fix: tolerate install-mutated validate artifacts by rafaelscosta · Pull Request #664 · SynkraAI/aiox-core

rafaelscosta · 2026-05-07T11:28:04Z

Summary

Fixes #663.

This PR makes aiox validate tolerate the two .aiox-core files that are intentionally mutated during a clean install:

core-config.yaml, generated or merged by environment configuration
data/entity-registry.yaml, populated by entity registry bootstrap

The validator still checks existence, path containment, symlink rejection, and regular-file safety before treating these files as valid project-local install artifacts. Hash and size checks remain strict for non-mutable framework files. I also tightened report semantics so any real missing/corrupted file produces at least warning status.

Validation

npm test -- tests/installer/post-install-validator.test.js --runInBand
node -c packages/installer/src/installer/post-install-validator.js
npm run generate:manifest
npm run validate:manifest
Local package smoke with packed @aiox-squads/core@5.1.4:
- npx --yes aiox --version -> 5.1.4
- npx --yes aiox validate --json -> status: success, validFiles: 1103, corruptedFiles: 0, issueCount: 0
npm run lint -- --quiet
npm run typecheck
npm run validate:publish
git diff --check
npm run test:ci -> 313 suites passed, 7,824 tests passed, 149 skipped

Notes

The previous published smoke for 5.1.3 reproduced the issue with corruptedFiles: 2; this branch verifies the same install/validate sequence locally as 5.1.4 with corruptedFiles: 0.

Summary by CodeRabbit

Bug Fixes
- Validation no longer flags installer-created or installer-mutated files as corrupted, preventing false corruption warnings after install.
Tests
- Added regression tests covering mutable-artifact validation and manifest mutation scenarios.
Documentation
- Added a story describing validation behavior, acceptance criteria, and verification steps for mutable installation artifacts.

vercel · 2026-05-07T11:28:08Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aiox-core	Ready	Preview, Comment	May 7, 2026 11:35am

coderabbitai · 2026-05-07T11:28:17Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 68addcca-d7fd-44e1-83fc-cdc1f436d80f

📥 Commits

Reviewing files that changed from the base of the PR and between 9b4b0cb and a1efc25.

📒 Files selected for processing (1)

docs/stories/epic-123/STORY-123.6-validate-mutable-install-artifacts.md

Walkthrough

This PR treats specific install-manifest paths as project-mutable so post-install validation marks them valid without hash/size checks, preserves other validation rules, exposes a helper to classify those paths, adds tests, and bumps package/manifest versions.

Changes

Mutable Install Artifacts Support

Layer / File(s)	Summary
Specification & Goals `docs/stories/epic-123/STORY-123.6-validate-mutable-install-artifacts.md`	Story doc defines acceptance criteria and lists mutable install artifact paths while preserving containment/symlink/type checks.
Mutable Path Detection Logic `packages/installer/src/installer/post-install-validator.js`	Adds `PROJECT_MUTABLE_MANIFEST_PATHS` and updates `validateFile()` to mark matching entries as `projectMutable` and skip hash/size comparisons.
Public API Export `packages/installer/src/installer/post-install-validator.js`	Exports `isProjectMutableManifestPath()` for external classification of mutable manifest paths.
Test Coverage `tests/installer/post-install-validator.test.js`	Adds tests verifying mutable path classification and validator behavior: mutable paths do not trigger corruption, non-mutable paths still report corruption.
Version & Release Updates `.aiox-core/install-manifest.yaml`, `package.json`	Bumps version from `5.1.3` to `5.1.4` and refreshes manifest `generated_at` metadata.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant Installer
  participant PostInstallValidator
  participant InstallManifest
  Client->>Installer: run aiox install
  Installer->>InstallManifest: write install files (including mutable paths)
  Client->>PostInstallValidator: run aiox validate
  PostInstallValidator->>InstallManifest: read manifest entries
  PostInstallValidator->>InstallManifest: isProjectMutableManifestPath? (classification)
  alt project-mutable
    PostInstallValidator->>PostInstallValidator: mark projectMutable, skip hash/size checks
  else immutable
    PostInstallValidator->>PostInstallValidator: perform hash/size comparison
  end
  PostInstallValidator->>Client: return validation report

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Suggested labels

area: installer, type: test, area: docs

Suggested reviewers

Pedrovaleriolopez
oalanicolas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: fixing validation to tolerate files mutated during install.
Linked Issues check	✅ Passed	All coding requirements from issue `#663` are met: validator now classifies mutable paths, skips strict hash/size checks for them, and maintains other validation checks.
Out of Scope Changes check	✅ Passed	All changes directly support the stated objective of tolerating mutable install artifacts; version bumps and documentation updates are appropriate scope.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/validate-mutable-install-artifacts-20260507

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-05-07T11:29:41Z

📊 Coverage Report

Coverage report not available

📈 Full coverage report available in Codecov

Generated by PR Automation (Story 6.1)

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/stories/epic-123/STORY-123.6-validate-mutable-install-artifacts.md`:
- Around line 46-50: Replace the machine-local absolute file links in
STORY-123.6-validate-mutable-install-artifacts.md with repository-relative
links: locate the list items referencing ".aiox-core/install-manifest.yaml",
"package.json", "package-lock.json",
"packages/installer/src/installer/post-install-validator.js", and
"tests/installer/post-install-validator.test.js" and change their hrefs from the
full local path (/Users/rafaelcosta/Projects/AIOX/aiox-core-pro-13-2/...) to
repo-relative paths appropriate for the docs file (e.g., relative paths from the
docs/stories folder like ../../.aiox-core/install-manifest.yaml or the correct
relative path to each file in the repo) so other contributors can access them
without exposing local machine paths.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 363633c6-021c-4f95-a504-d2305956d07d

📥 Commits

Reviewing files that changed from the base of the PR and between 80485c6 and 9b4b0cb.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

.aiox-core/install-manifest.yaml
docs/stories/epic-123/STORY-123.6-validate-mutable-install-artifacts.md
package.json
packages/installer/src/installer/post-install-validator.js
tests/installer/post-install-validator.test.js

* fix: tolerate install-mutated validate artifacts (SynkraAI#663) * docs: use repo-relative story file links (SynkraAI#663)

fix: tolerate install-mutated validate artifacts (#663)

9b4b0cb

rafaelscosta requested review from Pedrovaleriolopez and oalanicolas as code owners May 7, 2026 11:28

coderabbitai Bot requested changes May 7, 2026

View reviewed changes

Comment thread docs/stories/epic-123/STORY-123.6-validate-mutable-install-artifacts.md Outdated

docs: use repo-relative story file links (#663)

a1efc25

vercel Bot deployed to Preview May 7, 2026 11:35 View deployment

coderabbitai Bot approved these changes May 7, 2026

View reviewed changes

rafaelscosta merged commit 2dac962 into main May 7, 2026
40 checks passed

rafaelscosta deleted the fix/validate-mutable-install-artifacts-20260507 branch May 7, 2026 11:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: tolerate install-mutated validate artifacts - #664

fix: tolerate install-mutated validate artifacts#664
rafaelscosta merged 2 commits into
mainfrom
fix/validate-mutable-install-artifacts-20260507

rafaelscosta commented May 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented May 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 7, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

rafaelscosta commented May 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Notes

Summary by CodeRabbit

Uh oh!

vercel Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Suggested labels

Suggested reviewers

Uh oh!

github-actions Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Coverage Report

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

rafaelscosta commented May 7, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented May 7, 2026 •

edited

Loading

coderabbitai Bot commented May 7, 2026 •

edited

Loading

github-actions Bot commented May 7, 2026 •

edited

Loading