cleanup#144
Conversation
Removes private data that GitHub secret scanning does not catch: - docs/archive/EXPECTED_VALUE_DATABASE.md: strip 12 private Notion workspace links (root CLAUDE.md forbids copying Notion links into the repo) and a collaborator's first name. - nonprofit-identity.ts: remove bank name + account last-4 and a private vendor rejection from a code comment. - .env.example: replace a real cloud account ID with a placeholder. Adds scripts/leak-scan.mjs + a CI job that fails PRs containing private Notion links, bank-account references, or non-placeholder cloud account IDs. Structural patterns only, so the denylist itself carries no secrets. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Per Mike: deleting the archived planning docs is cleaner than leaving redaction breadcrumbs, and archived planning docs belong in Notion (repo policy), not a public repo. Removes all of docs/archive/ (including the Notion-link-leaking EXPECTED_VALUE_DATABASE.md). The fix-ai canonical-argument transcript is read at runtime, so it is relocated to docs/ (the loader already had a docs/ fallback path); trimmed the now-dead archive candidate paths and the docs/README entry. fix-ai-content test passes against the new location. Keeps the nonprofit-identity.ts + .env.example redactions and the CI leak-scan gate from the first commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- notion-private-link rule: match slug-prefixed notion.so URLs (notion.so/<workspace>/<Title>-<hex>, the default Notion "copy link" format) and *.notion.site hosts, not just a bare hex segment immediately after notion.so/. Verified the old regex missed both real-world formats; verified the new one still ignores the notion.so/mercury-style test fixtures. - bank-account-ref rule: add "account number:", "account no.", and "account no 1234" phrasing as an additional alternative alongside the existing checking/savings/account #NNNN pattern. - tracked(): use `git ls-files -z` and split on the NUL byte instead of newline-splitting, so a tracked filename containing a newline can't produce a bogus path and skip scanning. - ci.yml leak-scan job: set persist-credentials: false on the checkout step. This job checks out untrusted PR content (a fork PR could modify scripts/leak-scan.mjs itself) and never needs to push afterward, matching the same pattern already used at ci.yml:895 for the fork-head checkout in sync-preview-managed-data. node scripts/leak-scan.mjs stays clean (3828 files). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 42 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a CI leak scanner, removes archived documentation and references, adds a canonical argument document, updates its runtime lookup, and adjusts related configuration and identity comments. ChangesRepository hygiene and canonical documentation
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant CI as leak-scan CI job
participant Checkout as actions/checkout
participant Scanner as scripts/leak-scan.mjs
participant Files as tracked repository files
CI->>Checkout: checkout without persisted credentials
CI->>Scanner: run node scripts/leak-scan.mjs
Scanner->>Files: enumerate and scan tracked files
Scanner-->>CI: report matches and return exit status
Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 665060083a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
PR review packetStart here
No user-facing page or component changes were inferred from changed files or the visual review manifest. Changed files considered
Updated automatically when this PR's preview or visual review reruns. |
- bank-account-ref pattern now matches camelCase/snake_case keys (accountNumber, ACCOUNT_NUMBER) and quoted or =-delimited values, which previously slipped past the CI leak-scan gate. - MCP_SERVER.md no longer links to the deleted docs/archive/ EXPECTED_VALUE_DATABASE.md file. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
docs/canonical-argument-2026-05-20.md (1)
48-48: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winMove operational backlog items into the task tree.
The slider note and open-questions list are a parallel Markdown checklist for audits, implementation, and product decisions. Move them to the owning
optimitron:devtasks, update their status/comments, and leave task links here; replace “this turn” with a dated status if the note remains. As per coding guidelines, use the productionoptimitron:devtask tree instead of maintaining a parallel Markdown checklist.Also applies to: 66-72
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/canonical-argument-2026-05-20.md` at line 48, Move the slider note and open questions around the referenced documentation section into the owning optimitron:dev task tree, updating each task’s status and comments as needed. Replace the Markdown checklist entries with links to those tasks, and if any note remains, replace “this turn” with a dated status.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/canonical-argument-2026-05-20.md`:
- Line 18: Separate the unsupported causal connection between reducing the
capacity claim from 122 to 121 and achieving a 12× speedup. Update the
statements around the capacity claim and the `443 ÷ 36` calculation so the
speedup is presented only as derived from that calculation, unless a valid
derivation linking the two values is added.
- Line 21: Normalize the terrorism and disease risk figures in the argument so
both use the same time horizon, updating the associated wording and parameter
mapping consistently. Revise the “actual risk distribution” comparison to
reflect the normalized values rather than contrasting annual terrorism risk with
lifetime disease mortality.
- Around line 62-64: Update the ratio entry in the parameter table to use the
intended cost-of-war-and-disease numerator and the universal shirt distribution
cost denominator, matching the framing on lines 46 and 71. If retaining 1.77
million×, reference the unrounded values used to calculate it; otherwise change
the displayed ratio to match the rounded $84Q ÷ $48B inputs.
In `@scripts/leak-scan.mjs`:
- Around line 44-45: Remove the broad scripts/leak-scan.mjs entry from
PATH_ALLOW so the scanner source is scanned for leaked content. Keep PATH_ALLOW
only for narrowly reviewed path exemptions, adding line-specific handling only
if the scanner itself requires it.
- Around line 73-75: Update the exemption check in the line-processing loop of
leak-scan.mjs so “leak-scan-ok” is recognized only within a valid trailing
comment, not arbitrary line content. Match the supported inline comment syntax
according to the scanned file type, while preserving exemptions for legitimate
trailing comments.
---
Nitpick comments:
In `@docs/canonical-argument-2026-05-20.md`:
- Line 48: Move the slider note and open questions around the referenced
documentation section into the owning optimitron:dev task tree, updating each
task’s status and comments as needed. Replace the Markdown checklist entries
with links to those tasks, and if any note remains, replace “this turn” with a
dated status.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: a623c0c1-72df-4730-aeaa-cdd12037cad7
📒 Files selected for processing (19)
.env.example.github/workflows/ci.ymldocs/MCP_SERVER.mddocs/README.mddocs/archive/EXPECTED_VALUE_DATABASE.mddocs/archive/README.mddocs/archive/REFERENCES.mddocs/archive/TODO-history-2026-07.mddocs/archive/ai-challenge-eod-2026-05-20.mddocs/archive/earth-optimization-date-2026-05-20.mddocs/archive/joke-handout-draft.mddocs/archive/mcp-tasks-improvements-2026-05-24.mddocs/archive/mockup.mddocs/archive/one-percent-treaty-song.mddocs/archive/shirt-distribution-thesis-2026-05-20.mddocs/canonical-argument-2026-05-20.mdpackages/web/src/app/fix-ai/corpus.server.tspackages/web/src/lib/nonprofit-identity.tsscripts/leak-scan.mjs
💤 Files with no reviewable changes (12)
- docs/archive/TODO-history-2026-07.md
- docs/archive/joke-handout-draft.md
- docs/archive/mockup.md
- docs/archive/mcp-tasks-improvements-2026-05-24.md
- docs/archive/EXPECTED_VALUE_DATABASE.md
- docs/archive/shirt-distribution-thesis-2026-05-20.md
- docs/archive/earth-optimization-date-2026-05-20.md
- docs/archive/README.md
- docs/archive/REFERENCES.md
- docs/README.md
- docs/archive/ai-challenge-eod-2026-05-20.md
- docs/archive/one-percent-treaty-song.md
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 5
🧹 Nitpick comments (1)
docs/canonical-argument-2026-05-20.md (1)
48-48: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winMove operational backlog items into the task tree.
The slider note and open-questions list are a parallel Markdown checklist for audits, implementation, and product decisions. Move them to the owning
optimitron:devtasks, update their status/comments, and leave task links here; replace “this turn” with a dated status if the note remains. As per coding guidelines, use the productionoptimitron:devtask tree instead of maintaining a parallel Markdown checklist.Also applies to: 66-72
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/canonical-argument-2026-05-20.md` at line 48, Move the slider note and open questions around the referenced documentation section into the owning optimitron:dev task tree, updating each task’s status and comments as needed. Replace the Markdown checklist entries with links to those tasks, and if any note remains, replace “this turn” with a dated status.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/canonical-argument-2026-05-20.md`:
- Line 18: Separate the unsupported causal connection between reducing the
capacity claim from 122 to 121 and achieving a 12× speedup. Update the
statements around the capacity claim and the `443 ÷ 36` calculation so the
speedup is presented only as derived from that calculation, unless a valid
derivation linking the two values is added.
- Line 21: Normalize the terrorism and disease risk figures in the argument so
both use the same time horizon, updating the associated wording and parameter
mapping consistently. Revise the “actual risk distribution” comparison to
reflect the normalized values rather than contrasting annual terrorism risk with
lifetime disease mortality.
- Around line 62-64: Update the ratio entry in the parameter table to use the
intended cost-of-war-and-disease numerator and the universal shirt distribution
cost denominator, matching the framing on lines 46 and 71. If retaining 1.77
million×, reference the unrounded values used to calculate it; otherwise change
the displayed ratio to match the rounded $84Q ÷ $48B inputs.
In `@scripts/leak-scan.mjs`:
- Around line 44-45: Remove the broad scripts/leak-scan.mjs entry from
PATH_ALLOW so the scanner source is scanned for leaked content. Keep PATH_ALLOW
only for narrowly reviewed path exemptions, adding line-specific handling only
if the scanner itself requires it.
- Around line 73-75: Update the exemption check in the line-processing loop of
leak-scan.mjs so “leak-scan-ok” is recognized only within a valid trailing
comment, not arbitrary line content. Match the supported inline comment syntax
according to the scanned file type, while preserving exemptions for legitimate
trailing comments.
---
Nitpick comments:
In `@docs/canonical-argument-2026-05-20.md`:
- Line 48: Move the slider note and open questions around the referenced
documentation section into the owning optimitron:dev task tree, updating each
task’s status and comments as needed. Replace the Markdown checklist entries
with links to those tasks, and if any note remains, replace “this turn” with a
dated status.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: a623c0c1-72df-4730-aeaa-cdd12037cad7
📒 Files selected for processing (19)
.env.example.github/workflows/ci.ymldocs/MCP_SERVER.mddocs/README.mddocs/archive/EXPECTED_VALUE_DATABASE.mddocs/archive/README.mddocs/archive/REFERENCES.mddocs/archive/TODO-history-2026-07.mddocs/archive/ai-challenge-eod-2026-05-20.mddocs/archive/earth-optimization-date-2026-05-20.mddocs/archive/joke-handout-draft.mddocs/archive/mcp-tasks-improvements-2026-05-24.mddocs/archive/mockup.mddocs/archive/one-percent-treaty-song.mddocs/archive/shirt-distribution-thesis-2026-05-20.mddocs/canonical-argument-2026-05-20.mdpackages/web/src/app/fix-ai/corpus.server.tspackages/web/src/lib/nonprofit-identity.tsscripts/leak-scan.mjs
💤 Files with no reviewable changes (12)
- docs/archive/TODO-history-2026-07.md
- docs/archive/joke-handout-draft.md
- docs/archive/mockup.md
- docs/archive/mcp-tasks-improvements-2026-05-24.md
- docs/archive/EXPECTED_VALUE_DATABASE.md
- docs/archive/shirt-distribution-thesis-2026-05-20.md
- docs/archive/earth-optimization-date-2026-05-20.md
- docs/archive/README.md
- docs/archive/REFERENCES.md
- docs/README.md
- docs/archive/ai-challenge-eod-2026-05-20.md
- docs/archive/one-percent-treaty-song.md
🛑 Comments failed to post (5)
docs/canonical-argument-2026-05-20.md (3)
18-18: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Do not encode an unsupported causal link between the 121/122 claim and 12× speed.
Line 18 makes the speedup conditional on reducing overkill from 122 to 121, but Lines 55-56 derive 12× solely from
443 ÷ 36 ≈ 12.3; no relationship to the 122→121 change is modeled. Split the claims or add the missing derivation before exposing them downstream.Also applies to: 55-56
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/canonical-argument-2026-05-20.md` at line 18, Separate the unsupported causal connection between reducing the capacity claim from 122 to 121 and achieving a 12× speedup. Update the statements around the capacity claim and the `443 ÷ 36` calculation so the speedup is presented only as derived from that calculation, unless a valid derivation linking the two values is added.
21-21: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Normalize the risk comparison to one time horizon.
Line 59 defines terrorism risk annually, while Line 60 describes lifetime disease mortality. Comparing them as the “actual risk distribution” is not valid; use annual-to-annual or lifetime-to-lifetime values and update the wording and parameter mapping.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/canonical-argument-2026-05-20.md` at line 21, Normalize the terrorism and disease risk figures in the argument so both use the same time horizon, updating the associated wording and parameter mapping consistently. Revise the “actual risk distribution” comparison to reflect the normalized values rather than contrasting annual terrorism risk with lifetime disease mortality.
62-64: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash rg -n '\b(EXPECTED_TREATY_VALUE_USD|DFDA_TRIAL_CAPACITY_PLUS_EFFICACY_LAG_ECONOMIC_VALUE|UNIVERSAL_SHIRT_DISTRIBUTION_COST_USD)\b' --glob '!node_modules' --glob '!dist'Repository: mikepsinn/optimitron
Length of output: 158
🏁 Script executed:
#!/bin/bash set -u echo "== repo files related to target ==" fd -a 'canonical-argument-2026-05-20\.md$|AGENTS\.md$|SYSTEM_MAP\.md$' . | sed 's#^\./##' echo echo "== target file outline/size ==" wc -l docs/canonical-argument-2026-05-20.md 2>/dev/null || true sed -n '1,100p' docs/canonical-argument-2026-05-20.md 2>/dev/null || true echo echo "== search canonical identifiers broadly ==" find docs .claude pnpm-lock.yaml 2>/dev/null | head -500 | xargs rg -n '\b(EXPECTED_TREATY_VALUE_USD|DFDA_TRIAL_CAPACITY_PLUS_EFFICACY_LAG_ECONOMIC_VALUE|UNIVERSAL_SHIRT_DISTRIBUTION_COST_USD|shirt distribution|Millions of times less|84Q|48B)\b' 2>/dev/null || trueRepository: mikepsinn/optimitron
Length of output: 12122
🏁 Script executed:
#!/bin/bash set -u echo "== parameter definitions/search ==" rg -n '\b(EXPECTED_TREATY_VALUE_USD|DFDA_TRIAL_CAPACITY_PLUS_EFFICACY_LAG_ECONOMIC_VALUE|UNIVERSAL_SHIRT_DISTRIBUTION_COST_USD)\b' --glob '!node_modules' --glob '!dist' 2>/dev/null || true echo echo "== related parameter names ==" rg -n '(EXPECTED_TREATY_VALUE|TREATY.*VALUE|ECONOMIC_VALUE|UNIVERSAL_SHIRT|SHIRT_DISTRIBUTION_COST)\b' --glob '!node_modules' --glob '!dist' 2>/dev/null || true echo echo "== docs/questions relevant sections ==" sed -n '690,815p' docs/questions.md 2>/dev/null || true echo echo "== arithmetic check for rounded inputs ==" python3 - <<'PY' n = 84e15 d = 48e9 print("rounded ratio =", n/d, "million =", n/d/1e6) PYRepository: mikepsinn/optimitron
Length of output: 193
Align the “millions of times less” ratio with its denominator.
Lines 46 and 71 frame the cited ratio as shirt cost versus the cost of war and disease. In the parameter table, line 63 maps
$84QtoDFDA_TRIAL_CAPACITY_PLUS_EFFICACY_LAG_ECONOMIC_VALUE, while line 64 derives the ratio fromEXPECTED_TREATY_VALUE_USD ÷ UNIVERSAL_SHIRT_DISTRIBUTION_COST_USD. Use the intended numerator/denominator consistently, and if1.77 million×is intentional, show the unrounded input values because the displayed rounded inputs give84Q ÷ 48B = 1.75M×.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/canonical-argument-2026-05-20.md` around lines 62 - 64, Update the ratio entry in the parameter table to use the intended cost-of-war-and-disease numerator and the universal shirt distribution cost denominator, matching the framing on lines 46 and 71. If retaining 1.77 million×, reference the unrounded values used to calculate it; otherwise change the displayed ratio to match the rounded $84Q ÷ $48B inputs.scripts/leak-scan.mjs (2)
44-45: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not exclude the scanner source from scanning.
Line 45 omits every version of this tracked file, so an actual private URL or account reference added to
scripts/leak-scan.mjswill always pass CI. The current scanner source does not require this broad exclusion; remove it and use narrowly reviewed line exemptions if needed.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/leak-scan.mjs` around lines 44 - 45, Remove the broad scripts/leak-scan.mjs entry from PATH_ALLOW so the scanner source is scanned for leaked content. Keep PATH_ALLOW only for narrowly reviewed path exemptions, adding line-specific handling only if the scanner itself requires it.
73-75: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Require a real trailing comment for scan exemptions.
Line 75 accepts
leak-scan-okanywhere in the line. A private Notion URL can include that text in a query or fragment and bypass the scan without an inline comment. Match only supported trailing comment forms, preferably by file type.Proposed direction
- if (line.includes("leak-scan-ok")) continue; + if (hasTrailingLeakScanComment(file, line)) continue;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/leak-scan.mjs` around lines 73 - 75, Update the exemption check in the line-processing loop of leak-scan.mjs so “leak-scan-ok” is recognized only within a valid trailing comment, not arbitrary line content. Match the supported inline comment syntax according to the scanned file type, while preserving exemptions for legitimate trailing comments.
update-pr-branches.yml (merged in #142) pushes merge-from-main commits as github-actions[bot]. claude-code-action hard-fails for non-human actors ("Workflow initiated by non-human actor"), so every auto-updated PR got a red claude-review check the moment the auto-updater did its job — first seen on PR #143 within a minute of #142 landing. Skip the job for bot-triggered synchronize events instead of allowlisting the bot: a merge from main leaves the PR diff unchanged, so re-reviewing it would burn a full review run on nothing new. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Mf3c4CzpfCCqAQA2k4UQKH
|
Superseded by a squashed version of the same diff (byte-identical content); new PR follows. |
Housekeeping pass:
docs/archive/folder of historical planning docs (per repo policy, working/planning docs belong in Notion, not the repo). The one file read at runtime by the fix-ai feature (canonical-argument-2026-05-20.md) is relocated todocs/, where the loader already had a fallback path;fix-ai-contenttest passes against the new location.scripts/leak-scan.mjs+ aleak-scanCI job that fails a PR containing private workspace links, account-number references, or non-placeholder cloud account IDs. Structural patterns only — the script carries no sensitive literals. Scans all tracked files in a few seconds..env.exampleand a code comment.Replaces PR #141, which GitHub auto-closed when its branch was renamed. Review comments on that PR were already triaged and their fixes are in this branch's history.
Summary by CodeRabbit
Documentation
Quality Improvements