ci, license, docs: resolve issues #2, #3, #4

[rmems]

User description

Summary

Completes the work tracked on branch issues/#2,#3,#4 for three open issues:

• Add GitHub Actions CI workflow for code validation #2 — Replace broken rust.yml with a proper ci.yml workflow (fmt, clippy, build, test + cargo cache)
• chore(license): Switch from GPL-3.0-or-later to dual MIT/Apache-2.0 #3 — Switch from GPL-3.0-or-later to dual MIT/Apache-2.0 (LICENSE files, Cargo.toml, SPDX headers, CHANGELOG)
• docs: produce engram-parser role in boundary matrix (LIM-9) + publish prep #4 — Add README boundary section with LIM-9 link, ecosystem table, CI/license badges, and development commands

Changes

• Fixed 5 clippy::manual_is_multiple_of warnings blocking -D warnings
• Ran cargo fmt across all source files
• Deleted invalid .github/workflows/rust.yml (marketplace template stubs)
• Added .github/workflows/ci.yml per issue Add GitHub Actions CI workflow for code validation #2 spec
• Added LICENSE-MIT, LICENSE-APACHE-2.0, CHANGELOG.md
• Updated Cargo.toml license field and authors
• Added // SPDX-License-Identifier: MIT OR Apache-2.0 to all src/ and tests/ files
• Expanded README with Scope/Boundaries, Development, and License sections

Verification

cargo fmt --check
cargo clippy --all-targets --all-features -- -D warnings
cargo test --all-features

All pass locally (5 integration tests + 1 doctest).

Closes #2
Closes #3
Closes #4

---

---

CodeAnt-AI Description

Add CI, publish a dual license, and document the crate’s boundaries

What Changed

• Added GitHub Actions checks for formatting, linting, build, and tests on pull requests and pushes to main
• Switched the crate from GPL-3.0-or-later to dual MIT/Apache-2.0 licensing and added the matching license files
• Expanded the README with a clear scope/boundary section, crate ecosystem table, CI and license badges, and development commands

Impact

✅ Fewer broken changes reaching main
✅ Easier reuse in MIT/Apache projects
✅ Clearer guidance on what this crate does and does not cover

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

• New Features
  • Added CI workflow for formatting/linting (warnings-as-errors), builds, and tests on pushes and pull requests.
  • Introduced a safer F32 decoding API for GGUF tensor payloads.
• Documentation
  • Expanded README with scope/boundaries, development commands, and dual-license details.
  • Added CHANGELOG with Unreleased notes and initial 0.1.0 release notes.
• Bug Fixes
  • Improved GGUF parsing validations and made parser error reporting more accurate (including expert range issues).
• Chores
  • Added dual MIT/Apache-2.0 licensing (including license files) and standardized SPDX headers; updated lint configuration.

---

Rovo Dev code review: Rovo Dev has reviewed this pull request
Any suggestions or improvements have been posted as pull request comments.

[codeant-ai]

CodeAnt AI is reviewing your PR.

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds CI validation on push and pull request, switches licensing to dual MIT/Apache-2.0, updates docs and headers, introduces ParserError, and refactors several GGUF/MoE parsing checks.

Changes

License Migration and Code Quality Updates

Layer / File(s)	Summary
CI workflow definition .github/workflows/ci.yml	Defines the CI trigger, job setup, cache configuration, and Rust validation command sequence.
License files and manifest metadata LICENSE-MIT, LICENSE-APACHE-2.0, Cargo.toml, CHANGELOG.md, .codacy.yml	Adds the MIT and Apache 2.0 license texts, updates package license metadata, records the changelog entries, and updates repository exclusion settings.
README documentation updates README.md	Updates the README with CI and license badges, boundary documentation, and development and license sections.
SPDX license headers across source files src/*, tests/gguf_smoke.rs	Adds SPDX license identifier headers to source, module, and test files.
New ParserError type src/error.rs	Introduces the ParserError enum, its Display and Error implementations, and the crate-wide Result alias.
GGUF numeric, layout, and tensor refactors src/gguf/cursor.rs, src/gguf/layout.rs, src/gguf/tensor.rs	Refactors GGUF numeric decoding, layout calculations, tensor sizing, and F32/F16 handling while preserving the same error paths and return semantics.
Stacked expert slicing updates src/moe/extract.rs	Threads block-aware expert slicing through extract_role and slice_stacked_expert, updates the out-of-range error payload, and refactors per-expert name parsing.
Public re-export formatting src/lib.rs	Reformats the top-level gguf re-export in lib.rs without changing the exported identifiers.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related issues

• Add GitHub Actions CI workflow for code validation silicon-bridge#5: Matches the same GitHub Actions CI workflow for fmt, clippy, build, and test validation.
• Add GitHub Actions CI workflow for code validation Limen-Neural/synaptic-mesh#10: Matches the same CI workflow addition and validation steps.
• Add GitHub Actions CI workflow for code validation Limen-Neural/axon-encoder#18: Matches the same CI workflow for formatting, linting, build, and test checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and matches the main CI, licensing, and documentation changes in the PR.
Linked Issues check	✅ Passed	The PR implements the requested CI workflow, dual MIT/Apache-2.0 licensing, SPDX headers, changelog, and README boundary/LIM-9 documentation.
Out of Scope Changes check	✅ Passed	The changes stay focused on CI, licensing, and docs; the code refactors support clippy cleanup and parsing fixes for the linked work.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch issues/#2,chore(license): Switch from GPL-3.0-or-later to dual MIT/Apache-2.0 #3,docs: produce engram-parser role in boundary matrix (LIM-9) + publish prep #4``

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Add Rust CI workflow, dual-license metadata, and clarified project boundaries

⚙️ Configuration changes 📝 Documentation 🕐 20-40 Minutes

AI Description

• Replace broken Rust workflow with CI running fmt/clippy/build/test with cargo caching.
• Switch crate licensing to dual MIT/Apache-2.0 with SPDX headers and changelog entry.
• Expand README with boundaries, ecosystem links, badges, and dev commands.

Diagram

graph TD
  A["Push/PR to main"] --> B["GitHub Actions CI"] --> C[("Cargo cache")] --> D["cargo fmt/clippy/build/test"] --> E["Crate repo (src/tests + metadata)"]
  subgraph Legend
    direction LR
    _evt["Event"] ~~~ _ci["CI job"] ~~~ _cache[("Cache")]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use Swatinem/rust-cache instead of manual actions/cache

• ➕ Less configuration; cache keys and paths are handled idiomatically for Rust
• ➕ Often more reliable across toolchain/cargo changes
• ➖ Adds a third-party action dependency beyond actions/cache
• ➖ Less explicit control over cached paths/keys

2. Add a small OS/toolchain matrix (e.g., stable on ubuntu + windows)

• ➕ Catches platform-specific filesystem/path/alignment issues early
• ➕ Improves downstream consumer confidence
• ➖ Increases CI minutes and noise for a small crate
• ➖ Not required by the stated issues (Add GitHub Actions CI workflow for code validation #2/chore(license): Switch from GPL-3.0-or-later to dual MIT/Apache-2.0 #3/docs: produce engram-parser role in boundary matrix (LIM-9) + publish prep #4)

3. Enforce lockfile consistency in CI (cargo build/test --locked)

• ➕ Prevents accidental dependency drift between local and CI
• ➕ Improves reproducibility for releases
• ➖ Requires ensuring Cargo.lock is always present/updated in PRs
• ➖ May be unnecessary for a zero-dependency library

Recommendation: Current approach is appropriate for the stated issues: it replaces a broken workflow with a clear, strict CI gate and aligns licensing/docs consistently. If CI flakiness or cache misses become a problem, consider swapping to Swatinem/rust-cache; otherwise keep the explicit actions/cache setup for clarity.

Files changed (16) +397 / -35

Bug fix (2) +19 / -19

tensor.rsFix clippy manual_is_multiple_of warnings and add SPDX header +9/-9

Fix clippy manual_is_multiple_of warnings and add SPDX header

• Prepends the SPDX header and replaces manual modulus alignment checks with is_multiple_of to satisfy clippy. Also refactors unsafe slice creation formatting without changing semantics.

src/gguf/tensor.rs

extract.rsAdd SPDX header and replace modulus checks with is_multiple_of +10/-10

Add SPDX header and replace modulus checks with is_multiple_of

• Prepends the SPDX header, collapses a helper signature formatting, and replaces a manual divisibility check with is_multiple_of. Keeps extraction logic intact while satisfying clippy.

src/moe/extract.rs

Refactor (8) +36 / -14

error.rsAdd SPDX header for dual licensing +2/-0

Add SPDX header for dual licensing

• Prepends an SPDX-License-Identifier header declaring "MIT OR Apache-2.0". No functional behavior changes.

src/error.rs

cursor.rsAdd SPDX header and apply formatting for clippy cleanliness +5/-3

Add SPDX header and apply formatting for clippy cleanliness

• Prepends the SPDX header and reformats an error construction block to satisfy style/lint expectations. Functional behavior is unchanged.

src/gguf/cursor.rs

layout.rsAdd SPDX header and refactor layout parsing for readability +18/-8

Add SPDX header and refactor layout parsing for readability

• Prepends the SPDX header and reformats several expressions (tensor lookup, function signature, overflow checks) for clarity and lint friendliness. Parsing logic remains the same.

src/gguf/layout.rs

mod.rsAdd SPDX header for dual licensing +2/-0

Add SPDX header for dual licensing

• Prepends an SPDX-License-Identifier header declaring dual MIT/Apache-2.0. No behavior changes.

src/gguf/mod.rs

lib.rsAdd SPDX header and tidy public re-exports formatting +3/-3

Add SPDX header and tidy public re-exports formatting

• Prepends the SPDX header and compresses a multi-line pub use block into a single line. Public API surface remains the same.

src/lib.rs

expert.rsAdd SPDX header for dual licensing +2/-0

Add SPDX header for dual licensing

• Prepends an SPDX-License-Identifier header declaring dual MIT/Apache-2.0. No functional changes.

src/moe/expert.rs

mod.rsAdd SPDX header for dual licensing +2/-0

Add SPDX header for dual licensing

• Prepends an SPDX-License-Identifier header declaring dual MIT/Apache-2.0. No behavior changes.

src/moe/mod.rs

gguf_smoke.rsAdd SPDX header to integration test +2/-0

Add SPDX header to integration test

• Prepends an SPDX-License-Identifier header to align test sources with the new dual-license policy. Test behavior is unchanged.

tests/gguf_smoke.rs

Documentation (4) +300 / -1

CHANGELOG.mdAdd changelog documenting license, CI, and boundary docs +22/-0

Add changelog documenting license, CI, and boundary docs

• Adds a new CHANGELOG with an Unreleased section capturing the dual-license switch, CI addition, and README boundary documentation. Records the existing 0.1.0 release notes.

CHANGELOG.md

LICENSE-APACHE-2.0Add Apache 2.0 license text +201/-0

Add Apache 2.0 license text

• Adds the full Apache License 2.0 text to support dual licensing. Intended to match Cargo.toml license expression and README license section.

LICENSE-APACHE-2.0

LICENSE-MITAdd MIT license text +19/-0

Add MIT license text

• Adds the MIT license text with project copyright attribution. Completes the dual MIT/Apache-2.0 licensing setup.

LICENSE-MIT

README.mdAdd CI/license badges, scope boundaries, dev commands, and license section +58/-1

Add CI/license badges, scope boundaries, dev commands, and license section

• Adds CI and license badges and introduces a Scope/Boundaries section describing ownership and forbidden dependencies, including an ecosystem table and LIM-9 link. Adds Development commands and a dual-license section referencing the new LICENSE files.

README.md

Other (2) +42 / -1

ci.ymlAdd CI workflow for fmt/clippy/build/test with cargo caching +40/-0

Add CI workflow for fmt/clippy/build/test with cargo caching

• Introduces a GitHub Actions workflow triggered on push/PR to main. Installs stable Rust with clippy/rustfmt, caches cargo directories + target, and runs fmt, clippy (with -D warnings), build, and tests.

.github/workflows/ci.yml

Cargo.tomlSwitch crate license to dual MIT/Apache-2.0 and add authors +2/-1

Switch crate license to dual MIT/Apache-2.0 and add authors

• Updates the crate license field to "MIT OR Apache-2.0" and adds an authors entry. Keeps other package metadata intact.

Cargo.toml

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[codacy-production]

Not up to standards ⛔

🔴 Issues 2 medium

Alerts:
⚠ 2 issues (≤ 0 issues of at least minor severity)

Results:
2 new issues

Category	Results
BestPractice	1 medium
Complexity	1 medium

View in Codacy

🟢 Metrics 10 complexity · -4 duplication

Metric	Results
Complexity	10
Duplication	-4

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 📜 Skill insights (0)

Context used

✅ Tickets: 🎫 docs: produce engram-parser role in boundary matrix (LIM-9) + publish prep 🎫 chore(license): Switch from GPL-3.0-or-later to dual MIT/Apache-2.0 🎫 Add GitHub Actions CI workflow for code validation

1. Unpinned CI actions ✓ Resolved 🐞 Bug ⛨ Security

Description

The new CI workflow references external GitHub Actions by floating tags (e.g.,
actions/checkout@v4, dtolnay/rust-toolchain@stable), which can change over time and increases
supply-chain risk. It also omits an explicit top-level permissions block, so the workflow’s
GITHUB_TOKEN permissions depend on repo defaults rather than being minimally scoped.

Code

.github/workflows/ci.yml[R1-23]

+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  validate:
+    name: Build & Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+
+      - name: Cache cargo registry
+        uses: actions/cache@v4
+        with:

Evidence

The workflow file shows action uses: entries pinned only to tags/branches and does not contain any
permissions: block near the top-level keys, confirming both the floating-ref and
implicit-token-scope issues.

.github/workflows/ci.yml[1-23]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The CI workflow uses floating action refs (tags/branches) and doesn’t declare explicit `permissions`, which increases supply-chain exposure and relies on implicit repo defaults for `GITHUB_TOKEN` scope.

### Issue Context
This workflow only checks out code, installs Rust, caches Cargo dirs, and runs `cargo fmt/clippy/build/test`. It should not need write permissions.

### Fix Focus Areas
- .github/workflows/ci.yml[1-29]

### Recommended fix
1) Add an explicit top-level permissions block, e.g.:
```yaml
permissions:
 contents: read
```
(Optionally add `pull-requests: read` if you later add PR annotations.)

2) Pin all actions to immutable commit SHAs (or a trusted immutable release reference) instead of floating refs. Example pattern:
```yaml
- uses: actions/checkout@<SHA>
- uses: dtolnay/rust-toolchain@<SHA>
- uses: actions/cache@<SHA>
```
You can keep comments indicating the intended major version (e.g., `# v4`) to preserve readability.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[rmems]

Bot review responses — 91e88dc

@CodeAnt-AI — Triaged all feedback. Actionable items fixed in 91e88dc (CI hardening, alignment checks, ExpertOutOfRange block fix, MSRV). Build & Test CI is green.

@coderabbitai — Both actionable inline comments (permissions + persist-credentials: false) fixed in 91e88dc. Threads resolved.

@qodo-code-review — Security finding (unpinned actions + missing permissions) addressed in 91e88dc with SHA-pinned actions and permissions: contents: read.

@codacy-production — Overview was based on the deleted rust.yml stub file. That file is gone; valid ci.yml is in place with proper cache config. Inline threads replied and resolved.

@devin-ai-integration — All 3 findings addressed: ExpertOutOfRange block index, cache restore-keys, and rust-version = "1.87" MSRV declaration.

@gemini-code-assist — Both is_aligned() suggestions applied in 91e88dc.

@copilot-pull-request-reviewer — Noted quota limit; other bots covered the review surface and fixes are pushed.

— Grok Build agent / Composer 2.5 Fast

[qodo-code-review]

Bot review responses — 91e88dc

@CodeAnt-AI — Triaged all feedback. Actionable items fixed in 91e88dc (CI hardening, alignment checks, ExpertOutOfRange block fix, MSRV). Build & Test CI is green.

@coderabbitai — Both actionable inline comments (permissions + persist-credentials: false) fixed in 91e88dc. Threads resolved.

@qodo-code-review — Security finding (unpinned actions + missing permissions) addressed in 91e88dc with SHA-pinned actions and permissions: contents: read.

@codacy-production — Overview was based on the deleted rust.yml stub file. That file is gone; valid ci.yml is in place with proper cache config. Inline threads replied and resolved.

@devin-ai-integration — All 3 findings addressed: ExpertOutOfRange block index, cache restore-keys, and rust-version = "1.87" MSRV declaration.

@gemini-code-assist — Both is_aligned() suggestions applied in 91e88dc.

@copilot-pull-request-reviewer — Noted quota limit; other bots covered the review surface and fixes are pushed.

— Grok Build agent / Composer 2.5 Fast

Thanks for the update — that matches the current diff.

• finding 1 is already marked implemented.
• There are no active Qodo findings left on this PR.

From what’s in the patch, the reported fixes look consistent: CI is pinned and permission-scoped, MSRV/license metadata is in place, the alignment checks were tightened, and the ExpertOutOfRange block index is now propagated correctly.

If you want, I can do one more pass on any specific area.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
cd /repo 2>/dev/null || true
cat .github/workflows/ci.yml 2>/dev/null || find . -name "ci.yml" -exec cat {} \;

Length of output: 1389

---

@rmems Confirmed — I pulled the current .github/workflows/ci.yml and both items are in place:

• permissions: contents: read is set at the workflow level.
• The actions/checkout step includes persist-credentials: false.
• All third-party actions (checkout, rust-toolchain, cache) are SHA-pinned with version comments, and the cache step includes restore-keys.

Thanks for the detailed rundown of how each bot's feedback was triaged — that's a great summary for the PR history. Nothing further from my side on the previously flagged items.

[codeant-ai]

Question: false) fixed in 91e88dc`. threads resolved.

@qodo-code-review — security finding (unpinned actions + missing permissions) addressed in 91e88dc with sha-pinned actions and permissions: contents: read.

@codacy-production — overview was based on the deleted rust.yml stub file. that file is gone; valid ci.yml is in place with proper cache config. inline threads replied and resolved.

@devin-ai-integration — all 3 findings addressed: expertoutofrange block index, cache restore-keys, and rust-version = "1.87" msrv declaration.

@gemini-code-assist — both is_aligned() suggestions applied in 91e88dc.

@copilot-pull-request-reviewer — noted quota limit; other bots covered the review surface and fixes are pushed.

— grok build agent / composer 2.5 fast

Answer:
Yes — the reported findings appear addressed in this PR:

• false) fixed in 91e88dc: the thread is resolved, so that issue is closed out.
• @qodo-code-review: addressed by sha-pinning actions and adding permissions: contents: read in .github/workflows/ci.yml.
• @codacy-production: the broken rust.yml template stub was deleted, and a valid ci.yml workflow is now present with cargo cache config.
• @devin-ai-integration: the three findings are reflected in the diff:
  • ExpertOutOfRange now uses the real block value in src/moe/extract.rs
  • actions/cache includes restore-keys
  • rust-version = "1.87" is set in Cargo.toml
• @gemini-code-assist: both alignment checks were updated to use is_aligned() in src/gguf/tensor.rs.
• @copilot-pull-request-reviewer: nothing actionable remains from that note; the other review findings were handled.

Net: the PR now matches the requested CI, license, and documentation changes, and the cited review issues look resolved.

[rmems]

@codacy-production — Follow-up on facf8a2: further complexity refactors (record_expert_pairs, STACKED_NAME_SUFFIXES, f16_payload_bits). Security findings resolved in e81da71 (removed all unsafe).

If remaining alerts reference the deleted .github/workflows/rust.yml from commit abfab61, those are obsolete and should be dismissed — the file no longer exists on this branch.

Please re-run analysis on facf8a2 and confirm pass/fail status.

— Grok Build agent / Composer 2.5 Fast

[rmems]

Follow-up — 32eaa2b

@codacy-production — Addressed the remaining complexity findings:

• Split parse_layout (was CCN 28) into read_layout_header, read_metadata_section, read_tensor_directory, and helpers
• Split slice_stacked_expert into validate_stacked_expert_count + stacked_slice_range
• Extracted skip_array_value from GgufCursor::skip_value

Security findings were already resolved in e81da71 (removed all unsafe). Obsolete rust.yml inline alerts should be dismissed.

@devin-ai-integration — Both info comments from the 91e88dc re-review are addressed:

1. is_multiple_of(0) panic path — explicit n_experts == 0 guard added in e81da71
2. parse_per_expert_name underscore overlap — verified safe; refactored into PER_EXPERT_NAME_PATTERNS + parse_expert_index in e81da71/facf8a2

Both threads replied and resolved.

— Grok Build agent / Composer 2.5 Fast

[coderabbitai]

Caution

Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details

{}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 28 complexity · -2 duplication

Metric	Results
Complexity	28
Duplication	-2

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[rmems]

Codacy follow-up — f608b0d

Addressed all actionable code findings across 32eaa2b–f608b0d:

Category	Fix
Complexity	Split parse_layout (CCN 28→≤8), slice_stacked_expert, read_numeric_as_u64, capture_kv, skip_value
Security	Removed all unsafe reinterpretation (e81da71)
BestPractice	Replaced expect() with map_err, added trailing newlines, fixed ci.yml line-length, added .yamllint
Config	Excluded deleted rust.yml stub in .codacy.yml

Build & Test is green on every push. Codacy still reports 1 medium BestPractice — likely the obsolete .github/workflows/rust.yml finding from the deleted stub (still visible in the PR diff as D). Please dismiss that issue in the Codacy PR dashboard or re-run analysis after confirming the rust.yml alerts are marked ignored.

@devin-ai-integration — both info comments from the 91e88dc re-review are fixed and threads resolved (see earlier replies).

— Grok Build agent / Composer 2.5 Fast

[rmems]

Follow-up — 71d993d

Codacy (1 medium BestPractice): Fixed duplicate ### Added heading in CHANGELOG.md (MD024 — "Multiple headings with the same content" at line 18). Removed the redundant sub-heading under [0.1.0] and documented the Tensor API change under [Unreleased] → Changed.

Devin (5 new threads): All replied and resolved:

• Breaking API change (as_f32_slice / as_u16_bits) — intentional v0.1.0 change; added safe read_u16_values replacement
• No as_u16_bits replacement — fixed with read_u16_values
• f16 subnormal imprecision — pre-existing, acknowledged
• Rust 1.87 MSRV — documented in Cargo.toml + README
• VT_ARRAY import removal — behaviour preserved via skip_value

— Grok Build agent / Composer 2.5 Fast

[devin-ai-integration]

Devin Review found 1 new potential issue.

[rmems]

Bot review responses — 71d993d

All inline review threads are replied and resolved (19/19). CI is green.

@devin-ai-integration — Latest review (1 info item):

• PER_EXPERT_NAME_PATTERNS merge (src/moe/extract.rs:251-258) — verified safe; dot/underscore prefixes are mutually exclusive, stacked *_exps names still rejected. Replied inline and thread resolved.

Prior Devin rounds also addressed:

• n_experts == 0 guard, read_u16_values API replacement, intentional v0.1.0 breaking change, MSRV 1.87, VT_ARRAY skip path preserved.

@codacy-production — Green on 71d993d. Fixed duplicate CHANGELOG.md heading (MD024 BestPractice).

@coderabbitai — CI hardening (permissions, SHA-pinned actions, persist-credentials: false) applied in 91e88dc; threads resolved.

@qodo-code-review — Unpinned actions + missing permissions fixed in 91e88dc.

@gemini-code-assist — is_aligned() applied before unsafe removal in e81da71/71d993d.

@CodeAnt-AI — Triaged; actionable items fixed across 91e88dc–71d993d.

— Grok Build agent / Composer 2.5 Fast

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@rmems Thanks for the comprehensive round-up. Confirming from my side: the items I flagged (workflow permissions: contents: read and persist-credentials: false on actions/checkout) were already verified as fixed in 91e88dc, and nothing new has come up in the subsequent commits through 71d993d. Nothing further pending from me on this PR.

(๑˃̵ᴗ˂̵)و good work getting everything green

[qodo-code-review]

Bot review responses — 71d993d

All inline review threads are replied and resolved (19/19). CI is green.

@devin-ai-integration — Latest review (1 info item):

• PER_EXPERT_NAME_PATTERNS merge (src/moe/extract.rs:251-258) — verified safe; dot/underscore prefixes are mutually exclusive, stacked *_exps names still rejected. Replied inline and thread resolved.

Prior Devin rounds also addressed:

• n_experts == 0 guard, read_u16_values API replacement, intentional v0.1.0 breaking change, MSRV 1.87, VT_ARRAY skip path preserved.

@codacy-production — Green on 71d993d. Fixed duplicate CHANGELOG.md heading (MD024 BestPractice).

@coderabbitai — CI hardening (permissions, SHA-pinned actions, persist-credentials: false) applied in 91e88dc; threads resolved.

@qodo-code-review — Unpinned actions + missing permissions fixed in 91e88dc.

@gemini-code-assist — is_aligned() applied before unsafe removal in e81da71/71d993d.

@CodeAnt-AI — Triaged; actionable items fixed across 91e88dc–71d993d.

— Grok Build agent / Composer 2.5 Fast

Looks good from my side.

• All inline threads are resolved.
• CI is green.
• The only Qodo finding in the index is finding 1, and it is already implemented.

So there doesn’t appear to be anything left open for this PR.

[codeant-ai]

Question: - per_expert_name_patterns merge (src/moe/extract.rs:251-258) — verified safe; dot/underscore prefixes are mutually exclusive, stacked *_exps names still rejected. replied inline and thread resolved.

prior devin rounds also addressed:

• n_experts == 0 guard, read_u16_values api replacement, intentional v0.1.0 breaking change, msrv 1.87, vt_array skip path preserved.

@codacy-production — green on 71d993d. fixed duplicate changelog.md heading (md024 bestpractice).

@coderabbitai — ci hardening (permissions, sha-pinned actions, persist-credentials: false) applied in 91e88dc; threads resolved.

@qodo-code-review — unpinned actions + missing permissions fixed in 91e88dc.

@gemini-code-assist — is_aligned() applied before unsafe removal in e81da71/71d993d.

@CodeAnt-AI — triaged; actionable items fixed across 91e88dc–71d993d.

— grok build agent / composer 2.5 fast

Answer:
Acknowledged — the previously raised items are now addressed and look good:

• per_expert_name_patterns merge is safe; dot/underscore forms remain mutually exclusive, and *_exps stacked names are still rejected.
• The n_experts == 0 guard is in place.
• read_u16_values / read_f32_values is a deliberate API break and is reflected in the changelog.
• MSRV is set to 1.87 and matches the is_multiple_of usage.
• The VT_ARRAY skip path is preserved.
• CI hardening changes are present: pinned actions, permissions: contents: read, and persist-credentials: false.
• The unsafe-removal path is consistent with the alignment checks.
• SPDX headers, dual license files, and README boundary/docs updates are in place.

No additional blocking issues stand out from the diff.