release: prepare v1.3.2#79
Merged
Merged
Conversation
📝 WalkthroughWalkthroughThis PR updates release documentation from v1.3.1 to v1.3.2 across README, ROADMAP, and maintainer audit documents, and introduces a comprehensive security audit report bundle covering threat model, runtime inventory, findings discovery, validation, coverage tracking, and attack path analysis. Two medium-severity findings (JSON-RPC ID narrowing and network-policy amendment fail-open behavior) and three deferred review areas are documented. ChangesVersion Milestone and Security Audit Documentation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@docs/security-audits/82ea49d_20260511T213956-0400/artifacts/finding_discovery_report.md`:
- Around line 25-26: The two references for the same finding point to different
line numbers (instance key referencing :229 while affected location references
:226); update the finding metadata so both the instance key and the affected
location reference the single verified source line in
CodexAppServer+ProtocolPayloads.swift (e.g., pick the correct line after
verifying the exact code using git blame/grep) and ensure the instance
identifier string
(fail-open-policy:Sources/SwiftASB/Public/CodexAppServer+ProtocolPayloads.swift:229)
and the affected location entry are made identical and accurate so triage links
remain stable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1d4d1289-3149-4069-86ff-39716eed3f20
📒 Files selected for processing (12)
README.mdROADMAP.mddocs/maintainers/v1-public-api-audit.mddocs/security-audits/82ea49d_20260511T213956-0400/artifacts/attack_path_analysis_report.mddocs/security-audits/82ea49d_20260511T213956-0400/artifacts/exhaustive-file-checklist.mddocs/security-audits/82ea49d_20260511T213956-0400/artifacts/finding_discovery_report.mddocs/security-audits/82ea49d_20260511T213956-0400/artifacts/repository_coverage_ledger.mddocs/security-audits/82ea49d_20260511T213956-0400/artifacts/runtime_inventory.mddocs/security-audits/82ea49d_20260511T213956-0400/artifacts/seed_research.mddocs/security-audits/82ea49d_20260511T213956-0400/artifacts/threat_model.mddocs/security-audits/82ea49d_20260511T213956-0400/artifacts/validation_report.mddocs/security-audits/82ea49d_20260511T213956-0400/report.md
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/security-audits/82ea49d_20260511T213956-0400/report.md`:
- Line 81: The phrase "Turn lifecycle, approval, elicitation, and turn handle
files." is ambiguous; update that fragment (the sentence containing "turn handle
files") to a clearer compound modifier, e.g., change "turn handle files" to
"turn-handle files" or expand to "files handling turn lifecycle objects" so the
meaning is explicit and unambiguous.
- Line 95: Update the validation note that currently reads "`git diff --check`
should be run before commit if this docs artifact is committed." to clearer
release-facing wording by replacing "this docs artifact" with "this
documentation artifact" and optionally rephrasing the sentence for clarity
(e.g., "Run `git diff --check` before committing this documentation artifact.").
Locate the exact string to change to ensure the wording is tightened.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 0be9e789-061f-4c7b-a282-db4d7c65bf91
📒 Files selected for processing (2)
docs/security-audits/82ea49d_20260511T213956-0400/artifacts/finding_discovery_report.mddocs/security-audits/82ea49d_20260511T213956-0400/report.md
✅ Files skipped from review due to trivial changes (1)
- docs/security-audits/82ea49d_20260511T213956-0400/artifacts/finding_discovery_report.md
|
|
||
| - Protocol decode and JSON-RPC envelope files. | ||
| - Startup, compatibility, config, and error files. | ||
| - Turn lifecycle, approval, elicitation, and turn handle files. |
There was a problem hiding this comment.
Clarify compound modifier for readability.
Line 81 (“turn handle files”) reads ambiguously; use a hyphenated or expanded form (for example, “turn-handle files” or “files handling turn lifecycle objects”) to avoid misreading.
🧰 Tools
🪛 LanguageTool
[grammar] ~81-~81: Use a hyphen to join words.
Context: ...fecycle, approval, elicitation, and turn handle files. - Library, loaded thread, ...
(QB_NEW_EN_HYPHEN)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/security-audits/82ea49d_20260511T213956-0400/report.md` at line 81, The
phrase "Turn lifecycle, approval, elicitation, and turn handle files." is
ambiguous; update that fragment (the sentence containing "turn handle files") to
a clearer compound modifier, e.g., change "turn handle files" to "turn-handle
files" or expand to "files handling turn lifecycle objects" so the meaning is
explicit and unambiguous.
| Validation commands: | ||
|
|
||
| - No build or test suite was run because this task was an audit/report artifact pass with no code behavior changes. | ||
| - `git diff --check` should be run before commit if this docs artifact is committed. |
There was a problem hiding this comment.
Tighten phrasing in the validation note.
Line 95 is understandable but awkward (“this docs artifact”). Consider “this documentation artifact” for clearer release-facing wording.
🧰 Tools
🪛 LanguageTool
[style] ~95-~95: To form a complete sentence, be sure to include a subject.
Context: ... behavior changes. - git diff --check should be run before commit if this docs artif...
(MISSING_IT_THERE)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/security-audits/82ea49d_20260511T213956-0400/report.md` at line 95,
Update the validation note that currently reads "`git diff --check` should be
run before commit if this docs artifact is committed." to clearer release-facing
wording by replacing "this docs artifact" with "this documentation artifact" and
optionally rephrasing the sentence for clarity (e.g., "Run `git diff --check`
before committing this documentation artifact."). Locate the exact string to
change to ensure the wording is tightened.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release
docs/security-audit-2026-05-11mainupdates behind pull request review and CIv1.3.2was created locally before this PR so the reviewed release candidate is preserved exactlyReview Loop
Before merge,
scripts/repo-maintenance/release.shwatches CI and stops on review comments unless the maintainer has already addressed or resolved them and reruns with--review-comments-addressed.Summary by CodeRabbit
Chores
Documentation