feat: add environment contract v2 and release hardening - #2
Conversation
Summary by CodeRabbit
WalkthroughThis release introduces manifest schema version 2 with package-version and executable checks, bounded manifest parsing, schema-aware reports, terminal-output sanitization, updated tests, CI auditing, and 0.2.0 release documentation. ChangesManifest-driven doctor checks
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant CLI
participant ManifestLoader
participant Doctor
participant PATH
participant Report
CLI->>ManifestLoader: Load schema version 2 manifest
ManifestLoader-->>CLI: Return validated components and executables
CLI->>Doctor: Run checks
Doctor->>PATH: Look up declared executables
PATH-->>Doctor: Return executable availability
Doctor->>Report: Build schema-aware results
Report-->>CLI: Render JSON or sanitized terminal output
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deathcharge
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/PULL_REQUEST_TEMPLATE.md:
- Line 1: Update the first heading in the pull request template from the
level-two “Summary” heading to a top-level “Summary” heading, ensuring the
document’s first line satisfies markdownlint MD041.
In `@CHANGELOG.md`:
- Line 13: Consolidate the duplicate Added and Changed subsections under the
Unreleased changelog section: retain one heading for each category and move all
corresponding entries beneath it, or place older entries under their appropriate
separate release heading.
In `@pyproject.toml`:
- Line 10: Use the PEP 440 prerelease version 0.2.0rc1 consistently across
pyproject.toml:10, src/samsarix_platform/__init__.py:6, tests/test_cli.py:137,
docs/RELEASING.md:7, and both docs/PRODUCTIZATION.md:162 and :172; update each
version reference, including README-related release documentation, while
preserving the existing metadata, test, and documentation content.
In `@ROADMAP.md`:
- Line 16: Update the coverage statement in ROADMAP.md to report the measured
result as 95% branch-aware total coverage, replacing the incorrect 90% value
while preserving the rest of the validation summary.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 290f5093-744c-4e52-8db1-b779ca29fe58
📒 Files selected for processing (24)
.github/ISSUE_TEMPLATE/bug_report.yml.github/ISSUE_TEMPLATE/config.yml.github/ISSUE_TEMPLATE/feature_request.yml.github/PULL_REQUEST_TEMPLATE.md.github/workflows/ci.ymlCHANGELOG.mdQUICK_START.mdREADME.mdROADMAP.mdSECURITY.mddocs/ARCHITECTURE.mddocs/PRODUCTIZATION.mddocs/RELEASING.mdexamples/agent-project/samsarix-stack.tomlpyproject.tomlrequirements-dev.txtsamsarix-stack.tomlsrc/samsarix_platform/__init__.pysrc/samsarix_platform/cli.pysrc/samsarix_platform/doctor.pysrc/samsarix_platform/manifest.pytests/test_cli.pytests/test_doctor.pytests/test_manifest.py
| @@ -0,0 +1,21 @@ | |||
| ## Summary | |||
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use a top-level heading on the first line.
markdownlint-cli2 reports MD041 because the template starts with ## Summary. Change it to # Summary.
Proposed fix
-## Summary
+# Summary📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ## Summary | |
| # Summary |
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 1-1: First line in a file should be a top-level heading
(MD041, first-line-heading, first-line-h1)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/PULL_REQUEST_TEMPLATE.md at line 1, Update the first heading in the
pull request template from the level-two “Summary” heading to a top-level
“Summary” heading, ensuring the document’s first line satisfies markdownlint
MD041.
Source: Linters/SAST tools
| - Read-only executable availability checks that never launch declared commands. | ||
| - Manifest schema version in successful JSON reports for contract-aware automation. | ||
|
|
||
| ### Changed |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Merge duplicate Unreleased subsections.
The ### Added heading at Line 28 duplicates the heading at Line 7. The ### Changed heading at Line 13 also duplicates the heading at Line 37. Keep one Added and one Changed subsection under ## Unreleased, or move the older entries under a separate release heading.
Also applies to: 28-28
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CHANGELOG.md` at line 13, Consolidate the duplicate Added and Changed
subsections under the Unreleased changelog section: retain one heading for each
category and move all corresponding entries beneath it, or place older entries
under their appropriate separate release heading.
Source: Linters/SAST tools
| [project] | ||
| name = "samsarix-platform" | ||
| version = "0.1.0" | ||
| version = "0.2.0" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python - <<'PY'
from packaging.version import Version
assert not Version("0.2.0").is_prerelease
assert Version("0.2.0rc1").is_prerelease
PYRepository: Deathcharge/samsarix-platform
Length of output: 167
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- target files ---'
for f in pyproject.toml src/samsarix_platform/__init__.py tests/test_cli.py docs/RELEASING.md docs/PRODUCTIZATION.md; do
test -f "$f"
printf '\n--- %s ---\n' "$f"
case "$f" in
pyproject.toml) sed -n '1,24p' "$f" ;;
src/samsarix_platform/__init__.py) sed -n '1,16p' "$f" ;;
tests/test_cli.py) sed -n '125,145p' "$f" ;;
docs/RELEASING.md) sed -n '1,24p' "$f" ;;
docs/PRODUCTIZATION.md) sed -n '154,178p' "$f" ;;
esac
done
printf '\n--- all tracked 0.2.0 references ---\n'
rg -n --glob '!*.lock' '0\.2\.0|prerelease|pre-release|release candidate|candidate' .Repository: Deathcharge/samsarix-platform
Length of output: 7804
Use a PEP 440 prerelease version, or remove the prerelease claims.
The project metadata, module version, CLI test, and artifact documentation use 0.2.0, which PEP 440 classifies as a final release. The release documentation identifies this version as a prerelease candidate. Use 0.2.0rc1 consistently, including the README, or describe 0.2.0 as a final release.
📍 Affects 5 files
pyproject.toml#L10-L10(this comment)src/samsarix_platform/__init__.py#L6-L6tests/test_cli.py#L137-L137docs/RELEASING.md#L7-L7docs/PRODUCTIZATION.md#L162-L162docs/PRODUCTIZATION.md#L172-L172
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pyproject.toml` at line 10, Use the PEP 440 prerelease version 0.2.0rc1
consistently across pyproject.toml:10, src/samsarix_platform/__init__.py:6,
tests/test_cli.py:137, docs/RELEASING.md:7, and both docs/PRODUCTIZATION.md:162
and :172; update each version reference, including README-related release
documentation, while preserving the existing metadata, test, and documentation
content.
| - Keep the default branch buildable from a clean checkout and preserve exact-head CI evidence. | ||
| - Keep Samsarix LLC branding, package identity, license metadata, and compatibility aliases internally consistent. | ||
| - Preserve the pre-productization default under a rollback ref before merging; do not delete legacy history. | ||
| - Locally reproduced in this pass: unit tests, formatting, lint, types, 90% coverage, and package build pass. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- ROADMAP.md ---'
cat -n ROADMAP.md | sed -n '1,40p'
printf '%s\n' '--- coverage references ---'
rg -n -i --glob '!node_modules' --glob '!dist' --glob '!build' \
'coverage|branch coverage|90%|95%' .Repository: Deathcharge/samsarix-platform
Length of output: 5552
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- coverage configuration ---'
cat -n pyproject.toml | sed -n '55,85p'
printf '%s\n' '--- documented verification results ---'
cat -n docs/PRODUCTIZATION.md | sed -n '135,165p'
printf '%s\n' '--- release and contribution coverage requirements ---'
cat -n docs/RELEASING.md | sed -n '28,45p'
cat -n CONTRIBUTING.md | sed -n '24,55p'Repository: Deathcharge/samsarix-platform
Length of output: 6273
Report the measured coverage correctly.
Line 16 should state 95% branch-aware total coverage. 90% is the configured coverage floor, not the measured result.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ROADMAP.md` at line 16, Update the coverage statement in ROADMAP.md to report
the measured result as 95% branch-aware total coverage, replacing the incorrect
90% value while preserving the rest of the validation summary.
1 participant
Summary
Why
The repository is now a focused, usable local readiness product rather than an aspirational platform skeleton. The additional hardening closes all four low-severity findings from the complete 34-file Codex Security scan before public publication.
User impact
Users can declare compatible Python package ranges and required command-line tools in schema v2, receive stable actionable human or JSON results, and safely feed untrusted local manifests through bounded checks. Version 1 manifests remain supported unchanged.
Verification
pip-audit . --strict --progress-spinner off: no known runtime dependency vulnerabilitiessetuptools 84.0.0passedinit, strictdoctor, module entry point, andpip checkpassedPyPI publication remains intentionally separate from this repository release.