Commit Graph
4 Commits
Author SHA1 Message Date
deepseek-v4-pro deba5f7023 docs(review 002): pre-publish coverage, convention, and cleanup review
- One hard publishing blocker: missing README.md (R-01)
- Three expect() calls in library code violate AGENTS.md §2 (R-02)
- Unnecessary #[allow(dead_code)] on generate_request_id (R-03)
- Seven files below 90% line coverage, clustered in post-Unit-2 paths:
  single-stream call mode (R-04), ChannelsAdapter::handle() (R-05),
  ChannelCore/open-op machinery (R-06), SendStream/RecvStream (R-07),
  make_sink_forwarding_handler (R-08), ChannelsSessionEnv (R-09),
  CallClient accessors (R-10)
- Minor smells: too_many_arguments annotations (R-11), stub handlers (R-12)
- Five-unit remediation plan, each independently shippable

Verification: 483 tests pass, clippy/fmt/doc clean, 91.97% line coverage
2026-08-14 09:50:20 +00:00
glm-5.2 f362c9e596 fix: Unit 8 — Pub protocol semantics (P-03, P-04, P-07)
The publish path's decided-but-unimplemented behaviors land: per-chunk
schema validation, initiator call.error terminates the stream, and an
early handler return short-circuits the feed. alktype::validation::
build_validator is now used on both dispatch paths (the dependency was
declared and unused); jsonschema was added as a direct dependency
because its Validator type is part of alktype's public API.

P-03 — OperationSpec::publish_schema was declared, had a builder,
defaulted to None, and was never read. It now round-trips through
discovery: spec_to_json emits "publish_schema" when Some,
operation_spec_schema() advertises the property, and rebuild_spec_for
parses it back (null/absent treated as None, so an imported Pub op no
longer loses the schema). Both dispatch paths (pump_sink and
run_loop_single_stream) validate each call.published chunk's input
against the schema before yielding it to the SinkHandler; on
validation failure an Err(CallError::invalid_input(...)) with the
offending chunk in `details` is injected and the feed terminates,
matching the SinkHandler contract that an Err terminates the stream.
The validator is built once at dispatch time and carried in the
SinkDispatch (and, for the single-stream path, in a new InFlightSink
struct alongside chunk_tx); a schema that fails to compile logs a
warn and falls back to no validation. When publish_schema is None,
chunks are yielded as-is (unchanged behavior).

P-04 — pump_sink matched only call.published/call.completed/call.
aborted and dropped everything else into a debug-log ignore branch; a
call.error from the initiator was silently ignored. Both dispatch
paths now match call.error, parse the CallError from the payload,
inject it as Err(call_error) into the sink's chunk_tx, and terminate
the feed — the handler sees the initiator's error, not a synthetic
"aborted" message. A malformed payload falls back to
CallError::internal("publish error from initiator (malformed)").

P-07 — pump_sink used tokio::join!(feed_fut, handler) and only wrote
the response after both completed; an early-returning handler (e.g.
rejects after chunk 1) had its response deferred until the initiator
finished publishing or the next chunk_tx.send failed. Replaced with a
tokio::select! loop over handler.fuse() and reader.read_frame(): when
the handler completes first, the response is captured and the loop
breaks immediately, the feed is short-circuited (chunk_tx dropped,
the handler's PublishStream sees EOF), and the response is written
without waiting for the feed. The feed-wins branch (natural end /
abort / error / read failure) awaits the handler after the loop as
before. This removes the unbounded stall on a path ADR-046 intends
for long-lived streams.

Tests (15 new, 480 total):
- discovery: spec_to_json emits/omits publish_schema; operation_spec_
  schema documents the property (3).
- from_call: rebuild_spec_for parses publish_schema (present/omitted/
  null) and round-trips with spec_to_json (4).
- dispatch (stream-per-request): publish_schema rejects invalid chunk
  + passes valid chunks + no-schema yields as-is (3); initiator
  call.error terminates with the initiator's error + malformed
  fallback (2); early handler return short-circuits a slow feed and
  the response is not deferred (1).
- channels/client (single-stream): publish_schema rejects invalid
  chunk over channel 0; initiator call.error terminates the publish
  over channel 0 (drives run_loop_single_stream directly with crafted
  frames since the public publish() API takes Stream<Item = Value> and
  cannot emit an initiator call.error) (2).

Verification:
- cargo test              → 480 passed, 0 failed (was 465; +15 new tests)
- cargo clippy --all-targets -- -D warnings → clean
- cargo fmt --check       → clean
- cargo doc --no-deps     → 0 warnings
2026-08-13 09:43:39 +00:00
glm-5.2 48564a8f49 docs(review 001): decompose Unit 6 into Units 6-10
The original Unit 6 was the largest unit by item count and mixed
trivial doc fixes with real protocol-semantics work (P-03/P-04/P-06/
P-07) in one commit. Decomposed into five focused units, each
independently shippable, ordered by risk and dependency:

- Unit 6 — convention + doc cleanup (C-09, C-20-rem, C-22-rem, C-24,
  P-10, P-11): mechanical; `cargo doc` clean, producer/consumer
  naming, ADR-046 §3 text amendment, EVENT_* constants in pump_sink.
- Unit 7 — small correctness fixes (C-19-misc, C-21, C-23, P-13):
  write_header returns Result not panic, honest error envelopes,
  mux pump map leak, derive_alpn_from_op_name dead branch, Box::leak
  Arc<str> refactor, REQ-CH-04 counter, opaque-wrap chunk_tx.
- Unit 8 — Pub protocol semantics (P-03, P-04, P-07): publish_schema
  per-chunk validation via alktype, initiator call.error terminates
  the stream, early handler return short-circuits the feed.
- Unit 9 — abort-cancels-Pub (P-06): drop the handler future on
  abort (not just join! to completion); needs a cancellation token
  per in-flight sink; depends on Unit 8's pump_sink changes.
- Unit 10 — stubs + substrate + doc renumber (C-10, C-11, C-14,
  C-15, C-26): honestly stub the deferred behaviors with OQs, remove
  stale doc claims, renumber alknet ADR refs to alkcall ADR-001..047.

Also records which original Unit 6 items were already absorbed by
Units 1-5 (P-09, C-20's reassembly deliberation, C-22's env tautology,
C-19's next_id/demux_sender/mux-error-mapping) so the units below
cover only what remains.

Verified 2026-08-13 against tree f25d0a6 (post-Units 1-5): every
remaining item re-checked in source; the `cargo doc` warning count
(2, down from 4 — the register_openable links were fixed in Unit 3)
and file:line references updated to the current tree.
2026-08-13 08:31:24 +00:00
glm-5.2 f1d6796436 docs: consolidated review 001 — Pub (ADR-046) + channels integration (ADR-047)
Consolidates three code-review passes (one main summary + sub-review A
on ADR-046 + sub-review B on channels ADRs 034–043/047) into a single
verified document under docs/reviews/. Every finding was re-verified
directly against the source at f305f8c with exact file:line refs.

Findings (all verified): 10 critical, 19 major, 7 minor.
- Pub end-to-end cannot work (chunks written to a different bi-stream
  than the request); publish() takes Vec<Value> not a Stream; 30s
  client timeout; abort-doesn't-cancel-Pub; dispatch re-implements
  invoke_sink inline; from_call sink forwarding swallows errors.
- Channel 0 dead in both directions; register_openable absent;
  resolve_channel_manager stub; backpressure drops chunks; buffer cap
  in messages not bytes; ledger decrement on 1/4 teardown paths; demux
  desyncs on oversized chunk; no channel-adoption/collision scheme.
- channel/control + resources/subscribe stubs; busy-wait spin; lost
  EOF sentinel; TOCTOU on max_channels; ~50 lines of abandoned
  deliberation in poll_write; cargo doc 4 warnings; spec docs
  inconsistent post-047.

Includes a 6-unit remediation plan sequenced by dependency, with
acceptance gates. Units 1/2/4 need no spec decisions; Units 3 and 5
each need one written ADR decision first (ADR-047 §4 env-resolution;
§5 channel-id adoption). The overarching acceptance gate is the
end-to-end ChannelClient ↔ ChannelsAdapter test whose absence let
both commits land green.

Two corrections to the original reviews noted in the verification log:
- C-17 (lost EOF sentinel): Sub Review B overstated "the pump does not
  write an EOF chunk" — the pump does write EOF when it receives the
  sentinel; the real bug is narrower (sentinel lost on full buffer →
  pump exits on recv→None without writing EOF).
- Warning count: main review said 5 cargo doc warnings; this pass sees
  4 (2× register_openable, 1× default_policy, 1× env module/macro).

Verification:
- cargo test → 432 passed (no source changed; docs-only commit)
- cargo clippy --all-targets -- -D warnings → clean
- cargo fmt --check → clean
- cargo doc --no-deps → 4 warnings (documented as C-09; not addressed
  here — fixing them requires the register_openable method to exist,
  which is Unit 3 of the remediation plan)
2026-08-12 13:03:36 +00:00