docs(#95): port CodeRabbit rules into AGENTS.md, drop config by fullsend-ai-coder[bot] · Pull Request #96 · fullsend-ai/test-creator

fullsend-ai-coder · 2026-10-30T10:19:01Z

Summary

Changes in this repository:

AGENTS.md, Code conventions: adds a Script security rule. Scripts must not write through a planted symlink, must not use destinations that escape the intended root (absolute paths, .., or unsanitized CLI/frontmatter values), and must not put secrets in argv, URLs, logs, exception messages, or JSON output. It also carries over the local single-user CLI threat model, so agents don't raise TOCTOU or SSRF-style findings that don't apply here. It cites Harden fetch_issue.py output path handling #62 and bootstrap.sh can place the .odh-test-gen symlink inside the generated run directory #79 as past bugs of this kind.
AGENTS.md, Test conventions: adds the six test anti-patterns from .coderabbit.yaml: no effective assertion, mocking the unit under test, asserting only on the mock, tautological expectations, swallowed failures, and weak JSON checks. The existing "prefer exact substring assertions" rule now applies only to generated markdown documents, so it doesn't contradict the rule on weak JSON checks.
Deletes .coderabbit.yaml. The fullsend org doesn't have the CodeRabbit app installed, so the file is dead config. Also removes the links to it in AGENTS.md ("Where things are"), CLAUDE.md ("Code Review Invariants"), and CONTRIBUTING.md ("Opening a pull request"). The CLAUDE.md and CONTRIBUTING.md edits touch only the dead-link lines, to keep conflicts with docs: fix marketplace install instructions and stale symlink claims #93 small.

Testing

grep -ri "coderabbit.yaml" (excluding .git) finds nothing.
pre-commit couldn't fetch its hook repos (TLS failure in the sandbox). I ran the markdown-relevant hooks from pre-commit-hooks v6.0.0 directly (trailing-whitespace, end-of-file-fixer, check-merge-conflict) and they passed. pymarkdown only scans skills/, which this PR doesn't touch.
skillsaw couldn't run (uvx isn't available in the sandbox). No skills/ files changed.
uv run pytest tests/: 1566 passed, 2 failed. The two failures (test_repo_cli.py::test_validate_local_path_*) also fail on unchanged main in the sandbox. They come from the sandbox's Fullsend environment, not from this change.

🤖 Generated with Claude Code

Closes #95

Post-script verification

Branch is not main/master (agent/95-remove-coderabbit-config)
Secret scan passed (gitleaks — aa84460deae11b014510f7999ea7bf917231dff5..HEAD)
PR body secret scan passed (gitleaks — no-git)
Final PR description secret scan passed (gitleaks — no-git)

The repo moved into the fullsend org, which has no CodeRabbit app installed, so .coderabbit.yaml is dead config. Two of its rule sets are still useful for the code agent, so move them into AGENTS.md: - Code conventions: script security rules (no symlink-following writes, no destinations escaping the intended root, no secrets in argv/URLs/logs/exceptions/JSON) plus the local single-user CLI threat model, citing #62 and #79. - Test conventions: the six test anti-patterns. The existing substring-assertion rule is scoped to generated markdown so it does not contradict the "weak JSON checks" rule. Delete .coderabbit.yaml and its dead links in AGENTS.md, CLAUDE.md, and CONTRIBUTING.md. Note: pre-commit could not fetch hook repos (TLS failure in the sandbox); the pre-commit-hooks v6.0.0 hooks that apply to markdown (trailing-whitespace, end-of-file-fixer, check-merge-conflict) were run directly and passed. skillsaw could not run (uvx unavailable); no skills/ files changed. pytest: 1566 passed; 2 failures in test_repo_cli.py also fail on main (sandbox environment). Closes #95 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fullsend-ai-review · 2026-10-30T10:21:02Z

🤖 Finished Review · ✅ Success · Started 10:21 AM UTC · Completed 10:28 AM UTC

Commit: 4a83bfd · View workflow run →

Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $1.16

fullsend-ai-review · 2026-10-30T10:28:03Z

Risk Assessment: moderate (2/5)

Details

Moderate risk driven by modifications to protected paths (AGENTS.md and CLAUDE.md) and medium blast radius, mitigated by docs/config-only scope, bot authorship, low churn, and complete linked issue alignment.

Previous run

Risk Assessment: moderate (2/5)

Details

Moderate risk driven by modifications to protected paths (AGENTS.md and CLAUDE.md) and medium blast radius, mitigated by docs/config-only scope, bot authorship, low churn, and complete linked issue alignment.

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Moderate risk driven by modifications to protected paths (AGENTS.md and CLAUDE.md) and medium blast radius, mitigated by docs/config-only scope, bot authorship, low churn, and complete linked issue alignment.

fullsend-ai-review · 2026-10-30T10:28:05Z

Review

Findings

Medium

[protected-path] AGENTS.md — This PR modifies protected governance files: AGENTS.md (agent working rules) and CLAUDE.md. It links issue Remove dead .coderabbit.yaml; port its useful rules into AGENTS.md #95 and the description explains the rationale (retire the dead .coderabbit.yaml, port its script-security and test-anti-pattern rules into AGENTS.md). Human approval is always required for protected-path changes, regardless of context.

Previous run

Review

Findings

Medium

[protected-path] AGENTS.md — This PR modifies protected governance files: AGENTS.md and CLAUDE.md. The PR links issue Remove dead .coderabbit.yaml; port its useful rules into AGENTS.md #95 and explains the rationale (port useful CodeRabbit rules, remove dead links), so context is sufficient. Human approval is still required for protected-path changes, regardless of context.

Earlier findings

AGENTS.md:101, data-exposure — resolved by change: the latest commit restores "or generated artifacts" to the secrets prohibition in the Script security rule.

Previous run (2)

Review

Findings

Medium

[protected-path] AGENTS.md — This PR modifies protected governance files (AGENTS.md and CLAUDE.md). It links issue Remove dead .coderabbit.yaml; port its useful rules into AGENTS.md #95 and explains the rationale, but human approval is always required for protected-path changes, whatever the context.

Low

[data-exposure] AGENTS.md:101 — The new script-security rule drops "generated artifacts" from the secrets prohibition. The deleted .coderabbit.yaml named artifacts in both the threat-model block (Secrets in argv, URLs, logs, exception messages, or artifacts) and the SECRET PROTECTION path instruction (...JSON output, or generated artifacts). AGENTS.md:101 now reads put secrets in argv, URLs, logs, exception messages, or JSON output. With the config deleted, AGENTS.md is the only place this rule lives, so non-JSON outputs such as TestPlan.md and TC-*.md are no longer named.
Remediation: Add "or generated artifacts" back to the list at AGENTS.md:101 so the rule matches the deleted .coderabbit.yaml wording.

Labels: PR is a documentation-only change to AGENTS.md and related docs.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

fullsend-ai-coder · 2026-10-30T10:30:02Z

🤖 Finished Fix · ✅ Success · Started 10:30 AM UTC · Completed 10:32 AM UTC

Commit: 4a83bfd · View workflow run →

Runtime: claude · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $0.23

Restore "generated artifacts" to the secrets prohibition in the script-security rule in AGENTS.md, matching the deleted .coderabbit.yaml wording so non-JSON outputs (TestPlan.md, TC-*.md) stay covered. Note: pre-commit hooks could not run (infrastructure failure: hook repos could not be fetched, TLS verification failed). pytest/ruff are not available in the sandbox; the change is a one-phrase docs edit. Addresses #96 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fullsend-ai-coder · 2026-10-30T10:32:21Z

🔧 Fix agent — iteration 1 (bot-triggered)

Addressed the low-severity data-exposure finding by restoring 'generated artifacts' to the secrets rule in AGENTS.md. The protected-path finding only requires human approval. Pre-commit hooks could not run (hook repos unreachable); pytest/ruff unavailable in sandbox; the change is a one-phrase docs edit.

Fixed (1):

Script-security rule dropped "generated artifacts" from secrets prohibition (AGENTS.md): Restored "generated artifacts" to the list of places secrets must not appear (AGENTS.md line 101), matching the deleted .coderabbit.yaml wording.

Disagreed (1):

Protected-path change requires human approval: This is the mandatory merge-gate notice and prescribes no content edit; it needs human approval, so no code change was made.

Tests: passed

CI inspections (4):

Lint / pre-commit (passing, success)
Lint / skillsaw (passing, success)
Tests / Run pytests (passing, success)
DCO (passing, success)

Conflict update: skipped; strategy `none`; forge `MERGEABLE`; target `main`

Next steps:

/fs-review — request a re-review of the changes
/fs-fix <your instruction> — run another fix pass with specific guidance
Push commits directly — review re-runs automatically on push
_{Updated by fullsend fix agent}

fullsend-ai-review · 2026-10-30T10:34:30Z

🤖 Finished Review · ✅ Success · Started 10:34 AM UTC · Completed 10:40 AM UTC

Commit: 94d65a6 · View workflow run →

Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $0.97

Superseded by updated review

fege · 2026-10-30T10:42:44Z

/fs-fix The deleted .coderabbit.yaml said secrets must never appear in generated artifacts. The new rule in AGENTS.md only mentions JSON output, so Markdown and other generated files, such as test plans, are no longer covered

fullsend-ai-coder · 2026-10-30T10:44:48Z

🤖 Fix · ❌ Terminated · Started 10:44 AM UTC · Ended 10:50 AM UTC

Commit: 94d65a6 · View workflow run →

Make the secrets prohibition in the AGENTS.md script-security rule explicitly cover Markdown generated artifacts (TestPlan.md, TC-*.md), per the human /fs-fix instruction. Pre-commit could not run (hook repos unreachable); tests not run as the change is documentation-only. Addresses #96 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fullsend-ai-coder · 2026-10-30T10:50:12Z

🔧 Fix agent — iteration 2 (human-triggered)

Made the AGENTS.md script-security secrets prohibition explicitly cover Markdown generated artifacts (TestPlan.md, TC-*.md). Docs-only change; pre-commit could not run (hook repos unreachable) and pytest/ruff are unavailable in the sandbox.

Fixed (1):

Secrets rule in AGENTS.md no longer covers Markdown and other generated files (test plans) after .coderabbit.yaml removal (AGENTS.md): The rule already listed generated artifacts after the previous iteration; added an explicit parenthetical naming Markdown outputs such as TestPlan.md and TC-*.md so the coverage is unambiguous.

Tests: passed

CI inspections (4):

Run pytests (passing, success): Passed.
pre-commit (passing, success): Passed.
skillsaw (passing, success): Passed.
DCO (passing, success): Passed.

Conflict update: skipped; strategy `none`; forge `MERGEABLE`; target `main`

Next steps:

/fs-review — request a re-review of the changes
/fs-fix <your instruction> — run another fix pass with specific guidance
Push commits directly — review re-runs automatically on push
_{Updated by fullsend fix agent}

fullsend-ai-review · 2026-10-30T10:52:16Z

🤖 Finished Review · ✅ Success · Started 10:52 AM UTC · Completed 10:57 AM UTC

Commit: b059f4d · View workflow run →

Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $0.87

fege

/lgtm

fullsend-ai-coder Bot added the ready-for-review Triggers review agent dispatch label Oct 30, 2026

fullsend-ai-coder Bot assigned fege Oct 30, 2026

fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Oct 30, 2026

This comment was marked as outdated.

Sign in to view

fullsend-ai-review Bot added the kind/documentation Improvements or additions to documentation label Oct 30, 2026

fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Oct 30, 2026

fege mentioned this pull request Oct 30, 2026

test_repo_cli.py: two validate_local_path tests fail when FULLSEND_TARGET_REPO_DIR is set #97

Closed

fege approved these changes Oct 30, 2026

View reviewed changes

fege enabled auto-merge October 30, 2026 10:55

fege merged commit 4759986 into main Oct 30, 2026
34 checks passed

fege deleted the agent/95-remove-coderabbit-config branch October 30, 2026 11:04

Conversation

fullsend-ai-coder Bot commented Oct 30, 2026

Summary

Testing

Post-script verification

Uh oh!

fullsend-ai-review Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Findings

Medium

Review

Findings

Medium

Earlier findings

Review

Findings

Medium

Low

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-coder Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-coder Bot commented Oct 30, 2026

🔧 Fix agent — iteration 1 (bot-triggered)

Conflict update: skipped; strategy none; forge MERGEABLE; target main

Uh oh!

fullsend-ai-review Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fege commented Oct 30, 2026

Uh oh!

fullsend-ai-coder Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-coder Bot commented Oct 30, 2026

🔧 Fix agent — iteration 2 (human-triggered)

Conflict update: skipped; strategy none; forge MERGEABLE; target main

Uh oh!

fullsend-ai-review Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fege left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fullsend-ai-review Bot commented Oct 30, 2026 •

edited

Loading

fullsend-ai-review Bot commented Oct 30, 2026 •

edited

Loading

fullsend-ai-review Bot commented Oct 30, 2026 •

edited

Loading

fullsend-ai-coder Bot commented Oct 30, 2026 •

edited

Loading

Conflict update: skipped; strategy `none`; forge `MERGEABLE`; target `main`

fullsend-ai-review Bot commented Oct 30, 2026 •

edited

Loading

fullsend-ai-coder Bot commented Oct 30, 2026 •

edited

Loading

Conflict update: skipped; strategy `none`; forge `MERGEABLE`; target `main`

fullsend-ai-review Bot commented Oct 30, 2026 •

edited

Loading