[M3gA-Mind]

Summary

Mostly tests. The module loader's refusals were right but untested per reason, and several existing tests only checked that some error happened:

• The ABI descriptor prefix checks (magic, revision, size range, minimum size) were written twice: once in load, against the prefix read through the symbol, and again in gate_descriptor. Only the copy in gate_descriptor was reachable from a test, and only two of its reasons were exercised, with is_err().
• The manifest checks (null pointer, size cap, JSON) lived inline in load, so they needed a real dynamic library to test.
• zip_archives_refuse_paths_outside_the_destination, zip_archives_refuse_symlink_entries and zip_archives_refuse_special_file_entries asserted is_err(). Any failure, including an unreadable file, made them pass.

Change

• gate_prefix(path, magic, revision, size) holds the four prefix checks once; load calls it on the prefix and gate_descriptor on the full descriptor. Same order, same messages.
• manifest_from(path, slice) (an unsafe fn with a documented contract) holds the null/cap/JSON checks; the 1 MiB cap is now the named constant MAX_MANIFEST_BYTES.
• New tests the_descriptor_prefix_is_refused_for_each_reason and the_manifest_slice_is_refused_for_each_reason assert each refusal message. The oversized case is refused before any byte is read, so the test needs no 1 MiB buffer.
• The descriptor test and the three zip tests now assert the reason: "descriptor size is invalid", "target endianness does not match", "unsafe path", "unsupported entry type".

Validation

cargo test -p tinybus --features modules --lib -- module::loader:: zip_archives_refuse:

	result
this branch	7 passed
deliberate break: the ABI revision check removed from gate_prefix	the_descriptor_prefix_is_refused_for_each_reason FAILED (the loader accepted a wrong revision)

Behaviour change

None. The checks, their order and their messages are unchanged; only where they are written moved.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b05a1c74-eaaf-4611-bf13-ad0543c96c80

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Reviewed head: aa209c70ff7a5200be32c83895504aa4d67137e3

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 3 of 3 files.
Pull request purpose (title): test(module): pin th…

Diagnostics and supporting details

Full summary

Pull request purpose (title): test(module): pin the loader's and archive extractor's refusal reasons. The pull request titled "test(module): pin the loader's and archive extractor's refusal reasons" is a pure refactor plus test tightening. In `crates/tinybus/src/module/loader.rs`, the duplicated ABI descriptor prefix checks are consolidated into `gate_prefix`, called by both `load` and `gate_descriptor`, and the manifest null-pointer/cap/JSON checks move into a documented `unsafe fn manifest_from` with the 1 MiB limit named `MAX_MANIFEST_BYTES`. In `crates/tinybus/src/module/loader_tests.rs`, a `refusal` helper replaces `is_err()`, the descriptor gate test asserts specific messages, and two new tests pin each prefix and manifest refusal reason. In `crates/tinybus/src/module/github_tests.rs`, three zip extraction tests now assert "unsafe path" and "unsupported entry type" while keeping their filesystem post-condition checks. The author reports no behavior change; the description lane agrees the description matches the diff, noting the manifest function now runs unconditionally but that this was already the case for non-strict loads. No trusted check evidence in this review confirms test execution or passage, and no push delta could be established.

Review snapshot

Change surface	Files	Review signal	Count
Production	1	Active findings	0
Tests	2	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

In `crates/tinybus/src/module/loader.rs`, the magic, revision, size-range, and minimum-size checks now exist once in `gate_prefix`, invoked by `load` on the prefix read through the symbol and by `gate_descriptor` on the full descriptor, same order and messages; the manifest null-pointer, cap, and JSON checks move into a documented `unsafe fn manifest_from` with the cap as `MAX_MANIFEST_BYTES`. In `crates/tinybus/src/module/loader_tests.rs`, a `refusal` helper replaces `is_err()`, the existing descriptor gate test asserts specific messages, and two new tests cover each prefix and manifest refusal reason including the boundary sizes. In `crates/tinybus/src/module/github_tests.rs`, three zip refusal tests now assert specific error text and keep verifying that offending files were not created.

Features

• Internal refactor — Single `gate_prefix` for ABI descriptor prefix checks: The four prefix checks exist once and apply both to the prefix in `load` and to the full descriptor in `gate_descriptor`, preserving order and messages while making each refusal reachable from a unit test. (crates/tinybus/src/module/loader.rs pub(crate) fn load(path: &Path, strict: bool) -> Result<LoadedArtifact> {)
• Internal refactor — Manifest checks extracted to `manifest_from` with named cap: The null-pointer, oversize, and JSON checks are isolated in a documented unsafe function with the 1 MiB limit as `MAX_MANIFEST_BYTES`; oversize slices are still rejected before any bytes are read, and refusal paths can be tested without a real dynamic library. (crates/tinybus/src/module/loader.rs pub(crate) fn load(path: &Path, strict: bool) -> Result<LoadedArtifact> {, crates/tinybus/src/module/loader.rs use crate::{build_info, version::Version};)
• Modified — Zip extraction tests assert specific refusal reasons: Tests for paths outside the destination, symlink entries, and special-file entries now require the "unsafe path" or "unsupported entry type" message rather than any error, so unrelated failures such as an unreadable file no longer satisfy them; post-condition checks on created files remain. (crates/tinybus/src/module/github_tests.rs fn zip_archives_refuse_paths_outside_the_destination() {, crates/tinybus/src/module/github_tests.rs fn zip_archives_refuse_symlink_entries() {, crates/tinybus/src/module/github_tests.rs fn zip_archives_refuse_special_file_entries() {)

Tests

• unit — New test `the_descriptor_prefix_is_refused_for_each_reason` asserts acceptance of valid values, then checks each `gate_prefix` refusal message: wrong magic, wrong revision, size below the prefix size, size above the maximum, and size too small for the full descriptor.: Covers each `gate_prefix` branch by reason, including the boundary sizes `DESCRIPTOR_PREFIX_SIZE - 1`, `MAX_DESCRIPTOR_SIZE + 1`, and `full - 1`; execution is not confirmed by trusted check evidence in this review. (crates/tinybus/src/module/loader_tests.rs, crates/tinybus/src/module/loader.rs pub(crate) fn load(path: &Path, strict: bool) -> Result<LoadedArtifact> {)
• unit — New test `the_manifest_slice_is_refused_for_each_reason` asserts a valid manifest parses and checks the null slice, the over-cap slice at `MAX_MANIFEST_BYTES + 1`, and invalid JSON, relying on the cap being rejected before any read so no 1 MiB buffer is needed.: Exercises each `manifest_from` refusal reason; execution is not evidenced by trusted check results in this review, and the tests lane noted the exact cap boundary is unpinned since the check uses `>` while `gate_prefix` uses an inclusive range. (crates/tinybus/src/module/loader_tests.rs, crates/tinybus/src/module/loader.rs use crate::{build_info, version::Version};)
• unit — The existing descriptor gate test now asserts "descriptor size is invalid" and "target endianness does not match" instead of `is_err()`.: Tightens assertions to specific reasons; whether it runs is not confirmed by trusted check evidence here. (crates/tinybus/src/module/loader_tests.rs)
• unit — The three zip extraction tests assert "unsafe path" and "unsupported entry type" and continue to verify that offending files were not created.: Prevents unrelated errors from satisfying the tests; the critique and security lanes confirmed the expected substrings match the refusal text the extraction code produces; execution is not confirmed by trusted check evidence. (crates/tinybus/src/module/github_tests.rs fn zip_archives_refuse_paths_outside_the_destination() {, crates/tinybus/src/module/github_tests.rs fn zip_archives_refuse_symlink_entries() {, crates/tinybus/src/module/github_tests.rs fn zip_archives_refuse_special_file_entries() {)

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 3 files; 0 findings.

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 3 files; 0 findings.

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This is a pure refactor: the descriptor-prefix gate moves into `gate_prefix` and the manifest-slice check into `manifest_from` (with the 1 MiB cap hoisted into `MAX_MANIFEST_BYTES`), and the diff adds `the_descriptor_prefix_is_refused_for_each_reason` and `the_manifest_slice_is_refused_for_each_reason`, which pin every refusal reason including the boundary sizes (`DESCRIPTOR_PREFIX_SIZE - 1`, `MAX_DESCRIPTOR_SIZE + 1`, `full - 1`, `MAX_MANIFEST_BYTES + 1`). The zip-extraction tests are strengthened to assert the specific refusal text. I found no behavioural regression, no unreachable-but-untested new branch that matters, and no violation of the repository's stated rules.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The commits lane reported no sensitive content in the committed files.
• Lane summary: No sensitive content in committed files.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The description lane reported no finding, confirming `gate_prefix` and `manifest_from` hold exactly the checks previously inline, `load` and `gate_descriptor` call them with identical arguments and order, and the new tests assert the claimed refusal reasons.
• Lane summary: The change is a faithful refactor plus test tightening: `gate_prefix` and `manifest_from` hold exactly the checks that were previously inline, `load` and `gate_descriptor` call them with identical arguments and order, and the new tests assert the refusal reasons the description claims. The one behavioural difference is that `manifest_from` is called as `manifest_from(path, manifest_fn())?`, so the ABI manifest function now runs unconditionally instead of only after the `strict` check — but `gating` is `false` for non-strict loads, which made the manifest call unconditional in the old code as well, so no regression is introduced. The description matches the diff.

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.008665
• Tokens: 231072 input · 4974 output · 53248 cached · 275 embedding
• Updated: 2026-10-23T11:01:34Z

Head	State	Pass summary
20c171626b93	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T00:02:33Z)
9bf9e50af923	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T08:03:39Z)
f392a3f1b3cd	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T09:05:02Z)
90110a67186c	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T10:51:28Z)
aa209c70ff7a	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T11:01:34Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0005