Repository navigation
docs: reconciliation & audit 2026-10-21 - #175
Conversation
…nch reconciliation, health verification - Verification on main @ 5dbe022: vitest 297/298 (1 flaky-under-load), tsc clean, eslint 0 errors, next build green - Findings: dead required-check 'quality / quality' blocks all merges; dependabot.yml watches dirs deleted by #167; DEPLOY.md stale paths; README boilerplate - Branch reconciliation: 12 stale/merged branches covered by archive/2026-10-21/* tags; backend branch verified as preserved Django line - Stray copies reconciled: D:\sast-depth\WebCoder + ~\webcoder_clean removed (all commits preserved here via refs); UI-audit screenshots relocated to docs/screenshots/
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ae2be8ab32
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
|
||
| ## 8. Recommended next steps (priority order) | ||
|
|
||
| 1. **Unblock merging** — resolve the required-check deadlock (§4.1; recommendation: drop `quality / quality`, keep `CodeQL` + `vitest`). |
There was a problem hiding this comment.
The repository at this commit has no .github/workflows/vitest.yml; the document says that check is introduced by PR #169, but the next step instructs maintainers to merge PR #170 before #169. If vitest is made required while applying step 1, PR #170 cannot report that check and remains blocked, defeating the proposed security-update recovery. Delay requiring vitest until its workflow reaches main, or add the workflow to PR #170 first.
Useful? React with 👍 / 👎.
| **Fix options (pick one):** (a) re-arm the QZP App for this repo; (b) drop `quality / quality` from both the classic protection and ruleset 14488879, keeping `CodeQL` + the `vitest` check that PR #169's new `.github/workflows/vitest.yml` provides. Option (b) is the lean-gate-consistent recommendation. | ||
|
|
||
| ### 4.2 Security update stuck (consequence of 4.1) | ||
| PR #170 bumps `next` 15.5.25→15.5.28 (critical advisory) + postcss. Tests pass; blocked only by the missing quality check. Merge promptly after 4.1 is resolved. |
There was a problem hiding this comment.
The verification table records local tests only for main at 5dbe022e, while the PR-check row says #170 has only a skipping CodeQL check, so none of the documented evidence tests the dependency versions on PR #170. Saying its tests pass can cause the recommended expedited merge to proceed without validating the PR head; run the suite against that head or qualify this claim.
AGENTS.md reference: AGENTS.md:L5-L6
Useful? React with 👍 / 👎.
| - (Docs otherwise carry excellent branch/evidence tagging.) | ||
|
|
||
| ### 4.5 Flaky test | ||
| `src/app/register/page.test.tsx` parametrized "surfaces the API failure" cases assert `routerMock.push` not called; under full-suite parallel load a redirect assertion can bleed (jsdom churn: 32 environments, 216 s). Passes 9/9 isolated. PR #169 already rewrites this file; if it stays flaky, harden the mock reset in `beforeEach`. |
There was a problem hiding this comment.
When the full suite is slow enough for this failure to occur, the preceding spinner test resolves registration under real timers, and RegisterPage schedules router.push('/login') two seconds later without canceling it on unmount. The existing beforeEach already calls vi.clearAllMocks(), but that cannot prevent the old timer from invoking the mock during a later parameterized case, so the recommended mock-reset hardening will not fix the flake. Use fake timers or cancel/flush the redirect timer instead.
Useful? React with 👍 / 👎.
|
|
||
| **Deletion candidate (owner decision):** `D:\Backups\docker-volumes\images\img-webcoder-judge-runner_latest.tar` (283 MB) — judge-runner image backup; Docker daemon not running to verify a live copy; image is rebuildable from the backend branch's Dockerfile. Recommend: verify `docker images` has `img-webcoder-judge-runner` (or rebuild), then delete the tar. | ||
|
|
||
| **Local-only scratch inside canonical clone (harmless, gitignored):** `.remember/tmp/last-ndc.ts` (lint warning source), `.next/` build cache, `node_modules/`. |
There was a problem hiding this comment.
The report earlier identifies .remember/tmp/last-ndc.ts as untracked, and neither the committed .gitignore nor the repository's ESLint ignores contain a .remember pattern. Calling it harmless and gitignored risks staging local scratch content with git add -A; add .remember/ to the ignore file or remove the claim and the local artifact.
AGENTS.md reference: AGENTS.md:L22-L26
Useful? React with 👍 / 👎.
|
|
||
| A competitive-programming judge platform (mini-judge: problems, submissions, sandboxed evaluation, leaderboard): | ||
|
|
||
| - **Frontend (this branch, `main`):** Next.js 15 App Router at repo root, React 19, MUI 9, i18next/next-intl, vitest (298 tests) + Playwright e2e. Routes: problems catalog/detail/edit, submissions, submission history, register/login/OAuth, profile, notifications, forum, leaderboard, admin (dashboard + problem queue). |
There was a problem hiding this comment.
At this commit, enumerating every src/app/**/page.tsx finds no notifications, forum, or leaderboard route, and a repo-wide search finds no renamed page or feature-flagged handler for any of them (the sole notifications match is a toast-related comment in providers.tsx). Listing these as frontend routes therefore overstates the shipped product and can misdirect deployment or QA coverage; remove them or identify the actual route implementation.
Useful? React with 👍 / 👎.
| - Drive scans: `find /c,/d -iname '*webcoder*'` (full) + native `dir /s /b` cross-check; **D: complete: 55 raw hits, 0 errors; C: complete: 144 raw hits, 2,279 transient errors (container-layer/permission noise, no unreadable areas of consequence)**. Net result: the only working copy on C: is the canonical clone; the only other working copies found anywhere were the two redundant ones removed in §6. | ||
| - GitHub: `gh api` (branches, rulesets, check-runs, PRs, contents), `git ls-remote`, PR list to #170. | ||
| - Ancestry: every stray copy fetched into the canonical clone; `merge-base --is-ancestor` + `rev-list --count` per branch; unique commits inspected (`git show`). | ||
| - Health: `vitest run`, `tsc --noEmit`, `eslint`, `next build` in the canonical clone on `main` @ `5dbe022e`. |
There was a problem hiding this comment.
This health summary records several individual commands but omits the repository-mandated bash scripts/verify; moreover, scripts/verify is absent from this commit, so the required command could not have succeeded. Restore and run the canonical verifier, or qualify the completion claims until that repository check is executable, rather than treating a hand-selected subset as equivalent.
AGENTS.md reference: AGENTS.md:L14-L20
Useful? React with 👍 / 👎.
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| 5. **Docs pass:** rewrite `README.md` from §2; fix `DEPLOY.md` paths (`frontend/web` → repo root); date-stamp. | ||
| 6. **Delete the 12 tagged stale branches** on the remote (`git push origin --delete …` after pushing the `archive/2026-10-21/*` tags). | ||
| 7. **Harden the flaky register test** if it reappears after #169. | ||
| 8. Optional: push this reconciliation branch and the archive tags; empty-recycle-bin the deleted copies when convenient. | ||
|
|
||
| ## 9. Method appendix | ||
|
|
||
| - Drive scans: `find /c,/d -iname '*webcoder*'` (full) + native `dir /s /b` cross-check; **D: complete: 55 raw hits, 0 errors; C: complete: 144 raw hits, 2,279 transient errors (container-layer/permission noise, no unreadable areas of consequence)**. Net result: the only working copy on C: is the canonical clone; the only other working copies found anywhere were the two redundant ones removed in §6. | ||
| - GitHub: `gh api` (branches, rulesets, check-runs, PRs, contents), `git ls-remote`, PR list to #170. | ||
| - Ancestry: every stray copy fetched into the canonical clone; `merge-base --is-ancestor` + `rev-list --count` per branch; unique commits inspected (`git show`). | ||
| - Health: `vitest run`, `tsc --noEmit`, `eslint`, `next build` in the canonical clone on `main` @ `5dbe022e`. |
There was a problem hiding this comment.
Bug: Reconciliation document contains inaccurate statements regarding the current states of .github/dependabot.yml and docs/DEPLOY.md, recommending changes that are already present.
Severity: LOW
Suggested Fix
Update docs/RECONCILIATION-2026-10-21.md (§4.3, §4.4, and §8) to accurately reflect that .github/dependabot.yml and docs/DEPLOY.md already point to the correct root configuration and paths.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: docs/RECONCILIATION-2026-10-21.md#L1-L115
Potential issue: The newly added reconciliation document contains inaccurate
descriptions of `.github/dependabot.yml` and `docs/DEPLOY.md`. It reports that
`.github/dependabot.yml` monitors legacy paths and that `docs/DEPLOY.md` still refers to
obsolete directory paths, recommending fixes for both. However, both target files
already reflect the updated repository structure. Following these recommendations could
result in unnecessary or breaking changes to working configurations.
Did we get this right? 👍 / 👎 to inform future reviews.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d7a8489a92
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| **Fix options (pick one):** (a) re-arm the QZP App for this repo; (b) drop `quality / quality` from both the classic protection and ruleset 14488879, keeping `CodeQL` + the `vitest` check that PR #169's new `.github/workflows/vitest.yml` provides. Option (b) is the lean-gate-consistent recommendation. | ||
|
|
||
| ### 4.2 Security update stuck (consequence of 4.1) | ||
| PR #170 bumps `next` 15.5.25→15.5.28 (critical advisory) + postcss. Tests pass; blocked only by the missing quality check. Merge promptly after 4.1 is resolved. |
There was a problem hiding this comment.
Fresh evidence in this commit's actual parent shows that fb14783 (PR #170) is already an ancestor, and package.json has since advanced to Next 16.4.2. Describing #170 as blocked and directing maintainers to merge it presents an obsolete security incident as active; regenerate this section against the commit's real base or clearly label it as a historical snapshot.
AGENTS.md reference: AGENTS.md:L5-L6
Useful? React with 👍 / 👎.
| PR #170 bumps `next` 15.5.25→15.5.28 (critical advisory) + postcss. Tests pass; blocked only by the missing quality check. Merge promptly after 4.1 is resolved. | ||
|
|
||
| ### 4.3 `dependabot.yml` stale after restructure | ||
| Config watches `pip:/backend` and `npm:/frontend/webcoder_ui` — **both directories deleted from `main` by #167** — and has no `npm:/` entry for the root Next.js app. Effect: recurring failed updater runs (`pip in /backend`, `npm_and_yarn in /frontend/webcoder_ui`) every schedule; root npm updates arrive only via security-driven PRs (e.g. #170). |
There was a problem hiding this comment.
At this commit's parent, .github/dependabot.yml already contains npm and github-actions entries rooted at / via commit 6585ac6; it no longer watches either deleted directory. This statement and the corresponding recommended action can therefore send maintainers to rewrite a configuration that is already correct, so the audit needs to be reconciled with its actual base.
AGENTS.md reference: AGENTS.md:L5-L6
Useful? React with 👍 / 👎.
| - **The project works.** `main` @ `5dbe022e` builds cleanly, typechecks cleanly, lints with 0 errors, and passes 297/298 vitest tests (the 1 failure is flaky under parallel load — passes 9/9 in isolation; see §4.5). | ||
| - **The merge pipeline is dead** — this is the one real operational regression. Branch protection (classic + active ruleset `quality-zero-platform / WebCoder` #14488879) requires the `quality / quality` check (QZP App, integration 15368), but **no run of that check exists on any recent commit** — not on `main` HEAD, not on either open PR. Result: every PR is `BLOCKED` with nothing failing. PR #170 (Next 15.5.28, contains a **critical security fix**) has been stuck since 2026-10-16. | ||
| - **No unique work was stranded on disk.** Both stray full copies (`D:\sast-depth\WebCoder`, `C:\Users\Prekzursil\webcoder_clean`) are clean, fully-merged clones. One commit (`f3ef394e`, QZP-SaaS purge, June 26) existed only in `webcoder_clean` — now fetched into this clone under `refs/remotes/webcoderclean/*` + tag `rescue/C4-ruff-cleanup-workflow-permissions-20260801`. Nothing else unique anywhere. | ||
| - **Housekeeping debt, not code debt:** stale `dependabot.yml` (watches two directories deleted by the #167 restructure), boilerplate README, stale paths in `docs/DEPLOY.md`, 12 stale/merged branches (now archived under local `archive/2026-10-21/*` tags). |
There was a problem hiding this comment.
In the newly committed webcoder-home-mobile-390.png, the unauthenticated navbar extends beyond the 390px viewport, clips the Register/language controls, and produces a horizontal scrollbar. Calling the audit findings “housekeeping debt, not code debt” while omitting this directly reproduced mobile defect can cause responsive QA and remediation to be skipped; include it in the defect inventory and next steps.
AGENTS.md reference: AGENTS.md:L5-L6
Useful? React with 👍 / 👎.
|
|
||
| - **Frontend (this branch, `main`):** Next.js 15 App Router at repo root, React 19, MUI 9, i18next/next-intl, vitest (298 tests) + Playwright e2e. Routes: problems catalog/detail/edit, submissions, submission history, register/login/OAuth, profile, notifications, forum, leaderboard, admin (dashboard + problem queue). | ||
| - **Backend (preserved on `backend` branch @ `71200023`):** Django REST Framework (`/api/v1/`), JWT (dj_rest_auth) + Google/GitHub OAuth, `problems`/`submissions`/`users` apps, Celery async judging, PostgreSQL (port 5433 local), CORS for `localhost:3000`. See `docs/API-MAP.md` (evidence-anchored). | ||
| - **Judge runner:** sandboxed Docker image (non-root, cap-drop ALL, no-new-privileges, `--network none`); `JUDGE_BACKEND=container|local` toggle. Image backup: `D:\Backups\docker-volumes\images\img-webcoder-judge-runner_latest.tar` (283 MB). |
There was a problem hiding this comment.
For Python submissions that request custom libraries, backend/submissions/judge_utils/execution.py on the preserved backend branch explicitly changes network_value from none to bridge (lines 58–60), giving untrusted execution full network access; the committed deployment guide also labels this E1 CRITICAL. Presenting --network none as an unconditional runner property can lead operators to deploy under a false isolation assumption, so document the exception and required remediation here.
AGENTS.md reference: AGENTS.md:L5-L6
Useful? React with 👍 / 👎.
|
|
||
| - **The project works.** `main` @ `5dbe022e` builds cleanly, typechecks cleanly, lints with 0 errors, and passes 297/298 vitest tests (the 1 failure is flaky under parallel load — passes 9/9 in isolation; see §4.5). | ||
| - **The merge pipeline is dead** — this is the one real operational regression. Branch protection (classic + active ruleset `quality-zero-platform / WebCoder` #14488879) requires the `quality / quality` check (QZP App, integration 15368), but **no run of that check exists on any recent commit** — not on `main` HEAD, not on either open PR. Result: every PR is `BLOCKED` with nothing failing. PR #170 (Next 15.5.28, contains a **critical security fix**) has been stuck since 2026-10-16. | ||
| - **No unique work was stranded on disk.** Both stray full copies (`D:\sast-depth\WebCoder`, `C:\Users\Prekzursil\webcoder_clean`) are clean, fully-merged clones. One commit (`f3ef394e`, QZP-SaaS purge, June 26) existed only in `webcoder_clean` — now fetched into this clone under `refs/remotes/webcoderclean/*` + tag `rescue/C4-ruff-cleanup-workflow-permissions-20260801`. Nothing else unique anywhere. |
There was a problem hiding this comment.
Checking all refs and objects in the reviewed repository finds neither f3ef394e nor the stated rescue/C4-ruff-cleanup-workflow-permissions-20260801 tag; Git refs created in a local clone are not carried by this documentation commit. Because the report also says the only other copy was deleted, the supposedly preserved unique commit remains dependent on one unpushed local clone and can still be lost; push and verify the rescue tag before recording the deletion as safe.
AGENTS.md reference: AGENTS.md:L5-L6
Useful? React with 👍 / 👎.
Full-drive trace sweep, branch reconciliation, health verification, and the remediation record for the 2026-10-21 session. Includes the relocated UI-audit screenshots. See docs/RECONCILIATION-2026-10-21.md.