Address audit remediation bundle

[flyingrobots]

Summary

Addresses the audit omnibus as twelve focused remediation slices, each committed separately with RED/GREEN evidence and a self-review before moving to the next item.

Closes #84
Closes #85
Closes #86
Closes #87
Closes #88
Closes #91
Closes #92
Closes #93
Closes #94
Closes #95
Closes #99
Closes #100

What Changed

• Hardened CLI trust boundaries with optional inputRoot confinement for path, path-list, directory, and glob inputs.
• Reworked CLI JSONL record construction through typed Serialize structs while preserving byte-for-byte goldens.
• Denied unwrap/expect in edict-cli production targets and documented the parser self.expect helper as fallible parsing vocabulary.
• Added the cargo deny check supply-chain gate and deny.toml policy.
• Removed per-file dotted-extension allocation in CLI directory expansion.
• Added cargo xtask cli-goldens --check/--write and wired check mode into cargo xtask verify.
• Added cargo xtask release-prep <version> for mechanical release-prep scaffolding.
• Added the root workspace architecture map.
• Added the canonical Core encoding explainer.
• Recorded crate-scope and schema-codegen decisions in design notes.
• Split xtask out of the single-file shape into focused modules plus relocated tests.

RED/GREEN Evidence

Issue	RED	GREEN
#95	cargo test -p edict-cli input_root_rejects_path_outside_configured_root failed before root confinement existed.	Focused input-root tests, cargo test -p edict-cli, cargo xtask contract-check, cargo xtask verify.
#92	bash -lc '! rg -n "record\\[" crates/edict-cli/src/main.rs' failed while records were still mutated by JSON indexing.	Same guard, cargo test -p edict-cli, contract-check, markdown checks.
#93	Static guards for CLI unwrap/expect lint policy and parser self.expect docs failed.	Static guards, cargo clippy -p edict-cli --lib --bin edict -- -D warnings, CLI tests.
#94	test -f deny.toml failed.	cargo deny check, CI YAML parse checks, cargo xtask contract-check.
#91	rg -n 'format!\\("\\.\\{extension\\}"\\)' crates/edict-cli/src/main.rs found the per-file allocation.	Inverse guard, CLI tests, CLI goldens, clippy.
#86	cargo xtask cli-goldens --check failed as an unknown command.	cargo xtask cli-goldens --check, cargo xtask cli-goldens --write, cargo test -p xtask, cargo xtask verify.
#87	cargo test -p xtask release_prep_scaffolds_version_policy_changelog_and_test_stub failed missing release-prep scaffolding.	Release-prep focused tests, cargo test -p xtask, xtask clippy, contract-check, markdown checks, cargo xtask verify.
#99	test -f ARCHITECTURE.md failed.	Existence check, markdownlint, contract-check, cargo xtask verify.
#100	test -f docs/topics/core-ir/canonical-encoding.md failed.	Existence check, markdownlint, contract-check, cargo xtask verify.
#84	test -f docs/design/crate-scope-v0.11.md failed.	Existence check, markdownlint, contract-check, cargo xtask verify.
#88	test -f docs/design/schema-as-sot-codegen.md failed.	Existence check, markdownlint, contract-check, cargo xtask verify.
#85	test -f xtask/src/tests.rs failed before the split. Self-review RED: cargo test -p xtask release_prep_scaffolds_version_policy_changelog_and_test_stub failed because release-prep still targeted xtask/src/main.rs.	cargo test -p xtask release_prep_, cargo test -p xtask, cargo clippy -p xtask --all-targets -- -D warnings, contract-check, markdown checks, cargo xtask verify.
Self hygiene	cargo xtask verify exposed git diff --check failure from a trailing blank line in the new CLI fixture.	Removed fixture whitespace drift and reran cargo xtask verify.

Final Verification

• cargo xtask verify passed on a clean tree after the final commit.
• cargo test -p xtask passed after the xtask split.
• cargo clippy -p xtask --all-targets -- -D warnings passed after the xtask split.
• cargo xtask contract-check passed with 21 topic shelves.

Notes

• The omnibus contains one extra hygiene commit (Fix: remove CLI fixture trailing blank line) because the full gate found whitespace drift after the Document the CLI trust boundary + optional input-path root confinement #95 fixture landed.
• The Refactor xtask/src/main.rs (3,052-line single file) into modules + split tests #85 self-review found and fixed a real split regression: release-prep now writes generated boundary tests to xtask/src/tests.rs, not dispatch-only xtask/src/main.rs.

[coderabbitai]

Warning

Review limit reached

@flyingrobots, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 24 seconds

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 95173a9c-73ab-4fa4-a278-0d790ec56788

📥 Commits

Reviewing files that changed from the base of the PR and between 9a54eb4 and b909cdb.

📒 Files selected for processing (39)

• .github/workflows/ci.yml
• ARCHITECTURE.md
• CHANGELOG.md
• README.md
• crates/edict-cli/src/lib.rs
• crates/edict-cli/src/main.rs
• crates/edict-cli/tests/jsonl_cli.rs
• crates/edict-syntax/src/parser.rs
• deny.toml
• docs/audit/2026-06-28_code-quality.md
• docs/audit/2026-06-28_documentation-quality.md
• docs/audit/2026-06-28_ship-readiness.md
• docs/design/crate-scope-v0.11.md
• docs/design/schema-as-sot-codegen.md
• docs/schemas/edict.compiler-settings.v1.schema.json
• docs/topics/cli/README.md
• docs/topics/cli/test-plan.md
• docs/topics/core-ir/README.md
• docs/topics/core-ir/canonical-encoding.md
• docs/topics/documentation/test-plan.md
• docs/topics/fixtures/test-plan.md
• docs/topics/release-process/README.md
• docs/topics/release-process/policy.toml
• docs/topics/release-process/runbook.md
• docs/topics/release-process/test-plan.md
• docs/topics/target-ir/test-plan.md
• docs/topics/tests/test-plan.md
• fixtures/cli/13-input-root-outside/allowed/.gitkeep
• fixtures/cli/13-input-root-outside/exit
• fixtures/cli/13-input-root-outside/expected.stderr.jsonl
• fixtures/cli/13-input-root-outside/outside/outside.edict
• fixtures/cli/13-input-root-outside/request.jsonl
• fixtures/cli/README.md
• xtask/src/contract_check.rs
• xtask/src/goldens.rs
• xtask/src/main.rs
• xtask/src/release_prep.rs
• xtask/src/tests.rs
• xtask/src/util.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[flyingrobots]

@codex review please

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a2ec1683c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[flyingrobots]

Self-Code Review Findings

@codex please confirm this review finding before merge.

Severity	File(s)	Lines	Issue	Recommended mitigation
P3	docs/topics/cli/test-plan.md; docs/topics/fixtures/test-plan.md; docs/topics/target-ir/test-plan.md; docs/topics/documentation/test-plan.md; docs/topics/tests/test-plan.md	41; 25-26; 81; 36,48; 37,48,57	Topic shelves still cite xtask/src/main.rs as the source/fixture/evidence for behavior that this PR moved into focused modules. After #85, main.rs is dispatch/verify only; golden logic is in xtask/src/goldens.rs, contract graph/link/evidence validation is in xtask/src/contract_check.rs, and harness tests are in xtask/src/tests.rs. This is not runtime-breaking, but it violates the topic-shelf rule that these pages describe current HEAD truth and makes ownership/evidence lookup misleading.	Update topic-shelf references after the xtask split: keep xtask/src/main.rs only where dispatch/verify sequencing is the actual source, use xtask/src/goldens.rs for Core/Target IR/CLI golden check-write behavior, use xtask/src/contract_check.rs for contract-graph validation, and use xtask/src/tests.rs for harness regression evidence. Rerun npx markdownlint-cli2 README.md CHANGELOG.md ARCHITECTURE.md 'docs/**/*.md' fixtures/cli/README.md and cargo xtask contract-check.

Additional checks run during review:

• git status --porcelain was clean before review.
• git fetch origin completed.
• git diff --check origin/main...HEAD passed.
• npx markdownlint-cli2 README.md CHANGELOG.md ARCHITECTURE.md 'docs/**/*.md' fixtures/cli/README.md passed.
• cargo deny check passed locally.
• PR CI currently has stable/MSRV/supply-chain passing; CodeRabbit remains unavailable due prepaid credits exhausted.

[flyingrobots]

Resolved the P3 topic-shelf reference drift in cbb7b5e. Updated CLI, fixtures, Target IR, documentation, and tests topic shelves to cite the split xtask owners (goldens.rs, contract_check.rs, tests.rs) while keeping main.rs only for dispatch/verify sequencing. Verification: exact stale-pattern guard passed, markdownlint on touched topic shelves passed, cargo xtask contract-check passed, and full cargo xtask verify passed.

[flyingrobots]

@codex review please on latest head cbb7b5e

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cbb7b5e37d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[flyingrobots]

@codex self-audit follow-up for latest local fixes:

ID	Severity	Source	File	Lines	Issue	Mitigation
SELF-002	P5	Self	crates/edict-cli/src/main.rs	621	cargo fmt --all --check reports formatting drift after the glob non-file fix.	Run rustfmt, verify cargo fmt --all --check / cargo xtask verify, and commit the formatting-only correction.

[flyingrobots]

Activity Summary

@codex follow-up review requested for the post-thread fixes.

#	Severity	Source	File	Issue	Commit	Outcome
1	P2	PR	crates/edict-cli/src/main.rs	Explicit inputRoot: null disabled root confinement by deserializing to None.	2c0f2a9	Added regression; parser now rejects null as InvalidSettings; thread resolved.
2	P2	PR	crates/edict-cli/src/main.rs	Root-confined glob canonicalized dangling symlink/non-file matches before filtering.	00375a7	Added Unix dangling-symlink regression; non-file glob matches are skipped before canonicalization; thread resolved.
3	P2	PR	xtask/src/goldens.rs	CLI golden runner ignored Cargo target directory and used target/debug/edict.	188099c	Added metadata-path regression; runner resolves binary through cargo metadata target_directory; thread resolved.
4	P2	PR	xtask/src/release_prep.rs	Generated release boundary tests required scaffold TODO placeholders.	bcf2cc6	Added scaffold assertion; generated boundary tests now reject remaining placeholders; thread resolved.
5	P5	Self	crates/edict-cli/src/main.rs	rustfmt drift after the glob fix.	b909cdb	Ran rustfmt and rechecked formatting.

RED evidence:

• cargo test -p edict-cli input_root_null_rejects_as_invalid_settings failed before fix.
• cargo test -p edict-cli input_root_glob_skips_dangling_symlink_matches failed before fix.
• cargo test -p xtask cli_golden_binary_path_uses_cargo_metadata_target_directory failed before fix.
• cargo test -p xtask release_prep_scaffolds_version_policy_changelog_and_test_stub failed before fix.
• cargo xtask verify failed at cargo fmt --all --check before formatting commit.

GREEN evidence:

• cargo test -p edict-cli
• cargo test -p xtask
• cargo xtask cli-goldens --check
• npx markdownlint-cli2 CHANGELOG.md
• git diff --check origin/main...HEAD
• cargo xtask verify

Thread state: 4/4 PR review threads resolved via GraphQL. Local worktree clean before push; branch pushed to audit/omnibus at b909cdb.

[chatgpt-codex-connector]

Summary

• Moved root-confinement canonicalization behind the glob is_file filter so dangling symlinks and other non-file glob matches are ignored instead of aborting root-confined requests. crates/edict-cli/src/main.rsL618-L623
• Added a Unix regression test that creates a valid .edict file plus a dangling .edict symlink inside inputRoot and asserts the glob request succeeds with one checked source. crates/edict-cli/tests/jsonl_cli.rsL212-L249
• Updated the CLI topic test plan and determinism obligations to document that root-confined glob expansion skips non-file matches before canonicalization. docs/topics/cli/test-plan.mdL81-L96
• Committed the changes on the current branch with commit baa848a (Fix root-confined glob non-file matches) and created the follow-up PR via make_pr.

Testing

• ❌ cargo test -p edict-cli input_root_glob_skips_dangling_symlink_match_inside_root — RED before implementation, confirming dangling symlink glob matches failed through pre-filter canonicalization.
• ✅ cargo test -p edict-cli input_root_glob_skips_dangling_symlink_match_inside_root
• ✅ cargo fmt --all --check
• ✅ git diff --check
• ⚠️ npx markdownlint-cli2 docs/topics/cli/test-plan.md — npm registry returned HTTP 403 for markdownlint-cli2 in this environment.
• ✅ cargo xtask contract-check
• ✅ cargo xtask verify

View task →

[flyingrobots]

@codex review please on latest head b909cdb

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b909cdb386

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the existing changelog-date test attribute

When release-prep runs against the current xtask/src/tests.rs, the target function is top-level (#[test] immediately before fn alpha_changelog_dates_match_release_policy()), not indented. This fallback marker matches only the fn, so insert_before_once inserts the new boundary test between the existing #[test] and that function; the old attribute then attaches to the new stub and the alpha changelog/date guard stops running, even though the command also adds a new date case there. Match the unindented attribute-plus-function pair, or insert before the attribute, so scaffolding does not silently disable the existing guard.

Useful? React with 👍 / 👎.