Release dev to main

[djm81]

Summary

Promote the current dev branch to main after merging PR #609 (Tighten CI gates and module verification).

Notes

• Source branch: dev
• Target branch: main
• PR Tighten CI gates and module verification #609 merge commit on dev: da416b9

Validation

GitHub Actions will run on this PR.

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 20.61s
Checks: 4 total (1 passed) (3 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 19.70s
Checks: 4 total (1 passed) (3 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 20.24s
Checks: 4 total (1 passed) (3 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 19.82s
Checks: 4 total (1 passed) (3 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 19.77s
Checks: 4 total (1 passed) (3 skipped)

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

tools/semgrep/sast.yml (1)

66-82: ⚡ Quick win

Hardcoded-secret patterns may be broad, but baseline approach mitigates false positives.

Lines 72-73 match any string literal assigned to API_KEY or PASSWORD constants, including empty initialization (API_KEY = ""), placeholders, or environment variable references. This could cause false positives. However, the baseline-gated approach (tools/semgrep/sast-baseline.json with empty accepted_findings) means any findings will be reviewed and either remediated or explicitly accepted before merge.

This is a reasonable starting ruleset for fail-closed SAST gating.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/semgrep/sast.yml` around lines 66 - 82, The hardcoded-secret rule (id:
hardcoded-secret) is too broad and flags placeholders/empty assignments like
API_KEY = "" or env references; narrow the patterns in tools/semgrep/sast.yml by
excluding empty/placeholder values and common env-ref forms and by matching
likely-secret shapes (e.g., require non-empty string of sufficient length or
regex pattern) instead of any string literal; specifically update the pattern
entries for API_KEY and PASSWORD to ignore empty strings and typical
placeholders (""/"REPLACE_ME"/"your_key") and skip patterns that wrap env access
(e.g., os.getenv or process.env) while keeping the rule id and metadata intact
so findings still surface for review.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/specfact_cli/modules/module_registry/src/commands.py`:
- Around line 64-69: The public Typer callback function module_registry_callback
is missing the `@beartype` decorator; add the decorator above its definition
(i.e., annotate module_registry_callback with `@beartype`) and ensure the beartype
symbol is imported (from beartype import beartype) at the module top; keep the
existing `@ensure` (icontract) decorator in place so the function has both `@ensure`
and `@beartype` as required by the public-API guideline.

---

Nitpick comments:
In `@tools/semgrep/sast.yml`:
- Around line 66-82: The hardcoded-secret rule (id: hardcoded-secret) is too
broad and flags placeholders/empty assignments like API_KEY = "" or env
references; narrow the patterns in tools/semgrep/sast.yml by excluding
empty/placeholder values and common env-ref forms and by matching likely-secret
shapes (e.g., require non-empty string of sufficient length or regex pattern)
instead of any string literal; specifically update the pattern entries for
API_KEY and PASSWORD to ignore empty strings and typical placeholders
(""/"REPLACE_ME"/"your_key") and skip patterns that wrap env access (e.g.,
os.getenv or process.env) while keeping the rule id and metadata intact so
findings still surface for review.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 0cf1dded-31f2-482c-9490-53718f0bae51

📥 Commits

Reviewing files that changed from the base of the PR and between 0a5f8d9 and 8b5fd59.

📒 Files selected for processing (17)

• CHANGELOG.md
• openspec/changes/cli-val-05-ci-integration/TDD_EVIDENCE.md
• openspec/changes/cli-val-05-ci-integration/proposal.md
• openspec/changes/cli-val-05-ci-integration/tasks.md
• pyproject.toml
• resources/bundled-module-registry/index.json
• scripts/pre-commit-verify-modules.sh
• setup.py
• src/__init__.py
• src/specfact_cli/__init__.py
• src/specfact_cli/modules/module_registry/module-package.yaml
• src/specfact_cli/modules/module_registry/src/commands.py
• tests/integration/test_bundle_install.py
• tests/unit/scripts/test_pre_commit_verify_modules.py
• tests/unit/workflows/test_trustworthy_green_checks.py
• tools/semgrep/sast-baseline.json
• tools/semgrep/sast.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• nold-ai/specfact-cli-modules (manual)

✅ Files skipped from review due to trivial changes (5)

• src/init.py
• openspec/changes/cli-val-05-ci-integration/proposal.md
• CHANGELOG.md
• openspec/changes/cli-val-05-ci-integration/tasks.md
• openspec/changes/cli-val-05-ci-integration/TDD_EVIDENCE.md

🚧 Files skipped from review as they are similar to previous changes (1)

• pyproject.toml

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

• GitHub Check: Compatibility (Python 3.11)
• GitHub Check: Tests (Python 3.12)
• GitHub Check: Tests (Python 3.12)

🧰 Additional context used

📓 Path-based instructions (11)

**/test_*.py

📄 CodeRabbit inference engine (.cursor/rules/python-github-rules.mdc)

**/test_*.py: Write tests first in test-driven development (TDD) using the Red-Green-Refactor cycle
Ensure each test is independent and repeatable with no shared state between tests
Organize Python imports in tests using unittest.mock for Mock and patch
Use setup_method() for test initialization and Arrange-Act-Assert pattern in test files
Use @pytest.mark.asyncio decorator for async test functions in Python
Organize test files in structure: tests/unit/, tests/integration/, tests/e2e/ by module

Files:

• tests/integration/test_bundle_install.py
• tests/unit/scripts/test_pre_commit_verify_modules.py
• tests/unit/workflows/test_trustworthy_green_checks.py

**/*.py

📄 CodeRabbit inference engine (.cursor/rules/python-github-rules.mdc)

**/*.py: Maintain minimum 80% test coverage, with 100% coverage for critical paths in Python code
Use clear naming and self-documenting code, preferring clear names over comments
Ensure each function/class has a single clear purpose (Single Responsibility Principle)
Extract common patterns to avoid code duplication (DRY principle)
Apply SOLID object-oriented design principles in Python code
Use type hints everywhere in Python code and enable basedpyright strict mode
Use Pydantic models for data validation and serialization in Python
Use async/await for I/O operations in Python code
Use context managers for resource management in Python
Use dataclasses for simple data containers in Python
Enforce maximum line length of 120 characters in Python code
Use 4 spaces for indentation in Python code (no tabs)
Use 2 blank lines between classes and 1 blank line between methods in Python
Organize imports in order: Standard library → Third party → Local in Python files
Use snake_case for variables and functions in Python
Use PascalCase for class names in Python
Use UPPER_SNAKE_CASE for constants in Python
Use leading underscore (_) for private methods in Python classes
Use snake_case for Python file names
Enable basedpyright strict mode with strict type checking configuration in Python
Use Google-style docstrings for functions and classes in Python
Include comprehensive exception handling with specific exception types in Python code
Use logging with structured context (extra parameters) instead of print statements
Use retry logic with tenacity decorators (@retry) for operations that might fail
Use Pydantic BaseSettings for environment-based configuration in Python
Validate user input using Pydantic validators in Python models
Use @lru_cache and Redis-based caching for expensive calculations in Python
Run code formatting with Black (120 character line length) and isort in Python
Run type checking with basedpyright on all Python files
Run linting with ruff and pylint on all Pyth...

Files:

• tests/integration/test_bundle_install.py
• src/specfact_cli/__init__.py
• tests/unit/scripts/test_pre_commit_verify_modules.py
• setup.py
• src/specfact_cli/modules/module_registry/src/commands.py
• tests/unit/workflows/test_trustworthy_green_checks.py

tests/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

Tests must be meaningful and test actual functionality, cover both success and failure cases, be independent and repeatable, and have clear, descriptive names. NO EXCEPTIONS - no placeholder or empty tests.

tests/**/*.py: Trim low-value unit tests when a contract covers the same assertion (type/shape/raises on negative checks)
Delete tests that only assert input validation, datatype/shape enforcement, or raises on negative conditions now guarded by contracts and runtime typing
Convert repeated edge-case permutations into one Hypothesis property with contracts acting as oracles

Secret redaction via LoggerSetup.redact_secrets must be covered by unit tests

Files:

• tests/integration/test_bundle_install.py
• tests/unit/scripts/test_pre_commit_verify_modules.py
• tests/unit/workflows/test_trustworthy_green_checks.py

---

⚙️ CodeRabbit configuration file

tests/**/*.py: Contract-first testing: meaningful scenarios, not redundant assertions already covered by
contracts. Flag flakiness, environment coupling, and missing coverage for changed behavior.

Files:

• tests/integration/test_bundle_install.py
• tests/unit/scripts/test_pre_commit_verify_modules.py
• tests/unit/workflows/test_trustworthy_green_checks.py

@(src|tests)/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

Linting must pass with no errors using: pylint src tests

Files:

• tests/integration/test_bundle_install.py
• src/specfact_cli/__init__.py
• tests/unit/scripts/test_pre_commit_verify_modules.py
• src/specfact_cli/modules/module_registry/src/commands.py
• tests/unit/workflows/test_trustworthy_green_checks.py

**/*.{py,pyi}

📄 CodeRabbit inference engine (.cursorrules)

**/*.{py,pyi}: After any code changes, follow these steps in order: (1) Apply linting and formatting to ensure code quality: hatch run format, (2) Type checking: hatch run type-check (basedpyright), (3) Contract-first approach: Run hatch run contract-test for contract validation, (4) Run full test suite: hatch test --cover -v, (5) Verify all tests pass and contracts are satisfied, (6) Fix any issues and repeat steps until all tests pass
All public APIs must have @icontract decorators and @beartype type checking
Use Pydantic models for all data structures with data validation
Only write high-value comments if at all. Avoid talking to the user through comments

Files:

• tests/integration/test_bundle_install.py
• src/specfact_cli/__init__.py
• tests/unit/scripts/test_pre_commit_verify_modules.py
• setup.py
• src/specfact_cli/modules/module_registry/src/commands.py
• tests/unit/workflows/test_trustworthy_green_checks.py

**/*.{yml,yaml}

📄 CodeRabbit inference engine (.cursor/rules/testing-and-build-guide.mdc)

Validate YAML configuration files locally using hatch run yaml-lint before committing

**/*.{yml,yaml}: Format all YAML and workflow files using hatch run yaml-fix-all before committing
Use Prettier to fix whitespace, indentation, and final newline across YAML files
Use yamllint with the repo .yamllint configuration (line-length 140, trailing spaces and final newline enforced) to lint non-workflow YAML files

Files:

• tools/semgrep/sast.yml
• src/specfact_cli/modules/module_registry/module-package.yaml

src/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

src/**/*.py: All code changes must be followed by running the full test suite using the smart test system.
All Python files in src/ and tools/ directories must have corresponding test files in tests/ directory. If you modify src/common/logger_setup.py, you MUST have tests/unit/common/test_logger_setup.py. NO EXCEPTIONS - even small changes require tests.
All new Python runtime code files must have corresponding test files created BEFORE committing the code. NO EXCEPTIONS - no code without tests.
Test Coverage Validation: Run hatch run smart-test-unit for modified files, hatch run smart-test-folder for modified directories, and hatch run smart-test-full before committing. ALL TESTS MUST PASS.
All components must support TEST_MODE=true environment variable with test-specific behavior defined as: if os.environ.get('TEST_MODE') == 'true': # test-specific behavior
Use src/common/logger_setup.py for all logging via: from common.logger_setup import get_logger; logger = get_logger(name)
Use src/common/redis_client.py with fallback for Redis operations via: from common.redis_client import get_redis_client; redis_client = get_redis_client()
Type checking must pass with no errors using: mypy .
Test coverage must meet or exceed 80% total coverage. New code must have corresponding tests. Modified code must maintain or improve coverage. Critical paths must have 100% coverage.
Use Pydantic v2 validation for all context and data schemas.

Add/update contracts on new or modified public APIs, stateful classes and adapters using icontract decorators and beartype runtime type checks

src/**/*.py: Meaningful Naming — identifiers reveal intent; avoid abbreviations. Identifiers in src/ must use snake_case (modules/functions), PascalCase (classes), UPPER_SNAKE_CASE (constants). Avoid single-letter names outside short loop variables.
KISS — keep functions and modules small and single-purpose. Maximum function length: 120 lines (Phase A error threshold). Maximum cyclomati...

Files:

• src/specfact_cli/__init__.py
• src/specfact_cli/modules/module_registry/src/commands.py

src/specfact_cli/**/*.py

⚙️ CodeRabbit configuration file

src/specfact_cli/**/*.py: Focus on modular CLI architecture: lazy module loading, registry/bootstrap patterns, and
dependency direction. Flag breaking changes to public APIs, Pydantic models, and resource
bundling. Verify @icontract + @beartype on public surfaces; prefer centralized logging
(get_bridge_logger) over print().

Files:

• src/specfact_cli/__init__.py
• src/specfact_cli/modules/module_registry/src/commands.py

**/*.yaml

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

YAML files must pass linting using: hatch run yaml-lint with relaxed policy.

Files:

• src/specfact_cli/modules/module_registry/module-package.yaml

{src/__init__.py,pyproject.toml,setup.py}

📄 CodeRabbit inference engine (.cursor/rules/python-github-rules.mdc)

{src/__init__.py,pyproject.toml,setup.py}: Update src/init.py first as primary source of truth for package version, then pyproject.toml and setup.py
Maintain version synchronization across src/init.py, pyproject.toml, and setup.py

Files:

• setup.py

{pyproject.toml,setup.py,src/__init__.py}

📄 CodeRabbit inference engine (.cursor/rules/testing-and-build-guide.mdc)

Manually update version numbers in pyproject.toml, setup.py, and src/init.py when making a formal version change

Files:

• setup.py

🔀 Multi-repo context nold-ai/specfact-cli-modules

Findings

nold-ai/specfact-cli-modules

• Tests asserting presence/behavior of verify-module-signatures:

  • tests/unit/workflows/test_pr_orchestrator_signing.py:16 — asserts workflow contains "verify-module-signatures". [::nold-ai/specfact-cli-modules::tests/unit/workflows/test_pr_orchestrator_signing.py:16]
  • tests/unit/test_pre_commit_quality_parity.py:13,118-122 — expects verify-module-signatures hook and branch-rule behavior. [::nold-ai/specfact-cli-modules::tests/unit/test_pre_commit_quality_parity.py:13][::nold-ai/specfact-cli-modules::tests/unit/test_pre_commit_quality_parity.py:118-122]

• Spec/docs encoding branch-aware verify semantics (omit/add --require-signature):

  • openspec/specs/ci-integration/spec.md — multiple assertions that CI omits --require-signature for dev and requires it for main. [::nold-ai/specfact-cli-modules::openspec/specs/ci-integration/spec.md:11-63]
  • docs/guides/ci-cd-pipeline.md and docs/authoring/module-signing.md — document same branch rule. [::nold-ai/specfact-cli-modules::docs/guides/ci-cd-pipeline.md:59][::nold-ai/specfact-cli-modules::docs/authoring/module-signing.md:142]

• Workflow files present and verify-module-signatures implementation:

  • .github/workflows/pr-orchestrator.yml — contains the verify-module-signatures job, including checkout/setup steps and logic that appends --require-signature only when target is main (pull_request base or ref_name for pushes). Also exposes outputs like skip_tests_dev_to_main used by downstream jobs. [::nold-ai/specfact-cli-modules::.github/workflows/pr-orchestrator.yml:jobs.verify-module-signatures / jobs.changes]
  • .github/workflows/sign-modules.yml and sign-modules-on-approval.yml exist and are part of signing flow. [::nold-ai/specfact-cli-modules::.github/workflows/sign-modules.yml][::nold-ai/specfact-cli-modules::.github/workflows/sign-modules-on-approval.yml]

• Semgrep SAST gating artifacts and scripts:

  • tools/semgrep/sast-baseline.json referenced in PR summary and repo contains SAST baseline usage (tests/docs expect checked-in config). Hatch/script names referenced by tests. [::nold-ai/specfact-cli-modules::tools/semgrep/sast-baseline.json]
  • scripts/semgrep_sast_gate.py (present in repo list) used to gate Semgrep findings against baseline. [::nold-ai/specfact-cli-modules::scripts/semgrep_sast_gate.py]

• Scripts involved in verification/signing:

  • scripts/verify-modules-signature.py — invoked by workflow; its flags/behavior are relied upon by docs/tests. [::nold-ai/specfact-cli-modules::scripts/verify-modules-signature.py]
  • scripts/pre-commit-verify-modules-signature.sh — pre-commit hook mirrors CI branch rule. Tests expect parity. [::nold-ai/specfact-cli-modules::scripts/pre-commit-verify-modules-signature.sh]

• Other CI gating impacts:

  • pr-orchestrator.yml exposes outputs (skip_tests_dev_to_main) and pins some actions; downstream jobs (quality, verify-module-signatures) depend on these outputs — changes to naming/semantics will affect tests and job conditions. [::nold-ai/specfact-cli-modules::.github/workflows/pr-orchestrator.yml:jobs.changes.outputs / jobs.quality]

Summary implication: This repository contains multiple tests and docs that assert precise branch-aware behavior of verify-module-signatures and Semgrep SAST gating; the PR changes that adjust workflow outputs, rename skip flags, change when --require-signature is applied, or alter pinned action refs will directly affect these consumers and should be validated against the tests/docs referenced above.

🔇 Additional comments (15)

tests/unit/workflows/test_trustworthy_green_checks.py (4)

255-263: LGTM!

---

439-448: LGTM!

---

324-350: LGTM!

---

180-201: LGTM!

resources/bundled-module-registry/index.json (1)

16-19: LGTM!

src/specfact_cli/modules/module_registry/module-package.yaml (1)

2-2: LGTM!

Also applies to: 20-21

tools/semgrep/sast-baseline.json (1)

1-6: LGTM!

tools/semgrep/sast.yml (1)

1-97: LGTM!

setup.py (1)

10-10: LGTM!

src/specfact_cli/__init__.py (1)

79-79: LGTM!

src/specfact_cli/modules/module_registry/src/commands.py (2)

397-400: LGTM!

---

19-19: LGTM!

Also applies to: 57-57

scripts/pre-commit-verify-modules.sh (1)

23-27: LGTM!

tests/unit/scripts/test_pre_commit_verify_modules.py (1)

341-345: LGTM!

tests/integration/test_bundle_install.py (1)

145-147: LGTM!

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 20.26s
Checks: 4 total (1 passed) (3 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 20.02s
Checks: 4 total (1 passed) (3 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 19.73s
Checks: 4 total (1 passed) (3 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 19.56s
Checks: 4 total (1 passed) (3 skipped)

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/integration/test_bundle_install.py`:
- Line 161: Replace the direct mutation of module_lifecycle.console with a
pytest-safe patch: instead of "module_lifecycle.console = stale_console" use
"monkeypatch.setattr(module_lifecycle, 'console', stale_console)" in the test so
pytest will restore the original console after the test; remove the original
assignment line and ensure the test uses the monkeypatch fixture (pytest
provides it) where module_lifecycle.console is referenced.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c1ad4681-ff78-4579-a271-ddb3523c12af

📥 Commits

Reviewing files that changed from the base of the PR and between 8b5fd59 and 30971b6.

📒 Files selected for processing (10)

• CHANGELOG.md
• openspec/changes/cli-val-05-ci-integration/TDD_EVIDENCE.md
• pyproject.toml
• resources/bundled-module-registry/index.json
• setup.py
• src/__init__.py
• src/specfact_cli/__init__.py
• src/specfact_cli/modules/module_registry/module-package.yaml
• src/specfact_cli/modules/module_registry/src/commands.py
• tests/integration/test_bundle_install.py

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• nold-ai/specfact-cli-modules (manual)

✅ Files skipped from review due to trivial changes (6)

• src/specfact_cli/init.py
• src/init.py
• resources/bundled-module-registry/index.json
• setup.py
• CHANGELOG.md
• openspec/changes/cli-val-05-ci-integration/TDD_EVIDENCE.md

🚧 Files skipped from review as they are similar to previous changes (2)

• pyproject.toml
• src/specfact_cli/modules/module_registry/src/commands.py

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (17)

• GitHub Check: Package Runtime Matrix (hatch-source)
• GitHub Check: Linting (ruff, pylint, safe-write guard)
• GitHub Check: CLI Command Validation
• GitHub Check: Runtime Discovery Smoke (macOS)
• GitHub Check: Type Checking (basedpyright)
• GitHub Check: Tests (Python 3.12)
• GitHub Check: Independent Static Analysis
• GitHub Check: Contract-First CI
• GitHub Check: Compatibility (Python 3.11)
• GitHub Check: Package Runtime Matrix (hatch-source)
• GitHub Check: Linting (ruff, pylint, safe-write guard)
• GitHub Check: Tests (Python 3.12)
• GitHub Check: Runtime Discovery Smoke (macOS)
• GitHub Check: Independent Static Analysis
• GitHub Check: Compatibility (Python 3.11)
• GitHub Check: CLI Command Validation
• GitHub Check: Analyze (python)

🧰 Additional context used

📓 Path-based instructions (7)

**/*.yaml

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

YAML files must pass linting using: hatch run yaml-lint with relaxed policy.

Files:

• src/specfact_cli/modules/module_registry/module-package.yaml

**/*.{yml,yaml}

📄 CodeRabbit inference engine (.cursor/rules/testing-and-build-guide.mdc)

Validate YAML configuration files locally using hatch run yaml-lint before committing

**/*.{yml,yaml}: Format all YAML and workflow files using hatch run yaml-fix-all before committing
Use Prettier to fix whitespace, indentation, and final newline across YAML files
Use yamllint with the repo .yamllint configuration (line-length 140, trailing spaces and final newline enforced) to lint non-workflow YAML files

Files:

• src/specfact_cli/modules/module_registry/module-package.yaml

**/test_*.py

📄 CodeRabbit inference engine (.cursor/rules/python-github-rules.mdc)

**/test_*.py: Write tests first in test-driven development (TDD) using the Red-Green-Refactor cycle
Ensure each test is independent and repeatable with no shared state between tests
Organize Python imports in tests using unittest.mock for Mock and patch
Use setup_method() for test initialization and Arrange-Act-Assert pattern in test files
Use @pytest.mark.asyncio decorator for async test functions in Python
Organize test files in structure: tests/unit/, tests/integration/, tests/e2e/ by module

Files:

• tests/integration/test_bundle_install.py

**/*.py

📄 CodeRabbit inference engine (.cursor/rules/python-github-rules.mdc)

**/*.py: Maintain minimum 80% test coverage, with 100% coverage for critical paths in Python code
Use clear naming and self-documenting code, preferring clear names over comments
Ensure each function/class has a single clear purpose (Single Responsibility Principle)
Extract common patterns to avoid code duplication (DRY principle)
Apply SOLID object-oriented design principles in Python code
Use type hints everywhere in Python code and enable basedpyright strict mode
Use Pydantic models for data validation and serialization in Python
Use async/await for I/O operations in Python code
Use context managers for resource management in Python
Use dataclasses for simple data containers in Python
Enforce maximum line length of 120 characters in Python code
Use 4 spaces for indentation in Python code (no tabs)
Use 2 blank lines between classes and 1 blank line between methods in Python
Organize imports in order: Standard library → Third party → Local in Python files
Use snake_case for variables and functions in Python
Use PascalCase for class names in Python
Use UPPER_SNAKE_CASE for constants in Python
Use leading underscore (_) for private methods in Python classes
Use snake_case for Python file names
Enable basedpyright strict mode with strict type checking configuration in Python
Use Google-style docstrings for functions and classes in Python
Include comprehensive exception handling with specific exception types in Python code
Use logging with structured context (extra parameters) instead of print statements
Use retry logic with tenacity decorators (@retry) for operations that might fail
Use Pydantic BaseSettings for environment-based configuration in Python
Validate user input using Pydantic validators in Python models
Use @lru_cache and Redis-based caching for expensive calculations in Python
Run code formatting with Black (120 character line length) and isort in Python
Run type checking with basedpyright on all Python files
Run linting with ruff and pylint on all Pyth...

Files:

• tests/integration/test_bundle_install.py

tests/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

Tests must be meaningful and test actual functionality, cover both success and failure cases, be independent and repeatable, and have clear, descriptive names. NO EXCEPTIONS - no placeholder or empty tests.

tests/**/*.py: Trim low-value unit tests when a contract covers the same assertion (type/shape/raises on negative checks)
Delete tests that only assert input validation, datatype/shape enforcement, or raises on negative conditions now guarded by contracts and runtime typing
Convert repeated edge-case permutations into one Hypothesis property with contracts acting as oracles

Secret redaction via LoggerSetup.redact_secrets must be covered by unit tests

Files:

• tests/integration/test_bundle_install.py

---

⚙️ CodeRabbit configuration file

tests/**/*.py: Contract-first testing: meaningful scenarios, not redundant assertions already covered by
contracts. Flag flakiness, environment coupling, and missing coverage for changed behavior.

Files:

• tests/integration/test_bundle_install.py

@(src|tests)/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

Linting must pass with no errors using: pylint src tests

Files:

• tests/integration/test_bundle_install.py

**/*.{py,pyi}

📄 CodeRabbit inference engine (.cursorrules)

**/*.{py,pyi}: After any code changes, follow these steps in order: (1) Apply linting and formatting to ensure code quality: hatch run format, (2) Type checking: hatch run type-check (basedpyright), (3) Contract-first approach: Run hatch run contract-test for contract validation, (4) Run full test suite: hatch test --cover -v, (5) Verify all tests pass and contracts are satisfied, (6) Fix any issues and repeat steps until all tests pass
All public APIs must have @icontract decorators and @beartype type checking
Use Pydantic models for all data structures with data validation
Only write high-value comments if at all. Avoid talking to the user through comments

Files:

• tests/integration/test_bundle_install.py

🔀 Multi-repo context nold-ai/specfact-cli-modules

nold-ai/specfact-cli-modules

• .github/workflows/pr-orchestrator.yml defines verify-module-signatures job, uses outputs and the dev→main skip output named skip_tests_dev_to_main, and appends --require-signature only when target is main. [::nold-ai/specfact-cli-modules::.github/workflows/pr-orchestrator.yml:1-200]

• pr-orchestrator.yml exposes outputs used by downstream jobs (quality, etc.) and contains multiple conditions referencing needs.changes.outputs.skip_tests_dev_to_main. [::nold-ai/specfact-cli-modules::.github/workflows/pr-orchestrator.yml:30-209]

• actions/checkout usage is mixed: most workflow steps use actions/checkout@v4, but some checkouts are pinned to a commit SHA (e.g., pr-orchestrator checkout of paired repo uses @34e114876b0b11c390a56381ad16ebd13914f8d5). [::nold-ai/specfact-cli-modules::.github/workflows/*:lines shown]

• scripts/verify-modules-signature.py exists and is invoked by the verify-module-signatures workflow. (File present; workflow shows invocation.) [::nold-ai/specfact-cli-modules::.github/workflows/pr-orchestrator.yml:Verify bundled module signatures and version bumps]

• tools/semgrep/sast.yml and tools/semgrep/sast-baseline.json are present, and scripts/semgrep_sast_gate.py exists (Semgrep SAST gating artifacts present). [::nold-ai/specfact-cli-modules::tools/semgrep/sast.yml][::nold-ai/specfact-cli-modules::tools/semgrep/sast-baseline.json][::nold-ai/specfact-cli-modules::scripts/semgrep_sast_gate.py]

• Tests assert presence/behavior of verify-module-signatures (e.g., tests/unit/workflows/test_pr_orchestrator_signing.py and tests/unit/test_pre_commit_quality_parity.py reference it). [::nold-ai/specfact-cli-modules::tests/unit/workflows/test_pr_orchestrator_signing.py:16][::nold-ai/specfact-cli-modules::tests/unit/test_pre_commit_quality_parity.py:13,118-122]

• scripts/module-verify-policy.sh was not found in this repository (attempt to read it failed). If your review expects changes to that script, note it's not present here. (sed error: file not found). [::nold-ai/specfact-cli-modules::scripts/module-verify-policy.sh - not present]

Conclusion: This repository contains workflow, test, and Semgrep-gate artifacts that directly consume the pr-orchestrator workflow outputs and verify-modules-signature invocation. Any PR changes that rename/repurpose the dev→main skip output, alter when --require-signature is added, or change action pinning will affect these workflows and tests here.

🔇 Additional comments (1)

src/specfact_cli/modules/module_registry/module-package.yaml (1)

2-2: LGTM!

The version bump (0.1.26 → 0.1.30) and integrity metadata update follow the expected pattern for auto-signed bundled module manifests. The checksum and signature formats are valid, and the linked repo's verify-module-signatures job (with --require-signature on main) will validate these values against the actual module content during CI.

Also applies to: 19-21

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 19.68s
Checks: 4 total (1 passed) (3 skipped)

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/specfact_cli/modules/module_registry/module-package.yaml (1)

20-21: ⚠️ Potential issue | 🔴 Critical

CRITICAL: Bundled module-registry has invalid integrity checksum.

The stored checksum does not match the actual module payload. When the workflow runs verify-modules-signature.py, it will compute a different hash and reject this module as tampered or misaligned.

Impact:

• verify-module-signatures (a required job) will fail
• Module signing/verification trust chain is broken
• The bundled module cannot be safely distributed

Required fix:
Regenerate integrity values using hatch run python scripts/sign-modules.py --key-file <private-key.pem> src/specfact_cli/modules/module_registry/module-package.yaml, then re-run verification until passing. Do not manually edit checksum/signature values—use the automated signing workflow.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/specfact_cli/modules/module_registry/module-package.yaml` around lines 20
- 21, The checksum and signature fields in the module-package.yaml file contain
invalid integrity values that do not match the actual module payload, causing
the verify-modules-signature.py workflow to fail. To fix this, run the automated
signing script sign-modules.py with your private key file to regenerate both the
checksum and signature fields. Do not manually edit these values—use the
automated signing workflow to ensure the integrity values are correctly computed
and the module signing/verification trust chain is restored.

Source: Pipeline failures

🧹 Nitpick comments (1)

tests/integration/test_bundle_install.py (1)

159-176: 💤 Low value

Consider hasattr for clearer module attribute check.

Line 175 uses vars(module_lifecycle).get("console") to verify the console was replaced. While correct, hasattr(module_lifecycle, "console") and module_lifecycle.console is not stale_console would be more direct.

Optional refactor

-    assert vars(module_lifecycle).get("console") is not stale_console
+    assert hasattr(module_lifecycle, "console") and module_lifecycle.console is not stale_console

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/integration/test_bundle_install.py` around lines 159 - 176, The
assertion in test_bundle_install_refreshes_stale_loaded_module_consoles that
checks if the console was replaced currently uses
vars(module_lifecycle).get("console") which is indirect and less readable.
Replace this assertion with a more direct check using hasattr to verify the
console attribute exists on the module_lifecycle object and that it is not the
stale_console instance, combining both conditions with an and operator for
clarity.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@src/specfact_cli/modules/module_registry/module-package.yaml`:
- Around line 20-21: The checksum and signature fields in the
module-package.yaml file contain invalid integrity values that do not match the
actual module payload, causing the verify-modules-signature.py workflow to fail.
To fix this, run the automated signing script sign-modules.py with your private
key file to regenerate both the checksum and signature fields. Do not manually
edit these values—use the automated signing workflow to ensure the integrity
values are correctly computed and the module signing/verification trust chain is
restored.

---

Nitpick comments:
In `@tests/integration/test_bundle_install.py`:
- Around line 159-176: The assertion in
test_bundle_install_refreshes_stale_loaded_module_consoles that checks if the
console was replaced currently uses vars(module_lifecycle).get("console") which
is indirect and less readable. Replace this assertion with a more direct check
using hasattr to verify the console attribute exists on the module_lifecycle
object and that it is not the stale_console instance, combining both conditions
with an and operator for clarity.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b9910424-3780-4726-89f2-0c9dce5ad6b3

📥 Commits

Reviewing files that changed from the base of the PR and between 30971b6 and 519a599.

📒 Files selected for processing (9)

• CHANGELOG.md
• openspec/changes/cli-val-05-ci-integration/TDD_EVIDENCE.md
• pyproject.toml
• setup.py
• src/__init__.py
• src/specfact_cli/__init__.py
• src/specfact_cli/modules/module_registry/module-package.yaml
• src/specfact_cli/modules/module_registry/src/commands.py
• tests/integration/test_bundle_install.py

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• nold-ai/specfact-cli-modules (manual)

✅ Files skipped from review due to trivial changes (2)

• CHANGELOG.md
• openspec/changes/cli-val-05-ci-integration/TDD_EVIDENCE.md

🚧 Files skipped from review as they are similar to previous changes (4)

• src/init.py
• src/specfact_cli/init.py
• pyproject.toml
• src/specfact_cli/modules/module_registry/src/commands.py

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Analyze (python)

🧰 Additional context used

📓 Path-based instructions (9)

**/*.py

📄 CodeRabbit inference engine (.cursor/rules/python-github-rules.mdc)

**/*.py: Maintain minimum 80% test coverage, with 100% coverage for critical paths in Python code
Use clear naming and self-documenting code, preferring clear names over comments
Ensure each function/class has a single clear purpose (Single Responsibility Principle)
Extract common patterns to avoid code duplication (DRY principle)
Apply SOLID object-oriented design principles in Python code
Use type hints everywhere in Python code and enable basedpyright strict mode
Use Pydantic models for data validation and serialization in Python
Use async/await for I/O operations in Python code
Use context managers for resource management in Python
Use dataclasses for simple data containers in Python
Enforce maximum line length of 120 characters in Python code
Use 4 spaces for indentation in Python code (no tabs)
Use 2 blank lines between classes and 1 blank line between methods in Python
Organize imports in order: Standard library → Third party → Local in Python files
Use snake_case for variables and functions in Python
Use PascalCase for class names in Python
Use UPPER_SNAKE_CASE for constants in Python
Use leading underscore (_) for private methods in Python classes
Use snake_case for Python file names
Enable basedpyright strict mode with strict type checking configuration in Python
Use Google-style docstrings for functions and classes in Python
Include comprehensive exception handling with specific exception types in Python code
Use logging with structured context (extra parameters) instead of print statements
Use retry logic with tenacity decorators (@retry) for operations that might fail
Use Pydantic BaseSettings for environment-based configuration in Python
Validate user input using Pydantic validators in Python models
Use @lru_cache and Redis-based caching for expensive calculations in Python
Run code formatting with Black (120 character line length) and isort in Python
Run type checking with basedpyright on all Python files
Run linting with ruff and pylint on all Pyth...

Files:

• setup.py
• tests/integration/test_bundle_install.py

{src/__init__.py,pyproject.toml,setup.py}

📄 CodeRabbit inference engine (.cursor/rules/python-github-rules.mdc)

{src/__init__.py,pyproject.toml,setup.py}: Update src/init.py first as primary source of truth for package version, then pyproject.toml and setup.py
Maintain version synchronization across src/init.py, pyproject.toml, and setup.py

Files:

• setup.py

{pyproject.toml,setup.py,src/__init__.py}

📄 CodeRabbit inference engine (.cursor/rules/testing-and-build-guide.mdc)

Manually update version numbers in pyproject.toml, setup.py, and src/init.py when making a formal version change

Files:

• setup.py

**/*.{py,pyi}

📄 CodeRabbit inference engine (.cursorrules)

**/*.{py,pyi}: After any code changes, follow these steps in order: (1) Apply linting and formatting to ensure code quality: hatch run format, (2) Type checking: hatch run type-check (basedpyright), (3) Contract-first approach: Run hatch run contract-test for contract validation, (4) Run full test suite: hatch test --cover -v, (5) Verify all tests pass and contracts are satisfied, (6) Fix any issues and repeat steps until all tests pass
All public APIs must have @icontract decorators and @beartype type checking
Use Pydantic models for all data structures with data validation
Only write high-value comments if at all. Avoid talking to the user through comments

Files:

• setup.py
• tests/integration/test_bundle_install.py

**/*.yaml

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

YAML files must pass linting using: hatch run yaml-lint with relaxed policy.

Files:

• src/specfact_cli/modules/module_registry/module-package.yaml

**/*.{yml,yaml}

📄 CodeRabbit inference engine (.cursor/rules/testing-and-build-guide.mdc)

Validate YAML configuration files locally using hatch run yaml-lint before committing

**/*.{yml,yaml}: Format all YAML and workflow files using hatch run yaml-fix-all before committing
Use Prettier to fix whitespace, indentation, and final newline across YAML files
Use yamllint with the repo .yamllint configuration (line-length 140, trailing spaces and final newline enforced) to lint non-workflow YAML files

Files:

• src/specfact_cli/modules/module_registry/module-package.yaml

**/test_*.py

📄 CodeRabbit inference engine (.cursor/rules/python-github-rules.mdc)

**/test_*.py: Write tests first in test-driven development (TDD) using the Red-Green-Refactor cycle
Ensure each test is independent and repeatable with no shared state between tests
Organize Python imports in tests using unittest.mock for Mock and patch
Use setup_method() for test initialization and Arrange-Act-Assert pattern in test files
Use @pytest.mark.asyncio decorator for async test functions in Python
Organize test files in structure: tests/unit/, tests/integration/, tests/e2e/ by module

Files:

• tests/integration/test_bundle_install.py

tests/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

Tests must be meaningful and test actual functionality, cover both success and failure cases, be independent and repeatable, and have clear, descriptive names. NO EXCEPTIONS - no placeholder or empty tests.

tests/**/*.py: Trim low-value unit tests when a contract covers the same assertion (type/shape/raises on negative checks)
Delete tests that only assert input validation, datatype/shape enforcement, or raises on negative conditions now guarded by contracts and runtime typing
Convert repeated edge-case permutations into one Hypothesis property with contracts acting as oracles

Secret redaction via LoggerSetup.redact_secrets must be covered by unit tests

Files:

• tests/integration/test_bundle_install.py

---

⚙️ CodeRabbit configuration file

tests/**/*.py: Contract-first testing: meaningful scenarios, not redundant assertions already covered by
contracts. Flag flakiness, environment coupling, and missing coverage for changed behavior.

Files:

• tests/integration/test_bundle_install.py

@(src|tests)/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/spec-fact-cli-rules.mdc)

Linting must pass with no errors using: pylint src tests

Files:

• tests/integration/test_bundle_install.py

🪛 GitHub Actions: PR Orchestrator - SpecFact CLI / 17_Verify Module Signatures.txt

src/specfact_cli/modules/module_registry/module-package.yaml

[error] 1-1: verify-modules-signature: checksum mismatch for module package (FAIL src/specfact_cli/modules/module_registry/module-package.yaml).

🪛 GitHub Actions: PR Orchestrator - SpecFact CLI / Verify Module Signatures

src/specfact_cli/modules/module_registry/module-package.yaml

[error] 1-1: Module verification failed: checksum mismatch for module-package.yaml

🔀 Multi-repo context nold-ai/specfact-cli-modules

Linked repositories findings

nold-ai/specfact-cli-modules

CRITICAL: Cross-Repository Workflow Output Breaking Change

The PR renames a shared workflow output that nold-ai/specfact-cli-modules directly depends on, causing workflow failures in the consumer repository.

Output name change:

• Source: PR renames skip_tests_dev_to_main → skip_expensive_tests_dev_to_main
• Consumer: nold-ai/specfact-cli-modules still references the old name in 22+ locations

Locations affected in the modules repository:

Changes job output definition and setup:

• .github/workflows/pr-orchestrator.yml:30 — Exports skip_tests_dev_to_main output [::nold-ai/specfact-cli-modules::.github/workflows/pr-orchestrator.yml:30]
• .github/workflows/pr-orchestrator.yml:55, 57 — Sets skip_tests_dev_to_main in output step [::nold-ai/specfact-cli-modules::.github/workflows/pr-orchestrator.yml:55-57]

Downstream job conditions (22 references) that will break:

• .github/workflows/pr-orchestrator.yml:123 — if: needs.changes.outputs.skip_tests_dev_to_main == 'true' [::nold-ai/specfact-cli-modules::.github/workflows/pr-orchestrator.yml:123]
• .github/workflows/pr-orchestrator.yml:126, 132, 151, 159, 162, 167, 172, 175, 178, 183, 188, 191, 194, 197, 200, 203, 206, 209 — Multiple if: needs.changes.outputs.skip_tests_dev_to_main != 'true' conditions [::nold-ai/specfact-cli-modules::.github/workflows/pr-orchestrator.yml:126-209]

Breaking impact:
When PR #610 merges to main:

1. The changes job will output skip_expensive_tests_dev_to_main (new name from PR)
2. All 22 downstream job conditions will fail to evaluate because they reference the old output name skip_tests_dev_to_main
3. The dev→main parity gating mechanism will break entirely
4. Expensive test suites will run unnecessarily on all dev→main PRs in the modules repository
5. CI/CD reliability is compromised in a dependent repository

Required remediation: Before or concurrent with merging this PR to main, nold-ai/specfact-cli-modules must be updated to rename all 22 references from skip_tests_dev_to_main to skip_expensive_tests_dev_to_main in .github/workflows/pr-orchestrator.yml.

🔇 Additional comments (3)

tests/integration/test_bundle_install.py (2)

166-166: LGTM!

---

56-64: LGTM!

setup.py (1)

10-10: LGTM!

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 20.31s
Checks: 4 total (1 passed) (3 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 20.05s
Checks: 4 total (1 passed) (3 skipped)