Skip to content

review: batch-end quality round - #11

Merged
CMGS merged 4 commits into
mainfrom
review/audit-2026-07-23
Jul 23, 2026
Merged

review: batch-end quality round#11
CMGS merged 4 commits into
mainfrom
review/audit-2026-07-23

Conversation

@CMGS

@CMGS CMGS commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator

Batch-end quality round across the Rust workspace, the Go control plane and the web client: style walkthrough, comment budget, simplify lenses, and a loc-justify pass with adversarial verification.

Removed

  • crates/handler/src/lib.rs: new_request_id's hand-rolled epoch-millis. gw_state::epoch_millis() is the same SystemTime::now().duration_since(UNIX_EPOCH) sequence, gw-state is already a dependency of this crate, and this crate already calls it elsewhere.

Kept, after verification

  • control-plane/internal/auth/password.go: VerifyPassword. The candidate's argument that every PasswordHash writer goes through HashPassword is factually right, but the conclusion does not follow: VerifyPassword is deliberately written to be constant-time against the dummy-hash path in auth.go, and that property is the point of the function, not incidental volume.

Style, layout and comments

  • crates/config/src/lib.rs: moved impl Default for StabilityConf directly below its struct and relocated the six serde-default helpers after the impl, matching the convention TokenRateConf and AlertsConf already follow in the same file.
  • crates/state/src/store.rs: dropped a needless explicit lifetime on the mutex helper (elision produces the identical signature) and trimmed its doc to one line, keeping the WHY (it recovers a poisoned lock rather than panicking because every critical section here is infallible).
  • Comment budget applied across the Rust crates, the Go control plane and the web client; section labels and restatements removed, load-bearing WHY comments kept.

Gates

  • cargo fmt --all -- --check: clean
  • cargo clippy --workspace --all-targets -- -D warnings: 0 warnings, 0 errors
  • cargo test --workspace: every test result: line ok, 0 failed
  • cd control-plane && GOWORK=off go vet ./... && GOWORK=off go test ./...: pass
  • npm --prefix web test && npm --prefix web run build: 2 tests pass, build ok
  • Cargo.lock, control-plane/go.mod, control-plane/go.sum, web/package-lock.json unmodified

Net: -77 prod, 0 test.

CMGS added 4 commits July 23, 2026 16:31
Delete a restated comment, tighten a stale doc comment to match the
current return type, and move a misplaced doc comment onto the
function it actually documents.
Move the nav const block above its first use, glue StabilityConf's
Default impl to the struct, switch to let-else and lazy defaulting
where the match/eager form obscured the same logic, group the test
module's use imports, and drop redundant std:: qualification where
the type is already imported.
Inline a single-use type and a single-use private method, drop a
redundant self-rebind, consolidate the four request-text traversals
(blocklist scan, inbound-text view, mask application, DLP redaction)
behind one shared helper, and factor the repeated poisoned-mutex
lock into one function in the memory store.
Remove the hand-rolled epoch-millis computation in new_request_id;
reuse gw_state::epoch_millis, already depended on and already called
elsewhere in this crate. No behaviour change.
@CMGS
CMGS merged commit 74d4782 into main Jul 23, 2026
2 checks passed
@CMGS
CMGS deleted the review/audit-2026-07-23 branch July 23, 2026 10:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant