docs(devlog): final Wave 5 campaign record, including its own errors - #1972
Conversation
…e's fault My second explanation was also wrong. Dev is not scanned on push - its last analysis is from 8/15, default setup runs weekly, and 0be660a is not an ancestor of that commit, so the code was never in a dev scan. Dev's 84 alerts are stale rather than current, which is the opposite of what I said they showed. The real answer: github-advanced-security posted the finding as an inline review comment on #1959 at 02:38:08Z, and #1963 promoted at 02:55:04Z. It sat in the review thread of a promotion PR for seventeen minutes - while I was editing that same PR's description. Not a coverage gap. I did not read the review comments on a PR I was actively rewriting. Three explanations for one mistake. The first two blamed infrastructure; the third is true and the least comfortable, which is roughly how that tends to go.
|
Warning Review limit reached
Next review available in: 1 minute Limit details: You’ve used all 10 included reviews currently available under your plan. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
the
documentation
|
✅ Deterministic PR hygiene checks passed. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cca48ad927
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| **The root cause is a process one and belongs in the record.** #1897 merged on local focused | ||
| tests plus `tsc`. That substitutes for CI on the axis it covers — behavior — and silently skips | ||
| the axis it does not: static analysis. Waiting for full CI would have surfaced this before it | ||
| the axis it does not: static analysis. ~~Waiting for full CI would have surfaced this before it~~ |
There was a problem hiding this comment.
Striking out only this sentence leaves the next sentences claiming that skipping per-PR CI “traded away exactly this class of finding,” but the corrected investigation above establishes that CodeQL would not have run on #1897 even with full CI because it targeted dev; the actual available signal was the later inline comment on #1959. Rewrite the rest of this paragraph as well so the final campaign record does not retain the disproven process conclusion.
Useful? React with 👍 / 👎.
1 participant
Summary
Final record for the Wave 5 campaign. Devlog-only.
Most of this document is a list of things I got wrong and how they were caught, which is the
part worth keeping. The campaign ran nine PABCD work-phases with an independent adversarial
review at each gate, and the reviews found more than I did.
The corrections that mattered
it merged afterwards, and my record described my decision rather than the branch.
js/polynomial-redosvia fix(antigravity): match live agy model discovery #1897 —and I told an approver "nothing in this campaign introduced them."
the document.
ide_versionfix was fix(antigravity): send a bare ide_version, not the whole User-Agent #1955, not fix(antigravity): send a bare ide_version + Wave 5 closeout record #1957 — I credited a documentation-only PR.third is true: the bot posted it as an inline review comment on [WRONG BRANCH] promote: dev -> main after the Wave 5 campaign #1959 at 02:38:08Z, promotion
happened at 02:55:04Z, and I was editing that PR's description during the seventeen minutes
in between without reading its review thread.
What the campaign actually changed
Wave 5A–5D landed on
devand reachedmain: the Gemini wire-id opt-out, the Windowsfail-closed process query, destination-scoped signature replay, ordered writer-hardening
assertions, Cursor transport gates, Antigravity discovery, and more. Two issues closed, both
with ancestry evidence. Ten stayed open, none for release-timing reasons.
Three PRs were deliberately held rather than landed — #1889 and #1888 need
maintainer-sponsored, which is the record that a security review happened rather than a labelan agent should apply to unblock itself, and #1903 needs a rebase.
Verification
bun test --isolate tests— 12805 pass, 10 skip, 0 fail across 826 files.bun run typecheckclean,bun run privacy:scanpassed.verification are recorded as failures rather than removed.
Checklist
dev