Docs/qodo evidence

[GautamTalksDev]

An access governance agent. Finds every grant your people and your AI agents still hold, waits for human approval, and writes a verifiable audit trail. Built on TrueForge.

[qodo-code-review]

PR Summary by Qodo

Improve AI agent queue visibility and document Qodo review evidence

✨ Enhancement 🐞 Bug fix 🧪 Tests 📝 Documentation 🕐 20-40 Minutes

AI Description

• Pins AI-agent grants separately and aligns keyboard navigation with rendered queue order.
• Uses declaration status for accurate unregistered-agent highlighting, labels, and summary counts.
• Collapses card evidence for readability and documents Qodo findings from prior reviews.

Diagram

graph TD
  A["Scan cards"] --> B["Format helpers"] --> C["Queue sections"] --> D["Approval cards"] --> E["Evidence details"]
  B --> F["Scan summary"]

Loading

High-Level Assessment

The centralized formatting-helper approach is appropriate because queue rendering, keyboard navigation, and headline counts share the same identity semantics. Component-local filtering was considered but would risk display and navigation order diverging again.

Files changed (5) +316 / -21

Enhancement (2) +106 / -21

ApprovalCardView.tsxMake agent status and card evidence easier to scan +61/-15

Make agent status and card evidence easier to scan

• Highlights unregistered agents from authoritative declaration status and labels Keyring-originated identities as self-inventory. Replaces always-expanded attribution and risk text with concise conclusions and expandable detail sections.

apps/web/src/components/ApprovalCardView.tsx

ApprovalQueue.tsxAdd a dedicated AI-agent queue section +45/-6

Add a dedicated AI-agent queue section

• Renders AI-agent grants between unattributed and attributed sections with a distinct heading. Uses the rendered section order for focus, keyboard navigation, selection, and queue totals.

apps/web/src/components/ApprovalQueue.tsx

Bug fix (1) +46 / -0

format.tsCentralize agent classification, counts, and queue sections +46/-0

Centralize agent classification, counts, and queue sections

• Introduces declaration-status-based unregistered-agent detection and reports unique unregistered agents in scan summaries. Adds queue partitioning that groups non-agent unattributed cards, all AI-agent grants, and attributed non-agent cards in visual order.

apps/web/src/lib/format.ts

Tests (1) +148 / -0

format.test.tsCover agent status, counts, and visual queue ordering +148/-0

Cover agent status, counts, and visual queue ordering

• Adds regression coverage proving unresolved declared agents are not marked unregistered and true unregistered agents are counted. Verifies keyboard order follows rendered sections and agent queue rows count grants rather than unique identities.

apps/web/src/lib/format.test.ts

Documentation (1) +16 / -0

README.mdDocument Qodo review evidence and resulting fixes +16/-0

Document Qodo review evidence and resulting fixes

• Adds evidence that Qodo reviewed all merged pull requests and links representative findings. Summarizes test-isolation, audit-ledger concurrency, demo safety, and agent-labelling fixes prompted by those reviews.

README.md

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Unattributed warning becomes hidden ✓ Resolved 🐞 Bug ≡ Correctness

Description

The new collapsed inference summary only parses reasoning containing Inference chain:, so every
unknown-bucket card displays the generic no matching inference text while its explicit high-risk
warning is hidden inside the disclosure. This removes decision-critical context that was previously
visible by default and labels the disclosure as an inference chain even though unknown reasoning has
none.

Code

apps/web/src/components/ApprovalCardView.tsx[R234-239]

+  const chain = card.attribution.reasoning.split("Inference chain:")[1]?.trim();
+  const firstSignal = chain
+    ?.split(" → ")[0]
+    ?.replace(/^\([^)]+\)\s*/, "")
+    .split(":")[0]
+    ?.trim();

Relevance

●●● Strong

Recent reviews consistently accepted fixes preventing UI from hiding or misrepresenting
decision-critical scan context.

PR-#7
PR-#9

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Core assigns unknown grants reasoning that says they could not be attributed and are “the scariest
findings,” without the parser's Inference chain: delimiter. The new parser necessarily falls back
to no matching inference, while the full warning is now placed in a closed <details> element.

packages/core/src/approval-build.ts[49-53]
packages/core/src/identity/reconcile.ts[554-560]
apps/web/src/components/ApprovalCardView.tsx[188-195]
apps/web/src/components/ApprovalCardView.tsx[233-242]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Unknown-bucket attribution reasoning does not use the `Inference chain:` format, causing its warning to be replaced by a generic collapsed summary.

## Issue Context
Provide a separate summary for unattributed cards that surfaces the unknown-bucket warning, and use a disclosure label that does not claim an inference chain exists.

## Fix Focus Areas
- apps/web/src/components/ApprovalCardView.tsx[188-195]
- apps/web/src/components/ApprovalCardView.tsx[233-242]
- packages/core/src/identity/reconcile.ts[554-560]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Spoofable self-inventory badge ✓ Resolved 🐞 Bug ≡ Correctness

Description

ApprovalCardView labels any AI agent named Keyring as “Self-inventory,” even when its evidence
came from an external fixture or MCP source. This presents an unverified name as provenance and can
mislead reviewers about who discovered the access.

Code

apps/web/src/components/ApprovalCardView.tsx[R89-92]

+                (card.grant.principal.agentName === "Keyring" ||
+                  card.grant.evidence.some(
+                    (evidence) => evidence.source === "keyring:self-inventory",
+                  )) ? (

Relevance

●●● Strong

Recent PR #9 accepted correcting UI classification to use authoritative declaration data rather than
inferred fields.

PR-#9

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Agent names and evidence are independent source-provided fields, and records from the external
source and self-inventory are merged before being mapped unchanged to grants. Therefore an external
record can use the name Keyring without carrying the explicit self-inventory evidence marker, yet
the new UI condition still grants it the badge.

packages/connectors/src/agent-identity/connector.ts[12-38]
packages/connectors/src/agent-identity/connector.ts[65-75]
packages/connectors/src/agent-identity/connector.ts[136-161]
fixtures/test-org/agent-identities.json[88-94]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The Self-inventory badge currently trusts `agentName === "Keyring"`, although agent names are source-provided and do not establish provenance.

## Issue Context
Use the explicit `keyring:self-inventory` evidence marker, or another authoritative provenance field, rather than a display name.

## Fix Focus Areas
- apps/web/src/components/ApprovalCardView.tsx[88-95]
- packages/connectors/src/agent-identity/connector.ts[136-161]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Guided order diverges visually ✓ Resolved 🐞 Bug ≡ Correctness

Description

ApprovalQueue now renders and focuses cards in queueSections(...).visualOrder, but useGuidedDemo
still processes cards in the old sortCards order. Guided highlighting and auto-approval therefore
jump through cards in a different order than the visible queue whenever agent and attributed-human
risk ordering interleaves.

Code

apps/web/src/components/ApprovalQueue.tsx[R53-54]

+    visualOrder: ordered,
+  } = useMemo(() => queueSections(cards), [cards]);

Relevance

●●● Strong

PR #7 accepted guided-flow sequencing bugs; this is the same navigation-order consistency issue in
the queue.

PR-#7
PR-#9

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The queue uses the new flattened section order for navigation and renders unattributed, agents, then
attributed, while the guided hook independently retains risk-based sortCards. The added test
explicitly proves the two orders differ for the same cards.

apps/web/src/components/ApprovalQueue.tsx[49-65]
apps/web/src/hooks/useGuidedDemo.ts[262-270]
apps/web/src/hooks/useGuidedDemo.ts[296-307]
apps/web/src/lib/format.test.ts[232-240]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Guided-demo traversal still uses `sortCards`, while the queue now has a different section-based visual order.

## Issue Context
Derive guided safe-card and protected-card traversal from `queueSections(cards).visualOrder`, or expose one shared ordering helper used by both components.

## Fix Focus Areas
- apps/web/src/components/ApprovalQueue.tsx[49-54]
- apps/web/src/hooks/useGuidedDemo.ts[262-270]
- apps/web/src/lib/format.ts[182-197]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

Review mode: ⚖️ Balanced

Tip of the day

💡 Did you know, you can enable the Remediation agent and Qodo fixes findings in a dedicated fix PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗