Skip to content

Promote AI bloat review advisories to main#273

Merged
djm81 merged 16 commits into
mainfrom
dev
May 20, 2026
Merged

Promote AI bloat review advisories to main#273
djm81 merged 16 commits into
mainfrom
dev

Conversation

@djm81
Copy link
Copy Markdown
Contributor

@djm81 djm81 commented May 20, 2026

Summary

  • Promotes the merged dev work for AI-bloat review advisories to main.
  • Includes the ai_bloat review category, Semgrep/AST detectors, /specfact.08-simplify, docs, tests, and signed module manifest updates.

Included PRs

Verification

Validation was completed on the feature PR before merge:

  • hatch run format
  • hatch run type-check
  • hatch run lint
  • hatch run yaml-lint
  • hatch run check-bundle-imports
  • hatch run validate-prompt-commands
  • hatch run verify-modules-signature --payload-from-filesystem --enforce-version-bump
  • hatch run contract-test (693 passed, 2 warnings)
  • hatch run smart-test (693 passed, 2 warnings)
  • hatch run test (693 passed, 2 warnings)
  • openspec validate code-review-ai-bloat-detection --strict

omit-test and others added 14 commits May 17, 2026 23:28
Introduces ai_bloat as a sixth principle category in the code-review
pipeline alongside naming/kiss/yagni/dry/solid/clean_code/architecture.
Adds a packaged semgrep rule pack for pattern-shape detectors, an AST
runner for semantic detectors, a parallel ai-bloat-patterns policy pack,
and a /specfact.08-simplify slash-command prompt that drives LLM-mediated
rewrites with per-change human confirmation.

Findings are advisory-only; pre-commit warns but never blocks.

Tracks: #269 (sub-issue of Feature #175 under Modules Epic #162).
Extends tasks.md with section 8 covering root README callout, quickstart
walkthrough with before/after evidence, modules.specfact.io homepage
callout, follow-up tracking issue for the core specfact-cli README, and
explicit honest-framing guardrails ("bloat detection tuned for the shapes
AI code commonly produces" — never an is-this-AI classifier).

Section 9 absorbs the original passing-evidence section. Proposal Impact
section updated to reflect the broader docs scope.

Tracks: #269.
…ection

Feature/code review ai bloat detection
@strix-security
Copy link
Copy Markdown

Strix is installed on this repository, but we could not run this PR security review because this workspace does not have an active plan. If you'd like to continue receiving code reviews, you can add a payment method or manage billing here.

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 20, 2026

Review Change Stack

Warning

Rate limit exceeded

@djm81 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 3 minutes and 32 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: cad5e46f-17e0-4c4d-bb38-27782735e23b

📥 Commits

Reviewing files that changed from the base of the PR and between db6dd66 and 0b4e251.

⛔ Files ignored due to path filters (2)
  • registry/modules/specfact-code-review-0.47.17.tar.gz is excluded by !**/*.gz
  • registry/modules/specfact-project-0.41.11.tar.gz is excluded by !**/*.gz
📒 Files selected for processing (47)
  • .gitignore
  • README.md
  • docs/bundles/code-review/run.md
  • docs/bundles/project/overview.md
  • docs/index.md
  • docs/modules/code-review.md
  • docs/quickstart-ai-bloat.md
  • openspec/CHANGE_ORDER.md
  • openspec/changes/code-review-ai-bloat-detection/TDD_EVIDENCE.md
  • openspec/changes/code-review-ai-bloat-detection/design.md
  • openspec/changes/code-review-ai-bloat-detection/proposal.md
  • openspec/changes/code-review-ai-bloat-detection/specs/code-review-ai-bloat-detection/spec.md
  • openspec/changes/code-review-ai-bloat-detection/tasks.md
  • packages/specfact-code-review/module-package.yaml
  • packages/specfact-code-review/resources/policy-packs/specfact/ai-bloat-patterns.yaml
  • packages/specfact-code-review/resources/semgrep-rules/ai-bloat.yaml
  • packages/specfact-code-review/src/specfact_code_review/run/findings.py
  • packages/specfact-code-review/src/specfact_code_review/run/runner.py
  • packages/specfact-code-review/src/specfact_code_review/run/scorer.py
  • packages/specfact-code-review/src/specfact_code_review/tools/__init__.py
  • packages/specfact-code-review/src/specfact_code_review/tools/ai_bloat_runner.py
  • packages/specfact-code-review/src/specfact_code_review/tools/semgrep_runner.py
  • packages/specfact-project/module-package.yaml
  • packages/specfact-project/resources/prompts/specfact.08-simplify.md
  • registry/index.json
  • registry/modules/specfact-code-review-0.47.17.tar.gz.sha256
  • registry/modules/specfact-project-0.41.11.tar.gz.sha256
  • registry/signatures/specfact-code-review-0.47.17.tar.sig
  • registry/signatures/specfact-project-0.41.11.tar.sig
  • scripts/pre_commit_code_review.py
  • tests/fixtures/semgrep/bad_identity_try_except.py
  • tests/fixtures/semgrep/bad_manual_loop_comprehension.py
  • tests/fixtures/semgrep/bad_none_then_none.py
  • tests/fixtures/semgrep/bad_passthrough_lambda.py
  • tests/fixtures/semgrep/bad_single_call_wrapper.py
  • tests/fixtures/semgrep/good_identity_try_except.py
  • tests/fixtures/semgrep/good_manual_loop_comprehension.py
  • tests/fixtures/semgrep/good_none_then_none.py
  • tests/fixtures/semgrep/good_passthrough_lambda.py
  • tests/fixtures/semgrep/good_single_call_wrapper.py
  • tests/unit/scripts/test_pre_commit_code_review.py
  • tests/unit/specfact_code_review/run/test_findings.py
  • tests/unit/specfact_code_review/run/test_runner.py
  • tests/unit/specfact_code_review/run/test_scorer.py
  • tests/unit/specfact_code_review/tools/test_ai_bloat_runner.py
  • tests/unit/specfact_code_review/tools/test_semgrep_runner.py
  • tests/unit/test_bundle_resource_payloads.py
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dev

Comment @coderabbitai help to get the list of available commands and usage tips.

chore(registry): publish changed modules
@djm81 djm81 self-assigned this May 20, 2026
@djm81 djm81 added enhancement New feature or request codebase Specfact codebase related topic labels May 20, 2026
@djm81 djm81 moved this from Todo to In Progress in SpecFact CLI May 20, 2026
@djm81 djm81 linked an issue May 20, 2026 that may be closed by this pull request
Comment thread tests/fixtures/semgrep/bad_passthrough_lambda.py Fixed
@djm81 djm81 merged commit 2220c02 into main May 20, 2026
24 checks passed
@github-project-automation github-project-automation Bot moved this from In Progress to Done in SpecFact CLI May 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

codebase Specfact codebase related topic enhancement New feature or request

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

[Change] Code review AI bloat detection

1 participant