feat: severity rules and the triage inbox #5

Merged

Breadway merged 1 commit from feature/triage into main

2026-10-12 09:51:14 +08:00

Breadway commented

2026-10-09 15:26:35 +08:00

Owner

Closes BUG-7 (the optional LLM suggestion is not built; see below)

Stacked on #4. Part of ECO-EP1.

What

Severity (triage.rs): rules, not a model. Crash/panic 100 > freeze 60 > behavior 20, plus volume (per doubling, capped), distinct installs, recency (day/week), spread across 3+ versions, and a regression bonus. Every point is attributed to a named rule and shown on the cluster page. Weights can be overridden from a TOML file (BREADBUG_TRIAGE_RULES).
Admin UI (admin.rs) on its own listener (BREADBUG_ADMIN_ADDR, default 127.0.0.1:8121; disabled unless BREADBUG_ADMIN_TOKEN_SHA256 is set; never routed publicly):
- ranked inbox with status filters (open / all / promoted / fixed / dismissed) and an app filter;
- cluster page: score breakdown, versions, OS builds, latest reports' notes, messages, symbolicated stacks and WARN/ERROR lines;
- actions: set status, mark fixed in a version, merge a duplicate cluster into another (same app only; counts, versions and installs fold; later reports with the merged fingerprint keep landing in the target);
- quarantine review: release (then clustered), delete, delete + ban the install; banned installs get 403 at intake;
- missing symbols list.
Hardening: bearer token or an HttpOnly/SameSite=Strict session cookie derived from the token; every cookie POST requires a CSRF token; login rate limit; CSP default-src 'none' with no scripts, nosniff, no-store, no-referrer; all report-derived text goes through one HTML escaper; 16 KiB body cap on the admin listener.
Migration 5 (bans); DB operations for status, fixed, merge, samples, quarantine, release, admin delete.

Not built

The optional LLM-suggested severity/summary from the issue. It is advisory-only and off by default in the spec, and I did not want an LLM step reading hostile text before the rest of the pipeline is proven. If wanted later it needs: a local model only, report text passed strictly as data, no tools, output shown as a labeled suggestion.

Tests

8 unit/rule tests (scoring order, caps, explanation completeness, TOML rules, escaping, UTC formatting) and 9 HTTP tests: admin off without a token, locked without credentials (every route, GET and POST), ranking and headers, hostile text escaped on every page, cookie login with CSRF enforcement, status/fixed/merge/filters, merged clusters keep collecting, quarantine release/delete/ban, login rate limit, missing symbols.
clippy -D warnings clean.

Closes BUG-7 (the optional LLM suggestion is not built; see below) Stacked on #4. Part of ECO-EP1. ## What - **Severity** (`triage.rs`): rules, not a model. Crash/panic 100 > freeze 60 > behavior 20, plus volume (per doubling, capped), distinct installs, recency (day/week), spread across 3+ versions, and a regression bonus. Every point is attributed to a named rule and shown on the cluster page. Weights can be overridden from a TOML file (`BREADBUG_TRIAGE_RULES`). - **Admin UI** (`admin.rs`) on its own listener (`BREADBUG_ADMIN_ADDR`, default 127.0.0.1:8121; disabled unless `BREADBUG_ADMIN_TOKEN_SHA256` is set; never routed publicly): - ranked inbox with status filters (open / all / promoted / fixed / dismissed) and an app filter; - cluster page: score breakdown, versions, OS builds, latest reports' notes, messages, symbolicated stacks and WARN/ERROR lines; - actions: set status, mark fixed in a version, merge a duplicate cluster into another (same app only; counts, versions and installs fold; later reports with the merged fingerprint keep landing in the target); - quarantine review: release (then clustered), delete, delete + ban the install; banned installs get 403 at intake; - missing symbols list. - **Hardening**: bearer token or an HttpOnly/SameSite=Strict session cookie derived from the token; every cookie POST requires a CSRF token; login rate limit; CSP `default-src 'none'` with no scripts, `nosniff`, `no-store`, `no-referrer`; all report-derived text goes through one HTML escaper; 16 KiB body cap on the admin listener. - Migration 5 (bans); DB operations for status, fixed, merge, samples, quarantine, release, admin delete. ## Not built The optional LLM-suggested severity/summary from the issue. It is advisory-only and off by default in the spec, and I did not want an LLM step reading hostile text before the rest of the pipeline is proven. If wanted later it needs: a local model only, report text passed strictly as data, no tools, output shown as a labeled suggestion. ## Tests - 8 unit/rule tests (scoring order, caps, explanation completeness, TOML rules, escaping, UTC formatting) and 9 HTTP tests: admin off without a token, locked without credentials (every route, GET and POST), ranking and headers, hostile text escaped on every page, cookie login with CSRF enforcement, status/fixed/merge/filters, merged clusters keep collecting, quarantine release/delete/ban, login rate limit, missing symbols. - clippy `-D warnings` clean.

Breadway added 1 commit

2026-10-09 15:26:35 +08:00

feat: severity rules and the triage inbox

check / check (push) Successful in 32s

Details

ae6ca2f3f8

Explainable rule-based severity (kind, volume, distinct installs, recency,
version spread, regression), tunable from a TOML file. A server-rendered
admin UI on its own listener: ranked inbox with status filters, cluster
page with score breakdown and evidence, set status, mark fixed in a
version, merge duplicate clusters, quarantine review (release, delete,
delete and ban), and missing symbols. Bearer or cookie auth, CSRF on every
cookie POST, login rate limit, a script-free CSP, and every report-derived
value HTML-escaped. Banned installs are refused at intake.

Refs BUG-7

Breadway referenced this pull request

2026-10-09 15:31:12 +08:00

feat: promote clusters to breadboard issues and track them #6

Breadway force-pushed feature/triage from ae6ca2f3f8

check / check (push) Successful in 32s

Details

to 1a6d27104e

check / check (push) Successful in 46s

Details

2026-10-12 09:21:58 +08:00

Compare

Breadway changed target branch from feature/fuzzy-clustering to main