Add cargo audit dependency gate

[leynos]

Summary

This branch adds a Cargo audit dependency gate so Podbot fails CI when RustSec
reports vulnerable dependency paths. It mirrors Corbusier's Rust audit approach
with a top-level Makefile target, installs cargo-audit in CI before the gate
runs, and updates dependency selections so the new gate passes without ignoring
vulnerability advisories.

No roadmap task or issue was identified for this branch.

Review walkthrough

• Start with Makefile to see the new audit and rust-audit targets, including the manifest discovery loop that skips target output.
• Then review .github/workflows/ci.yml for the CI installation of cargo-audit and the new make audit step.
• Review Cargo.toml and Cargo.lock for the audit-driven dependency updates. The JWT backend now uses AWS-LC through jsonwebtoken and octocrab, which removes the unresolved rsa advisory path.
• Finish with docs/developers-guide.md for the maintainer-facing quality-gate documentation.

Validation

• make check-fmt: passed
• make lint: passed
• make audit: passed; it still reports the allowed informational proc-macro-error warning through rstest-bdd-macros
• make test: passed
• cargo check --no-default-features: passed
• cargo test --no-default-features --test cli_feature_gating --test compile_contract: passed
• cargo test --features internal: passed
• make markdownlint: passed
• make nixie: passed
• mbake validate Makefile: passed
• git diff --check: passed

Notes

make fmt was attempted, but the Markdown formatter path emitted repository-wide
pre-existing line-length diagnostics before the unrelated generated changes were
discarded. The narrower validation commands above passed after the final branch
state was restored.

Summary by Sourcery

Add a dependency vulnerability audit gate to the build and CI pipeline and update Rust dependencies to satisfy the new checks.

New Features:

• Introduce Makefile targets to audit Rust manifests for known dependency vulnerabilities using cargo-audit.

Enhancements:

• Update octocrab, jsonwebtoken, and tar dependencies and adjust feature flags to use AWS-LC-based JWT support and resolve RustSec advisory paths.

CI:

• Extend the CI workflow to install cargo-audit and run the new dependency audit gate as part of the quality checks.

Documentation:

• Document the new make audit quality gate in the developer guide alongside existing validation targets.

[sourcery-ai]

Sorry @leynos, you have reached your weekly rate limit of 2500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

Cargo audit dependency gate

Introduces a cargo audit quality gate that fails CI when RustSec reports vulnerable dependency paths. The implementation includes:

Build and CI integration

• Makefile targets audit and rust-audit: discover workspace manifests (using cargo metadata), prune generated dirs (target/, node_modules/, .venv/) to avoid false positives, print discovered manifests, and run a single cargo audit from the workspace root. Documentation in docs/developers-guide.md documents the per-manifest discovery behaviour and the exact find/discovery semantics.
• CI workflow (.github/workflows/ci.yml): installs cargo-audit via cargo binstall --no-confirm, sets up Python 3 for manifest extraction, and runs make audit as part of CI before the existing validation steps.

Dependency updates

• octocrab: 0.49.5 → 0.51.0 (keeps default-features = false; enables features including redirect, retries, rustls-ring, timeout, tracing, default-client, jwt-aws-lc-rs).
• jsonwebtoken: 10.3.0 → 10.4.0; switched crypto backend from rust_crypto to aws_lc_rs and retains use_pem.
• tar: 0.4.44 → 0.4.45.
• http: added as direct dependency (1.4.0).
  These changes remove prior RustSec advisory paths and adopt AWS-LC-backed crypto to satisfy the audit gate.

GitHub retry observability & token metrics

• New src/github/retry_metrics.rs: PodbotOctocrabRetryMetrics implements octocrab retry hooks, centralising WARN-level structured logs (operation, method, path, status, retries, wait duration) and recording low-cardinality counters podbot.github.octocrab.retry.events.total with labels (operation, event, status_class).
• src/github/installation_token.rs: records token-acquisition latency (Instant) and emits counters/histograms for outcomes; timeout failures are detected by downcasting to std::io::Error and checking ErrorKind::TimedOut to record a dedicated timeout-failure counter.

Test support & tests

• New src/github/test_support.rs (gated by test or internal): provides CounterEvent, HistogramEvent, and RecordingMetrics implementing metrics::Recorder to capture counter and histogram events for assertions in tests.
• New tests/make_audit_target.rs: integration test validating the Makefile rust-audit target using a temporary workspace and a fake cargo; ensures manifest discovery excludes generated dirs and that cargo audit runs exactly once at the workspace root; verifies failure propagation for failing cargo audit and cargo metadata.
• New src/github/retry_metrics_tests.rs and tests/github_retry_metrics.rs: unit and integration tests validating log output and metric events for retry and rate-limit scenarios.
• Additional test work: property-based proptest for github_status_class, rstest parameterisations, expanded token-acquisition tests, and removal/scoping of broad lint suppression in tests/bdd_hosting_config_helpers.rs.

Documentation

• New docs/contents.md: repository documentation index linking onboarding, user/developer guides, design docs, ADRs (001–009), and noting execplans/ is historical context.
• New docs/repository-layout.md: maps repository layout, responsibilities, and locations (notes target/ must not be edited).
• Updated docs/developers-guide.md: adds make audit to quality-gates table, documents the audit discovery behaviour, documents retry observability contract and token-acquisition metrics, and describes shared test-support types.
• Updated docs/podbot-design.md: aligns token-management and credential-signing docs with octocrab v0.51.0; documents RSA-only private-key loading via Octocrab’s jwt-aws-lc-rs feature and use of jsonwebtoken with aws_lc_rs; documents conservative metadata derivation and zero-state metrics behaviour for token acquisition.
• Updated docs/documentation-style-guide.md and AGENTS.md: tighten canonical docs, documentation-maintenance rules, refactoring workflow, and expanded Rust validation/observability guidance.

Validation

CI/local validation reported passing: formatting/lint/audit/tests (including feature permutations), cargo check/test permutations, markdownlint, nixie, Makefile validation, and git diff checks. A make fmt attempt was aborted due to pre-existing Markdown line-length diagnostics unrelated to these changes.

Follow-ups and related decisions

• Issue #113 created to track injecting Clock and an explicit metrics::Recorder into the token-acquisition path to remove hidden time/global-recorder dependencies.
• Documentation and developer-guide updates explicitly describe the Makefile discovery semantics (workspace-derived manifests vs naïve repo-wide walk) to address reviewer concerns about scanning nested tools/examples.

Walkthrough

Add Makefile audit/rust-audit targets, run make audit in CI (install cargo-audit), bump Rust dependencies, and update docs, telemetry, and tests to integrate repository-wide cargo audit and Octocrab v0.51.0 behaviour.

Changes

Dependency audit integration

Layer / File(s)	Summary
Audit targets, CI wiring and integration tests Makefile, .github/workflows/ci.yml, tests/make_audit_target.rs	Define .PHONY audit/rust-audit targets that derive workspace manifests via cargo metadata/python3 and run cargo audit once at the workspace root; CI installs cargo-audit and invokes make audit; add integration tests for traversal, pruning, and failure propagation.
Dependency versions and design notes Cargo.toml, docs/podbot-design.md	Add http = "1.4.0"; bump tar to 0.4.45; upgrade octocrab to 0.51.0 with expanded features; upgrade jsonwebtoken to 10.4.0 and switch crypto backend to aws_lc_rs; update design docs to reflect token signing/loading and tcp->http aliasing.
GitHub client & observability src/github/..., src/github/retry_metrics_tests.rs, tests/github_retry_metrics.rs, src/github/test_support.rs	Introduce PodbotOctocrabRetryMetrics, wire RetryConfig::HandleRateLimits in build_app_client, add structured retry warnings and podbot.github.octocrab.retry.events.total counters, and add unit/integration tests plus test recorder support to validate logging and metric labels.
Installation token telemetry src/github/installation_token.rs, src/github/installation_token_tests.rs	Measure installation-token acquisition latency, record success/failure counters and latency histograms, detect IO timeouts by downcasting service errors, and add unit tests for timeout classification and emitted metrics.
Tests and snapshot/BDD hygiene src/bin_tests/main_tests.rs, tests/bdd_hosting_config_helpers.rs, tests/make_audit_target.rs	Update snapshot expectations to strip ANSI escapes; remove lint-expect suppression attributes from generated BDD step functions; add integration tests covering rust-audit behaviour and failure propagation.
Metrics test support src/github/test_support.rs	Add RecordingMetrics, CounterEvent, HistogramEvent, and supporting Recorder/CounterFn/HistogramFn implementations for deterministic unit/integration metric assertions under `cfg(test
Documentation index, style and developer guidance docs/contents.md, docs/repository-layout.md, docs/documentation-style-guide.md, docs/developers-guide.md, AGENTS.md	Add top-level docs index and repository-layout guidance; tighten documentation-style rules and canonical filenames; insert make audit into developer quality gates; rewrite contributor/developer guidance and adjust developer-guide observability and test-support documentation.

Sequence Diagram(s)

sequenceDiagram
  participant CI
  participant Makefile
  participant CargoMetadata
  participant WorkspaceRoot
  participant CargoAudit
  CI->>Makefile: install `cargo-audit` and run `make audit`
  Makefile->>CargoMetadata: `cargo metadata --no-deps --format-version 1`
  CargoMetadata-->>Makefile: workspace_root + manifest paths
  Makefile->>WorkspaceRoot: cd workspace_root
  WorkspaceRoot->>CargoAudit: run `cargo audit`
  CargoAudit-->>Makefile: exit code
  Makefile-->>CI: propagate exit code

Loading

Possibly related issues

• Redact ANSI formatting codes from observability snapshot test #108: Shares the snapshot change to strip ANSI escapes in run_observability_logs_match_snapshot.
• Testing (Overall): rust-audit Makefile target lacks isolated substantive tests mxd#331: Matches the added integration tests that exercise the Makefile rust-audit traversal and failure propagation.

Possibly related PRs

• leynos/rstest-bdd#500: Overlaps documentation guidance edits in AGENTS.md and docs index pages.
• leynos/corbusier#79: Implements analogous Makefile/CI audit wiring and CI changes.
• leynos/agent-template-rust#37: Overlaps contributor guidance and AGENTS.md wording updates.

Poem

Run the audits, print the trace,
Bump the crates and tidy place,
Strip the colours from the log,
Let CI check each manifest’s cog,
Keep the supply chain calm and safe.

🚥 Pre-merge checks | ✅ 5 | ❌ 15

❌ Failed checks (15 inconclusive)

Check name	Status	Explanation	Resolution
Testing (Overall)	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
User-Facing Documentation	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Developer Documentation	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Module-Level Documentation	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Testing (Unit And Behavioural)	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Testing (Property / Proof)	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Testing (Compile-Time / Ui)	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Unit Architecture	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Domain Architecture	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Observability	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Security And Privacy	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Performance And Resource Use	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Concurrency And State	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Architectural Complexity And Maintainability	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
Rust Compiler Lint Integrity	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarises the main change: adding cargo audit as a CI dependency gate, matching the PR's core objective to fail CI when RustSec reports vulnerable dependencies.
Description check	✅ Passed	The description is substantive and directly related to the changeset, clearly explaining the audit gate implementation, dependency updates, CI wiring, and validation results.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/cargo-audit-makefile

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sourcery-ai]

Reviewer's Guide

Adds a Rust dependency vulnerability audit gate via Makefile and CI, installs cargo-audit in GitHub Actions, updates Rust dependencies to satisfy the new audit, and documents the new quality gate for maintainers.

Sequence diagram for CI dependency audit gate

sequenceDiagram
    participant GitHubActions
    participant Make
    participant CargoBinstall
    participant CargoAudit

    GitHubActions->>CargoBinstall: cargo binstall --no-confirm cargo-audit
    CargoBinstall-->>GitHubActions: cargo-audit installed

    GitHubActions->>Make: make audit
    Make->>Make: audit target
    Make->>Make: rust-audit target
    Make->>CargoAudit: cargo audit (per Cargo.toml manifest)
    CargoAudit-->>Make: Vulnerability report
    Make-->>GitHubActions: Audit result (pass/fail)
    GitHubActions->>GitHubActions: Continue CI steps if audit passes

Loading

Flow diagram for rust-audit Make target over manifests

flowchart TD
    A[make audit] --> B[rust-audit]
    B --> C[find . -name Cargo.toml]
    C --> D{Entry under target/?}
    D -- Yes --> E[Prune entry]
    D -- No --> F[Set manifest_dir]
    F --> G[cd manifest_dir]
    G --> H[cargo audit]
    H --> I{More Cargo.toml files?}
    I -- Yes --> C
    I -- No --> J[Exit with aggregated audit result]

Loading

File-Level Changes

Change	Details	Files
Introduce a Makefile-based Rust dependency audit gate that runs cargo-audit on all Cargo manifests while skipping build artifacts.	Extend the PHONY target list to include audit and rust-audit Add an audit target that delegates to rust-audit Implement a rust-audit target that finds all Cargo.toml files outside target directories and runs cargo audit in each manifest directory	Makefile
Wire the new audit gate into CI so GitHub Actions installs cargo-audit and runs the audit as part of the main workflow.	Add a CI step to install cargo-audit using cargo-binstall Add a CI step to run make audit before linting and other checks	.github/workflows/ci.yml
Adjust Rust dependencies to pass cargo-audit by updating tar, octocrab, and jsonwebtoken and enabling AWS-LC-based JWT handling.	Bump tar dependency from 0.4.44 to 0.4.45 Change octocrab to 0.51.0 with a curated set of features including rustls, retry, tracing, and jwt-aws-lc-rs Update jsonwebtoken to 10.4.0 and switch crypto features from rust_crypto to aws_lc_rs Refresh Cargo.lock to reflect the new dependency graph and resolved advisories	Cargo.toml Cargo.lock
Document the new dependency audit quality gate for maintainers in the developer guide.	Add make audit to the quality gates table with a description mapping it to cargo audit	docs/developers-guide.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[leynos]

@coderabbitai Have the following now been resolved?

• The rust-audit target walks every Cargo.toml under . (including nested tools/examples) which may be more than intended; consider restricting the search to the main workspace roots or using cargo metadata to derive manifests to avoid auditing incidental or third-party directories.
• The developer guide describes make audit as running cargo audit, but the Makefile implementation audits each manifest separately via find; updating the docs to clarify this behavior would avoid confusion for maintainers running the target locally.

[leynos]

@coderabbitai Please suggest a fix for this issue and supply a prompt for an AI coding agent to enable it to apply the fix. Include the file and symbol names indicated in the issue at the head of your response. Ensure that this is validated against the current version of the codegraph.

If further refinement to address this finding would be deleterious, please supply a clear explanatory one to two paragraph markdown message I can paste into the CodeScene web ui's diagnostic suppression function so this diagnostic can be silenced.

Excess Number of Function Arguments

src/github/retry_metrics.rs: RateLimitMetrics.rate_limited

What lead to degradation?

RateLimitMetrics.rate_limited has 5 arguments, max arguments = 4

Why does this problem occur?

Functions with many arguments indicate either a) low cohesion where the function has too many responsibilities, or b) a missing abstraction that encapsulates those arguments.
The threshold for the Rust language is 4 function arguments.

How to fix it?

Start by investigating the responsibilities of the function. Make sure it doesn't do too many things, in which case it should be split into smaller and more cohesive functions. Consider the refactoring INTRODUCE PARAMETER OBJECT to encapsulate arguments that refer to the same logical concept.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
echo "=== src/github/retry_metrics.rs - rate_limited signature and body ==="
fd -e rs retry_metrics.rs --search-path src --exec cat {}

Length of output: 3883

---

---

File: src/github/retry_metrics.rs — Symbol: PodbotOctocrabRetryMetrics::rate_limited (implementing octocrab::service::middleware::retry::RateLimitMetrics)

---

Current state of the codegraph

The method body has already been reduced to its absolute minimum — two statements, neither of which can be consolidated further:

fn rate_limited(
    &self,
    req: &http::Request<octocrab::OctoBody>,
    status_code: http::StatusCode,
    retries_remaining: usize,
    waiting_seconds: u64,
) {
    RetryEventContext::new(req, status_code, retries_remaining).log_warn(
        "Octocrab retry policy is waiting before retrying a GitHub API request",
        Some(waiting_seconds),
    );
    record_octocrab_retry_event("rate_limited", status_code);
}

No code change is warranted. The five-argument signature is imposed by the upstream octocrab::service::middleware::retry::RateLimitMetrics trait. Use the suppression message below.

---

CodeScene suppression message

PodbotOctocrabRetryMetrics::rate_limited is an implementation of the externally-defined octocrab::service::middleware::retry::RateLimitMetrics trait. All five arguments — &self, req, status_code, retries_remaining, and waiting_seconds — are mandated by that upstream trait contract and cannot be removed or consolidated without forking the octocrab crate or introducing a superfluous delegation wrapper type; neither option is warranted.

The method body has already been reduced to the minimum possible complexity via the RetryEventContext helper struct in the same module: the body is two statements, each parameter is consumed exactly once, and every field carries distinct semantic meaning. Applying the Introduce Parameter Object refactoring to a foreign-trait method signature is not possible in Rust, so this diagnostic should be suppressed for RateLimitMetrics::rate_limited in src/github/retry_metrics.rs.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/developers-guide.md`:
- Around line 863-870: The table listing types (rows for `CounterEvent`,
`HistogramEvent`, `RecordingMetrics`, `RecordedCounter`, `RecordedHistogram`) is
missing a caption; add a short caption line immediately after that table block
(directly below the final | `RecordedHistogram` row) describing the table (e.g.,
"Shared test-support types and their purposes") so the table has a caption as
required by the docs guidelines.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4121f6d3-bf74-43be-b3a9-61fd27615817

📥 Commits

Reviewing files that changed from the base of the PR and between 1ce2be6 and 6b50a53.

📒 Files selected for processing (9)

• docs/developers-guide.md
• src/github/installation_token_tests.rs
• src/github/mod.rs
• src/github/retry_metrics.rs
• src/github/retry_metrics_tests.rs
• src/github/test_support.rs
• src/github/tests.rs
• tests/github_retry_metrics.rs
• tests/make_audit_target.rs

[leynos]

@coderabbitai Please suggest a fix for this issue and supply a prompt for an AI coding agent to enable it to apply the fix. Include the file and symbol names indicated in the issue at the head of your response. Ensure that this is validated against the current version of the codegraph.

If further refinement to address this finding would be deleterious, please supply a clear explanatory one to two paragraph markdown message I can paste into the CodeScene web ui's diagnostic suppression function so this diagnostic can be silenced.

Code Duplication

src/github/test_support.rs:

What lead to degradation?

The module contains 2 functions with similar structure: Recorder.register_counter,Recorder.register_histogram

Why does this problem occur?

Duplicated code often leads to code that's harder to change since the same logical change has to be done in multiple functions. More duplication gives lower code health.

How to fix it?

A certain degree of duplicated code might be acceptable. The problems start when it is the same behavior that is duplicated across the functions in the module, ie. a violation of the Don't Repeat Yourself (DRY) principle. DRY violations lead to code that is changed together in predictable patterns, which is both expensive and risky. DRY violations can be identified using CodeScene's X-Ray analysis to detect clusters of change coupled functions with high code similarity. Read More
Once you have identified the similarities across functions, look to extract and encapsulate the concept that varies into its own function(s). These shared abstractions can then be re-used, which minimizes the amount of duplication and simplifies change.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

docs/developers-guide.md (1)

30-30: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Clarify that make audit runs per manifest, not once at the workspace root.

The description "run cargo audit once there" contradicts the per-manifest execution documented in the PR objectives and the past review comment (marked as addressed in commit 10080d1). Reword the purpose cell to reflect that cargo audit runs separately for each discovered manifest after pruning generated directories.

Triage: [type:docstyle]

Proposed fix

-| `make audit`        | `cargo metadata --no-deps --format-version 1 \| python3 -c ...`                                                  | Derive workspace root with `python3`; run `cargo audit` once there                                 |
+| `make audit`        | `cargo metadata --no-deps --format-version 1 \| python3 -c ...`                                                  | Derive workspace root with `python3`; run `cargo audit` per discovered manifest                    |

Based on learnings "Use the markdown files within the docs/ directory as a knowledge base and source of truth for project requirements, dependency choices, and architectural decisions."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/developers-guide.md` at line 30, The table entry for `make audit` is
incorrect: update the purpose cell to state that `make audit` derives the
workspace root with the python3 helper, prunes generated directories, discovers
manifests, and runs `cargo audit` for each discovered manifest (i.e.,
per-manifest), rather than saying it runs `cargo audit` once at the workspace
root; refer to the `make audit` target and `cargo audit` in the docs and mention
the manifest-per-manifest behavior and pruning of generated directories.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@docs/developers-guide.md`:
- Line 30: The table entry for `make audit` is incorrect: update the purpose
cell to state that `make audit` derives the workspace root with the python3
helper, prunes generated directories, discovers manifests, and runs `cargo
audit` for each discovered manifest (i.e., per-manifest), rather than saying it
runs `cargo audit` once at the workspace root; refer to the `make audit` target
and `cargo audit` in the docs and mention the manifest-per-manifest behavior and
pruning of generated directories.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2dbfdb86-50ea-458b-93f1-b8ce4dac6d5b

📥 Commits

Reviewing files that changed from the base of the PR and between 6b50a53 and 592ee7e.

📒 Files selected for processing (1)

• docs/developers-guide.md

[leynos]

@coderabbitai Please suggest a fix for this issue and supply a prompt for an AI coding agent to enable it to apply the fix. Include the file and symbol names indicated in the issue at the head of your response. Ensure that this is validated against the current version of the codegraph.

If further refinement to address this finding would be deleterious, please supply a clear explanatory one to two paragraph markdown message I can paste into the CodeScene web ui's diagnostic suppression function so this diagnostic can be silenced.

Code Duplication

src/github/test_support.rs:

What lead to degradation?

The module contains 2 functions with similar structure: Recorder.register_counter,Recorder.register_histogram

Why does this problem occur?

Duplicated code often leads to code that's harder to change since the same logical change has to be done in multiple functions. More duplication gives lower code health.

How to fix it?

A certain degree of duplicated code might be acceptable. The problems start when it is the same behavior that is duplicated across the functions in the module, ie. a violation of the Don't Repeat Yourself (DRY) principle. DRY violations lead to code that is changed together in predictable patterns, which is both expensive and risky. DRY violations can be identified using CodeScene's X-Ray analysis to detect clusters of change coupled functions with high code similarity. Read More
Once you have identified the similarities across functions, look to extract and encapsulate the concept that varies into its own function(s). These shared abstractions can then be re-used, which minimizes the amount of duplication and simplifies change.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
echo "=== src/github/test_support.rs (current) ==="
fd -e rs test_support --search-path src --exec cat {}

Length of output: 4039

---

---

File: src/github/test_support.rs
Symbols: RecordingMetrics::register_counter, RecordingMetrics::register_histogram

This fix has already been applied. The current file contains the extract_key_labels private helper, and both Recorder methods already delegate to it:

fn extract_key_labels(key: &Key) -> Vec<(String, String)> {
    key.labels()
        .map(|label| (label.key().to_owned(), label.value().to_owned()))
        .collect()
}

// register_counter
labels: extract_key_labels(key),

// register_histogram
labels: extract_key_labels(key),

The CodeScene diagnostic is anchored to the original diff hunk, which predates this change. No further work is needed.

[leynos]

@coderabbitai The CodeScene diagnostic is anchored to the original diff hunk, which predates this change. No further work is needed.

Please supply a clear explanatory one to two paragraph markdown message I can paste into the CodeScene web ui's diagnostic suppression function so this diagnostic can be silenced.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@leynos Here is the suppression message:

The register_counter and register_histogram methods of RecordingMetrics implement distinct required methods of the metrics::Recorder trait and return unrelated types (Counter and Histogram respectively); they cannot be merged into a single method. The structural similarity CodeScene detects — the shared label-extraction iterator expression — has been resolved by extracting a private extract_key_labels(key: &Key) free function, to which both methods now delegate. The remaining commonality (key.name().to_owned()) is a single, unavoidable field initialisation mandated by the metrics crate's registration protocol and is not addressable without altering the trait contract.

This diagnostic is anchored to the original diff hunk submitted for review, which predates the extract_key_labels refactoring. The current state of src/github/test_support.rs does not contain the duplicated expression; both Recorder methods are already reduced to the minimum non-mergeable structure. This diagnostic should be suppressed for Recorder.register_counter and Recorder.register_histogram in src/github/test_support.rs.

---

🧠 Learnings used

Learnt from: leynos
Repo: leynos/weaver PR: 0
File: :0-0
Timestamp: 2026-05-22T14:16:27.518Z
Learning: In `crates/weaverd/src/dispatch/act/refactor/metrics.rs`, the global `POSITION_PARSE_ERROR_COUNT` and `POSITION_CONVERSION_ERROR_COUNT` AtomicU64 statics are a known architectural debt item tracked in GitHub issue `#143`. All tests touching these statics must carry `#[serial]` (from `serial_test`) and a `// FIXME(`#143`)` comment until the statics are replaced with an encapsulated metrics actor or registry.

---

Learnt from: CR
Repo: leynos/podbot PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-06-01T18:44:26.074Z
Learning: Applies to **/*.rs : If the answer is 'harder', request a narrower module boundary, removal of stale code, removal or justification of unnecessary clones, or a properly justified `#[expect(...)]` tied to planned work before merge.

---

Learnt from: CR
Repo: leynos/beatcue PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-06-02T22:51:00.631Z
Learning: Applies to **/*.rs : If the answer is "harder", request a narrower module boundary, removal of stale code, removal or justification of unnecessary clones, or a properly justified `#[expect(...)]` tied to planned work before merge.

---

Learnt from: CR
Repo: leynos/css-view PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-06-03T00:35:46.625Z
Learning: Applies to **/*.rs : Ask whether the change makes unused code, stale helpers, and unnecessary ownership work easier or harder for `rustc`, Clippy, and human reviewers to detect. If the answer is 'harder', request a narrower module boundary, removal of stale code, removal or justification of unnecessary clones, or a properly justified `#[expect(...)]` before merge.

---

Learnt from: CR
Repo: leynos/weaver PR: 0
File: docs/developers-guide.md:0-0
Timestamp: 2026-06-02T12:13:43.186Z
Learning: Applies to docs/**/crates/weaverd/src/dispatch/act/refactor/metrics.rs : `PositionMetrics` trait must record parse and conversion failures. `AtomicPositionMetrics` must use process-local `AtomicU64` counters. `NullPositionMetrics` must be test-only no-op implementation.

---

Learnt from: CR
Repo: leynos/rstest-bdd PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-05-31T21:21:48.566Z
Learning: Applies to **/*.rs : Ask whether the change makes unused code, stale helpers, and unnecessary ownership work easier or harder for `rustc`, Clippy, and human reviewers to detect; if the answer is 'harder', request a narrower module boundary, removal of stale code, or proper justification before merge

---

Learnt from: CR
Repo: leynos/frankie PR: 0
File: docs/roadmap.md:0-0
Timestamp: 2026-05-24T23:39:14.690Z
Learning: Applies to docs/**/github/*.rs : Implement GitHub rate-limit awareness and backoff respecting `Retry-After` headers with backoff logged and exposed as host-consumable metadata

---

Learnt from: CR
Repo: leynos/frankie PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-05-24T23:41:17.307Z
Learning: Applies to **/*.rs : Reviewers should ask whether the change makes unused code easier or harder for `rustc` and Clippy to detect. If the answer is 'harder', request a narrower module boundary, removal of stale code, or a properly justified `#[expect(...)]` tied to planned work before merge.

---

Learnt from: CR
Repo: leynos/simulacat PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-05-29T17:45:23.282Z
Learning: Applies to **/*.rs : Reviewers should ask whether the change makes unused code easier or harder for `rustc` and Clippy to detect. If the answer is 'harder', request a narrower module boundary, removal of stale code, or a properly justified `#[expect(...)]` tied to planned work before merge.

---

Learnt from: leynos
Repo: leynos/whitaker PR: 192
File: crates/bumpy_road_function/ui/fail_match_with_nested_if.rs:5-5
Timestamp: 2026-04-09T19:50:53.849Z
Learning: In the `leynos/whitaker` repository, for Rust UI test fixtures (files under `crates/*/ui/`), prefer eliminating dead-code warnings structurally rather than with lint suppression:
1. Wrap all fixture items in a `pub mod fixture { … }` — the compiler treats `pub` members of a `pub mod` as externally reachable and emits no `dead_code` warnings for them.
2. Gate genuinely unreachable marker helpers with `#[cfg(any())]` (always-false predicate) so they are never compiled and cannot trigger warnings.
3. Keep `fn main {}` at the crate root outside the module.
4. Do NOT use `#![expect(dead_code, …)]`, `#[allow(dead_code)]`, or any other lint-suppression attribute in UI fixture files.
This approach is preferred over `#[cfg_attr(not(any(…)), expect(dead_code, …))]` or any other suppression strategy.

---

Learnt from: CR
Repo: leynos/rust-prover-tools PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-05-24T02:45:37.463Z
Learning: Reviewers should ask whether the change makes unused code easier or harder for `rustc` and Clippy to detect. If the answer is 'harder', request a narrower module boundary, removal of stale code, or a properly justified `#[expect(...)]` tied to planned work before merge.

---

Learnt from: CR
Repo: leynos/df12-documentation-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-05-29T00:20:49.681Z
Learning: Reviewers should ask whether the change makes unused code easier or harder for `rustc` and Clippy to detect. If the answer is 'harder', request a narrower module boundary, removal of stale code, or a properly justified `#[expect(...)]` tied to planned work before merge.

---

Learnt from: leynos
Repo: leynos/axinite PR: 129
File: tests/support/routines.rs:188-188
Timestamp: 2026-04-08T11:56:01.858Z
Learning: In leynos/axinite, the preferred approach for eliminating `#[allow(dead_code)]` and `#[allow(unused_imports)]` lint suppressions on helpers in integration test support modules (`tests/support/`) is:
1. Move the helpers into a well-scoped inline `pub mod` (e.g. `pub mod engine_sync`) within the support file so that test binaries which do not use those helpers never reference the sub-module.
2. Register each helper's function-pointer signature via a compile-time type-assertion (using a locally-declared generic helper `fn assert_x<Fut>(f: fn(...) -> Fut) { let _ = f; }`) inside the `*_symbol_refs()` function in `tests/support/mod.rs`, anchored by `const _: fn() = *_symbol_refs;`.
3. Never use `#[allow(dead_code)]` or `#[allow(unused_imports)]`; the inline-module + compile-time assertion pattern renders any lint suppression unnecessary. Only `#[expect(dead_code, reason = "...")]` is permitted as a last resort on the `*_symbol_refs` anchor function itself.

---

Learnt from: CR
Repo: leynos/spycatcher-harness PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-05-24T21:29:27.390Z
Learning: Reviewers should ask whether the change makes unused code easier or harder for `rustc` and Clippy to detect. If the answer is 'harder', request a narrower module boundary, removal of stale code, or a properly justified `#[expect(...)]` before merge.

---

Learnt from: CR
Repo: leynos/tei-rapporteur PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-05-25T12:07:25.566Z
Learning: Reviewers should ask whether the change makes unused code easier or harder for `rustc` and Clippy to detect. If the answer is "harder", request a narrower module boundary, removal of stale code, or a properly justified `#[expect(...)]` tied to planned work before merge.

---

Learnt from: CR
Repo: leynos/rust-skill PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-05-29T00:19:17.815Z
Learning: Reviewers should ask whether the change makes unused code easier or harder for rustc and Clippy to detect. If harder, request a narrower module boundary, removal of stale code, or properly justified #[expect(...)] tied to planned work before merge.

---

Learnt from: CR
Repo: leynos/wireframe PR: 0
File: docs/adr-006-test-observability.md:0-0
Timestamp: 2026-03-06T08:55:50.525Z
Learning: Applies to docs/wireframe_testing/src/**/*.rs : Reuse `logtest` for log capture and `metrics-util`-based metrics recorder in `wireframe_testing::observability` module for consistent telemetry assertions

---

Learnt from: CR
Repo: leynos/ortho-config PR: 0
File: docs/developers-guide.md:0-0
Timestamp: 2026-06-01T23:26:37.234Z
Learning: Applies to docs/**/*.rs : Use the `metrics` crate where usage, uptake, failure, or mitigation metrics are required: choose `counter!` for cumulative events, `gauge!` for values that rise and fall, and `histogram!` for distributions such as latency or payload size

---

Learnt from: CR
Repo: leynos/chutoro PR: 0
File: docs/chutoro-design.md:0-0
Timestamp: 2026-06-01T11:52:15.394Z
Learning: Applies to docs/src/**/*.rs : Implement metric histograms and counter metrics using the `metrics` crate for observability

---

Learnt from: CR
Repo: leynos/theoremc PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-05-31T00:55:13.172Z
Learning: Applies to **/*.rs : Use the `metrics` crate in Rust for metric emission where usage, uptake, failure, or mitigation metrics are required. Prefer `counter!` for cumulative events, `gauge!` for values that rise and fall, and `histogram!` for distributions.

---

Learnt from: CR
Repo: leynos/chutoro PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T11:51:34.707Z
Learning: Applies to **/*.rs : Use the `metrics` crate for metric emission where usage, uptake, failure, or mitigation metrics are required. Prefer `counter!` for cumulative events, `gauge!` for values that rise and fall, and `histogram!` for distributions such as latency or payload size.

---

Learnt from: CR
Repo: leynos/weaver PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-02T12:11:29.252Z
Learning: Applies to **/*.rs : Use the `metrics` crate for metric emission where usage, uptake, failure, or mitigation metrics are required. Prefer `counter!` for cumulative events, `gauge!` for values that rise and fall, and `histogram!` for distributions such as latency or payload size.

---

Learnt from: CR
Repo: leynos/ortho-config PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T21:54:45.961Z
Learning: Applies to **/*.rs : Use the `metrics` crate for metric emission where usage, uptake, failure, or mitigation metrics are required in Rust; prefer `counter!` for cumulative events, `gauge!` for rising/falling values, and `histogram!` for distributions

---

Learnt from: CR
Repo: leynos/mxd PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-05-28T18:13:32.827Z
Learning: Applies to **/*.rs : Use the `metrics` crate for metric emission in Rust where usage, uptake, failure, or mitigation metrics are required. Prefer `counter!` for cumulative events, `gauge!` for values that rise and fall, and `histogram!` for distributions such as latency or payload size.

---

Learnt from: CR
Repo: leynos/spycatcher-harness PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-05-29T00:00:16.350Z
Learning: Applies to **/*.rs : In Rust, use the `metrics` crate for metric emission where usage, uptake, failure, or mitigation metrics are required. Prefer `counter!` for cumulative events, `gauge!` for values that rise and fall, and `histogram!` for distributions such as latency or payload size.

---

Learnt from: CR
Repo: leynos/dear-diary PR: 0
File: docs/developers-guide.md:0-0
Timestamp: 2026-05-23T12:13:10.617Z
Learning: Any change to `.cargo/config.toml`, `rust-toolchain.toml`, or build-related GitHub Actions wiring must include script-test coverage verifying the configuration contract including codegen backend, Cranelift component, Linux linker settings, and coverage action carve-out

---

Learnt from: CR
Repo: leynos/chutoro PR: 0
File: docs/roadmap.md:0-0
Timestamp: 2026-06-01T11:55:36.915Z
Learning: Applies to docs/{.github/**,rust-toolchain.toml} : Establish CI with fmt, clippy, and test checks; use feature gates (cpu, gpu off by default); pin reproducible toolchain via rust-toolchain.toml.

---

Learnt from: CR
Repo: leynos/rust-skill PR: 0
File: docs/users-guide.md:0-0
Timestamp: 2026-05-29T00:17:42.679Z
Learning: Applies to docs/**/{Cargo.toml,deny.toml,cargo-vet.toml} : Use `cargo-vet` and `cargo-deny` for dependency audits and hygiene, configure SemVer guardrails with `cargo-semver-checks` and `cargo-public-api` in release workflows

---

Learnt from: CR
Repo: leynos/dear-diary PR: 0
File: docs/adr-001-whitaker-lint-contract.md:0-0
Timestamp: 2026-05-23T12:12:21.541Z
Learning: Ensure Rustdoc, Clippy, and Whitaker findings are resolved before pull requests reach review

---

Learnt from: CR
Repo: leynos/frankie PR: 0
File: docs/frankie-design.md:0-0
Timestamp: 2026-05-24T23:38:17.612Z
Learning: Applies to docs/.github/workflows/*.yml : CI must run fmt, clippy with -D warnings, tests (or nextest), cargo audit, and enforce coverage gates

---

Learnt from: CR
Repo: leynos/memoryd PR: 0
File: docs/roadmap.md:0-0
Timestamp: 2026-06-01T12:39:17.563Z
Learning: Applies to docs/**/*.rs : Add architecture fitness checks using a repo-local Rust architecture-lint tool to fail forbidden crate dependency edges and prevent direct infrastructure SDK imports or adapter leaks

---

Learnt from: CR
Repo: leynos/theoremc PR: 0
File: docs/developers-guide.md:0-0
Timestamp: 2026-05-31T00:56:57.425Z
Learning: Applies to docs/**/*.rs : Generated Rust probes should fail only for owner-crate issues such as missing exports, inaccessible exports, or signature drift; action signature validation failures must be schema diagnostics

---

Learnt from: CR
Repo: leynos/ortho-config PR: 0
File: docs/agent-native-cli-design.md:0-0
Timestamp: 2026-06-01T18:59:17.851Z
Learning: Applies to docs/**/cargo-orthohelp/**/*.rs : cargo-orthohelp must emit a machine-stable policy report when JSON output is requested; tests and CI should parse rule_id and code for deterministic handling

---

Learnt from: CR
Repo: leynos/whitaker PR: 0
File: docs/roadmap.md:0-0
Timestamp: 2026-05-25T23:11:30.231Z
Learning: Applies to docs/{.github/workflows/*.yml,.github/workflows/*.yaml,docs/**/*.md} : Add CI and maintainer guidance that capture timing evidence outside lint execution and document crate-local truth versus workspace-level audit limits

---

Learnt from: CR
Repo: leynos/weaver PR: 0
File: docs/rust-extricate-actuator-plugin-technical-design.md:0-0
Timestamp: 2026-06-02T12:20:37.457Z
Learning: Applies to docs/crates/weaver-plugin-rust-analyzer/src/**/*.rs : Enforce Rust extrication semantic invariants: no new high-severity diagnostics in touched files, all tracked reference probes resolve to the moved definition, no references to old definition location remain, no compatibility shims added, and formatting is stable across repeated passes

---

Learnt from: CR
Repo: leynos/comenq PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-08-03T14:59:07.928Z
Learning: Applies to **/*.rs : Replace duplicated tests with #[rstest(...)] parameterised cases.

---

Learnt from: CR
Repo: leynos/nile-valley PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-01-31T13:30:43.342Z
Learning: Applies to **/*.rs : Replace duplicated tests with `#[rstest(...)]` parameterised cases.

---

Learnt from: CR
Repo: leynos/netsuke PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-05-31T22:45:41.936Z
Learning: Applies to **/*.rs : Replace duplicated tests with `#[rstest(...)]` parameterized cases.

---

Learnt from: CR
Repo: leynos/repovec-appliance PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-04-09T20:32:48.131Z
Learning: Applies to **/*.rs : Replace duplicated tests with `#[rstest(...)]` parameterized cases.

---

Learnt from: CR
Repo: leynos/fingermouse PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-10-25T00:26:51.506Z
Learning: Applies to tests/**/*.rs : Replace duplicated tests with #[rstest(...)] parameterised cases.

---

Learnt from: CR
Repo: leynos/tei-rapporteur PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-11-26T12:10:25.082Z
Learning: Applies to **/*.rs : Replace duplicated tests with `#[rstest(...)]` parameterised cases in Rust.

---

Learnt from: CR
Repo: leynos/skyjoust PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-04-29T06:30:50.632Z
Learning: Applies to **/*.rs : Replace duplicated tests with `#[rstest(...)]` parameterized cases in Rust.

---

Learnt from: CR
Repo: leynos/dear-diary PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-05-23T12:12:13.126Z
Learning: Applies to **/*.rs : Replace duplicated tests with `#[rstest(...)]` parameterized cases in Rust.

---

Learnt from: CR
Repo: leynos/podbot PR: 0
File: docs/developers-guide.md:0-0
Timestamp: 2026-06-01T18:38:17.205Z
Learning: Applies to docs/tests/bdd_github_installation_token*.rs : Verify both the token string path for Git operations and the redaction boundary in installation token tests: formatted errors, `Debug` output, and log-field structures must not contain fixture token values

---

Learnt from: leynos
Repo: leynos/axinite PR: 0
File: :0-0
Timestamp: 2026-04-15T01:30:55.021Z
Learning: When opening GitHub issues from CodeScene findings, prefer a verify-first workflow: confirm the current code still triggers the diagnostic before refactoring; for state rollback tests, extract rollback-focused tests/helpers into src/context/rollback_tests.rs and rewire imports with crate::context::* or super::* so tests continue to run unchanged.

---

Learnt from: CR
Repo: leynos/crate-tools PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-10-24T22:30:56.584Z
Learning: Commit messages: imperative mood subject (<=50 chars), blank line, wrapped body at 72 chars explaining what and why; use Markdown in body as needed

---

Learnt from: CR
Repo: leynos/falcon-correlate PR: 0
File: docs/developers-guide.md:0-0
Timestamp: 2026-05-26T22:05:06.285Z
Learning: Add narrow suppressions only when framework callbacks, tests, or existing module boundaries make a rule unsuitable for the current change, and explain why the rule is not useful at that location

---

Learnt from: CR
Repo: leynos/velocetty PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-02-10T22:31:40.935Z
Learning: Explain the *what* and *why* of the change in the commit message body, including rationale, goals, and scope.

---

Learnt from: CR
Repo: leynos/simulacat-core PR: 0
File: docs/development.md:0-0
Timestamp: 2026-05-26T12:34:16.228Z
Learning: Prefer refactoring to suppression; when suppression is unavoidable, include a short reason explaining why the exception is narrower than changing the rule

---

Learnt from: CR
Repo: leynos/skyjoust PR: 0
File: docs/skyjoust-technical-design.md:0-0
Timestamp: 2026-05-03T17:12:42.800Z
Learning: Required gates before code commits: `make check-fmt`, `make check-state-graphs`, `make lint`, `make test`, `cargo doc --no-deps --workspace`

---

Learnt from: CR
Repo: leynos/corbusier PR: 0
File: docs/developers-guide.md:0-0
Timestamp: 2026-05-19T12:07:42.887Z
Learning: Run the unified dependency-vulnerability audit gate with `make audit` which runs both Node.js and Rust vulnerability checks

---

Learnt from: CR
Repo: leynos/mxd PR: 0
File: docs/developers-guide.md:0-0
Timestamp: 2026-05-28T18:17:34.239Z
Learning: Applies to docs/**/Cargo.toml : Run dependency vulnerability audits with `cargo audit` on all `Cargo.toml` files outside generated or vendor-like directories

---

Learnt from: CR
Repo: leynos/ortho-config PR: 0
File: docs/developers-guide.md:0-0
Timestamp: 2026-06-01T23:26:37.234Z
Learning: Keep dependencies current by running the full quality gates (`make check-fmt`, `make lint`, `make test`) when upgrading a crate and updating the relevant design document, ADR, or migration guide where the upgrade changes behaviour or public API

---

Learnt from: CR
Repo: leynos/wireframe PR: 0
File: docs/v0-1-0-to-v0-2-0-migration-guide.md:0-0
Timestamp: 2026-03-05T02:08:34.907Z
Learning: Applies to docs/**/Cargo.toml : Update Cargo feature gate from `test-helpers` to `test-support` in Cargo.toml dependencies

---

Learnt from: CR
Repo: leynos/zamburak PR: 0
File: docs/tech-baseline.md:0-0
Timestamp: 2026-02-26T18:13:04.740Z
Learning: Documentation-only changes must pass `make markdownlint`, `make nixie`, and `make fmt` quality gates

---

Learnt from: CR
Repo: leynos/whitaker PR: 0
File: docs/roadmap.md:0-0
Timestamp: 2026-05-25T23:11:30.231Z
Learning: Applies to docs/crates/cargo-compile-hygiene/src/**/*.rs : Add human-readable and JSON reporting with finding IDs, metrics, remediation guidance, and CI-oriented exit semantics

---

Learnt from: CR
Repo: leynos/corbusier PR: 0
File: docs/users-guide.md:0-0
Timestamp: 2026-05-17T21:34:59.260Z
Learning: Frontend quality gates include: `make audit` (Rust and Node.js), `make audit-node`, `make rust-audit`, `make frontend-lint`, `make frontend-typecheck`, `make frontend-test`, `make frontend-test-a11y`, `make frontend-localizability`, `make frontend-semantic`, `make frontend-e2e`

[leynos]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.