No actionable comments were generated in the recent review. 🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 57.42% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 155 functions across 19 files. (5 skipped…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the main change: routing device, notification, and task-source storage through storage ports.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 57.42% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 155 functions across 19 files. (5 skipped: 5 unsupported.)

---

---

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the scoped-store trail,
While documents hop where backends prevail.
Devices, tasks, and notices land,
With SQLite waiting close at hand.
The tests nibble through each case,
And leave clean tracks in every place.}

_{Comment @coderabbitai help to get the list of available commands.}

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 20 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Changes requested
Priority: critical
Reviewed head: 512275f47d56
Updated: 1791545800 (Unix time)

Review snapshot

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

• critical · critique · Add the declared store_rows module — This declaration has no corresponding `store_rows.rs` module in the repository, so the crate fails to compile with a missing module file. Add the module source at the expected path (crates/openhuman\-core/src/integrations/task\_sources/store\.rs:445)
• critical · critique · Add the declared test module source — The new file declares `store_documents_tests.rs` under `#[cfg(test)]`, but that source file is not included in the supplied patch. If it does not already exist in the branch, any t (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:519)
• critical · critique · Add the missing store_rows module source — Rust resolves this declaration to `store_rows.rs` or `store_rows/mod.rs` beside `store.rs`. Neither source file is present in the complete diff, so this change fails to compile unl (crates/openhuman\-core/src/desktop/notifications/store\.rs:704)
• high · critique · Do not release another process's dedup claim — The rollback identifies ownership only by `last_ms`. Two callers can receive the same millisecond from `Utc::now().timestamp_millis()`; if the second caller claims the same content (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:203)
• high · critique · Do not leave a dedup claim before storing the notification — The dedup document is claimed before the notification document is written. If the process exits or loses its storage connection between these operations, the claim remains for up t (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:248)
• high · critique · Record the actual arrival time for deduplication — `now_ms` is captured before entering the document-store operation. Under executor or storage contention, the claim can be written substantially later, but its timestamp still refle (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:246)
• medium · critique · Do not treat malformed notification timestamps as valid state — A corrupt `received_at` is silently replaced with the current time, changing the notification's ordering and making the corruption invisible to callers. A corrupt `scored_at` is si (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:132)
• medium · critique · Preserve full timestamp ordering when listing sources — `created_ms` truncates `DateTime<Utc>` to milliseconds. Two sources created within one millisecond are then ordered by `_id`, not by their actual creation time, so `list_sources` c (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\.rs:39)
• medium · critique · Preserve full timestamp ordering for ingested references — `ingested_ms` truncates the supplied ingestion time to milliseconds. References ingested within the same millisecond are ordered by `external_id`, which is not their arrival order. (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\.rs:40)
• medium · critique · Reject unknown notification statuses — Any unknown or malformed stored status, including a typo such as `"dismiss"` or a non-string value, is silently mapped to `Unread`. That makes corrupted or newly introduced states (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:73)
• medium · critique · Make source removal and ledger cleanup atomic — These are two independent writes. If the source deletion fails after the ledger deletion succeeds, the source remains but all of its deduplication history is gone; a retry can re-i (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\.rs:199)
• medium · critique · Make the source check and ledger insert atomic — The parent check and the subsequent `put` are separate operations. If source removal runs after `get_source` succeeds but before `docs.put`, this method inserts an orphan ledger en (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\.rs:264)
• medium · critique · Make clearing sources and ledger entries atomic — The two collection-wide deletes are independent. If the second delete fails after the source delete succeeds, the reset leaves all ingestion ledger entries behind; if a later opera (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\.rs:339)
• medium · critique · Propagate a missing source from record_fetch — `record_fetch` updates an existing source, so a nonexistent source should be reported as an error rather than silently accepted. This test currently requires the opposite behavior (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\_tests\.rs:130)
• medium · critique · Propagate a missing source from record_fetch — `compare_and_swap` returns no updated document when the source does not exist, but this code maps that result directly to `Ok(())`. A fetch racing with source removal therefore rep (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\.rs:220)
• critical · security · Add the missing `store_rows` module source — This declaration requires `store_rows.rs` (or an inline module body), but the pull request does not provide that source. The crate therefore fails to compile. Add the module contai (crates/openhuman\-core/src/desktop/notifications/store\.rs:704)
• critical · security · Add the declared store_rows module — This declaration requires `crates/openhuman-core/src/integrations/task_sources/store_rows.rs` (or an inline module), but no such source is present in the provided pull-request diff (crates/openhuman\-core/src/integrations/task\_sources/store\.rs:445)
• high · security · Store the notification before claiming its deduplication entry — The deduplication document is updated before the notification document is inserted. A process crash between these operations permanently suppresses a notification for the deduplica (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:248)
• medium · security · Propagate a missing source from record_fetch — `compare_and_swap` returns `None` when the source does not exist, but the result is mapped to `()` and reported as success. Callers can therefore record a fetch for a deleted or un (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\.rs:220)
• medium · security · Require record_fetch to reject a missing source — This test explicitly accepts `record_fetch` succeeding for an unknown source, which codifies the missing-source behavior previously identified as incorrect. A fetch status must not (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\_tests\.rs:130)
• medium · security · Reject unknown notification statuses — Malformed or future status values are silently converted to `Unread`. This makes corrupted data appear actionable and can disagree with `unread_count`, which only counts documents (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:78)
• medium · security · Do not replace invalid receipt times with the current time — A missing or malformed persisted `received_at` is replaced with the current time during reads. That changes historical notification metadata and can make old corrupt records appear (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:132)
• medium · security · Preserve full timestamp ordering when listing sources — Sources are persisted with only epoch milliseconds, so sources created within the same millisecond are ordered by `_id` rather than their actual `DateTime<Utc>` values. This can ch (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\.rs:164)
• medium · security · Preserve full timestamp ordering for ingested references — The reference listing sorts only the millisecond timestamp and then the external ID. Multiple ingestions can share that millisecond while having different actual arrival times, so (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\.rs:285)
• medium · security · Preserve full ingestion ordering when listing tasks — Recently ingested tasks are ordered only by epoch milliseconds. Tasks received in the same millisecond are therefore ordered by the backend's unspecified tie behavior, which can vi (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\.rs:313)
• medium · security · Do not treat malformed scoring timestamps as unscored — When `scored_at` is present but malformed, `parse_time` returns `None`, making the notification look unscored even though it has persisted scoring fields. This creates incorrect tr (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:133)
• medium · security · Make the source check and ledger write atomic — The parent existence check is performed in a separate operation from the ledger write. A concurrent source removal can pass `get_source`, delete the source and its ledger, and then (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\.rs:264)
• medium · tests · Avoid sleeping to establish timestamp ordering — Still unfixed from the earlier review: `devices_list_oldest_first` relies on a 5 ms sleep to make `created_at` differ, which is a time-based flake the repository rules forbid. Inje (crates/openhuman\-core/src/security/devices/store\_documents\_tests\.rs:74)
• medium · tests · Do not claim the dedup key on a plain insert — `insert` is the non-dedup path (`insert_if_not_recent` is the dedup one), but it calls `claim_content` unconditionally, so even with `skip_recent = false` it stamps `last_ms = now` (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:248)
• medium · tests · Migrate existing pairings before switching storage backends — Still unfixed from the earlier review: the moment a backend is configured, every read and write goes to the document port and anything already persisted in `devices.db` — paired de (crates/openhuman\-core/src/security/devices/store\.rs:30)
• medium · tests · Make source removal and ledger cleanup atomic — Still unfixed from the earlier review: the ledger wipe and the source delete are two independent operations. The ordering comment explains the chosen failure mode, but a crash betw (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\.rs:199)
• medium · description · Do not treat malformed scoring times as unscored — The row conversion moved to `store_rows.rs` unchanged, so the finding stands: a stored but unparseable `scored_at` is reported as never scored, losing the fact that triage ran. An (\(pull request description\))
• medium · e2e · Do not treat malformed scoring times as unscored — Still stands from the earlier revision and unchanged: a `scored_at` value that fails to parse makes the notification read as unscored, so the intelligence pipeline re-scores conten (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:133)
• medium · e2e · Do not replace invalid receipt times with the current time — Still stands: an unparseable `received_at` becomes the current time, silently reordering and re-deduplicating against real arrivals. Surface the corruption rather than fabricating (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:132)
• medium · e2e · Reject unknown notification statuses — Still stands: an unrecognized `status` string silently reads as `Unread`, corrupting counts and re-surfacing dismissed or acted notifications. Fail the read (or log loudly and surf (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs:78)
• medium · e2e · Make source removal and ledger cleanup atomic — Still stands: ledger deletion and source deletion are two separate operations, so a failure between them deletes ledger entries for a source that still exists (or, reversed, orphan (crates/openhuman\-core/src/integrations/task\_sources/store\_documents\.rs:199)

Previously reported and still active

• Add the declared store\_rows module
• Propagate a missing source from record\_fetch

Resolved this pass

• Add the declared store_rows module
• critical — Add the declared store_rows module
• critical — Add the missing store_rows module source
• critical — Add the test source or remove the target
• high — Record the actual arrival time for deduplication
• medium — Preserve full ingestion ordering when listing tasks
• medium — Avoid sleeping to establish timestamp ordering
• medium — Preserve full timestamp ordering when listing sources
• medium — Preserve full timestamp ordering for ingested references
• medium — Migrate existing pairings before switching storage backends
• medium — Skip the SQLite interval bound for document-backed sources
• medium — Make source removal and ledger cleanup atomic
• medium — Propagate a missing source from record_fetch
• medium — Avoid sleeping to establish persistence ordering
• medium — Bound dedup timestamps to the actual arrival time
• Skip the SQLite interval bound for document-backed sources
• critical — Add the declared store_rows module
• critical — Add the missing store_rows module source
• critical — Add the test source or remove the target
• medium — Avoid sleeping to establish persistence ordering
• medium — Bound dedup timestamps to the actual arrival time
• medium — Propagate malformed ingested task payloads
• Add the declared store_rows module
• Do not consume the dedup claim before storing the notification
• Record the actual arrival time for deduplication
• Do not treat malformed scoring times as unscored
• Preserve full ingestion ordering when listing tasks
• Avoid sleeping to establish timestamp ordering
• Preserve full timestamp ordering when listing sources
• Preserve full timestamp ordering for ingested references
• Do not replace invalid receipt times with the current time
• Propagate malformed ingested task payloads
• Migrate existing pairings before switching storage backends
• Do not treat malformed scoring timestamps as unscored
• Reject unknown notification statuses
• Skip the SQLite interval bound for document-backed sources
• Propagate a missing source from record_fetch
• Make source removal and ledger cleanup atomic
• Add the test source or remove the target
• Add the missing store_rows module source
• Avoid sleeping to establish persistence ordering
• Bound dedup timestamps to the actual arrival time
• Add the declared store_rows module
• Do not consume the dedup claim before storing the notification
• Record the actual arrival time for deduplication
• Do not treat malformed scoring times as unscored
• Avoid sleeping to establish timestamp ordering
• Do not replace invalid receipt times with the current time
• Propagate malformed ingested task payloads
• Migrate existing pairings before switching storage backends
• Do not treat malformed scoring timestamps as unscored
• Reject unknown notification statuses
• Skip the SQLite interval bound for document-backed sources
• Add the test source or remove the target
• Add the missing store_rows module source
• Avoid sleeping to establish persistence ordering
• Bound dedup timestamps to the actual arrival time
• critical — Add the test source or remove the target
• critical — Add the declared store_rows module
• critical — Add the missing store_rows module source
• Record the actual arrival time for deduplication
• Avoid sleeping to establish timestamp ordering
• Bound dedup timestamps to the actual arrival time
• high — Do not consume the dedup claim before storing the notification
• high — Record the actual arrival time for deduplication
• critical — Add the test source or remove the target
• Do not treat malformed scoring times as unscored
• Preserve full ingestion ordering when listing tasks
• Avoid sleeping to establish timestamp ordering
• Preserve full timestamp ordering when listing sources
• Preserve full timestamp ordering for ingested references
• Do not replace invalid receipt times with the current time
• Propagate malformed ingested task payloads
• Migrate existing pairings before switching storage backends
• Do not treat malformed scoring timestamps as unscored
• Reject unknown notification statuses
• Skip the SQLite interval bound for document-backed sources
• Propagate a missing source from record_fetch
• Make source removal and ledger cleanup atomic
• Propagate the missing source from record_fetch
• Avoid sleeping to establish persistence ordering
• Bound dedup timestamps to the actual arrival time
• Add the declared store_rows module
• Do not consume the dedup claim before storing the notification
• Record the actual arrival time for deduplication
• Do not treat malformed scoring times as unscored
• Preserve full ingestion ordering when listing tasks
• Avoid sleeping to establish timestamp ordering
• Preserve full timestamp ordering when listing sources
• Preserve full timestamp ordering for ingested references
• Do not replace invalid receipt times with the current time
• Propagate malformed ingested task payloads
• Migrate existing pairings before switching storage backends
• Do not treat malformed scoring timestamps as unscored
• Reject unknown notification statuses
• Skip the SQLite interval bound for document-backed sources
• Propagate a missing source from record_fetch
• Make source removal and ledger cleanup atomic
• Add the test source or remove the target
• Add the missing store_rows module source
• Avoid sleeping to establish persistence ordering
• Bound dedup timestamps to the actual arrival time
• Add the declared store_rows module
• Add the declared store_rows module
• Add the missing store_rows module source
• Add the test source or remove the target
• Do not consume the dedup claim before storing the notification
• Record the actual arrival time for deduplication
• Bound dedup timestamps to the actual arrival time
• Propagate malformed ingested task payloads
• Skip the SQLite interval bound for document-backed sources
• Preserve full timestamp ordering when listing sources
• Preserve full timestamp ordering when listing sources
• Preserve full ingestion ordering when listing tasks
• Preserve full timestamp ordering for ingested references
• Avoid sleeping to establish persistence ordering
• Add the declared store_rows module
• Add the declared store_rows module
• Add the missing store_rows module source
• Add the test source or remove the target
• Do not consume the dedup claim before storing the notification
• Record the actual arrival time for deduplication
• Bound dedup timestamps to the actual arrival time
• Skip the SQLite interval bound for document-backed sources
• Preserve full timestamp ordering when listing sources
• Preserve full timestamp ordering for ingested references
• Propagate malformed ingested task payloads
• Add the declared store_rows module
• Add the declared store_rows module
• Add the missing store_rows module source
• Add the test source or remove the target
• Do not consume the dedup claim before storing the notification
• Record the actual arrival time for deduplication
• Bound dedup timestamps to the actual arrival time
• Preserve full ingestion ordering when listing tasks
• Preserve full timestamp ordering when listing sources
• Preserve full timestamp ordering for ingested references
• Skip the SQLite interval bound for document-backed sources
• Propagate malformed ingested task payloads

Pending checks: Rust E2E (mock backend), Build Playwright E2E Artifact, E2E (Playwright / web lane), Desktop E2E (full suite, 3 OS)

Before merge

• Address carried finding Add the declared store\_rows module.
• Address carried finding Propagate a missing source from record\_fetch.
• Address Add the declared store_rows module (crates/openhuman\-core/src/integrations/task\_sources/store\.rs).
• Address Add the declared test module source (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs).
• Address Add the missing store_rows module source (crates/openhuman\-core/src/desktop/notifications/store\.rs).
• Address Do not release another process's dedup claim (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs).
• Address Do not leave a dedup claim before storing the notification (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs).
• Address Record the actual arrival time for deduplication (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs).
• Address Add the missing `store_rows` module source (crates/openhuman\-core/src/desktop/notifications/store\.rs).
• Address Add the declared store_rows module (crates/openhuman\-core/src/integrations/task\_sources/store\.rs).
• Address Store the notification before claiming its deduplication entry (crates/openhuman\-core/src/desktop/notifications/store\_documents\.rs).
• Wait for Rust E2E (mock backend), Build Playwright E2E Artifact, E2E (Playwright / web lane), Desktop E2E (full suite, 3 OS).

How this fits together

flowchart LR
  n0["handle_ingest<br/>changed"]:::changed
  n1["exists_recent<br/>changed<br/>2 findings"]:::blocking
  n2["get_settings<br/>changed<br/>2 findings"]:::blocking
  n3["insert<br/>changed<br/>2 findings"]:::blocking
  n4["list<br/>changed<br/>2 findings"]:::blocking
  n5["list_core_notifications<br/>changed<br/>2 findings"]:::blocking
  n6["mark_acted<br/>changed<br/>2 findings"]:::blocking
  n7["with_connection"]:::impacted
  n8["with_connection"]:::impacted
  n9["prepare"]:::impacted
  n10["format"]:::impacted
  n0 -->|calls| n10
  n1 -->|calls| n7
  n2 -->|calls| n7
  n2 -->|calls| n9
  n3 -->|calls| n7
  n4 -->|calls| n7
  n4 -->|calls| n9
  n4 -->|calls| n10
  n5 -->|calls| n7
  n5 -->|calls| n9
  n6 -->|calls| n7
  n7 -->|calls| n10
  n8 -->|calls| n10
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.