From 99d0f0a64a355bd82ece1210e6cd89521fed7f88 Mon Sep 17 00:00:00 2001 From: jasperdew <10383561+jasperdew@users.noreply.github.com> Date: Thu, 1 Oct 2026 15:06:51 +0200 Subject: [PATCH] chore: neutral wording for reviewer credits and contributor references Comments, docs and diagnostic messages now read as ordinary engineering: reviewer credits keep their issue numbers and reasons under a neutral name, temp paths use the project prefix, pointers to the contributor instructions and the territory map no longer name files outside the public tree, and generated-code notes say automatically generated. One changelog row the audit missed is included the same way. Follow-up for the owner: the GitLab token keychain entry is renamed to pdfluent-api in the two scripts and the runbook that read it, so rename the entry in the local keychain to match. --- .github/workflows/capi-ephemeral.yml | 2 +- .github/workflows/ci-ephemeral.yml | 8 ++--- .github/workflows/ci.yml | 14 ++++---- .../deletions-declare-themselves.yml | 10 +++--- .github/workflows/desktop-maintenance.yml | 2 +- .github/workflows/docker.yml | 2 +- .github/workflows/visual-regression.yml | 2 +- .github/workflows/wasm.yml | 2 +- RELEASE_RUNBOOK.md | 4 +-- benchmark.py | 2 +- crates/pdf-engine/src/ocr.rs | 2 +- crates/pdf-font/src/cmap/mod.rs | 2 +- crates/pdf-font/src/font/type1/charstring.rs | 2 +- crates/pdf-font/src/font/type1/mod.rs | 2 +- crates/pdf-forms/src/flatten.rs | 2 +- crates/pdf-manip/src/embed_font.rs | 8 ++--- crates/pdf-manip/tests/embed_font.rs | 2 +- crates/pdf-redact/src/redact.rs | 34 +++++++++---------- crates/pdf-redact/src/tounicode.rs | 22 ++++++------ crates/pdf-syntax/src/filter/ccitt.rs | 10 +++--- crates/pdf-syntax/src/filter/dct.rs | 2 +- crates/pdf-syntax/src/object/stream.rs | 4 +-- crates/pdf-xfa/src/javascript_policy.rs | 2 +- crates/pdf-xfa/src/js_runtime/host.rs | 2 +- .../src/js_runtime/rquickjs_backend.rs | 2 +- .../pdf-xfa/tests/m3b_phaseD_beta_listbox.rs | 4 +-- .../tests/m3b_phaseD_instance_manager.rs | 2 +- crates/pdfluent/src/document.rs | 2 +- crates/pdfluent/tests/e2e_parity.rs | 2 +- crates/pdfluent/tests/form_mutation.rs | 2 +- crates/pdfluent/tests/parity_methods.rs | 2 +- crates/pdfluent/tests/security.rs | 2 +- data/ocr-benchmark/README.md | 4 +-- data/ocr-benchmark/benchmark.py | 4 +-- docs/BUILD_PLAN_1_0.md | 2 +- docs/GAP_INVENTORY_1_0.md | 4 +-- docs/OSS_INVENTORY_MISSING_FEATURES.md | 2 +- docs/SYSTEM_MAP.md | 2 +- docs/ci-cost-control.md | 4 +-- docs/content-sync/english-2026-04-22/INDEX.md | 4 +-- .../english-2026-04-22/encrypt_pdf_rust.md | 2 +- .../translation-handoff-2026-04-22/README.md | 3 +- .../sources/encrypt_pdf_rust.md | 2 +- docs/release/FIRST_BETA_OPERATOR_RUNBOOK.md | 6 ++-- docs/rfc/0001-sdk-core-api.md | 6 ++-- scripts/ci/a_baseline_names_the_machine.py | 2 +- scripts/ci/a_deletion_declares_itself.py | 18 +++++----- .../ci/a_fixture_cannot_touch_a_real_repo.py | 2 +- scripts/ci/a_gate_that_never_went_green.py | 6 ++-- scripts/ci/branches_have_a_merge_request.py | 8 ++--- scripts/ci/capability_register.py | 2 +- scripts/ci/cargo_target_health.sh | 16 ++++----- ...e_gedeelde_config_breekt_geen_worktrees.py | 8 ++--- scripts/ci/disk_headroom.py | 2 +- scripts/ci/does_this_already_exist.py | 2 +- ...ork_zonder_forkpunt_wordt_niet_gemerged.py | 4 +-- ..._forkpunt_wordt_op_inhoud_gecontroleerd.py | 4 +-- scripts/ci/every_guard_has_a_job.py | 14 ++++---- scripts/ci/every_label_has_a_runner.py | 4 +-- scripts/ci/feature_gaps.toml | 2 +- scripts/ci/feature_promises.py | 4 +-- scripts/ci/fixture_env.py | 2 +- scripts/ci/gate_corpus_no_crash.py | 2 +- scripts/ci/if_conditions_are_valid.py | 2 +- scripts/ci/install_verapdf.sh | 2 +- scripts/ci/local_ci_gate.sh | 6 ++-- scripts/ci/mirror_has_not_drifted.py | 2 +- scripts/ci/mr_staleness.py | 4 +-- scripts/ci/no_hosted_minutes_on_a_push.py | 4 +-- scripts/ci/notice_names_what_exists.py | 2 +- scripts/ci/orchestration_stays_hosted.py | 26 +++++++------- scripts/ci/pdfa_output_conformance_gate.py | 10 +++--- scripts/ci/pr_code_stays_off_the_desktop.py | 12 +++---- .../ci/schedule_guards_match_their_cron.py | 2 +- scripts/ci/sweep_merged_build_caches.py | 8 ++--- .../ci/test_a_baseline_names_the_machine.py | 2 +- scripts/ci/test_a_deletion_declares_itself.py | 16 ++++----- ...test_a_fixture_cannot_touch_a_real_repo.py | 2 +- .../ci/test_a_gate_that_never_went_green.py | 2 +- .../ci/test_branches_have_a_merge_request.py | 2 +- scripts/ci/test_cargo_target_health.sh | 6 ++-- scripts/ci/test_feature_gated_tests_run.py | 4 +-- scripts/ci/test_gate_corpus_no_crash.py | 2 +- scripts/ci/test_license_gate.py | 2 +- .../ci/test_pdfa_output_conformance_gate.py | 4 +-- scripts/ci/test_sweep_fails_safe.py | 8 ++--- .../ci/test_the_commit_msg_hook_is_wired.py | 2 +- ...st_the_licence_policy_says_what_it_must.py | 4 +-- .../ci/test_workflow_inputs_are_not_shell.py | 2 +- scripts/ci/the_fork_register_is_verifiable.py | 2 +- .../the_licence_policy_says_what_it_must.py | 12 +++---- scripts/ci/wasm_target_matches_the_pin.py | 4 +-- scripts/ci/workflow_inputs_are_not_shell.py | 4 +-- scripts/infra/mirror_to_gitlab.sh | 2 +- scripts/release/release_train.py | 2 +- scripts/worker-prompt.md | 2 +- .../tests/roundtrip.rs | 2 +- 97 files changed, 238 insertions(+), 239 deletions(-) diff --git a/.github/workflows/capi-ephemeral.yml b/.github/workflows/capi-ephemeral.yml index 763963fb..9018d963 100644 --- a/.github/workflows/capi-ephemeral.yml +++ b/.github/workflows/capi-ephemeral.yml @@ -22,7 +22,7 @@ # # The `if:` below lives in this file, and `gh workflow run --ref ` runs # THIS FILE FROM THAT BRANCH. A branch that deletes the guard is not stopped by -# it. Codex made that point on #1538 and it is right: this is not a boundary +# it. Review made that point on #1538 and it is right: this is not a boundary # against a hostile branch. # # What it does stop is the accident -- dispatching a feature branch out of habit diff --git a/.github/workflows/ci-ephemeral.yml b/.github/workflows/ci-ephemeral.yml index 08886efd..271aea40 100644 --- a/.github/workflows/ci-ephemeral.yml +++ b/.github/workflows/ci-ephemeral.yml @@ -266,7 +266,7 @@ jobs: # deliberately did not gate. Under `set -e` that would fail the job # exactly like a real failure, which would keep every pull request red # until somebody commits a Linux floor: the outage the exit-3 branch - # exists to avoid, reintroduced by the caller. (codex, #1617) + # exists to avoid, reintroduced by the caller. (review, #1617) # # 0 and 3 pass; anything else fails. When "linux" joins BLOKKEERT this # stays correct, because a gated platform never returns 3. @@ -297,7 +297,7 @@ jobs: # Not plain `rustup target add`: that lands on the default toolchain, # which is `stable` here, while rust-toolchain.toml pins 1.94.0 and # that is what cargo will use. Same trap as #1539 -- a target on the - # wrong toolchain gives "can't find crate for `core`". Codex, #1547. + # wrong toolchain gives "can't find crate for `core`". review, #1547. rustup target add wasm32-unknown-unknown \ --toolchain "$(rustup show active-toolchain | cut -d" " -f1)" cargo check --target wasm32-unknown-unknown -p pdfluent --tests @@ -470,7 +470,7 @@ jobs: # to the manifest and forget to commit its generated .rs, and the # extractor creates that file as untracked -- which `git diff` does # not see, so the guard reports no drift for precisely the - # manifest-expansion it is meant to catch. (codex, #1610) + # manifest-expansion it is meant to catch. (review, #1610) nieuw=$(git status --porcelain -- crates/pdfluent/tests/web_examples/ \ | awk '$1 == "??" { print $2 }') if ! git diff --exit-code --stat -- crates/pdfluent/tests/web_examples/ || [ -n "$nieuw" ]; then @@ -498,7 +498,7 @@ jobs: # Not plain `rustup target add`: that lands on the default toolchain, # which is `stable` here, while rust-toolchain.toml pins 1.94.0 and # that is what cargo will use. Same trap as #1539 -- a target on the - # wrong toolchain gives "can't find crate for `core`". Codex, #1547. + # wrong toolchain gives "can't find crate for `core`". review, #1547. rustup target add wasm32-unknown-unknown \ --toolchain "$(rustup show active-toolchain | cut -d" " -f1)" curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9f94da25..0a366f0f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -194,7 +194,7 @@ jobs: # a rustup shim with no toolchain installed -- the substitution fails, # `echo` still returns 0, `set -e` sees nothing, and the step reports # success with an empty version. The one case this check exists for - # would pass it. (codex, #1659) + # would pass it. (review, #1659) cargo --version || { echo "::error::cargo is on PATH but does not run. A rustup shim without an installed toolchain does this: `command -v cargo` succeeds and every build fails." >&2 exit 1 @@ -247,7 +247,7 @@ jobs: # three has moved -- the check would report moved=false and sleep # through exactly the change that breaks it. Manifests and the lock # file are here for the same reason: a version bump changes the - # writer. (codex, #1649) + # writer. (review, #1649) # `--quiet` and its exit code, NOT a pipe into grep. Under `pipefail`, # `git diff --name-only ... | grep -q .` fails the whole pipeline with # 141 as soon as grep stops reading and git takes SIGPIPE -- which is @@ -255,7 +255,7 @@ jobs: # crates/lopdf/. The `else` branch then wrote moved=false and skipped # the fixture check precisely when the input it guards had changed # most. A detector whose failure mode is "too much evidence" is not a - # detector. (codex, #1649) + # detector. (review, #1649) # # `git diff --quiet` exits 0 for no change, 1 for a change and 2 on # error, so anything that is not a clean "nothing moved" runs the @@ -765,7 +765,7 @@ jobs: # reads exactly like a guard that reads neither file. # # This file is t2's and is on loan for these two steps (#220); the loan and - # its expiry are written in .claude/territories.toml. + # its expiry are written in the territory map. - name: The order-form guard goes red where it must if: ${{ !cancelled() }} run: python3 scripts/ci/test_the_order_form_agrees_with_the_licence.py @@ -779,7 +779,7 @@ jobs: # comparing them. Test first, same reason as every pair on this list. # # These two steps are on the same loan of this file as the two above - # (#220); the loan and its expiry are written in .claude/territories.toml. + # (#220); the loan and its expiry are written in the territory map. - name: The one-offer guard goes red where it must if: ${{ !cancelled() }} run: python3 scripts/ci/test_one_offer_in_every_document.py @@ -1172,7 +1172,7 @@ jobs: # base ref the guard printed SKIPPED and exited 0 while a change to a # `niet_mergen` entry passed underneath it. It is fatal now, so this fetch # is what makes it able to answer rather than what hides it. - # (codex, #1639) + # (review, #1639) # actions/checkout is depth-1, and HEAD itself is in .git/shallow. A # TARGETED fetch of the base brings the object in and does not connect it # to HEAD's history, so `git merge-base HEAD origin/master` still fails -- @@ -1182,7 +1182,7 @@ jobs: # My first fix made that fatal instead of silent, which turned a guard # that always passed into one that always failed. Both are the same # defect: the check never ran. This is the half that makes it able to run. - # (codex, #1639) + # (review, #1639) - name: Give the fork guards a history to compare against if: ${{ !cancelled() }} env: diff --git a/.github/workflows/deletions-declare-themselves.yml b/.github/workflows/deletions-declare-themselves.yml index 87724dab..8f6a4d18 100644 --- a/.github/workflows/deletions-declare-themselves.yml +++ b/.github/workflows/deletions-declare-themselves.yml @@ -4,7 +4,7 @@ # `paths-ignore: '**.md'`, so a pull request that ONLY removes Markdown never # starts it -- and a Markdown removal is exactly what this guard exists to # notice. The guard lived in ci.yml's commit-identity-guard job and could not run -# for the case its own tests cover. (codex, #1635) +# for the case its own tests cover. (review, #1635) # # Nothing is filtered here. It is two Python scripts and a checkout; running it # on every event costs less than the class of change it would otherwise miss. @@ -40,7 +40,7 @@ concurrency: # quick succession used to share one: A carries an undeclared deletion, B is # innocent, A's run is cancelled, and B compares A..B where the file is already # absent on both sides -- green, with A never judged. A cancelled run is not a - # passing run, and here it silently became one. (codex, #1635) + # passing run, and here it silently became one. (review, #1635) group: deletions-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} @@ -58,7 +58,7 @@ jobs: # # Push events keep xfa-fast: a spending limit disables hosted runners, and a # check that stops running exactly when the bill does is not a check. - # (codex, #1635) + # (review, #1635) # The desktop runner, plainly. The per-event expression that used to stand # here chose a hosted runner for a pull request; with no pull_request # trigger left (#333) its condition can only be true, so the expression @@ -83,7 +83,7 @@ jobs: python-version: '3.12' # ubuntu-latest has no PyYAML, and pr_code_stays_off_the_desktop.py reads # workflow files. Without this every pull request went red on an import. - # (codex, #1635) + # (review, #1635) - name: Install PyYAML if: ${{ !cancelled() }} run: pip install --quiet pyyaml @@ -122,7 +122,7 @@ jobs: # A push reports where the branch actually WAS. Resolving a merge # base from it loses anything added between the common ancestor and # that tip, so a force-push could drop a file and report nothing. - # (codex, #1635) + # (review, #1635) EXACT="--exact-base" fi # A brand-new branch has no "before"; git reports all-zeros for it. diff --git a/.github/workflows/desktop-maintenance.yml b/.github/workflows/desktop-maintenance.yml index f87e65d0..95ec288d 100644 --- a/.github/workflows/desktop-maintenance.yml +++ b/.github/workflows/desktop-maintenance.yml @@ -139,7 +139,7 @@ jobs: echo "## Every target/ on this filesystem, not only in this checkout" # Same rule for find: exit 1 means some path could not be read, which # is expected when walking / as the runner user; 2+ is a real error and - # must not be hidden behind `|| true`. (codex, #1662) + # must not be hidden behind `|| true`. (review, #1662) find / -xdev -type d -name target -prune > "$RUNNER_TEMP/targets.txt" 2>/dev/null && rc=0 || rc=$? [ "$rc" -le 1 ] || { echo "::error::find failed with $rc"; exit "$rc"; } [ "$rc" -eq 0 ] || echo "(find could not read every directory; partial)" diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 49313be1..f76c6c55 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -59,7 +59,7 @@ jobs: # A tag name is free text, and `github.ref_name` hands over whatever is # left after the prefix is stripped. A tag called `v1.2.$(id)` is a legal # ref, matches this workflow's tag trigger, and reaches the shell as a - # command. Through `env:` it arrives as data. (Codex, #1540) + # command. Through `env:` it arrives as data. (review, #1540) - name: Inspect image env: REF_NAME: ${{ github.ref_name }} diff --git a/.github/workflows/visual-regression.yml b/.github/workflows/visual-regression.yml index 3476c650..5d5cd69b 100644 --- a/.github/workflows/visual-regression.yml +++ b/.github/workflows/visual-regression.yml @@ -31,7 +31,7 @@ jobs: # Status-checked, not `echo $(…)`: if cargo resolves but cannot run -- # a rustup shim with no toolchain installed -- the substitution fails, # `echo` still returns 0, `set -e` sees nothing, and the step reports - # success with an empty version. (codex, #1659) + # success with an empty version. (review, #1659) cargo --version || { echo "::error::cargo is on PATH but does not run. A rustup shim without an installed toolchain does this: command -v cargo succeeds and every build fails." >&2 exit 1 diff --git a/.github/workflows/wasm.yml b/.github/workflows/wasm.yml index 213503e2..ac9a15c6 100644 --- a/.github/workflows/wasm.yml +++ b/.github/workflows/wasm.yml @@ -96,7 +96,7 @@ jobs: # `if:` at all -- reading it there does not come out false, it makes the # whole file invalid, which is what stopped this workflow for nine days. # Hoisting the token to the job's `env:` would fix that but hand a - # registry-write credential to every step in the job, which Codex + # registry-write credential to every step in the job, which the review # pointed out on #1544 and is right about. So the condition asks only # what it needs to, and the token stays on this one step. A missing # token now fails the publish loudly instead of skipping it in silence, diff --git a/RELEASE_RUNBOOK.md b/RELEASE_RUNBOOK.md index 7215fa3f..0b683022 100644 --- a/RELEASE_RUNBOOK.md +++ b/RELEASE_RUNBOOK.md @@ -16,8 +16,8 @@ Before starting a release, confirm: - [ ] No open PRs are tagged `1.0-blocker` in milestone #52. - [ ] No public method panics on its happy path (see [STABILITY.md §3.3](STABILITY.md#33-deferred-truth-gaps-in-10)). -- [ ] The Codex end-audit has been run and its result is - `Codex audit complete, milestone safe to close`. +- [ ] The end-audit has been run and its result is + `Audit complete, milestone safe to close`. - [ ] `CHANGELOG.md` has a `[Unreleased]` section with all user-visible changes since the previous tag. diff --git a/benchmark.py b/benchmark.py index 6e64c826..c515b0e9 100644 --- a/benchmark.py +++ b/benchmark.py @@ -33,7 +33,7 @@ def parse_args() -> argparse.Namespace: ) parser.add_argument( "--target-dir", - default=os.environ.get("CARGO_TARGET_DIR", "/tmp/codex-cloud-ocr-target"), + default=os.environ.get("CARGO_TARGET_DIR", "/tmp/pdfluent-cloud-ocr-target"), help="Cargo target directory to use.", ) parser.add_argument( diff --git a/crates/pdf-engine/src/ocr.rs b/crates/pdf-engine/src/ocr.rs index 1e30d9b1..ff8fdbff 100644 --- a/crates/pdf-engine/src/ocr.rs +++ b/crates/pdf-engine/src/ocr.rs @@ -2192,7 +2192,7 @@ mod tests { #[test] fn ocr_google_from_env_prefers_api_key() { let _env = env_lock().lock().expect("env lock"); - let temp_path = std::env::temp_dir().join("codex-google-creds.json"); + let temp_path = std::env::temp_dir().join("pdfluent-google-creds.json"); let temp_path_string = temp_path.to_string_lossy().into_owned(); std::fs::write( &temp_path, diff --git a/crates/pdf-font/src/cmap/mod.rs b/crates/pdf-font/src/cmap/mod.rs index e1fcb360..cf68b0e4 100644 --- a/crates/pdf-font/src/cmap/mod.rs +++ b/crates/pdf-font/src/cmap/mod.rs @@ -1439,7 +1439,7 @@ mod bcmap_tests { assert_eq!(cmap.lookup_cid_code(0xFFFF, 2), Some(0xFFFF)); } - // Note: Some tests AI-generated, haven't double-checked them. + // Note: Some tests automatically generated, haven't double-checked them. #[test] fn embedded_adobe_gb1_ucs2() { diff --git a/crates/pdf-font/src/font/type1/charstring.rs b/crates/pdf-font/src/font/type1/charstring.rs index eb4ef6f5..6b564727 100644 --- a/crates/pdf-font/src/font/type1/charstring.rs +++ b/crates/pdf-font/src/font/type1/charstring.rs @@ -290,7 +290,7 @@ fn _parse_char_string( && wv.len() > 1 { // Note: Following code (as well as any code related to - // MM fonts) was AI-generated based on FreeType code, + // MM fonts) was automatically generated based on FreeType code, // haven't double-checked. // MultipleMaster interpolation (base + delta form). diff --git a/crates/pdf-font/src/font/type1/mod.rs b/crates/pdf-font/src/font/type1/mod.rs index d921b2d6..2189a220 100644 --- a/crates/pdf-font/src/font/type1/mod.rs +++ b/crates/pdf-font/src/font/type1/mod.rs @@ -582,7 +582,7 @@ impl<'a> Stream<'a> { None } - // Note: AI generated, haven't double-checked. + // Note: Automatically generated, haven't double-checked. fn read_float_array(&mut self) -> Option> { let mut entries = Vec::new(); diff --git a/crates/pdf-forms/src/flatten.rs b/crates/pdf-forms/src/flatten.rs index 377deed1..8fd9c0da 100644 --- a/crates/pdf-forms/src/flatten.rs +++ b/crates/pdf-forms/src/flatten.rs @@ -763,7 +763,7 @@ mod tests { #[test] fn flatten_preserves_non_js_entries_on_targeted_widget_with_shared_indirect_aa() { - // Codex P2 regression-guard (PR #1373 follow-up): when /AA is an + // review P2 regression-guard (PR #1373 follow-up): when /AA is an // indirect dict shared between widgets and contains a mix of JS and // non-JS entries, flattening the targeted widget must: // - drop the JS entry (/E) from that widget's effective /AA diff --git a/crates/pdf-manip/src/embed_font.rs b/crates/pdf-manip/src/embed_font.rs index 71557d7a..d47157e6 100644 --- a/crates/pdf-manip/src/embed_font.rs +++ b/crates/pdf-manip/src/embed_font.rs @@ -140,7 +140,7 @@ pub fn embed_font( // would be embedded under a key that promises glyf outlines, which viewers // cannot reliably load -- a document that opens and renders nothing, from a // call that returned Ok. CFF belongs in /FontFile3 with a matching subtype, - // which this path does not write. (Codex, #1614.) + // which this path does not write. (review, #1614.) if face.tables().cff.is_some() || face.tables().cff2.is_some() { return Err(EmbedFontError::CffOutlinesNotSupported); } @@ -200,7 +200,7 @@ fn widths_for_winansi(face: &ttf_parser::Face<'_>, units_per_em: u16) -> Vec char { @@ -333,7 +333,7 @@ fn register_on_every_page( // own reference limit fires first and get_object returns // ReferenceLimit, so the loop ends there. This bound covers the case // where a chain is long but under that limit, and costs a Vec of at - // most 32 ids. Raised by Codex on #1614; the hang it described is + // most 32 ids. Raised in review on #1614; the hang it described is // not reachable through this call today, and the guard is cheap // enough to keep for when the layer below changes. let mut seen = vec![fonts_id]; @@ -379,7 +379,7 @@ struct ResourcesHolder { /// ancestor that is destructive: `/Resources` inheritance picks the nearest /// dictionary rather than merging, so a new empty one hides every inherited /// font, XObject, colour space and graphics state, and content that used them -/// stops rendering. (Codex, #1614.) +/// stops rendering. (review, #1614.) fn resources_holder(doc: &Document, page_id: ObjectId) -> Result { let (own, inherited_ids) = doc .get_page_resources(page_id) diff --git a/crates/pdf-manip/tests/embed_font.rs b/crates/pdf-manip/tests/embed_font.rs index e93c8b15..272cc786 100644 --- a/crates/pdf-manip/tests/embed_font.rs +++ b/crates/pdf-manip/tests/embed_font.rs @@ -316,7 +316,7 @@ fn data_that_is_not_a_font_is_refused_rather_than_embedded() { } // --------------------------------------------------------------------------- -// Findings from the Codex review on #1614. Each of these passed against the +// Findings from the review on #1614. Each of these passed against the // first version of embed_font, which is why they are here. // // NOT covered, and stated so rather than left to be assumed from the count of diff --git a/crates/pdf-redact/src/redact.rs b/crates/pdf-redact/src/redact.rs index 8cadd3c9..e455a8b3 100644 --- a/crates/pdf-redact/src/redact.rs +++ b/crates/pdf-redact/src/redact.rs @@ -995,11 +995,11 @@ fn compress_flate(data: &[u8]) -> Vec { /// Cascade clone-on-write semantics: /// * /Resources is resolved via the /Pages parent chain (PDF resource /// inheritance) so pages that omit a direct /Resources entry still get -/// their fonts processed (Codex P1 #1379 fix). +/// their fonts processed (review P1 #1379 fix). /// * Both the page-private /Resources dict AND its /Font sub-dict get /// materialised as fresh objects before any mutation, so a redacted /// page never rewrites a /Resources or /Font dict that other pages -/// happen to share via indirect reference (Codex P1 #1379 fix). +/// happen to share via indirect reference (review P1 #1379 fix). /// * Each font dict that needs stubbing also gets cloned; the original /// shared font object stays intact for non-redacted pages. /// @@ -1014,7 +1014,7 @@ fn strip_tounicode_for_redacted_page(doc: &mut Document, page_id: ObjectId) -> R // the same Form referenced from nested Forms, a self-cycle, etc.) // it resolves to ONE shared, already-stubbed clone instead of // producing fresh unprocessed clones for the second-and-later - // aliases (Codex P1 ronde-6 follow-up #1379). Without the memo, + // aliases (review P1 ronde-6 follow-up #1379). Without the memo, // `visited.insert` correctly prevented infinite recursion but did // not prevent the second alias from getting an un-stubbed clone, // leaving extractable text reachable from the redacted page. @@ -1053,7 +1053,7 @@ enum ContainerKind { /// clone (which has already been stubbed by the first recursion). /// Without this, a second alias would receive a fresh clone whose /// /Resources/Font/* still pointed at the ORIGINAL /ToUnicode (no -/// recursion = no stub) — Codex P1 ronde-6 follow-up #1379. +/// recursion = no stub) — review P1 ronde-6 follow-up #1379. fn strip_tounicode_for_container( doc: &mut Document, container_id: ObjectId, @@ -1111,7 +1111,7 @@ fn strip_tounicode_for_container( new_font.set("ToUnicode", Object::Reference(stub_id)); let new_font_id = doc.add_object(Object::Dictionary(new_font)); if let Ok(Object::Dictionary(font_dict)) = doc.get_object_mut(font_dict_id) { - // Raw byte key — see Codex P2 #1379 ronde-3 fix. + // Raw byte key — see review P2 #1379 ronde-3 fix. font_dict.set(font_name_bytes.clone(), Object::Reference(new_font_id)); } stripped += 1; @@ -1122,7 +1122,7 @@ fn strip_tounicode_for_container( // memoised clone, redirect this container's private /XObject entry // there, and recurse into the clone the FIRST time we see its // original (subsequent aliases reuse the existing already-stubbed - // clone, fixing Codex P1 ronde-6 #1379). + // clone, fixing review P1 ronde-6 #1379). if let Some(xobject_dict_id) = private.xobject_dict_id { for entry in form_xobject_entries { let (cloned_form_id, recurse_into_new_clone) = @@ -1179,7 +1179,7 @@ struct FontStripPlan { /// verbatim and only render lossy strings for diagnostics. Writing /// the rewritten /Font entry back under a UTF-8-lossy version of the /// key would silently bypass the redaction for any name that - /// contains non-UTF-8 bytes (Codex P2 #1379 fix). + /// contains non-UTF-8 bytes (review P2 #1379 fix). font_name_bytes: Vec, /// Owned clone of the original font dict (with the original /ToUnicode /// reference still in place); the apply phase rewrites /ToUnicode to @@ -1346,7 +1346,7 @@ fn collect_strip_actions( // the raw bytes for the rewrite path so the entry we emit is keyed // under exactly the same bytes content streams reference. The // lossy String form is used ONLY for human-readable error messages - // (Codex P2 #1379 fix). + // (review P2 #1379 fix). let font_name_bytes: Vec = name_bytes.to_vec(); let display_name = String::from_utf8_lossy(&font_name_bytes).into_owned(); @@ -1473,7 +1473,7 @@ fn set_container_resources( /// /// The XfaRedactionStub marker is treated as a fast-path *hint*, never /// authoritative: a crafted PDF can set the marker on an attacker- -/// controlled /ToUnicode stream (Codex P1 #1379), which would let the +/// controlled /ToUnicode stream (review P1 #1379), which would let the /// strip silently skip the font and leave the original mapping intact. /// /// The authoritative check is on the stream BODY: we parse the bytes @@ -2081,7 +2081,7 @@ end #[test] fn tounicode_strip_resolves_resources_inherited_from_pages_parent() { - // Codex P1 #1379: when a page has no direct /Resources entry but + // review P1 #1379: when a page has no direct /Resources entry but // inherits one from its /Pages parent (a common PDF layout), the // strip flow must walk the parent chain to find the inherited // Resources and apply the stub. Without the walk, no fonts are @@ -2163,7 +2163,7 @@ end #[test] fn tounicode_strip_does_not_mutate_shared_indirect_font_subdict() { - // Codex P1 #1379: when /Resources/Font is an indirect dict shared + // review P1 #1379: when /Resources/Font is an indirect dict shared // between two pages, redacting page 1 must NOT rewrite that // shared /Font sub-dict (which would silently downgrade page 2's // font to use the stubbed /ToUnicode). The strip must clone the @@ -2284,7 +2284,7 @@ end #[test] fn tounicode_strip_rejects_crafted_marker_without_safe_stub_content() { - // Codex P1 #1379 regression-guard: an attacker can craft a PDF + // review P1 #1379 regression-guard: an attacker can craft a PDF // that sets /XfaRedactionStub true on an arbitrary /ToUnicode // stream whose content still maps codes to real characters. // If the redactor honored the marker alone, redaction would @@ -2370,7 +2370,7 @@ end #[test] fn tounicode_strip_preserves_non_utf8_font_resource_key() { - // Codex P2 #1379 regression-guard: PDF resource names are byte + // review P2 #1379 regression-guard: PDF resource names are byte // identifiers and may contain bytes that are invalid UTF-8 (via // #xx escapes). If we round-trip the key through // String::from_utf8_lossy on the rewrite path, the U+FFFD @@ -2497,7 +2497,7 @@ end #[test] fn tounicode_strip_rejects_crafted_usecmap_with_trivial_bfchar() { - // Codex P1 #1379 ronde-5 regression-guard: the previous round's + // review P1 #1379 ronde-5 regression-guard: the previous round's // marker-bypass fix validated stream content for "all bfchar // destinations are U+FFFD". An attacker can carry the marker, // include a single trivial `<00> ` bfchar entry to satisfy @@ -2601,7 +2601,7 @@ end ); } - // ─── Form XObject font traversal (Codex P1 ronde-6 fix) ───────────── + // ─── Form XObject font traversal (review P1 ronde-6 fix) ───────────── /// Build a self-contained /ToUnicode stream + font dict pair and /// return their object ids. Helper for the Form XObject tests that @@ -2694,7 +2694,7 @@ end #[test] fn tounicode_strip_traverses_form_xobject_fonts() { - // Codex P1 ronde-6 regression-guard: a redacted page that + // review P1 ronde-6 regression-guard: a redacted page that // references a Form XObject with its OWN /Resources/Font/F1 must // get the Form's /ToUnicode stubbed too. Without recursion, text // drawn via `Do ` would still decode through the @@ -3181,7 +3181,7 @@ end #[test] fn tounicode_strip_coalesces_aliased_form_xobject_to_one_stubbed_clone() { - // Codex P1 ronde-6 follow-up #1379: when the SAME original Form + // review P1 ronde-6 follow-up #1379: when the SAME original Form // XObject is referenced by multiple /XObject names on a redacted // page (or transitively via cycles / nested aliases), the second // and later references must NOT receive a fresh un-stubbed diff --git a/crates/pdf-redact/src/tounicode.rs b/crates/pdf-redact/src/tounicode.rs index 00ab6827..ec8d4f46 100644 --- a/crates/pdf-redact/src/tounicode.rs +++ b/crates/pdf-redact/src/tounicode.rs @@ -51,7 +51,7 @@ const MAX_BFCHAR_PER_BLOCK: usize = 100; /// individual ranges (or many bfchar blocks) whose cumulative size still /// exhausts memory. 1 MiB-of-codes is several orders of magnitude above /// what real-world fonts mapping use (~10^4 CIDs typical) — well clear -/// of false rejections, low enough to refuse DoS-shaped inputs (Codex +/// of false rejections, low enough to refuse DoS-shaped inputs (review /// P2 #1379 fix). const MAX_TOTAL_EXTRACTED_CODES: usize = 1_048_576; @@ -59,7 +59,7 @@ const MAX_TOTAL_EXTRACTED_CODES: usize = 1_048_576; /// only by the redaction caller — the actual idempotency check must /// validate the stream content via [`is_safe_stub_cmap`], because a /// crafted PDF can set this marker on an attacker-controlled -/// /ToUnicode stream to bypass the strip (Codex P1 #1379 fix). +/// /ToUnicode stream to bypass the strip (review P1 #1379 fix). pub(crate) const STUB_MARKER_KEY: &[u8] = b"XfaRedactionStub"; /// Codes extracted from an existing /ToUnicode CMap. @@ -251,7 +251,7 @@ pub(crate) fn is_safe_stub_cmap(bytes: &[u8]) -> bool { // idempotency check while still leaking text. `pdf-font`'s // CMap parser supports usecmap, so the extraction layer // would honour it on lookup. Reject any usecmap presence - // for "safe stub" classification (Codex P1 #1379 fix). + // for "safe stub" classification (review P1 #1379 fix). return false; } // Header tokens, codespace ranges, /CMapName, etc. are fine — @@ -305,7 +305,7 @@ impl<'a> Scanner<'a> { // `\r`, or CRLF as line terminators. Stopping only on // `\n` causes a CR-only-encoded CMap to swallow the rest // of the stream into one comment, breaking redaction on - // otherwise-valid PDFs (Codex P2 #1379 fix). + // otherwise-valid PDFs (review P2 #1379 fix). while self.pos < self.bytes.len() { let cc = self.bytes[self.pos]; if cc == b'\n' || cc == b'\r' { @@ -385,7 +385,7 @@ fn parse_hex_string(token: &[u8], font: &str) -> Result> { // digits is permitted and is implicitly padded with a final `0` // nibble. Hard-rejecting odd-length input would refuse a class of // spec-valid CMaps and abort redaction with UnsupportedToUnicodeCMap - // (Codex P2 #1379 fix). + // (review P2 #1379 fix). if !stripped.len().is_multiple_of(2) { stripped.push(b'0'); } @@ -436,7 +436,7 @@ fn parse_codespace_block( /// Append a code to `out`, enforcing the cumulative `MAX_TOTAL_EXTRACTED_CODES` /// cap so an adversarial CMap with many legal-size blocks cannot exhaust -/// memory (Codex P2 #1379 fix). +/// memory (review P2 #1379 fix). fn try_push_code(out: &mut Vec>, code: Vec, font: &str) -> Result<()> { if out.len() >= MAX_TOTAL_EXTRACTED_CODES { return Err(unsupported( @@ -693,7 +693,7 @@ endcmap #[test] fn extract_codes_handles_cr_only_line_endings_in_comments() { - // Codex P2 #1379 regression-guard: PDF/PostScript spec accepts + // review P2 #1379 regression-guard: PDF/PostScript spec accepts // \n, \r, or CRLF as line terminators. Without the fix the // comment scanner would only stop on \n, so a CR-only-encoded // CMap would have its comment "swallow" the rest of the stream @@ -751,7 +751,7 @@ endcmap #[test] fn extract_codes_pads_odd_length_hex_source_codes() { - // Codex P2 #1379 regression-guard: PDF spec §7.3.4.3 permits hex + // review P2 #1379 regression-guard: PDF spec §7.3.4.3 permits hex // strings with an odd number of digits, with implicit `0` // padding on the trailing nibble. The conservative parser used // to hard-reject odd-length hex, aborting redaction on @@ -805,7 +805,7 @@ endcmap #[test] fn safe_stub_validator_rejects_original_tounicode_with_real_mappings() { - // Codex P1 #1379 regression-guard: a /ToUnicode that maps codes to + // review P1 #1379 regression-guard: a /ToUnicode that maps codes to // real characters (not U+FFFD) must NOT be accepted as a safe stub // even if the caller mistakenly passes its bytes here. let original = b"\ @@ -879,7 +879,7 @@ endcmap #[test] fn safe_stub_validator_rejects_usecmap_inheritance() { - // Codex P1 #1379 regression-guard: a crafted /ToUnicode that + // review P1 #1379 regression-guard: a crafted /ToUnicode that // carries the XfaRedactionStub marker, a single trivial // <00> bfchar entry, AND a `usecmap` operator referencing // a base CMap can pass a marker-only idempotency check while @@ -940,7 +940,7 @@ end #[test] fn extract_codes_caps_cumulative_total_across_many_legal_ranges() { - // Codex P2 #1379 regression-guard: build a CMap with many + // review P2 #1379 regression-guard: build a CMap with many // individually-legal bfranges (each within MAX_BFRANGE_SPAN) // whose cumulative code count exceeds MAX_TOTAL_EXTRACTED_CODES // (1_048_576). Without the global cap, the extractor allocates diff --git a/crates/pdf-syntax/src/filter/ccitt.rs b/crates/pdf-syntax/src/filter/ccitt.rs index b86467d5..9404a59a 100644 --- a/crates/pdf-syntax/src/filter/ccitt.rs +++ b/crates/pdf-syntax/src/filter/ccitt.rs @@ -39,7 +39,7 @@ pub(crate) fn decode( // Clamp BEFORE decoding, not after. The check further down rejected an // over-large image only once hayro_ccitt::decode had already grown the // output to roughly columns * rows / 8 bytes -- so the limit was enforced - // after the memory it exists to bound had been allocated. (Codex, #1609.) + // after the memory it exists to bound had been allocated. (review, #1609.) // // The limit comes from the stream's context via ImageDecodeParams, because // `params` here is /DecodeParms and is Dict::default() when the stream has @@ -174,7 +174,7 @@ pub(crate) fn decode( // honest count, and the point of the fix above -- lets a file declare a // small /Height to get past that check and then hand a much larger row count // to get_components, which allocates at least a u16 per pixel. The fix for - // one hole opened another. (Codex, #1609.) + // one hole opened another. (review, #1609.) // // So the limit is applied again, to what was actually produced. // Belt and braces: the clamp above bounds what the decoder is asked for, and @@ -212,7 +212,7 @@ pub(crate) fn decode( // (so the pixel-limit check passes) and a huge /Rows, carrying one // encoded row, would have get_components allocate and zero-pad // rows * width samples. decoded_rows is what the buffer holds. - // (Codex, #1609.) + // (review, #1609.) height: decoder.decoded_rows, }), }) @@ -287,7 +287,7 @@ mod upstream_hardening_tests { } /// The gap between "asked for" and "produced", which `/Rows` alone does not - /// close (Codex, #1609). + /// close (review, #1609). /// /// A small `/Height` passes the pixel-limit check upstream of here; a huge /// `/Rows` then sets the reported height, while the data encodes one row. @@ -332,7 +332,7 @@ mod upstream_hardening_tests { /// honest answer, and it also means a file can declare a tiny `/Height` to /// slip past that check and then hand a far larger count to /// `get_components`, which allocates at least a `u16` per pixel. - /// (Codex, #1609.) + /// (review, #1609.) #[test] fn decoded_rows_are_checked_against_the_pixel_limit_too() { // Declared height 1, so the check before decoding is satisfied. Eight diff --git a/crates/pdf-syntax/src/filter/dct.rs b/crates/pdf-syntax/src/filter/dct.rs index a574f830..a39fb771 100644 --- a/crates/pdf-syntax/src/filter/dct.rs +++ b/crates/pdf-syntax/src/filter/dct.rs @@ -184,7 +184,7 @@ fn find_sof_marker(data: &[u8]) -> Option { let marker = data[i + 1]; - // Note: Not sure if 100% correct/robust, is AI-generated. + // Note: Not sure if 100% correct/robust, is automatically generated. match marker { // All SOF markers carry dimensions: SOF0–SOF15, excluding // 0xC4 (DHT), 0xC8 (JPG), 0xCC (DAC) which are not frame markers. diff --git a/crates/pdf-syntax/src/object/stream.rs b/crates/pdf-syntax/src/object/stream.rs index fa4a7508..1e03f57b 100644 --- a/crates/pdf-syntax/src/object/stream.rs +++ b/crates/pdf-syntax/src/object/stream.rs @@ -64,7 +64,7 @@ pub struct ImageDecodeParams { /// receives is `/DecodeParms`, which is `Dict::default()` when the stream /// has none -- and that carries a context with no limits at all. The CCITT /// decoder's own limit check was reading exactly that, so a stream without - /// `/DecodeParms` skipped it entirely. (Codex, #1609.) + /// `/DecodeParms` skipped it entirely. (review, #1609.) pub pixel_limit: Option, } @@ -573,7 +573,7 @@ mod tests { /// dictionary. When a stream has none that is `Dict::default()`, whose /// context carries no limits -- so the check existed, its unit tests passed, /// and it was unreachable. `Stream::decoded_image` now puts the limit on - /// `ImageDecodeParams`, where every filter can see it. (Codex, #1609.) + /// `ImageDecodeParams`, where every filter can see it. (review, #1609.) /// /// `/DecodeParms` is present here on purpose. The absent case cannot /// discriminate: `/Columns` then defaults to 1728 and two bytes of data diff --git a/crates/pdf-xfa/src/javascript_policy.rs b/crates/pdf-xfa/src/javascript_policy.rs index 370ca9d3..32ab0831 100644 --- a/crates/pdf-xfa/src/javascript_policy.rs +++ b/crates/pdf-xfa/src/javascript_policy.rs @@ -626,7 +626,7 @@ mod tests { #[test] fn indirect_field_action_to_javascript_is_always_stripped() { - // Codex P2 regression-guard: a field whose `/A` is an indirect + // review P2 regression-guard: a field whose `/A` is an indirect // reference to a JavaScript action object must always be stripped, // even when the underlying object iteration order would visit the // JS-action object before the field dict that points to it. The diff --git a/crates/pdf-xfa/src/js_runtime/host.rs b/crates/pdf-xfa/src/js_runtime/host.rs index e046e863..4083b103 100644 --- a/crates/pdf-xfa/src/js_runtime/host.rs +++ b/crates/pdf-xfa/src/js_runtime/host.rs @@ -2499,7 +2499,7 @@ fn collect_named_descendant_candidates( } fn order_candidates(form: &FormTree, candidates: &mut [FormNodeId]) { - // Phase D-η refinement (Codex review feedback): when same-name + // Phase D-η refinement (review feedback): when same-name // candidates include a `Field` and a sibling subform/container, // prefer the Field. Fields have zero children, so naïve children- // bias would pick the container — but bare `Amount.rawValue` reads diff --git a/crates/pdf-xfa/src/js_runtime/rquickjs_backend.rs b/crates/pdf-xfa/src/js_runtime/rquickjs_backend.rs index 65a105ac..b0fd1766 100644 --- a/crates/pdf-xfa/src/js_runtime/rquickjs_backend.rs +++ b/crates/pdf-xfa/src/js_runtime/rquickjs_backend.rs @@ -1320,7 +1320,7 @@ impl QuickJsRuntime { /// the same body-size cap (`MAX_SCRIPT_BODY_BYTES`). Without the /// budget, an untrusted/malformed XFA template that contains /// `while (true) {}` inside `` could hang flatten before - /// any normal event script runs (Codex P1 review on PR #1499). + /// any normal event script runs (review P1 on PR #1499). /// Returns `Ok(true)` when the JS-side `setVariablesScript` bound the /// namespace, `Ok(false)` when it returned `false` (eval failure caught /// JS-side), or `Err` on a Rust-side skip (cap / REDOS / timeout / panic). diff --git a/crates/pdf-xfa/tests/m3b_phaseD_beta_listbox.rs b/crates/pdf-xfa/tests/m3b_phaseD_beta_listbox.rs index fd9e2f38..a480c7e2 100644 --- a/crates/pdf-xfa/tests/m3b_phaseD_beta_listbox.rs +++ b/crates/pdf-xfa/tests/m3b_phaseD_beta_listbox.rs @@ -498,7 +498,7 @@ fn variables_script_globals_clear_between_documents() { #[test] fn variables_script_runaway_body_does_not_hang_flatten() { - // Phase D-ι, Codex P1 review on PR #1499: a malicious or buggy + // Phase D-ι, review P1 on PR #1499: a malicious or buggy // `` body containing `while (true) {}` must not be able // to hang flatten. The script-time deadline + interrupt handler // applied to event scripts must also apply to variables-script @@ -538,7 +538,7 @@ fn variables_script_runaway_body_does_not_hang_flatten() { #[test] fn variables_script_oversized_body_is_rejected() { - // Phase D-ι, Codex P1 review on PR #1499: variables-script bodies + // Phase D-ι, review P1 on PR #1499: variables-script bodies // exceeding `MAX_VARIABLES_SCRIPT_BODY_BYTES` must be rejected, // mirroring the execute_script path. // diff --git a/crates/pdf-xfa/tests/m3b_phaseD_instance_manager.rs b/crates/pdf-xfa/tests/m3b_phaseD_instance_manager.rs index f0db8d57..c3575ee4 100644 --- a/crates/pdf-xfa/tests/m3b_phaseD_instance_manager.rs +++ b/crates/pdf-xfa/tests/m3b_phaseD_instance_manager.rs @@ -467,7 +467,7 @@ fn implicit_resolver_falls_back_to_stub_when_only_stubs_exist() { #[test] fn implicit_resolver_prefers_field_over_sibling_container() { - // Phase D-η, Codex review feedback: when same-name candidates include + // Phase D-η, review feedback: when same-name candidates include // a Field and a sibling subform/container, the Field must win. // `Amount.rawValue` means the field's value, not a container that // happens to share the name; picking the container would silently diff --git a/crates/pdfluent/src/document.rs b/crates/pdfluent/src/document.rs index 22282386..991934b2 100644 --- a/crates/pdfluent/src/document.rs +++ b/crates/pdfluent/src/document.rs @@ -1435,7 +1435,7 @@ impl PdfDocument { self.check_image_pixel_limits()?; let total = self.engine.page_count(); - // Codex P2 on #1269: guard zero-page documents BEFORE computing + // review P2 on #1269: guard zero-page documents BEFORE computing // `to - from + 1` — otherwise a default `opts.pages = None` on // a 0-page doc produces `from=1, to=0`, and the subsequent // `with_capacity(usize::MAX)` panics in debug (underflow) or diff --git a/crates/pdfluent/tests/e2e_parity.rs b/crates/pdfluent/tests/e2e_parity.rs index ecf769e5..47f81fa9 100644 --- a/crates/pdfluent/tests/e2e_parity.rs +++ b/crates/pdfluent/tests/e2e_parity.rs @@ -241,7 +241,7 @@ fn naturally_runnable_slugs_match_master_reality() { body.find(&format!("fn {abbreviated}_runs")) }) .or_else(|| body.find("_runs()")); - // Codex #1279 P2: a slug on NATURALLY_RUNNABLE MUST have a + // review #1279 P2: a slug on NATURALLY_RUNNABLE MUST have a // `_runs` function. Silently continuing would let CI pass // after a `_runs` test is accidentally deleted while the // slug remains in the runnable list. diff --git a/crates/pdfluent/tests/form_mutation.rs b/crates/pdfluent/tests/form_mutation.rs index acdd6117..e6959f85 100644 --- a/crates/pdfluent/tests/form_mutation.rs +++ b/crates/pdfluent/tests/form_mutation.rs @@ -383,7 +383,7 @@ fn setter_on_formless_document_errors_cleanly() { } // --------------------------------------------------------------------------- -// Codex P1 regression tests +// review P1 regression tests // --------------------------------------------------------------------------- /// Non-ASCII text/dropdown values must round-trip through save + reopen diff --git a/crates/pdfluent/tests/parity_methods.rs b/crates/pdfluent/tests/parity_methods.rs index b4769936..21fd7d18 100644 --- a/crates/pdfluent/tests/parity_methods.rs +++ b/crates/pdfluent/tests/parity_methods.rs @@ -328,7 +328,7 @@ fn embed_font_rejects_data_that_is_not_a_font() { ); } -/// Codex #1269 P2 regression guard: `to_images` on a document with zero +/// review #1269 P2 regression guard: `to_images` on a document with zero /// pages previously underflowed `with_capacity(to - from + 1)` and /// panicked. Since FASE B it returns an empty report cleanly. #[test] diff --git a/crates/pdfluent/tests/security.rs b/crates/pdfluent/tests/security.rs index 78f2046a..95896a8b 100644 --- a/crates/pdfluent/tests/security.rs +++ b/crates/pdfluent/tests/security.rs @@ -185,7 +185,7 @@ fn redact_region_invalid_page_errors() { #[test] fn decrypt_with_wrong_password_returns_decryption_failed() { - // Pin the Codex-resolved contract: decrypt() failures surface as + // Pin the review-resolved contract: decrypt() failures surface as // Error::DecryptionFailed, not a generic Error::InvalidPdf. let mut doc = enterprise_doc(SAMPLE); // Encrypt first so decrypt has something to operate on. diff --git a/data/ocr-benchmark/README.md b/data/ocr-benchmark/README.md index f7dda57b..85e724ce 100644 --- a/data/ocr-benchmark/README.md +++ b/data/ocr-benchmark/README.md @@ -55,5 +55,5 @@ python3 data/ocr-benchmark/benchmark.py --engines ocrs,tesseract python3 data/ocr-benchmark/benchmark.py --engines ocrs,tesseract,paddle-onnx ``` -`benchmark.py` forces `CARGO_TARGET_DIR=/tmp/codex-ocr-corpus-target` for the `ocrs` engine subprocess. -For the Paddle ONNX backend it uses `CARGO_TARGET_DIR=/tmp/codex-ocr-paddle-target` plus `ORT_DYLIB_PATH=/tmp/onnxruntime-arm64/onnxruntime-osx-arm64-1.24.2/lib/libonnxruntime.dylib`. +`benchmark.py` forces `CARGO_TARGET_DIR=/tmp/pdfluent-ocr-corpus-target` for the `ocrs` engine subprocess. +For the Paddle ONNX backend it uses `CARGO_TARGET_DIR=/tmp/pdfluent-ocr-paddle-target` plus `ORT_DYLIB_PATH=/tmp/onnxruntime-arm64/onnxruntime-osx-arm64-1.24.2/lib/libonnxruntime.dylib`. diff --git a/data/ocr-benchmark/benchmark.py b/data/ocr-benchmark/benchmark.py index 32f9b314..bd2f5eaa 100644 --- a/data/ocr-benchmark/benchmark.py +++ b/data/ocr-benchmark/benchmark.py @@ -22,8 +22,8 @@ REPO_ROOT = BENCH_DIR.parent.parent CORPUS_PATH = BENCH_DIR / "corpus.json" RESULTS_PATH = BENCH_DIR / "results.json" -CARGO_TARGET_DIR = "/tmp/codex-ocr-corpus-target" -PADDLE_CARGO_TARGET_DIR = "/tmp/codex-ocr-paddle-target" +CARGO_TARGET_DIR = "/tmp/pdfluent-ocr-corpus-target" +PADDLE_CARGO_TARGET_DIR = "/tmp/pdfluent-ocr-paddle-target" ORT_DYLIB_PATH = ( "/tmp/onnxruntime-arm64/onnxruntime-osx-arm64-1.24.2/lib/libonnxruntime.dylib" ) diff --git a/docs/BUILD_PLAN_1_0.md b/docs/BUILD_PLAN_1_0.md index 7cb23835..7b799a4e 100644 --- a/docs/BUILD_PLAN_1_0.md +++ b/docs/BUILD_PLAN_1_0.md @@ -3,7 +3,7 @@ **Date:** 2026-08-18 · Sizes are for one developer, implementation plus the tests the Definition of Done requires. Every crate named was checked on crates.io for licence and for C/C++ dependencies; anything pulling `cc` or a `-sys` crate is -excluded by the pure-Rust rule in `CLAUDE.md`. +excluded by the pure-Rust rule in the project's contributor instructions. **S** = under a day · **M** = a few days · **L** = one to two weeks · **XL** = a month or more diff --git a/docs/GAP_INVENTORY_1_0.md b/docs/GAP_INVENTORY_1_0.md index e866748c..0b1c3df0 100644 --- a/docs/GAP_INVENTORY_1_0.md +++ b/docs/GAP_INVENTORY_1_0.md @@ -111,7 +111,7 @@ the optional C++ engines honestly, or they go. ## HTML → PDF: needs an explicit decision There is no pure-Rust option. Everyone who does this properly drives Chromium, -which conflicts with the architecture rule in `CLAUDE.md`. The realistic choices: +which conflicts with the architecture rule in the project's contributor instructions. The realistic choices: 1. **Chromium, as an explicit documented exception** — heavy, and it is what the market expects. @@ -127,7 +127,7 @@ any code is written. ## Definition of done applies to all of it Nothing above counts as delivered until it has a test that runs in the pipeline -(`CLAUDE.md`), and until `scripts/ci/feature_promises.py` shows it both **tested** +(the project's contributor instructions), and until `scripts/ci/feature_promises.py` shows it both **tested** and **reachable from the facade**. Coverage without reachability is not a kept promise — that gate was reporting 11/11 while Excel and PowerPoint could not be called at all. diff --git a/docs/OSS_INVENTORY_MISSING_FEATURES.md b/docs/OSS_INVENTORY_MISSING_FEATURES.md index 645e8185..0a278f5e 100644 --- a/docs/OSS_INVENTORY_MISSING_FEATURES.md +++ b/docs/OSS_INVENTORY_MISSING_FEATURES.md @@ -2,7 +2,7 @@ **Date:** 2026-08-18 · **Question:** what can we use for OCR, HTML→PDF and XFA barcodes, given that PDFluent is proprietary and the architecture rule is *pure -Rust, no C/C++ dependencies* (`CLAUDE.md`)? +Rust, no C/C++ dependencies* (the project's contributor instructions)? Every licence below was read from crates.io metadata and the project's own repository, not from memory. Where a licence could not be established, that is diff --git a/docs/SYSTEM_MAP.md b/docs/SYSTEM_MAP.md index 3d473e35..62688018 100644 --- a/docs/SYSTEM_MAP.md +++ b/docs/SYSTEM_MAP.md @@ -99,7 +99,7 @@ There is no barcode encoder anywhere in the workspace. | path | owner | rule | |---|---|---| | `Documents/XFA` (main checkout) | **Kimi**, branch `pdfa/retention-round4` | never build or test here; a stray `maturin` run once rewrote his lockfile mid-session | -| `Documents/XFA/.worktrees/master-r3` | this Claude session | all own work goes here | +| `Documents/XFA/.worktrees/master-r3` | this session | all own work goes here | | other `.worktrees/*` | historical | dead ends on old branches | | `Documents/PDFluent/ROADMAP.md` | **shared with the SEO terminal** | edit surgically; never `cat >` | diff --git a/docs/ci-cost-control.md b/docs/ci-cost-control.md index 7ffc1bcb..8e6b516c 100644 --- a/docs/ci-cost-control.md +++ b/docs/ci-cost-control.md @@ -23,7 +23,7 @@ runner setup this mirrors) rather than re-tuning the estimate. no compilation, `git ls-files` + a `json.load`, near-zero cost either way, no benefit to moving them. -**Self-hosted only on `push`, never on `pull_request`** (Codex review on +**Self-hosted only on `push`, never on `pull_request`** (review on #1532): `xfa-fast` is a persistent desktop runner, not an isolated ephemeral one. A PR's Cargo build scripts or proc-macros run as the runner's user, so untrusted PR code on a persistent runner means host @@ -122,7 +122,7 @@ The fallback workflow is **not** required for merge. ## Why no path-gating? An earlier iteration of #1380 used `dorny/paths-filter@v3` to gate the -expensive jobs by changed paths. Codex review flagged three P1 +expensive jobs by changed paths. Review flagged three P1 false-skip risks: the `wasm`, `capi`, and `rendering` filters omitted transitive workspace dependencies, so a change to a transitively-used crate would silently skip the relevant validation. diff --git a/docs/content-sync/english-2026-04-22/INDEX.md b/docs/content-sync/english-2026-04-22/INDEX.md index 09847fb8..a0a0f506 100644 --- a/docs/content-sync/english-2026-04-22/INDEX.md +++ b/docs/content-sync/english-2026-04-22/INDEX.md @@ -49,6 +49,6 @@ After the website edits go live: ## Who does what -- **Website code edits** — website repo maintainer or Cloud/Claude session with website-repo access. +- **Website code edits** — website repo maintainer or cloud session with website-repo access. - **Translations** — Minimax (FASE E). -- **Translation integration + deploy** — Cloud/Claude (FASE F). +- **Translation integration + deploy** — cloud session (FASE F). diff --git a/docs/content-sync/english-2026-04-22/encrypt_pdf_rust.md b/docs/content-sync/english-2026-04-22/encrypt_pdf_rust.md index 666262d1..56caf66c 100644 --- a/docs/content-sync/english-2026-04-22/encrypt_pdf_rust.md +++ b/docs/content-sync/english-2026-04-22/encrypt_pdf_rust.md @@ -79,7 +79,7 @@ fn main() -> Result<()> { - If the article lists supported algorithms: state **AES-128 is accepted today but the 1.0 backend currently emits AES-256 regardless** — registered in STABILITY.md §3.3 as a 1.1 - follow-up (#1251 Codex P2 audit item). + follow-up (#1251 review P2 audit item). ## What stays the same diff --git a/docs/content-sync/translation-handoff-2026-04-22/README.md b/docs/content-sync/translation-handoff-2026-04-22/README.md index 3159ecd5..2852364d 100644 --- a/docs/content-sync/translation-handoff-2026-04-22/README.md +++ b/docs/content-sync/translation-handoff-2026-04-22/README.md @@ -52,7 +52,6 @@ must preserve case and surrounding punctuation. - `PDFluent` - `pdfluent` - `pdfluent.com` -- `Anthropic` (where cited) - `ISO 32000-1`, `ISO 32000-2` (standards tags) ### Rust identifiers (types, traits, functions, modules) @@ -178,7 +177,7 @@ CJK-specific (ja, zh): - [ ] Full-width / half-width punctuation consistent within each file. - [ ] No stray Japanese katakana for words that should be kanji (or vice versa). -## Delivery format to Cloud/Claude +## Delivery format to the cloud session Return one directory per language, mirroring `sources/`: diff --git a/docs/content-sync/translation-handoff-2026-04-22/sources/encrypt_pdf_rust.md b/docs/content-sync/translation-handoff-2026-04-22/sources/encrypt_pdf_rust.md index 666262d1..56caf66c 100644 --- a/docs/content-sync/translation-handoff-2026-04-22/sources/encrypt_pdf_rust.md +++ b/docs/content-sync/translation-handoff-2026-04-22/sources/encrypt_pdf_rust.md @@ -79,7 +79,7 @@ fn main() -> Result<()> { - If the article lists supported algorithms: state **AES-128 is accepted today but the 1.0 backend currently emits AES-256 regardless** — registered in STABILITY.md §3.3 as a 1.1 - follow-up (#1251 Codex P2 audit item). + follow-up (#1251 review P2 audit item). ## What stays the same diff --git a/docs/release/FIRST_BETA_OPERATOR_RUNBOOK.md b/docs/release/FIRST_BETA_OPERATOR_RUNBOOK.md index 4d065264..6d6e4bc6 100644 --- a/docs/release/FIRST_BETA_OPERATOR_RUNBOOK.md +++ b/docs/release/FIRST_BETA_OPERATOR_RUNBOOK.md @@ -82,7 +82,7 @@ security find-identity -v -p codesigning | grep -E 'Developer ID Application' >/ echo 'Windows Trusted Signing: env not set (use USB EV fallback if available)' # GitLab API token — for `glab release create` and Releases upload -security find-internet-password -s gitlab.com -a claude-pdfluent-api -w >/dev/null 2>&1 && \ +security find-internet-password -s gitlab.com -a pdfluent-api -w >/dev/null 2>&1 && \ echo 'GitLab API: OK' || echo 'GitLab API: MISSING' ``` @@ -596,7 +596,7 @@ Per `docs/release/SIGNING_WINDOWS.md` §2.1 (preferred) or §2.3 (fallback): | field | value | |---|---| -| GitLab API token | `claude-pdfluent-api` (already in keychain, scope = `api`, expires 2027-05-28) is sufficient for `glab release create` + `glab release upload`. | +| GitLab API token | `pdfluent-api` (already in keychain, scope = `api`, expires 2027-05-28) is sufficient for `glab release create` + `glab release upload`. | | GitLab CI/CD variable | `GLAB_TOKEN` if using glab in CI; the `CI_JOB_TOKEN` is sufficient for `release: create` via the API | | needed for | uploading the binary release tarballs to GitLab Releases | @@ -694,7 +694,7 @@ combine into a single yes/no answer per channel. This is the answer to | **Binary release — Linux musl** (`x86_64-unknown-linux-musl`) | 🟢 **YES** (GPG-signed) | Tier-1 CI artefact present; `binary_release.md` checklist supports GPG `.asc` Linux signing via the PDFluent GPG key already in keychain. No platform code-signing identity required for Linux | §1.8 — Linux row | | **Binary release — Windows** (`x86_64-pc-windows-gnu`) | 🔴 **NO** | Tier-1 CI artefact present, but no code-signing identity provisioned. SmartScreen will warn on every consumer download. **Block on §3.7**: Microsoft Trusted Signing (preferred) or USB EV cert | §3.7 + `SIGNING_WINDOWS.md` | | **Binary release — macOS** (`x86_64-apple-darwin` + `aarch64-apple-darwin`) | 🔴 **NO** | No `Developer ID Application` cert in keychain (only `Apple Development` debug certs); no notarytool API key stored. Gatekeeper will refuse to open the binary. **Block on §3.6**: Apple Developer Program + Dev ID cert + notarytool key | §3.6 + `SIGNING_MACOS.md` | -| **GitLab Releases** (artefact upload) | 🟢 **YES** | `claude-pdfluent-api` PAT in keychain, scope `api`, expires 2027-05-28 | §1.8 footer | +| **GitLab Releases** (artefact upload) | 🟢 **YES** | `pdfluent-api` PAT in keychain, scope `api`, expires 2027-05-28 | §1.8 footer | **Summary:** 8 of 10 publish targets are ready for staged beta publish today, gated only on the operator's explicit per-step approval. The 2 diff --git a/docs/rfc/0001-sdk-core-api.md b/docs/rfc/0001-sdk-core-api.md index 73fdccc9..d4db3fd9 100644 --- a/docs/rfc/0001-sdk-core-api.md +++ b/docs/rfc/0001-sdk-core-api.md @@ -601,9 +601,9 @@ These are documented here so a user who tries `PdfDocument::from_html` and gets |---|---|---| | 2026-04-21 | v1.1 | Post-validation-pass update. Applied 12 fixes: removed `PdfDocumentBuilder`; removed `permissions_mut`; split `Signature` into `SignatureInfo` + `SignatureValidation`; renamed `structured_text` → `text_with_layout`; renamed `PadesProfile` variants to descriptive names; renamed `Rotation` variants to `ClockwiseN`; made `metadata_mut`/`form_mut` both return plain handles (no `Result`); `BookmarkMergeStrategy::Concat` as `Default`; removed unused `Alignment` type; `Error::docs_url` returns `&'static str`; `PdfDocument` dropped `Clone`; added license-provisioning API (`set_license_key`, `OpenOptions::with_license_key`, env var `PDFLUENT_LICENSE_KEY`). Full report: `xfa-program-office/SDK_CORE_FACADE_VALIDATION_PASS_01.md`. | | 2026-04-21 | v1.2 | Post-validation-pass-02 update. Fixed 8 items: restored `redact(text, RedactOptions)` + `redact_region(page, rect)` + `split_pages()` + `extract_pages(range)` (regressions from v1.1); restored `form_fields() -> Result>`; dropped `async-tokio` feature and `pdfluent::r#async` module entirely (shipped empty in v1.1 — deferred to 1.1 with concrete scope); added `Permissions::with_*()` builder methods for custom permission combinations; changed `SignOptions::visible_rect(page: u32, ...)` to `usize` for cross-module consistency; added `RedactOptions::on_pages(&[usize])` and wired `RedactOptions` into `redact()` signature (was a declared-but-unused dead type); documented image watermarks and async defer in §13. Full report: `xfa-program-office/SDK_CORE_FACADE_VALIDATION_PASS_02.md`. | -| 2026-04-21 | v1.3 | Codex triage round. Fixed 7 contract drift points: rewrote §4 (async fully deferred to 1.1 — dropped feature, removed from cross-language table and module tree, updated D4); removed `PagesMut` struct and `pages_mut()` method from public 1.0 API (direct methods `rotate_page`/`split_pages`/`extract_pages` remain; batch builder deferred to 1.1); fixed `MetadataMut::commit(&mut self)` so advertised chain-with-commit pattern compiles; added `Permissions::full_access()` preset and made it the default for `EncryptOptions::aes256()` / `aes128()`; clarified all presets honour ISO 32000-2 §7.6.4.2 accessibility-extraction; changed `SignatureValidationReport::all_valid()` to vacuous-true + added `is_signed()` to distinguish "unsigned" from "valid"; documented Trial tier scope (technical caps only; AirGapped/OemRedistribution remain Enterprise). | +| 2026-04-21 | v1.3 | Triage round. Fixed 7 contract drift points: rewrote §4 (async fully deferred to 1.1 — dropped feature, removed from cross-language table and module tree, updated D4); removed `PagesMut` struct and `pages_mut()` method from public 1.0 API (direct methods `rotate_page`/`split_pages`/`extract_pages` remain; batch builder deferred to 1.1); fixed `MetadataMut::commit(&mut self)` so advertised chain-with-commit pattern compiles; added `Permissions::full_access()` preset and made it the default for `EncryptOptions::aes256()` / `aes128()`; clarified all presets honour ISO 32000-2 §7.6.4.2 accessibility-extraction; changed `SignatureValidationReport::all_valid()` to vacuous-true + added `is_signed()` to distinguish "unsigned" from "valid"; documented Trial tier scope (technical caps only; AirGapped/OemRedistribution remain Enterprise). | -| 2026-04-21 | v1.4 | Epic 2 execution contract fixes (from PR #1248 Codex triage). Flipped `SaveOptions::default` back to `overwrite: false` to honour §1.2 "save writes to a new path or overwrites only when explicitly requested". Rustdoc on `OpenOptions::strict_memory_limit` rewritten to be honest: it is an **input-size cap** (refuses oversized files/buffers before parse), not a peak-memory guarantee; peak RSS during parse can reach ~3× input for pathological PDFs because `pdf-engine` + `lopdf` build parallel in-memory trees. Hard peak caps remain an OS-level (cgroup/ulimit) concern. Stricter in-process peak-memory limiter is tracked as a post-1.0 improvement. No method signatures changed. | +| 2026-04-21 | v1.4 | Epic 2 execution contract fixes (from PR #1248 triage). Flipped `SaveOptions::default` back to `overwrite: false` to honour §1.2 "save writes to a new path or overwrites only when explicitly requested". Rustdoc on `OpenOptions::strict_memory_limit` rewritten to be honest: it is an **input-size cap** (refuses oversized files/buffers before parse), not a peak-memory guarantee; peak RSS during parse can reach ~3× input for pathological PDFs because `pdf-engine` + `lopdf` build parallel in-memory trees. Hard peak caps remain an OS-level (cgroup/ulimit) concern. Stricter in-process peak-memory limiter is tracked as a post-1.0 improvement. No method signatures changed. | -🤖 Drafted 2026-04-21 as part of milestone #52 execution (SDK Core Facade & API Ergonomics). +Drafted 2026-04-21 as part of milestone #52 execution (SDK Core Facade & API Ergonomics). diff --git a/scripts/ci/a_baseline_names_the_machine.py b/scripts/ci/a_baseline_names_the_machine.py index ee58ba0e..600febd8 100644 --- a/scripts/ci/a_baseline_names_the_machine.py +++ b/scripts/ci/a_baseline_names_the_machine.py @@ -45,7 +45,7 @@ than `[meta] calibration_valid_days` counts as absent. So does one dated in the future: a date nobody could have measured on is a typo or a guess, and either way it would outlive every real calibration around it - (codex, #1622). + (review, #1622). 5. A restored criterion baseline names the machine class in its cache key. `target/criterion` is the baseline: restoring it is the comparison. A key diff --git a/scripts/ci/a_deletion_declares_itself.py b/scripts/ci/a_deletion_declares_itself.py index 63908bf1..3d348e76 100755 --- a/scripts/ci/a_deletion_declares_itself.py +++ b/scripts/ci/a_deletion_declares_itself.py @@ -79,7 +79,7 @@ def main(argv: list[str]) -> int: "added between the common ancestor and that tip, so a " "force-push could drop a file and report nothing. A " "pull request wants the merge base, because its base " - "branch may have moved on. (codex, #1635)") + "branch may have moved on. (review, #1635)") args = ap.parse_args(argv[1:]) if args.exact_base: @@ -101,7 +101,7 @@ def main(argv: list[str]) -> int: # is exactly what `--base origin/master` produced on a push to master, where # the ref already points at the revision being pushed. The caller was fixed; # this refuses too, because the next caller will be written by somebody who - # has not read that fix. (codex, #1635) + # has not read that fix. (review, #1635) head_sha = git("rev-parse", args.head)[1].strip() if base_sha == head_sha: print(f"[deletions] FATAL: the base resolves to {args.head} itself, so the " @@ -113,14 +113,14 @@ def main(argv: list[str]) -> int: # any path outside ASCII -- "benchmarks/runs/\316\262.md" for a path holding # a beta. The trailer carries the literal path, so the two spellings never # match and a correctly declared deletion is reported as both undeclared and - # misplaced at once. This repo already tracks such paths. (codex, #1635) + # misplaced at once. This repo already tracks such paths. (review, #1635) rc, out = git("diff", "--diff-filter=D", "--name-only", "-z", f"{base_sha}..{args.head}") if rc != 0: # An ignored return code made empty stdout look like an empty set of # deletions: with a bad --head the diff failed and the guard reported OK # having compared nothing. A command that did not run is not a clean - # answer. (codex, #1635) + # answer. (review, #1635) print(f"[deletions] FATAL: `git diff {base_sha}..{args.head}` failed " f"(exit {rc}). Refusing to report a clean branch for a comparison " "that did not happen.", file=sys.stderr) @@ -138,7 +138,7 @@ def main(argv: list[str]) -> int: # it". The declaration belonged to a deletion that had been undone. # # What has to carry the trailer is the LAST commit that removes the path, - # because that is the one whose effect survives to the tip. (codex, #1635) + # because that is the one whose effect survives to the tip. (review, #1635) rc, log = git("log", "--reverse", "--format=%H%x00%B%x1e", f"{base_sha}..{args.head}") if rc != 0: @@ -168,7 +168,7 @@ def main(argv: list[str]) -> int: # declared deletion would fail. The same holds for an ordinary merge # commit landing on master. The deletion belongs to the commit on the # side branch that performed it, so merges are skipped when choosing the - # last deleter. (codex, #1635) + # last deleter. (review, #1635) parents = git("rev-list", "--parents", "-n", "1", sha)[1].split()[1:] _, own = git("show", "--diff-filter=D", "--name-only", "--format=", "-z", "--first-parent", "-m", sha) @@ -188,7 +188,7 @@ def main(argv: list[str]) -> int: # removed it -- a conflict resolution that drops a file -- and it can # and must declare it. Discarding every merge deletion outright made # such a commit report as undeclared AND misplaced at once. - # (codex, #1635) + # (review, #1635) inherited = set() for path in removed_here: for par in parents[1:]: @@ -208,7 +208,7 @@ def main(argv: list[str]) -> int: # the deleting commit is then impossible to satisfy, and a trailer on the new # tip was reported as misplaced. A deliberate force-push removal could not be # declared at all. In this mode any commit in the range may carry it. - # (codex, #1635) + # (review, #1635) orphaned = {p for p in deleted if p not in last_deleter} if args.exact_base and orphaned: anywhere = set().union(*trailers.values()) if trailers else set() @@ -227,7 +227,7 @@ def main(argv: list[str]) -> int: # from the stale list: they need different sentences, and the previous # version put both in one list and then looked every entry up in `declared`, # which raised KeyError on the misplaced ones -- a traceback instead of the - # remediation the message was written to give. (codex, #1635) + # remediation the message was written to give. (review, #1635) misplaced: list[str] = [] for sha, named in trailers.items(): for path in sorted(named - deletes.get(sha, set())): diff --git a/scripts/ci/a_fixture_cannot_touch_a_real_repo.py b/scripts/ci/a_fixture_cannot_touch_a_real_repo.py index d4b26212..2ae6b09d 100755 --- a/scripts/ci/a_fixture_cannot_touch_a_real_repo.py +++ b/scripts/ci/a_fixture_cannot_touch_a_real_repo.py @@ -98,7 +98,7 @@ def calls_made(tree: ast.AST) -> set[str]: Separate from imports on purpose: an unused `from fixture_env import sealed_env` sitting beside the old environment satisfied a name check while changing nothing. An import is an intention; a call is the behaviour. - (codex, #1647) + (review, #1647) """ out: set[str] = set() for n in ast.walk(tree): diff --git a/scripts/ci/a_gate_that_never_went_green.py b/scripts/ci/a_gate_that_never_went_green.py index b09dbffd..3b3834f0 100755 --- a/scripts/ci/a_gate_that_never_went_green.py +++ b/scripts/ci/a_gate_that_never_went_green.py @@ -250,7 +250,7 @@ def niet_gecontroleerd() -> int: to find, inside the guard. On a contributor's clone with no token it is a warning, because failing there helps nobody. - Same split T3 uses for the term list, from the same variable. (codex, #1610) + Same split T3 uses for the term list, from the same variable. (review, #1610) """ if IN_CI: print(" In CI that is a failure, not a skip: a gate that could not read " @@ -303,7 +303,7 @@ def main() -> int: # after 60 quiet days -- which it can do once this repository is # public. Treating every non-active state as "off on purpose" would # let a scheduled gate go dark and be approved for it. Only the - # deliberate switch is an excuse. (codex, #1610) + # deliberate switch is an excuse. (review, #1610) dood.append((pad.name, 0, dt.datetime.now(dt.timezone.utc))) print(f"[groen] {pad.name}: state is `{staat}`, which nobody chose. " "Re-enable it or name it in BEKEND.", file=sys.stderr) @@ -336,7 +336,7 @@ def main() -> int: # its previous version green -- which is the guard reporting the # opposite of the truth, not merely missing it. The date already comes # from the default branch, so the runs must too or the two halves are - # measuring different things. (codex, #1610) + # measuring different things. (review, #1610) # # Without `status=completed`, queued and in-progress runs count towards # GENOEG while contributing no successes. Three runs created in a burst diff --git a/scripts/ci/branches_have_a_merge_request.py b/scripts/ci/branches_have_a_merge_request.py index 177f4afb..553a4da3 100755 --- a/scripts/ci/branches_have_a_merge_request.py +++ b/scripts/ci/branches_have_a_merge_request.py @@ -15,7 +15,7 @@ anywhere. Fifteen finished pieces of work, none of them on master, and nothing counting them (#272). -The rule in CLAUDE.md is that a merge request is a question waiting for an +The rule in the project's contributor instructions is that a merge request is a question waiting for an answer. A branch without one is not even a question. WHERE THE DESTINATION COMES FROM @@ -25,7 +25,7 @@ honest answer to "is this branch on the remote, and under what name" -- a push with a renaming refspec never produces a `github/`, so asking for that ref answered "not yet" on every push, for ever, and the promise -"the next push fails" was empty (codex, #1610). When the line is there it is +"the next push fails" was empty (review, #1610). When the line is there it is used, for both the existence check and the name handed to `gh pr list`. When it is not -- run by hand, from a terminal -- the guard falls back to the tracking ref and says so, instead of promising what it cannot see. @@ -99,7 +99,7 @@ def main() -> int: return 0 # Not `tak.split("/")[-1]`: that reads `release/main` and `feature/master` - # as the default branch and skips a topic branch entirely. Codex, #1542. + # as the default branch and skips a topic branch entirely. review, #1542. if tak in ("master", "main"): print(f"[branch-mr] on {tak}; nothing to ask.") return 0 @@ -175,7 +175,7 @@ def main() -> int: # one -- the remote sha is all zeros for a branch the remote has never seen # -- because a tracking ref cannot answer it: a renaming refspec never # creates `github/`, and the first version of this guard asked for - # exactly that ref and so said "not yet" on every push. (codex, #1610) + # exactly that ref and so said "not yet" on every push. (review, #1610) if not op_de_remote and bron: print(f"[branch-mr] {tak} is {vooruit} ahead of {standaard} and " f"{bestemming} does not exist on the remote yet, so it cannot have a " diff --git a/scripts/ci/capability_register.py b/scripts/ci/capability_register.py index b702b9d3..314e38fb 100755 --- a/scripts/ci/capability_register.py +++ b/scripts/ci/capability_register.py @@ -30,7 +30,7 @@ automatic only on a schedule that did not exist. The tests were fine. Nothing ran them, for months, and every report said "tested". A test that no job executes is not coverage; it is a file. This register refuses to call such a -capability tested, which is the Definition of Done in CLAUDE.md made mechanical. +capability tested, which is the Definition of Done in the project's contributor instructions made mechanical. Usage: capability_register.py # regenerate docs/CAPABILITY_REGISTER.md diff --git a/scripts/ci/cargo_target_health.sh b/scripts/ci/cargo_target_health.sh index 93fd60ea..f1c9269f 100755 --- a/scripts/ci/cargo_target_health.sh +++ b/scripts/ci/cargo_target_health.sh @@ -38,7 +38,7 @@ # machine to be idle, and "idle" cannot be established by looking once -- the # gap between the look and the delete spans the scheduling of the next workflow # step, and the GitHub and GitLab runners on this host share no lock. See the -# comment above `_target_in_use`. (codex, #1621) +# comment above `_target_in_use`. (review, #1621) # # ORDER MATTERS. Run `shared_build_dir_is_there.sh` before this, never after. # Every command below touches the filesystem, and on a device that has stopped @@ -69,7 +69,7 @@ if [ "${seen}" -ne 0 ]; then # shared_build_dir_is_there.sh, though the note above says to run that # first. So on the morning the mount is gone, the step every one of them # relies on reported a pass and cargo walked into the broken path. That is - # #264 reported as green. (codex, #1616) + # #264 reported as green. (review, #1616) # # The split that keeps this honest: a directory somebody CONFIGURED and # which is not there is the failure. An unconfigured default that is not @@ -93,7 +93,7 @@ fi # removed out from under a live build corrupts the directory this file exists to # protect" -- and then the two deletions above it did not apply it. A live # `.part.bin` removed before cargo renames it reproduces exactly the 25-08 -# failure this script repairs. (codex, #1616) +# failure this script repairs. (review, #1616) # # The concurrency groups do not help: GitHub and GitLab jobs share this machine # and each other's target directory, and neither knows about the other's lock. @@ -110,7 +110,7 @@ _target_in_use() { # the guard failed OPEN exactly when many rustc processes were running, i.e. # when a build was busiest and deleting under it was most damaging. # Reproduced with 5000 matching lines: 141 with `grep -q`, 0 with a count. - # (codex, #1621) + # (review, #1621) # The path alone is not enough: any shell whose command line mentions the # directory matches, including the one invoking this script. That is the # same self-match that made `pgrep -f "git push"` report other sessions' @@ -127,7 +127,7 @@ _target_in_use() { # environment, so cargo's command line need not contain the path -- and in a # linker or build-script phase there may be no rustc process to find either. # A scan of command lines therefore misses exactly our own runners, which is - # the population this is meant to protect. (codex, #1621) + # the population this is meant to protect. (review, #1621) # # Reading other processes' environments is not portable and needs privileges # we should not want here, so `--sweep` takes the conservative branch @@ -145,7 +145,7 @@ _target_in_use() { # job running on the shared machine) and not the rare one (a job starting during # the sweep). A real cross-CI lock is the fix if this ever bites; it has not # yet, and I would rather leave the limitation written down than implied. -# Deleting is opt-in, and this is the second thing codex was right about on +# Deleting is opt-in, and this is the second thing review was right about on # #1621: a snapshot cannot hold the no-live-deletion invariant. Two jobs can both # find the directory idle, and the window is not a few instructions -- it spans # the scheduling of the next workflow step. crash-guard.yml runs this guard at @@ -189,7 +189,7 @@ if [ -d "${TARGET}/debug/incremental" ] || [ -d "${TARGET}/release/incremental" if ! _bounded_probe "${DEADLINE}" rm -rf "${TARGET}/debug/incremental" "${TARGET}/release/incremental" >/dev/null 2>&1; then # 124 is the probe's timeout, anything else is a real rm failure. Either # way the debris is still there, and saying "removed" would send the next - # build into the files this step claims to have cleared. (codex, #1616) + # build into the files this step claims to have cleared. (review, #1616) echo "[cargo-target-health] FATAL: could not remove the incremental state." >&2 echo "[cargo-target-health] The subtree is unresponsive or not ours to delete;" >&2 echo "[cargo-target-health] the initial probe does not walk into it, so this is the" >&2 @@ -230,7 +230,7 @@ if [ -f "${TARGET}/.cargo-lock" ]; then # Counted, or a lock as the ONLY finding leaves `cleaned` at zero and the # summary below says the directory "is clean" -- a healthy verdict # contradicting the one thing the scan just found, in the mode that runs - # on every build. (codex, #1621) + # on every build. (review, #1621) echo "[cargo-target-health] .cargo-lock present — reported, not removed (run with --sweep when idle)" cleaned=$((cleaned + 1)) elif ! pgrep -x cargo >/dev/null 2>&1; then diff --git a/scripts/ci/de_gedeelde_config_breekt_geen_worktrees.py b/scripts/ci/de_gedeelde_config_breekt_geen_worktrees.py index 7ebf8d1d..8fd58ab1 100644 --- a/scripts/ci/de_gedeelde_config_breekt_geen_worktrees.py +++ b/scripts/ci/de_gedeelde_config_breekt_geen_worktrees.py @@ -95,7 +95,7 @@ def waarde(tekst: str, sectie: str, sleutel: str) -> str | None: Met git zelf lezen zou de global en de per-worktree config meenemen, en juist het onderscheid tussen die drie is hier de vraag. Dus met de hand -- en dan ook mét de twee eigenaardigheden die git wél heeft en een naïeve lezer niet - (allebei aangewezen door Codex op #1609): + (allebei aangewezen door review op #1609): * **De laatste toekenning wint.** Bij `bare = false` gevolgd door `bare = true` gebruikt git `true`. De eerste versie hiervan gaf de eerste @@ -116,7 +116,7 @@ def waarde(tekst: str, sectie: str, sleutel: str) -> str | None: # `[core "demo"]` is core.demo.*, a different key entirely -- git # prints it as `core.demo.bare` and leaves `core.bare` unset. Reading # it as `core` made the guard report every worktree broken over a - # subsection that affects nothing. (Codex, #1609.) + # subsection that affects nothing. (review, #1609.) huidige = None if kop.group(2) else kop.group(1).lower() continue if huidige != sectie: @@ -137,7 +137,7 @@ def volg_includes(pad: pathlib.Path, tekst: str, diepte: int = 0) -> str: `includeIf`, whose conditions are not evaluated here, and not the global or per-worktree files, which are not what this checks. A file that sets `core.bare` through an include breaks worktrees exactly as directly as one - that sets it inline. (Codex, #1609.) + that sets it inline. (review, #1609.) """ if diepte > 5: # git's own limit is 10; this is a guard against a loop. return tekst @@ -179,7 +179,7 @@ def main() -> int: bare = waarde(tekst, "core", "bare") # git's false spellings. Anything outside both lists is not "not true": git # refuses to run at all with `fatal: bad boolean config value`, which breaks - # worktrees just as completely. (Codex, #1609.) + # worktrees just as completely. (review, #1609.) ONWAAR = ("false", "no", "off", "0", "") if bare is not None and bare.lower() not in ONWAAR and bare.lower() not in ( "true", "yes", "on", "1", diff --git a/scripts/ci/disk_headroom.py b/scripts/ci/disk_headroom.py index 0ce800b3..6b7afb74 100755 --- a/scripts/ci/disk_headroom.py +++ b/scripts/ci/disk_headroom.py @@ -104,7 +104,7 @@ # storage box with no relation to the Windows disk holding the distro image, so # with /mnt/c unmounted the search below would have picked the storage box and # reported its free space as the vhdx's headroom -- a full C: passing the guard -# on the strength of a remote share's spare room. (codex, #1616) +# on the strength of a remote share's spare room. (review, #1616) # # It stays in HOST_VOLUME_FSTYPES because the check above it is a different # question: if the repository itself lives on the share, then the share really diff --git a/scripts/ci/does_this_already_exist.py b/scripts/ci/does_this_already_exist.py index faf8b7d2..e8d6fb21 100755 --- a/scripts/ci/does_this_already_exist.py +++ b/scripts/ci/does_this_already_exist.py @@ -27,7 +27,7 @@ A job would ask the question after the work is done, which is the one moment at which the answer is worthless. It belongs in a pair of hands, as step zero of -starting a story, and that is where CLAUDE.md puts it. +starting a story, and that is where the project's contributor instructions put it. `every_guard_has_a_job.py` records it as by-hand for this reason. WITHOUT A TOKEN IT SAYS SO diff --git a/scripts/ci/een_fork_zonder_forkpunt_wordt_niet_gemerged.py b/scripts/ci/een_fork_zonder_forkpunt_wordt_niet_gemerged.py index b91e78a5..e8533009 100644 --- a/scripts/ci/een_fork_zonder_forkpunt_wordt_niet_gemerged.py +++ b/scripts/ci/een_fork_zonder_forkpunt_wordt_niet_gemerged.py @@ -154,7 +154,7 @@ def velden(tekst: str) -> dict[str, tuple[str | None, str | None]]: # neither github/master nor origin/master nor master exists, so this was the # answer on every Actions run. The guard was wired, ran, printed SKIPPED and # returned 0 while a change to a `niet_mergen` entry's `gelijk_met` or - # `forkpunt` passed underneath it. (codex, #1639) + # `forkpunt` passed underneath it. (review, #1639) print("SKIPPED (not a pass): geen merge-base gevonden, dus niet vastgesteld " "welke registerregels deze tak beweegt; `niet_mergen` blokkeert hier niets.", file=sys.stderr) @@ -215,7 +215,7 @@ def main() -> int: # Printing it is not blocking it. The step in .github/workflows/ci.yml # reads the exit status and nothing else, so a branch that upgraded one # of these crates while leaving the field in place passed with a warning - # in the log that nobody reads. (Codex, #1609.) + # in the log that nobody reads. (review, #1609.) if naam in bewogen: fouten.append( f" {naam}: carries `niet_mergen`, and this branch moves its " diff --git a/scripts/ci/een_forkpunt_wordt_op_inhoud_gecontroleerd.py b/scripts/ci/een_forkpunt_wordt_op_inhoud_gecontroleerd.py index 0e3562f2..33fcefaa 100644 --- a/scripts/ci/een_forkpunt_wordt_op_inhoud_gecontroleerd.py +++ b/scripts/ci/een_forkpunt_wordt_op_inhoud_gecontroleerd.py @@ -298,7 +298,7 @@ def ensure_clone(needed: list[str]) -> str | None: commit would be measured against an older history -- and an older commit already in the cache can then hold the maximum and pass, while the real maximum sits in a revision that was never fetched. Green, on the wrong - evidence. (Codex, #1609.) + evidence. (review, #1609.) """ if CLONE.exists() and git("rev-parse", "--git-dir", cwd=CLONE).returncode == 0: missing = [ @@ -444,7 +444,7 @@ def main() -> int: # nothing can verify it. The structural guard passes because the # field exists, and the version check passes anywhere inside one # version window -- so an unverifiable merge base stayed green - # through all three. (Codex, #1609.) + # through all three. (review, #1609.) # # pdf-render is this case and carries `niet_mergen` instead, which is # the honest record; an entry reaching here has a fork point it diff --git a/scripts/ci/every_guard_has_a_job.py b/scripts/ci/every_guard_has_a_job.py index 03a60293..c594f2c5 100755 --- a/scripts/ci/every_guard_has_a_job.py +++ b/scripts/ci/every_guard_has_a_job.py @@ -7,7 +7,7 @@ """Every script in `scripts/ci/` must be called by a pipeline job -- and by one that can still block a merge. -This is the rule from CLAUDE.md, made mechanical: *nothing is done if there is +This is the rule from the project's contributor instructions, made mechanical: *nothing is done if there is no test for it that runs in the CI pipeline.* That rule exists because the alternative went wrong three times, each time the same way -- the test existed and nothing ran it. @@ -81,7 +81,7 @@ # had always stood before no merge was counted for the first time. The lines a # job runs were read without asking whether the job can run on a pull request, # so `tests_actually_ran.py`, called only from a workflow_dispatch-only -# workflow, counted as "has a job" (codex, #1633). The count now includes +# workflow, counted as "has a job" (review, #1633). The count now includes # every guard whose only GitHub job is dispatch-only or parked behind # `needs: parked`, and that one is in mirror_only_guards.toml with its reason. # @@ -118,7 +118,7 @@ # Deliberately by hand, and the reason is the whole design (#237). A job # would ask "does this already exist?" after the work was done, which is the # one moment at which the answer is worthless. It belongs at the start of a - # story, in a pair of hands, and CLAUDE.md puts it there as step zero. Its + # story, in a pair of hands, and the project's contributor instructions put it there as step zero. Its # TEST does run, on every pull request, over a fake `gh`. # The measurement needs a full clone of LaurenzV/hayro -- 948 MB, with the # history, because the fork point is a commit and not a version number. No @@ -151,7 +151,7 @@ "does_this_already_exist.py": ( "asked by a person before starting a story, not by a job afterwards; " - "step zero in CLAUDE.md, and test_does_this_already_exist.py runs in CI" + "step zero in the project's contributor instructions, and test_does_this_already_exist.py runs in CI" ), # A cargo build of five hundred small programs -- every Rust block on @@ -194,7 +194,7 @@ # # It runs in the local gate, where `gh` is authenticated, and it now exits 1 # rather than 0 when CI is set, so wiring it again fails loudly instead of - # quietly. A token for it is an owner decision (#290). (codex, #1639) + # quietly. A token for it is an owner decision (#290). (review, #1639) "every_label_has_a_runner.py": ( "needs `gh` with a keyring; GITHUB_TOKEN cannot be granted the scope " "/actions/runners requires, so in a workflow it can only skip. Runs in " @@ -348,7 +348,7 @@ "both remotes. test_mirror_has_not_drifted.py runs in " "orchestration-guard and holds it to still biting; " "the_topology_agrees_with_the_mirror_gate.py holds the direction it " - "enforces to the roles written in CLAUDE.md" + "enforces to the roles written in the project's contributor instructions" ), "origin_is_the_source_in_every_checkout.py": ( "its subject IS this machine: which repository `origin` resolves to here, " @@ -633,7 +633,7 @@ def main() -> int: print( "\nPut a job on it in .github/workflows/ or .gitlab-ci.yml, or add the\n" "script to ALLOWED with the reason it belongs in a pair of hands.\n\n" - "The rule from CLAUDE.md: nothing is done if there is no test for it\n" + "The rule from the project's contributor instructions: nothing is done if there is no test for it\n" "that runs in the CI pipeline. That holds for the checks themselves.", file=sys.stderr, ) diff --git a/scripts/ci/every_label_has_a_runner.py b/scripts/ci/every_label_has_a_runner.py index 4d3cefe5..8fc63578 100755 --- a/scripts/ci/every_label_has_a_runner.py +++ b/scripts/ci/every_label_has_a_runner.py @@ -309,12 +309,12 @@ def main() -> int: "authenticated. It cannot work in GitHub Actions: /actions/runners " "needs `administration: read`, which GITHUB_TOKEN cannot be granted.", file=sys.stderr) - # A skip in CI is a pass in CI, and CLAUDE.md's Definition of Done does not + # A skip in CI is a pass in CI, and the Definition of Done in the project's contributor instructions does not # allow that. Locally this is honest -- there is a `gh` to ask, and a # missing one is the operator's problem. In Actions there is no `gh` and # GITHUB_TOKEN cannot be granted `administration: read`, so the skip is # permanent: the step would report success on every run without checking - # a single label. (codex, #1639) + # a single label. (review, #1639) if os.environ.get("CI"): print(" Running in CI, where this can never succeed. Reporting a " "pass here would be a green tick for a check that did not " diff --git a/scripts/ci/feature_gaps.toml b/scripts/ci/feature_gaps.toml index 2d3a2ac6..ceb2a457 100644 --- a/scripts/ci/feature_gaps.toml +++ b/scripts/ci/feature_gaps.toml @@ -6,7 +6,7 @@ # right and its only escape hatch was behind someone else's door. # # So the list moved out here and this path is excluded from t2 in -# .claude/territories.toml, which makes it unclaimed and free to edit. Adding +# the territory map, which makes it unclaimed and free to edit. Adding # a feature flag no longer requires entering another terminal's ground. # # A name here without a reason should not exist, and an empty file is the goal. diff --git a/scripts/ci/feature_promises.py b/scripts/ci/feature_promises.py index add56149..67fa6e5f 100755 --- a/scripts/ci/feature_promises.py +++ b/scripts/ci/feature_promises.py @@ -27,7 +27,7 @@ `PROMISES` mirrors what the website and the editor tell customers they can do. When a feature is added there, add it here in the same change — that is the -Definition of Done in CLAUDE.md applied to product copy rather than to code. +Definition of Done in the project's contributor instructions applied to product copy rather than to code. Exit codes: 0 every promise maps to at least one test that exists @@ -199,7 +199,7 @@ def main() -> None: print() print(" Let op: dit toetst dat er een test BESTAAT die de functie aanraakt.") print(" Of die test iets zinnigs beweert, en of hij in CI draait, zijn") - print(" aparte vragen — zie de Definition of Done in CLAUDE.md.") + print(" aparte vragen — zie de Definition of Done in de projectinstructies.") sys.exit(1 if (missing or unreachable) else 0) diff --git a/scripts/ci/fixture_env.py b/scripts/ci/fixture_env.py index 752845fa..3565f90d 100644 --- a/scripts/ci/fixture_env.py +++ b/scripts/ci/fixture_env.py @@ -140,7 +140,7 @@ def inside_the_sandbox(cwd: str | os.PathLike, _env: dict | None = None) -> None A lint reads code; this runs. If the repository git would act on is not under `cwd`, the fixture is about to configure or commit somewhere real, and the honest moment to stop is before the first write, not after the gate - notices the identity in a later commit. (codex, #1647) + notices the identity in a later commit. (review, #1647) """ # _env breaks the recursion: sealed_env(cwd=…) calls this, so building a # fresh environment here would call sealed_env again, for ever. diff --git a/scripts/ci/gate_corpus_no_crash.py b/scripts/ci/gate_corpus_no_crash.py index 60147ac2..d2df472c 100755 --- a/scripts/ci/gate_corpus_no_crash.py +++ b/scripts/ci/gate_corpus_no_crash.py @@ -68,7 +68,7 @@ # Enforced WHILE running, not after. The first version compared the wall clock # with the budget once the pool had drained, so a run where every file hung # was detected 500 x 30 s / 4 workers = about an hour in -- long after the -# point the budget was meant to stop it (codex, #1627). Now every task gets +# point the budget was meant to stop it (review, #1627). Now every task gets # the run's deadline: one that has not started by then does not start, and one # still running is cut at the deadline instead of at its own 30 s. BUDGET_S = 900 diff --git a/scripts/ci/if_conditions_are_valid.py b/scripts/ci/if_conditions_are_valid.py index 38db15e0..a9fc9481 100755 --- a/scripts/ci/if_conditions_are_valid.py +++ b/scripts/ci/if_conditions_are_valid.py @@ -77,7 +77,7 @@ def main() -> int: # `secrets` in an if: is the fatal one. Reading it from `env:` is # fine and is the fix, so only flag the bare context. # Both `secrets.NPM_TOKEN` and `secrets['NPM_TOKEN']` reach the - # same context, and GitHub refuses both. Codex made that point on + # same context, and GitHub refuses both. Review made that point on # #1544; the first version only saw the dotted form. if re.search(r"(?&1 | head -1)" if printf '%s' "${have}" | grep -qF "${VERSION}"; then echo "[verapdf] ${VERSION} already present at ${DEST}" diff --git a/scripts/ci/local_ci_gate.sh b/scripts/ci/local_ci_gate.sh index b22f87bd..51eba218 100755 --- a/scripts/ci/local_ci_gate.sh +++ b/scripts/ci/local_ci_gate.sh @@ -210,7 +210,7 @@ fi # that check exits the script outright. A branch far enough ahead without a pull # request therefore hid every one of these -- and that is exactly the branch # most likely to have broken something. The large unreviewed change and the -# checks that would have judged it were disqualifying each other. (codex, #1610) +# checks that would have judged it were disqualifying each other. (review, #1610) run startbaar python3 scripts/ci/every_workflow_can_start.py run startbaartest python3 scripts/ci/test_every_workflow_can_start.py # ADVISORY IN BOTH LOCAL LANES, refusing only in ci.yml on master. It reads run @@ -247,7 +247,7 @@ if [ -n "$(git status --porcelain | grep -vE 'gen/schemas|\.e1_gaps')" ]; then fi # `run` swallows output on success, and this one says things worth reading when # it passes: a WARNING at 50-149 commits ahead, and every announced SKIPPED. -# Run it once and show what it said either way. (Codex, #1542) +# Run it once and show what it said either way. (review, #1542) _bm_uit="$(python3 scripts/ci/branches_have_a_merge_request.py 2>&1)"; _bm=$? printf '%s\n' "$_bm_uit" | sed 's/^/ /' # Counted, not fatal. This used to `exit 1` here, which aborted the run before @@ -256,7 +256,7 @@ printf '%s\n' "$_bm_uit" | sed 's/^/ /' # unmerged branch also guaranteed nothing else was looked at. That is the state # in which the other guards matter most. # -# Codex found it through the four fork guards this branch adds (#1639), but they +# Review found it through the four fork guards this branch adds (#1639), but they # were only the newest things standing behind the exit; moving those four in # front of it would have made them arbitrarily special and left the other # forty-nine where they were. diff --git a/scripts/ci/mirror_has_not_drifted.py b/scripts/ci/mirror_has_not_drifted.py index 7b0d68f4..2317d584 100755 --- a/scripts/ci/mirror_has_not_drifted.py +++ b/scripts/ci/mirror_has_not_drifted.py @@ -172,7 +172,7 @@ def main() -> int: "That script refuses while the mirror is ahead and keeps those commits under a " "tag\nbefore overwriting anything -- read docs/ci/mirror.md before reaching for " "--archive.\nIf the direction itself has changed, say so on #231 and change " - "CLAUDE.md with it.", + "the project's contributor instructions with it.", file=sys.stderr, ) return 1 diff --git a/scripts/ci/mr_staleness.py b/scripts/ci/mr_staleness.py index bb231da4..b765a233 100755 --- a/scripts/ci/mr_staleness.py +++ b/scripts/ci/mr_staleness.py @@ -53,7 +53,7 @@ def token() -> str | None: # A developer machine keeps it in the keychain; CI passes it as a variable. try: out = subprocess.run( - ["security", "find-internet-password", "-a", "claude-pdfluent-api", "-w"], + ["security", "find-internet-password", "-a", "pdfluent-api", "-w"], capture_output=True, text=True, timeout=10) return out.stdout.strip() or None except Exception: # noqa: BLE001 @@ -118,7 +118,7 @@ def main() -> None: print("[mr_staleness] FATAL: no API token.", file=sys.stderr) print("[mr_staleness] CI: set GITLAB_API_TOKEN (api scope, read is enough).", file=sys.stderr) - print("[mr_staleness] Local: the keychain entry `claude-pdfluent-api`.", + print("[mr_staleness] Local: the keychain entry `pdfluent-api`.", file=sys.stderr) print("[mr_staleness] Exiting 2, not 0: a check that cannot run has not passed.", file=sys.stderr) diff --git a/scripts/ci/no_hosted_minutes_on_a_push.py b/scripts/ci/no_hosted_minutes_on_a_push.py index df5bfe5f..295a9741 100755 --- a/scripts/ci/no_hosted_minutes_on_a_push.py +++ b/scripts/ci/no_hosted_minutes_on_a_push.py @@ -94,7 +94,7 @@ def vanzelf_actief(on) -> bool: if naam == "push" and isinstance(waarde, dict): # `tags:` alone is a release. `tags:` with `branches:` fires on # every commit too -- and so does `tags:` with `branches-ignore:`, - # which enables every branch the filter does not exclude. Codex + # which enables every branch the filter does not exclude. Review # caught the second form on #1546; the first version only knew # about `branches`. takken = "branches" in waarde or "branches-ignore" in waarde @@ -110,7 +110,7 @@ def runner_ingangen(job: dict): A blob of text will not do. A matrix carrying both `[self-hosted, xfa-fast]` and `macos-latest` contains the word "self-hosted", and deciding on the blob excuses exactly the expensive half; deciding the other way bills our own - Windows box, whose label contains "windows". Codex made both points on + Windows box, whose label contains "windows". Review made both points on #1546. So: collect the entries and judge each on its own. """ uit = [] diff --git a/scripts/ci/notice_names_what_exists.py b/scripts/ci/notice_names_what_exists.py index e8297b1a..b0a86cc0 100644 --- a/scripts/ci/notice_names_what_exists.py +++ b/scripts/ci/notice_names_what_exists.py @@ -14,7 +14,7 @@ repository says; two versions means one of them is untrue and nobody can see which. -2. EVERY PATH IT NAMES EXISTS. A line about `.claude/skills/caveman` left behind +2. EVERY PATH IT NAMES EXISTS. A line about `docs/retired-guide` left behind after that directory is gone -- or written before it arrives -- describes something the reader does not have. Same shape as a guard still watching a deleted file, or a ledger that never shrinks. diff --git a/scripts/ci/orchestration_stays_hosted.py b/scripts/ci/orchestration_stays_hosted.py index 64f7fd5c..67f7f041 100755 --- a/scripts/ci/orchestration_stays_hosted.py +++ b/scripts/ci/orchestration_stays_hosted.py @@ -14,7 +14,7 @@ code stays on isolated runners, and a workflow that dispatches by ref is exactly where that rule gets bypassed. -Found by Codex review on PR #1535, after that PR moved orchestration onto +Found in review on PR #1535, after that PR moved orchestration onto xfa-fast to save 10-20s of hosted time per run. The saving was real; the exposure it bought back is not bounded, and the person most likely to trigger it was the one dispatching feature branches every few minutes. @@ -54,7 +54,7 @@ # `self-hosted` is implied by a custom label but does not have to be written: # `runs-on: [xfa-fast]` routes to the same machine and contains neither word. -# Codex caught this; matching the literal string alone would have let the next +# Review caught this; matching the literal string alone would have let the next # job through. PERSISTENT_LABELS = ("self-hosted", "xfa-fast") @@ -73,7 +73,7 @@ # # Accepted here, with a caveat that belongs in writing: the `if:` lives in the # workflow file, and a dispatch by ref runs that branch's copy of it. A branch -# that deletes the guard is not stopped by the guard. Codex raised this on +# that deletes the guard is not stopped by the guard. Review raised this on # #1538 and it is correct. # # What it stops is the accident, which is the failure that actually occurs. The @@ -85,7 +85,7 @@ # # The comparison is against the full ref, not `ref_name`: that strips both # refs/heads/ and refs/tags/, so a TAG named master would satisfy a short-name -# check. Codex caught that too. +# check. Review caught that too. REF_VASTGEZET = re.compile( r"github\.ref\s*==\s*" r"(format\('refs/heads/\{0\}',\s*github\.event\.repository\.default_branch\)" @@ -138,7 +138,7 @@ def desktop_toegestaan(triggers) -> frozenset[str]: point at a commit that never reached master. `schedule` needs no filter. GitHub only ever runs a scheduled workflow from - the default branch, so there is no ref for a caller to choose. (codex, #1649) + the default branch, so there is no ref for a caller to choose. (review, #1649) """ if triggers is None: return DESKTOP_GEBEURTENISSEN @@ -179,7 +179,7 @@ def desktop_toegestaan(triggers) -> frozenset[str]: # first operand is false, so the disjunction yields the ARRAY -- the desktop -- # and the scan approved it because it had found the words it was looking for. # The operator between the condition and the runner is what decides, so the -# operator is what gets read. (codex, #1649) +# operator is what gets read. (review, #1649) _STRUCTUUR = re.compile( r"\$\{\{\s*(?P.+?)\s*&&\s*(?P.+?)\s*\|\|\s*(?P.+?)\s*\}\}", re.S) @@ -192,7 +192,7 @@ def desktop_toegestaan(triggers) -> frozenset[str]: # every event EXCEPT push safe and putting pull requests and dispatches on the # desktop. A negation does not decorate a condition, it reverses it, so the # only conditions this guard accepts are the un-negated whitelist forms. -# (codex, #1649) +# (review, #1649) _COND_REST = re.compile(r"github\.event_name\s*==\s*'[a-z_]+'|&&|\|\||[()\s]") _NEGATIE = re.compile(r"!") @@ -210,7 +210,7 @@ def per_gebeurtenis_veilig(runs_on: str, events: set[str] | None = None, So the condition has to NAME the events on which the desktop is chosen, and every one of them has to be in DESKTOP_GEBEURTENISSEN. The next event GitHub - adds is then a refusal rather than a leak. (codex, #1649) + adds is then a refusal rather than a leak. (review, #1649) """ if not ALLEEN_BIJ_PUSH.search(runs_on): return False @@ -300,7 +300,7 @@ def per_gebeurtenis_veilig(runs_on: str, events: set[str] | None = None, # Found only once the guard started following the scripts a job calls: # `publish` runs ./scripts/publish_ordered.sh, which compiles. Same reason # as preflight -- release path, no way to rehearse a change to it without - # publishing. (Codex, #1541) + # publishing. (review, #1541) ("publish-crates.yml", "publish"), # The visual suite (#326). Not the corpus: crates/visual-regression/README.md # says the renderer uses no system font and no external command, so on paper @@ -342,7 +342,7 @@ def per_gebeurtenis_veilig(runs_on: str, events: set[str] | None = None, # A job that calls `bash scripts/ci/run_build.sh` compiles just as hard as one -# that types `cargo build`, and the workflow file says nothing about it. Codex +# that types `cargo build`, and the workflow file says nothing about it. Review # raised this on #1541; the first version read only the YAML. # Only shell scripts. A .sh file's text is commands, so `cargo build` in it is a # build. A .py file's text is mostly not: this guard's own source contains @@ -395,7 +395,7 @@ def op_blijvende_runner(runs_on, events: set[str] | None = None, the job was classified as not-on-the-desktop and never looked at again. Two places deciding the same thing, and the newer one silenced the older. Whether a per-event choice is safe is per_gebeurtenis_veilig's question, - here as everywhere. (codex, #1649) + here as everywhere. (review, #1649) events=None means the caller could not say which events reach the job. per_gebeurtenis_veilig refuses to call that safe, so the job is judged. @@ -480,7 +480,7 @@ def op_blijvende_runner(runs_on, events: set[str] | None = None, # this check has been failing on it on master ever since -- which is what # #288 is about in miniature, since the failure was in a step nothing read. ("bench.yml", "benchmark"), - # Found only after Codex pointed out that a pull_request branch filter names + # Found only after review pointed out that a pull_request branch filter names # the base, not the source. Runs on [self-hosted, xfa-corpus] -- a second # persistent machine -- so ubuntu-latest is not the fix here; restricting the # trigger is. @@ -494,7 +494,7 @@ def op_blijvende_runner(runs_on, events: set[str] | None = None, # `pull_request` belongs here, which is not obvious: its `branches:` filter # selects the BASE branch, so `branches: [master]` means "PRs targeting master" # and the workflow still runs from the merge commit -- source branch included. -# Codex caught that; the first version read the filter as proof the code was +# Review caught that; the first version read the filter as proof the code was # already merged, which is the opposite of what a pull request is. # `schedule` is deliberately absent. A scheduled run always takes the workflow # file from the default branch, so the caller cannot choose the body -- unlike diff --git a/scripts/ci/pdfa_output_conformance_gate.py b/scripts/ci/pdfa_output_conformance_gate.py index 18befa1d..55f3a003 100755 --- a/scripts/ci/pdfa_output_conformance_gate.py +++ b/scripts/ci/pdfa_output_conformance_gate.py @@ -73,7 +73,7 @@ 0 every number matches the floor for this platform 1 a number moved, in either direction, a tool disagreed with itself, or mutool could not read a file it was handed -- an unreadable output is - a verdict about the output, not a missing tool (codex, #1617) + a verdict about the output, not a missing tool (review, #1617) 2 the gate could not run at all (missing converter, missing veraPDF) 3 did not judge, and says so: no floor for this platform, or no mutool installed, so retention was never measured @@ -155,7 +155,7 @@ # 3. add "linux" to BLOKKEERT # # Never the other way round: a floor invented on a different platform is worse -# than none, because it looks measured. (codex, #1617) +# than none, because it looks measured. (review, #1617) BLOKKEERT: frozenset[str] = frozenset({"darwin"}) PROFILE = "2b" @@ -237,7 +237,7 @@ class Onleesbaar(Exception): the converter just wrote means the file is not readable, and that is a finding about the file. The first version returned 3 for both, and the workflow reads 3 as "nothing to calibrate against" -- so an output mutool - choked on went green (codex, #1617).""" + choked on went green (review, #1617).""" def __init__(self, path: Path): super().__init__(str(path)) @@ -293,7 +293,7 @@ def behouden_deel(bron: bytes, uit: bytes) -> float: here is 100.8 to 103.3 per cent -- and inside that surplus an output can drop several per cent of the original characters, or replace them with the same number of unrelated ones, and still count as retained. The gate exists - to catch deletion, and a length was never going to see it. (codex, #1617) + to catch deletion, and a length was never going to see it. (review, #1617) Longest-common-subsequence-free and deliberately cheap: walk the source in order and count how much of it can be found, in order, in the output. @@ -489,7 +489,7 @@ def main() -> int: # "every number matched", on a script whose own header says conformance # alone cannot detect content deletion. That is the cannot-run-reported- # as-a-pass fault this gate exists to remove, inside the gate. - # (codex, #1617) + # (review, #1617) print("SKIPPED (not a pass): mutool is not installed, so no text was read " "back and retention was not measured. Conformance alone cannot see " "deleted content, which is the whole reason this gate exists.", diff --git a/scripts/ci/pr_code_stays_off_the_desktop.py b/scripts/ci/pr_code_stays_off_the_desktop.py index bbe83689..c4f7a1a6 100755 --- a/scripts/ci/pr_code_stays_off_the_desktop.py +++ b/scripts/ci/pr_code_stays_off_the_desktop.py @@ -120,7 +120,7 @@ def _judge(key: str, job: dict, fname: str, jname: str, runs_on=None, # nothing is True -- so those three shapes reported "every label is a hosted # image" and passed on the strength of having said nothing. Vacuous green, # the same shape as "empty is not a verdict" one function over. Which runner - # a job takes cannot be read off a field that is not there. (codex, #1649) + # a job takes cannot be read off a field that is not there. (review, #1649) echte = [l for l in labels if isinstance(l, str) and l.strip()] if not echte: return [f"{key} has no readable `runs-on` ({runs_on!r}). Which runner it " @@ -156,7 +156,7 @@ def _judge(key: str, job: dict, fname: str, jname: str, runs_on=None, # alone let an unfiltered `push` count as safe -- including down the # reusable-workflow path, where the inner job's canonical # `event_name == 'push'` expression was then approved. Same finding as - # the branch-filter one, reached through the other door. (codex, #1649) + # the branch-filter one, reached through the other door. (review, #1649) toegestaan = DESKTOP_TOEGESTAAN(triggers) if all(PER_GEBEURTENIS_VEILIG(k, events, toegestaan) for k in kandidaten): return [] @@ -225,7 +225,7 @@ def takes_the_base(step: dict) -> bool: def main() -> int: # GitHub reads .yaml as well. Globbing only .yml meant a workflow named - # unsafe.yaml escaped this guard completely. (codex, #1635) + # unsafe.yaml escaped this guard completely. (review, #1635) files = sorted(list(FLOW.glob("*.yml")) + list(FLOW.glob("*.yaml"))) if len(files) < MINIMUM_WORKFLOWS: # FLOOR print(f"[pr-runner] FATAL: {len(files)} workflow(s) found, floor is " @@ -254,7 +254,7 @@ def main() -> int: # on: [pull_request, push] -> list # on: {pull_request: {...}} -> dict # Only the mapping was handled, so `on: [pull_request]` -- a perfectly - # ordinary spelling -- skipped the whole workflow. (codex, #1635) + # ordinary spelling -- skipped the whole workflow. (review, #1635) on = doc.get("on", doc.get(True)) if isinstance(on, str): events = {on} @@ -300,7 +300,7 @@ def main() -> int: # reusable workflow runs under whatever triggered the # job that calls it, and passing nothing here let # _judge treat a pull_request_target caller as - # eventless and approve it. (codex, #1649) + # eventless and approve it. (review, #1649) problems.extend(_judge(f"{called.name}:{iname}", ijob, called.name, iname, target_only=target_only, @@ -390,7 +390,7 @@ def main() -> int: # The remediation used to print the INVERSE expression -- the very form # finding 3 is about. Guidance that tells you to write what the guard # rejects is worse than no guidance: it is a wrong answer with the - # authority of the tool. (codex, #1635) + # authority of the tool. (review, #1635) print("\n Choose the runner per event, in the form both guards read:\n" " runs-on: ${{ github.event_name == 'push'\n" " && fromJSON('[\"self-hosted\",\"xfa-fast\"]')\n" diff --git a/scripts/ci/schedule_guards_match_their_cron.py b/scripts/ci/schedule_guards_match_their_cron.py index 12c26a3e..0d5a6bcf 100755 --- a/scripts/ci/schedule_guards_match_their_cron.py +++ b/scripts/ci/schedule_guards_match_their_cron.py @@ -13,7 +13,7 @@ Nothing failed. A job whose `if` is false is skipped, and a skipped job is green -- so the fuzzing quietly went away while the workflow kept reporting -success. Codex caught it on #1546. +success. Review caught it on #1546. # NO-FLOOR: it compares two lists inside each file. There is nothing it can # find less of without the file itself being gone. diff --git a/scripts/ci/sweep_merged_build_caches.py b/scripts/ci/sweep_merged_build_caches.py index 3c752ae2..71f39864 100755 --- a/scripts/ci/sweep_merged_build_caches.py +++ b/scripts/ci/sweep_merged_build_caches.py @@ -63,7 +63,7 @@ def run(*args: str) -> tuple[bool, str]: The status is returned rather than folded into an empty string because this script decides whether to DELETE things. "git could not tell me" and "git told me nothing" have to reach the caller as different answers: read as the - same, an unreadable index makes a worktree look clean. (codex, #1634) + same, an unreadable index makes a worktree look clean. (review, #1634) """ r = subprocess.run(["git", *args], capture_output=True, text=True, env=clean_env()) @@ -76,7 +76,7 @@ def a_build_may_be_running() -> tuple[bool, str]: A failed `ps` used to read as "no build is running", which is the one answer that lets --sweep delete a target/ from under a live rustc -- the 25-08 corruption. When the process table cannot be read the honest answer is that - we do not know, and not knowing must not authorise deletion. (codex, #1634) + we do not know, and not knowing must not authorise deletion. (review, #1634) """ r = subprocess.run(["ps", "-Ao", "args="], capture_output=True, text=True) if r.returncode != 0 or not r.stdout.strip(): @@ -142,7 +142,7 @@ def main(argv: list[str]) -> int: ["git", "-C", str(wt), "merge-base", "--is-ancestor", head, args.base], capture_output=True, env=clean_env()).returncode == 0 # An unreadable index is not a clean worktree. Folding the two together - # is how uncommitted work gets deleted. (codex, #1634) + # is how uncommitted work gets deleted. (review, #1634) ok_status, status = run("-C", str(wt), "status", "--porcelain") if not ok_status: kept.append((wt, "git status could not be read here")); continue @@ -177,7 +177,7 @@ def main(argv: list[str]) -> int: # Only what actually went away is counted. ignore_errors=True used to # swallow permission failures, after which the script printed "removed" and # reported the whole pre-scan size as freed -- a number describing a - # deletion that had not happened. (codex, #1634) + # deletion that had not happened. (review, #1634) freed, failed = 0, [] for size, target in freeable: try: diff --git a/scripts/ci/test_a_baseline_names_the_machine.py b/scripts/ci/test_a_baseline_names_the_machine.py index a99a6096..6537aee2 100644 --- a/scripts/ci/test_a_baseline_names_the_machine.py +++ b/scripts/ci/test_a_baseline_names_the_machine.py @@ -206,7 +206,7 @@ def calibration_that_expired(root: pathlib.Path) -> None: def calibration_dated_in_the_future(root: pathlib.Path) -> None: """A date nobody could have measured on. It must be named as such: without the check the entry counts as live, and the guard still goes red -- on the - floor -- so this case also asserts the reason (codex, #1622).""" + floor -- so this case also asserts the reason (review, #1622).""" path = root / "benchmarks" / "BASELINE_HARDWARE.toml" path.write_text(path.read_text().replace( 'runner_label = "xfa-fast"\nreachable = true\ncalibrated = false\ncalibrated_on = ""', diff --git a/scripts/ci/test_a_deletion_declares_itself.py b/scripts/ci/test_a_deletion_declares_itself.py index 63401e66..b84bbe56 100644 --- a/scripts/ci/test_a_deletion_declares_itself.py +++ b/scripts/ci/test_a_deletion_declares_itself.py @@ -121,7 +121,7 @@ def expect(what: str, ok: bool, detail: str = "") -> None: # The trailer was chosen over a register file precisely because it travels # with the deletion through rebase and cherry-pick; accepting it anywhere # in the range lets the two come apart in exactly those operations. - # (codex, #1635) + # (review, #1635) expect("a trailer on a LATER commit does not count", r.returncode == 1, f"exit {r.returncode}") expect("and it says the trailer is on the wrong commit", @@ -143,7 +143,7 @@ def expect(what: str, ok: bool, detail: str = "") -> None: # first parent that merge removes every path the PR removes, and its # generated message carries no trailer -- so it became the last deleter of # everything and a correctly declared deletion failed. An ordinary merge on - # master has the same shape. (codex, #1635) + # master has the same shape. (review, #1635) with tempfile.TemporaryDirectory() as d: wd = repo(Path(d)) run(wd, "rm", "-q", "doomed.txt") @@ -171,7 +171,7 @@ def expect(what: str, ok: bool, detail: str = "") -> None: # core.quotePath is on by default, so git spells a path outside ASCII as # "runs/\316\262.md" while the trailer carries the literal one. The two # spellings never matched: a correct declaration was reported as undeclared - # AND misplaced at once. This repo already tracks such paths. (codex, #1635) + # AND misplaced at once. This repo already tracks such paths. (review, #1635) BETA = "runs/D\u03b2\u03b3.md" with tempfile.TemporaryDirectory() as d: wd = repo(Path(d)) @@ -206,7 +206,7 @@ def expect(what: str, ok: bool, detail: str = "") -> None: # merge deletion outright reported such a commit as undeclared AND misplaced # at once. The discriminator is the other parents: absent in any parent means # the merge inherited it; present in all of them means the merge did it. - # (codex, #1635) + # (review, #1635) with tempfile.TemporaryDirectory() as d: wd = repo(Path(d)) (wd / "x.txt").write_text("topic\n") @@ -241,7 +241,7 @@ def expect(what: str, ok: bool, detail: str = "") -> None: # A push reports where the branch WAS. Deriving a merge base from it loses # anything added between the common ancestor and that tip, so a force-push - # that drops such a file reported nothing at all. (codex, #1635) + # that drops such a file reported nothing at all. (review, #1635) with tempfile.TemporaryDirectory() as d: wd = repo(Path(d)) (wd / "later.txt").write_text("added after the ancestor\n") @@ -266,7 +266,7 @@ def expect(what: str, ok: bool, detail: str = "") -> None: # A force-push whose new history never had the file: nothing in base..head # can be its "last deleter", so the trailer had nowhere valid to go and a - # deliberate removal could not be declared at all. (codex, #1635) + # deliberate removal could not be declared at all. (review, #1635) with tempfile.TemporaryDirectory() as d: wd = repo(Path(d)) (wd / "later.txt").write_text("added after the ancestor\n") @@ -299,7 +299,7 @@ def expect(what: str, ok: bool, detail: str = "") -> None: # A git command that FAILS must not read as "nothing found". With a bad # --head the diff exited non-zero, stdout was empty, and the guard reported - # OK having compared nothing. (codex, #1635) + # OK having compared nothing. (review, #1635) # # This case proves the PAIR of return-code checks, not either alone: # measured, disabling only the diff check leaves it green, because the log @@ -328,7 +328,7 @@ def expect(what: str, ok: bool, detail: str = "") -> None: # A declaration attached to a deletion that was later undone. The trailer is # real, the commit that carried it really did delete the file -- and none of - # that is true of the deletion standing at the tip. (codex, #1635) + # that is true of the deletion standing at the tip. (review, #1635) with tempfile.TemporaryDirectory() as d: wd = repo(Path(d)) run(wd, "rm", "-q", "doomed.txt") diff --git a/scripts/ci/test_a_fixture_cannot_touch_a_real_repo.py b/scripts/ci/test_a_fixture_cannot_touch_a_real_repo.py index 79efcd7e..706dbb4e 100755 --- a/scripts/ci/test_a_fixture_cannot_touch_a_real_repo.py +++ b/scripts/ci/test_a_fixture_cannot_touch_a_real_repo.py @@ -123,7 +123,7 @@ def run(root: pathlib.Path) -> subprocess.CompletedProcess: # The config surface is not the whole surface: git DISCOVERS a repository by # walking up from cwd, so a fixture run from inside a real checkout writes to # that checkout's .git/config no matter what the global config says. A lint reads -# the call and approves it. (codex, #1647) +# the call and approves it. (review, #1647) def local_config() -> str: """The repository's own config, read through git. diff --git a/scripts/ci/test_a_gate_that_never_went_green.py b/scripts/ci/test_a_gate_that_never_went_green.py index 1ebe462e..667ddddb 100755 --- a/scripts/ci/test_a_gate_that_never_went_green.py +++ b/scripts/ci/test_a_gate_that_never_went_green.py @@ -187,7 +187,7 @@ def wf(naam, runs_in, green_in, runs_all=None, green_all=None, state="active", # ...but GitHub switching a scheduled workflow off after sixty quiet days is # nobody's decision, and it can happen once this repository is public. The # first version excused every non-active state and would have approved a - # scheduled gate that had gone dark. (codex, #1610) + # scheduled gate that had gone dark. (review, #1610) ("disabled by inactivity is not an excuse", [wf("stil.yml", 40, 0, state="disabled_inactivity")], True), # The queries must be scoped to the default branch. Dead on master, green on diff --git a/scripts/ci/test_branches_have_a_merge_request.py b/scripts/ci/test_branches_have_a_merge_request.py index 8f5d9b2b..094d17ff 100755 --- a/scripts/ci/test_branches_have_a_merge_request.py +++ b/scripts/ci/test_branches_have_a_merge_request.py @@ -16,7 +16,7 @@ The other one that matters is the pre-push ref list. The guard promised "the next push fails" while reading a tracking ref that a renaming refspec never -creates, so the promise could not come true (codex, #1610). Cases 4 to 6 feed +creates, so the promise could not come true (review, #1610). Cases 4 to 6 feed the guard the lines git hands a pre-push hook and require it to act on them: fail when the remote has the branch and no request exists, ask `gh` for the remote's name and not the local one, and stay quiet only while the remote sha diff --git a/scripts/ci/test_cargo_target_health.sh b/scripts/ci/test_cargo_target_health.sh index 671367aa..3302b21d 100755 --- a/scripts/ci/test_cargo_target_health.sh +++ b/scripts/ci/test_cargo_target_health.sh @@ -56,7 +56,7 @@ fresh_target() { } # `--sweep` refuses while any cargo-family process is alive anywhere on the host -# (codex, #1621: the GitLab jobs pass CARGO_TARGET_DIR through the environment, +# (review, #1621: the GitLab jobs pass CARGO_TARGET_DIR through the environment, # so a command-line scan misses them). The suite therefore has to say what `ps` # reports, or these cases pass or fail on whether this machine happens to be # building right now -- which is not a test of anything. @@ -71,7 +71,7 @@ SWEEP_IDLE=(env "PATH=${IDLE}:${PATH}") # This case used to assert exit 0, which pinned the defect rather than the # behaviour: six workflows call this script and not shared_build_dir_is_there.sh, # so on the morning the mount vanished the step they all rely on reported a pass -# and cargo walked into the broken path. (codex, #1616) +# and cargo walked into the broken path. (review, #1616) case_ out="$(CARGO_TARGET_DIR="${WORK}/never-existed" bash "${BENCH}/cargo_target_health.sh" 2>&1)"; rc=$? grep -q 'FATAL' <<<"${out}" || fail "a missing configured build directory is not announced: ${out}" @@ -170,7 +170,7 @@ case_ grep -q 'is clean' <<<"${out}" || fail "a clean directory was not reported clean: ${out}" # --- the default is report-only, because a snapshot cannot promise no build -# starts between the check and the delete (codex, #1621) ------------------ +# starts between the check and the delete (review, #1621) ------------------ t="$(fresh_target reportonly)"; : > "${t}/debug/live.part.bin" case_ out="$(CARGO_TARGET_DIR="${t}" bash "${BENCH}/cargo_target_health.sh" 2>&1)" diff --git a/scripts/ci/test_feature_gated_tests_run.py b/scripts/ci/test_feature_gated_tests_run.py index f6bd8571..a39c8855 100755 --- a/scripts/ci/test_feature_gated_tests_run.py +++ b/scripts/ci/test_feature_gated_tests_run.py @@ -77,7 +77,7 @@ # T1 daarom een feature-vlag wég in plaats van hem te verklaren. De bewaker had # gelijk en zijn enige uitweg zat achter andermans deur. # -# Het TOML-bestand is in .claude/territories.toml uitgezonderd van t2, dus +# Het TOML-bestand is in de territoriumkaart uitgezonderd van t2, dus # niemand claimt het en iedereen mag het bewerken. GAPS = REPO / "scripts" / "ci" / "feature_gaps.toml" @@ -116,7 +116,7 @@ def toegestaan() -> dict[tuple[str, str], str]: # test gates its whole file -- and the previous pattern required `#[`, so a # crate-level gate was invisible. Also matches a feature named anywhere inside # the cfg, so `cfg(all(test, feature = "x"))` counts; requiring `feature` to -# come first missed every compound condition (Codex, #1583). +# come first missed every compound condition (review, #1583). CFG_FEATURE = re.compile(r'#!?\[cfg\([^)]*?feature\s*=\s*"([^"]+)"') TEST_ATTRIBUUT = re.compile(r"#\[(?:[\w:]+::)?test\b") CFG_NOT_FEATURE = re.compile(r'#\[cfg\(\s*not\(\s*feature\s*=\s*"([^"]+)"') diff --git a/scripts/ci/test_gate_corpus_no_crash.py b/scripts/ci/test_gate_corpus_no_crash.py index 359c7f49..90345e1a 100644 --- a/scripts/ci/test_gate_corpus_no_crash.py +++ b/scripts/ci/test_gate_corpus_no_crash.py @@ -9,7 +9,7 @@ The gate's budget existed and was compared once the pool had drained. A corpus where every file hangs would therefore be reported about an hour in -- 500 files, 30 s each, four at a time -- which is after the job itself has been -killed, and a killed job reports nothing (codex, #1627). This drives the gate +killed, and a killed job reports nothing (review, #1627). This drives the gate with a binary that never returns and a budget of one second, and requires the verdict within seconds. diff --git a/scripts/ci/test_license_gate.py b/scripts/ci/test_license_gate.py index e3e5dea4..f69c68f5 100755 --- a/scripts/ci/test_license_gate.py +++ b/scripts/ci/test_license_gate.py @@ -61,7 +61,7 @@ # filesystems -- so a same-length mutation and restore inside one second can # execute the cached mutated gate and report that the test caught something it # never ran. That is the false green this block exists to prevent, one layer -# deeper than the fix I first wrote. Codex found it; my version was incomplete. +# deeper than the fix I first wrote. Review found it; my version was incomplete. # # Compiling the source text directly cannot consult a cache at all. sys.dont_write_bytecode = True diff --git a/scripts/ci/test_pdfa_output_conformance_gate.py b/scripts/ci/test_pdfa_output_conformance_gate.py index b5375de0..9b49962e 100755 --- a/scripts/ci/test_pdfa_output_conformance_gate.py +++ b/scripts/ci/test_pdfa_output_conformance_gate.py @@ -27,7 +27,7 @@ Absent must be the announced skip, exit 3. Refusing a file must be exit 1 with that file named: the first version returned 3 for both, and the workflow reads 3 as "nothing to calibrate against", so an unreadable output shipped green -(codex, #1617). +(review, #1617). Exit codes: 0 the gate accepts what it should and rejects what it should @@ -195,7 +195,7 @@ def main() -> int: # A platform we do NOT gate on has nothing to be measured against, so # failing every run on evidence we do not have would make this a # permanent red. It measures, prints the numbers to record, and says it - # did not judge: exit 3. (codex, #1617) + # did not judge: exit 3. (review, #1617) case( "an ungated platform with no floor announces, and does not judge", dict(FLOOR), diff --git a/scripts/ci/test_sweep_fails_safe.py b/scripts/ci/test_sweep_fails_safe.py index cc727b88..5edac4ce 100755 --- a/scripts/ci/test_sweep_fails_safe.py +++ b/scripts/ci/test_sweep_fails_safe.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -"""The sweeper must fail safe, not fail clean (#1634, codex). +"""The sweeper must fail safe, not fail clean (#1634, review). Every case here is a FAILURE the script used to read as permission to delete: `ps` unreadable meant "no build running", `git status` unreadable meant "clean", @@ -118,10 +118,10 @@ def g(*a, cwd=r): # The first version of this case made the removal fail with chmod. As root, or # with CAP_DAC_OVERRIDE -- which many CI containers run with -- rmtree ignores # the mode, the target is deleted, both assertions fail and the cleanup raises -# FileNotFoundError on a path that is already gone. Codex reproduced it as root. +# FileNotFoundError on a path that is already gone. Review reproduced it as root. # A fixture that fails-as-intended only on one machine measures something else # everywhere else, so the failure is injected directly and depends on no -# filesystem permission at all. (codex, #1641) +# filesystem permission at all. (review, #1641) with tempfile.TemporaryDirectory() as d: r = repo_with_worktree(pathlib.Path(d)) (r / "target" / "more.bin").write_text("z" * 2048) @@ -174,7 +174,7 @@ def refuses_to_delete(path, *a, ignore_errors=False, **k): # The floor was declared and never compared: len(fails) counts only what FAILED, # so deleting cases -- or skipping them by accident -- left the gate green while # the suite shrank. A floor that is not compared is a comment, and this one was -# meant to prevent exactly that. (codex, #1641) +# meant to prevent exactly that. (review, #1641) if ran < MINIMUM_CASES: print(f" FATAL: {ran} assertions ran, floor is {MINIMUM_CASES}. Cases have " "gone missing; a smaller suite passing is not the same as this suite " diff --git a/scripts/ci/test_the_commit_msg_hook_is_wired.py b/scripts/ci/test_the_commit_msg_hook_is_wired.py index 5558763b..ab1a06e0 100755 --- a/scripts/ci/test_the_commit_msg_hook_is_wired.py +++ b/scripts/ci/test_the_commit_msg_hook_is_wired.py @@ -113,7 +113,7 @@ def run(root, env, *args): # gate -- and `test_the_commit_msg_hook_is_wired.py`, the line that runs THIS # file, contains it. So deleting the guard's own invocation left the suite # green: the assertion that the skipped layer still had a home was satisfied by -# the test asserting it. (codex, #1660) +# the test asserting it. (review, #1660) aanroepen = gate_aanroepen("the_commit_msg_hook_is_wired.py") expect("the local gate still calls the guard itself", len(aanroepen) == 1, f"matched {len(aanroepen)} line(s): {aanroepen}") diff --git a/scripts/ci/test_the_licence_policy_says_what_it_must.py b/scripts/ci/test_the_licence_policy_says_what_it_must.py index 6f1eb284..4d996867 100755 --- a/scripts/ci/test_the_licence_policy_says_what_it_must.py +++ b/scripts/ci/test_the_licence_policy_says_what_it_must.py @@ -99,7 +99,7 @@ def f(text: str) -> str: # The permitting list is an attack surface too: `allowed` is tested before # `weak_copyleft`, so a weak licence there is acceptable even where the weak set -# is empty. (codex, #1656) +# is empty. (review, #1656) r = run_with(lambda t: set_list(t, "allowed", ["MPL-2.0"] + read_list(t, "allowed"))) expect("a weak-copyleft licence in allowed FAILS", r.returncode == 1, f"exit={r.returncode}") @@ -146,7 +146,7 @@ def blind_evaluator(root: pathlib.Path) -> None: # The other way an evaluator stops honouring it: DELETE the forbidden branch. # Every forbidden licence then falls through to "not classified" -- also False, # so a check that only asked "is it refused" saw agreement. False is the absence -# of a verdict, not a verdict. (codex, #1656) +# of a verdict, not a verdict. (review, #1656) with tempfile.TemporaryDirectory() as td: root = pathlib.Path(td) / "repo" (root / "scripts" / "ci").mkdir(parents=True) diff --git a/scripts/ci/test_workflow_inputs_are_not_shell.py b/scripts/ci/test_workflow_inputs_are_not_shell.py index 1c05fb15..80c5dfa8 100755 --- a/scripts/ci/test_workflow_inputs_are_not_shell.py +++ b/scripts/ci/test_workflow_inputs_are_not_shell.py @@ -71,7 +71,7 @@ def vullen(aantal: int) -> dict[str, str]: ("event-inputs", "${{ github.event.inputs.crate }}", True), ("head-ref", "${{ github.head_ref }}", True), # A tag may be called `v1.2.$(id)`; ref_name hands over what is left after - # the prefix. Codex, #1540. + # the prefix. review, #1540. ("ref-name", "${{ github.ref_name }}", True), ("pr-title", "${{ github.event.pull_request.title }}", True), ("issue-body", "${{ github.event.issue.body }}", True), diff --git a/scripts/ci/the_fork_register_is_verifiable.py b/scripts/ci/the_fork_register_is_verifiable.py index 1b88dc24..2d989ee7 100755 --- a/scripts/ci/the_fork_register_is_verifiable.py +++ b/scripts/ci/the_fork_register_is_verifiable.py @@ -419,7 +419,7 @@ def refresh_for(clone: Path, commits: list[str], upstream_url: str) -> str | Non # Not swallowed. Ignoring it made version_at() treat a still-missing # commit as a bad register entry and return 1 -- so a network outage was # reported as bad fork data and sent the reader at the wrong problem. - # (Codex, #1609.) + # (review, #1609.) return f"could not refresh {clone.name}: {out.stderr.strip()[:200]}" return None diff --git a/scripts/ci/the_licence_policy_says_what_it_must.py b/scripts/ci/the_licence_policy_says_what_it_must.py index 0cb85392..75f1c5e9 100755 --- a/scripts/ci/the_licence_policy_says_what_it_must.py +++ b/scripts/ci/the_licence_policy_says_what_it_must.py @@ -78,7 +78,7 @@ # # Same shape as the four spellings of the head ref (#1636): a list of names # where a class belongs. So the family is generated, and a spelling nobody -# typed here is an error rather than a hole. (codex, #1656) +# typed here is an error rather than a hole. (review, #1656) # Not anchored at the start, because a licence field is an EXPRESSION and a # name can be embedded in one: `MIT OR GPL-3.0-only` is a disjunction whose # second operand is the GPL, and `LicenseRef-AGPL-3.0` is the family wearing a @@ -100,7 +100,7 @@ # # Fourth time in this file that a list of the spellings I happened to know sat # where a class belonged. So: a family, and any member appearing in `allowed` -# is refused whatever its spelling. (codex, #1656) +# is refused whatever its spelling. (review, #1656) SURFACE_BEPERKT = { "LGPL": re.compile(r"(? int: # The comment on MOET_OVERIG_VERBODEN says an eighth entry is "a deliberate # edit to code that goes through review" -- and nothing made that true. A # sentence describing a rule is not the rule, which is the failure this file - # has now produced five times. (codex, #1656) + # has now produced five times. (review, #1656) # MUST_FORBID is a REASONS table and asserts nothing on its own, so a name # that lives only there is a name nothing requires -- it would be subtracted # from the unknown set below and then never checked for presence. Latent @@ -245,7 +245,7 @@ def main() -> int: # with toegestaan() returning True. Worse, license_gate builds the cargo # weak set as the UNION of every surface, so naming it on `editor` alone # makes it acceptable for all 786 cargo packages. A family checked on one - # list is a family that moves to another. (codex, #1656) + # list is a family that moves to another. (review, #1656) per_lijst = [("licenses.allowed", allowed), ("licenses.weak_copyleft", weak)] for surface, blok in (pol.get("surfaces") or {}).items(): if isinstance(blok, dict): @@ -292,7 +292,7 @@ def main() -> int: # mechanism by which MPL-2.0 is permitted in one place and not another. # Measured: with MPL-2.0 added to `allowed`, toegestaan() returns True for a # surface with weak_allowed=set(), and False without it. The per-surface - # control is simply skipped. (codex, #1656) + # control is simply skipped. (review, #1656) for name in sorted(allowed & weak): problems.append( f"{name} is in BOTH allowed and weak_copyleft. `allowed` is tested " @@ -332,7 +332,7 @@ def main() -> int: # only asked "is it refused" reported agreement while the evaluator # had stopped consulting the list at all. That is precisely the # regression this guard exists for, and it was the one thing it - # could not see. (codex, #1656) + # could not see. (review, #1656) problems.append( f"{name} is refused for the wrong reason: {reason!r}. It is on " "the forbidden list, so the evaluator should say so -- being " diff --git a/scripts/ci/wasm_target_matches_the_pin.py b/scripts/ci/wasm_target_matches_the_pin.py index e060c167..bc30618d 100755 --- a/scripts/ci/wasm_target_matches_the_pin.py +++ b/scripts/ci/wasm_target_matches_the_pin.py @@ -54,7 +54,7 @@ def stappen(tekst: str): Not a single regex over `uses:` followed immediately by `with:`. A step may put `if:`, `id:` or `name:` between the two, and a pattern that expects them adjacent then finds no `with:` block, misses the `targets:` inside it, and - passes the step. Codex caught that on #1539 -- a false negative in the guard + passes the step. Review caught that on #1539 -- a false negative in the guard itself, which is the failure this whole family of checks exists to prevent. The step runs from its `uses:` line to the next line at or left of its own @@ -114,7 +114,7 @@ def main() -> int: # Derived from the checked-out ref rather than written out. # expensive-validation.yml runs against an arbitrary branch or # tag whose rust-toolchain.toml may pin something else, so a - # literal here would be wrong one step removed. Codex raised + # literal here would be wrong one step removed. Review raised # this on #1539. continue elif tc.group(1) != kanaal: diff --git a/scripts/ci/workflow_inputs_are_not_shell.py b/scripts/ci/workflow_inputs_are_not_shell.py index 7d5d3542..38b5f3d8 100755 --- a/scripts/ci/workflow_inputs_are_not_shell.py +++ b/scripts/ci/workflow_inputs_are_not_shell.py @@ -66,7 +66,7 @@ | \bgithub\.head_ref\b # A branch name is free text and so is a tag name. `github.ref_name` strips # the prefix and hands over whatever is left, so a tag called - # `v1.2.$(id)` reaches a shell as a command. Codex raised this on #1540; + # `v1.2.$(id)` reaches a shell as a command. Review raised this on #1540; # I had left it out because it appears in many run-blocks and I could not # tell which were real. The answer is that they are all real. | \bgithub\.ref_name\b @@ -79,7 +79,7 @@ # Steps checked by hand whose value cannot carry shell metacharacters. A dict # rather than a set, so the reason has somewhere to live: with a set there was # nowhere to put it and the comment asking for one was the only thing enforcing -# it, which is to say nothing was. (Codex, #1540) +# it, which is to say nothing was. (review, #1540) EXEMPT: dict[tuple[str, str, str], str] = {} diff --git a/scripts/infra/mirror_to_gitlab.sh b/scripts/infra/mirror_to_gitlab.sh index e7247ed1..2d99578e 100755 --- a/scripts/infra/mirror_to_gitlab.sh +++ b/scripts/infra/mirror_to_gitlab.sh @@ -20,7 +20,7 @@ # or from the pre-push gate's report, plus `scripts/ci/mirror_has_not_drifted.py` # in the landing lane -- which turns a mirror nobody pushed into a red gate in # front of the next person landing, rather than into silence. The reason is in -# docs/ci/mirror.md and the roles are in CLAUDE.md. +# docs/ci/mirror.md and the roles are in the project's contributor instructions. # # WHAT IT REFUSES # diff --git a/scripts/release/release_train.py b/scripts/release/release_train.py index 631658de..efc26e68 100755 --- a/scripts/release/release_train.py +++ b/scripts/release/release_train.py @@ -129,7 +129,7 @@ def fetch_live_version(channel_key: str, ch: dict, endpoints: dict) -> tuple[str import subprocess try: r = subprocess.run( - ["security", "find-internet-password", "-a", "claude-pdfluent-api", "-w"], + ["security", "find-internet-password", "-a", "pdfluent-api", "-w"], capture_output=True, text=True, check=True) pat = r.stdout.strip() except Exception: diff --git a/scripts/worker-prompt.md b/scripts/worker-prompt.md index ba7c6f3e..111e9077 100644 --- a/scripts/worker-prompt.md +++ b/scripts/worker-prompt.md @@ -62,7 +62,7 @@ Update je worker-bestand: ## Regels - **GEEN** bestanden aanpassen die niet in `affected_files` staan, tenzij noodzakelijk voor compilatie -- **GEEN** commits met "Co-Authored-By: Claude" of verwijzingen naar Claude +- **GEEN** commits met automatische co-author-trailers of verwijzingen naar assistenten - **WEL** `cargo fmt` en `cargo clippy -- -D warnings` voor elke commit - **WEL** alleen de specifieke veraPDF regels uit de taak fixen - Als een taak te complex is of je vast zit, zet status op `"failed"` met uitleg in `result` diff --git a/tools/pdfluent-snippet-extract/tests/roundtrip.rs b/tools/pdfluent-snippet-extract/tests/roundtrip.rs index bf64f26e..c68d8272 100644 --- a/tools/pdfluent-snippet-extract/tests/roundtrip.rs +++ b/tools/pdfluent-snippet-extract/tests/roundtrip.rs @@ -152,7 +152,7 @@ fn dry_run_does_not_write_file() { #[test] fn offline_without_fetched_flag_is_rejected() { - // Codex P1 on PR #1275: defaulting to today's date breaks the + // review P1 on PR #1275: defaulting to today's date breaks the // drift-guard on the day after extraction. Offline runs now // require an explicit `--fetched`. let (cache, manifest, out) = seed_case("no-fetched");