Repository navigation
Wave 9: sibling-call sweep, guarddog step, Actions allow-list rule, pipeline hub fixes, perf A/B and load smoke - #2153
Merged
Merged
Conversation
…ipeline hub fixes, perf A/B and load smoke Review hub: - sibling_sweep.py and a sibling-sweep step in review_checks.sh --base: for each function whose call arguments the diff changes at some call sites, the same function's unchanged call sites in non-test code are listed as review leads (the shape of a fix that covers one route and misses its sibling). Stdlib only and read-only: git diff and git grep against commits. A name with more than 25 call sites is not swept and is named in a not-checked row; at most 5 leads per function. Replayed on one known incomplete fix it flagged the missed call site (1 true miss among 2 leads); on 30 recent fix commits it listed 28 leads, none a missed sibling. - guarddog 3.2.0 as an offline npm supply-chain step: with a base, each package that a changed package-lock.json newly adds and that is installed at the locked version is scanned. Each threat-* rule hit is a [heuristic] lead, a rule error costs only that rule, and a new entry with hasInstallScript is a lead of its own. guarddog has no offline flag, so the step points GUARDDOG_TOP_PACKAGES_CACHE_LOCATION at stub lists. Measured on 25 installed packages of a real app: 15.7 s for the whole run, 0 leads. - A bundled GitHub Actions semgrep rule, perun.gha.actor-allowlist-from-vars (WARNING, [heuristic]): an actor check fed by a repository variable. Anyone with write access can edit repository variables, so any writer could add themselves; the message says who can edit what and names the fix. Delivery and performance (refs #1559): - pipeline_hub.py names and skips a run whose jobs or attempts call fails instead of stopping all collection: on this repo's own CI, one run whose jobs endpoint answered HTTP 502 left most runs and every PR uncollected. - pipeline_hub.py duplicates match on the full command. The same script with different arguments in two steps is an advisory, never a drop, and a saving is printed only for a step that runs that one command, not as an even split of the step's median. On this repo's CI it had reported two different gates as one duplicate and priced a 0.07 s gate at about 45 s per run. - scripts/perf_compare.sh: a hyperfine A/B of a command in a detached base worktree (git hooks off) against the current tree, one verdict line. The caller's other worktrees are left alone and arguments are POSIX-quoted, so dash reads them intact. heavy_gate.py classes it as heavy. - scripts/app_pentest.sh --load: a k6 smoke run (default 5 VUs for 15 s, caps 20 VUs and 60 s, refused beyond them) behind the same target rules as the scanners. size-budget-raise: .claude/skills/deep-code-review/references/tool-hub.md 10152→14455 wave total: the guarddog row, the perf tools rows and verdict rules, and one row for the bundled Actions rule size-budget-raise: .claude/skills/deep-code-review/references/method-situational.md 44231→44396 the analyzer list names the sibling-sweep step and what its rows are size-budget-raise: .claude/skills/deep-code-review/references/app-pentest.md 6393→8135 Load smoke section: caps, statuses and what the numbers do not prove size-budget-raise: .claude/skills/deep-code-review/references/performance-latency-depth.md 13236→13456 one routed line to perf_compare.sh and app_pentest.sh --load Tests: 358/358 in the wave's own suites, run one at a time on this tip: perf_compare 55, app_pentest --load 68, guarddog 68, sibling-sweep 23, tool-hub 108, pipeline_hub 29, heavy_gate perf 6, semgrep actor rule 1. scripts/test-ci-gates.sh on this tip: 303 pass, 8 fail, 2 skipped; the 8 are the checks this sandbox blocks, the same set as on 1.625.0. The affected run was left to GitHub CI, which runs the full set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
performance-latency-depth.md gained one routed line (to perf_compare.sh and app_pentest.sh --load). The latency-split pin test holds the file's line multiset to the pre-split lines plus an explicit ADDED list, so the new line joins ADDED; nothing else changes. Tests: test_latency_split.py 6/6 on this tip. CI leg 2 stopped at this test, so the 36 registrations it never reached (35 serial, 1 background) ran here one at a time with bash -e, as CI runs them: 36/36 exit 0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wave 9: nine lane commits in one squashed commit. The commit message has the detail for each item.
What changes
review_checks.sh --baselists the unchanged call sites of a function whose arguments the diff changed elsewhere, the shape of a fix that misses its sibling route.perf_compare.sh(hyperfine) andapp_pentest.sh --load(k6).Verification
3cfce8a65: the wave's own suites pass, 358/358;test-ci-gates.shmatches the 1.625.0 baseline (303 pass, the same 8 sandbox-only failures); light gates pass.9eed619ef: the latency-split pin test, which failed CI leg 2, allowlists the routed line this wave adds (6/6); the 36 leg-2 registrations CI never reached pass here.🤖 Generated with Claude Code