Skip to content

fix(audit): bootstrap template skips and pass-color signal matches - #53

Merged
jaruesink merged 2 commits into
mainfrom
fix/sfe-1073-1074-loupe
Aug 24, 2026
Merged

fix(audit): bootstrap template skips and pass-color signal matches#53
jaruesink merged 2 commits into
mainfrom
fix/sfe-1073-1074-loupe

Conversation

@jaruesink

@jaruesinkjaruesink commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Fixes SFE-1073 and SFE-1074 as a bounded one-off against current main (ec4e279, same as the frozen Loupe evidence commit).

SFE-1073 — bootstrap metadata validation

Malformed or unknown template metadata is no longer dropped silently. The loader names the file and missing/invalid field, treats onDemand as on-demand instead of alwaysApply, and gives general explicit match-all semantics. All 18 templates now load; performance-measure-before-optimize is on-demand. Inventory/vocabulary tests and the bootstrap golden were updated deliberately.

SFE-1074 — audit report status color

Successful PR rule-signal matches render as 🟢 signal match instead of yellow. Missing stays red; unknown stays unlabeled. Yellow remains the degraded/backlog color elsewhere in the report.

Validation

  • bun test scripts/bootstrap-generate.test.ts scripts/audit-report-format.test.ts scripts/__tests__/golden.test.ts scripts/verify-self-audit-proof.test.ts
  • bun run lint && bun run typecheck && bun test — 534 pass / 0 fail

Conversation: https://app.warp.dev/conversation/9e0e7871-f0b3-46b9-9cc9-7405363f9b73

Co-Authored-By: Warp agent@warp.dev

@jaruesink@warp-agent
fix(audit): surface bootstrap template skips and pass-color signal ma…
eabf398
…tches
Make malformed or unknown bootstrap metadata visible instead of silently
dropping templates, treat onDemand/general as explicit vocabulary, and
render successful PR signal matches as green so they no longer look
degraded.
Co-Authored-By: Warp <agent@warp.dev>
@coderabbitai

coderabbitaiBot commented Aug 24, 2026•
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

  • Run on-demand review

On-demand reviews are free for the next 27 days. After that, they cost $0.25 per reviewed file.

Or wait 51 minutes for your next included review.

View limit details

Limit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 26c8235e-c63e-498d-9d78-4fa2482d9eb5

📥 Commits

Reviewing files that changed from the base of the PR and between ec4e279 and 9316c1e.

📒 Files selected for processing (9)
  • .gitleaks.toml
  • docs/audits/anvil-audit-2026-08-09.md
  • docs/bootstrap-templates/scope-boundaries.md
  • scripts/__tests__/golden/bootstrap-generate.sample-cli.md
  • scripts/audit-report-format.test.ts
  • scripts/audit.ts
  • scripts/bootstrap-generate.test.ts
  • scripts/bootstrap-generate.ts
  • scripts/verify-self-audit-proof.test.ts

Comment @coderabbitai help to get the list of available commands.

@jaruesink@warp-agent
fix(ci): allowlist bootstrap golden example credentials
9316c1e
The SFE-1073 catalog fix now emits the security-patterns template into
the sample-cli bootstrap golden, which copies the same documented
example key already allowlisted in the source template.
Co-Authored-By: Warp <agent@warp.dev>
@jaruesink
jaruesink merged commit 3b04ac6 into mainAug 24, 2026
3 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jaruesink
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
fix(audit): bootstrap template skips and pass-color signal matches by jaruesink · Pull Request #53 · lambda-curry/anvil · GitHub
Skip to content
fix(audit): bootstrap template skips and pass-color signal matches - #53
Merged
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Aug 24, 2026
Merged
fix(audit): bootstrap template skips and pass-color signal matches#53
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Conversation
@jaruesink
@jaruesinkjaruesink
commented
Aug 24, 2026

Copy link


Copy Markdown

Contributor
Fixes SFE-1073 and SFE-1074 as a bounded one-off against current main (ec4e279, same as the frozen Loupe evidence commit).
SFE-1073 — bootstrap metadata validation
Malformed or unknown template metadata is no longer dropped silently. The loader names the file and missing/invalid field, treats onDemand as on-demand instead of alwaysApply, and gives general explicit match-all semantics. All 18 templates now load; performance-measure-before-optimize is on-demand. Inventory/vocabulary tests and the bootstrap golden were updated deliberately.
SFE-1074 — audit report status color
Successful PR rule-signal matches render as 🟢 signal match instead of yellow. Missing stays red; unknown stays unlabeled. Yellow remains the degraded/backlog color elsewhere in the report.
Validation
  • bun test scripts/bootstrap-generate.test.ts scripts/audit-report-format.test.ts scripts/__tests__/golden.test.ts scripts/verify-self-audit-proof.test.ts
  • bun run lint && bun run typecheck && bun test — 534 pass / 0 fail
Conversation: https://app.warp.dev/conversation/9e0e7871-f0b3-46b9-9cc9-7405363f9b73
Co-Authored-By: Warp agent@warp.dev
@jaruesink@warp-agent
fix(audit): surface bootstrap template skips and pass-color signal ma…
eabf398
…tches
Make malformed or unknown bootstrap metadata visible instead of silently
dropping templates, treat onDemand/general as explicit vocabulary, and
render successful PR signal matches as green so they no longer look
degraded.
Co-Authored-By: Warp <agent@warp.dev>
@coderabbitai
coderabbitaiBot
commented
Aug 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review limit reached
  • Run on-demand review
On-demand reviews are free for the next 27 days. After that, they cost $0.25 per reviewed file.
Or wait 51 minutes for your next included review.
View limit details
Limit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.
Learn how review limits work.
Review configuration:
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 26c8235e-c63e-498d-9d78-4fa2482d9eb5
📥 Commits
Reviewing files that changed from the base of the PR and between ec4e279 and 9316c1e.
📒 Files selected for processing (9)
  • .gitleaks.toml
  • docs/audits/anvil-audit-2026-08-09.md
  • docs/bootstrap-templates/scope-boundaries.md
  • scripts/__tests__/golden/bootstrap-generate.sample-cli.md
  • scripts/audit-report-format.test.ts
  • scripts/audit.ts
  • scripts/bootstrap-generate.test.ts
  • scripts/bootstrap-generate.ts
  • scripts/verify-self-audit-proof.test.ts
Comment @coderabbitai help to get the list of available commands.
@jaruesink@warp-agent
fix(ci): allowlist bootstrap golden example credentials
9316c1e
The SFE-1073 catalog fix now emits the security-patterns template into
the sample-cli bootstrap golden, which copies the same documented
example key already allowlisted in the source template.
Co-Authored-By: Warp <agent@warp.dev>
@jaruesink
jaruesink
merged commit 3b04ac6
into
mainAug 24, 2026

3 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jaruesink

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(audit): bootstrap template skips and pass-color signal matches by jaruesink · Pull Request #53 · lambda-curry/anvil · GitHub
Skip to content
fix(audit): bootstrap template skips and pass-color signal matches - #53
Merged
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Aug 24, 2026
Merged
fix(audit): bootstrap template skips and pass-color signal matches#53
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Conversation
@jaruesink
@jaruesinkjaruesink
commented
Aug 24, 2026

Copy link


Copy Markdown

Contributor
Fixes SFE-1073 and SFE-1074 as a bounded one-off against current main (ec4e279, same as the frozen Loupe evidence commit).
SFE-1073 — bootstrap metadata validation
Malformed or unknown template metadata is no longer dropped silently. The loader names the file and missing/invalid field, treats onDemand as on-demand instead of alwaysApply, and gives general explicit match-all semantics. All 18 templates now load; performance-measure-before-optimize is on-demand. Inventory/vocabulary tests and the bootstrap golden were updated deliberately.
SFE-1074 — audit report status color
Successful PR rule-signal matches render as 🟢 signal match instead of yellow. Missing stays red; unknown stays unlabeled. Yellow remains the degraded/backlog color elsewhere in the report.
Validation
  • bun test scripts/bootstrap-generate.test.ts scripts/audit-report-format.test.ts scripts/__tests__/golden.test.ts scripts/verify-self-audit-proof.test.ts
  • bun run lint && bun run typecheck && bun test — 534 pass / 0 fail
Conversation: https://app.warp.dev/conversation/9e0e7871-f0b3-46b9-9cc9-7405363f9b73
Co-Authored-By: Warp agent@warp.dev
@jaruesink@warp-agent
fix(audit): surface bootstrap template skips and pass-color signal ma…
eabf398
…tches
Make malformed or unknown bootstrap metadata visible instead of silently
dropping templates, treat onDemand/general as explicit vocabulary, and
render successful PR signal matches as green so they no longer look
degraded.
Co-Authored-By: Warp <agent@warp.dev>
@coderabbitai
coderabbitaiBot
commented
Aug 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review limit reached
  • Run on-demand review
On-demand reviews are free for the next 27 days. After that, they cost $0.25 per reviewed file.
Or wait 51 minutes for your next included review.
View limit details
Limit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.
Learn how review limits work.
Review configuration:
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 26c8235e-c63e-498d-9d78-4fa2482d9eb5
📥 Commits
Reviewing files that changed from the base of the PR and between ec4e279 and 9316c1e.
📒 Files selected for processing (9)
  • .gitleaks.toml
  • docs/audits/anvil-audit-2026-08-09.md
  • docs/bootstrap-templates/scope-boundaries.md
  • scripts/__tests__/golden/bootstrap-generate.sample-cli.md
  • scripts/audit-report-format.test.ts
  • scripts/audit.ts
  • scripts/bootstrap-generate.test.ts
  • scripts/bootstrap-generate.ts
  • scripts/verify-self-audit-proof.test.ts
Comment @coderabbitai help to get the list of available commands.
@jaruesink@warp-agent
fix(ci): allowlist bootstrap golden example credentials
9316c1e
The SFE-1073 catalog fix now emits the security-patterns template into
the sample-cli bootstrap golden, which copies the same documented
example key already allowlisted in the source template.
Co-Authored-By: Warp <agent@warp.dev>
@jaruesink
jaruesink
merged commit 3b04ac6
into
mainAug 24, 2026

3 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jaruesink

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(audit): bootstrap template skips and pass-color signal matches by jaruesink · Pull Request #53 · lambda-curry/anvil · GitHub
Skip to content
fix(audit): bootstrap template skips and pass-color signal matches - #53
Merged
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Aug 24, 2026
Merged
fix(audit): bootstrap template skips and pass-color signal matches#53
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Conversation
@jaruesink
@jaruesinkjaruesink
commented
Aug 24, 2026

Copy link


Copy Markdown

Contributor
Fixes SFE-1073 and SFE-1074 as a bounded one-off against current main (ec4e279, same as the frozen Loupe evidence commit).
SFE-1073 — bootstrap metadata validation
Malformed or unknown template metadata is no longer dropped silently. The loader names the file and missing/invalid field, treats onDemand as on-demand instead of alwaysApply, and gives general explicit match-all semantics. All 18 templates now load; performance-measure-before-optimize is on-demand. Inventory/vocabulary tests and the bootstrap golden were updated deliberately.
SFE-1074 — audit report status color
Successful PR rule-signal matches render as 🟢 signal match instead of yellow. Missing stays red; unknown stays unlabeled. Yellow remains the degraded/backlog color elsewhere in the report.
Validation
  • bun test scripts/bootstrap-generate.test.ts scripts/audit-report-format.test.ts scripts/__tests__/golden.test.ts scripts/verify-self-audit-proof.test.ts
  • bun run lint && bun run typecheck && bun test — 534 pass / 0 fail
Conversation: https://app.warp.dev/conversation/9e0e7871-f0b3-46b9-9cc9-7405363f9b73
Co-Authored-By: Warp agent@warp.dev
@jaruesink@warp-agent
fix(audit): surface bootstrap template skips and pass-color signal ma…
eabf398
…tches
Make malformed or unknown bootstrap metadata visible instead of silently
dropping templates, treat onDemand/general as explicit vocabulary, and
render successful PR signal matches as green so they no longer look
degraded.
Co-Authored-By: Warp <agent@warp.dev>
@coderabbitai
coderabbitaiBot
commented
Aug 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review limit reached
  • Run on-demand review
On-demand reviews are free for the next 27 days. After that, they cost $0.25 per reviewed file.
Or wait 51 minutes for your next included review.
View limit details
Limit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.
Learn how review limits work.
Review configuration:
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 26c8235e-c63e-498d-9d78-4fa2482d9eb5
📥 Commits
Reviewing files that changed from the base of the PR and between ec4e279 and 9316c1e.
📒 Files selected for processing (9)
  • .gitleaks.toml
  • docs/audits/anvil-audit-2026-08-09.md
  • docs/bootstrap-templates/scope-boundaries.md
  • scripts/__tests__/golden/bootstrap-generate.sample-cli.md
  • scripts/audit-report-format.test.ts
  • scripts/audit.ts
  • scripts/bootstrap-generate.test.ts
  • scripts/bootstrap-generate.ts
  • scripts/verify-self-audit-proof.test.ts
Comment @coderabbitai help to get the list of available commands.
@jaruesink@warp-agent
fix(ci): allowlist bootstrap golden example credentials
9316c1e
The SFE-1073 catalog fix now emits the security-patterns template into
the sample-cli bootstrap golden, which copies the same documented
example key already allowlisted in the source template.
Co-Authored-By: Warp <agent@warp.dev>
@jaruesink
jaruesink
merged commit 3b04ac6
into
mainAug 24, 2026

3 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jaruesink

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
fix(audit): bootstrap template skips and pass-color signal matches by jaruesink · Pull Request #53 · lambda-curry/anvil · GitHub
Skip to content
fix(audit): bootstrap template skips and pass-color signal matches - #53
Merged
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Aug 24, 2026
Merged
fix(audit): bootstrap template skips and pass-color signal matches#53
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Conversation
@jaruesink
@jaruesinkjaruesink
commented
Aug 24, 2026

Copy link


Copy Markdown

Contributor
Fixes SFE-1073 and SFE-1074 as a bounded one-off against current main (ec4e279, same as the frozen Loupe evidence commit).
SFE-1073 — bootstrap metadata validation
Malformed or unknown template metadata is no longer dropped silently. The loader names the file and missing/invalid field, treats onDemand as on-demand instead of alwaysApply, and gives general explicit match-all semantics. All 18 templates now load; performance-measure-before-optimize is on-demand. Inventory/vocabulary tests and the bootstrap golden were updated deliberately.
SFE-1074 — audit report status color
Successful PR rule-signal matches render as 🟢 signal match instead of yellow. Missing stays red; unknown stays unlabeled. Yellow remains the degraded/backlog color elsewhere in the report.
Validation
  • bun test scripts/bootstrap-generate.test.ts scripts/audit-report-format.test.ts scripts/__tests__/golden.test.ts scripts/verify-self-audit-proof.test.ts
  • bun run lint && bun run typecheck && bun test — 534 pass / 0 fail
Conversation: https://app.warp.dev/conversation/9e0e7871-f0b3-46b9-9cc9-7405363f9b73
Co-Authored-By: Warp agent@warp.dev
@jaruesink@warp-agent
fix(audit): surface bootstrap template skips and pass-color signal ma…
eabf398
…tches
Make malformed or unknown bootstrap metadata visible instead of silently
dropping templates, treat onDemand/general as explicit vocabulary, and
render successful PR signal matches as green so they no longer look
degraded.
Co-Authored-By: Warp <agent@warp.dev>
@coderabbitai
coderabbitaiBot
commented
Aug 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review limit reached
  • Run on-demand review
On-demand reviews are free for the next 27 days. After that, they cost $0.25 per reviewed file.
Or wait 51 minutes for your next included review.
View limit details
Limit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.
Learn how review limits work.
Review configuration:
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 26c8235e-c63e-498d-9d78-4fa2482d9eb5
📥 Commits
Reviewing files that changed from the base of the PR and between ec4e279 and 9316c1e.
📒 Files selected for processing (9)
  • .gitleaks.toml
  • docs/audits/anvil-audit-2026-08-09.md
  • docs/bootstrap-templates/scope-boundaries.md
  • scripts/__tests__/golden/bootstrap-generate.sample-cli.md
  • scripts/audit-report-format.test.ts
  • scripts/audit.ts
  • scripts/bootstrap-generate.test.ts
  • scripts/bootstrap-generate.ts
  • scripts/verify-self-audit-proof.test.ts
Comment @coderabbitai help to get the list of available commands.
@jaruesink@warp-agent
fix(ci): allowlist bootstrap golden example credentials
9316c1e
The SFE-1073 catalog fix now emits the security-patterns template into
the sample-cli bootstrap golden, which copies the same documented
example key already allowlisted in the source template.
Co-Authored-By: Warp <agent@warp.dev>
@jaruesink
jaruesink
merged commit 3b04ac6
into
mainAug 24, 2026

3 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jaruesink

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(audit): bootstrap template skips and pass-color signal matches by jaruesink · Pull Request #53 · lambda-curry/anvil · GitHub
Skip to content
fix(audit): bootstrap template skips and pass-color signal matches - #53
Merged
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Aug 24, 2026
Merged
fix(audit): bootstrap template skips and pass-color signal matches#53
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Conversation
@jaruesink
@jaruesinkjaruesink
commented
Aug 24, 2026

Copy link


Copy Markdown

Contributor
Fixes SFE-1073 and SFE-1074 as a bounded one-off against current main (ec4e279, same as the frozen Loupe evidence commit).
SFE-1073 — bootstrap metadata validation
Malformed or unknown template metadata is no longer dropped silently. The loader names the file and missing/invalid field, treats onDemand as on-demand instead of alwaysApply, and gives general explicit match-all semantics. All 18 templates now load; performance-measure-before-optimize is on-demand. Inventory/vocabulary tests and the bootstrap golden were updated deliberately.
SFE-1074 — audit report status color
Successful PR rule-signal matches render as 🟢 signal match instead of yellow. Missing stays red; unknown stays unlabeled. Yellow remains the degraded/backlog color elsewhere in the report.
Validation
  • bun test scripts/bootstrap-generate.test.ts scripts/audit-report-format.test.ts scripts/__tests__/golden.test.ts scripts/verify-self-audit-proof.test.ts
  • bun run lint && bun run typecheck && bun test — 534 pass / 0 fail
Conversation: https://app.warp.dev/conversation/9e0e7871-f0b3-46b9-9cc9-7405363f9b73
Co-Authored-By: Warp agent@warp.dev
@jaruesink@warp-agent
fix(audit): surface bootstrap template skips and pass-color signal ma…
eabf398
…tches
Make malformed or unknown bootstrap metadata visible instead of silently
dropping templates, treat onDemand/general as explicit vocabulary, and
render successful PR signal matches as green so they no longer look
degraded.
Co-Authored-By: Warp <agent@warp.dev>
@coderabbitai
coderabbitaiBot
commented
Aug 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review limit reached
  • Run on-demand review
On-demand reviews are free for the next 27 days. After that, they cost $0.25 per reviewed file.
Or wait 51 minutes for your next included review.
View limit details
Limit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.
Learn how review limits work.
Review configuration:
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 26c8235e-c63e-498d-9d78-4fa2482d9eb5
📥 Commits
Reviewing files that changed from the base of the PR and between ec4e279 and 9316c1e.
📒 Files selected for processing (9)
  • .gitleaks.toml
  • docs/audits/anvil-audit-2026-08-09.md
  • docs/bootstrap-templates/scope-boundaries.md
  • scripts/__tests__/golden/bootstrap-generate.sample-cli.md
  • scripts/audit-report-format.test.ts
  • scripts/audit.ts
  • scripts/bootstrap-generate.test.ts
  • scripts/bootstrap-generate.ts
  • scripts/verify-self-audit-proof.test.ts
Comment @coderabbitai help to get the list of available commands.
@jaruesink@warp-agent
fix(ci): allowlist bootstrap golden example credentials
9316c1e
The SFE-1073 catalog fix now emits the security-patterns template into
the sample-cli bootstrap golden, which copies the same documented
example key already allowlisted in the source template.
Co-Authored-By: Warp <agent@warp.dev>
@jaruesink
jaruesink
merged commit 3b04ac6
into
mainAug 24, 2026

3 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jaruesink

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(audit): bootstrap template skips and pass-color signal matches by jaruesink · Pull Request #53 · lambda-curry/anvil · GitHub
Skip to content
fix(audit): bootstrap template skips and pass-color signal matches - #53
Merged
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Aug 24, 2026
Merged
fix(audit): bootstrap template skips and pass-color signal matches#53
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Conversation
@jaruesink
@jaruesinkjaruesink
commented
Aug 24, 2026

Copy link


Copy Markdown

Contributor
Fixes SFE-1073 and SFE-1074 as a bounded one-off against current main (ec4e279, same as the frozen Loupe evidence commit).
SFE-1073 — bootstrap metadata validation
Malformed or unknown template metadata is no longer dropped silently. The loader names the file and missing/invalid field, treats onDemand as on-demand instead of alwaysApply, and gives general explicit match-all semantics. All 18 templates now load; performance-measure-before-optimize is on-demand. Inventory/vocabulary tests and the bootstrap golden were updated deliberately.
SFE-1074 — audit report status color
Successful PR rule-signal matches render as 🟢 signal match instead of yellow. Missing stays red; unknown stays unlabeled. Yellow remains the degraded/backlog color elsewhere in the report.
Validation
  • bun test scripts/bootstrap-generate.test.ts scripts/audit-report-format.test.ts scripts/__tests__/golden.test.ts scripts/verify-self-audit-proof.test.ts
  • bun run lint && bun run typecheck && bun test — 534 pass / 0 fail
Conversation: https://app.warp.dev/conversation/9e0e7871-f0b3-46b9-9cc9-7405363f9b73
Co-Authored-By: Warp agent@warp.dev
@jaruesink@warp-agent
fix(audit): surface bootstrap template skips and pass-color signal ma…
eabf398
…tches
Make malformed or unknown bootstrap metadata visible instead of silently
dropping templates, treat onDemand/general as explicit vocabulary, and
render successful PR signal matches as green so they no longer look
degraded.
Co-Authored-By: Warp <agent@warp.dev>
@coderabbitai
coderabbitaiBot
commented
Aug 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review limit reached
  • Run on-demand review
On-demand reviews are free for the next 27 days. After that, they cost $0.25 per reviewed file.
Or wait 51 minutes for your next included review.
View limit details
Limit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.
Learn how review limits work.
Review configuration:
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 26c8235e-c63e-498d-9d78-4fa2482d9eb5
📥 Commits
Reviewing files that changed from the base of the PR and between ec4e279 and 9316c1e.
📒 Files selected for processing (9)
  • .gitleaks.toml
  • docs/audits/anvil-audit-2026-08-09.md
  • docs/bootstrap-templates/scope-boundaries.md
  • scripts/__tests__/golden/bootstrap-generate.sample-cli.md
  • scripts/audit-report-format.test.ts
  • scripts/audit.ts
  • scripts/bootstrap-generate.test.ts
  • scripts/bootstrap-generate.ts
  • scripts/verify-self-audit-proof.test.ts
Comment @coderabbitai help to get the list of available commands.
@jaruesink@warp-agent
fix(ci): allowlist bootstrap golden example credentials
9316c1e
The SFE-1073 catalog fix now emits the security-patterns template into
the sample-cli bootstrap golden, which copies the same documented
example key already allowlisted in the source template.
Co-Authored-By: Warp <agent@warp.dev>
@jaruesink
jaruesink
merged commit 3b04ac6
into
mainAug 24, 2026

3 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jaruesink

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
fix(audit): bootstrap template skips and pass-color signal matches by jaruesink · Pull Request #53 · lambda-curry/anvil · GitHub
Skip to content
fix(audit): bootstrap template skips and pass-color signal matches - #53
Merged
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Aug 24, 2026
Merged
fix(audit): bootstrap template skips and pass-color signal matches#53
jaruesink merged 2 commits into
mainfrom 
fix/sfe-1073-1074-loupe
Conversation
@jaruesink
@jaruesinkjaruesink
commented
Aug 24, 2026

Copy link


Copy Markdown

Contributor
Fixes SFE-1073 and SFE-1074 as a bounded one-off against current main (ec4e279, same as the frozen Loupe evidence commit).
SFE-1073 — bootstrap metadata validation
Malformed or unknown template metadata is no longer dropped silently. The loader names the file and missing/invalid field, treats onDemand as on-demand instead of alwaysApply, and gives general explicit match-all semantics. All 18 templates now load; performance-measure-before-optimize is on-demand. Inventory/vocabulary tests and the bootstrap golden were updated deliberately.
SFE-1074 — audit report status color
Successful PR rule-signal matches render as 🟢 signal match instead of yellow. Missing stays red; unknown stays unlabeled. Yellow remains the degraded/backlog color elsewhere in the report.
Validation
  • bun test scripts/bootstrap-generate.test.ts scripts/audit-report-format.test.ts scripts/__tests__/golden.test.ts scripts/verify-self-audit-proof.test.ts
  • bun run lint && bun run typecheck && bun test — 534 pass / 0 fail
Conversation: https://app.warp.dev/conversation/9e0e7871-f0b3-46b9-9cc9-7405363f9b73
Co-Authored-By: Warp agent@warp.dev
@jaruesink@warp-agent
fix(audit): surface bootstrap template skips and pass-color signal ma…
eabf398
…tches
Make malformed or unknown bootstrap metadata visible instead of silently
dropping templates, treat onDemand/general as explicit vocabulary, and
render successful PR signal matches as green so they no longer look
degraded.
Co-Authored-By: Warp <agent@warp.dev>
@coderabbitai
coderabbitaiBot
commented
Aug 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review limit reached
  • Run on-demand review
On-demand reviews are free for the next 27 days. After that, they cost $0.25 per reviewed file.
Or wait 51 minutes for your next included review.
View limit details
Limit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.
Learn how review limits work.
Review configuration:
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 26c8235e-c63e-498d-9d78-4fa2482d9eb5
📥 Commits
Reviewing files that changed from the base of the PR and between ec4e279 and 9316c1e.
📒 Files selected for processing (9)
  • .gitleaks.toml
  • docs/audits/anvil-audit-2026-08-09.md
  • docs/bootstrap-templates/scope-boundaries.md
  • scripts/__tests__/golden/bootstrap-generate.sample-cli.md
  • scripts/audit-report-format.test.ts
  • scripts/audit.ts
  • scripts/bootstrap-generate.test.ts
  • scripts/bootstrap-generate.ts
  • scripts/verify-self-audit-proof.test.ts
Comment @coderabbitai help to get the list of available commands.
@jaruesink@warp-agent
fix(ci): allowlist bootstrap golden example credentials
9316c1e
The SFE-1073 catalog fix now emits the security-patterns template into
the sample-cli bootstrap golden, which copies the same documented
example key already allowlisted in the source template.
Co-Authored-By: Warp <agent@warp.dev>
@jaruesink
jaruesink
merged commit 3b04ac6
into
mainAug 24, 2026

3 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jaruesink