016 US6: the deepest corpus, and a ceiling that is actually a ceiling - #18
Open
jlgore wants to merge 1 commit into
Open
016 US6: the deepest corpus, and a ceiling that is actually a ceiling#18jlgore wants to merge 1 commit into
jlgore wants to merge 1 commit into
Conversation
Two refusals that were being spelled as the wrong kind of refusal. An unpinned CodeQL bundle was reaching `steps`, which meant it read as "ran and broke" when nothing had run at all. It is a reason the scan *could not start*, so `probe` now owns it and returns `Unavailable` carrying `expected: UNPINNED` — a spelling no version comparison can be mistaken for, with its own `Display` arm naming the setting that would fix it. `steps` keeps a refusal too, because it authors a command line and re-checks what it is about to write. And the scan budget was handed to every child afresh. A CodeQL scan is a version check plus two children, so a 30s budget bounded a 90s scan while each child looked well-behaved. The budget becomes a deadline at the top of the call and each child gets what is left of it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes US6 of
016-native-tools— the CodeQL adapter — and fixes two refusals that were being spelled as the wrong kind of refusal.What lands
The CodeQL adapter (
3e773bc). A bundle-pinned external scanner:probeanswers everything a scan can be refused for without spawning anything,preflightverifies the CLI's ownversion --format=jsonagainst the operator's pin in-scope, andstepsauthorsdatabase createthendatabase analyze. Traced languages are declined explicitly via a newUnavailableReason::LanguageRequiresBuildcarrying what is analysable — extraction for compiled languages intercepts the build's process spawns, which would mean admitting every compiler and linker the build invokes.An unpinned bundle is now
Unavailable, notFailed(e5b3397). It was reachingsteps, so it read as "ran and broke" when nothing had run.probeowns it now, returningBundleMismatch { expected: UNPINNED, found: None }— a spelling no version comparison can be mistaken for — with its ownDisplayarm naming the setting that would fix it.The scan budget bounds the scan, not each child of it. A CodeQL scan is a version check plus two children, each of which was handed the full budget afresh: a 30s ceiling bounded a 90s scan while every individual child looked well-behaved. The budget becomes a deadline at the top of the call and each child gets what is left of it.
Verification
cargo test --features sec— all green, 0 failurescargo clippy --workspace --all-targets --features sec— cleancargo fmt --check— cleantests/codeql_adapter.rs::the_budget_bounds_the_whole_scan_not_each_child_of_itproves the deadline: three 2s children under a 3s ceiling must fail, and must fail in under 5sNot in this PR
T073 — walking a provisioned bundle end to end and recording it in
quickstart.md. Worth noting the evidence is now in hand: a localcodeql-bundlereports CLI2.26.1(matching the pin), and itsrust/tools/ships notracing-config.lua, which is CodeQL's own tracedness test. Sorustis buildless and belongs inBUILDLESS_LANGUAGES— that one-line change plus the walkthrough is what T073 still owes.🤖 Generated with Claude Code