Fix repository resolution order, add plugin diagnostics, and clean up dependencies (2026-06 audit)#69
Merged
Conversation
Self-version labels updated to match the bump. The full report regeneration could not run in this environment: the Spine artifact registries are not reachable from the sandbox (HTTP 403 via egress policy). Dependency content is unchanged from the last real run. https://claude.ai/code/session_01J8FpY1sQd1ehN3upW7HiUr
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a repository audit report and a follow-up improvement plan, while bumping the compiler snapshot version and updating the generated dependency-report self-version labels accordingly.
Changes:
- Bump compiler snapshot version
2.0.0-SNAPSHOT.046→2.0.0-SNAPSHOT.047. - Update dependency report artifacts/headers to reflect the new snapshot version.
- Add a technical audit report (
docs/audit-2026-06.md) and a draft improvement plan (.agents/tasks/improvement-plan.md) to track follow-up work.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| version.gradle.kts | Snapshot version bump for the build/publishing version. |
| docs/dependencies/pom.xml | Updates the dependency report POM’s self <version> to the new snapshot. |
| docs/dependencies/dependencies.md | Updates dependency report headers to the new snapshot version. |
| docs/audit-2026-06.md | Adds the audit report documenting findings and rationale. |
| .agents/tasks/improvement-plan.md | Adds a draft plan for addressing the audit findings (tracking/tasks). |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #69 +/- ##
============================================
+ Coverage 75.34% 75.55% +0.20%
- Complexity 672 677 +5
============================================
Files 202 202
Lines 3947 3943 -4
Branches 393 390 -3
============================================
+ Hits 2974 2979 +5
+ Misses 855 846 -9
Partials 118 118 🚀 New features to boost your workflow:
|
Conflicts resolved by taking the master versions of `version.gradle.kts` and the dependency reports (regenerated on master by PR #66). https://claude.ai/code/session_01J8FpY1sQd1ehN3upW7HiUr
Self-version labels updated to match the bump; content as regenerated on master by PR #66. https://claude.ai/code/session_01J8FpY1sQd1ehN3upW7HiUr
…ia-tmv0w1 # Conflicts: # docs/dependencies/dependencies.md
Apply reviewer feedback to the engine performance smoke test:
- use `kotlin.io.path.createDirectories()` instead of
`.also { it.toFile().mkdirs() }`, which discarded a `Boolean`;
- wrap the over-long KDoc link line within the 100-column limit;
- backtick the `@DisplayName` subject, matching `PipelineSpec`.
No behavior change; `:backend:performanceTest` and `:backend:build`
remain green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Mark (P1) done: the engine performance smoke signal landed as a non-gating timed `Pipeline` run guarded by a hang ceiling (commits e506e37, 5faf39e), which sidesteps the audit's perf-budget open question instead of waiting on it. The same file also carries the concurrent (T1) plan-doc updates already present in the working tree — the T1 checkbox, bullet, and Log entries, including the `Parameter.equals()` dead-code-removal note. The T1 source changes belong to a separate, in-flight commit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c437fa21bd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
armiol
requested changes
Jun 15, 2026
armiol
left a comment
armiol
left a comment
Contributor
There was a problem hiding this comment.
@claude @alexander-yevsyukov please see my comment.
…to claude/loving-hypatia-tmv0w1 # Conflicts: # jvm/build.gradle.kts
armiol
approved these changes
Jun 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
This PR began as the 2026-06 repository audit and its follow-up plan, and has
grown to execute the highest-leverage findings the repository owns. The audit
documents are included for traceability, but the substance of the PR is the fixes
below. Finding IDs (S2, Q2, A1, …) refer to
docs/audit-2026-06.md.Improvements
Correctness & hygiene (audit Milestone 1):
pluginManagementanddependencyResolutionManagementinsettings.gradle.ktssogradlePluginPortal()is first and
mavenLocal()is no longer the first repository, aligning withcore-jvm-compiler. Removes the footgun of a stalemavenLocalartifact shadowinga released one during resolution, while keeping the sibling-repo
-SNAPSHOTworkflow intact (verified via
:params:dependencies).protobufExtension!!dereferences in the Gradle plugin with a shared
Project.protobufExtensionOrFail()helper (
gradle-plugin/.../plugin/Plugin.kt,Paths.kt). A missingcom.google.protobufplugin now fails with a message that names the missing pluginid and the offending project path and tells the user how to fix it, instead of an
opaque
NullPointerException.Pre-GA API surface (audit Milestone 2):
:jvm→:backendapiedge documented (A1). Theapi(project(":backend"))edge in
jvm/build.gradle.ktsis intentional — downstream consumers program againstthe engine's
PipelineandCodeGenerationContext. Rather than narrow it toimplementation, the edge now carries abecause(...)rationale, closing A1 via theaudit's sanctioned "record why it must" path and answering audit open question 3.
Cleanup:
CodeGenerationContextSpec) that no longermatched current
CompilerEventsbehavior, along with the imports it left dead.ProtoDatadependency declaration and refreshed the localSpine dependency versions.
Audit & plan (origin)
docs/audit-2026-06.md— read-only audit of this repository andcore-jvm-compiler(architecture, code quality, security, testing, performance, dependencies, DevEx,
docs), every finding cited as
file:lineand labeled FACT vs JUDGMENT.Health grade: B+, no Critical findings. The snapshot describes
master@
3fe9dcb(2026-06-10)..agents/tasks/improvement-plan.md— tracks which findings are done (S2, Q2, A1),delegated to
config(config#691:S1 scrambled PAT, Q3 silent npm-audit catch, coverage policy, workflow
concurrency+ SHA-pinned actions), and still open (T1paramsspecs, P1 engineperf smoke, Doc1 getting-started, A4 process-exit contract).
Open questions for a human before the remaining items start — PAT ownership, GA
timeline, perf budget — are listed in audit §6.