Contract hardening from the import-review findings (compete 1.14.0) - #3
Merged
ainetx merged 3 commits intoAug 6, 2026
Merged
Conversation
…(compete 1.14.0) - Idempotent traceability back-links in every authoring contract: append only when the ID is absent, update the existing line otherwise - Watch passes bind to their commissioning request and watched-field set; per-pass slug token keeps every pass ID unique - Explicit artifact-ID lifecycle: profile/OSS refreshes update the registered file in place; dossier records the no-profile state and the direct path creates its fact ledger before time-sensitive facts - One vendor-posture enum across the OSS-REVIEW surface; taxonomy and mechanism contracts author Section 8 explicitly; CPT-TAX-NO-001 names its sole exemption (user-accepted unmined corpus in Evidence Scope) - Undocumented mechanisms stay out of the Mechanism Map (limitation or hypothesis seed until evidence supports a row) - capture validates destinations before any fetch: http(s) only, public addresses only, redirects revalidated, rejections logged - Kind detection prefers the KIND-named ancestor directory over ID-token scanning (cpt-cmp-platform-reg-demo resolves as reg); CI covers the ambiguous-slug case - Examples: corporate/finance split; OSS drop-in boundaries; mechanism example moves local isolation to an adjacent-surface note - CI: temp-project install + generate-agents e2e job Closes constructorfabric#2 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016phJWcmabz45DpvUUiC1C3 Signed-off-by: vasylcf <vasylcf@gmail.com>
|
Warning Review limit reached
Next review available in: 55 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (20)
📝 WalkthroughWalkthroughThe compete kit advances to version 1.14.0. It adds idempotent traceability and refresh rules, tighter workflow contracts, public-destination validation, directory-based artifact-kind detection, and CI coverage for rendering and temporary-project generation. ChangesCompete kit contract hardening
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
166-175: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winTest
check_artifact_refs.pywith the ambiguous fixture.Lines 168-175 only execute
render_views.py. The separatecheck_artifact_refs.pyimplementation is not covered by the reserved-slug fixture. Add a direct assertion that its path-based lookup returns"reg".Proposed CI addition
python3 scripts/render_views.py /tmp/kind-test/CANDIDATE-REGISTER/ambiguous.md \ --format csv --out-dir /tmp/kind-test head -1 /tmp/kind-test/ambiguous.csv \ | grep -qx "candidate,relationship,why_in_scope,evidence,next_action" + python3 - <<'PY' + from pathlib import Path + from scripts.check_artifact_refs import kind_from_path + assert kind_from_path( + Path("/tmp/kind-test/CANDIDATE-REGISTER/ambiguous.md") + ) == "reg" + PY🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 166 - 175, Add a CI assertion in the ambiguous fixture block after preparing the fixture to invoke check_artifact_refs.py with that fixture and verify its path-based lookup returns "reg". Keep the existing render_views.py CSV assertion unchanged and target the check_artifact_refs.py lookup behavior directly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kits/compete/artifacts/CANDIDATE-REGISTER/rules.md`:
- Line 29: Update the refresh flows so existing IDs are resolved before
uniqueness validation: in kits/compete/artifacts/CANDIDATE-REGISTER/rules.md:29,
resolve an existing register ID and update its registered file in place,
validating uniqueness only for new IDs; apply the same dossier-ID behavior in
kits/compete/artifacts/COMPANY-DOSSIER/rules.md:36 and taxonomy-ID behavior in
kits/compete/workflows/taxonomy.md:121-126. Preserve in-place
commissioning-request link updates without appending duplicates.
In `@kits/compete/artifacts/FEATURE-TAXONOMY/rules.md`:
- Line 54: Update the CPT-TAX-NO-001 exemption and validation workflow so the
Section 2 unmined-vendor completeness note explicitly identifies each unmined
vendor and separately records verifiable design-gate approval. Validate both the
vendor-specific identification and approval before allowing the exemption;
otherwise retain CPT-TAX-NO-001 as a hard fail.
In `@kits/compete/artifacts/OSS-REVIEW/rules.md`:
- Around line 33-34: Update the backlink refresh rules so every refresh
normalizes the current artifact ID to exactly one commissioning-request link,
updates that link’s title in place, and preserves unrelated links. Apply this to
OSS-REVIEW in kits/compete/artifacts/OSS-REVIEW/rules.md:33-34, RESEARCH-REVIEW
in kits/compete/artifacts/RESEARCH-REVIEW/rules.md:51-51, WATCH-REPORT in
kits/compete/artifacts/WATCH-REPORT/rules.md:36-38, COMPARISON-MATRIX in
kits/compete/workflows/compare.md:115-118, CANDIDATE-REGISTER in
kits/compete/workflows/discover.md:117-120, COMPANY-DOSSIER in
kits/compete/workflows/dossier.md:102-105, MECHANISM-STUDY in
kits/compete/workflows/mechanism.md:109-112, and ORIENTATION-CARD in
kits/compete/workflows/orient.md:98-101; each site requires the same
duplicate-removal and in-place title-update behavior.
In `@kits/compete/artifacts/WATCH-REPORT/rules.md`:
- Around line 36-38: Update the Traceability refresh rule in the report workflow
to remove any pre-existing duplicate links for the current pass ID, then retain
exactly one link for that ID with the latest report title. Preserve the existing
behavior of replacing the default no-derived-artifacts line and avoiding
duplicate appends.
In `@kits/compete/workflows/watch.md`:
- Around line 75-81: Update the WATCH-REPORT rules in rules.md to resolve prior
reports only when they match both the commissioning request ID and the
normalized watched-field set. Ensure change-report mode is used only for an
exact match; otherwise use baseline mode, preserving the request and field-set
binding defined by the watch workflow.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 166-175: Add a CI assertion in the ambiguous fixture block after
preparing the fixture to invoke check_artifact_refs.py with that fixture and
verify its path-based lookup returns "reg". Keep the existing render_views.py
CSV assertion unchanged and target the check_artifact_refs.py lookup behavior
directly.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 22ef59f4-953b-425e-b4bc-f3a3a2e96f76
📒 Files selected for processing (34)
.cf-studio-kit.toml.github/workflows/ci.ymlkits/compete/README.mdkits/compete/artifacts/CANDIDATE-REGISTER/rules.mdkits/compete/artifacts/COMPANY-DOSSIER/rules.mdkits/compete/artifacts/COMPANY-DOSSIER/template.mdkits/compete/artifacts/COMPANY-PROFILE/examples/example.mdkits/compete/artifacts/COMPANY-PROFILE/rules.mdkits/compete/artifacts/COMPANY-PROFILE/template.mdkits/compete/artifacts/COMPARISON-MATRIX/rules.mdkits/compete/artifacts/FEATURE-TAXONOMY/rules.mdkits/compete/artifacts/MECHANISM-STUDY/examples/example.mdkits/compete/artifacts/MECHANISM-STUDY/rules.mdkits/compete/artifacts/ORIENTATION-CARD/rules.mdkits/compete/artifacts/OSS-REVIEW/examples/example.mdkits/compete/artifacts/OSS-REVIEW/rules.mdkits/compete/artifacts/RESEARCH-REVIEW/rules.mdkits/compete/artifacts/WATCH-REPORT/rules.mdkits/compete/artifacts/WATCH-REPORT/template.mdkits/compete/conf.tomlkits/compete/scripts/check_artifact_refs.pykits/compete/scripts/render_views.pykits/compete/whatsnew.tomlkits/compete/workflows/capture.mdkits/compete/workflows/compare.mdkits/compete/workflows/discover.mdkits/compete/workflows/dossier.mdkits/compete/workflows/mechanism.mdkits/compete/workflows/orient.mdkits/compete/workflows/oss-review.mdkits/compete/workflows/profile.mdkits/compete/workflows/review.mdkits/compete/workflows/taxonomy.mdkits/compete/workflows/watch.md
…ble exemption, duplicate repair, watch rules aligned - In-place refresh on an existing ID now stated for every stable-ID kind (register, dossier, orientation card, matrix, mechanism study, taxonomy) in both rules and workflows; per-pass kinds (watch) state the opposite: a colliding ID means the per-pass token is missing - CPT-TAX-NO-001 exemption is auditable: the Section 2 note must name each unmined vendor and cite the design-gate approval (turn/option); a generic note grants nothing — enforced by a new UNION-EXEMPT checklist item - Backlink refresh also repairs duplicates left by earlier runs: collapse all lines for the ID into one, leave other artifacts' lines untouched (all rules + workflows) - WATCH-REPORT rules now match the workflow: the prior report must share the commissioning request ID and confirmed watched-field set; baseline otherwise Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016phJWcmabz45DpvUUiC1C3 Signed-off-by: vasylcf <vasylcf@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kits/compete/artifacts/COMPANY-DOSSIER/rules.md`:
- Around line 35-36: Update the refresh backlink rules in
kits/compete/artifacts/COMPANY-DOSSIER/rules.md lines 35-36 so any existing
valid dossier backlink also removes the contradictory no-derived-artifacts
sentinel while preserving duplicate collapse behavior. Apply the same change to
the matrix backlink refresh logic in kits/compete/workflows/compare.md lines
116-120; other artifact links must remain untouched.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3ba8621c-2c37-4c63-ad82-9f8d945f8acd
📒 Files selected for processing (21)
kits/compete/artifacts/CANDIDATE-REGISTER/rules.mdkits/compete/artifacts/COMPANY-DOSSIER/rules.mdkits/compete/artifacts/COMPANY-PROFILE/rules.mdkits/compete/artifacts/COMPARISON-MATRIX/rules.mdkits/compete/artifacts/FEATURE-TAXONOMY/checklist.mdkits/compete/artifacts/FEATURE-TAXONOMY/rules.mdkits/compete/artifacts/MECHANISM-STUDY/rules.mdkits/compete/artifacts/ORIENTATION-CARD/rules.mdkits/compete/artifacts/OSS-REVIEW/rules.mdkits/compete/artifacts/RESEARCH-REVIEW/rules.mdkits/compete/artifacts/WATCH-REPORT/rules.mdkits/compete/workflows/compare.mdkits/compete/workflows/discover.mdkits/compete/workflows/dossier.mdkits/compete/workflows/mechanism.mdkits/compete/workflows/orient.mdkits/compete/workflows/oss-review.mdkits/compete/workflows/profile.mdkits/compete/workflows/review.mdkits/compete/workflows/taxonomy.mdkits/compete/workflows/watch.md
🚧 Files skipped from review as they are similar to previous changes (18)
- kits/compete/artifacts/ORIENTATION-CARD/rules.md
- kits/compete/workflows/review.md
- kits/compete/workflows/taxonomy.md
- kits/compete/workflows/discover.md
- kits/compete/workflows/dossier.md
- kits/compete/artifacts/RESEARCH-REVIEW/rules.md
- kits/compete/artifacts/COMPANY-PROFILE/rules.md
- kits/compete/workflows/oss-review.md
- kits/compete/artifacts/OSS-REVIEW/rules.md
- kits/compete/artifacts/CANDIDATE-REGISTER/rules.md
- kits/compete/workflows/mechanism.md
- kits/compete/workflows/profile.md
- kits/compete/artifacts/COMPARISON-MATRIX/rules.md
- kits/compete/artifacts/MECHANISM-STUDY/rules.md
- kits/compete/artifacts/FEATURE-TAXONOMY/rules.md
- kits/compete/artifacts/WATCH-REPORT/rules.md
- kits/compete/workflows/watch.md
- kits/compete/workflows/orient.md
… exists A prior run could leave both a valid back-link and the contradictory sentinel; the refresh contract now removes the sentinel in every branch, uniformly across all rules and workflows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016phJWcmabz45DpvUUiC1C3 Signed-off-by: vasylcf <vasylcf@gmail.com>
ainetx
approved these changes
Aug 6, 2026
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The deferred contract-level findings from #1's review, tracked in #2 — one
competeminor release (1.14.0, whatsnew entry included). Closes #2.Contracts (rules/templates/workflows)
openspec-baseline) so every pass mints a distinct ID.open-source | open-core | partly-open-source | closed-source | not_assessed) — the workflow description no longer abbreviates.Scripts
check_artifact_refs.py/render_views.py: kind detection prefers the KIND-named ancestor directory over ID-token scanning, so a hyphenated{system}slug containing a reserved token (cpt-cmp-platform-reg-demo) resolves correctly; ID-scan remains the fallback for loose files, and the unknown-kind negative still fails.Examples
corporate: capturedfromfinance: deferred(honest per-class statuses).CI
cfs init → kit install --kit compete → validate-kits → generate-agents, asserting the generatedcf-compete-runskill exists.Verification (local)
cfs validate-kits .all passed;cfs kit normalize --dry-run . --json --kit allPASS;cfs pdsl validate25/25 PASSCANDIDATE-REGISTER/resolves asreg; unknown-kind negative still failscf-compete-*skills generated🤖 Generated with Claude Code
https://claude.ai/code/session_016phJWcmabz45DpvUUiC1C3
Summary by CodeRabbit
New Features
Improvements
Tests