[newhoggy]

Description

Re-pins the vendored @atlaskit/adf-schema snapshot from 57.6.21 to 57.7.39 (the newest upstream release reported on the issue), so the adf-schema-drift job stops reporting "Version changed: true". The upstream full.json is byte-identical to the vendored one (SHA-256 5128562b…ff66fbe), so this is a provenance-only refresh with no content-model, attribute or mark changes — the same shape as #2199.

Closes #2221

Plan: #2221 (comment) (no departures).

Type of Change

• Dependency update

Changes Made

Core Changes:

• assets/adf-schema/provenance.json: version, tarball URL and tarball SHA-256 → 57.7.39 (full_json_sha256 unchanged; full.json untouched).
• src/atlassian/adf_schema/generated.rs: regenerated with adf-schema-codegen (only UPSTREAM_VERSION and UPSTREAM_TARBALL_SHA256 change).
• src/atlassian/adf_schema.rs: SCHEMA_VERSION → 57.7.39-2026-11-10, UPSTREAM_TARBALL_SHA256 and the doc-comment verification URL updated. CONTENT_ENTRIES unchanged.

Testing

Automated Testing:

• All existing tests pass

Verification (all run in this worktree, and the codegen check and adf_schema tests re-run after the rebase on origin/main):

• Downloaded the 57.7.39 tarball: SHA-256 1118a1da…97865c matches the drift report; extracted full.json is identical to the vendored one.
• cargo run --bin adf-schema-codegen -- --check → OK
• cargo test --lib atlassian::adf_schema → 106 passed
• cargo test --test adf_schema_test → 13 passed
• ./scripts/build.sh → all checks passed
• omni-dev git commit message lint --strict origin/main..HEAD → 0 errors, 0 warnings
• python3 scripts/changelog.py check-pr --base origin/main → fragment requirement waived by the Changelog: none trailer

Review

code-review (medium) found no bugs. Two low-severity design notes were skipped: SCHEMA_VERSION and UPSTREAM_TARBALL_SHA256 are duplicated across adf_schema.rs, generated.rs and provenance.json. That is the existing, documented design (the binary carries its own provenance), and the existing consistency test in adf_schema.rs already asserts the constants agree, so deriving them is out of scope here.

Checklist

• I have performed a self-review of my own code
• I have added a changelog fragment or a Changelog: none <reason> commit trailer
• New and existing unit tests pass locally with my changes
• No performance impact
• No security implications
• No special deployment requirements

[github-actions]

Coverage

Total: 97.25% ⚪ 0 pp vs main

Comparing 71ebf6e..f3298f8 (merge-base → PR head)

No per-file coverage changes vs main.

🔇 56 ignored region(s), 0 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
src/claude/client.rs	ignore	815-827	both	process-bound: hardcodes SystemEnv with no injectable seam (unlike create_default_claude_client_with's tested Default arm, which this mirrors) and has no in-crate caller; testing it would mean mutating real process env for shared credential vars
src/cli.rs	ignore	202	both	process-bound: the command opens a real network or daemon connection, or reads the real stdin and credentials, so a test cannot dispatch it; each command is covered through its own run_* seams
src/cli.rs	ignore	206	both	process-bound: the command opens a real network or daemon connection, or reads the real stdin and credentials, so a test cannot dispatch it; each command is covered through its own run_* seams
src/cli.rs	ignore	210	both	process-bound: the command opens a real network or daemon connection, or reads the real stdin and credentials, so a test cannot dispatch it; each command is covered through its own run_* seams
src/cli.rs	ignore	218	both	process-bound: the command opens a real network or daemon connection, or reads the real stdin and credentials, so a test cannot dispatch it; each command is covered through its own run_* seams
src/cli.rs	ignore	219	both	process-bound: the command opens a real network or daemon connection, or reads the real stdin and credentials, so a test cannot dispatch it; each command is covered through its own run_* seams
src/cli/ai/jev/route.rs	ignore	176-251	both	RouteCommand::execute is the process-bound wiring shell; fetch_docs, run_route_with_reference_fetch_failures, render_output_with_style and terminal_style_with provide its deterministic seams
src/cli/ai/jev/route.rs	ignore	325-330	both	the SystemEnv/stdout probe is process-bound; terminal_style_with is exhaustively covered through its injected environment and TTY seam
src/cli/ai/jev/route.rs	ignore	882	both	guards this test's assumption; the parse above always fails on --ignore-closed with --allow-closed
src/cli/ai/jev/route.rs	ignore	914	both	guards this test's assumption; the parse above always fails on a malformed --ladder-definition
src/cli/ai/jev/verify_decision.rs	ignore	89-142	both	VerifyDecisionCommand::execute is the process-bound wiring shell; fetch_input and run_verify provide its deterministic seams
src/cli/claude_wrap.rs	ignore	160-170	both	process-bound wiring shell: it joins this process's own stdin/stdout and reads the real OMNI_DEV_CLAUDE_WRAP_LOG, which a test must not take over (see the note on run/wrap in the tests module); wrap_io_diagnostics beneath it is covered directly
src/cli/claude_wrap.rs	ignore	716-720	both	resolve_socket fails only when the platform has no data directory to put the default socket in (no resolvable home), which a test cannot reproduce on macOS or Linux; the fail-open return is what keeps the wrapper forwarding
src/cli/claude_wrap.rs	ignore	773-777	both	to_value on an ObserveRequest fails only for a non-UTF-8 cwd, and the tracker takes cwd from a JSON string, so it is always UTF-8; the arm exists so a future non-string field cannot silently drop the report
src/cli/claude_wrap/diagnostics.rs	ignore	60	both	Builder::spawn fails only when the OS refuses a new thread (resource exhaustion), which a test cannot provoke; the fail-open return is what keeps the wrapper forwarding
src/cli/sessions.rs	ignore	273-276	both	resolve_socket fails only when the platform has no data directory to put the default socket in (no resolvable home), which a test cannot reproduce on macOS or Linux; the sink is fail-open by design, so this is the same silent return as every other skipped hook
src/cli/sessions.rs	ignore	283	both	wire returns None only through the serialization failure ignored in wire() itself (a non-UTF-8 cwd, which a hook payload cannot carry), so this arm is unreachable for the same reason
src/cli/sessions.rs	ignore	403-410	both	to_value on an ObserveRequest fails only for a non-UTF-8 cwd, and the hook payload's cwd is deserialized from a JSON string, so it is always UTF-8; the arm exists so a future non-string field cannot silently drop the report
src/cli/sessions.rs	ignore	3529	both	the arm above always matches: parse() above always parses an install-hooks argv into SessionsSubcommands::InstallHooks
src/cli/sessions.rs	ignore	3533	both	the arm above always matches: parse() above always parses an uninstall-hooks argv into SessionsSubcommands::UninstallHooks
src/cli/worktrees/ui/terminal/pty.rs	ignore	314-321	both	the closure runs only in the forked child between fork and exec, and exec discards that process's coverage counters before they can be flushed, so llvm-cov reports 0 hits on these lines however often the tests run it (CI measured the whole body uncovered on PR #2169); the reset is checked by behaviour instead, in the_well_behaved_test_passes_when_the_test_process_ignores_sighup
src/daemon.rs	ignore	175	both	path resolution fails only without a data dir, which the daemon cannot start without; same arm as the PR cache above
src/daemon/services/worktrees/closed.rs	ignore	119	both	spawn_blocking only fails if the closure panics, which nothing in it can do
src/daemon/services/worktrees/closed.rs	ignore	366	both	needs 99 live worktrees sharing one directory name; the suffix loop is covered by a_name_held_by_a_live_worktree_gets_a_suffix
src/daemon/services/worktrees/divergence.rs	ignore	348	both	only runs if a started computation never sets its flag within 2s, which fails the calling test; a passing run never takes it
src/github_issues.rs	ignore	579	both	validated by the citation parser; every ItemRef reaching here already has a project of the form owner/repo
src/github_metrics/incremental.rs	ignore	1207	both	guards this test's assumption; the last attempt treats a raced search as a file not found, so it always plans
src/jev/citations.rs	ignore	127	both	unreachable: both call sites (find_citations, first_citation) already filtered out the only alternative with no numbered group (other_url) via number_end before calling this
src/jev/exists.rs	ignore	190	both	Child::kill returns Ok for a child that has exited but not been reaped, and wait() only runs after this call, so only an OS-level failure such as EPERM reaches this arm; it exists so that failure is logged rather than silently dropped
src/jev/route.rs	ignore	310	both	defensive: the embedded questions YAML always has all three stage keys, pinned by stage_questions_are_the_tested_wording
src/jev/route.rs	ignore	320	both	defensive: every embedded stage question is a choice question, pinned by stage_questions_are_the_tested_wording
src/jev/route.rs	ignore	328	both	defensive: no embedded or custom tier is ever named none, the one fixed criterion (stage_design's no-design-work option)
src/jev/route.rs	ignore	1804	both	unreachable: https is a special scheme per the WHATWG URL spec, so a URL that already passed the scheme check above can never be cannot-be-a-base and path_segments() is always Some
src/jev/route.rs	ignore	1970	both	assert_eq!'s message args are only evaluated on failure, and this test always passes
src/jev/route.rs	ignore	1980	both	assert_eq!'s message args are only evaluated on failure, and this test always passes
src/jev/route.rs	ignore	1981	both	assert_eq!'s message args are only evaluated on failure, and this test always passes
src/jev/route.rs	ignore	3369	both	guards this test helper against misuse; every call site below passes an already-routed outcome
src/jev/route.rs	ignore	3575	both	guards this test's assumption; the mocked response above always answers with a routed outcome
src/jev/route.rs	ignore	3639	both	guards this test's assumption; the mocked response above always leaves gemini's answers missing
src/mcp/browser_tools.rs	ignore	150-152	both	process-bound: reached only after BridgeClient::send gets a reply from a live bridge on a local port, which the unit tests do not run; the serializer call is a plain to_string over the already-parsed envelope
src/mcp/transcript_tools.rs	ignore	153-155	both	network-bound: reached only after Youtube::info fetches a real video page, which a unit test must not do; the serializer call is a plain to_string
src/mcp/transcript_tools.rs	ignore	162-164	both	network-bound: reached only after Youtube::list_languages fetches a real video page, which a unit test must not do; the serializer call is a plain to_string
src/request_log.rs	ignore	725	both	a blocking flock only fails on EINTR/ENOLCK, which a test cannot provoke; the fallback writes unlocked, as the best-effort contract requires
src/sessions/watcher.rs	ignore	148-151	both	read_dir yields an Err entry only on an I/O fault (EIO, a vanished directory mid-iteration), which a test cannot provoke; the scan counts it and moves on, the same handling as the unreadable project directory below
src/sessions/watcher.rs	ignore	159-162	both	read_dir yields an Err entry only on an I/O fault (EIO, a vanished directory mid-iteration), which a test cannot provoke; the scan counts it and moves on, the same handling as the unreadable project directory above
src/sessions/watcher.rs	ignore	174-177	both	DirEntry::metadata does not follow symlinks, so it fails only when the entry vanished between read_dir and the stat, a race a test cannot provoke; the scan counts it and moves on
src/sessions/watcher.rs	ignore	183-186	both	Metadata::modified fails only on a platform with no mtime, and every supported one (Linux, macOS) has it
src/sessions/watcher.rs	ignore	250-254	both	spawn_blocking's JoinError needs the scan closure to panic or the runtime to shut down mid-scan; scan has no panicking path, and the runtime outlives the watcher, whose token is cancelled first
src/utils/secret_env.rs	ignore	927-935	both	the loop above runs this 4 times and every mode fails the same way; verified locally that llvm-cov still reports 0 hits on the matches!( line — a region-attribution artifact on the nested assert!/matches! macro call, not an untested path
src/utils/secret_env.rs	ignore	1357	both	exercised by strip_test_modules_ignores_braces_in_literals_and_comments's '{' char literal; verified locally that llvm-cov still reports 0 hits — a region-attribution artifact on this closing brace, not an untested path
src/utils/secret_env.rs	ignore	1412	both	only runs if an unregistered secret-shaped literal exists; the assert below that unknown is empty is this test's whole point, so a passing run never takes this branch
src/utils/secret_env.rs	ignore	1470-1472	both	only runs if a registered secret is read through a plain accessor outside this module; offenders.is_empty() below is this test's whole point
src/utils/secret_env.rs	ignore	1516	both	only runs if a _FILE companion collides with an existing variable; collisions.is_empty() below is this test's whole point
src/utils/secret_env.rs	ignore	1545	both	only runs if a stray file names the companion; strays.is_empty() below is this test's whole point
src/utils/secret_env/command.rs	ignore	281-290	both	try_wait on a live, owned child fails only if waitpid itself errors (ECHILD/EINTR from outside the process); no in-process test can provoke it, and the arm only reaps and reports
src/utils/settings.rs	ignore	888-890	both	process-bound: binds the real process env and the settings file on disk; get_env_vars_with is the tested core

Touched files absent from every coverage report (2)

• assets/adf-schema/provenance.json
• src/atlassian/adf_schema/generated.rs

These files may contain no executable code or may have been omitted from the coverage run.

Patch coverage

No new executable lines added by this diff.

_{📦 Full per-file coverage summary · run summary}