chore: silent-failure killers (5 audit quick wins)#321
Merged
4 commits merged intomainfrom Apr 28, 2026
Merged
Conversation
added 4 commits
April 28, 2026 22:41
CI re-runs the full test suite (incl. doctests) on every PR via the .github/workflows/ci.yml tests job, so local pre-push duplication adds ~20 min per push without catching anything new. Pre-push hooks should be fast-fail; expensive checks belong on the CI server. Closes audit finding: silent productivity tax (pre-push duplication).
Documents the three-state intent (true/false/absent) of ProviderConfig.is_enabled and the dependency on deny_unknown_fields (added in the next commit) to reject typos like enbaled = false at parse time. Behaviour is unchanged; this is purely contractual clarity to support the silent-typo-killer audit. Closes audit finding: silent typo killer on provider config.
Adds #[serde(deny_unknown_fields)] to AppConfig and the major sub-structs (ProviderConfig, ModelConfig, TierConfig, RouterConfig, ScoringConfig, CacheConfig, BudgetConfig, DlpConfig, SecurityConfig). Without this guard, a typo like enbaled = false in a [[providers]] block silently parses (the unknown key is dropped) and the provider remains enabled with the wrong intent. With the guard, parsing fails loudly and the operator gets an actionable error pointing at the offending key. Tested with the full nextest suite (1268 tests) plus all doctests: no fixture, preset or example carries a stale field, so this is a pure tightening with no migration cost. Closes audit finding: silent typo killer on TOML config.
Each entry in DENIED_SECTIONS / DENIED_KEYS now carries a short justification table covering why it can not be hot-reloaded — either because the data is sensitive (credentials, DLP rules) or because the consumer is constructed once at process start (TLS listener, secret backend, TEE attestation, FIPS gate). Adds tee, fips, server.tls and secrets.backend to the deny-list so the documented "static-init" rationale matches actual behaviour. Also emits an INFO log on every denied attempt telling the operator to restart instead of expecting the silent reload to apply. Adds two unit tests covering the new deny entries (tee/fips sections and server.tls / secrets.backend keys) and asserts that sibling keys in the same sections remain editable. Closes audit finding: hot-reload UX (silent ignore of denied edits).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Five quick-win fixes from the architecture audit, all sharing the
"silent failure killer" theme — bugs that compile, parse, and run
green but mask user intent.
cargo-testandcargo-doctestfromprek.tomlpre-push hooks. CI re-runs them on every PR, so the local copy adds ~20 min per push without catching anything new.chore(prek): drop redundant cargo-test and cargo-doctest from pre-pushProviderConfig::is_enabled()semantics with explicit three-state docs (true / false / absent) and pin its typo-safety contract on fix #3. Behaviour is unchanged.docs(config): clarify is_enabled semantics and typo-safety contract#[serde(deny_unknown_fields)]toAppConfigplus the major sub-structs (ProviderConfig,ModelConfig,TierConfig,RouterConfig,ScoringConfig,CacheConfig,BudgetConfig,DlpConfig,SecurityConfig). A typo likeenbaled = falsenow fails parsing instead of silently becoming a misconfigured provider. Full nextest suite (1268 tests) and all doctests pass — no fixture, preset, or example carries a stale field.fix(config): reject unknown TOML fields in core config structsDENIED_SECTIONS/DENIED_KEYSinsrc/server/config_guard.rs, extend the deny-list to cover the static-init sections (tee,fips) and keys (server.tls,secrets.backend), and emit an INFO log on every denied attempt so operators see actionable guidance ("restart instead of expecting silent reload").docs(config-guard): document deny-list rationale and log denied reloadsAborted
src/server/rpc/auth.rsas orphaned dead code.grep -rn "rpc::auth" src/ tests/returned three real references (src/server/mod.rs:601,src/server/mcp_handlers/control_bridge.rs:10,tests/unit/rpc_test.rs:1). The module is not orphaned and removing it would break the build.Test plan
cargo check --all-targetspasses locally.cargo clippy --all-targets -- -D warningspasses locally.cargo fmt --all -- --checkpasses locally.cargo nextest run --no-fail-fast— 1270 tests, all green (1268 before fix chore: release v0.9.0 #5 added two new unit tests).cargo test --doc— all doctests pass.Base note
Original task suggested basing this PR on
fix/preset-mod-include-strbecause main was thought to be broken by staleinclude_str!references. That branch (PR #304) has since merged into main, so this PR is correctly based on the up-to-datemain.