Skip to content

docs(reports): land cycle 17 with three claims corrected - #283

Merged
emrecdr merged 2 commits into
mainfrom
docs/hardening-cycle-17
Aug 17, 2026
Merged

docs(reports): land cycle 17 with three claims corrected#283
emrecdr merged 2 commits into
mainfrom
docs/hardening-cycle-17

Conversation

@emrecdr

@emrecdr emrecdr commented Aug 17, 2026

Copy link
Copy Markdown
Owner

Cycle 17 audits the implementation of cycle 16's own finding (#278, the breaking grammar excision) and adjudicates the corrections attached to #277 and #282. Landed after an independent validation pass.

What held

Every structural claim re-derived from source, including at the pre-change commit 6382f11^:

Claim Verified
LANG has exactly six variants Java, Javascript, Python, Rust, Tsx, Typescript
Zero residual removed identifiers across .rs/.toml/.yml zero hits
ParserTrait::new(code); metrics_with_guard keeps path
petgraph absent from lockfile 0 entries
CHANGELOG breaking-change quotation verbatim
outputSchema at 1 of 11 MCP tools

The section-1 footnote is real and independently reproducible: lowercasing DocCommentMarker genuinely contains ccomment, which is what produced the eleven phantom residual hits it describes catching.

Two counts I initially suspected turned out correct, and were checked before being challenged:

  • "21 distinct Preproc node names" — 36 raw, exactly 21 once the numbered nesting variants (PreprocElif, PreprocElif2, PreprocElif3, PreprocElif4) collapse to one node type.
  • "7 reference the module" — 6 files via crate::preproc / mod preproc, plus macros.rs via PreprocResults = 7 dependents.

What was corrected

Section 1.2 — the aho-corasick claim. The report said petgraph and aho-corasick were "both now absent from Cargo.lock". Only petgraph left. aho-corasick remains, pulled by globset, regex and regex-automata — dropping it from codelore-rca's manifest removed an unused direct dependency, not the crate from the build. Its compile cost is unchanged. Written without opening the lockfile, in the paragraph claiming credit for finding dead dependencies.

Section 3 — the C++ enumeration. iana-time-zone-haiku also ships a C++ scanner, but behind cfg(target_os = "haiku"), so it compiles on no target this project builds for. Enumeration incomplete; the finding it supports is unaffected.

Section 6 — the gh-pages figure. Described as "13 behind"; it is an orphan branch with no common ancestor with main, so "behind" measures nothing there (raw counts: 805 and 168).

On the new finding

F (LOW) holds and is a genuine second-order observation: removing the grammars merged two previously independent roadmap rows into one decision, which retroactively changed the option ranking in a row the change never touched. Dynamic linking plus a pre-built DuckDB speeds the build but defeats the static binary that motivates the musl target; only build-once-and-cache closes both.

Docs only; no code touched.

Anchor 9811bd8 (v0.28.0); baseline fbc9c93. Delta 7 commits (#277-#282)
plus the cut. Cycle 16's F1 shipped as #278, a breaking change, so this
cycle audits an implementation of the audit's own finding — and the
corrections attached to my reports land harder than the finding did.

EXCISION VALIDATED CLEAN. Five grammar crates remain; LANG has exactly
six variants matching the six dispatched parsers; a word-boundary sweep
for every removed identifier returns zero across .rs/.toml/.yml;
preproc.rs and all four language_*.rs are gone; petgraph absent from
Cargo.lock. Consumer coverage complete: CHANGELOG discloses the breaking
API change, version 0.27.4 -> 0.28.0 is the correct semver-breaking bump
for a published 0.x crate, and the musl roadmap row was rewritten rather
than left stale. Payoff realised by construction — the surviving set is
byte-identical to the set benchmarked at 25s, so the measured 33s of
unreachable compile work is gone.

The implementation went past the finding in four places, three of which
are my gaps. (1) The four could NOT be separated: ParserTrait::new took
Option<Arc<PreprocResults>>, consumed by exactly one arm (LANG::Cpp), so
preproc was the MOST invasive of the four — my "two independently
shippable steps, smallest first" sequencing was exactly backwards, and
the pre-change signature was available to me. (2) petgraph and
aho-corasick were also dead; my cycle-16 sweep covered codelore-lib and
codelore-cli and skipped codelore-rca — the one crate the finding was
about. (3) Downstream consumers I never traced: the dependabot ignore
rule, the deferred 0.6->0.8 bump, and leiden-rs's petgraph feature,
correctly left off with its comment reclassified. (4) ParserTrait::new
simplified further, dropping a path argument used only by get_fake_code.

CORRECTIONS ADJUDICATED — all verified against pre-change source. File
counts inflated by substring matching (language_cpp.rs alone has 21
Preproc* node names; my method matched 19 files, 7 reference the
module). The "~120 KB" named the wrong quantity — the C++ forcing
musl-g++ is 4,839 B of scanner.cc. P3 asserted a property of eleven MCP
tools while listing nine. The depth claim compared 57 analyses to a tool
count.

And the serious one: I quoted the crate header as "Don't refactor
upstream code... keep the divergence from upstream minimal", eliding
"to satisfy newer clippy lints" — turning a narrow instruction into a
general prohibition, which I then used to reject the feature-gating
option. The objection was also self-defeating, since the Mozjs excision
I cited as precedent edited macros.rs itself. Worst error in seventeen
cycles, because it was load-bearing for a recommendation rather than
merely wrong. Rule added: quote whole when a quotation carries a
recommendation, and check whether the objection also applies to the
option being recommended.

F (LOW, new) — the excision merged two roadmap rows into one problem.
libduckdb-sys is now the ONLY C++-compiling dependency in the lockfile,
so the "bundled-DuckDB compile dominator" (:119) and "re-add the musl
target" (:121) share a single root cause. The three options at :119 are
no longer interchangeable: sccache tuning does nothing for musl, and
`dynamic` + pre-built DuckDB gives up the static linking that is the
whole point of the musl target. Only build-once-and-cache closes both,
and only if the cached artifact is built with a musl C++ toolchain.
Recommend merging the rows and recording that option as load-bearing.

Also validated: the CI concurrency fix is correct — the SHA is appended
only on main, so each main commit gets its own group while PRs still
cancel.
Independent validation re-derived every structural claim from source,
including at the pre-change commit. The six LANG variants, the
zero-residual identifier sweep, the trait signature, the 21/7 counts in
section 2 and the verbatim CHANGELOG quotation all hold. Three claims
did not.

- Section 1.2 said petgraph and aho-corasick were "both now absent from
  Cargo.lock". Only petgraph left. aho-corasick is still in the
  lockfile, pulled by globset, regex and regex-automata; dropping it
  from codelore-rca's manifest removed an unused direct dependency, not
  the crate from the build, so its compile cost is unchanged. Written
  without opening the lockfile -- and written in the paragraph claiming
  credit for finding dead dependencies, two sections before
  adjudicating this exact defect class in earlier reports.
- Section 3 called libduckdb-sys the only C++-compiling dependency.
  iana-time-zone-haiku also ships a scanner, but it sits behind
  cfg(target_os = "haiku") and compiles on no target this project
  builds for. The enumeration was incomplete; the finding it supports
  is unaffected.
- Section 6 described gh-pages as "13 behind". It is an orphan branch
  with no common ancestor with main, so "behind" does not measure
  anything there.

The 21 and 7 counts were checked against both a literal and a natural
reading before being accepted: 21 is the distinct node types once the
numbered nesting variants collapse (36 raw), and 7 is the files
depending on the preproc module's exports (6 via crate::preproc, plus
macros.rs via PreprocResults).
@emrecdr
emrecdr merged commit dd4ed4c into main Aug 17, 2026
14 checks passed
@emrecdr
emrecdr deleted the docs/hardening-cycle-17 branch August 17, 2026 13:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants