fix: 22 audit findings across graph, harness, providers, language, and repl/rlm

[senamakel]

Summary

A full-crate audit (multi-agent fan-out: 5 area-scoped finders, each finding adversarially verified, fixes independently code-reviewed) confirmed and fixed 22 defects across all five surfaces. Every fix carries a regression test proven red-before/green-after.

graph

• resume() broadcast the resume value to every pending activation, not just the interrupted node(s) — never-run successor nodes observed ctx.resume on first execution, and a subgraph successor made the whole resume fail with "no checkpoint found". Resume is now keyed on the interrupted node(s) via new optional interrupted_nodes checkpoint metadata (legacy checkpoints fall back compatibly, with test coverage).
• prune() ignored checkpoint namespaces and deleted embedded subgraphs' checkpoint lineages, leaving threads permanently unresumable. The recency window now applies per namespace.
• DurabilityMode::Async spawned unordered background checkpoint writes (append-ordered backends could record a stale "latest") and abandoned in-flight writes on abort paths. Writes are now chained in order, drained on every exit, and a write is skipped when its predecessor failed.
• update_state(as_node) scheduled barrier successors without honouring the waiting-edge precondition; it now goes through the same gate as normal routing, and pending_activations/next_nodes are kept consistent.

harness

• Cancellation never propagated into sub-agent child runs (ToolExecutionContext now carries the parent's CancellationToken).
• BudgetMiddleware reservations were clobbered by concurrent runs, permanently leaking reserved tokens — now keyed per run-context instance (run ids are caller-supplied and collide).
• StreamAccumulator turned unparseable streamed tool arguments into null instead of ToolCall::invalid preserving the raw fragment.
• Truncated-empty recovery state leaked its token-cap boost into every later turn of the run.
• Middleware on_error fired twice for a single hook failure; now dispatched exactly once.

providers / tools

• apply_prompt_tool_calls destroyed every non-text content block (dropping Thinking blocks); non-text blocks are now preserved.
• The degraded unary invoke path lost its 600s timeout once the stream-required constraint latched, and list_models had no timeout at all — a stalled provider hung forever. Both now enforce the default request timeout (caller-owned clients keep their opt-out).
• The 400-driven request-shape degradation is now latched on the instance, so a rejecting endpoint no longer costs a guaranteed-400 round trip per call.

language / registry

• parse() hung forever on a token slice missing the trailing Eof sentinel; it now errors.
• Strict registry binding never validated the secondary model on subagent / repl_agent / subgraph nodes; both binding and the resolver now reject unregistered references.
• compile_with_provenance skipped the duplicate-graph-name check that compile performs.
• The documented steering { … } node item did not parse; the documented grammar is now implemented (parse + AST retention; harness lowering tracked separately).

repl / rlm

• RlmSession::eval panicked on non-ASCII output at the max_output_bytes boundary (UTF-8-unsafe truncate).
• Every recoverable .ragsh capability error became a fatal cell error, defeating try/catch; recoverable errors are now catchable while uncaught ones keep their typed form.
• model_query sent the registry alias as the provider model id, overriding the provider's configured model.
• RhaiInterpreter silently lost the persistent scope when a cell was cancelled or panicked; the scope now survives cancellation and a panic poisons it loudly.
• RlmRunner::run could not be called twice (cumulative cell counter vs restarting budget check); max_cells is now cumulative by contract, documented.

⚠️ Breaking changes (semver-major)

• ToolExecutionContext gained a public field cancellation: CancellationToken.
• NodeDecl gained a public field steering: Option<SteeringDecl>.
• External struct-literal constructors of these break; vendored consumers (e.g. openhuman-core) should be grepped for ToolExecutionContext { before bumping.
• Behavior changes worth release notes: model_query no longer forwards the registry alias as ModelRequest.model; middleware on_error fires once per failure.

Validation

• cargo fmt --check clean; cargo clippy --all-targets --all-features -- -D warnings clean.
• cargo test --all-features: 2,030 passed, 0 failed (~40 new regression tests; baseline before the fixes was ~1,900 passing).
• Independent review of the full diff found no Critical issues; both Important findings (legacy-checkpoint resume fallback, update_state checkpoint consistency) were fixed and re-verified.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 25 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: cb72cc84-af98-4526-a734-280a968a7211

📥 Commits

Reviewing files that changed from the base of the PR and between 107a515 and 460d289.

📒 Files selected for processing (50)

• docs/modules/graph/checkpointing.md
• src/graph/checkpoint/mod.rs
• src/graph/checkpoint/test.rs
• src/graph/compiled/executor.rs
• src/graph/compiled/mod.rs
• src/graph/compiled/state_api.rs
• src/graph/compiled/test.rs
• src/graph/compiled/types.rs
• src/graph/goals/test.rs
• src/graph/todos/test.rs
• src/harness/agent_loop/entry.rs
• src/harness/agent_loop/run_loop.rs
• src/harness/agent_loop/test.rs
• src/harness/context/mod.rs
• src/harness/context/types.rs
• src/harness/middleware/README.md
• src/harness/middleware/library/budget.rs
• src/harness/middleware/library/test.rs
• src/harness/middleware/library/types.rs
• src/harness/middleware/mod.rs
• src/harness/model/mod.rs
• src/harness/model/test.rs
• src/harness/providers/openai/mod.rs
• src/harness/providers/openai/test.rs
• src/harness/providers/openai/transport.rs
• src/harness/subagent/mod.rs
• src/harness/subagent/test.rs
• src/harness/tool/prompt.rs
• src/harness/tool/prompt_test.rs
• src/harness/tool/types.rs
• src/language/ast.rs
• src/language/capability_resolver.rs
• src/language/compiler.rs
• src/language/parser.rs
• src/language/resolver.rs
• src/language/test/compiler.rs
• src/language/test/extended_grammar.rs
• src/language/test/parser.rs
• src/language/test/resolver.rs
• src/repl/session/builtins/batched.rs
• src/repl/session/builtins/capabilities.rs
• src/repl/session/builtins/mod.rs
• src/repl/session/mod.rs
• src/repl/session/test.rs
• src/rlm/interpreter/rhai_cell.rs
• src/rlm/runner.rs
• src/rlm/session.rs
• src/rlm/test.rs
• src/rlm/types.rs
• tests/feature_repl_session.rs

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 460d289661

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".