An automated reviewer raised a Critical asking for torch.compile to be disabled
by default on every platform "so the default is uniform", citing the
cross-platform parity rule. Following it would have slowed down every Linux
CUDA user to match hosts that cannot compile at all.
Read literally, the rule forbids GPU support: CUDA, MPS, DirectML and Triton
availability are all host-dependent by design. It was always about what a user
can SEE AND DO, not about throughput — so it now says that, in CLAUDE.md and
AGENTS.md, and .coderabbit.yaml tells the reviewers directly so the finding
stops regenerating every month.
An optimization skipped where it physically cannot work is not a parity
violation. A feature usable on one OS but not another still is.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
analytics.ts landed unformatted in e3ed9523, so CI's oxfmt gate has been
red on main since — every PR inherited the failure. Separately,
tone_instructions exceeded CodeRabbit's 250-char cap, so the whole config
failed to parse and reviews silently ran with defaults (the brevity
tuning was never active). Shortened to 204.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Owner directive: no fluff on PRs. Greptile: logic-only comments at max
strictness, no diagrams/confidence sections, summary collapsed.
CodeRabbit: three-sentence findings, no sequence diagrams or ASCII
sketches, collapsed walkthrough, no per-push status comments, finishing
touches off. Both: comment only when a finding changes what merges.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Harvested and verified every CodeRabbit/Greptile finding from PRs #1175,
#1189, #1192, #1195: 16 real ones fixed (fallback ASR preflight bypass,
VRAM release on stream exit, typed 409 parity, uv env independence,
path-privacy in errors, MCP clone_voice hardening, CaptureWidget WS
guard, test hygiene), 4 refuted with evidence, rest documented as
deliberate design or deferred.
Deterministic CI replaces hand-enforcement: tests/test_changelog_style.py
(quiet one-liner format) and tests/test_locale_parity.py (21-locale
key/placeholder lockstep with a ratchet baseline) — the latter surfaced
and fixes 151 already-broken locale strings. CodeRabbit/Greptile carry
the house rules via .coderabbit.yaml + greptile.json; CLAUDE.md gains
the harvest-before-merge and never-accept-as-is rules.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore(review-bots): visual walkthroughs — diagrams for mechanics, ASCII sketches for UI
CodeRabbit: enable sequence_diagrams explicitly and instruct the
high-level summary to sketch UI changes as compact ASCII before/after
and behavior changes as a small mermaid flow. Greptile: new repo-level
greptile.json turning on the sequence-diagram and summary sections with
matching instructions, plus the project's local-first and cross-platform
hard rules so both bots review against them.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore(review-bots): expert-panel review rubrics, pre-merge rule audits, knowledge base
Encode one senior-domain-expert lens per subsystem (ML inference for
backend/services, product frontend for src, desktop systems for
src-tauri, test infra for tests) as path instructions; add non-gating
pre-merge checks for the project's four hard rules (cross-platform
default parity, 21-locale i18n completeness, local-first guarantee,
backward compatibility); feed CLAUDE.md and docs into CodeRabbit's
knowledge base; mirror it all in greptile.json with customContext rules
and strictness tuning.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* ci(security): add scanning workflow + CodeRabbit config + sweep design
PR 0 of the v0.3.0 stabilization sweep — establishes the automated
review + security gate every subsequent plan PR flows through.
- .github/workflows/security.yml: gitleaks (gating secret scan),
CodeQL (Python + JS/TS), bandit (SARIF), pip-audit + bun audit.
Only the secret scan gates; dep/SAST findings are reporting-only
to stay consistent with the no-ceremony, continuous-to-main cadence.
- .coderabbit.yaml: path filters + constitution constraints encoded as
review instructions (local-first, cross-platform parity, alembic,
no secret/home-path leakage). Drafts excluded from auto-review.
- SECURITY.md: document the automated scanning + bot review.
- docs/specs: program design for the full sweep (plan-01..05 + PR triage).
CodeRabbit and Greptile apps are already installed and will review on
PR open.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* ci(security): install bandit[sarif] extra; pin JS actions to Node 24
The bandit SARIF formatter ships in the `bandit[sarif]` extra; plain
`bandit` rejects `-f sarif` (exit 2), so no SARIF was written and the
upload step failed. Install via `pipx run --spec 'bandit[sarif]'`.
Also add FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 (mirrors ci.yml) to silence
the Node 20 deprecation warning on checkout/setup-python/upload-sarif.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* ci(security): harden per bot review — persist-credentials, upload guard, bun pin
Addresses CodeRabbit + Greptile findings on #135:
- persist-credentials: false on all checkout steps (don't leave GITHUB_TOKEN
in git config; none of these jobs need authed git after clone). [CodeRabbit]
- continue-on-error on the bandit SARIF upload so a missing SARIF can't fail
this reporting-only job. [Greptile P1]
- pin bun-version "1.2" — `bun audit` only exists in bun >=1.2.x. [Greptile P2]
Declined: full-SHA action pinning. Meets the major-tag bar set in
.coderabbit.yaml and matches ci.yml/release.yml convention; SHA pinning
belongs in a repo-wide hardening pass with Dependabot, not one file.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
