feat(codenexus): give codenexus_adapter.rs a real DAG caller - #215
Open
2233admin wants to merge 6 commits into
Open
feat(codenexus): give codenexus_adapter.rs a real DAG caller#2152233admin wants to merge 6 commits into
2233admin wants to merge 6 commits into
Conversation
A provider-usage audit found codenexus_adapter.rs (already-compiled, already-tested) had zero callers from the actual DAG execution engine — only reachable via a legacy CLI compatibility route explicitly annotated "retire when the DAG exclusively calls the typed codenexus adapter seam." This wires it in, mirroring the existing Sentrux/graph builtin-adapter pattern exactly: - builtin_provider_evidence.rs: new codenexus_admission(), collecting native evidence by shelling to legacy/Invoke-CodeNexusLite.ps1 (the same facade run-code-intel.ps1 already uses for the default-run codenexus-context.json), then running it through the existing codenexus_adapter::translate()/validate_admitted_payload() contract. - capability_inventory.rs: dispatch arm for provider.codenexus-builtin.compat. - execution_policy.rs: codenexus is now an independently-gateable ProviderRequirement (Optional/Required/Required/Disabled across Default/Strict/Compatibility/Offline, matching sentrux) instead of implicitly always-on. - dag_run.rs: evidence.codenexus is now a real conditional DAG node, feeding diagnosis.hospital exactly like evidence.graph/evidence.sentrux. - orchestration/integrations.json + internalization/codenexus.json: capabilityDeclaration/runtimeAdapter added for the new route; governance record updated with the new production-caller evidence without reviving crates/code-nexus-lite (a separate, still CVE-2026-48504-blocked prototype, untouched by this change). Verified: cargo fmt/check clean, full suite 3783/3783 passing (60 suites), and a local authoritative self-scan shows evidence.codenexus succeeding and producing real admission/payload artifacts.
|
✅ Health of changed files: 3.6 (unchanged) 📋 At a glance ✅ Health gate: passed 📌 Before you merge
🔎 More signals (3)🗺️ Change map flowchart LR
subgraph PR ["Changed in this PR (6 with dependents)"]
f_crates_code_intel_cli_src_dag_run_rs[".../src/dag_run.rs 🔥"]:::changed
f_crates_code_intel_cli_src_execution_policy_rs[".../src/execution_policy.rs 🔥"]:::changed
f_crates_code_intel_cli_src_capability_inventory_rs[".../src/capability_inventory.rs"]:::changed
f_crates_code_intel_cli_tests_artifact_ref_rs[".../tests/artifact_ref.rs"]:::changed
f_crates_code_intel_cli_tests_capability_exec_rs[".../tests/capability_exec.rs"]:::changed
f_crates_code_intel_cli_tests_dag_run_rs[".../tests/dag_run.rs"]:::changed
end
f_crates_code_intel_cli_src_authoritative_run_execution_kernel_rs[".../authoritative_run/execution_kernel.rs"]
f_crates_code_intel_cli_src_dag_run_rs --> f_crates_code_intel_cli_src_authoritative_run_execution_kernel_rs
f_crates_code_intel_cli_src_main_rs[".../src/main.rs"]
f_crates_code_intel_cli_src_dag_run_rs --> f_crates_code_intel_cli_src_main_rs
f_crates_code_intel_cli_src_run_cli_rs[".../src/run_cli.rs"]
f_crates_code_intel_cli_src_dag_run_rs --> f_crates_code_intel_cli_src_run_cli_rs
f_crates_code_intel_cli_src_execution_policy_rs --> f_crates_code_intel_cli_src_main_rs
f_crates_code_intel_cli_src_execution_policy_rs --> f_crates_code_intel_cli_src_run_cli_rs
f_crates_code_intel_cli_src_anchor_verification_mod_rs[".../anchor_verification/mod.rs"]
f_crates_code_intel_cli_src_capability_inventory_rs --> f_crates_code_intel_cli_src_anchor_verification_mod_rs
f_crates_code_intel_cli_src_capability_rs[".../src/capability.rs"]
f_crates_code_intel_cli_src_capability_inventory_rs --> f_crates_code_intel_cli_src_capability_rs
f_crates_code_intel_cli_src_edit_impact_rs[".../src/edit_impact.rs"]
f_crates_code_intel_cli_src_capability_inventory_rs --> f_crates_code_intel_cli_src_edit_impact_rs
f_crates_code_intel_cli_src_capability_inventory_rs --> f_crates_code_intel_cli_src_main_rs
f_crates_code_intel_cli_tests_artifact_ref_rs --> f_crates_code_intel_cli_src_main_rs
f_crates_code_intel_cli_tests_capability_exec_rs --> f_crates_code_intel_cli_src_main_rs
f_crates_code_intel_cli_tests_dag_run_rs --> f_crates_code_intel_cli_src_main_rs
w_orchestration_internalization_rg_json(["⚠️ orchestration/internalization/rg.json changed together 11×, not in PR"]):::warn
f_crates_code_intel_cli_tests_capability_exec_rs -.- w_orchestration_internalization_rg_json
w_orchestration_integrations_json(["⚠️ orchestration/integrations.json changed together 11×, not in PR"]):::warn
f_crates_code_intel_cli_src_capability_inventory_rs -.- w_orchestration_integrations_json
classDef changed fill:#dbeafe,stroke:#1d4ed8,color:#1e3a5f
classDef warn fill:#fef3c7,stroke:#b45309,color:#78350f
classDef guard fill:#dcfce7,stroke:#15803d,color:#14532d
Solid arrows: code that imports the changed files (6 direct dependents, from the last indexed snapshot). Dashed: history/tests. 🔥 Hotspots touched (5)
2 more
🔗 Hidden coupling (2 files)
📊 See the full report for this PR |
Code Intel change risk
Top signals
revspec: |
|
Important Review skippedToo many files! This PR contains 113 files, which is 13 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (113)
You can disable this status message by setting the 📝 WalkthroughSummary by CodeRabbit
WalkthroughCodeNexus-lite support now includes profile-based policy gating, capability dispatch, DAG execution, PowerShell-backed admission, artifact publication, integration metadata, and tests for direct and production execution paths. ChangesCodeNexus admission flow
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant CapabilityExecutor
participant codenexus_admission
participant PowerShellFacade
participant ArtifactStore
participant DiagnosisHospital
CapabilityExecutor->>codenexus_admission: dispatch provider.codenexus-builtin.compat
codenexus_admission->>PowerShellFacade: invoke Invoke-CodeNexusLite.ps1
PowerShellFacade-->>codenexus_admission: return parsed or unavailable result
codenexus_admission->>ArtifactStore: publish admission and evidence payload
ArtifactStore-->>DiagnosisHospital: supply evidence.codenexus
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
crates/code-intel-cli/tests/capability_exec.rs (3)
2189-2203: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAlso assert the payload artifact on the direct-dispatch path.
codenexus_admissionpublishes two artifacts: theevidence.admissionresult and anobserved.evidence.payloadpayload. This test checks only the first.tests/dag_run.rsLine 196 already asserts the payload artifact at the DAG level, so the direct path currently proves less than the DAG path.💚 Proposed assertion
assert!( result["artifacts"] .as_array() .unwrap() .iter() .any(|artifact| artifact["type"] == "evidence.admission"), "result={result}" ); + assert!( + result["artifacts"] + .as_array() + .unwrap() + .iter() + .any(|artifact| artifact["type"] == "observed.evidence.payload"), + "result={result}" + ); + assert!(codenexus_out.join("codenexus-payload.json").is_file());🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/tests/capability_exec.rs` around lines 2189 - 2203, Extend the direct-dispatch test assertions around the existing evidence.admission check to also require an artifact with type observed.evidence.payload. Match the DAG-level assertion pattern used by the existing test utilities, while preserving the current admission verdict validation.
2208-2229: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueFold
run_capabilityandrun_with_request_filetogether.
run_capabilityduplicatesrun_with_request_fileat Line 81. The only difference is the--artifact-rootpair. Make the artifact root optional and keep one helper.♻️ Proposed refactor
fn run_capability( request: &Value, request_path: &Path, out: &Path, - artifact_root: &Path, + artifact_root: Option<&Path>, cli_capability: &str, ) -> std::process::Output { fs::write( request_path, serde_json::to_vec(request).expect("serialize request"), ) .expect("write request"); - common::cli() - .args(["capability", "exec", cli_capability, "--request"]) - .arg(request_path) - .arg("--out") - .arg(out) - .arg("--artifact-root") - .arg(artifact_root) - .output() - .expect("run capability executor") + let mut command = common::cli(); + command + .args(["capability", "exec", cli_capability, "--request"]) + .arg(request_path) + .arg("--out") + .arg(out); + if let Some(artifact_root) = artifact_root { + command.arg("--artifact-root").arg(artifact_root); + } + command.output().expect("run capability executor") }Then make
run_with_request_filedelegate withNone.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/tests/capability_exec.rs` around lines 2208 - 2229, Combine run_capability with the existing run_with_request_file helper by adding an optional artifact-root parameter to the single helper and conditionally appending the --artifact-root argument pair. Remove the duplicate run_capability implementation, and update its callers to delegate through run_with_request_file with None when no artifact root is needed.
14-22: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRead these implementations from the registry instead of duplicating them.
registry_implementation(capability)at Line 1930 already loadscapabilityDeclaration.implementationfromorchestration/integrations.json.REPO_SNAPSHOT_DIGESTandCODENEXUS_TOOLCHAIN_DIGESTSrestate values that helper would return.Two consequences follow. A registry digest change breaks this test with an opaque digest mismatch instead of tracking the registry. And because the constants copy the registry verbatim, the test cannot detect a wrong pin in the registry, including the
builtin_provider_evidence.rsdigest gap flagged onorchestration/integrations.jsonLine 664.♻️ Proposed refactor
const REPO_SNAPSHOT_DIGEST: &str = "1fa974b28cc2ab92b1ac04e22702b6b126023bcc0ccf1feee14e3d31a833f9dc"; -const CODENEXUS_TOOLCHAIN_DIGESTS: [&str; 5] = [ - "e78c7c3d492c0047bd53151d83f3413d2aa937a974aed0b929b94cc4c61d86de", - "645675312135932dfce365a8dfc14e214cec78ee733f248606547b3eaa56edc8", - "52644a812174988ede91d98ddfec63c6a91f8478277d7bf74c73f106dd0f776b", - "98ccc64478b2c61bfd7af741ea1f8ee01a88094065c0f025700e8110b525ef26", - "cdd5c6d0fe940d2756c45a51095c275b13ebe64347914b581641693e1288ca56", -];Then build both requests from the registry:
- "implementation": { - "id": "repository.snapshot.compat", - "version": "1.0.0", - "toolchainDigests": [REPO_SNAPSHOT_DIGEST] - }, + "implementation": registry_implementation("repository.snapshot-identity"),- "implementation": { - "id": "provider.codenexus-builtin.compat", - "version": "1.0.0", - "toolchainDigests": CODENEXUS_TOOLCHAIN_DIGESTS - }, + "implementation": registry_implementation("provider.codenexus-adapt"),
registry_implementationlooks up by integrationid, so confirm the exactidvalues before applying.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/tests/capability_exec.rs` around lines 14 - 22, Remove the duplicated REPO_SNAPSHOT_DIGEST and CODENEXUS_TOOLCHAIN_DIGESTS constants from the capability execution tests. Use registry_implementation(capability) to obtain each integration’s implementation and build both requests from the registry entries, verifying the exact integration id values used for the repository snapshot and Codenexus toolchain.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/code-intel-cli/src/builtin_provider_evidence.rs`:
- Around line 288-299: Inspect the DAG coordinator for an enforced per-node
deadline; if none applies to this provider, update the execution around the
visible command.output() call to run pwsh with an explicit timeout, terminate
the child on expiry, and classify the result as the existing failed/unavailable
path. Preserve the current command arguments and successful output handling.
- Around line 286-315: Bind the scratch directory cleanup to scope in
codenexus_admission by introducing a ScratchDir guard near
create_codenexus_scratch_dir, exposing its path for command construction and
removing the directory in Drop. Replace direct scratch-path usage with the guard
and remove the manual fs::remove_dir_all call so cleanup also occurs when
lease.verify_after, now, or snapshot_identity returns early.
In `@orchestration/integrations.json`:
- Around line 664-670: Update the toolchainDigests list for the affected
provider declaration around toolchainDigests so the builtin_provider_evidence.rs
input uses the shared digest
5634551c7d560819289cc6aef60c32818b8e2f1a5ee310ee71e68222d0c36035. Preserve the
existing admissibility.rs and adapter_contract.rs digests and keep the list
synchronized with the graph-adapt and sentrux-adapt declarations.
---
Nitpick comments:
In `@crates/code-intel-cli/tests/capability_exec.rs`:
- Around line 2189-2203: Extend the direct-dispatch test assertions around the
existing evidence.admission check to also require an artifact with type
observed.evidence.payload. Match the DAG-level assertion pattern used by the
existing test utilities, while preserving the current admission verdict
validation.
- Around line 2208-2229: Combine run_capability with the existing
run_with_request_file helper by adding an optional artifact-root parameter to
the single helper and conditionally appending the --artifact-root argument pair.
Remove the duplicate run_capability implementation, and update its callers to
delegate through run_with_request_file with None when no artifact root is
needed.
- Around line 14-22: Remove the duplicated REPO_SNAPSHOT_DIGEST and
CODENEXUS_TOOLCHAIN_DIGESTS constants from the capability execution tests. Use
registry_implementation(capability) to obtain each integration’s implementation
and build both requests from the registry entries, verifying the exact
integration id values used for the repository snapshot and Codenexus toolchain.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 46060cfc-54dc-445d-bdb3-3f3a2d25e87f
📒 Files selected for processing (14)
crates/code-intel-cli/src/builtin_provider_evidence.rscrates/code-intel-cli/src/capability_inventory.rscrates/code-intel-cli/src/dag_run.rscrates/code-intel-cli/src/execution_policy.rscrates/code-intel-cli/tests/artifact_ref.rscrates/code-intel-cli/tests/capability_exec.rscrates/code-intel-cli/tests/dag_run.rslegacy/run-code-intel.ps1orchestration/integrations.jsonorchestration/internalization/ast-grep.jsonorchestration/internalization/codenexus.jsonorchestration/internalization/graph.jsonorchestration/internalization/rg.jsonorchestration/internalization/sentrux.json
Editing builtin_provider_evidence.rs to add codenexus_admission changed the file's sha256, but only provider.codenexus-adapt's own toolchainDigests entry got resynced -- provider.graph-adapt and provider.sentrux-adapt each independently pin the same shared file and were left stale, since repin's stale-detection only catches drift from HEAD and this file had already gone through a prior repin --write round before the final edit (the documented head-anchor blind spot). Caught by test-atomic-capability-contract.ps1 in CI (cross-platform-smoke failed on macos-latest/ubuntu-latest), not by cargo test, which doesn't cover this PowerShell contract check. Verified locally: repin --write now reports clean, the PS contract test passes, and cargo test -p code-intel --locked (capability_exec/dag_run/declared_pins/ internalization_record/artifact_ref/repin) all still pass.
…t resync Addresses CodeRabbit review on #215: - builtin_provider_evidence.rs: bound the CodeNexus-lite facade's pwsh invocation with a 120s timeout (run_with_timeout) -- a hung script previously blocked evidence.codenexus, and the whole DAG run, forever. status: "unavailable" already handles this outcome gracefully, a timeout just routes into that existing branch. - Wrap the scratch directory in a Drop-guard (ScratchDir) so it's cleaned up on every exit path, including the early `?` returns between collection and publication that the plain end-of-function fs::remove_dir_all was missing. - capability_exec.rs: also assert the observed.evidence.payload artifact (and that codenexus-payload.json actually lands on disk) on the direct capability-exec dispatch path, matching what the DAG-level test already checks. - Resync every toolchainDigests/conformance pin chained through builtin_provider_evidence.rs and capability_exec.rs after the above edits (graph-adapt, sentrux-adapt, codenexus-adapt, ast-grep, rg) -- repin --write hit its own documented "internal inconsistency" limit on 3 of these (the same head-anchor blind spot as the prior digest fix commit), so they were resynced by hand and verified against a freshly recomputed sha256, not just repin's report. Verified: cargo fmt/check clean, full suite 3783/3783 passing, PS atomic-capability-contract test green, and a local self-scan confirms evidence.codenexus still succeeds with the new timeout/cleanup path.
Retirement packets freeze a working-tree overlay taken at generation time, not a commit -- editing any file in their frozen source set makes them stale, and only their own New-*RetirementPacket.ps1 generator can produce a valid replacement (never hand-edited, unlike the toolchain digest pins). Regenerated: e02-recommender, e03-provider-preflight, e04-codenexus-direct, e07-native-code, e08-hospital -- all touch source files edited across this PR's commits (builtin_provider_evidence.rs, execution_policy.rs, capability_inventory.rs, dag_run.rs). Verified via legacy/scripts/tests/test-retirement-packets.ps1: 8 packets, 2 audits, 0 known-blocked, all passing (was 5 of 10 checks failing before this commit). This is what windows-build-test-package's "Compatibility retirement packets" step was catching in CI.
…vider_evidence.rs The sentrux architecture gate failed CI (exit 10, "god_files_increased": builtin_provider_evidence.rs reached 814 loc / 23 functions, crossing the loc>800 threshold) after the timeout+cleanup commit pushed it over the limit -- a real, deterministic gate, not a flake. Missed locally because I checked evidence.codenexus's own status but not diagnosis.hospital's. Extracted the CodeNexus-lite-specific process/filesystem plumbing that has nothing to do with the admission/evidence contract itself into a new crates/code-intel-cli/src/codenexus_scratch.rs: CODENEXUS_LITE_TIMEOUT, create_codenexus_scratch_dir, ScratchDir, run_with_timeout. Brings builtin_provider_evidence.rs to 757 lines. codenexus_admission itself, and the graph/sentrux admission functions, are untouched. Resynced every toolchain digest chained through the two changed files (graph-adapt/sentrux-adapt/codenexus-adapt, ast-grep, rg) and regenerated the E04 retirement packet again (its frozen source set also includes builtin_provider_evidence.rs). Verified: cargo fmt/check clean, full suite 3783/3783, PS atomic-capability-contract and retirement-packets suites both green, and a local self-scan confirms diagnosis.hospital now passes (was "architecture gate failure" / god_files_increased before this commit).
main advanced significantly (v0.7.0 GA cut, ps1-exit T2 first increment via #217) since this branch diverged. Conflicts were confined to frozen retirement-packet overlays (e02/e03/e04-codenexus-direct/e07/e08) and one internalization pin file (rg.json) -- resolved by regenerating each packet fresh via its own New-*RetirementPacket.ps1 generator against the merged tree (never hand-merged, per the documented 'frozen overlay, not a commit' convention) and letting repin resync rg.json. No source-code conflicts. Verified post-merge: cargo fmt/check clean, full test suite green (one pre-existing, already-tracked flaky sentrux_gate/tool_path race unrelated to this branch -- see task_b5c3ea40), PS atomic-capability-contract and retirement-packets suites both green, and a local self-scan confirms diagnosis.hospital and evidence.codenexus both pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A provider-usage audit found that
codenexus_adapter.rs(already-compiled, already-tested, 387 lines) had zero callers from the actual DAG execution engine — reachable only via a legacy CLI compatibility route explicitly annotated "retire when the DAG exclusively calls the typed codenexus adapter seam."orchestration/internalization/codenexus.jsonalready marked it a retirement candidate for exactly that reason.This gives it a real production caller by mirroring the existing Sentrux/graph builtin-adapter pattern — no new architecture, just replicating a working shape:
builtin_provider_evidence.rs: newcodenexus_admission(), collecting native evidence by shelling tolegacy/Invoke-CodeNexusLite.ps1(the same facaderun-code-intel.ps1already uses for the default-runcodenexus-context.json), then running it through the existingcodenexus_adapter::translate()/validate_admitted_payload()contract — reused, not reimplemented.capability_inventory.rs: dispatch arm forprovider.codenexus-builtin.compat.execution_policy.rs:codenexusis now an independently-gateableProviderRequirement(Optional/Required/Required/Disabled across Default/Strict/Compatibility/Offline, matchingsentrux) instead of implicitly always-on.dag_run.rs:evidence.codenexusis now a real conditional DAG node, feedingdiagnosis.hospitalexactly likeevidence.graph/evidence.sentrux.orchestration/integrations.json+internalization/codenexus.json:capabilityDeclaration/runtimeAdapteradded for the new route; governance record updated with the new production-caller evidence.Explicitly out of scope
crates/code-nexus-lite/(a separate, empty, still CVE-2026-48504-blocked Rust worker prototype) — untouched. It's a different thing fromcodenexus_adapter.rs; reviving it needs upstreamiii-sdkto resolve itsopentelemetry_sdkCVE first, unrelated to this PR.Test plan
cargo fmt -p code-intel -- --check— cleancargo check --locked— 0 errorscargo test -p code-intel --locked— 3783/3783 passing across 60 suites (independently re-run, not just trusting the implementation pass)code-intel run execute --repo . ...) confirmsevidence.codenexusnode now runs and succeeds, producing realcodenexus-admission.json/codenexus-payload.jsonartifacts where the node previously didn't exist at alldag_run.rs(node presence/absence across profiles),capability_exec.rs(builtin dispatch)