[kixelated]

Problem

The recurring VA-API audit had no checked upstream heads. One applicable upstream fix remains in the published moq-vaapi 0.1.0: its hardcoded release log level conflicts with applications selecting another level.

Approach

Audit all five cros-libva commits through 59384456 and the single cros-codecs commit through a050c6cd against the recorded Discord baselines.

moq-dev/vaapi#5, head 7b013835f2fe69e60972c7ffb7ed8602ce8a633e, ports the logging fix, adds the failing-before/passing-after feature-unification check to CI, and records every disposition in its README. The other upstream changes are already covered or optional features with no needed correctness consumer. Published repository advisories for both ChromeOS upstreams and both Discord forks, plus global Rust advisory queries for both packages, returned no entries.

This PR rewrites the quest to the remaining release and dependency-update work, preserving both full checked heads for the next recurring cycle. It deliberately keeps the quest and the parent's link.

Impact

• Public API and wire: unchanged.
• MoQ still consumes moq-vaapi 0.1.0; no version bump, crate publication, or merge.

Alternatives

Keep the existing owned-buffer API and H.264 scope. Do not add borrowed inputs, protected-content support, or VP9 API parameters without a consumer. A git dependency or guessed future crate version would not satisfy the existing crates.io build constraint.

Checks

• quest check --base origin/main: passed, 667 documents.
• VA-API: quest gate nix develop --command just ci passed, including 31 library test cases, lint/format, cargo-deny, and the new compatibility compilation check. No GPU execution claim.
• MoQ: full just ci passed through quest gate with the pinned Nix Rust 1.98.1 toolchain directly:
  env -u BASH_ENV PATH=/nix/store/0s5nn92557klizxvbwb6hxg4hfh92zf8-rust-minimal-1.98.1/bin:$PATH quest gate just ci.
• The ordinary launcher initially failed in the existing lint-gate test with mbx's Argument list too long. Prepending PATH alone still let the shell hook reinsert mbx; removing that hook for this validation run exercised the same pinned compiler and passed. No CI/test assertions or production code were changed to bypass a failure.

Review

Codex (gpt-6.1-sol, medium effort) reviewed 82fb18d269423829d3f0405b4217f0fbf08fb205 against origin/main (d8288e6934) with quest review --base origin/main --new: 0 findings.

That head merges origin/main into 575aa61b56. Main's moq-dev/moq#7568 had added a CI paragraph to this quest's Plan. It plans removing id-token: write from moq-dev/vaapi's check.yml. That conflicted with this branch's rewrite of the checked-heads prose. The resolution keeps this branch's audit record and remaining release steps, and appends main's CI paragraph unchanged. As of 2026-11-01, moq-dev/vaapi#5 is still an open draft at 7b013835, check.yml still grants id-token: write, and crates.io's newest moq-vaapi is still 0.1.0, so the remaining-work text stays accurate. quest check --base origin/main passed (621 documents). Only quest docs changed.

The land fixer's validation failed in python3 sh/dispatch-query.test.py, which needs /dev/kvm. This PR doesn't cause that; draft moq-dev/moq#7598 targets it.

Previous round: Claude Code (claude-opus-5-5, medium) reviewed 575aa61b56. Its two findings on ac68e4c116 were fixed: the recurring Goal and title were restored, and transient status moved out of the quest Plan.

Follow-ups

The retained quest owns the VA-API release and moq's later moq-vaapi version and lockfile bump. moq-dev/vaapi#5 still needs its own local review, a maintainer merge, and a crates.io publish before that quest can finish. Merging this PR doesn't wait on those steps. Main has already planned the VA-API OIDC permission removal into this same quest, so no separate follow-up is needed.

(Written by GPT-6.1 Sol; Review section by Claude Opus 5.5)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 6 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5b76e315-f3d4-4997-bfc3-a8e3e32e7ec6

Commits

Reviewing files that changed from the base of the PR and between d8288e6 and 82fb18d.

Files selected for processing: 1

• quest/m1/vendor-sync/vaapi.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[kixelated]

Automated review by review (OpenAI)

Reviewed commit 575aa61b56f2ade2e2d22c6dbf893fe0781aa840.

No actionable bugs found in this quest-only change. Keeping the recurring goal and checked upstream heads while explicitly retaining the release/dependency-bump work is the right direction; it avoids introducing a temporary git dependency or unused codec API. The two earlier local-review concerns recorded in the PR body are addressed: the recurring goal/title remain compatible with the parent, and the quota-status note is gone. Public API and wire behavior are unchanged by this PR.

Verification: read the full changed quest, parent recurrence plan, recent history, workspace dependency, and the linked upstream logging fix and port/check. Static review only; I did not run tests, repeat the full upstream/security audit, or validate VA-API hardware behavior.

(Written by OpenAI)

[pullfrog]

✅ No new issues found.

Reviewed changes

This is a doc-only checkpoint of the recurring VA-API vendor-sync child, quest/m1/vendor-sync/vaapi.md; no public API or wire impact.

• Audit recorded — the Plan now carries the 2026-10-31 check of cros-libva 59384456 (five absent commits inspected) and cros-codecs a050c6cd, with a disposition per change.
• Ported fix named — only the cros-codecs log/release_max_level_debug removal applies; it is ported in moq-dev/vaapi 6d38f3d0 with the log/release_max_level_trace unification check in just ci, and the remaining steps (merge vaapi#5, publish, bump moq-vaapi) are spelled out.
• Recurrence preserved — the recurring Goal and [XS] title are kept (the parent re-creates each child by Goal), and transient status (dates, quota, CI result) was dropped in 575aa61b56 after the prior review.

I verified the cited moq-dev/vaapi#5 (open draft, head 7b013835) and its port commit 6d38f3d0, the two ChromeOS commits, the Discord baseline SHAs, and that moq pins moq-vaapi = "0.1.0" at Cargo.toml:187 with no conflicting release_max_level_* feature anywhere in the tree. The parent's Required link text and the child title agree.

One note, not a change request: the child Goal now names a moq-vaapi bump while the parent README says "Skip dependency bumps". I read that parent line as "skip upstream dependency-bump commits", and the pre-PR Plan already bumped the pin, so the two are consistent.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[moq-bot]

codex / Codex land fixer note:

The supplied failure log reports:

1: Conflicts with the base: quest/m1/vendor-sync/vaapi.md

Merged base into pr-7463 and resolved the documentation conflict, preserving the PR vendor-sync update and the base CI follow-up paragraph, in commit 88711156b4591fd9b9d3d0591e0a66c4f01cb3ff. No protected paths were manually changed.

The landing gate passed Markdown formatting, validation of all 640 quest documents, and all check phases after installing locked PyYAML 6.0.3 in a temporary Python environment. No package builds are selected by this documentation-only diff. However, PATH=/tmp/quest-land-7463-python/bin:$PATH ALLOW_HOST_TOOLCHAIN=1 just ci base failed during python3 sh/dispatch-query.test.py with FAILED (failures=20). The unchanged tests enter flake-check paths that require /dev/kvm, absent on this host. The PR cannot be certified passing here; rerun on a KVM-capable host.

(written by codex / Codex)

[moq-bot]

codex / Codex land fixer: PATH=/tmp/quest-land-7463-python/bin:$PATH ALLOW_HOST_TOOLCHAIN=1 just ci base failed in python3 sh/dispatch-query.test.py: "FAILED (failures=20)"; unchanged dispatch tests require /dev/kvm, absent on. Recommendation: Validate the preserved conflict resolution at pr-7463 tip 88711156b4591fd9b9d3d0591e0a66c4f01cb3ff on a KVM-capable host with the locked PyYAML dependency available, then rerun the landing gate.

Conflicts with the base: quest/m1/vendor-sync/vaapi.md

(written by codex / Codex)