fix(checks): run every check on the reviewed snapshot and record scanned-tree provenance

[m-szymanska]

Substrate truth: every check judges the reviewed commit, and proves it

Part 1 of a 2-PR campaign attacking the root cause behind prview's recurring regressions: the truth about what was scanned lived in N places and none of them was authoritative. This PR makes the scanned substrate correct and auditable.

What was broken

1. Pytest ran on the local checkout (config.repo_root), not the reviewed snapshot. Reviewing a PR while another branch was checked out reported the local branch's test failures against the PR. Ruff/Mypy/JS were fixed in July (7d32744); pytest was the one check left behind.
2. All six cargo checks ran at cargo_cache_root (the local tree) for the same historical reason: build cache. A --pr pack could combine the target's diff with build/clippy/test/fmt verdicts from unrelated local code — the likely root cause of the 2026-07-24 remote-substrate-mutation incident.
3. Cargo cache keys couldn't tell substrates apart: the cached-result lookup runs before the snapshot is materialised, so a --pr run could hit an entry stored by a local run and serve the local checkout's verdict as the PR's.
4. No artifact could prove what was scanned. CheckProvenance carried cwd only — no tree SHA, no cleanliness. This is the "tree provenance" gap from the PR #46 artifact audit.

What this PR does

• Pytest resolves its cwd through plan_check_run → shared target snapshot, like every other language check (fix/pytest-on-pr-head).
• Cargo checks run in the snapshot with the build cache preserved via CARGO_TARGET_DIR → ~/.prview/cargo-target/<repo>, passed to the child process only. Local reviews (target == HEAD) are byte-for-byte unaffected. Cache keys use the resolved target commit when it differs from HEAD (fix/cargo-on-reviewed-snapshot).
• Every check's provenance now records target_sha (commit whose tree was scanned) and tree_state (snapshot / local-clean / local-dirty), resolved from the directory the command actually ran in — one resolver, no per-check duplication (fix/provenance-target-sha). Additive, no schema bump; old packs parse unchanged.
• Docs: new architecture.md sections "Where checks run" and "Check provenance".

Verification

• Each cut was falsified before merge: reverting the fix makes its regression test fail (recorded in the branch reports).
• Full gates on the integrated branch: 1221 lib + 81 integration tests, 0 failures; clippy -D warnings clean; fmt clean.
• Dogfood: a release build of this branch reviewing its own tree emits target_sha == HEAD, tree_state: local-clean in RUN.json, gate .result.json and report.json.
• One semantic (non-textual) merge conflict surfaced and was resolved with its own test update: the pytest branch pinned "cargo stays out of the shared snapshot", the cargo branch moved it in — the contract test now asserts the integrated truth.

Deliberate decisions (flagged, not hidden)

• rustfmt/cargo_audit are not added to check_scans_target_snapshot (the pre-existing-findings downgrade list), even though they now scan the snapshot. Widening that list makes the gate more permissive — that's verdict semantics, owned by the upcoming decision-core work, not a side effect of a substrate fix.
• Known trade-offs: first --pr run after this change compiles cold into the new cache dir; the cache dir has no GC yet; concurrent runs on different commits share it and rely on cargo's own locking (in-run cargo checks were already serialized).

Follow-up cut (pushed after the initial review round)

• Substrate manifest (feat/substrate-manifest): the pack now proves its substrate instead of merely recording it per check. 00_summary/PROVENANCE.json states the resolved target SHA and worktree state (clean + status_digest) for the whole run; cache entries gain a <key>.prov.json sidecar recording what tree produced them; pack sanity requires the manifest's required_files. Cleanup removes sidecars with their entries.
• RUSTSEC-2026-0213: ammonia bumped 4.1.3 → 4.1.4 (lockfile-only; Security Audit was red on main too).

Integrated gates after the follow-up: 1312 tests, 0 failures; clippy -D warnings clean; fmt clean.

• Review followup (round 1) (fix/review-followup-substrate): all 8 first-round threads addressed — an external cargo_root off-HEAD now skips the cargo checks with an explicit reason instead of scanning the operator's unrelated checkout (no verdict beats a wrong verdict); cache keys discriminate the cargo root (commit-<sha>-root:<rel>); a failed git status yields unknown tree state, never a false local-clean; off-HEAD python checks isolate uv into ~/.prview/uv-env/<repo> instead of mutating the operator's .venv; a mutated snapshot loses its clean certification (snapshot-dirty); a moved Cargo.toml resolves against the snapshot. Submodule init is deferred with a documented limitation (network-bound, mutates the superproject's .git/modules). One model underneath: repo_relative_cargo_root() feeds the snapshot mapping, the cache key, and the skip decision, so they cannot diverge. Details in the individual thread replies.

Integrated gates: 1324 tests, 0 failures; clippy -D warnings clean; fmt clean.

• Review followup (round 2) (fix/review-followup-substrate-2): PROVENANCE.json records the merge-base the diff actually used (not the base tip); the worktree digest fingerprints changed bytes (streamed sha256 of the dirty subset), so two runs differing only in content no longer share a digest; --watch refreshes worktree provenance every iteration; cache entries publish atomically as a single file (staging + rename, legacy entries still readable); AI_INDEX.md documents PROVENANCE.json in the pack reading order. Known candidate follow-up flagged, not silently patched: RUN.json freshness.base_sha has the same tip-vs-merge-base issue (no consumers in-repo).

• Review followup (round 3) (fix/review-followup-substrate-3): uv environments keyed per reviewed substrate (target SHA token, conservative pruning: 3 freshest kept, nothing used within 24h deleted); cargo eligibility asks the reviewed commit's tree (path_exists_at_commit) instead of the local profile, so a target that dropped its last Cargo.toml skips with a reason instead of six missing-manifest failures; cache keys are filesystem-safe (commit-<sha>-root-<hash>, no slashes or colons — the nested-root shape previously failed every write, so those checks silently recomputed each run).

• Review followup (round 4) (fix/review-followup-substrate-4): a cargo root moved to a different directory in the reviewed commit is rediscovered from the git tree (mapped root → repo root → exactly-one manifest within 2 levels; ambiguity skips with the candidates named instead of guessing), and a symlinked cargo root can never escape the snapshot (git-tree resolution cannot traverse symlinks, plus a canonicalizing containment check as defence in depth).

• Review followup (round 5) (fix/review-followup-substrate-5): cargo results for targets without a committed Cargo.lock are day-stamped in the cache key (the Cargo audit pattern) instead of cached indefinitely by commit — bounded staleness without paying dependency resolution before the lookup; nested repositories contribute gitlink:<head>:<clean|dirty> to the worktree digest instead of a literal dir, so materially different submodule states no longer share a digest.

Final integrated gates: 1343 tests, 0 failures; clippy -D warnings clean (verified on 1.93/1.95/1.97); fmt clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Nqgpf1YwXw2m3vqC8Ur8nr

[claude]

⚠️ Code review skipped — your organization has reached its monthly code review spending cap.

An organization admin can view or raise the cap at claude.ai/admin-settings/claude-code. The cap resets at the start of the next billing period.

Once the cap resets or is raised, reopen this pull request to trigger a review.

[Copilot]

Pull request overview

This PR runs checks against the reviewed snapshot and records scanned-tree provenance.

Changes:

• Moves Pytest and Cargo checks onto reviewed snapshots.
• Preserves Cargo caching via CARGO_TARGET_DIR.
• Adds target_sha and tree_state to artifacts and reports.
• Updates tests, documentation, and changelog.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Summary
src/config/mod.rs	Adds shared Cargo cache path resolution.
src/cli/mod.rs	Updates provenance-related help text.
src/checks/typescript.rs	Records substrate provenance.
src/checks/semgrep.rs	Supplies repository context for provenance.
src/checks/python.rs	Runs Pytest in the reviewed snapshot.
src/checks/mod.rs	Adds shared substrate resolution; cleanliness failures must not be reported as clean provenance. Moderate, 3 votes.
src/checks/cargo.rs	Cargo checks may fall back to an unrelated local checkout off-HEAD. Critical, 2 votes. Cache keys also omit the configured Cargo root. Critical, 3 votes.
src/artifacts/verdict.rs	Preserves verdict downgrade behavior.
src/artifacts/tests.rs	Tests provenance artifact behavior.
src/artifacts/report.rs	Adds substrate fields to reports.
src/artifacts/mod.rs	Emits provenance in generated artifacts.
docs/architecture.md	Documents check execution and provenance.
CHANGELOG.md	Records the changes.

Suppressed comments (3)

docs/architecture.md:257

• “Every non-cached check” is stronger than the implementation: runtime spawn errors, Semgrep worktree failures, and Cargo geiger's virtual-manifest/timeout paths return non-cached results with provenance: None (for example, src/checks/cargo.rs:732-740). Qualify this as every non-cached check that actually executes a command so consumers do not require provenance on skipped or unavailable results.

Every non-cached check records a `CheckProvenance` alongside its result:

src/checks/mod.rs:119

• Excluding ignored entries means an ignored test_*.py (or another file collected by a broad check) can be present in repo_root, be scanned by Pytest, and still yield LocalClean; the emitted target_sha then falsely claims the scanned bytes exactly match the commit. Either include ignored files in the conservative classification or weaken the LocalClean contract so it does not promise byte-for-byte identity.

    let mut opts = git2::StatusOptions::new();
    opts.include_untracked(true)
        .include_ignored(false)
        .include_unmodified(false);

src/checks/python.rs:650

• The guard checks for either executable, but the implementation always prefers uv when it is present. If uv is installed while pytest is not, this fixture still runs uv run pytest from a temporary directory with no pyproject.toml or virtual environment and can fail before testing the scan directory. Make the fixture provide the selected launcher with a usable pytest environment, or skip when that exact invocation is unavailable.

    async fn test_pytest_runs_in_scan_dir_not_repo_root() {
        if which::which("pytest").is_err() && which::which("uv").is_err() {
            return;

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d5e5ccdcc6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated no new comments.

Suppressed comments (9)

src/artifacts/report.rs:735

• Cached results still arrive from load_cached_result with provenance: None, so this tuple emits no target_sha/tree_state (or cache key) whenever a check is served from cache. A PR run can therefore produce a cached gate/report with no evidence of which substrate was scanned, defeating the auditability goal; persist provenance in the cache or reconstruct it when loading the cached result.

                        prov.target_sha.clone(),
                        prov.tree_state.map(|state| state.as_str()),
                        if prov.hard_fail_signatures.is_empty() {
                            None
                        } else {

src/checks/cargo.rs:75

• Because this branch is taken in an off-HEAD run, it leaves Cargo on the local cargo_root even though the target snapshot exists. off_head_target_commit still keys the result by the reviewed commit, and the provenance resolver classifies this external git directory as snapshot, so a result from an unrelated local tree can be cached/reported as the PR's. Fail the check (or otherwise mark it unscannable) when the configured root cannot be mapped into the snapshot instead of falling back.

    let Some(cwd) = snapshot_cargo_root(&local_root, &config.repo_root, &plan.scan_dir) else {
        // A cargo root configured outside the repo cannot exist inside a
        // snapshot of that repo, so there is nothing to redirect to: keep the
        // previous local-tree behaviour rather than invent a path.
        return Ok(CargoRun {

src/checks/cargo.rs:136

• The cache-safety change is not exercised by the current tests: test_cargo_run_uses_shared_build_cache_off_head uses a non-git repo plus scan_dir_override, so off_head_target_commit returns None and the new commit-based branch is never reached. Add a real git fixture with HEAD != target and assert the cargo/clippy/rustfmt/audit keys differ from the local key and contain the target commit, otherwise the reported PR/local cache collision can regress undetected.

    if let Some(commit) = reviewed_substrate_key(config) {
        return commit;
    }

src/checks/cargo.rs:1511

• Despite its name and assertions, this test invokes RustfmtCheck.run, not CargoCheck.run, so it never exercises the new cargo check snapshot path at lines 191-195. Rename it to describe Rustfmt or switch the invocation to CargoCheck (and keep separate coverage for both) so a regression in the check implementation cannot pass under the wrong test name.

    async fn test_cargo_check_runs_in_scan_dir_not_repo_root() {

src/checks/cargo.rs:156

• Using only the reviewed commit as the Cargo cache key drops the configured cargo root/workspace from the cache identity. Two configurations in the same repository can analyze different Cargo.toml roots at the same commit (for example, the repository root versus a workspace member), but Cargo check, Clippy, Rustfmt, audit, and geiger will now share a key and can return one workspace's verdict for another. Preserve a stable cargo-root/workspace component alongside the target commit (including the audit key).

/// The reviewed tree is fully determined by the target commit, so the commit id
/// IS the content key — no file hashing needed, and no chance of colliding with
/// a local-tree key written by an earlier local run (which would serve the local
/// checkout's verdict for a PR).

src/checks/mod.rs:122

• An error from repo.statuses is converted to false, so the caller records LocalClean and claims the scanned bytes exactly match target_sha even though cleanliness was never verified. That makes the new audit signal actively misleading on status/read errors; propagate an unknown substrate (leave both fields unset) rather than treating an error as clean.

    repo.statuses(Some(&mut opts))
        .map(|statuses| !statuses.is_empty())
        .unwrap_or(false)

src/checks/mod.rs:99

• is_external is only a path comparison, but externality is not equivalent to being an ephemeral snapshot. An external Cargo root can be a real unrelated Git repository, while a snapshot created under TMPDIR inside the repo is classified as local. Both cases produce incorrect tree_state/target provenance; identify snapshots from the plan/worktree metadata or expected target commit rather than path location alone.

    let is_external =
        crate::paths::normalize_to_repo_relative(&cwd.display().to_string(), repo_root).is_external;

    let tree_state = if is_external {
        TreeState::Snapshot

src/checks/mod.rs:52

• local-clean claims the scanned bytes are exactly target_sha, but the dirty check explicitly excludes ignored files. Commands such as pytest -v, ruff check ., and Cargo can read ignored/generated source files, so a Git-clean working tree can still differ from the commit being reported. Either account for relevant ignored content or weaken this state to tracked-tree cleanliness.

    /// The repo's own working tree with no uncommitted changes — the scanned
    /// bytes are exactly `target_sha`.
    LocalClean,
    /// The repo's own working tree carrying uncommitted changes — the scanned
    /// bytes are NOT exactly `target_sha`.
    LocalDirty,

src/config/mod.rs:1004

• prview_home() returns PRVIEW_HOME verbatim. If that environment variable is relative, this relative CARGO_TARGET_DIR is resolved by Cargo against the snapshot cwd, so each ephemeral snapshot gets its own throwaway cache instead of the shared per-repo cache. Normalize or reject relative PRVIEW_HOME before passing this path to the child process.

    pub fn cargo_build_cache_dir(&self) -> PathBuf {
        prview_home()
            .join("cargo-target")
            .join(cache_namespace_from_root(&self.repo_root))

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 81a21e3651

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 19 out of 20 changed files in this pull request and generated 1 comment.

Suppressed comments (10)

Previously missed (1) — in code that hasn't changed since the last review.

src/checks/mod.rs:99

• is_external is the only condition for Snapshot, so any external Git repository is reported as the reviewed snapshot. For example, the out-of-repository cargo-root fallback above can execute in another repository, whose unrelated HEAD is then emitted as a snapshot target_sha. Validate the external repository against the resolved target, or carry the snapshot identity into this resolver, instead of inferring it from path location alone.

    let is_external =
        crate::paths::normalize_to_repo_relative(&cwd.display().to_string(), repo_root).is_external;

    let tree_state = if is_external {
        TreeState::Snapshot

src/artifacts/mod.rs:625

• This adds a new required Artifact Pack v1 file and schema, but the docs/contracts set has no contract for PROVENANCE.json describing its version, fields, or timing. Architecture and usage prose do not provide a versioned consumer contract; add one alongside this change so pack consumers do not have to reverse-engineer the new artifact.

    // 00_summary/PROVENANCE.json — pack-level substrate record. Written before
    // RUN.json/MANIFEST so the manifest hashes it like any other pack file.
    let t = Instant::now();
    generate_provenance_json(ProvenanceJsonInput {
        dir: &summary_dir,

src/artifacts/mod.rs:1154

• resolved_bases are the original base tips, but the callers compute diff_bases = resolve_diff_bases(...) and generate the pack's diffs from those merge-base refs. When a base branch has advanced, this records the base tip rather than the commit the pack actually diffed against, so PROVENANCE.json's base_sha is not an auditable diff baseline. Pass the diff-baseline refs into this generator while retaining the display/base-tip refs separately.

        "base_sha": resolved_bases.first().map(|b| b.commit_id.as_str()),

src/cache/mod.rs:104

• The cache key is published before the newly added output/provenance sidecars. A concurrent prview can observe the status file and return a cached result while *.prov.json is absent or still belongs to another write, so the promised cache provenance can be missing or mismatched (and the output sidecar has the same race). Publish a complete entry atomically under a per-entry lock, or otherwise make the key visible only after all sidecars are committed.

        // Write provenance if present, and drop a stale one otherwise so a
        // re-run without provenance can never replay the previous run's.
        match provenance {
            Some(provenance) => {
                fs::write(sidecar(&cache_dir, key, PROVENANCE_SUFFIX), provenance)?;
            }
            None => {
                let _ = fs::remove_file(sidecar(&cache_dir, key, PROVENANCE_SUFFIX));

src/checks/cargo.rs:75

• snapshot_cargo_root can return None for a configured cargo root outside repo_root, and this branch silently runs the check against local_root. That breaks the reviewed-snapshot invariant: a --pr/--remote run can still report the local checkout's cargo result. Reject or skip this configuration (or materialise an equivalent snapshot) instead of falling back to the local tree.

    let Some(cwd) = snapshot_cargo_root(&local_root, &config.repo_root, &plan.scan_dir) else {
        // A cargo root configured outside the repo cannot exist inside a
        // snapshot of that repo, so there is nothing to redirect to: keep the
        // previous local-tree behaviour rather than invent a path.
        return Ok(CargoRun {

src/checks/cargo.rs:159

• reviewed_substrate_key keys every off-HEAD run by the target commit, but plan_cargo_run can fall back to local_root when snapshot_cargo_root returns None. In that case this key is attached to a result produced by the local checkout, so a later run can replay unrelated local contents under the reviewed commit's key. Only use the commit key when the cargo root is snapshot-mappable, or disable caching for this case.

fn reviewed_substrate_key(config: &Config) -> Option<String> {
    off_head_target_commit(config).map(|commit| format!("commit-{commit}"))
}

src/checks/cargo.rs:1529

• This regression test invokes RustfmtCheck, so it never exercises the Cargo check path described by its name and docstring. A regression in CargoCheck could pass while this test remains green; use CargoCheck with a compile-failing local fixture, or rename this test and add a separate CargoCheck case.

        let result = RustfmtCheck.run(&config).await.expect("rustfmt run");

src/checks/cargo.rs:135

• When the target is off HEAD, this replaces the content hash with only the target commit. That drops the configured cargo_cache_root identity, so runs against the same commit from a workspace root and a member (or two different configured members) share one result even though Cargo scans different manifests/packages and can produce different verdicts. Include a stable cargo-root/manifest identity in the off-HEAD key as well.

    if let Some(commit) = reviewed_substrate_key(config) {
        return commit;

src/checks/mod.rs:156

• This resolver is called only after build_with_cwd_display has awaited the command. A local check that creates a non-ignored file, or a concurrent worktree change, can therefore be recorded as local-dirty even though it started from a clean tree, making the per-check substrate disagree with the tree that was scanned. Capture the substrate before spawning and carry it through the result.

    pub fn with_scan_substrate(mut self, cwd: &Path, repo_root: &Path) -> Self {
        let substrate = resolve_scan_substrate(cwd, repo_root);
        self.target_sha = substrate.target_sha;
        self.tree_state = substrate.tree_state;

src/checks/mod.rs:122

• unwrap_or(false) maps a status-read failure to LocalClean, so provenance asserts that the checked-out HEAD was clean when the repository could not be inspected. For an audit record, preserve an unknown state (for example, return no tree state) rather than reusing the gate's permissive fallback.

    repo.statuses(Some(&mut opts))
        .map(|statuses| !statuses.is_empty())
        .unwrap_or(false)

[chatgpt-codex-connector]

💡 Codex Review

prview-rs/src/checks/mod.rs

Lines 426 to 430 in 6a5141f

	match run_command_with_timeout(
	"uv",
	&["sync", "--quiet"],
	&config.repo_root,
	CHECK_TIMEOUT_SECS,

Pre-sync the reviewed Python environment

On the first off-HEAD review of a Python commit, this pre-sync still runs in config.repo_root without the commit-specific UV_PROJECT_ENVIRONMENT that plan_python_run later assigns. The installed uv sync --help identifies the command as updating the current project's environment, so it warms the checkout's environment rather than the reviewed target's; each subsequent uv run must build the cold target environment inside its own 300-second timeout, and the parallel Python checks can spend that budget waiting for the same environment synchronization. Materialize the shared snapshot and pre-sync its commit-scoped environment before starting the per-check timers.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cc4107a232

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

prview-rs/src/checks/mod.rs

Lines 481 to 482 in a3bc2dd

	let mut config = config.clone();
	let _shared_snapshot = share_target_snapshot(&mut config, &runnable_checks);

Isolate checks that can mutate the shared snapshot

When a test, build script, or tool writes into its checkout, every concurrently running and subsequent check now observes that mutation because all runnable checks share this single mutable worktree. For example, a pytest fixture or Cargo build script that rewrites a tracked config/source file can make a sibling linter judge bytes that are neither the reviewed commit nor its own clean setup, producing order-dependent gate results; recording snapshot-dirty afterward exposes the contamination but does not make the verdict accurate. Use isolated worktrees for potentially mutating checks or reset/verify the shared tree before each check consumes it.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 48679c7121

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove the leftover merge marker

This conflict marker and the duplicated ### Changed block below it are now part of the published changelog. git diff --check reports this exact line as a leftover conflict marker, so resolve the duplicated section before shipping the documentation.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Traverse every declared workspace member

When a workspace member is four or more directories below the Cargo root, this fixed-depth walk never inspects its manifest, so an absolute or symlink-escaping path dependency there still compiles foreign source while provenance reports an exact snapshot. Fresh evidence beyond the earlier workspace-manifest finding is the current hard-coded depth of 3; Cargo accepted and compiled a member at a/b/c/d in an offline check. Enumerate the actual workspace members instead; Cargo documents that cargo metadata --no-deps outputs workspace members without fetching dependencies.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Include member manifests in stale-lock detection

When a workspace member changes a direct dependency requirement without regenerating the root Cargo.lock, this reads only the Cargo-root manifest, so lock_covers_manifest can still classify the substrate as pinned and omit the daily freshness stamp. The Cargo commands do not pass --locked—which Cargo defines as asserting that the lockfile remains unchanged—so the first run may resolve from the moving registry and then cache that result permanently by commit. Fresh evidence beyond the prior requirement-comparison finding is that the current implementation still never reads member manifests here.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Refuse source symlinks that escape snapshots

When the reviewed commit tracks an absolute source symlink such as src/lib.rs pointing outside the repository, the snapshot remains status-clean and this classifies it as exact even though Cargo follows the link and compiles the external bytes; changing those bytes does not alter the commit-based cache key. Fresh evidence beyond the manifest and dirty-symlink fixes is that a clean tracked source symlink never reaches the dirty-path fingerprint or the manifest/lock containment checks. Detect escaping tracked symlinks or classify the substrate as non-hermetic instead of snapshot.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Disable downgrades for borrowed dependency snapshots

When an off-HEAD JavaScript review links the checkout's node_modules, this state correctly records snapshot-borrowed-deps, but CleanComparison::applies_to still whitelists ESLint and Stylelint solely by check ID via check_scans_target_snapshot and never consults the check's provenance. A local plugin or rule version can therefore create findings in unchanged files that are downgraded as pre-existing, potentially allowing a PASS for a dependency-changing target. Fresh evidence beyond the earlier substrate-label fix is that the new label is serialized but is not used by the downgrade predicate; require an exact snapshot state before applying that downgrade.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Record the tree scanned by ghost-reference checks

When a remote or off-HEAD review produces a ghost_refs warning, that synthetic check is included in all_checks with provenance: None, so these fields are emitted as null even though generate_ghost_refs actually walks repo.path()—the operator's local checkout, not the reviewed target snapshot. This can make a target deletion's gating signal depend on unrelated local files while the mandatory provenance row gives no way to detect it. Fresh evidence beyond the Loctree provenance fix is the separate ghost_refs result in src/artifacts/signal/ghost_refs.rs, which still scans a real tree without recording it; run it on the target substrate or populate its actual local-tree provenance.

Useful? React with 👍 / 👎.