feat(client): display and gate on provisional evidence tier (P6) - #115
Conversation
VersionEntry gains optional evidence_tier/deferral_reason, parsed from
the registry index (absence means proven, per the two-tier model).
- numan info: shows "evidence: provisional — <reason>" under a
provisional version (falls back to "reason not recorded" if
deferral_reason is empty/missing).
- numan search: appends a " [provisional]" marker to the displayed
version's row.
- numan install: prints a one-time notice ("has not been
lifecycle-tested... passed integrity checks") right after a
provisional package installs successfully (not on the
already-installed no-op path).
Ref: docs/plans/2026-08-09-intake-process-reform.md (P6)
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
📜 Recent review details⏰ Context from checks skipped due to timeout. (7)
🧰 Additional context used📓 Path-based instructions (13)**/*📄 CodeRabbit inference engine (CLAUDE.md)
Files:
**/*.{js,jsx,ts,tsx,py,java,go,rs,rb,php,c,cpp,h,hpp,cs,swift,kt,kts}📄 CodeRabbit inference engine (CLAUDE.md)
Files:
!**/.env,!**/credentials.json,!**/*.pem📄 CodeRabbit inference engine (CLAUDE.md)
Files:
**/*.rs📄 CodeRabbit inference engine (CONTRIBUTING.md)
Files:
**/*.{rs,toml}📄 CodeRabbit inference engine (CONTRIBUTING.md)
Files:
**/*.{rs,nu}📄 CodeRabbit inference engine (CONTRIBUTING.md)
Files:
**/*.{rs,md}📄 CodeRabbit inference engine (CONTRIBUTING.md)
Files:
**/*.{rs,md,toml}📄 CodeRabbit inference engine (CONTRIBUTING.md)
Files:
src/cmd/**/*.rs📄 CodeRabbit inference engine (AGENTS.md)
Files:
src/core/**/*.rs📄 CodeRabbit inference engine (AGENTS.md)
Files:
tests/**/*.rs📄 CodeRabbit inference engine (AGENTS.md)
Files:
src/core/{trust.rs,official_registry.rs,registry.rs}📄 CodeRabbit inference engine (AGENTS.md)
Files:
src/install/**/*.rs📄 CodeRabbit inference engine (AGENTS.md)
Files:
🔍 Remote MCP DeepWiki, GitHub CopilotAdditional review context
🔇 Additional comments (10)
📝 WalkthroughWalkthroughChangesProvisional Version Evidence
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 7 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (7 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
✨ Simplify code
Warning Review ran into problems🔥 ProblemsLinked repositories: Public OSS repositories can only analyze public repositories installed in this organization. Analyzed Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @tonythethompson, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
PR Summary by QodoAdd provisional evidence tier support (P6) to info/search/install
AI Description
Diagram
High-Level Assessment
Files changed (9)
|
Greptile SummaryThe PR adds typed provisional-evidence metadata to registry versions and consistently exposes it in package information, search results, and successful installation output.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| src/core/package.rs | Adds typed evidence tiers and a sanitized deferral-reason formatter; the previous blank-reason issue is fixed for missing, empty, whitespace-only, and control-character-containing values. |
| src/cmd/info.rs | Displays provisional evidence using the shared sanitized fallback, completing the fix requested by the previous review thread. |
| src/cmd/search.rs | Adds a provisional marker derived from the same version entry used for the displayed version label. |
| src/install/transaction.rs | Prints the sanitized provisional notice after a successful installation while preserving the intentional already-installed short circuit. |
Reviews (2): Last reviewed commit: "Merge branch 'master' into feat/p6-provi..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6d3894dd88
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/cmd/search.rs`:
- Line 151: Remove the narrative comment above the row-suffix definition in the
search command; keep the suffix implementation and surrounding behavior
unchanged.
In `@src/core/package.rs`:
- Around line 115-130: The VersionEntry evidence_tier field currently accepts
arbitrary strings and silently treats unsupported values as proven. Introduce an
EvidenceTier enum with serde representations for “proven” and “provisional”,
change VersionEntry.evidence_tier to Option<EvidenceTier>, and update
is_provisional() accordingly while preserving None as the legacy proven value.
Add a deserialization test confirming an unsupported tier is rejected.
In `@src/install/transaction.rs`:
- Around line 411-419: Ensure every install path, including cache hits, verifies
cache_file against artifact_sha256 before extraction by routing through the
existing integrity verification flow or equivalent comparison. Only print the
lifecycle-tested warning in the resolved.is_provisional() block after
verification succeeds, and prevent corrupted artifacts from reaching extraction.
In `@tests/install_test.rs`:
- Around line 140-141: Extend the install integration tests around the
evidence_tier and deferral_reason fixture to cover a newly installed provisional
entry and the already-installed no-op path. Assert the provisional warning
includes the fallback reason and is emitted only after a successful new
installation, while the no-op path produces no warning.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 6aa9f7da-5349-4e84-9c86-ecb9149685bd
📒 Files selected for processing (9)
src/cmd/info.rssrc/cmd/search.rssrc/cmd/try_cmd.rssrc/core/package.rssrc/core/registry.rssrc/core/resolve.rssrc/install/transaction.rstests/install_test.rstests/support/active_update/mod.rs
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
tonythethompson/QuickShell(manual)tonythethompson/numan(manual)tonythethompson/dependency-chain-substrate(manual)
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Greptile Review
⚠️ CI failures not shown inline (2)
GitHub Actions: Trigger Kiro Crew / 0_trigger _ trigger-agent.txt: feat(client): display and gate on provisional evidence tier (P6)
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m: "${***REDACTED_SECRET_ASSIGNMENT*** missing}"�[0m
�[36;1m: "${***REDACTED_SECRET_ASSIGNMENT*** missing}"�[0m
�[36;1m: "${GATEWAY_URL:?KIRO_GATEWAY_URL missing}"�[0m
�[36;1m�[0m
�[36;1mif [ -n "${GATEWAY_ORIGIN:-}" ]; then�[0m
�[36;1m ORIGIN="$GATEWAY_ORIGIN"�[0m
�[36;1melse�[0m
�[36;1m ORIGIN=$(printf '%s' "$GATEWAY_URL" | sed -E 's#(https?://[^/]+).*#\1#')�[0m
�[36;1mfi�[0m
�[36;1mREPO_SHORT="${REPO##*/}"�[0m
�[36;1mSESSION_KEY="hook:github:${REPO_SHORT}:${EVENT}:${RUN_ID}"�[0m
�[36;1m�[0m
�[36;1mONE_OFF=""�[0m
�[36;1mif [ -n "${ONE_OFF_RAW// }" ]; then�[0m
�[36;1m ONE_OFF=$(printf '%s' "$ONE_OFF_RAW" | sed -E 's|^[[:space:]]*/[Kk][Ii][Rr][Oo][Cc][Rr][Ee][Ww][[:space:]]*||')�[0m
�[36;1m ONE_OFF=$(printf '%s' "$ONE_OFF" | sed -E 's|/kirocrew||Ig' | sed -E 's/^[[:space:]]+//;s/[[:space:]]+$//')�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mif [ -n "${PR_NUMBER}" ]; then�[0m
�[36;1m COMMENT_TARGET="Leave a single GitHub PR comment on ${REPO}#${PR_NUMBER} (gh pr comment ${PR_NUMBER})."�[0m
�[36;1m PR_LABEL="PR #${PR_NUMBER}"�[0m
�[36;1melse�[0m
�[36;1m COMMENT_TARGET="If an open PR contains commit ${SHA}, comment on that PR; otherwise leave a commit comment on ${SHA}."�[0m
�[36;1m PR_LABEL=""�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mMSG=$(jq -nr \�[0m
�[36;1m --arg prefix "$MESSAGE_PREFIX" \�[0m
�[36;1m --arg event "$EVENT" \�[0m
�[36;1m --arg repo "$REPO" \�[0m
�[36;1m --arg ref "$REF" \�[0m
�[36;1m --arg sha "$SHA" \�[0m
�[36;1m --arg run_id "$RUN_ID" \�[0m
�[36;1m --arg run_url "$RUN_URL" \�[0m
�[36;1m --arg pr_number "$PR_NUMBER" \�[0m
�[36;1m --arg pr_label "$PR_LABEL" \�[0m
�[36;1m --arg daytona "$DAYTONA_OS" \�[0m
�[36;1m --arg one_off "$ONE_OFF" \�[0m
�[36;1m --arg comment_url "$COMMENT_URL" \�[0m
�[36;1m --arg comment_target "$COMMENT_TARGET" \�[0m
�[36;1m '�[0m
�[36;1m def nl: "\n";�[0m
�[36;1m (if ($prefix | length) > 0 then $prefix ...
GitHub Actions: Trigger Kiro Crew / trigger _ trigger-agent: feat(client): display and gate on provisional evidence tier (P6)
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m: "${***REDACTED_SECRET_ASSIGNMENT*** missing}"�[0m
�[36;1m: "${***REDACTED_SECRET_ASSIGNMENT*** missing}"�[0m
�[36;1m: "${GATEWAY_URL:?KIRO_GATEWAY_URL missing}"�[0m
�[36;1m�[0m
�[36;1mif [ -n "${GATEWAY_ORIGIN:-}" ]; then�[0m
�[36;1m ORIGIN="$GATEWAY_ORIGIN"�[0m
�[36;1melse�[0m
�[36;1m ORIGIN=$(printf '%s' "$GATEWAY_URL" | sed -E 's#(https?://[^/]+).*#\1#')�[0m
�[36;1mfi�[0m
�[36;1mREPO_SHORT="${REPO##*/}"�[0m
�[36;1mSESSION_KEY="hook:github:${REPO_SHORT}:${EVENT}:${RUN_ID}"�[0m
�[36;1m�[0m
�[36;1mONE_OFF=""�[0m
�[36;1mif [ -n "${ONE_OFF_RAW// }" ]; then�[0m
�[36;1m ONE_OFF=$(printf '%s' "$ONE_OFF_RAW" | sed -E 's|^[[:space:]]*/[Kk][Ii][Rr][Oo][Cc][Rr][Ee][Ww][[:space:]]*||')�[0m
�[36;1m ONE_OFF=$(printf '%s' "$ONE_OFF" | sed -E 's|/kirocrew||Ig' | sed -E 's/^[[:space:]]+//;s/[[:space:]]+$//')�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mif [ -n "${PR_NUMBER}" ]; then�[0m
�[36;1m COMMENT_TARGET="Leave a single GitHub PR comment on ${REPO}#${PR_NUMBER} (gh pr comment ${PR_NUMBER})."�[0m
�[36;1m PR_LABEL="PR #${PR_NUMBER}"�[0m
�[36;1melse�[0m
�[36;1m COMMENT_TARGET="If an open PR contains commit ${SHA}, comment on that PR; otherwise leave a commit comment on ${SHA}."�[0m
�[36;1m PR_LABEL=""�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mMSG=$(jq -nr \�[0m
�[36;1m --arg prefix "$MESSAGE_PREFIX" \�[0m
�[36;1m --arg event "$EVENT" \�[0m
�[36;1m --arg repo "$REPO" \�[0m
�[36;1m --arg ref "$REF" \�[0m
�[36;1m --arg sha "$SHA" \�[0m
�[36;1m --arg run_id "$RUN_ID" \�[0m
�[36;1m --arg run_url "$RUN_URL" \�[0m
�[36;1m --arg pr_number "$PR_NUMBER" \�[0m
�[36;1m --arg pr_label "$PR_LABEL" \�[0m
�[36;1m --arg daytona "$DAYTONA_OS" \�[0m
�[36;1m --arg one_off "$ONE_OFF" \�[0m
�[36;1m --arg comment_url "$COMMENT_URL" \�[0m
�[36;1m --arg comment_target "$COMMENT_TARGET" \�[0m
�[36;1m '�[0m
�[36;1m def nl: "\n";�[0m
�[36;1m (if ($prefix | length) > 0 then $prefix ...
🧰 Additional context used
📓 Path-based instructions (13)
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
**/*: Use Serena's semantic, symbol-aware tools as the primary tools for reading and editing code; use built-in Read, Glob, Grep, and Edit only under the stated exceptions.
Before editing a code file, inspect its symbol overview, read the specific symbols being changed, and edit them with Serena's symbol-aware tools.
Understand the existing code before changing it and make the smallest change that satisfies the request; avoid unrelated cleanup, premature abstractions, unnecessary error handling, feature flags, and compatibility shims.
Prefer editing existing files over creating new ones, and never create Markdown or README files unless explicitly requested.
For exploratory questions, provide a 2–3 sentence recommendation with the main tradeoff and do not implement until the user agrees.
For UI or frontend changes that cannot be tested in a browser, explicitly state that browser testing was not performed rather than claiming success.
Address security issues when discovered, including injection, XSS, SQL injection, path traversal, and secret leaks.
Pause and obtain confirmation before destructive, hard-to-reverse, externally visible, or third-party-upload actions, including deleting files or branches, dropping tables, force-pushing, modifying CI/CD, posting externally, or uploading content.
When blocked, investigate the root cause instead of bypassing it with --no-verify, --force, or deletion; investigate unfamiliar files, branches, and configuration before deleting them.
Only commit when explicitly asked; do not proactively update git configuration or push changes.
Do not skip Git hooks unless explicitly asked; if a pre-commit hook fails, fix the issue, re-stage, and create a new commit rather than amending.
Stage files by name rather than using git add -A or git add ., to avoid accidentally including secrets or large binaries.
Use a HEREDOC for commit messages, and add co-author attribution only when the user explicitly requests the exact trailer.
Do not force-pus...
Files:
src/core/registry.rssrc/cmd/try_cmd.rssrc/cmd/info.rssrc/install/transaction.rssrc/core/resolve.rssrc/core/package.rstests/install_test.rstests/support/active_update/mod.rssrc/cmd/search.rs
**/*.{js,jsx,ts,tsx,py,java,go,rs,rb,php,c,cpp,h,hpp,cs,swift,kt,kts}
📄 CodeRabbit inference engine (CLAUDE.md)
Add comments only when the WHY is non-obvious; do not narrate what the code does, reference the current task, or reference the PR in comments.
Files:
src/core/registry.rssrc/cmd/try_cmd.rssrc/cmd/info.rssrc/install/transaction.rssrc/core/resolve.rssrc/core/package.rstests/install_test.rstests/support/active_update/mod.rssrc/cmd/search.rs
!**/.env,!**/credentials.json,!**/*.pem
📄 CodeRabbit inference engine (CLAUDE.md)
Do not commit files that appear to contain secrets, including .env, credentials.json, and PEM files; warn before doing so even if explicitly requested.
Files:
src/core/registry.rssrc/cmd/try_cmd.rssrc/cmd/info.rssrc/install/transaction.rssrc/core/resolve.rssrc/core/package.rstests/install_test.rstests/support/active_update/mod.rssrc/cmd/search.rs
**/*.rs
📄 CodeRabbit inference engine (CONTRIBUTING.md)
**/*.rs: Use the Rust 2021 edition.
Useanyhow::Resultwith.context(...)in application code; usethiserrorfor library error types that callers match on.
Useclapderive macros for CLI definitions.
Useserdewithserde_jsonortomlfor serialization.
Function parameters must use&Path, not&PathBuf.
Library code must not panic; error paths should returnanyhow::Resultwith context where appropriate.
Add or update tests for behavior changes, including relevant failure paths.
New mutating code paths must acquire the mutation lock viaacquire_mutation_lock(root)and snapshot the lockfile before writes.
Lockfile, journal, and state-file JSON writes must usewrite_json_atomic.
numan installmust write only to$NUMAN_ROOT; it must not invoke Nu or register plugins/autoloads.
Onlyactivateanddeactivatemay modify Nu integration state.
Treat the lockfile as the authoritative source of truth; derived projections such as autoload state must not be authoritative.
Install payloads under versioned, content-addressed paths and never overwrite them in place.
Never overwrite foreign autoload files; respectOWNERSHIP_MARKER.
Pass plugin paths through environment variables only; do not use runtime interpolation in Nu program strings.
**/*.rs: All CI gates must pass:cargo test,cargo clippy -- -D warnings, andcargo fmt --check.
Every mutating command—includinginstall,remove,update,gc, and futurenupm import—must callacquire_mutation_lock(root).
Lockfiles, journals, and state files must usewrite_json_atomic; partial writes are not allowed.
Pending activation, autoload, and lifecycle journals must be stored under$NUMAN_ROOT/state/.
Module autoload identity must match all four fields: Nu executable hash, Nu version, vendor autoload directory, and managed file path; the lockfilemodule_activationvalue is authoritative.
Never overwrite foreign autoload files; respectOWNERSHIP_MARKER.
Pass paths to Nu only throu...
Files:
src/core/registry.rssrc/cmd/try_cmd.rssrc/cmd/info.rssrc/install/transaction.rssrc/core/resolve.rssrc/core/package.rstests/install_test.rstests/support/active_update/mod.rssrc/cmd/search.rs
**/*.{rs,toml}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Run and keep
cargo fmt/rustfmtclean, and ensurecargo clippy -- -D warningspasses.
Files:
src/core/registry.rssrc/cmd/try_cmd.rssrc/cmd/info.rssrc/install/transaction.rssrc/core/resolve.rssrc/core/package.rstests/install_test.rstests/support/active_update/mod.rssrc/cmd/search.rs
**/*.{rs,nu}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
**/*.{rs,nu}: Real-Nu acceptance tests must be marked#[ignore]and should be run when changes affect activation or nupm import; unit tests must not spawn realnuand should use injectable seams such asFakeCandidateRunneror registrars.
The nupm integration must be read-only towardNUPM_HOME, must not executebuild.nu, and must not perform bidirectional synchronization.Unit tests must use
FakeCandidateRunneror injectable registrars and must not spawn a realnuprocess.
Files:
src/core/registry.rssrc/cmd/try_cmd.rssrc/cmd/info.rssrc/install/transaction.rssrc/core/resolve.rssrc/core/package.rstests/install_test.rstests/support/active_update/mod.rssrc/cmd/search.rs
**/*.{rs,md}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Match existing naming, module layout, and documentation level in the file being edited; update
AGENTS.md,docs/, or command help when structure, conventions, or user-visible behavior changes.Tests must cover failure modes, not only successful execution.
Files:
src/core/registry.rssrc/cmd/try_cmd.rssrc/cmd/info.rssrc/install/transaction.rssrc/core/resolve.rssrc/core/package.rstests/install_test.rstests/support/active_update/mod.rssrc/cmd/search.rs
**/*.{rs,md,toml}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Use the repository's established serialization and module conventions rather than introducing unrelated refactors.
Files:
src/core/registry.rssrc/cmd/try_cmd.rssrc/cmd/info.rssrc/install/transaction.rssrc/core/resolve.rssrc/core/package.rstests/install_test.rstests/support/active_update/mod.rssrc/cmd/search.rs
src/core/**/*.rs
📄 CodeRabbit inference engine (AGENTS.md)
Derive the platform triple from compile-time
#[cfg(target_env)]values, notstd::env::consts;LIBCmust be a compile-time constant.
Files:
src/core/registry.rssrc/core/resolve.rssrc/core/package.rs
src/core/{trust.rs,official_registry.rs,registry.rs}
📄 CodeRabbit inference engine (AGENTS.md)
Verify Ed25519 signatures over the exact
index.jsonbytes; use the built-in production trust root for theofficialregistry. Unsigned bypass is allowed only withNUMAN_ALLOW_UNSIGNED=1for development.
Files:
src/core/registry.rs
src/cmd/**/*.rs
📄 CodeRabbit inference engine (AGENTS.md)
Pass Nu paths and names through environment variables (
NUMAN_PLUGIN_BINARY,NUMAN_PLUGIN_CONFIG, andNUMAN_PLUGIN_NAME); the Nu program string must be a compile-time constant with no runtime interpolation.
Files:
src/cmd/try_cmd.rssrc/cmd/info.rssrc/cmd/search.rs
src/install/**/*.rs
📄 CodeRabbit inference engine (AGENTS.md)
src/install/**/*.rs: Plugin binary artifacts must include a SHA256; the install transaction must fail whensha256is missing.
Installation must remain inert: it may write only to$NUMAN_ROOTand must not perform Nu integration.
Files:
src/install/transaction.rs
tests/**/*.rs
📄 CodeRabbit inference engine (AGENTS.md)
Test platform-specific behavior with mock platforms, and use injected fakes rather than real Nu for unit tests.
Files:
tests/install_test.rstests/support/active_update/mod.rs
🔍 Remote MCP DeepWiki, GitHub Copilot
Additional review context
- The client contract is paired with open
numan-registry#64: the registry schema addsevidence_tier(proven/provisional) anddeferral_reason;add-package.py --provisionalemits both fields. The currentmainschema does not yet contain these properties and usesadditionalProperties: false. - Registry signatures cover the canonical JSON for the entire index. Adding these fields changes signed bytes, so published indexes must be re-signed; the client verifier still accepts
schema_version: 1. searchmarks the resolver-selected displayed version, whileinstallresolves the version and returns before the warning on the already-installed no-op path.- The registry-side tooling treats a missing provisional reason as a non-fatal warning, and the client displays
reason not recorded; the schema description calls the reason required but does not conditionally enforce that requirement. - PR checks show tests, formatting, Clippy, MSRV, CodeQL, and platform acceptance succeeding. A
trigger / trigger-agentcheck failed, and Greptile review was still in progress. The PR explicitly states that install-warning output lacks a dedicated test.
🔇 Additional comments (7)
src/cmd/info.rs (1)
82-88: LGTM!Also applies to: 172-173, 208-234
src/cmd/try_cmd.rs (1)
471-472: LGTM!src/core/registry.rs (1)
409-410: LGTM!src/core/resolve.rs (1)
729-730: LGTM!Also applies to: 748-749, 1062-1063
tests/install_test.rs (1)
386-387: LGTM!Also applies to: 470-471, 542-543
tests/support/active_update/mod.rs (1)
509-510: LGTM!src/cmd/search.rs (1)
2-2: LGTM!Also applies to: 104-115, 152-158, 271-272, 358-375
Code Review by Qodo
1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Qodo FixerNo findings are within the configured fix scope. To change which findings are fixed, adjust the setting on your Qodo configuration page. |
|
Addressed in e3b5675 (pushed): merged latest master (resolved struct-literal conflicts with P1's Not fixed, flagged as out of scope for this PR: the cache-hit integrity-bypass comment on |
1 participant
Summary
VersionEntrygains optionalevidence_tier: Option<String>anddeferral_reason: Option<String>(both#[serde(default)], backward compatible), plus anis_provisional()helper (evidence_tier == Some("provisional"); absent means proven).numan info: showsevidence: provisional — <reason>under a provisional version (reason not recordedifdeferral_reasonis empty/absent).numan search: appends a[provisional]marker to the displayed version's row (extracted as a small pureprovisional_marker()helper for testability, mirroringformat_row_status).numan install: prints a one-time notice ("This package has not been lifecycle-tested. It passed integrity checks.") right after a provisional package installs successfully — not on the already-installed no-op short-circuit.Test plan
cargo build— cleancargo test— 668+ passed across lib and all integration binaries, 0 failedcargo fmt --check— cleanVersionEntry::is_provisional()(absent/proven/provisional),numan infoevidence line (with reason / without reason / omitted when proven),provisional_marker()(Some-provisional / Some-proven / None)Not separately tested: the
numan installprintln itself (a straightforward guard on the already-testedis_provisional()predicate; the codebase doesn't capture stdout forinstall_package's other status lines either).Ref:
docs/plans/2026-08-09-intake-process-reform.md(P6, innuman-registry/ADR PR #113 context).🤖 Generated with Claude Code