Skip to content

refactor(advisory): drop discoveryLenses and report unjudged batch candidates as gaps - #66

Merged
timbrinded merged 2 commits into
masterfrom
refactor/simplify
Oct 29, 2026
Merged

timbrinded merged 2 commits into
masterfrom
refactor/simplify

Conversation

@timbrinded

Copy link
Copy Markdown
Owner

Summary

  • Remove the discoveryLenses field: no code read it, and the verified category replaced it.
  • When the batch verifier gives a candidate no verdict, or more than one, that candidate's Verify branch now fails. The report goes incomplete and lists the candidate in its coverage. Before, the candidate became NOT_SUBSTANTIATED with the finder's lens category and the report still said complete. In code-review, that unverified category could promote a merged finding to bug.
  • The batch verdict schema now accepts only the batch's own candidateIds, and exactly one verdict per candidate. pi rejects an omitted, extra or mistyped verdict while the verifier can still fix it. A repeated ID still passes the schema, so a runtime check catches it.
  • Merged impacts drop repeated lines, so merging A, B, A no longer gives A\nB\nA.
  • The verifier prompt and the category description now refer to the candidate's initial category, not to a discovery lens the record no longer carries.

Test plan

  • bun run typecheck
  • bun run test (679 pass)
  • The updated batching and dedupe tests fail on the previous source and pass on this branch.

A batch verifier verdict that is missing or repeated for a candidate now
fails that candidate's Verify branch. Before, the candidate became
NOT_SUBSTANTIATED with the finder's lens category while the report still
read complete, and in code-review that unverified category could promote
a merged finding to bug. The report is now incomplete and lists each
unjudged candidate in its coverage.

The batch schema pins candidateId to the batch's IDs and the verdict
count to the batch size, so pi rejects an omitted, extra or mistyped
verdict while the verifier can still correct it; only a repeated ID gets
past the schema to the runtime check.

Merged impacts are deduplicated by line, so a third duplicate no longer
repeats an impact the first merge already joined. The verifier prompt and
category description name the initial category instead of a discovery
lens the record no longer carries.
Copilot AI balanced review requested due to automatic review settings October 29, 2026 09:19
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 29, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
🔒 Security Review ✅ Completed 2026-10-29T09:20:53.389475Z a8eda0c PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

@timbrinded
timbrinded merged commit cce31fc into master Oct 29, 2026
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants