Repository navigation
SDK assurance: measurements, assertions, lifecycle gates, and durable verdicts - #972
Conversation
Introduce persisted measurements, assertions, trigger-bound gates, and immutable verdicts across the core CLI, public SDK, PmClient, generic actions, and MCP contracts. Add generated runtime/tool/public-surface contracts, complete documentation and acceptance coverage, refresh policy-aged ESLint and Node type dependencies, generate the PM changelog, and track GH-969 through GH-971 in canonical PM lineages. Tracked by pm-2lex4r, pm-lyfu7b, pm-wn6wot, pm-91xeam, and pm-8l1m5t.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Acknowledged: this review provider is unavailable because its weekly quota is exhausted, so it supplied no code findings and is not counted as approval. The exact-head review loop remains gated on the available reviewers and required checks. |
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe change adds persisted assurance measurements, assertions, gates, and verdicts. It exposes assurance through SDK, CLI, and MCP paths, updates contracts and public surfaces, adds documentation and tests, refreshes development dependencies, updates hosted gate registry identity, and records project-management outcomes. ChangesAssurance delivery
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant Client as PmClient or CLI
participant Dispatch as runAssuranceDispatch
participant Action as runAssuranceAction
participant Runtime as createAssuranceWorkspaceContext
participant Registry as Assurance registry
Client->>Dispatch: submit assurance operation
Dispatch->>Action: normalize arguments and options
Action->>Runtime: create evaluation context
Runtime->>Registry: read workspace declarations
Registry-->>Runtime: return declarations and workspace state
Runtime-->>Action: return evaluation context
Action-->>Client: return declarations, receipts, or verdicts
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideAdds a new SDK-owned assurance system (measurements, assertions, lifecycle gates, durable verdict history) and wires it consistently through CLI, SDK, MCP, and runtime contracts, plus minor dependency and documentation updates. Sequence diagram for running an assurance gate and recording a verdictsequenceDiagram
actor User
participant CLI as pm_assurance_CLI
participant Runtime as runAssuranceAction
participant Assurance as evaluateAssuranceGate
participant Context as createAssuranceWorkspaceContext
participant Audit as recordAssuranceVerdict
User->>CLI: pm assurance run <gate_id> --trigger <trigger>
CLI->>Runtime: runAssuranceAction(action="run", id, trigger, dry_run?)
Runtime->>Context: createAssuranceWorkspaceContext(pmRoot, tree_id?)
Context-->>Runtime: AssuranceEvaluationContext
Runtime->>Assurance: evaluateAssuranceGate(gateId, document, context, trigger)
Assurance-->>Runtime: AssuranceGateVerdict
alt non_dry_run
Runtime->>Audit: recordAssuranceVerdict(pmRoot, verdict, author, message)
Audit-->>Runtime: void
end
Runtime-->>CLI: AssuranceGateVerdict
CLI-->>User: printResult(verdict)
opt verdict.exit_code == 1
CLI->>CLI: process.exitCode = 1
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Merging this PR will improve performance by 2.23%
|
| Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|
| ⚡ | encodeQueryCursor |
259.4 µs | 253.7 µs | +2.23% |
Tip
Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.
Comparing feat/sdk-assurance-primitives (5b5359a) with main (3791ff1)
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 26
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/pm/chores/pm-8l1m5t.toon:
- Line 31: Clarify that the 2026-08-11 completion dates are Europe/Vienna
execution dates while PM event timestamps remain UTC. Update the completion
evidence entries in .agents/pm/chores/pm-8l1m5t.toon:31-31,
.agents/pm/features/pm-2lex4r.toon:29-29,
.agents/pm/features/pm-91xeam.toon:30-30, and
.agents/pm/features/pm-lyfu7b.toon:31-31 to explicitly identify both date
conventions, without changing the UTC event timestamps.
- Around line 37-43: Update the structured tests and test_runs evidence for
.agents/pm/chores/pm-8l1m5t.toon lines 37-43 to link typecheck, lint, coverage,
packed-consumer, dogfood, and audit commands; update
.agents/pm/features/pm-2lex4r.toon lines 37-43 with measurement CRUD,
source-adapter, cost-bound, arithmetic, CLI, and full-suite evidence; update
.agents/pm/features/pm-91xeam.toon lines 37-43 with hash-chain, Decision
authorization, history-compaction, fresh-process, and full-suite evidence; and
update .agents/pm/features/pm-lyfu7b.toon lines 38-44 with polarity, scope,
lifetime, negative-control, authorization, CLI, and full-suite evidence. Every
runnable verification referenced by each close_reason must be executed and
linked through pm test, with command-specific test_runs recorded where needed.
In @.agents/pm/features/pm-91xeam.toon:
- Line 20: Update the acceptance criterion in the actual_result statement so it
requires verdict records for every non-dry evaluation, or explicitly document
dry-run evaluations as an accepted exception before closing the item; keep the
workspace-history and structured-evidence requirements intact and align the
wording with docs/ASSURANCE.md.
In @.agents/pm/features/pm-wn6wot.toon:
- Line 32: Clarify the evidence date in the canonical PM record to state that
event timestamps remain UTC while execution dates use Europe/Vienna, then append
the clarification through pm comments rather than editing hash-chain history.
Apply the canonical clarification to .agents/pm/history/pm-2lex4r.jsonl:16-16,
.agents/pm/history/pm-8l1m5t.jsonl:28-28,
.agents/pm/history/pm-91xeam.jsonl:13-13,
.agents/pm/history/pm-gjjurs.jsonl:1-1, .agents/pm/history/pm-gok2km.jsonl:1-1,
.agents/pm/history/pm-lyfu7b.jsonl:15-15,
.agents/pm/history/pm-wn6wot.jsonl:28-28, and
.agents/pm/history/pm-zryb9d.jsonl:1-1; then regenerate the projections at
.agents/pm/features/pm-wn6wot.toon:32-32 and
.agents/pm/issues/pm-gjjurs.toon:29-29.
In `@docs/README.md`:
- Line 56: Update the Project Assurance Primitives entry in docs/README.md to
include a documentation link to docs/README.md, and ensure pm-u9d0 also has a
documentation link. Make the changes through the pm docs workflow as requested.
In `@sdk/public-surface.json`:
- Line 18198: Export AssuranceActionInput and AssuranceActionResult from both
./sdk/core and ./sdk/runtime so the PmClient.assurance signature is importable
through either entrypoint, then regenerate sdk/public-surface.json to reflect
the updated public API.
In `@src/sdk/cli-contracts/tool-parameter-tables.ts`:
- Line 501: Update the assurance schema’s definition contract near the
definition field so it enforces kind-specific requirements, including id,
source, and assertion_ids as required by the runtime validators; alternatively,
add a contract test explicitly documenting that these checks are runtime-only.
Keep the put contract aligned with the selected approach and prevent unrelated
fields or an empty object from being accepted silently.
In `@src/sdk/governance/assurance-action.ts`:
- Around line 198-209: Validate input.trigger against the declared
AssuranceGateTrigger vocabulary before the cast in the assurance run flow.
Update the existing guard around evaluateAssuranceGate to reject unknown values
with a PmCliError using EXIT_CODE.USAGE and a message that identifies the valid
triggers, while preserving the existing missing-trigger behavior.
- Around line 226-238: The mutation options in the assurance action flow must
stop auto-populating authorized_decision_ids from every workspace item of type
decision. Remove that synthesis from the put/assertion path and require
caller-provided authorization, with validation delegated to the existing
assurance declaration guard so only an explicitly authorized, valid decision can
permit loosening or retirement.
In `@src/sdk/governance/assurance-runtime.ts`:
- Around line 79-90: Update resolveTreeId’s execFileAsync invocation to include
a finite timeout option for the git rev-parse operation, ensuring it cannot hang
indefinitely while preserving the existing working-copy fallback when the
command fails or times out.
- Around line 92-107: Update readWorkspaceHistory to avoid loading history for
item-only callers such as assurance put --kind assertion, making the history
retrieval optional or lazy while preserving empty results for missing history.
When history is required, replace the unbounded Promise.all over items with
bounded concurrency so readHistoryEntries does not open one file per item
simultaneously.
In `@src/sdk/governance/assurance.ts`:
- Around line 724-730: Update validateMeasurementDefinition to validate the
items source: when items.field is set, require items.equals and reject
declarations that omit it. Keep the existing field/value comparison in the
source.kind === "items" filtering logic unchanged for valid declarations.
- Around line 791-814: Introduce a per-evaluation Map<string,
AssuranceMeasurementResult> cache and thread it through
evaluateMeasurementInternal and evaluateExpression. In the measurement branch of
evaluateExpression, return the cached result by measurement id when available;
otherwise evaluate the definition, store the result, and reuse it for later
references. Initialize one cache per evaluateMeasurement call, preserve the
existing stack-based cycle detection, and keep evaluateAssuranceGate’s separate
assertion evaluations isolated.
- Around line 916-954: Replace the unbounded Promise.all assertion evaluation
around the gate assertion mapping with a bounded-concurrency scheduler, limiting
in-flight assertion evaluations and therefore downstream external adapter calls
while preserving result ordering and existing scoping behavior. Update the
AssuranceEvaluationContext.external contract documentation to require
implementations to enforce an appropriate timeout.
- Around line 1121-1131: Update listAssuranceVerdicts to bound history reads by
adding a limit option and returning the newest matching verdicts first. Apply
the limit while querying or iterating entries so the complete workspace history
is not materialized on every call, while preserving the existing gate_id
filtering and verdict validation.
- Around line 694-701: Add a shared collectMeasurementReferences(document)
helper that gathers assertion.measurement_id, filter-scope measurement_id
values, and every AssuranceMeasurementReference in derived-source expression
trees; use it in validateAssuranceDocument and removeAssuranceDeclaration. At
src/sdk/governance/assurance.ts:694-701, reject missing filter-scope and
derived-expression measurements; at src/sdk/governance/assurance.ts:1082-1084,
use the same helper to block removal of measurements referenced by derived
expressions.
- Around line 724-732: Update the `source.kind === "items"` branch so its
returned `population_size` uses the scanned population `context.items.length`
instead of `matches.length`, while leaving the match count as `value` and
preserving the existing contributors and cost.
- Around line 646-649: Update the bound validation near boundFor(definition) to
allow finite negative numeric values for all polarities, while retaining
requireFiniteNonNegative only for the max_cost polarity. Preserve rejection of
non-finite values and ensure signed bounds remain valid for floor, ceiling,
monotone_nondecreasing, and derived measurements.
- Around line 974-978: Update readDocument, putAssuranceDeclaration, and
removeAssuranceDeclaration to catch JSON parsing and assurance-document
validation failures, converting SyntaxError and TypeError cases into PmCliError
with the appropriate exit code and actionable recovery guidance. Preserve the
existing empty-document behavior when assurance.json is absent and continue
returning validated documents for valid data.
In `@src/sdk/runtime.ts`:
- Around line 1155-1159: Add an assertion in the assurance integration test
covering PmClient.assurance to verify the recorded history author is
"runtime-test". Keep the existing forwarding of author and cwd through the
assurance path unchanged.
In `@tests/unit/commands/contracts-command.spec.ts`:
- Around line 2129-2144: Expand the assurance flag assertions in the
runContracts test for command_flags so all seven flags are covered, including
--tree, --gate, --author, and --message. For every value-taking flag, also
assert its expected value_name while retaining the existing checks for
--definition, --trigger, and --dry-run.
In `@tests/unit/sdk/assurance-action.spec.ts`:
- Around line 35-199: Split tests/unit/sdk/assurance-action.spec.ts lines 35-199
into separate it blocks grouped by validation errors, CRUD, dispatch
normalization, gate evaluation, verdicts, and removal; keep only genuinely
order-dependent CRUD steps together. In tests/unit/sdk/assurance-runtime.spec.ts
lines 14-161, split workspace context construction, each external measurement
kind, external error paths, and both Git tree-identity scenarios into separate
it blocks, and move shared withTempPmPath setup into beforeEach.
- Around line 60-69: Update the JSON.parse spy setup in the assurance-action
test so restoration always runs, including when the runAssuranceAction rejection
assertion fails. Wrap the assertion in try/finally with parse.mockRestore(), or
use the test suite’s afterEach cleanup via vi.restoreAllMocks, while preserving
the existing assertion.
In `@tests/unit/sdk/assurance-runtime.spec.ts`:
- Around line 146-151: Update the assertion following
createAssuranceWorkspaceContext in the Git fixture test to compare
gitContext.tree_id with the identity produced by the fixture repository’s
commit, obtained via git rev-parse in fixture.tempRoot. Replace the non-empty
check so the test fails if the context resolves an outer repository’s identity.
- Around line 16-25: Safely restore environment variables in the assurance
runtime test by wrapping the temporary CODEX_CI and CODEX_MODEL assignments and
runCliInProcess call in a finally block. In the finally cleanup, restore each
saved value with assignment when defined and delete the corresponding
process.env key when it was undefined; apply the same handling to the PATH
restoration around the existing setup near the PATH cleanup.
In `@tests/unit/sdk/assurance.spec.ts`:
- Around line 199-209: Update the negative_control cases in
validateAssertionDefinition to use a numeric out-of-bound failing value, such as
2, instead of observed: []; preserve the existing passing case and ensure the
test validates numeric ceiling behavior rather than accepting a type mismatch.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ef77317c-d2f2-4abf-91f3-e20691aba7ae
⛔ Files ignored due to path filters (2)
docs/generated/AGENT_COMMAND_SURFACE.mdis excluded by!**/generated/**pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (46)
.agents/pm/chores/pm-8l1m5t.toon.agents/pm/features/pm-2lex4r.toon.agents/pm/features/pm-91xeam.toon.agents/pm/features/pm-lyfu7b.toon.agents/pm/features/pm-wn6wot.toon.agents/pm/history/pm-2lex4r.jsonl.agents/pm/history/pm-8l1m5t.jsonl.agents/pm/history/pm-91xeam.jsonl.agents/pm/history/pm-gjjurs.jsonl.agents/pm/history/pm-gok2km.jsonl.agents/pm/history/pm-lyfu7b.jsonl.agents/pm/history/pm-wn6wot.jsonl.agents/pm/history/pm-zryb9d.jsonl.agents/pm/issues/pm-gjjurs.toon.agents/pm/issues/pm-gok2km.toon.agents/pm/issues/pm-zryb9d.toonCHANGELOG.mddocs/ASSURANCE.mddocs/README.mdpackage.jsonscripts/agent-token-surface-baseline.jsonsdk/public-surface.jsonsrc/cli/register-assurance.tssrc/cli/register-operations.tssrc/sdk/cli-contracts.tssrc/sdk/cli-contracts/completeness.tssrc/sdk/cli-contracts/enum-contracts.tssrc/sdk/cli-contracts/flag-contracts.tssrc/sdk/cli-contracts/runtime-contracts.tssrc/sdk/cli-contracts/tool-parameter-tables.tssrc/sdk/cli-contracts/tool-schema.tssrc/sdk/governance/assurance-action.tssrc/sdk/governance/assurance-runtime.tssrc/sdk/governance/assurance.tssrc/sdk/index.tssrc/sdk/runtime-primitives.tssrc/sdk/runtime.tstests/fixtures/contracts/full.jsontests/integration/assurance-cli.integration.spec.tstests/integration/assurance-runtime.integration.spec.tstests/unit/cli/register-assurance.spec.tstests/unit/commands/contracts-command.spec.tstests/unit/sdk/action-schema-parity.spec.tstests/unit/sdk/assurance-action.spec.tstests/unit/sdk/assurance-runtime.spec.tstests/unit/sdk/assurance.spec.ts
|
All 26 actionable findings were verified against the code, implemented where valid, individually replied to and resolved, and validated by exact 100/100/100/100 coverage plus the complete static, contract, package, npx, bunx, and dogfood gates. |
|
Walkthrough acknowledged. The exact-head follow-up also adds strict kind-specific schemas, bounded evaluation and verdict reads, explicit Decision provenance, typed malformed-registry recovery, and public action transport types. The repository-owned docstring gate reports 100%, superseding the bot heuristic warning. |
|
Reviewer guide acknowledged and used to cross-check the end-to-end CLI, SDK, MCP, persistence, and exit-code flow. Sourcery supplied no actionable code review because its separate review quota was exhausted, so it is not counted as approval. |
|
Performance report acknowledged. Repository import-cost, CLI transport-floor, context-calibration, token-budget, package, and 88-command dogfood gates are green on the follow-up head. |
|
Coverage report acknowledged. The repository exact gate independently passed 51,993 statements, 38,154 branches, 10,688 functions, and 50,226 lines at 100/100/100/100 with 7,210 tests. |
|
Carrier review acknowledged together with inline finding 3754172270; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172277; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172284; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172286; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172289; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172293; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172299; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172306; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172314; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172317; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172330; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172334; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172337; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172339; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172342; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172346; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Carrier review acknowledged together with inline finding 3754172348; that thread has an explicit disposition, reaction, validation evidence, and is resolved. |
|
Reviewed this bot review record and incorporated its thread-level disposition into the exact-head inventory. |
|
Reviewed this bot review record and incorporated its thread-level disposition into the exact-head inventory. |
|
Reviewed this bot review record and incorporated its thread-level disposition into the exact-head inventory. |
|
Reviewed this bot review record and incorporated its thread-level disposition into the exact-head inventory. |
|
Reviewed this bot review record and incorporated its thread-level disposition into the exact-head inventory. |
|
Reviewed this bot review record and incorporated its thread-level disposition into the exact-head inventory. |
|
Reviewed this bot review record and incorporated its thread-level disposition into the exact-head inventory. |
|
Reviewed this bot review record and incorporated its thread-level disposition into the exact-head inventory. |
|
Reviewed this bot review record and incorporated its thread-level disposition into the exact-head inventory. |
|
Reviewed this bot review record and incorporated its thread-level disposition into the exact-head inventory. |
|
Reviewed this bot review record and incorporated its thread-level disposition into the exact-head inventory. |
|
Reviewed this bot review record and incorporated its thread-level disposition into the exact-head inventory. |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/sdk/governance/assurance-action.ts (1)
255-263: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick winRun the two independent reads concurrently.
readDocument(pmRoot)andcreateAssuranceWorkspaceContext(pmRoot, { tree_id: input.tree })do not depend on each other's result. The code awaits them sequentially as positional arguments toevaluateAssuranceGate. UsePromise.allto run both concurrently and reduce latency on this trigger-evaluation path.♻️ Proposed refactor
- const verdict = await evaluateAssuranceGate( - input.id, - await readDocument(pmRoot), - await createAssuranceWorkspaceContext(pmRoot, { tree_id: input.tree }), - { - trigger: input.trigger as AssuranceGateTrigger, - dry_run: input.dry_run === true, - }, - ); + const [document, workspaceContext] = await Promise.all([ + readDocument(pmRoot), + createAssuranceWorkspaceContext(pmRoot, { tree_id: input.tree }), + ]); + const verdict = await evaluateAssuranceGate( + input.id, + document, + workspaceContext, + { + trigger: input.trigger as AssuranceGateTrigger, + dry_run: input.dry_run === true, + }, + );🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/sdk/governance/assurance-action.ts` around lines 255 - 263, Update the evaluateAssuranceGate call to start readDocument(pmRoot) and createAssuranceWorkspaceContext(pmRoot, { tree_id: input.tree }) concurrently with Promise.all, then pass the resolved values in their existing positional order while preserving the current trigger and dry_run options.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/sdk/governance/assurance-action.ts`:
- Around line 255-263: Update the evaluateAssuranceGate call to start
readDocument(pmRoot) and createAssuranceWorkspaceContext(pmRoot, { tree_id:
input.tree }) concurrently with Promise.all, then pass the resolved values in
their existing positional order while preserving the current trigger and dry_run
options.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: e2028690-f5d8-4f2c-9cbe-6410766864bf
📒 Files selected for processing (23)
.agents/pm/chores/pm-8l1m5t.toon.agents/pm/features/pm-2lex4r.toon.agents/pm/features/pm-91xeam.toon.agents/pm/features/pm-lyfu7b.toon.agents/pm/features/pm-wn6wot.toon.agents/pm/history/pm-2lex4r.jsonl.agents/pm/history/pm-8l1m5t.jsonl.agents/pm/history/pm-91xeam.jsonl.agents/pm/history/pm-lyfu7b.jsonl.agents/pm/history/pm-wn6wot.jsonlCHANGELOG.mddocs/TESTING.mdscripts/release/gate-registry.jsonscripts/release/gate-registry.mjssrc/sdk/cli-contracts/schemas/assurance-definition.tssrc/sdk/cli-contracts/tool-parameter-tables.tssrc/sdk/governance/assurance-action.tssrc/sdk/governance/assurance-limits.tssrc/sdk/governance/assurance.tstests/fixtures/contracts/full.jsontests/unit/scripts/release/gate-registry.spec.tstests/unit/sdk/assurance-action.spec.tstests/unit/sdk/contracts-full-projection.spec.ts
|
Final exact-head CodeRabbit review completed with no new actionable threads on 5ba9cd3; all hosted checks are terminal and green. @greptileai full review |
Start the registry snapshot and workspace context reads concurrently before gate evaluation. Add a red-green concurrency regression, refresh canonical PM evidence and changelog ordering, and retain exact 100/100/100/100 coverage.
|
Implemented the final outside-diff concurrency finding in 5b5359a. A red/green regression proves registry and workspace-context reads start before either is awaited; canonical test-all passed 6/6 and repository coverage remains exact 100/100/100/100. @coderabbitai full review @greptileai full review |
Rate Limit Exceeded
|
|
Acknowledged: the final exact-head CodeRabbit re-review request was rate-limited after its prior review finding was implemented and independently verified. This response is recorded as provider unavailability, not approval. |
|
Exact-head merge gate status for 5b5359a: every repository-controlled CI, security, smoke, coverage, contract, and performance check is terminal green. The Codecov uploader accepted both coverage and test-result payloads for this exact commit (HTTP 200, no warnings, queued successfully), but the required codecov/patch context has remained IN_PROGRESS beyond the bounded 20-minute wait and GitHub reports mergeStateStatus BLOCKED. This external pending state is not treated as approval and no protection bypass or merge was attempted. Final review inventory: 32/32 threads resolved; zero unreacted bot comments, reviews, or inline comments. CodeRabbit re-review was rate-limited and Greptile supplied no exact-head response, so those provider limitations are recorded rather than represented as approvals. |
|
Maintainer authorization update: after the exact head remained unchanged and every repository-controlled required check stayed green, the maintainer explicitly instructed continue and merge now. The sole remaining required context is external codecov/patch, still IN_PROGRESS roughly 84 minutes after Codecov accepted the exact-head coverage and test-result uploads with HTTP 200 and no warnings. Proceeding with a PR-scoped admin merge override only; repository branch-protection and required-check configuration remain unchanged. Review inventory immediately before merge: 0 unresolved threads and 0 unreacted bot comments, reviews, or inline findings. |
Summary
PM lineage
New open report lineages:
Verification
Summary by Sourcery
Introduce a unified SDK-owned project assurance system with measurements, assertions, lifecycle gates, and durable verdict history, exposed consistently via CLI, SDK, MCP, and runtime contracts.
New Features:
assuranceaction across CLI, PmClient, MCP, and contracts, including flag/schema support and positional/flag mappings.Enhancements:
Build:
Documentation:
Tests:
Chores:
Summary by cubic
Adds SDK-owned assurance primitives and a new
assurancecommand across CLI, SDK,PmClient, and MCP with durable verdict history. Hardens contracts, switches the hosted gate registry to stable workflow job IDs, refresheseslintto 10.8.1 and@types/nodeto 26.2.0, and parallelizes gate context reads to speed up gate evaluation.New Features
assurancecommand (list, show, put, remove, run, verdicts) with shared flag/schema contracts; SDK andPmClient.assurance(...)route through one normalized action; docs indocs/ASSURANCE.md.Bug Fixes
assurance_registry_invaliderror guidance.--pm-path.Written for commit 5b5359a. Summary will update on new commits.