feat: add authoritative code intel execution kernel - #12
Conversation
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Warning Review limit reached
Next review available in: 46 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (17)
📝 WalkthroughWalkthroughThe CLI adds a typed execution kernel, immutable execution profiles, profile-aware DAG construction, schema-validated results, and integrated publication. PowerShell, orchestration contracts, provider adapters, tests, documentation, CI, and evidence metadata are updated for the 0.4.0 flow. ChangesExecution kernel and orchestration
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant PowerShellFacade
participant CodeIntelCLI
participant ExecutionPolicy
participant DAGCoordinator
participant AuthorityRoot
PowerShellFacade->>CodeIntelCLI: run execute
CodeIntelCLI->>ExecutionPolicy: resolve profile and overrides
CodeIntelCLI->>DAGCoordinator: execute policy-aware DAG
DAGCoordinator-->>CodeIntelCLI: manifest and typed outcome
CodeIntelCLI->>AuthorityRoot: publish committed run
AuthorityRoot-->>CodeIntelCLI: publication metadata
CodeIntelCLI-->>PowerShellFacade: schema-validated execution result
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
4c0bef6 to
5b5c0af
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
crates/code-intel-cli/tests/dag_run.rs (1)
650-651: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAssert that the omitted diagnosis capability emits no request.
The test verifies absent provider request files, but not
diagnosis.hospital.request.json. Add that assertion so an unintended diagnosis-side effect cannot regress unnoticed.Proposed test addition
assert!(!out.join("evidence.graph.request.json").exists()); assert!(!out.join("evidence.sentrux.request.json").exists()); +assert!(!out.join("diagnosis.hospital.request.json").exists());🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/tests/dag_run.rs` around lines 650 - 651, Extend the test assertions in the DAG run test to verify that out.join("diagnosis.hospital.request.json") does not exist when the diagnosis capability is omitted. Keep the existing evidence.graph and evidence.sentrux absence checks unchanged.crates/code-intel-cli/src/builtin_provider_evidence.rs (1)
295-321: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winTwo independent
sentrux_commandhelpers with duplicated OS-dispatch logic. Both files introduce a newsentrux_commandfunction in this PR to decide how to launch the externalsentruxtool per OS;sentrux.rs's version is functionally a duplicate of theNone-path fallback already implemented inbuiltin_provider_evidence.rs's more generalsentrux_command(explicit: Option<&Path>).
crates/code-intel-cli/src/builtin_provider_evidence.rs#L295-L321: keep this as the canonical helper (it already supports both the explicit-path and fallback cases); make itpub(crate)so it can be reused.crates/code-intel-cli/src/sentrux.rs#L64-L112: drop the localsentrux_command()and callbuiltin_provider_evidence::sentrux_command(None)instead, removing the duplicated Windows/non-Windows branches and duplicated tests.♻️ Proposed consolidation
--- a/crates/code-intel-cli/src/builtin_provider_evidence.rs +++ b/crates/code-intel-cli/src/builtin_provider_evidence.rs @@ -fn sentrux_command(explicit: Option<&Path>) -> Command { +pub(crate) fn sentrux_command(explicit: Option<&Path>) -> Command {--- a/crates/code-intel-cli/src/sentrux.rs +++ b/crates/code-intel-cli/src/sentrux.rs @@ - let mut command = sentrux_command(); + let mut command = crate::builtin_provider_evidence::sentrux_command(None); @@ -fn sentrux_command() -> Command { - #[cfg(windows)] - { - let mut command = Command::new("cmd.exe"); - command.args(["/d", "/c", "sentrux.cmd"]); - command - } - #[cfg(not(windows))] - { - Command::new("sentrux") - } -}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/src/builtin_provider_evidence.rs` around lines 295 - 321, Make builtin_provider_evidence::sentrux_command the shared canonical helper by changing its visibility to pub(crate). In crates/code-intel-cli/src/sentrux.rs lines 64-112, remove the local sentrux_command implementation and duplicated tests, and call builtin_provider_evidence::sentrux_command(None) instead; retain the explicit-path support in the canonical helper.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 20-21: Disable persisted checkout credentials in both
actions/checkout configurations at .github/workflows/ci.yml lines 20-21 and
221-222 by adding persist-credentials: false under each with block.
In `@orchestration/integrations.json`:
- Around line 341-342: Update both command registries in
orchestration/integrations.json: append optional --doctor-require-repowise and
--doctor-require-understand flags to runtime.code-intel.commands.execute at
lines 341-342 and run.execute.commands.run at lines 1106-1126. Keep the existing
--profile contract intact.
---
Nitpick comments:
In `@crates/code-intel-cli/src/builtin_provider_evidence.rs`:
- Around line 295-321: Make builtin_provider_evidence::sentrux_command the
shared canonical helper by changing its visibility to pub(crate). In
crates/code-intel-cli/src/sentrux.rs lines 64-112, remove the local
sentrux_command implementation and duplicated tests, and call
builtin_provider_evidence::sentrux_command(None) instead; retain the
explicit-path support in the canonical helper.
In `@crates/code-intel-cli/tests/dag_run.rs`:
- Around line 650-651: Extend the test assertions in the DAG run test to verify
that out.join("diagnosis.hospital.request.json") does not exist when the
diagnosis capability is omitted. Keep the existing evidence.graph and
evidence.sentrux absence checks unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: a88e39ee-e1dc-476d-ae5c-0247436b5de7
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (45)
.github/workflows/ci.ymlCHANGELOG.mdInvoke-CodeIntelAcceptance.ps1README.mdcrates/code-intel-cli/Cargo.tomlcrates/code-intel-cli/src/builtin_provider_evidence.rscrates/code-intel-cli/src/dag_coordinator.rscrates/code-intel-cli/src/dag_run.rscrates/code-intel-cli/src/execution_kernel.rscrates/code-intel-cli/src/execution_policy.rscrates/code-intel-cli/src/main.rscrates/code-intel-cli/src/run_commit.rscrates/code-intel-cli/src/sentrux.rscrates/code-intel-cli/src/sentrux_analysis.rscrates/code-intel-cli/tests/dag_coordinator.rscrates/code-intel-cli/tests/dag_run.rscrates/code-intel-cli/tests/sentrux_analysis.rscrates/code-intel-cli/tests/snapshot_identity.rsdocs/execution-kernel-architecture.mddocs/plans/automatic-pr-one-command-orchestration-idea.mddocs/plans/four-blind-spots-closure-idea.mddocs/plans/language-adapter-acceptance-standard-idea.mddocs/plans/model-independent-pipeline-completion-idea.mddocs/plans/multi-agent-merge-queue-idea.mddocs/plans/multi-agent-workspace-governance-idea.mddocs/plans/pon-multilanguage-code-evidence-idea.mddocs/plans/pon-parity-floor-idea.mddocs/plans/session-evidence-adapter-idea.mddocs/plans/three-stage-project-acceptance-idea.mdinvoke-code-intel.ps1orchestration/integrations.jsonorchestration/internalization/evidence/r08-live-20260714/github-solution-research.mdorchestration/internalization/git.jsonorchestration/internalization/graph.jsonorchestration/internalization/pon-multilanguage.jsonorchestration/internalization/pon-project-conformance.jsonorchestration/internalization/pon-python314-development.jsonorchestration/internalization/sentrux.jsonorchestration/schemas/code-intel-execution-result.v1.schema.jsonprototypes/session-observability/IDEA.mdprototypes/session-observability/README.mdtest-code-intel-project-conformance.ps1test-github-solution-research.ps1test-python314-pon-compatibility.ps1test-stable-wrapper-e2e.ps1
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 2
🧹 Nitpick comments (2)
crates/code-intel-cli/tests/dag_run.rs (1)
650-651: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAssert that the omitted diagnosis capability emits no request.
The test verifies absent provider request files, but not
diagnosis.hospital.request.json. Add that assertion so an unintended diagnosis-side effect cannot regress unnoticed.Proposed test addition
assert!(!out.join("evidence.graph.request.json").exists()); assert!(!out.join("evidence.sentrux.request.json").exists()); +assert!(!out.join("diagnosis.hospital.request.json").exists());🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/tests/dag_run.rs` around lines 650 - 651, Extend the test assertions in the DAG run test to verify that out.join("diagnosis.hospital.request.json") does not exist when the diagnosis capability is omitted. Keep the existing evidence.graph and evidence.sentrux absence checks unchanged.crates/code-intel-cli/src/builtin_provider_evidence.rs (1)
295-321: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winTwo independent
sentrux_commandhelpers with duplicated OS-dispatch logic. Both files introduce a newsentrux_commandfunction in this PR to decide how to launch the externalsentruxtool per OS;sentrux.rs's version is functionally a duplicate of theNone-path fallback already implemented inbuiltin_provider_evidence.rs's more generalsentrux_command(explicit: Option<&Path>).
crates/code-intel-cli/src/builtin_provider_evidence.rs#L295-L321: keep this as the canonical helper (it already supports both the explicit-path and fallback cases); make itpub(crate)so it can be reused.crates/code-intel-cli/src/sentrux.rs#L64-L112: drop the localsentrux_command()and callbuiltin_provider_evidence::sentrux_command(None)instead, removing the duplicated Windows/non-Windows branches and duplicated tests.♻️ Proposed consolidation
--- a/crates/code-intel-cli/src/builtin_provider_evidence.rs +++ b/crates/code-intel-cli/src/builtin_provider_evidence.rs @@ -fn sentrux_command(explicit: Option<&Path>) -> Command { +pub(crate) fn sentrux_command(explicit: Option<&Path>) -> Command {--- a/crates/code-intel-cli/src/sentrux.rs +++ b/crates/code-intel-cli/src/sentrux.rs @@ - let mut command = sentrux_command(); + let mut command = crate::builtin_provider_evidence::sentrux_command(None); @@ -fn sentrux_command() -> Command { - #[cfg(windows)] - { - let mut command = Command::new("cmd.exe"); - command.args(["/d", "/c", "sentrux.cmd"]); - command - } - #[cfg(not(windows))] - { - Command::new("sentrux") - } -}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/src/builtin_provider_evidence.rs` around lines 295 - 321, Make builtin_provider_evidence::sentrux_command the shared canonical helper by changing its visibility to pub(crate). In crates/code-intel-cli/src/sentrux.rs lines 64-112, remove the local sentrux_command implementation and duplicated tests, and call builtin_provider_evidence::sentrux_command(None) instead; retain the explicit-path support in the canonical helper.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 20-21: Disable persisted checkout credentials in both
actions/checkout configurations at .github/workflows/ci.yml lines 20-21 and
221-222 by adding persist-credentials: false under each with block.
In `@orchestration/integrations.json`:
- Around line 341-342: Update both command registries in
orchestration/integrations.json: append optional --doctor-require-repowise and
--doctor-require-understand flags to runtime.code-intel.commands.execute at
lines 341-342 and run.execute.commands.run at lines 1106-1126. Keep the existing
--profile contract intact.
---
Nitpick comments:
In `@crates/code-intel-cli/src/builtin_provider_evidence.rs`:
- Around line 295-321: Make builtin_provider_evidence::sentrux_command the
shared canonical helper by changing its visibility to pub(crate). In
crates/code-intel-cli/src/sentrux.rs lines 64-112, remove the local
sentrux_command implementation and duplicated tests, and call
builtin_provider_evidence::sentrux_command(None) instead; retain the
explicit-path support in the canonical helper.
In `@crates/code-intel-cli/tests/dag_run.rs`:
- Around line 650-651: Extend the test assertions in the DAG run test to verify
that out.join("diagnosis.hospital.request.json") does not exist when the
diagnosis capability is omitted. Keep the existing evidence.graph and
evidence.sentrux absence checks unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: a88e39ee-e1dc-476d-ae5c-0247436b5de7
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (45)
.github/workflows/ci.ymlCHANGELOG.mdInvoke-CodeIntelAcceptance.ps1README.mdcrates/code-intel-cli/Cargo.tomlcrates/code-intel-cli/src/builtin_provider_evidence.rscrates/code-intel-cli/src/dag_coordinator.rscrates/code-intel-cli/src/dag_run.rscrates/code-intel-cli/src/execution_kernel.rscrates/code-intel-cli/src/execution_policy.rscrates/code-intel-cli/src/main.rscrates/code-intel-cli/src/run_commit.rscrates/code-intel-cli/src/sentrux.rscrates/code-intel-cli/src/sentrux_analysis.rscrates/code-intel-cli/tests/dag_coordinator.rscrates/code-intel-cli/tests/dag_run.rscrates/code-intel-cli/tests/sentrux_analysis.rscrates/code-intel-cli/tests/snapshot_identity.rsdocs/execution-kernel-architecture.mddocs/plans/automatic-pr-one-command-orchestration-idea.mddocs/plans/four-blind-spots-closure-idea.mddocs/plans/language-adapter-acceptance-standard-idea.mddocs/plans/model-independent-pipeline-completion-idea.mddocs/plans/multi-agent-merge-queue-idea.mddocs/plans/multi-agent-workspace-governance-idea.mddocs/plans/pon-multilanguage-code-evidence-idea.mddocs/plans/pon-parity-floor-idea.mddocs/plans/session-evidence-adapter-idea.mddocs/plans/three-stage-project-acceptance-idea.mdinvoke-code-intel.ps1orchestration/integrations.jsonorchestration/internalization/evidence/r08-live-20260714/github-solution-research.mdorchestration/internalization/git.jsonorchestration/internalization/graph.jsonorchestration/internalization/pon-multilanguage.jsonorchestration/internalization/pon-project-conformance.jsonorchestration/internalization/pon-python314-development.jsonorchestration/internalization/sentrux.jsonorchestration/schemas/code-intel-execution-result.v1.schema.jsonprototypes/session-observability/IDEA.mdprototypes/session-observability/README.mdtest-code-intel-project-conformance.ps1test-github-solution-research.ps1test-python314-pon-compatibility.ps1test-stable-wrapper-e2e.ps1
🛑 Comments failed to post (2)
.github/workflows/ci.yml (1)
20-21: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable persisted checkout credentials.
actions/checkoutwrites the job token into local Git configuration by default; subsequent repository-controlled scripts can access it.
.github/workflows/ci.yml#L20-L21: addpersist-credentials: false..github/workflows/ci.yml#L221-L222: addpersist-credentials: false.🧰 Tools
🪛 zizmor (1.26.1)
[warning] 18-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 1 file
.github/workflows/ci.yml#L20-L21(this comment).github/workflows/ci.yml#L221-L222🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 20 - 21, Disable persisted checkout credentials in both actions/checkout configurations at .github/workflows/ci.yml lines 20-21 and 221-222 by adding persist-credentials: false under each with block.Source: Linters/SAST tools
orchestration/integrations.json (1)
341-342: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Document the supported
run executedoctor flags in both command registries.The facade passes
--doctor-require-repowiseand--doctor-require-understand, but bothrun executecontracts advertise only--profile. This leaves direct orchestration consumers unable to reproduce the facade invocation.
orchestration/integrations.json#L341-L342: append both optional doctor flags toruntime.code-intel.commands.execute.orchestration/integrations.json#L1106-L1126: append both optional doctor flags torun.execute.commands.run.📍 Affects 1 file
orchestration/integrations.json#L341-L342(this comment)orchestration/integrations.json#L1106-L1126🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@orchestration/integrations.json` around lines 341 - 342, Update both command registries in orchestration/integrations.json: append optional --doctor-require-repowise and --doctor-require-understand flags to runtime.code-intel.commands.execute at lines 341-342 and run.execute.commands.run at lines 1106-1126. Keep the existing --profile contract intact.
1 participant
What changed
Validation