input rejection follows the production early-return path. The other two harnesses check production helpers with fixed inputs. They do not verify arbitrary hashes, seed generation, or complete signatures.
Four LSH pair harnesses Concrete checks of a bounded alternative implementation. They exercise shared configuration, signature-band iteration, identifiers, and CandidatePair::new. They do not execute production bucket storage or production candidate enumeration.
lemma_fold_count_is_permutation_invariant Substantive, general algebraic verification. The supporting induction establishes fold_count_from = accumulator + matching_count for arbitrary finite sequences. The final lemma derives equal folded counts from equal contribution multisets. This is not bounded tree enumeration.

Preserve these three scope corrections

1. Describe fallback as concrete None checks

In crates/whitaker_clones_core/src/ast/kani.rs, Line 147–165 contains no symbolic inputs.

Replace “the two covering-range harnesses … over bounded symbolic ranges” with separate descriptions for symbolic minimal selection and concrete no-cover fixtures.

Also separate the helper result from parser behaviour. Production select_covering_node returns SpanOutOfBounds when selection is empty. The harness name does not establish an actual parser-root fallback.

The symbolic minimal-selection proof also does not assert first-candidate tie-breaking, malformed-range handling, or empty-target handling. Those remain outside its proposition.

2. State the configuration assumptions explicitly

The statement that symbolic inputs are unconstrained except for covering-range assumptions is incorrect.

In crates/whitaker_clones_core/src/index/kani.rs:

  • Line 110–111 constrains both configuration inputs to at most MINHASH_SIZE.
  • Line 169–170 constrains bands to the overflowing multiplication domain for fixed rows = 2.

These domains are satisfiable and appropriate for the stated split. They do not create a source-level vacuity concern. They must still appear in the inventory.

3. Keep the LSH implementation boundary explicit

In crates/whitaker_clones_core/src/index/lsh.rs:

  • Production insertion updates BTreeMap/BTreeSet buckets.
  • Kani insertion records fragments in a fixed-array log.
  • Production candidate_pairs and add_bucket_pairs are excluded under cfg(kani).
  • The harnesses instead call candidate_pair_summary_for_kani.

This is more than a replacement storage container. It is separate candidate-generation logic.

Two limitations follow:

  • Canonical ordering uses a shared oracle. expected_pair calls the same CandidatePair::new used by the model. The harness cannot independently detect a consistently reversed canonicalization rule. The runtime test candidate_pair_orders_distinct_inputs supplies literal expected ordering.
  • Repeated-band collision handling differs structurally. The model checks whether two fragments share any band, then adds that insertion pair once. The two-band fixture does not exercise production’s repeated bucket emissions and final set deduplication.

The documentation already discloses the fixed-array model. The model also predates the comparison base. Retain it as bounded model evidence, not a newly introduced production defect or a direct proof of production pair generation. The inspected runtime tests exercise the production paths.

Accept the foundations within those boundaries

The covering assumptions admit ordinary examples. The separate oracle does not call the shared production predicates. The recorded strict-boundary and dropped-coverage mutations therefore provide useful non-vacuity evidence.

The depth bound matches the fixture. Five visits require the terminal loop check at unwind 6. Kani’s unwinding documentation supports this interpretation. Treat the unwind-5 failure as a bound check, not a mutation test of the functional tally.

The Verus sidecar contains no local assume, admit, or external_body escape. Its nat model avoids machine-integer overflow. For parser-produced trees, the inspected 10,000-node and depth-256 limits support the documented representability argument. Keep that argument separate from a machine-checked Rust refinement proof.

The runners register all 15 Kani harnesses. The resource wrapper implements the stated caps and failure handling for reported OOM, timeout, unavailable peak measurements, and nonzero exits. These controls support execution discipline; they do not strengthen a harness’s proposition.

Keep these inspection gaps open

  1. Raw execution verification is inconclusive. All three supplied /tmp logs are unavailable in this sandbox. Provide durable copies and retry the execution-evidence check. I inspected the recorded totals, but did not reproduce the 936-second run, tool versions, resource results, or negative controls.
  2. Individual check statuses remain unaudited. The ExecPlan classifies the depth proof’s nine unreachable checks as library guards and records reachable harness assertions. I could not confirm those classifications against raw output. I also did not classify every unreachable check in the other harnesses.
  3. Production LSH refinement remains unproved. The fixed-array model appears consistent with these fixtures, but no inspected theorem connects it to production bucket enumeration.
  4. Verifier correctness remains trusted. The results depend on the compiler translations, library models, verification engines, and solvers. This inspection did not independently validate those tools.

I used the retrieved proof-scope learning to preserve the distinction between the depth tally and production map accumulation.

Accept the narrow source-level propositions and the Verus algebra. Correct the three scope statements above. Leave independent execution verification unresolved until durable logs are available. Do not describe all 15 harnesses as equally substantive, or as comprehensive production correctness proofs.

This assessment does not start a formal PR review or approve the PR.


🧠 Learnings used
Learnt from: buzzybee-df12
URL: https://github.com/leynos/whitaker/pull/365

Timestamp: 2026-10-18T19:15:13.789Z
Learning: In leynos/whitaker, the Rust AST Kani harness verify_kind_counts_stop_at_max_depth in crates/whitaker_clones_core/src/ast/kani.rs verifies the shared production for_each_node_at_depth traversal on one fixed five-node tree using a fixed-array depth tally. It does not symbolically verify kind_counts or KindCounts' BTreeMap accumulator. Production accumulation and sibling-order behaviour are exercised by runtime and property tests. Assess focused AST proof results separately from an unsuccessful or inconclusive full clone-detector Kani group run.

You are interacting with an AI system.

Separate AST proof obligations, correct claims about modeled
behavior, and preserve the bounded proof output for audit.
codescene-access[bot]

This comment was marked as outdated.

Distinguish the standalone pre-suite proof measurement from the\nlater invocation recorded in the full Kani group.
codescene-access[bot]

This comment was marked as outdated.

leynos added 2 commits October 19, 2026 06:55
Give parser-pin, API-contract, and isolated Cargo tests allowances sized
for observed shared-cache waits, and serialize parser-pin builds. Use a
re-entrant guard for environment-test protocols so nested helpers can
safely share the lock. Keep the UI harness crate name owned across
setup and runner invocation.

Align workflow contracts and the developer guide with the revised
budgets.

@codescene-access codescene-access Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Health Improved (1 files improve in Code Health)

Gates Passed
6 Quality Gates Passed

See analysis details in CodeScene

View Improvements
File Code Health Impact Categories Improved
inner_attr.rs 9.69 → 10.00 Complex Method

Absence of Expected Change Pattern

  • whitaker/suite/src/driver.rs is usually changed with: whitaker/suite/src/lints.rs

Quality Gate Profile: Pay Down Tech Debt
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants