CLI fixture-ui doctor + Spec 012 T004

[TheHalfMoon]

Summary

• medscale fixture-ui doctor emits FixtureUiViewModel JSON (synthetic-only)
• Mark Spec 012 T004 done (MESC Python refuse architecture test already on main)

Test plan

• cargo test -p medscale-cli
• clippy -D warnings

Made with Cursor

[qodo-code-review]

ⓘ Your Qodo trial ends soon. Ask your workspace admin to set up billing to keep reviews running after the trial. Manage billing

[coderabbitai]

Warning

Review limit reached

Next included review available in 9 minutes.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a229d739-bf90-4cdc-a5db-c3f6d2a50788

📥 Commits

Reviewing files that changed from the base of the PR and between 164f59f and 9eefecc.

📒 Files selected for processing (2)

• crates/medscale-cli/src/main.rs
• specs/012-mesc-artifact-integration/tasks.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Add fixture UI doctor CLI with privacy validation

✨ Enhancement 🧪 Tests 📝 Documentation 🕐 Less than 10 minutes

AI Description

• Add a synthetic-only fixture-ui doctor command that emits typed view-model JSON.
• Reject fixture output violating PHI boundaries or containing known secret markers.
• Cover privacy invariants and mark Spec 012's MESC import boundary task complete.

Diagram

graph TD
  CLI["CLI command"] --> Builder["Report builder"] --> Report["Doctor report"] --> Adapter["Fixture adapter"] --> VM["UI view model"] --> Checks["Privacy checks"] --> Output["JSON output"]

Loading

High-Level Assessment

The current approach is appropriate: it reuses the established doctor report and shared fixture UI contract rather than duplicating presentation structures in the CLI, while enforcing privacy invariants before serialization.

Files changed (2) +43 / -1

Enhancement (1) +42 / -0

main.rsAdd privacy-validated fixture UI doctor output +42/-0

Add privacy-validated fixture UI doctor output

• Adds 'medscale fixture-ui doctor' with optional vault-root context, converts the existing doctor report into a 'FixtureUiViewModel', and emits pretty JSON only after validating the surface, PHI boundary, and secret markers. Adds a unit test covering those output invariants.

crates/medscale-cli/src/main.rs

Documentation (1) +1 / -1

tasks.mdComplete the MESC Python import boundary task +1/-1

Complete the MESC Python import boundary task

• Marks T004 complete and identifies the existing 'mesc_boundary_012' architecture test as its implementation evidence.

specs/012-mesc-artifact-integration/tasks.md

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Incomplete MESC boundary test 🐞 Bug ≡ Correctness

Description

T004 is marked complete, but mesc_boundary_012 only scans crates/*/Cargo.toml with a narrow line
heuristic, so Python runtime imports/invocations and the required shared-database/shared-key
boundaries remain unenforced. This records the architecture safeguard as complete while prohibited
integrations can still enter the workspace undetected.

Code

specs/012-mesc-artifact-integration/tasks.md[6]

+- [x] T004 Architecture refuse MESC Python import (mesc_boundary_012 test)

Relevance

●●● Strong

Boundary test only scans Cargo manifests; it misses required Python runtime, shared database, and
shared-key safeguards.

PR-#26
PR-#29

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The specification explicitly requires refusal of the MESC Python package, shared DB, and shared
keys, while the cited test only iterates crates/*/Cargo.toml, checks three MESC strings, and
applies a dependency-line heuristic. Thus the newly checked task status claims completion beyond
what the test proves.

specs/012-mesc-artifact-integration/tasks.md[3-7]
specs/012-mesc-artifact-integration/spec.md[12-16]
crates/medscale-core/tests/mesc_boundary_012.rs[6-36]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description

Spec 012 T004 is marked complete even though `mesc_boundary_012` does not enforce the full architecture boundary. The current test scans only direct crate manifests with a string heuristic, leaving Python imports/runtime invocation, root/workspace dependency declarations, shared databases, and shared keys unchecked.

## Issue Context

The governing Spec 012 requirement refuses linking/importing the MESC Python package, shared DBs, and shared keys. Either expand the architecture checks to cover all required integration paths and bypass forms, or leave T004 unchecked until that enforcement exists and is active in CI.

## Fix Focus Areas

- specs/012-mesc-artifact-integration/tasks.md[3-7]
- specs/012-mesc-artifact-integration/spec.md[12-16]
- crates/medscale-core/tests/mesc_boundary_012.rs[6-36]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 35 rules

Review mode: ⚖️ Balanced

Tip of the day

💡 Did you know, you can start a comment with 'qodo' or '@qodo' to chat about any finding

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

1. Incomplete mesc boundary test 🐞 Bug ≡ Correctness

T004 is marked complete, but mesc_boundary_012 only scans crates/*/Cargo.toml with a narrow line
heuristic, so Python runtime imports/invocations and the required shared-database/shared-key
boundaries remain unenforced. This records the architecture safeguard as complete while prohibited
integrations can still enter the workspace undetected.

Agent Prompt

## Issue description

Spec 012 T004 is marked complete even though `mesc_boundary_012` does not enforce the full architecture boundary. The current test scans only direct crate manifests with a string heuristic, leaving Python imports/runtime invocation, root/workspace dependency declarations, shared databases, and shared keys unchecked.

## Issue Context

The governing Spec 012 requirement refuses linking/importing the MESC Python package, shared DBs, and shared keys. Either expand the architecture checks to cover all required integration paths and bypass forms, or leave T004 unchecked until that enforcement exists and is active in CI.

## Fix Focus Areas

- specs/012-mesc-artifact-integration/tasks.md[3-7]
- specs/012-mesc-artifact-integration/spec.md[12-16]
- crates/medscale-core/tests/mesc_boundary_012.rs[6-36]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools