Repository navigation
Conversation
From the performance and rule-portfolio agent round: - a corpus budget miss must never become a work skip; the old design made VisitTargetFiles continue past over-budget files, truncating cross-file passes at a scheduling-dependent point - the Go AST budget counted source bytes while retaining trees, so the 64 MiB cap admitted ~576 MiB of live AST - TypeScript targets' dominant memory consumer is the node child process, which no corpus budget bounds - IsSDKFacadeFile hardcodes pkg/codeguard, making two fail-level design rules false positives on every other repository - five emitted performance rule IDs are absent from the catalog, so `explain` fails for findings the tool just printed - codeguard does have an inline suppression directive (correcting an earlier note), but prefix globs parse and then silently never match Plus measurement corrections: budget exhaustion is necessary but not sufficient for nondeterminism, git archive snapshots cannot reproduce exclusion or budget behaviour, and cross-branch A/B needs a shared base. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Two confirmed instances (clone candidate selection, data-clump selection) where iterating a Go map and then breaking at a cap or returning the first match made findings depend on scheduling. Records the shape to look for and notes that a sweep found seven further candidates, all benign existence checks. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ings TestBuiltinGateCoversPatterns was documented here as enforcing the secret scanner's gate-superset invariant, but it did not exist anywhere in the tree - the only occurrence of the name was this file. It exists now, generated from regexp/syntax rather than hand-maintained, along with the equivalent for the new per-line gates. Also records that appendCommonLineFindings runs on every non-Go line despite its name, that builtinGatePasses has a latent non-ASCII false negative the newer gates avoid, that the SDK facade exemption is asymmetric by rule on purpose, and that make([]T, 0, N) allocates where make([]T, 0) does not. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation only — two files under
.claude/knowledge/, +20/−1. These were written alongside the work in #184 but landed on a branch that had already been merged into the integration branch, so they missed that PR.The correction is the reason this is worth landing rather than dropping:
TestBuiltinGateCoversPatternsdid not exist.architecture-boundaries.mdasserted it enforced the secret scanner's gate-superset invariant — that every built-in credential pattern has its required literal in the pre-check gate. Grepping every branch found the name only in that file. The invariant was documented but unenforced, which for a security scanner means a pattern added without its gate literal would silently stop detecting. #184 added the test for real, generated fromregexp/syntaxrather than hand-maintained; this corrects the note and records the two generator subtleties (the parser factors(?:ghp|gho|ghu)intogh[opu], so branches hide inside character classes; and a class representative must prefer a word character or a trailing\bis defeated).Also recorded, each verified during the audit:
VisitTargetFilescontinued past over-budget files, so cross-file passes were fed a truncated stream whose cut point was a scheduling race.git archivesnapshot cannot reproduce exclusion or budget behaviour, since it omits the gitignored build output those mechanisms exist to prune.appendCommonLineFindingsruns on every line of every non-Go file, despite the name.make([]T, 0, N)allocates wheremake([]T, 0)does not — ~1 GB per scan pass in one hot helper.🤖 Generated with Claude Code