docs: GAPS_CLOSEOUT audit — #90/#97/#98 against main#136
Conversation
Three-column reconciliation of what's actually merged vs each issue's acceptance checklist. Single source of truth for what closes each pillar issue. **Findings:** - **#90 Recover** — honestly closable. Code side is done (#124 + #130); operator-side real rehearsal is an ops action, not a code gap. - **#97 Prove tier 2** — 85% done. Rehearsal + visibility + hard gate + plan_id binding all landed (#127 + #133). Missing: install/smoke check (cargo install against the rehearsal registry / consumer build). One narrow follow-up PR closes it. - **#98 Remediate** — 60% done. Receipt schema + plan-yank (from-receipt) + yank primitive + fix-forward planning all landed (#121 + #132 + #134). Missing: plan-yank's --starting-crate graph mode, plan execution for yank + fix-forward. Two narrow follow-ups. Also captures the two review concerns on #122 (Trusted Publishing) that were addressed in a follow-up commit to that PR. Recommended next merge order and follow-up PRs spelled out at bottom.
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 15 minutes and 9 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Code Review
This pull request introduces GAPS_CLOSEOUT.md, a comprehensive audit document tracking the implementation status of key features related to recovery, preflight proving, and remediation. It identifies specific gaps in the current codebase, such as the lack of an install-smoke check for rehearsals and missing plan execution wrappers for yanking and fix-forwarding. Feedback was provided to correct the markdown formatting of a GitHub Actions expression to ensure proper rendering.
|
|
||
| ### #122 review concerns (raised by 3rd-party review) | ||
|
|
||
| 1. **Mixed-registration fallback.** `${{ steps.auth.outputs.token \|\| secrets.CARGO_REGISTRY_TOKEN }}` falls back ONLY if the OIDC action outputs an empty token. If the action succeeds but only some of the 12 crates are registered as trusted publishers, `cargo publish` 401s mid-train with no graceful retry on the long-lived token. **Fix**: either (a) add a preflight that probes each crate with the minted OIDC token and fails the whole run early if any crate 401s, or (b) document explicitly that ALL 12 crates must be registered before enabling Trusted Publishing and keep the secret as the bootstrap path. |
There was a problem hiding this comment.
The logical OR operator || in the GitHub Actions expression is escaped with backslashes (\|\|), which will render literally in markdown as this text is not within a table. Additionally, wrapping the expression and technical terms like cargo publish in backticks would improve readability and maintain consistency with the rest of the document.
| 1. **Mixed-registration fallback.** `${{ steps.auth.outputs.token \|\| secrets.CARGO_REGISTRY_TOKEN }}` falls back ONLY if the OIDC action outputs an empty token. If the action succeeds but only some of the 12 crates are registered as trusted publishers, `cargo publish` 401s mid-train with no graceful retry on the long-lived token. **Fix**: either (a) add a preflight that probes each crate with the minted OIDC token and fails the whole run early if any crate 401s, or (b) document explicitly that ALL 12 crates must be registered before enabling Trusted Publishing and keep the secret as the bootstrap path. | |
| 1. **Mixed-registration fallback.** `${{ steps.auth.outputs.token || secrets.CARGO_REGISTRY_TOKEN }}` falls back ONLY if the OIDC action outputs an empty token. If the action succeeds but only some of the 12 crates are registered as trusted publishers, `cargo publish` 401s mid-train with no graceful retry on the long-lived token. **Fix**: either (a) add a preflight that probes each crate with the minted OIDC token and fails the whole run early if any crate 401s, or (b) document explicitly that ALL 12 crates must be registered before enabling Trusted Publishing and keep the secret as the bootstrap path. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Summary
Three-column audit (implemented on main / still missing / needs follow-up) reconciling what's actually merged against the acceptance checklists of the three open pillar issues. Produced before touching more code to avoid solving already-solved problems.
Findings
Recommended merge / follow-up order
Why this file lives in-repo
Next operator or contributor inheriting the tracker shouldn't have to read a thread of chat to know the gap state. `GAPS_CLOSEOUT.md` stays in the repo until #97 and #98 close; then it either gets deleted or archives to `docs/explanation/`.