Skip to content

docs: add first contributor fast paths - #692

Merged
flyingrobots merged 12 commits into
evidence/rust-ir-performance-baselinefrom
dx/first-contributor-fast-paths
Jul 5, 2026
Merged

flyingrobots merged 12 commits into
evidence/rust-ir-performance-baselinefrom
dx/first-contributor-fast-paths

Conversation

@flyingrobots

@flyingrobots flyingrobots commented Jul 4, 2026 •

Copy link
Copy Markdown
Owner

Summary

Validation

  • pnpm exec prettier --write CHANGELOG.md CONTRIBUTING.md docs/topics/README.md docs/topics/docs-orientation.md docs/topics/contributing/first-pr.md docs/truth-manifest.json
  • cargo xtask docs-check
  • pnpm run preflight
  • git diff --check
  • pre-push Rust product preflight

Closes #682

Summary by CodeRabbit

  • New Features

    • Added guidance for first-time contributors, including a clearer path to a first small PR and starter-issue expectations.
    • Added a new security-tooling guidance topic covering how security checks are evaluated and when they should be adopted.
  • Bug Fixes

    • SDL lowering now correctly handles duplicate custom directives: non-repeatable duplicates are rejected, while repeatable directives are preserved in order.
  • Documentation

    • Updated contributor, validation, CI, and reference docs to link the new topics and improve navigation.

@coderabbitai

coderabbitai Bot commented Jul 4, 2026 •

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@flyingrobots, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 33 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 981da08a-c9e1-4874-b98e-189ac7375f2f

📥 Commits

Reviewing files that changed from the base of the PR and between 9b484af and 89207d5.

📒 Files selected for processing (3)
  • CONTRIBUTING.md
  • crates/wesley-core/src/adapters/apollo.rs
  • crates/wesley-core/tests/lowering_validation.rs
📝 Walkthrough

Walkthrough

This PR adds contributor onboarding documentation (a "First PR" guide) and a security-tooling policy document, linking both from CONTRIBUTING.md, SECURITY.md, and various docs topic pages. It also updates SDL lowering in apollo.rs to enforce repeatable-vs-non-repeatable custom directive semantics, with new tests.

Changes

Repeatable Directive Lowering

Layer / File(s) Summary
Repeatable directive detection and insertion
crates/wesley-core/src/adapters/apollo.rs
Adds repeatable_directive_names_from_document, TypeBuildAccumulator, and updates insert_directive_value to return Result enforcing duplicate rejection for non-repeatable directives while accumulating repeatable ones.
Threading repeatability through lowering pipeline
crates/wesley-core/src/adapters/apollo.rs
Propagates repeatable_directives through type/extension merging, field/input-field/argument builders, and schema-operation collection via extract_directives_with_repeatability.
Duplicate directive tests and changelog
crates/wesley-core/tests/lowering_validation.rs, CHANGELOG.md
New async tests cover duplicate rejection across type/extension boundaries, repeatable directive accumulation, and rejection of duplicate undefined directives; CHANGELOG documents the fix.

Estimated code review effort: 4 (Complex) | ~55 minutes

Contributor Onboarding and Security-Tooling Docs

Layer / File(s) Summary
First PR contributor guide
docs/topics/contributing/first-pr.md, CONTRIBUTING.md, docs/topics/docs-orientation.md, docs/topics/README.md, docs/truth-manifest.json, CHANGELOG.md
Adds a new First PR guide with starter-issue selection, fast-path PR patterns, and maintainer checklists; links it from CONTRIBUTING.md, docs-orientation, topics README, and truth manifest.
Security-tooling policy doc
docs/topics/security-tooling.md, SECURITY.md, docs/topics/ci-workflows.md, docs/topics/validation.md, docs/topics/README.md, docs/truth-manifest.json
Adds a new security-tooling baseline/evaluation-matrix doc and links it from SECURITY.md, CI workflows, validation, topics README, and truth manifest.
Directive reference table reformatting
docs/reference/directives.md
Reflows directive-table formatting without changing listed directives.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

Possibly related PRs

  • flyingrobots/wesley#513: Both modify directive extraction/duplicate-detection logic and add corresponding lowering tests in the same files.

Suggested labels: feature, enhancement

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description includes a summary and validation, but it omits many required template sections such as linked issue, why, changes, risk, backout, and checklist. Add the missing template sections, especially Linked Issue, Why, Changes, Risk, Backout, Testing, and Checklist details.
Out of Scope Changes check ⚠️ Warning The security-tooling docs, changelog/security updates, and SDL directive repeatability code/tests are unrelated to #682's first-contributor fast-path scope. Move the unrelated security-tooling and directive-lowering changes into separate linked PRs or add explicit issue coverage.
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title is concise and accurately describes the main change: adding first-contributor fast paths.
Linked Issues check ✅ Passed The PR appears to satisfy #682 by adding first-PR guidance, starter issues, required-vs-optional reading, and maintainer triage/release runbooks.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dx/first-contributor-fast-paths

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1cf3d1aa4b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread docs/topics/contributing/first-pr.md Outdated
Comment thread docs/topics/contributing/first-pr.md Outdated
@github-actions

github-actions Bot commented Jul 5, 2026 •

Copy link
Copy Markdown

🔍 The Case of Pull Request #692

Schema Sets

  • ecommerce
  • reference

Schema Set ecommerce

Plain-English Readout

  • Holmes (evidence investigation): The Holmes report is unavailable because the workflow finished without a readable holmes-report.json artifact.
  • Watson (independent verification): The Watson report is unavailable because the workflow finished without a readable watson-report.json artifact.
  • Moriarty (trend forecast): The Moriarty forecast is unavailable because the workflow finished without a readable moriarty-report.json artifact.

Suggested next actions

  1. Regenerate the HOLMES artifacts and make sure holmes-report.json is uploaded before trusting this PR summary.
  2. Regenerate the WATSON artifacts and make sure watson-report.json is uploaded before trusting this PR summary.
  3. Regenerate the MORIARTY artifacts and make sure moriarty-report.json is uploaded before trusting this PR summary.
🕵️ SHA-lock HOLMES full report for ecommerce (click to expand)

Report unavailable for holmes: readable holmes-report.md artifact not found.

🩺 Dr. WATSON full report for ecommerce (click to expand)

Report unavailable for watson: readable watson-report.md artifact not found.

🔮 Professor MORIARTY full report for ecommerce (click to expand)

Report unavailable for moriarty: readable moriarty-report.md artifact not found.


Schema Set reference

Plain-English Readout

  • Holmes (evidence investigation): The Holmes report is unavailable because the workflow finished without a readable holmes-report.json artifact.
  • Watson (independent verification): The Watson report is unavailable because the workflow finished without a readable watson-report.json artifact.
  • Moriarty (trend forecast): The Moriarty forecast is unavailable because the workflow finished without a readable moriarty-report.json artifact.

Suggested next actions

  1. Regenerate the HOLMES artifacts and make sure holmes-report.json is uploaded before trusting this PR summary.
  2. Regenerate the WATSON artifacts and make sure watson-report.json is uploaded before trusting this PR summary.
  3. Regenerate the MORIARTY artifacts and make sure moriarty-report.json is uploaded before trusting this PR summary.
🕵️ SHA-lock HOLMES full report for reference (click to expand)

Report unavailable for holmes: readable holmes-report.md artifact not found.

🩺 Dr. WATSON full report for reference (click to expand)

Report unavailable for watson: readable watson-report.md artifact not found.

🔮 Professor MORIARTY full report for reference (click to expand)

Report unavailable for moriarty: readable moriarty-report.md artifact not found.


📚 Glossary (what the Holmes terms mean)
  • HOLMES: Wesley’s main evidence investigation. It decides whether the cited proof is strong enough to justify shipping this commit.
  • WATSON: An independent verification pass. It checks Holmes’s citations and score math instead of trusting them blindly.
  • MORIARTY: A readiness forecast over time. It is advisory trend analysis, not the release gate itself.
  • Schema coverage score (SCS): How much of the schema has direct supporting evidence across generated artifacts and cited proof.
  • Test confidence index (TCI): How much test evidence exists for constraints, policies, relationships, and operations.
  • Migration risk index (MRI): How risky the schema change is to roll out. Lower is better.
  • Evidence trust: Whether the report is backed by exact citations, whole-file citations, or coarse references. Weak trust means the claim may be directionally right but not specific enough to trust blindly.
  • Citation quality: A count of exact line-span citations versus whole-file or coarse references.
  • ELEMENTARY: Ready to ship based on the current evidence.
  • REQUIRES INVESTIGATION: More work or review is needed before shipping.
  • YOU SHALL NOT PASS: Do not ship this change in its current state.

Machine-readable reports are grouped by schema set in workflow artifacts.


Filed at 221B Repository Street

@flyingrobots

Copy link
Copy Markdown
Owner Author

Self-Code Review Findings

@codex please sanity-check this self-discovered issue.

Severity Source File Lines Issue Mitigation
P2 Self CONTRIBUTING.md 75-78 Contributor onramp still allows scheduled starter issues without requiring a Goalpost: ... milestone, contradicting docs/METHOD.md and docs/topics/contributing/triage.md. Restore the goalpost milestone requirement in the starter-issue paragraph and validate docs formatting/link checks.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
crates/wesley-core/src/adapters/apollo.rs (1)

602-613: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Inconsistent/duplicate error path for core-directive duplicates.

The early check at Lines 602-607 rejects a duplicate core directive with message "Duplicate directive '@{name}'". However, since repeatable is forced to false for core directives (core_name.is_none() && ... at Line 609), insert_directive_value (Lines 1149-1173) would independently reject the same duplicate with a different message: "Duplicate non-repeatable directive '@{name}'". The Lines 602-607 check is therefore dead in practice except for producing a differently-worded error for the same failure mode as custom non-repeatable directives, which is confusing for consumers matching on diagnostic messages.

♻️ Proposed fix: remove the redundant early check and let insert_directive_value handle it uniformly
-            if core_name.is_some() && map.contains_key(&canonical_name) {
-                return Err(lowering_error_value(
-                    "directive",
-                    format!("Duplicate directive '@{canonical_name}'"),
-                ));
-            }
-
             let repeatable = core_name.is_none() && repeatable_directives.contains(&canonical_name);
             insert_directive_value(map, canonical_name, val, repeatable)?;

Also applies to: 1149-1173

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/wesley-core/src/adapters/apollo.rs` around lines 602 - 613, The
core-directive duplicate check in apollo.rs is redundant and creates a second
error path with a different message than insert_directive_value. Remove the
early map.contains_key duplicate return in the directive-lowering logic and rely
on insert_directive_value to reject all non-repeatable duplicates uniformly;
this keeps core directives and custom directives consistent via the shared
repeatable handling around repeatable_directives and insert_directive_value.
🧹 Nitpick comments (1)
crates/wesley-core/src/adapters/apollo.rs (1)

401-476: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Repetitive directive-extraction boilerplate across type kinds.

merge_definition and merge_extension each repeat the same if let Some(dirs) = node.directives() { Self::extract_directives_with_repeatability(dirs, &mut acc.directives, repeatable_directives)?; } pattern for every TypeDefinitionNode/TypeExtensionNode variant (6 variants each, 12 total occurrences). Consider factoring this into a small helper taking Option<cst::Directives> to reduce duplication and ease future changes to directive handling.

Also applies to: 489-564

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/wesley-core/src/adapters/apollo.rs` around lines 401 - 476, The
directive extraction logic in merge_definition and merge_extension is duplicated
across every TypeDefinitionNode and TypeExtensionNode branch. Factor the
repeated if let Some(dirs) = node.directives() call pattern into a small helper
that accepts the optional directives and applies
extract_directives_with_repeatability, then reuse it in each variant to keep
directive handling centralized and reduce boilerplate.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@crates/wesley-core/src/adapters/apollo.rs`:
- Around line 602-613: The core-directive duplicate check in apollo.rs is
redundant and creates a second error path with a different message than
insert_directive_value. Remove the early map.contains_key duplicate return in
the directive-lowering logic and rely on insert_directive_value to reject all
non-repeatable duplicates uniformly; this keeps core directives and custom
directives consistent via the shared repeatable handling around
repeatable_directives and insert_directive_value.

---

Nitpick comments:
In `@crates/wesley-core/src/adapters/apollo.rs`:
- Around line 401-476: The directive extraction logic in merge_definition and
merge_extension is duplicated across every TypeDefinitionNode and
TypeExtensionNode branch. Factor the repeated if let Some(dirs) =
node.directives() call pattern into a small helper that accepts the optional
directives and applies extract_directives_with_repeatability, then reuse it in
each variant to keep directive handling centralized and reduce boilerplate.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b7c90e7a-3c8b-45be-8811-e5a6b1bec8bd

📥 Commits

Reviewing files that changed from the base of the PR and between ef746ad and 9b484af.

📒 Files selected for processing (13)
  • CHANGELOG.md
  • CONTRIBUTING.md
  • SECURITY.md
  • crates/wesley-core/src/adapters/apollo.rs
  • crates/wesley-core/tests/lowering_validation.rs
  • docs/reference/directives.md
  • docs/topics/README.md
  • docs/topics/ci-workflows.md
  • docs/topics/contributing/first-pr.md
  • docs/topics/docs-orientation.md
  • docs/topics/security-tooling.md
  • docs/topics/validation.md
  • docs/truth-manifest.json

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9b484afccd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread CONTRIBUTING.md Outdated
@flyingrobots

Copy link
Copy Markdown
Owner Author

Activity Summary

Item Severity Source File Commit Outcome
TypeScript starter lane used Rust emitter tests P2 Review thread docs/topics/contributing/first-pr.md e3168504 Split Rust and TypeScript emitter starter rows; TypeScript lane now uses cargo test -p wesley-emit-typescript.
Starter issue checklist omitted goalpost milestone P2 Review thread docs/topics/contributing/first-pr.md 9b484afc Restored Goalpost: ... milestone requirement for scheduled starter issues.
Contributor onramp omitted goalpost milestone P2 Self CONTRIBUTING.md 151696f8 Restored Goalpost: ... milestone requirement in the public onramp paragraph.
Core directive duplicates had a separate diagnostic path P2 CodeRabbit crates/wesley-core/src/adapters/apollo.rs 06232eee Removed redundant early return and routed canonical/core duplicates through shared non-repeatable directive handling.
Directive extraction boilerplate repeated across type merge branches P5 CodeRabbit crates/wesley-core/src/adapters/apollo.rs 89207d55 Added extract_optional_directives helper and reused it across definition/extension merge paths.

Validation:

  • cargo test -p wesley-core --test lowering_validation duplicate_canonical -- --nocapture failed before 06232eee and passed after it.
  • cargo test -p wesley-core --test lowering_validation -- --nocapture passed.
  • cargo clippy -p wesley-core --all-targets -- -D warnings passed.
  • cargo fmt --check passed.
  • cargo xtask docs-check passed.
  • pnpm run preflight passed.
  • Push-time Rust product preflight passed.
  • gh pr checks 692 passed, including CodeRabbit.
  • Review threads resolved: PRRT_kwDOPoavfs6OUdNz, PRRT_kwDOPoavfs6OUdN0, PRRT_kwDOPoavfs6OZHrh.

Merge gate: clean and green for admin merge.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant