test(impact): prove reverse package exposure through CLI by TheHalfMoon · Pull Request #28 · TheHalfMoon/commandF

TheHalfMoon · 2026-08-26T07:18:55Z

Scope

CF-12 T022 follow-up evidence only.

PR #27 shipped commandf impact and was merged while this additional end-to-end package-exposure proof was being prepared. This PR preserves the merged implementation unchanged and adds only the missing CLI-level regression evidence.

Change

run commandf impact acme.shared against real synthetic schema-v2 before/after lock + cache states;
prove the reverse dependent package acme.subject is present specifically inside package_impacts;
prove the package-impact path preserves the exact before/after declared constraints (1.0.0 and 2.0.0);
parameterize the existing test helper so the same fixture can select either package.

Boundaries

no production code changes;
no compatibility severity authority;
no CF-06 / HL7 pin change;
no CF-10 corpus change;
no lock schema change;
no network behavior;
no new dependency.

Keep Draft until exact-head CI/applicable proofs and independent review are terminal and clean. This PR is intended to close the remaining CLI-level evidence gap for CF-12 T022 before convergence.

Summary by CodeRabbit

Tests
- Added coverage confirming impact analysis identifies reverse-dependent packages.
- Verified that dependency constraints remain consistent before and after impact analysis.

coderabbitai · 2026-08-26T07:19:02Z

Warning

Review limit reached

Next included review available in 11 minutes.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7ba2b85d-8dd4-470a-a8f9-635dfc7fcc27

📥 Commits

Reviewing files that changed from the base of the PR and between cd065b6 and c874c8c.

📒 Files selected for processing (1)

crates/commandf-cli/tests/impact_behavior.rs

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 50872fc2-c30b-4073-8334-3d317ae0d4aa

📥 Commits

Reviewing files that changed from the base of the PR and between 9e462cb and cd065b6.

📒 Files selected for processing (1)

crates/commandf-cli/tests/impact_behavior.rs

Included review availability: Your plan provides up to 10 included reviews per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The integration tests cover reverse dependency reporting for acme.shared. The test helper now accepts a package name while preserving the existing acme.subject wrapper.

Changes

Impact analysis

Layer / File(s)	Summary
Reverse impact coverage and test helper `crates/commandf-cli/tests/impact_behavior.rs`	The tests verify `acme.shared`, its reverse dependent `acme.subject`, and the declared `1.0.0` and `2.0.0` constraints. `run_impact_for` supports package-specific analysis, while `run_impact` keeps the default subject package.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to cd065

This PR adds localized CLI regression coverage without changing production behavior, dependencies, or deployment configuration; it is merge-ready after normal checks and review, with no actionable merge-blocking risk remaining.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies a CLI impact-analysis test that verifies reverse package exposure. It matches the main change described in the pull request.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch test/cf12-impact-cli-package-exposure

_{Comment @coderabbitai help to get the list of available commands.}

TheHalfMoon · 2026-08-26T07:19:07Z

@coderabbitai review

TheHalfMoon · 2026-08-26T07:19:12Z

/review

coderabbitai · 2026-08-26T07:19:14Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

TheHalfMoon · 2026-08-26T07:22:47Z

@coderabbitai review

coderabbitai · 2026-08-26T07:22:55Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

qodo-code-review · 2026-08-26T07:23:23Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. ~~Constraints aren't tied to package~~ ✓ Resolved 🐞 Bug ≡ Correctness

Description

The test checks for acme.subject and both constraints independently anywhere in the serialized
package_impacts region, so it can pass when those values belong to different package-impact
relations. This fails to prove the intended regression guarantee that the reverse-dependent
acme.subject relation itself preserves the exact before/after constraints.

Code

crates/commandf-cli/tests/impact_behavior.rs[R103-104]

+        package_impacts.contains("\"declared_constraint\": \"1.0.0\"")
+            && package_impacts.contains("\"declared_constraint\": \"2.0.0\""),

Relevance

●●● Strong
PR #10 established precedent: regression tests must exercise the exact intended boundary, not weaker
proxies.
PR-#10

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The report schema stores package identity and constraints in distinct nested fields, and the builder
creates one relation per impacted package with constraints attached to that relation's path.
Independent whole-region substring checks therefore do not verify the association the test is
intended to lock down.
crates/commandf-cli/tests/impact_behavior.rs[90-105]
crates/commandf-pkg/src/impact_model.rs[53-66]
crates/commandf-pkg/src/impact.rs[443-456]
crates/commandf-pkg/src/impact.rs[484-498]
PR-#10

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The CLI regression test uses independent substring checks, so it does not associate `acme.subject` with the path steps carrying constraints `1.0.0` and `2.0.0`.

## Issue Context
Deserialize stdout into a JSON value or a typed report, select the `package_impacts` relation whose impacted package is `acme.subject`, and assert that this relation's before/after path data contains the expected declared constraints on the appropriate sides.

## Fix Focus Areas
- crates/commandf-cli/tests/impact_behavior.rs[87-106]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Context sources

✅ Compliance rules (platform): 13 rules

Review mode: ⚖️ Balanced

Tip of the day

💡 Did you know, you can start a comment with 'qodo' or '@qodo' to chat about any finding

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Previous reviews

Review updated until commit c874c8c ⚖️ Balanced

Results up to commit cd065b6 ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. ~~Constraints aren't tied to package~~ ✓ Resolved 🐞 Bug ≡ Correctness

Description

The test checks for acme.subject and both constraints independently anywhere in the serialized
package_impacts region, so it can pass when those values belong to different package-impact
relations. This fails to prove the intended regression guarantee that the reverse-dependent
acme.subject relation itself preserves the exact before/after constraints.

Code

crates/commandf-cli/tests/impact_behavior.rs[R103-104]

+        package_impacts.contains("\"declared_constraint\": \"1.0.0\"")
+            && package_impacts.contains("\"declared_constraint\": \"2.0.0\""),

Relevance

●●● Strong
PR #10 established precedent: regression tests must exercise the exact intended boundary, not weaker
proxies.
PR-#10

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The report schema stores package identity and constraints in distinct nested fields, and the builder
creates one relation per impacted package with constraints attached to that relation's path.
Independent whole-region substring checks therefore do not verify the association the test is
intended to lock down.
crates/commandf-cli/tests/impact_behavior.rs[90-105]
crates/commandf-pkg/src/impact_model.rs[53-66]
crates/commandf-pkg/src/impact.rs[443-456]
crates/commandf-pkg/src/impact.rs[484-498]
PR-#10

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The CLI regression test uses independent substring checks, so it does not associate `acme.subject` with the path steps carrying constraints `1.0.0` and `2.0.0`.

## Issue Context
Deserialize stdout into a JSON value or a typed report, select the `package_impacts` relation whose impacted package is `acme.subject`, and assert that this relation's before/after path data contains the expected declared constraints on the appropriate sides.

## Fix Focus Areas
- crates/commandf-cli/tests/impact_behavior.rs[87-106]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Results up to commit c874c8c ⚖️ Balanced

No changes from previous review

qodo-code-review · 2026-08-26T07:25:57Z

ⓘ Your Qodo trial ends soon. Ask your workspace admin to set up billing to keep reviews running after the trial. Manage billing

TheHalfMoon · 2026-08-26T07:28:48Z

@coderabbitai review

coderabbitai · 2026-08-26T07:28:54Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

TheHalfMoon · 2026-08-26T07:28:54Z

/review

qodo-code-review · 2026-08-26T07:30:09Z

Code review by qodo was updated up to the latest commit c874c8c

greptile-apps

Your trial has ended. Reactivate Greptile to resume code reviews.

qodo-code-review · 2026-08-26T08:28:12Z

PR Summary by Qodo

Prove reverse package exposure through the impact CLI

🧪 Tests 🕐 Less than 10 minutes

AI Description

• Adds CLI regression coverage for reverse dependents in package impact reports.
• Verifies before and after relations retain exact declared constraints.
• Parameterizes impact invocation helpers to target either synthetic package.

Diagram

sequenceDiagram
    participant Test as Regression Test
    participant CLI as commandf impact
    participant Before as Before State
    participant After as After State
    participant Report as Impact Report
    Test->>CLI: Analyze acme.shared
    CLI->>Before: Load lock and cache
    CLI->>After: Load lock and cache
    CLI->>Report: Build package impacts
    Report-->>Test: Return JSON relations

High-Level Assessment

The focused CLI-level regression is the appropriate approach because it closes the stated evidence gap without changing production behavior. Lower-level library assertions would not prove public command output, while duplicating fixtures would add unnecessary maintenance; parameterizing the existing invocation helper keeps the scope minimal.

Files changed (1) +84 / -1

Tests (1) +84 / -1

impact_behavior.rsAdd reverse package exposure CLI regression coverage +84/-1

Add reverse package exposure CLI regression coverage

• Adds an end-to-end impact test showing that changing 'acme.shared' exposes reverse-dependent 'acme.subject' entries in 'package_impacts' for both states. It verifies the before and after sides preserve declared constraints '1.0.0' and '2.0.0', and parameterizes the CLI helper to select the analyzed package.

crates/commandf-cli/tests/impact_behavior.rs

qodo-code-review · 2026-08-26T08:29:36Z

Code review by qodo was updated up to the latest commit c874c8c

test(impact): prove reverse package exposure through CLI

cd065b6

qodo-code-review Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread crates/commandf-cli/tests/impact_behavior.rs Outdated

test(impact): bind constraints to package relations

6210db2

style(impact): match rustfmt relation assertion

c874c8c

TheHalfMoon marked this pull request as ready for review August 26, 2026 08:27

greptile-apps Bot reviewed Aug 26, 2026

View reviewed changes

TheHalfMoon merged commit 71c5c43 into main Aug 26, 2026
9 checks passed

TheHalfMoon mentioned this pull request Aug 26, 2026

docs(cf12): close deterministic impact convergence #29

Merged

qodo-code-review Bot mentioned this pull request Aug 26, 2026

feat(cf13): add deterministic quality-gate library #31

Merged

Conversation

TheHalfMoon commented Aug 26, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Scope

Change

Boundaries

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

TheHalfMoon commented Aug 26, 2026

Uh oh!

TheHalfMoon commented Aug 26, 2026

Uh oh!

coderabbitai Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TheHalfMoon commented Aug 26, 2026

Uh oh!

coderabbitai Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-code-review Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

Uh oh!

qodo-code-review Bot commented Aug 26, 2026

Uh oh!

TheHalfMoon commented Aug 26, 2026

Uh oh!

coderabbitai Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TheHalfMoon commented Aug 26, 2026

Uh oh!

qodo-code-review Bot commented Aug 26, 2026

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

qodo-code-review Bot commented Aug 26, 2026

PR Summary by Qodo

Uh oh!

qodo-code-review Bot commented Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

TheHalfMoon commented Aug 26, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 26, 2026 •

edited

Loading

coderabbitai Bot commented Aug 26, 2026 •

edited

Loading

coderabbitai Bot commented Aug 26, 2026 •

edited

Loading

qodo-code-review Bot commented Aug 26, 2026 •

edited

Loading

coderabbitai Bot commented Aug 26, 2026 •

edited

Loading