simplify-code-base run a7b8fa: 52 iterations of folding duplicated decisions onto single seams #96
No reviewers
Labels
No labels
epic
in-review
ready-for-agent
ready-for-human
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
weiwen/evie!96
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "gnhf/simplify-code-base-r-a7b8fa"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Output of a long-running
simplify-code-basepass (runa7b8fa, 52 iterations). Each commit is one iteration: pick a lens, find every place the codebase spells the same decision more than once, fold the copies onto one seam, and pin whatever contract turned out to have no test. Every iteration is atomic and self-contained, so this reads best commit-by-commit; it is expected to squash-merge.65 files, +4947/-3665.
Bugs the folding surfaced
Deduplication kept turning up copies that had already drifted apart. These are the ones where the drift was live behaviour, not just noise:
just checkhad been red onmainsince 2026-08-13 at its very first step (cargo fmt --check), so every CI run failed and theneeds: checkimage publish never ran (gnhf 38). The gate is now green, and widened to cover the other two languages in the tree — every tracked*.nixthroughnixfmt --checkand every tracked*.shthroughshellcheck -x, both pinned through the flake (gnhf 39).schedules.jsontoschedules.tomlinconfig.rsalone (gnhf 17).send/promptlost markdown rendering and pagination in #67 — a scheduled prompt reply over Telegram's per-message cap was rejected outright (gnhf 24).2eaf3ca: linking straight at the destination hitEEXIST(b0d13e7).Config::loadcreate-if-absent ran against a deliberately read-only/etc(gnhf 23).api-chat targets passed schedule creation and were then dropped at every fire — creation validated less than fire requires (gnhf 21).PiSpawnConfig'sinclude_sudo_only_skills/agent_auth_pathintoSpawnModeitself (gnhf 10, finished in 33).message_burst_debounce_ms(gnhf 1),[telegram.voice].max_duration_secsand[logging].format(gnhf 2).Dead code removed
Mechanisms whose last producer or caller was deleted upstream and never followed through: the scheduled-push delivery channel whose only producer #67 removed a month prior (gnhf 4), the
[[pi.models]]fallback list whose entries past[0]were never read (gnhf 5), thesecret_envcapability-gated-secret forwarding left always-empty by #90 (gnhf 6, 47), theChatId::TelegramDmaddressing axis superseded by ADR 0023'sSender(gnhf 3), the deployment-side sandbox-account provisioning orphaned by #94's privilege-drop removal (gnhf 8, 9), and the Node/TypeScript toolchain stranded by the.sandcastleagent loop's removal (gnhf 30).Seams introduced
state_file::{write_atomic, install_atomic},schedule::{Verb, Selector},control_plane::{Partition, Destination},pi::{read_bounded_line, bwrap_command, pi_store_command},telegram::markdown::Splitter,telegram::view::{send_page, inline_content},session::run_ephemeral_kind,chat_id::ChatSession,main'sTarget/Selectionclap groups,transcribe::MODEL_FILES,test_script::write_executable, and a sharedtests/hitl/common.sh.Docs
Prose that had drifted from the code it describes: extensions-as-per-user-capability and the fixed
evieservice account (gnhf 31), the setuid/setgid privilege drop #94 removed including three docs falsely claiming bwrap builds its namespace unprivileged (gnhf 8), and the two agent-facing triage docs pointing at the removed loop's phantom stages (gnhf 30). TouchesREADME,CONTEXT.md, ADR 0011/0023,flake.nix, and the config template.Verification
nix develop .#ci -c just checkpasses on the branch tip: 539 tests, 0 failed, exit 0. That is the whole CI gate, so this is green in CI.Review notes
control_plane'sControlRequest(gnhf 45, 49, and the flattenedTarget/Selectionin main.rs's CLI), and theschedules.jsonfilename restoration (gnhf 17) which affects an existing live state file.[[pi.models]]collapsed back to scalarpi.provider/pi.model,[pi.capability_env]and[sandbox]gone, fourSessionManagerConfigpath fields now required.message_burst_debounce_msconfig knob by threading it intocollect_burst, and collapsed the redundant 11-argument burst-sender construction path into the existingTelegramDeps::burst_senderhelper. 7d6d86767b[telegram.voice].max_duration_secsand[logging].format), both left half-plumbed by the #90 config restructure, and added validation plus tests locking each in place. f2dddde9a4ChatId::TelegramDmaddressing axis — a second DM-session identity model superseded by ADR 0023'sSenderaxis — removing the variant, its two dead constructors, its parse branch, and the four match arms that only existed to reject it. 1d496cad88DeliveryItem,delivery_consumer,deliver_silent) whose only producer was removed by PR #67 a month ago, leaving a consumer task idling on a receiver nobody wrote to. e4b4ec43b3[[pi.models]]fallback list — a plural config surface whose doc promised fallbacks but whose entries past[0]were never read — back to scalarpi.provider/pi.model, which also repairs the Nix module's documented example. e1befab7dbsecret_envcapability-gated-secret forwarding parameter — always empty in production since #90 removed[pi.capability_env]and its resolver — along with the danglingforwarded_secret_namesdoc references, five tombstone comments, and four operator-facing docs still instructing readers to configure the deleted table. 60053ea5e9ControlPlane'ssession_managerandschedule_storenon-optional, deleting two guard macros and the two unreachable error responses they existed to emit. 931dfa2146user/groupprivilege-drop fields onVouchedUserand corrected the source comments, config template, ADRs and module maps still describing the setuid/setgid reuid that #94 removed, including three that falsely claimed bwrap builds its namespace unprivileged. 65b301d23feviedrop account and its three dead config keys) and narrowed the 0711/0644 permission widenings the drop had required, including twoset_permissions(0o711)calls in control_plane.rs that were overriding systemd's RuntimeDirectoryMode at every boot. 706d62659ePiSpawnConfigfields that restated whatSpawnModealready decides (pi_argv'sinclude_sudo_only_skillsbool and the Sandboxed-onlyagent_auth_path) into the mode itself, closing a sandbox-escape shape that the test suite had already drifted into. ab1ee60393Options (view/query_id, exactly one of which is everSome) into a singleGuestTargetenum, deleting the two unreachableelsearms that existed only to answer for the impossible both-Nonestate. 0024834a71Route::Session's never-readcapabilitiespayload, collapsingresolve_guest_messageintoresolve_messagewithaddressed = true7df3aadffbusers.toml's second skill-grant surface intoCapability::Skillat load, collapsingSpawnTarget's parallelskillsfield andextension_and_skill_dirs's second resolution loop, and correct the README/control-skill capability vocabulary still advertising the withdrawnnetwork/extensions/<name>grants 3cfdf47d23Commandbuilders into onebwrap_commandseam, making theenv_clearthat keeps the daemon's root environment out of a bwrap spawn structural rather than a per-caller obligation stated in the memfd helper's doc, and pin the previously untested visible argv of the script path ddb9970874ScheduleStore::saveandUserRegistry::persist— the run's last cross-module textual duplicate, two hand-rolled copies of the same create-parent + temp + rename dance — into a singlestate_file::write_atomicseam, and fixed the fixed-temp-name race andwith_extensionmisuse both copies shared. 9295430b882eaf3cabroke by linking straight at the destination, folding the install into astate_file::install_atomicseam so the link is retried through a fresh scratch name on every spawn instead of hitting EEXIST and silently degrading to a copy b0d13e77e1schedules.jsonpath that #90's blanket TOML sweep renamed toschedules.tomlin config.rs alone, which had orphaned the live deployment's persisted schedules, and removed the store's second spelling of the file name so the derived path is the only place it is written. b3023ef132agent_auth_in_homeseam - the bwrap overlay target, the reserved mount a per-user bind may not shadow, and the Sudo path's physical install, which must agree exactly or the overlay becomes shadowable - and clear the four doc-comment defects rustdoc already flagged, includingbwrap_argv's 31-line doc thatcee2416'spush_bindextraction stranded on the four-line helper 63a01bfeadControlPlaneconstructions into onewith_delivererseam - the#[cfg(test)]twin ofnewthat re-listed all ten fields, the raw test struct literal that re-listed them a third time with a danglingself_weak, and the five identical recording-plane preambles - and restoremanager_with_fake_ephemerals doc comment thattest_managers insertion stranded on the wrong function 2b17e6a5f6Splitterparameterized by renderer/measure/cap, fixing the Rich path's habit of measuring the unsanitized source against Telegram's cap so a live page whose appended closers pushed it over the limit was sent anyway. 24a092b03aapi-chat target persisted happily and was then dropped at every fire — and folded the four spellings of thesend|prompt|rungrammar into oneschedule::Verbenum. 13e69aede9common.shseam, deleted the two template keys whose mechanisms were removed months ago (__SANDBOX_USER__,[rpc]), and gave the rendered template its first schema-drift test. 726e4c4732Config::loadinto a daemon-onlyload_or_create, so a missing config on the packaged deployment (whose unit deliberately makes/etcread-only) reports the missing file instead of masking it as a "Read-only file system" write failure, and folded main.rs's hardcoded state-root fallback intoresolve_state_dir. 1080ec3e24send/promptfires through theDelivererseam the immediate verbs already use, restoring the markdown rendering and pagination #67 dropped (a scheduled prompt reply over Telegram's per-message cap was rejected outright), and foldedControlPlane's two constructors into one now that the deliverer is built once and shared. e9f64a2ffdDelivererseam total with anunconfigured_deliverernull object, deletingControlPlane'sOptiondeliverer branch and un-gating the schedule timer from the Telegram dispatcher it stopped depending on last iteration, so an HTTP-only deployment no longer silently fires no schedule at all. 2721c5bae9SessionManagerConfigtest fixture into one crate-sharedsession::test_manager_config, and cutSchedule's six hand-spelled test literals down to one per module. a95197d887use_draft/live_editboolean pair thattelegram/mod.rs's streaming path derived fromDeliveryContext::streaming_modeand threaded as parameters into three functions that already held the mode, so every decision point now matches onStreamingModeexhaustively. 8ec29ce222pi_store_commandbuilder plus two bounded runners (which also givespi installthe--no-approveits two siblings pass), and gave the inverse pairextension_install_source/extension_package_nameone shared spelling of the source-scheme predicate they must agree on. 54548fb306TelegramDepsno longer restates the fiveTelegramConfigvalues (plus client/manager) that existed only to be copied into aDeliveryContextat two hand-spelled 9-field sites, and now holds the one contextbuild_depsderives from config. 7bf74530cf.sandcastleagent loop's removal a month ago, repaired the brokenbuild-docker-imagerecipe, and repointed the two agent-facing triage docs off the loop's phantom stages onto the.pi/workflows/implement-issue.tsworkflow that actually runs. 6097c0c6c2evieaccount, both of which the code stopped doing (ADR 0023's extensions-are-global amendment and #94's privilege-drop removal). 4f47d0eddbSessionManagerConfigpath fields that the daemon always derives from the State Root non-optional, deleting the threeNonearms only test fixtures could reach and correctingconfig.rs's claim that a missing provider credential merely skips the sandbox bind when it in fact fails every turn. a78f09bdc0SpawnMode::Sandboxed'sagent_auth_pathnon-optional now thatresolved_agent_authcanonicalizes the credential before both production spawns, and finished the tolerance iteration 32 found dead by turning the credential overlay into a hard--ro-bind. 6d5cb6db97Transcriber's four joinedPathBuffields) into onetranscribe::MODEL_FILEStable, and moved the sherpa invocation onto a testablesherpa_argvbuilder. 6ebb4c9cbdrun_telegram_and_http,run_telegram_only,run_http_only) into oneJoinSetof the enabled interfaces, removing a 2x2-minus-one dispatch matrix and the two divergent spawn disciplines it ran under. 992b19f6c7bind_unix_socketseam plus oneserve(listener, scope)accept loop, making the 0700-directory/0600-socket permission contract structural and giving it its first test coverage. 5df93e1386read_agent_responseanddrain_aborted) into oneread_bounded_lineseam returning a three-outcomePiLine, making the per-line OOM cap and the idle timeout one contract instead of two copies that had already drifted on their error wording. edb0322ccejust checkgate, red on main since 2026-08-13 at its first step (cargo fmt --check) so every CI run was failing and theneeds: checkimage publish never ran, and widened the gate to the two checks this run had been running by hand every iteration. 332a2b627anixfmt --checkandshellcheck -x, both pinned through the flake), and repaired the ~40 lines of nixfmt drift the two NixOS/home-manager modules had accumulated while nothing checked them. 78906b3819run_ephemeralandrun_ephemeral_isolated) onto onerun_ephemeral_kindseam parameterized by anEphemeralconfinement, so the test-process factory is consulted in one place rather than at two different depths, and gave the isolated summarizer its first test. d6ef991301StreamStatethechat_idhalf of the destination it already storedthread_idfor, deleting that parameter from four of its methods plusfinish_streaming_turnand folding the four duplicate draft-refresh call chains onto two seams. 3c776badcepi --mode rpctranscripts undertests/fixtures/pi-rpc/into pi.rs's test module, closing the gap where 1.3 MB of verbatim wire data documented as test fixtures was read by nothing while every parser regression was hand-transcribed inline. cdc7273b3dmessage_starton the assistant role and routing every preview send through onesend_if_newdedup. db3cc61c80ScheduleStoreonto oneSelector(chat, topic filter, optional name, owner), so the per-sender scoping the untrusted socket rests on is a required field of the selection rather than a rule each accessor restates, and pinned the topic-scoped upsert that had no test. 151fb7ba88Partitionbuilt from the request's ambient scope, deleting two helpers and three hand-writtenSelectorliterals, and pinned the topic half of that narrowing which no test covered. fc0727b3adFireTargetresolved in a single place, replaced the hand-written re-spelling ofChatId::telegram_numeric_id, and pinned the resolution no test covered. 7d99f5b33e--argsmemfd delivery those docs describe its first test, closing a gap where dropping the rewind broke every sandboxed spawn with the whole suite green. 1d912bd953test_script::write_executableseam that writes via a child process, then deleted the production retry loop and the fused four-in-one test that had been papering over that test-only race. f5153167d5#[arg]declarations, 8 hand-written help strings) onto oneTarget/Selectionpair of flattened clap groups, restoring the$EVIE_CHAT_IDfallback documentation to the three verbs whose help had drifted away from it, and pinned that contract per flag. 5001757c6dSessionKeyalready naming it into oneChatSessionminted byresolve_message, deleting fourteen parameter positions across the message/turn path (and onetoo_many_argumentsallow) plus the two hand-written "same key, other sudo slot" re-spellings, and pinned the pairing no test covered. 9cfb072eceSessionKeythe caller already held, folding them onto oneSessionManager::clear_both_sudo_slots(key)and aRoute::DropUnaddressed(ChatSession), which also removedSessionManager::clear_sessionentirely since http.rs'shttp_keyalready named the key it was re-deriving. 5450939ee7MarkdownFormat-to-wire-payload decision that was spelled five times across three files onto oneview::send_page/view::inline_contentpair, deleting theGuestAnswervocabulary that restatedViewOp's existingOption<MarkdownFormat>convention and the second hand-written copy ofmarkdown_v2_mode.