9.8 KiB
Mixed CLI independent source review
Contract committed locally at f810fb40, SHA256 69935281eadf9fa82bd8d4f606fed2df758cfe643ef88bd5168ee327453942e1. Baseline source bab6f96a5b05b37f2b5d67a430aed0f67d783e73. This first readback covers the worker-declared frozen core production diff, still uncommitted. CLI/tests/final commit and runtime remain pending. No compiler, application or archived helper was executed by this reviewer.
Frozen core readback
| File under crates/oa-core/src | SHA256 |
|---|---|
| language.rs | 690151cdd1ba6eff73d5805586e14261bec6d4e1c340347da994f76b797f6f93 |
| language/analysis_source.rs | bc8cb3a483cf9999e78ec7085a4de26d00444c329e6f920adae05ba80f85ebc0 |
| language/analysis_source/mixed.rs | 4491675a2d455285b70e0c79670fd4fbb905a77be9fc97cce0e53001333904a3 |
| language/analysis_source/mixed/discovery.rs | 85292e095fe311ef7b1b7d14cae006294b9a83ec553990c79acb7f0056d6666e |
| source_files.rs | b82a765fe6252500e642adf469f06525b4e9a2639cc4b8a607829f86bfa5a68b |
No semantic blocker found in this core slice. The shared parse_unit extraction preserves every Parser/State initializer, unit(entry,true), state extraction/drop and subsequent complete-parser projection/reconciliation logic. It introduces a Rust call frame; semantic equivalence is not evidence of unchanged stack reservations. Existing finite worker controls and parent-owned runtime gates remain necessary.
MixedDiscovery derives one profile, enables both producers with zero carry once, and shares Budget/ModelCounts across all inspections. Its per-file metadata slot is reserved before lexing. Scanner, parser and temporary/UUID/key producer hooks remain the original ones. It drops the typed State and eventually the ordinary syntax/tokens without unit-level counter refunds; includes are moved into bounded loader locations. No edit projection, resolved model or retained syntax authority is fabricated. The counters deliberately remain conservative phase reservations. Tokens retain their token-domain bound; this does not claim universal pre-allocation metering or token metadata projection during discovery.
The first complete located failure is stored separately from Budget's span-only latch. Repeated internal calls return that same located diagnostic, and the disk loop breaks immediately on a mixed inspection failure, before another sibling read/parse. Ordinary inspection errors still aggregate as before. Final snapshot/physical-alias/journal checks remain after that loop; filesystem errors can retain their existing precedence over previously collected syntax diagnostics. No partial include list escapes a failed unit.
load_mixed_source clamps source bytes to min(caller,64 MiB) before the shared bounded read; all other caller fields survive. Its fresh snapshot has no overlays. The existing shared loop keeps attempted-path suppression, depth/file/edge checks, captured UTF-8 originals, raw expectations, root/path checks and physical-alias checks. The ordinary wrapper retains clone/overlay/reset behavior and ordinary final compilation. Only Mixed skips compile_bundle; no existing ordinary completion behavior was removed.
The new public snapshot has private fields and immutable views only. After discovery, its private Budget drops, then the captured DiskProject is consumed to move bundle/diagnostics and drop unused expectations/root/reachability. There is no reachable_bundle source clone or editable conversion. The loader itself returns discovery evidence, not semantic admission. The forthcoming CLI must check diagnostics before invoking the complete checker and use the original caller policy for that independent phase.
No new cfg bypass, unchecked public budget authority, save/index substitute, journal recovery or atomic snapshot claim appears in these files. Core tests and full CLI dispatch must still demonstrate the selected behavior; source inspection alone does not establish runtime acceptance.
Settled CLI and test readback
CLI commit f83f3bf45b172862b62b74803de57108d9958d11 and subsequent core commit 3fd87bd8be534a37acbf0ce59f854267a10847b2 contain the exact reviewed files; core production hashes above are unchanged. Parent-owned language documentation remains a separate working change, so this is not yet a clean final combined-source pin.
| Additional file | SHA256 |
|---|---|
| crates/oa-cli/src/lib.rs | cecb1868d43310752956ad68321cd1d07b0e051ade6a2b93523ed6f1a23eb2d1 |
| crates/oa-cli/src/main.rs | f2b5e5605d86007bd1250cbe1864bb7b2e6621201b1358f807dc06f624cc54f7 |
| crates/oa-cli/tests/mixed_cli.rs | 34695030fe7c74e68eff211ccf62dd73c2ba34e41ef100c83a7bf97f3c48eb3f |
| docs/source-cli.md | ed50dc4b1782d7f7d9e5732321fae237dcc1323344260ffe18490f76f69fdf28 |
| crates/oa-core/tests/mixed_source_files.rs | f932ee90c8dc30624c21c5e7ec011f4829d34cbf5b111017672c1ee1ac637b49 |
| crates/oa-core/src/language/analysis_source/mixed/discovery/tests.rs | 5f271d751015a9625c072fa5e9c2b7b8fda379162b242f2c82e3332e3e42cbe7 |
No blocker found in the settled CLI implementation or authored tests. Closed Dispatch routes CheckMixed directly to a report-only function. It owns the actual snapshot, refuses complete checking when discovery diagnostics exist, invokes the public checker with the original CLI LIMITS, and moves/clones only owned diagnostics out of the checked borrow. No model/index/Prepared escape or mixed write branch exists. Empty report fields remain unchanged, ordered warnings are mapped without sorting, existing disk error conventions are preserved, and ordinary prepare/write branches retain their behavior. Human output explicitly reports no files changed. The documentation accurately separates the two budgets and staged read-only scope.
The five new core external tests use public filesystem/checker APIs and an independently built whole Project with scoped repeated parameter UUIDs, cross-file calls and nested Entity/Actor. They assert captured byte equality, first-error attribution with an unread queued sibling plus journal diagnostic, four missing-ID classes, cycles reaching the complete checker, exact file/depth/edge/132-byte boundaries, encoding/nonregular/case/hard-link refusals. The three internal tests inspect actual constructor/counters after dropped units: chain bytes132/tokens31/U3/T32/M3, zero temporary text, exact captured restrictions and source profile, and entry cap6 versus5 before the last unit. Repeated post-error calls retain original diagnostics and Usage. Numeric/reference tests demonstrate cumulative observations, not a measured numeric-cap refusal; that distinction is intentional in this readback.
The six CLI integration tests invoke the actual Cargo-reported executable. Their OA/SA fixtures reuse an independent public model constructor and author exact four-warning order/locations, with CRLF/Unicode, escaped include decoding, decoy comments and unrelated binary-file preservation. Other cases compare complete JSON for UUID/schema, unknown typed reference, disk/cycle/path/encoding/journal, direct disk errors and usage; valid human output is exact. The portable missing-file OS text is obtained from an independent filesystem error probe, not from CLI output. Every subprocess compares full recursive file/directory contents. These are source-reviewed expectations, not yet observed passes.
Parent runtime must establish compiler/lint correctness and the finite stack controls after the new parse-unit wrapper. No unchanged-stack or universal heap bound is inferred. Prior tests and production producer arithmetic were not edited in the reviewed commits.
Final combined candidate binding
Confirmed HEAD f2324822936374c5b9092518b986375233dc7882 and empty tracked/nonignored-untracked porcelain status. This adds only the parent's matching nine RST/eight generated HTML lines to reviewed core3fd87bd/CLIf83f3bf. The documentation accurately states explicit IDs/schema8, separate discovery and complete verification budgets, no combined numeric-work or atomic-snapshot promise, and unchanged ordinary command scope. RST SHA256 10e88aaf941b1ba0bb71c0cae2447f354ade1857fe653ee117a25b9d1dc76148; HTML SHA256 3754dddd495de341137b67e3c91b67c71c184da6b30ca2a8e80b1c72dabaaffd.
Final source disposition: no source-review blocker; all earlier production/test hashes remain bound through the unchanged committed ancestry. Expected new inventories are three core unit tests (302 total with baseline299), five core external tests and six CLI integration tests. These are pre-execution expectations. Parent owns actual compilation, runtime and acceptance, and must preserve any initial failures rather than treating this source approval as execution evidence.
Initial execution and reviewed test-only repair
Parent execution at f232482 produced five passing core external and six passing mixed CLI tests, with a Command glob-shadow warning. The newly run existing source_cli suite produced ten passes and two failures from old schema7 destination expectations. Those six original list/run receipts remain evidence; no prior execution of all12 source_cli tests was claimed by this review.
Reviewed repair f10490b13bb3332ff60c2372d554e276f6f44959, confirmed HEAD with clean porcelain. It changes only two test files and the interface note. mixed_cli.rs aliases std::process::Command as ProcessCommand at its two uses (SHA256 8d1e8de73f69a8dc16b84e1526cd103dac3c03079fc4dc5a508b823af3f66fc9); no oracle changes. source_cli.rs SHA256 20313f60d392b175655806c2c3c08cbcfa0c6542d819fd48bd93216cc17091fc: the original alarm fixture actually starts schema7; the expected complete ID-stripped saved bytes now allow exactly its first header token7→8, and preview migration7→8 is asserted. All40 identities, full model/fixed-point/write/preview checks remain. The separate schema5 rename keeps its input and other checks while expecting current target8 and the +arcadia8 diff line. No production file changed. No blocker in this correction; final reruns remain parent-owned.