feat: add graph proof evidence UX - #66
Merged
Merged
Conversation
📝 WalkthroughWalkthroughImplements graph evidence lookup across service, DB, REST, MCP, and CLI: new models, DB query, service shaping (redaction, payload budgeting), REST/MCP/CLI endpoints and output, tests, docs, and version bumps to 1.9.0. ChangesGraph Evidence Lookup Feature
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 743eba8e5b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+4018
to
+4019
| let redacted = lower.contains("authorization") | ||
| || lower.contains("bearer") |
There was a problem hiding this comment.
When a source log contains split auth headers such as Authorization: Bearer s3cr3t or Cookie: sid=abc, this token-by-token redaction only replaces the marker tokens (Authorization:, Bearer) and then emits the following credential value unchanged in source_log_summary.message. Because this commit adds the proof/evidence source-log summary specifically as a safe/redacted view, those common header formats can leak secrets through the new graph evidence endpoint/CLI output; please carry state to redact the value token(s) following these markers as well.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
Adds a proof-oriented “graph evidence” UX that lets callers fetch a single graph_relationship_evidence row with its owning relationship, endpoint summaries, and a bounded/redacted source-log summary across DB/service/REST/MCP/CLI. This extends existing graph surfaces (around/explain) with compact endpoint summaries and tightens redaction/safe-display guarantees for potentially sensitive evidence/log-derived text.
Changes:
- Added
graph evidencelookup mode end-to-end (DB query + service method + REST route + MCP dispatch/schema + CLI command + HTTP client). - Extended graph relationship payloads to optionally include compact
src_entity/dst_entityendpoint summaries for more readable output. - Added/updated docs, optional smoke checks, and bumped version to
1.9.0.
Reviewed changes
Copilot reviewed 36 out of 37 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/mcp/tools.rs | Adds MCP graph tool dispatch for mode=evidence. |
| src/mcp/tools_tests.rs | Tests MCP dispatch for graph evidence mode and schema enum exposure. |
| src/mcp/schemas.rs | Updates MCP schema to include explain + evidence modes and evidence_id. |
| src/db/graph.rs | Adds DB structs + query to fetch evidence row with relationship, endpoints, and optional log summary. |
| src/db/graph_tests.rs | Validates DB evidence lookup returns relationship endpoints + source log summary. |
| src/cli/run.rs | Wires new GraphCommand::Evidence into CLI run loop. |
| src/cli/parse_tests.rs | Adds CLI parsing tests for graph evidence and validation errors. |
| src/cli/output_graph.rs | Adds evidence lookup human output; enhances around/explain output with endpoint summaries. |
| src/cli/output_graph_tests.rs | Adds output tests for evidence lookup rendering and shared metadata helper. |
| src/cli/http_client.rs | Adds HTTP client call for /api/graph/evidence. |
| src/cli/help.rs | Documents new cortex graph evidence command in help catalog. |
| src/cli/dispatch.rs | Exposes run_graph_evidence in dispatch re-exports. |
| src/cli/dispatch_tests.rs | Adds request snapshot test for evidence args → request mapping. |
| src/cli/dispatch_surface.rs | Re-exports run_graph_evidence through surface module. |
| src/cli/dispatch_surface_gap.rs | Implements local/HTTP dispatch for evidence lookup and prints response. |
| src/cli/commands/graph.rs | Implements CLI argument parsing for graph evidence subcommand. |
| src/cli/args.rs | Adds GraphEvidenceArgs and new GraphCommand::Evidence variant. |
| src/cli.rs | Re-exports GraphEvidenceArgs in CLI public module. |
| src/app/service.rs | Implements graph_evidence_lookup, endpoint summaries on relationships, and redaction/bounds for source summaries. |
| src/app/service_tests.rs | Adds service-level tests for evidence lookup safety/redaction and missing-source behavior; tightens around/explain assertions for summaries. |
| src/app/models.rs | Adds GraphEntitySummary, evidence lookup request/response models, and optional endpoint summaries on relationships. |
| src/app.rs | Re-exports new graph evidence/summaries models from app. |
| src/api.rs | Adds REST route + handler for GET /api/graph/evidence. |
| src/api_tests.rs | Extends API tests to cover evidence endpoint behavior and bearer enforcement. |
| server.json | Bumps server package version and image tag to 1.9.0. |
| scripts/smoke-test.sh | Adds optional smoke coverage for graph evidence proof UX, privacy, size, and latency bounds. |
| mcpb/manifest.json | Bumps MCP bundle manifest version to 1.9.0. |
| docs/specs/investigation-graph.md | Updates investigation graph spec with evidence lookup and relationship summaries. |
| docs/mcp/TOOLS.md | Updates MCP tool docs to mention evidence proof rows. |
| docs/mcp/TESTS.md | Adds MCP call example + proof UX smoke checklist for evidence lookup. |
| docs/INVENTORY.md | Adds cortex graph evidence to CLI/MCP inventory table. |
| docs/contracts/investigation-graph.md | Defines contract for endpoint summaries and evidence lookup response + safety rules. |
| docs/CLI.md | Documents cortex graph evidence and updated around output expectations. |
| CHANGELOG.md | Adds 1.9.0 changelog entry for graph evidence UX and redaction hardening. |
| Cargo.toml | Bumps crate version to 1.9.0. |
| Cargo.lock | Updates locked crate version to 1.9.0. |
| .claude-plugin/plugin.json | Bumps plugin version to 1.9.0. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+4011
to
+4014
| let control_stripped: String = value | ||
| .chars() | ||
| .map(|ch| if ch.is_control() { ' ' } else { ch }) | ||
| .collect(); |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Line 10: The changelog added the release header "[1.9.0]" but the
reference-link block lacks a corresponding "[1.9.0]" entry and still points at
older ranges, breaking the compare links; update the reference-link block to add
a "[1.9.0]" link that compares the previous tag to v1.9.0 (e.g. compare
v1.8.0...v1.9.0) and adjust the "[Unreleased]" baseline to compare from
v1.9.0..HEAD so the new release and ongoing changes resolve correctly.
In `@docs/specs/investigation-graph.md`:
- Line 166: Update the CLI example "cortex graph evidence <evidence-id>
[--json]" to include the optional payload size flag used by the implementation:
change it to "cortex graph evidence <evidence-id> [--json] [--payload-budget
BYTES]" so the spec matches the actual supported flags (reference the command
string "cortex graph evidence <evidence-id> [--json]" and the flag name
"--payload-budget BYTES").
In `@scripts/smoke-test.sh`:
- Around line 896-901: The date commands that set GRAPH_PROOF_START and
GRAPH_PROOF_END use GNU-specific +%s%3N and will fail on macOS; replace those
timestamp captures with a portable approach (e.g., call python3 to emit
millisecond epoch timestamps) so GRAPH_PROOF_START/GRAPH_PROOF_END are valid
everywhere and GRAPH_EVIDENCE_LATENCY_MS calculation remains correct; update the
two places where GRAPH_PROOF_START and GRAPH_PROOF_END are set and ensure
GRAPH_EVIDENCE_LATENCY_MS still computes as GRAPH_PROOF_END - GRAPH_PROOF_START.
- Around line 914-915: The privacy smoke test loop that asserts sensitive
markers are absent from blob (the for marker in (...) assert marker not in blob
...) misses URL userinfo patterns; add a check that searches blob for URL
userinfo (e.g., using a regex like '://[^\\s:@]+:[^\\s@]+@' or equivalent) and
fail the test if any match is found so URLs containing user:pass@ are detected
and flagged for redaction. Ensure this new check runs alongside the existing
marker assertions against the same blob variable in the same loop/section.
In `@src/app/service.rs`:
- Line 4033: The redaction check using lower.contains("begin") is too broad and
will match words like "beginning"; update the logic that uses the lower variable
(the expression lower.contains("begin")) to instead match PEM markers more
precisely—for example, use lower.starts_with("begin ") or check exact strings
like "begin private key" / "begin rsa private key" (case-normalized) so only
genuine PEM header lines are redacted; locate and replace the
lower.contains("begin") usage accordingly.
In `@src/cli/output_graph.rs`:
- Around line 235-329: The printed follow-up "cortex get {source_log_id}" in
print_graph_evidence_lookup_response is invalid; locate the println that formats
source_log_id (uses the response.evidence.source_log_id variable inside
print_graph_evidence_lookup_response) and replace it with the actual CLI
subcommand used to fetch logs in the top-level dispatch (or remove it if you
choose to implement a dedicated top-level get command instead). Ensure the new
printed string matches the real command name and argument style used by the CLI
dispatch (or leave a clear TODO if you implement a top-level cortex get LOG_ID).
In `@src/mcp/schemas.rs`:
- Around line 62-65: The schema for "evidence_id" currently allows any integer
but the backend function graph_evidence_lookup in src/app/service.rs rejects
evidence_id <= 0; update the JSON Schema for the "evidence_id" property in
schemas.rs to include a lower bound (e.g., "minimum": 1) so clients validate
values >=1 and fail fast before calling graph_evidence_lookup.
In `@src/mcp/tools.rs`:
- Around line 1522-1530: The help text in tool_cortex_help() needs to be updated
to document the new "evidence" graph mode and its required parameter; modify the
function (tool_cortex_help) to include "evidence" in the list of supported modes
and explicitly state that mode="evidence" requires an evidence_id (or evidence
identifier) parameter, mirroring how "entity"/"around"/"explain" are described
so MCP clients that call cortex help will see the new capability.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 43095527-c3a7-4115-a34b-c035764d3dbb
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lockand included by**/*
📒 Files selected for processing (36)
.claude-plugin/plugin.jsonCHANGELOG.mdCargo.tomldocs/CLI.mddocs/INVENTORY.mddocs/contracts/investigation-graph.mddocs/mcp/TESTS.mddocs/mcp/TOOLS.mddocs/specs/investigation-graph.mdmcpb/manifest.jsonscripts/smoke-test.shserver.jsonsrc/api.rssrc/api_tests.rssrc/app.rssrc/app/models.rssrc/app/service.rssrc/app/service_tests.rssrc/cli.rssrc/cli/args.rssrc/cli/commands/graph.rssrc/cli/dispatch.rssrc/cli/dispatch_surface.rssrc/cli/dispatch_surface_gap.rssrc/cli/dispatch_tests.rssrc/cli/help.rssrc/cli/http_client.rssrc/cli/output_graph.rssrc/cli/output_graph_tests.rssrc/cli/parse_tests.rssrc/cli/run.rssrc/db/graph.rssrc/db/graph_tests.rssrc/mcp/schemas.rssrc/mcp/tools.rssrc/mcp/tools_tests.rs
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
13 issues found across 37 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/app/service.rs (1)
4012-4057:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winRedact the full secret value, not just the next token.
The whitespace-token state machine only carries
redact_next_valueforward by one token. That still leaks secrets for common patterns likeAuthorization: Basic abc123,Cookie: sid=abc; csrftoken=def, and multiline PEM blocks, because only the marker token (and sometimes the scheme token) gets replaced. This breaks the “no secrets in graph evidence/source-log summaries” guarantee.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/app/service.rs` around lines 4012 - 4057, In redact_graph_text_unbounded, the current redact_next_value boolean only hides the immediate next whitespace token and leaks many secrets; change the logic so that when a marker is seen (value_marker or cookie/credential patterns, or PEM begin), you redact the current token and then remain in a redact mode that continues redacting subsequent tokens until a clear boundary is reached (e.g., the next header-like token that ends with ':' indicating a new header, a token containing a header separator, a semicolon-delimited boundary for Cookie values, or for PEM blocks until the corresponding "-----end" / "end" token). Replace redact_next_value with a redact_mode state, implement PEM-specific termination (scan for "-----end" or token == "end"), and ensure tokens containing key=value pairs (cookie=, credential=, token=) redact the value part and any subsequent semi-colon separated segments; update the places that set and clear redact_next_value to use this new redact_mode so the function fully redacts secret values rather than only the next token.
♻️ Duplicate comments (1)
CHANGELOG.md (1)
1949-1951:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winComplete the 1.x changelog reference chain.
Line 1951 still points
[1.8.0]atv0.32.3...v1.8.0, so the 1.8.0 heading skips every intermediate 1.x release, and the bracketed1.7.1→1.0.0headings above still have no matching reference definitions. Please add the missing 1.x refs, or at minimum retarget[1.8.0]tov1.7.1...v1.8.0, so the release links stay usable.📝 Minimal fix shape
[Unreleased]: https://github.com/jmagar/cortex/compare/v1.9.0...HEAD [1.9.0]: https://github.com/jmagar/cortex/compare/v1.8.0...v1.9.0 -[1.8.0]: https://github.com/jmagar/cortex/compare/v0.32.3...v1.8.0 +[1.8.0]: https://github.com/jmagar/cortex/compare/v1.7.1...v1.8.0 +[1.7.1]: https://github.com/jmagar/cortex/compare/v1.7.0...v1.7.1 +... +[1.0.0]: https://github.com/jmagar/cortex/compare/v0.32.3...v1.0.0🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CHANGELOG.md` around lines 1949 - 1951, Update the release reference definitions in the CHANGELOG so the 1.x chain is contiguous: add missing bracketed link definitions for each 1.x release referenced (e.g., [1.7.1], [1.7.0], ... up to [1.0.0]) pointing to their compare URLs, or at minimum change the existing [1.8.0] definition from "v0.32.3...v1.8.0" to "v1.7.1...v1.8.0" so the [1.8.0] link targets the previous 1.x tag; adjust the bracket labels (like [1.9.0], [1.8.0], [1.7.1]) in the bottom reference block to match the headings above.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/api.md`:
- Line 18: The documented "28 routes total" in docs/api.md is stale; update the
endpoint matrix count or explicitly scope which routes are counted. Inspect the
mounted endpoints referenced in src/api_tests.rs (examples: /api/host-state,
/api/context, /api/fleet-state, /api/correlate-state, /api/silent-hosts,
/api/clock-skew, /api/anomalies, /api/compare, /api/apps,
/api/similar-incidents, /api/incident-context, /api/ai/ask-history,
/api/ai/incidents, /api/ai/investigate) and either recalculate and replace the
"28 routes total" number to the correct total or add a clarifying scope line
(e.g., "28 routes shown here; full surface listed in src/api_tests.rs") so the
canonical reference is accurate.
In `@scripts/smoke-test.sh`:
- Around line 920-922: The URL userinfo regex in scripts/smoke-test.sh currently
uses r'://[^\\s/:]+:[^\\s/@]+@' and misses common user:pass@ forms; update the
regex to explicitly forbid whitespace, '@' and '/' in both user and pass
portions (for example replace with r'://[^\\s@/:]+:[^\\s@/:]+@') so URLs like
https://user:pass@example.com are correctly detected; modify the assertion that
calls re.search to use the new pattern.
In `@src/app/service.rs`:
- Around line 3166-3167: The relationship conversion currently passes None for
endpoint summaries to graph_relationship_to_model, which clears
relationship.src_entity and relationship.dst_entity; update the call in
service.rs to forward the endpoint summary data from the query result instead of
None (e.g., pass rows.relationship.src_entity / src_endpoint_summary and
rows.relationship.dst_entity / dst_endpoint_summary or the fields that
graph_explain/graph_around populate) so graph_relationship_to_model can populate
relationship.src_entity and relationship.dst_entity while still attaching
vec![evidence.id].
In `@src/cli/output_graph.rs`:
- Around line 323-325: Remove the external mcporter suggestion by deleting the
println that outputs "mcporter call --config config/mcporter.json syslog.cortex
action=get id={source_log_id}" in src/cli/output_graph.rs so follow-ups remain
consistent with the native CLI; if a native cortex log-get command exists,
replace that println with the appropriate "cortex" command suggestion instead,
otherwise omit the follow-up entirely to avoid recommending an unavailable
external tool.
---
Outside diff comments:
In `@src/app/service.rs`:
- Around line 4012-4057: In redact_graph_text_unbounded, the current
redact_next_value boolean only hides the immediate next whitespace token and
leaks many secrets; change the logic so that when a marker is seen (value_marker
or cookie/credential patterns, or PEM begin), you redact the current token and
then remain in a redact mode that continues redacting subsequent tokens until a
clear boundary is reached (e.g., the next header-like token that ends with ':'
indicating a new header, a token containing a header separator, a
semicolon-delimited boundary for Cookie values, or for PEM blocks until the
corresponding "-----end" / "end" token). Replace redact_next_value with a
redact_mode state, implement PEM-specific termination (scan for "-----end" or
token == "end"), and ensure tokens containing key=value pairs (cookie=,
credential=, token=) redact the value part and any subsequent semi-colon
separated segments; update the places that set and clear redact_next_value to
use this new redact_mode so the function fully redacts secret values rather than
only the next token.
---
Duplicate comments:
In `@CHANGELOG.md`:
- Around line 1949-1951: Update the release reference definitions in the
CHANGELOG so the 1.x chain is contiguous: add missing bracketed link definitions
for each 1.x release referenced (e.g., [1.7.1], [1.7.0], ... up to [1.0.0])
pointing to their compare URLs, or at minimum change the existing [1.8.0]
definition from "v0.32.3...v1.8.0" to "v1.7.1...v1.8.0" so the [1.8.0] link
targets the previous 1.x tag; adjust the bracket labels (like [1.9.0], [1.8.0],
[1.7.1]) in the bottom reference block to match the headings above.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 83c685b3-016e-4109-8941-cb6f8d1dfaf1
📒 Files selected for processing (12)
CHANGELOG.mddocs/api.mddocs/contracts/investigation-graph.mddocs/specs/investigation-graph.mdscripts/smoke-test.shsrc/api_tests.rssrc/app/service.rssrc/app/service_tests.rssrc/cli/output_graph.rssrc/mcp/schemas.rssrc/mcp/tools.rssrc/mcp/tools_tests.rs
There was a problem hiding this comment.
2 issues found
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Resolve graph evidence proof UX review findings across redaction, payload accounting, help/docs, smoke coverage, and CLI follow-up output. Resolves review thread PRRT_kwDORy0Fc86GoCwC Resolves review thread PRRT_kwDORy0Fc86GoCwG Resolves review thread PRRT_kwDORy0Fc86GoCwJ Resolves review thread PRRT_kwDORy0Fc86GoCwL Resolves review thread PRRT_kwDORy0Fc86GoCwO Resolves review thread PRRT_kwDORy0Fc86GoCvm Resolves review thread PRRT_kwDORy0Fc86GoCvo Resolves review thread PRRT_kwDORy0Fc86GoCvr Resolves review thread PRRT_kwDORy0Fc86GoCvy Resolves review thread PRRT_kwDORy0Fc86GoCv0 Resolves review thread PRRT_kwDORy0Fc86GoCv4 Resolves review thread PRRT_kwDORy0Fc86GoCv8 Resolves review thread PRRT_kwDORy0Fc86GoCv_ Resolves review thread PRRT_kwDORy0Fc86GoAn_ Resolves review thread PRRT_kwDORy0Fc86GoAoA Resolves review thread PRRT_kwDORy0Fc86GoAoB Resolves review thread PRRT_kwDORy0Fc86GoAoF Resolves review thread PRRT_kwDORy0Fc86GoAoJ Resolves review thread PRRT_kwDORy0Fc86GoAoK Resolves review thread PRRT_kwDORy0Fc86GoAoP Resolves review thread PRRT_kwDORy0Fc86GoAoU Resolves review thread PRRT_kwDORy0Fc86Gn9M4 Resolves review thread PRRT_kwDORy0Fc86Gn9Mr Resolves review thread PRRT_kwDORy0Fc86Gn8kE
Restore relationship endpoint summaries in evidence lookup, fix smoke privacy scanning and URL userinfo detection, correct REST route count docs, and remove the external source-log follow-up suggestion. Resolves review thread PRRT_kwDORy0Fc86GxjaA Resolves review thread PRRT_kwDORy0Fc86GxjZp Resolves review thread PRRT_kwDORy0Fc86GxPpN Resolves review thread PRRT_kwDORy0Fc86GxPpY Resolves review thread PRRT_kwDORy0Fc86GxPpe Resolves review thread PRRT_kwDORy0Fc86GxPp4
jmagar
force-pushed
the
feat/syslog-mcp-fjdo-graph-proof-ux
branch
from
June 3, 2026 15:40
6e5b8f2 to
ab7cd40
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/api_tests.rs (1)
2424-2450:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winSelect a source-backed evidence row before requiring
source_log_summary.This test currently takes the first
/api/graph/aroundevidence sample and then unconditionally assertssource_log_summaryexists. The evidence lookup contract allowsmissing_source_reasonwhen the evidence row has nosource_log_id, so this can become nondeterministic as sampling/order changes. Mirror the MCP test’ssource_log_id IS NOT NULLselection or branch on the optional fields here instead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/api_tests.rs` around lines 2424 - 2450, The test currently picks the first entry from the `evidence` array and unconditionally asserts `source_log_summary` exists; change it to select an evidence row that has `source_log_id` (filter the `evidence` array for entries where `["source_log_id"]` is not null) before using its `id` with `get_json`, or after fetching `/api/graph/evidence` assert conditionally: if `value["source_log_summary"].is_object()` succeed, otherwise assert `value["missing_source_reason"]` is present; update the use of `evidence`, `evidence_id`, and the `get_json` call to reflect this selection/branching so the test no longer depends on sampling/order.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/smoke-test.sh`:
- Around line 914-926: The privacy scan currently builds privacy_blob from
recursive string VALUES via string_values, so sensitive markers appearing as
DICTIONARY KEYS are missed; update the logic to include keys as well (e.g., when
iterating dict in string_values yield the key string in addition to its value)
or replace the approach by serializing the entire payload to JSON and scanning
that serialized string for markers; ensure you still check the same markers list
and the userinfo regex against the new privacy_blob variable used by the markers
loop and assertions.
---
Outside diff comments:
In `@src/api_tests.rs`:
- Around line 2424-2450: The test currently picks the first entry from the
`evidence` array and unconditionally asserts `source_log_summary` exists; change
it to select an evidence row that has `source_log_id` (filter the `evidence`
array for entries where `["source_log_id"]` is not null) before using its `id`
with `get_json`, or after fetching `/api/graph/evidence` assert conditionally:
if `value["source_log_summary"].is_object()` succeed, otherwise assert
`value["missing_source_reason"]` is present; update the use of `evidence`,
`evidence_id`, and the `get_json` call to reflect this selection/branching so
the test no longer depends on sampling/order.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 8a474442-e0c6-4434-8e15-678d510acd15
📒 Files selected for processing (7)
docs/api.mdscripts/smoke-test.shsrc/api_tests.rssrc/app/service.rssrc/app/service_tests.rssrc/cli/output_graph.rssrc/mcp/tools_tests.rs
💤 Files with no reviewable changes (1)
- src/cli/output_graph.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
graph_relationship_evidenceacross DB, service, REST, MCP, and CLI.Beads
syslog-mcp-fjdo.1Graph evidence lookup: service, REST, and MCP.syslog-mcp-fjdo.2Graph CLI: proof-oriented evidence command.syslog-mcp-fjdo.3Graph output: endpoint entity summaries on relationships.syslog-mcp-fjdo.4Graph docs and smoke coverage for proof UX.syslog-mcp-fjdo.Tests
RUSTC_WRAPPER='' cargo check --lib --config 'build.rustc-wrapper=""'RUSTC_WRAPPER='' cargo test --lib graph --config 'build.rustc-wrapper=""'RUSTC_WRAPPER='' cargo test --bin cortex graph --config 'build.rustc-wrapper=""'RUSTC_WRAPPER='' cargo test --test cli_help --config 'build.rustc-wrapper=""'RUSTC_WRAPPER='' cargo clippy --config 'build.rustc-wrapper=""' -- -D warningsRUSTC_WRAPPER='' cargo test --config 'build.rustc-wrapper=""'./scripts/check-version-sync.shbash -n scripts/smoke-test.shgit diff --checkResidual Risk
CORTEX_SMOKE_GRAPH_EVIDENCE_ID, so live proof-UX smoke coverage requires a graph fixture/evidence id in the running deployment.Summary by cubic
Adds a proof-oriented evidence lookup to the investigation graph with readable endpoint summaries and a bounded, redacted source-log preview. Available via REST
/api/graph/evidence, MCPaction=graph mode=evidence, and CLIcortex graph evidence, fulfilling Linearsyslog-mcp-fjdo.New Features
graph_relationship_evidence.idreturns safe evidence, owning relationship withsrc_entity/dst_entitysummaries, top-level endpoint summaries, boundedsource_log_summary, andmissing_source_reasonwhen absent.1.9.0.Bug Fixes
explainand addsevidence+evidence_id; REST route count corrected; unknown query params rejected; bearer enforced.raw/metadata_jsonleakage.Written for commit ed23b54. Summary will update on new commits.
Summary by CodeRabbit
New Features
Improvements
Security/Privacy
Documentation
Tests