Fix the seven review findings left open on #3590
User description
Follow-up to #3590: fixes the seven review threads that were left open so the #3590 merge was not held up. Rebased onto main after #3590 merged.
| Thread | Fix |
|---|---|
tests/worker-lease-transition-contract.test.ts | The contract test now checks that the selected deadline is attached by .abortSignal(...) on the .rpc(...) builder. Before, it only checked that the strings appeared somewhere in the adapter. |
docs/governance-incident-runbooks.md | The runbook now sets the variables the app actually reads: RAG_PERSIST_RAW_QUERY_TEXT, RAG_PERSIST_ANSWER_TEXT and OPENAI_STORE_RESPONSES. |
scripts/deploy/write-release-manifest.mjs | Uses the same candidate order as resolveDeploymentCommitSha, and takes the first candidate that is a valid SHA. |
scripts/ops-digest.mjs | Accepts any positive gap of up to six hours, so a manual run between scheduled runs no longer breaks the evidence run. |
scripts/trivy-image-scan.mjs | Downloads the database again when the cached one has passed its NextUpdate time, or when the cached copy is missing or unreadable. If that download fails, the scan fails. |
src/lib/roster/alerts/dispatch.ts | An open-shift offer that reached at least one recipient is recorded as delivered. A replay therefore no longer resends it to everyone. |
src/lib/teaching/repository.ts | A non-organiser who revokes by occurrence, when someone else created one of the links, now gets teaching_role_denied and nothing is revoked. Before, some links were revoked and the call still returned {}. A non-organiser can still revoke their own link by its token. |
No migrations and no RAG ranking files are touched.
RAG impact: no retrieval behaviour change. No retrieval or ranking files are touched.
Tests: I added regression tests for each fix except the runbook. npx vitest run passed 110 of 110 across the 8 affected test files. verify:cheap could not run in the session worktree, because its installed dependencies do not match the lockfile. I am re-running it in a fresh checkout.
🤖 Generated with Claude Code
Summary by cubic
Implements the seven review-follow-up fixes left open on #3590, rebased onto main after that PR merged. No RAG retrieval behaviour changes.
Fixes
- The worker lease contract test now proves the selected deadline is attached to the RPC builder, not merely present in the adapter text.
- The incident runbook now disables the persistence variables the app actually reads (
RAG_PERSIST_RAW_QUERY_TEXT,RAG_PERSIST_ANSWER_TEXT,OPENAI_STORE_RESPONSES). - The release manifest resolves the commit SHA in the same candidate order as
resolveDeploymentCommitSha, skipping invalid values. - The ops digest now requires contiguous evidence from adjacent hourly buckets, so a manual run between scheduled runs no longer counts toward the window.
trivy-image-scan.mjsrefreshes its cached vulnerability database onceNextUpdatehas passed or the cache is partial (missing or unreadable metadata included); a failed refresh fails the scan, and the Java database is refreshed on its own when missing or stale.- Open-shift offers now track delivery per recipient in a new
roster_open_post_alert_deliveriestable, so a replay retries only the recipients who were not reached instead of resending to everyone. - A non-organiser revoking by occurrence is refused when any link was created by someone else; only their own link can be revoked by token.
Regression tests were added for every fix except the runbook; npx vitest run passes all affected tests.
CodeAnt-AI Description
Fix duplicate shift alerts, partial teaching-link revocations, and stale vulnerability scans
What Changed
- A partially delivered open-shift offer is recorded as delivered, so a replay does not resend it to everyone.
- Revoking teaching display links by occurrence now revokes all active links or none; non-organisers are refused if any link was created by someone else.
- Vulnerability scans refresh missing, unreadable, or expired databases and fail if a refresh fails, rather than using stale data.
- Manual operations runs can count toward consecutive evidence when no more than six hours apart. Release manifests skip invalid commit values, and the incident runbook now uses the correct privacy-control settings.
Impact
✅ No duplicate open-shift offers after partial delivery
✅ No partial unauthorised teaching-link revocations
✅ Scans avoid using expired vulnerability data
✅ More reliable release and incident evidence
💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
@codeant-ai ask: Your question here
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
@codeant-ai ask: Can you suggest a safer alternative to storing this secret?
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
@codeant-ai: Your feedback here
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
@codeant-ai: Do not flag unused imports.
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
@codeant-ai: review
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.