test(e2e): assert menu tiers match manifests, not that Teranga is non-empty

[hyperpolymath]

Summary

This is the last red check on the Zig 0.16 path (#354 bench, #355 invoke CLI). With #355 merged, E2E — Full REST + MCP Bridge builds and runs: 38 of 39 pass. The one failure is teranga tier has cartridges (expected '1', got '0'). The bundled cartridges/ tree was retired, so the E2E catalogue is now tests/fixtures/cartridges, and all 23 of its manifests declare "tier": "Ayo". The assertion can never pass against that catalogue, so this is a stale test rather than a defect in the menu.

Changes

• tests/e2e_full.sh Step 3: the "Teranga is non-empty" check is replaced by:
  • for each tier (teranga, shield, ayo), the menu count equals the number of manifests under $BOJ_CARTRIDGES_PATH declaring that tier (case-folded, matching router.ex);
  • tier_teranga + tier_shield + tier_ayo == summary.total, so no cartridge can silently fall outside the three tiers.
• The new assertions don't assume any tier is non-empty. Tier assignments are being re-audited under the trust-tier ruling, so adding a fake Teranga fixture would have pre-empted that work.

Type of change

Test fix. No production code changes.

📌 New pins

Head SHA: 7c192f0. No action, lockfile or container pins are added or changed.

RSR Quality Checklist

Required

• Tests pass: bash tests/e2e_full.sh locally reports Results: 42 passed, 0 failed, 0 skipped (of 42) with rc 0.
• Code is formatted: bash -n tests/e2e_full.sh reports no syntax errors. The repo has no shell formatter gate.
• Linter is clean: no new warnings.
• No banned language patterns: shell and jq only.
• No unsafe blocks. Not applicable.
• No banned functions.
• SPDX headers: the existing header is unchanged.
• No secrets.

As Applicable

• .machine_readable/*. Not applicable: A2ML is retired (D308).
• Documentation, TOPOLOGY, CHANGELOG. Not applicable: test-only change.
• New dependencies. Not applicable: jq is already installed by the workflow.
• ABI/FFI. Not applicable.

Testing

• Full suite locally on Zig 0.16.0 and the Elixir backend: 42/42 pass. The new checks report teranga 0, shield 0, ayo 23, total 23.
• Mutant controls, run on the new block in isolation against the real fixtures:
  • correct menu: 4/4 pass;
  • one cartridge dropped from tier_ayo: 2 fail (the ayo count and the total);
  • a cartridge in the wrong tier: 2 fail (the teranga count and the ayo count).

Pre-existing red checks (deferred, not introduced here)

• SonarQube: red on main, tracked in Three pre-existing red non-required checks on main: Allowlist Preflight (empty GH_TOKEN), Workflow security linter (duplicate with in abi-drift.yml), SonarQube (403) #338.
• governance / UUID v7 conformance: red on main, tracked in governance / UUID v7 conformance is red on main: v5 UUID literal in .machine_readable/CLADE.a2ml #347.

🤖 Generated with Claude Code

https://claude.ai/code/session_019j8She9eTFx54r6aL6sCHP

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 44 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 8b8231b5-cc5f-4b5f-9b86-4ac96a48e8ec

📥 Commits

Reviewing files that changed from the base of the PR and between 8318558 and 7c192f0.

📒 Files selected for processing (1)

• tests/e2e_full.sh

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🏁 path-claims bench

Commit 344ded9

Numbers

path-claims bench  (node v22.23.3)

  scenario                                              iters       ms        ns/op          ops/s
  --------------------------------------------------------------------------------------------------------------
  register: 10 active claims, 3 new paths               50000 iters    147 ms      2.96 µs/op    338.4k ops/s
  register: 100 active claims, 3 new paths              20000 iters    273 ms     13.70 µs/op     73.0k ops/s
  register: 1000 active claims, 3 new paths              5000 iters    875 ms    175.18 µs/op      5.7k ops/s
  register: 100 active claims, 20 new paths              5000 iters    285 ms     57.03 µs/op     17.5k ops/s

  pathsOverlap: deep diverge at segment 4             1000000 iters    116 ms     116.8 ns/op     8.56M ops/s
  pathsOverlap: short prefix match                    1000000 iters     99 ms      99.7 ns/op    10.03M ops/s

  refresh (existing claim)                             100000 iters      9 ms      92.7 ns/op    10.79M ops/s
  list (100 active claims)                              50000 iters    226 ms      4.54 µs/op    220.3k ops/s

  (Bench numbers depend on host; use deltas across commits, not absolute values.)

Host-dependent — compare deltas across commits, not absolute values.

[github-actions]

🔍 Hypatia Security Scan

Findings: 113 issues detected

Severity	Count
🔴 Critical	10
🟠 High	20
🟡 Medium	83

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Job `sonarqube` in build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sonarqube"
  },
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "reason": "Job `deploy` in pages-deploy.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "deploy"
  },
  {
    "reason": "Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
    "type": "secret_action_without_presence_gate",
    "file": ".github/workflows/instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high",
    "fix_recipe": "add_secret_presence_gate"
  },
  {
    "reason": "codeql.yml does not list `language: actions` in its matrix, but the repo has workflow files. CodeQL's `actions` language scans workflow YAML for injection and other CI/CD-specific weaknesses — every repo with workflows benefits. Add an entry to `matrix.include` with `language: actions` + `build-mode: none`.",
    "type": "codeql_missing_actions_language",
    "file": ".github/workflows/codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "fix_recipe": "add_codeql_actions_language"
  },
  {
    "line": 39,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 46,
    "reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 32,
    "reason": "job in .github/workflows/build.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/build.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 44,
    "reason": "job in .github/workflows/container-publish.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/container-publish.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence