reports: rules-map explanations, runtime dashboard panel, annotated health report, RU executive report - #52
Conversation
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MigRSeRnzZH6fo3TP9fRET
Third-party titles harvested from each analyzer's docs index into readable report/rules/*.tsv (Meziantou 211, Roslynator ~260, WpfAnalyzers 83, INPC 25, IDISP 26, AsyncFixer/Infer# extras); OWN*/XAML*/OWN-TIMER hand-written in Russian (what it is, why it leaks, how to fix) in rules_own.json. rules_map.py merges them and degrades gracefully: CodeQL slugs get derived titles + query-help links, compiler CS and MSTEST get doc links, unknowns echo the id. 13/13 incl a >=97% title-coverage gate over the real 72k STS findings. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MigRSeRnzZH6fo3TP9fRET
…untime panel Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MigRSeRnzZH6fo3TP9fRET
rule_meta rides with the interned rule list (harvested title, doc link, RU for OWN rules): the top-rules hover and the findings table's rule cell now answer 'what is OWN001' in place. New filter-independent 'Runtime-confirmed retention' panel renders the collector artifact (runtime-sts.json): reachable instances per suspect coloured by pinning root kind, hover names holder.member, subtitle carries the scenario + the reachability gate. Hidden when no runtime run exists. New tests wired into CI and the AGENTS.md sweep. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MigRSeRnzZH6fo3TP9fRET
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MigRSeRnzZH6fo3TP9fRET
Joins finding lines back to findings.json by path:line, appends the rule id + rules-map title (RU included for OWN rules) and a legend appendix with doc links. A post-pass on purpose — generator-agnostic. 5/5. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MigRSeRnzZH6fo3TP9fRET
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MigRSeRnzZH6fo3TP9fRET
Confirmed retention from the collector artifact as a management-readable table (тип / экземпляров / чем удержан / владелец), why-it-leaks + how-to-fix pulled from rules_own.json per root kind, the pain table carried over from the health report, and fixed next steps. 9/9 (one test assertion fixed: the headline check sliced past the headline). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MigRSeRnzZH6fo3TP9fRET
Confirmed table sorts by root-kind proof strength (static-event, timer, then bare static fields) before count, so the product-owned leaks top the page and the measuring scenario's own list-holders sink with a footnote. New suites (rules_map/annotate/exec/dashboard) wired into ci.yml and the AGENTS.md sweep; history snapshot from the artifacts rebuild. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MigRSeRnzZH6fo3TP9fRET
|
Warning Review limit reached
Next review available in: 18 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThe change adds rule metadata resolution, report annotation and executive-report CLIs, runtime-confirmed dashboard rendering, new fixtures, and regression tests wired into CI and the documented Linux-safe sweep. ChangesReport and dashboard enrichment
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Runtime as runtime-sts.json
participant Builder as viz/build_dashboard.py
participant HTML as sts-dashboard.html
participant Browser as Dashboard browser
Runtime->>Builder: retained runtime records
Builder->>Builder: build rule metadata and runtime payload
Builder->>HTML: serialize dashboard data
HTML->>Browser: render rule details and runtime panel
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
report/tests/test_rules_map.py (1)
55-62: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider failing or warning when the coverage fixture is missing.
Currently, if
sts_audit/findings.jsonis missing (e.g., due to a path change or artifact download failure in CI), the coverage gate is silently skipped and the test will still pass. Consider adding a check to fail or explicitly log a warning so the absence of this critical gate is noticed.♻️ Proposed fix
if os.path.exists(findings_path): with open(findings_path, encoding="utf-8") as fh: findings = json.load(fh)["findings"] total = len(findings) titled = sum(1 for f in findings if describe(f.get("rule", ""), rules)["title"] != f.get("rule", "")) check("coverage", titled / max(total, 1) >= 0.97, "titled %d of %d (%.1f%%)" % (titled, total, 100.0 * titled / max(total, 1))) +else: + print(f"Skipping coverage gate: {findings_path} not found")🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@report/tests/test_rules_map.py` around lines 55 - 62, Update the coverage check around findings_path so a missing sts_audit/findings.json is not silently ignored: explicitly fail the test or emit the repository’s established warning through check. Preserve the existing titled-coverage calculation when the fixture exists.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@report/annotate_cli.py`:
- Line 82: Update the default output-path construction around args.out and
args.report so non-.md report names receive an appended “.annotated.md” suffix
instead of remaining unchanged; preserve the existing replacement behavior for
.md inputs and explicit args.out values.
In `@report/exec_cli.py`:
- Around line 57-75: Normalize retained counts against each record’s expected
allowance in report/exec_cli.py lines 57-75 around retained, best_root, and
total_instances: keep only records with positive count minus expected, and use
that excess for confirmed-leak totals and displayed counts. Apply the same
count-minus-expected normalization before adding runtime chart entries in
viz/build_dashboard.py lines 274-281.
---
Nitpick comments:
In `@report/tests/test_rules_map.py`:
- Around line 55-62: Update the coverage check around findings_path so a missing
sts_audit/findings.json is not silently ignored: explicitly fail the test or
emit the repository’s established warning through check. Preserve the existing
titled-coverage calculation when the fixture exists.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: e6186d57-811a-4fc2-90ae-376c9301f589
⛔ Files ignored due to path filters (6)
report/rules/extra.tsvis excluded by!**/*.tsvreport/rules/idisposable.tsvis excluded by!**/*.tsvreport/rules/meziantou.tsvis excluded by!**/*.tsvreport/rules/propertychanged.tsvis excluded by!**/*.tsvreport/rules/roslynator.tsvis excluded by!**/*.tsvreport/rules/wpfanalyzers.tsvis excluded by!**/*.tsv
📒 Files selected for processing (13)
.github/workflows/ci.ymlAGENTS.mdreport/annotate_cli.pyreport/exec_cli.pyreport/rules_map.pyreport/rules_own.jsonreport/tests/test_annotate.pyreport/tests/test_exec.pyreport/tests/test_rules_map.pyviz/build_dashboard.pyviz/fixtures/runtime-sts.jsonviz/history.jsonlviz/tests/test_dashboard_rules.py
| retained = [r for r in runtime.get("retained", []) if r.get("count")] | ||
| heap = runtime.get("heapStats") or {} | ||
| catalog = load_rules_map() | ||
|
|
||
| kind_rank = {"static-event": 0, "timer": 1, "static-field": 2} | ||
|
|
||
| def best_root(rec): | ||
| roots = rec.get("roots") or [] | ||
| return min(roots, key=lambda r: kind_rank.get(r.get("kind"), 9)) if roots else {} | ||
|
|
||
| # the most PROVEN retention first: an event/timer root names a real product owner, | ||
| # a bare static list may be the measuring scenario's own bookkeeping. | ||
| retained.sort(key=lambda r: (kind_rank.get(best_root(r).get("kind"), 9), -r["count"])) | ||
|
|
||
| total_instances = sum(r["count"] for r in retained) | ||
| out = ["# %s" % title, ""] | ||
| out += ["**Главное:** куча подтверждает утечку по **%d** типам — суммарно **%d** экземпляров, " | ||
| "которые обязаны были собраться сборщиком мусора, но удерживаются живыми." | ||
| % (len(retained), total_instances)] |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Honor expected retention consistently across runtime reports.
Both consumers classify every nonzero retained count as a confirmed leak, ignoring the artifact’s expected allowance.
report/exec_cli.py#L57-L75: include only positive excess and base confirmed-leak totals oncount - expected.viz/build_dashboard.py#L274-L281: apply the same normalization before adding runtime chart entries.
📍 Affects 2 files
report/exec_cli.py#L57-L75(this comment)viz/build_dashboard.py#L274-L281
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@report/exec_cli.py` around lines 57 - 75, Normalize retained counts against
each record’s expected allowance in report/exec_cli.py lines 57-75 around
retained, best_root, and total_instances: keep only records with positive count
minus expected, and use that excess for confirmed-leak totals and displayed
counts. Apply the same count-minus-expected normalization before adding runtime
chart entries in viz/build_dashboard.py lines 274-281.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 25c28105df
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| title: str = "STS — сводка аудита памяти") -> None: | ||
| with open(runtime_path, encoding="utf-8") as fh: | ||
| runtime = json.load(fh) | ||
| retained = [r for r in runtime.get("retained", []) if r.get("count")] |
There was a problem hiding this comment.
When a runtime artifact includes an allowed survivor (the runtime contract/default config uses expected, defaulting to 1 for normal live instances), this filter treats count == expected as a confirmed leak and the executive headline/table says those objects should have collected. That turns clean singleton/control entries into reported leaks and inflates totals; filter and sum on count - expected using the same runtime threshold semantics instead of raw truthy count.
Useful? React with 👍 / 👎.
| if not rec.get("count"): | ||
| continue |
There was a problem hiding this comment.
For runtime.json entries with an expected survivor, this check still displays any nonzero count as “runtime-confirmed retention.” A scenario that legitimately keeps one singleton alive (count: 1, expected: 1) will be plotted as a leak in the dashboard, contradicting the existing correlate logic that only confirms excess retention; skip records whose count - expected is not positive/above the configured threshold.
Useful? React with 👍 / 👎.
| FAIL.append("%s %s" % (name, detail)) | ||
|
|
||
|
|
||
| build_dashboard.main(["viz/fixtures"]) |
There was a problem hiding this comment.
Running the newly added regression sweep executes this call, and build_dashboard.main() writes viz/history.jsonl via _update_history(). From a clean checkout the fixture digest is not the last committed history entry, so the test passes but leaves a tracked file modified and can add synthetic fixture points to the real trend; redirect build_dashboard.HISTORY to a temp file or disable the history write for this test.
Useful? React with 👍 / 👎.
The multi-tool health report prints clusters as '**[...]** — codeql, roslyn',
not '(tool)'; the annotator now matches both and appends every agreeing rule
('cs/local-not-disposed' + IDISP001). 6/6.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MigRSeRnzZH6fo3TP9fRET
…te history Both runtime consumers now report only EXCESS retention (count minus the contract's expected allowance, default 1) — an allowed singleton no longer plots as a leak; fixture + asserts pin it. annotate_cli never defaults its output onto the input for non-.md names. The dashboard test redirects HISTORY to a temp file; the fixture point it had leaked into viz/history.jsonl is scrubbed and the real multi-tool run (72,569) recorded. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MigRSeRnzZH6fo3TP9fRET
1 participant
Доводка отчётов до «удобного вида» — гибридная карта правил + два отчёта под разные аудитории.
rules-map (
report/rules_map.py+report/rules/*.tsv+report/rules_own.json): third-party правила несут официальные EN-титулы, выкачанные из док-индексов анализаторов (Meziantou 211, Roslynator ~260, WpfAnalyzers 83, INPC 25, IDISP 26 + AsyncFixer/Infer#); OWN*/OWN-TIMER/XAML107 — рукописные RU (что это / почему течёт / как чинить). CodeQL-слаги и компиляторные CS деградируют в производные титулы + ссылки. Гейт: ≥97% титулованности на реальных 72k находок.Дашборд (A):
rule_metaв hover топ-правил и в тултипах таблицы («что такое OWN001» — на месте); новая панель Runtime-confirmed retention изruntime-sts.json— reachable-инстансы по типам, цвет = вид корня, hover называет владельца; сабтайтл несёт сценарий + reachability-гейт.Annotate pass (
report/annotate_cli.py): пост-обработка health-report.md — джойн строк списка с findings.json по path:line,RULE+ титул (+RU) в строке, легенда-приложение со ссылками. Генератор-независимый.Executive-отчёт (B, RU) (
report/exec_cli.py): таблица подтверждённых утечек «тип / экземпляров / чем удержан / владелец», сортировка по силе доказательства (static-event → timer → static-field, сноска на generic-держатели), «почему течёт и как чинить» из rules_own, карта боли, следующие шаги. На реальных данных наверху: KDTKTS 107 / GB 79 / GTD 76 уGBProperty.PropertyChanged— плюс два ранее не описанных статических издателя (PrintProperty,GoodsCustomsCostType.PropertyChanged).Тесты: 4 новых bare-script suites (13+5+9+8), включены в ci.yml (+ -O прогон) и AGENTS.md-свип. Регенерированные
artifacts/exec-report.md,health-report.annotated.md,viz/sts-dashboard.html— локально (artifacts/* gitignored).🤖 Generated with Claude Code
https://claude.ai/code/session_01MigRSeRnzZH6fo3TP9fRET
Summary by CodeRabbit
New Features
Tests