Repository navigation
perf: retain bounded scanner projections and defer unused native proof - #117
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
P2
|
Codex review: needs maintainer review before merge. What this changesThis PR compresses retained scanner offset maps and delays native delimiter proof until a scan queries it. Example: The author’s no-model CLI scan of the original Solaris artifact on an isolated four-core VM.
Review scores
ProductKind: Performance · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep open: this maintainer-authored PR provides a useful performance improvement absent from main; no actionable correctness or security defect was found. Priority: P2 Before mergeNone. FindingsNone. Tests
Agent review detailsHow this fits togetherClawScan’s Docker runtime applies an owned patch to pinned SkillSpector; original artifact text enters its projection and marker scanners, which emit source-mapped findings and completeness records. flowchart LR
A[Original artifact text] --> B[Security view cache]
B --> C[Independent offset arrays]
C --> D[Static and marker scanners]
D --> E[Lazy native delimiter proof]
D --> F[Findings and completeness]
E --> D
Technical reviewBest possible solution: Land these focused optimizations within the existing cache and parser owners while preserving scanner evidence and conservative completeness behavior. Do we have a high-confidence way to reproduce the issue? Main visibly retains uncompressed offset arrays and eagerly constructs Markdown delimiter proof; the reported runtime improvement was not independently reproduced because this review executes no target code. Is this the best way to solve the issue? The approach is appropriately scoped: it improves retention inside the existing bounded cache and moves identical parser construction to the existing query boundary. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 3df93451eb5b. Provenance checked
TestingProof path: unit tests only. SecurityNone. EvidenceWhat I checked:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment Reviewed October 28, 2026, 1:22 AM ET / 05:22 UTC. |
|
Captured actual Solaris CLI comparison, with timing instrumentation and no model calls. Same retained original archive SHA-256: be62057b059fa024e9153f7389030220bb9415571e5c358c8929c70c38f7c852. Runs used the same isolated four-core/8 GiB VM, workflow limit 600 seconds, concurrency 10. The CLI path was [
{
"source": "before b85942d",
"wall_seconds": 394.825,
"process_cpu_seconds": 395.977,
"issues": 914,
"issue_sha256_excluding_random_finding_id": "874e68cadae827699c062946eab37515c357e398556331d7da79d585d66ab2b7",
"completeness_sha256": "891eb531a9ddf864b9a395022ead2fd34e9f30e68fdd142fb315bb7bc6505331",
"report_sha256": "e4c0dbc8028c1ac57b85d25b8e4470a0c5a1e1df163724cfc94a15f604ff3723"
},
{
"source": "candidate 6244514 / producer8c2587f",
"wall_seconds": 332.483,
"process_cpu_seconds": 335.009,
"issues": 914,
"issue_sha256_excluding_random_finding_id": "874e68cadae827699c062946eab37515c357e398556331d7da79d585d66ab2b7",
"completeness_sha256": "891eb531a9ddf864b9a395022ead2fd34e9f30e68fdd142fb315bb7bc6505331",
"report_sha256": "049278f16ffb686906f21af53f7cffcd39347dde98ddbfd8ffa1302ce205fb7f"
},
{
"source": "composed8a58465 including Bash predecessor",
"wall_seconds": 335.898,
"process_cpu_seconds": 338.271,
"issues": 914,
"issue_sha256_excluding_random_finding_id": "874e68cadae827699c062946eab37515c357e398556331d7da79d585d66ab2b7",
"completeness_sha256": "891eb531a9ddf864b9a395022ead2fd34e9f30e68fdd142fb315bb7bc6505331",
"report_sha256": "5dfb0f611c9c442bf7e02a73975eab751021d297a3fa30aa2e59eea46699aae1"
}
]All fields of all 914 issues except the random per-run finding ID are equal. The entire analysis-completeness object is equal, including each exception and analyzer status. Risk and suppression results are equal. The full composed run still has 30 partial files; this verifies the performance change and evidence preservation, not a user unblock. The two changed source modules in 6244514 are byte-identical at reviewed head cf09e66; the final 134-file composition was also checked against the exact reviewed predecessor. |
Solaris repeatedly builds large security projections and parses native string boundaries that most marker scans never query. Retain private offset maps as exact compressed snapshots under the existing 32 MiB cache budget, and construct the same native closer proof when a fallback actually queries it. Public views, findings, source offsets, parser eligibility, and runtime limits remain unchanged.
On the original Solaris artifact, the actual no-model CLI improved from 394.83 to 332.48 seconds on the same isolated four-core VM. Every field of all 914 issues except random finding IDs, the complete analysis-completeness object, and risk/suppression results are identical. This is static performance proof; Solaris still has parser and semantic-deadline blockers.
Validation: 1,458 related producer controls, 307 native adoption controls, exact equality of all 119 adopted source/dependency files, Ruff and diff checks. Independent producer and adoption P0–P3 reviews completed without findings (GPT-6.1 Sol, high, Standard). Both new native suites are included in image builds.