code-review: track code quality fixes

[2233admin]

Code Quality Fixes

Overview

AI-driven code review findings from 2026-08-18. These are code quality improvements, not security fixes (security issues deferred per team decision).

Code Quality Issues (for review)

High Priority

1. main.rs:831 - unwrap_or_default() silently ignores parse failures in parse_named_max_cc

2. main.rs:944 - Functions string_at, int_at, bool_at, string_path, string_first, existing_path, read_json duplicated across 5+ modules

3. main.rs:17 - Using Box<dyn Error> loses type information

4. artifacts.rs:313 - latest_run_dir can be simplified

Medium Priority

5. providers/evidence.rs:206 - is_sha256 validation only checks format, not valid hex

6. providers.rs:430 - Exit code unwrap_or(-1) hides failures

7. orchestration.rs:925 - generated_at() called repeatedly

8. artifacts.rs:296 - HOME/USERPROFILE fallback chain

Low Priority

9. Public functions lack doc comments
10. sha256.rs reads entire file into memory before hashing
11. features.rs:310 - repeated push_str string concatenation
12. main.rs:469 - redundant branch returning same value

Notes

• Security issues intentionally excluded
• Dependency audit passed (0 vulnerabilities)
• serde_json can update 1.0.150 → 1.0.151

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7d9b71b1-6210-4f93-aef8-41df455d25ec

📥 Commits

Reviewing files that changed from the base of the PR and between c16bb8f and 21fe558.

📒 Files selected for processing (1)

• CODE_QUALITY_REVIEW.md

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Documentation
  • Added a dated code quality review document for August 18, 2026.

Walkthrough

The pull request adds CODE_QUALITY_REVIEW.md with the title Code Quality Review - 2026-08-18.

Changes

Code quality review document

Layer / File(s)	Summary
Add dated review title CODE_QUALITY_REVIEW.md	Adds the dated document title for the code quality review.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 21fe5

This change only adds code-quality review documentation and does not alter product behavior or runtime code; no actionable merge-blocking risk remains after normal checks and review.

Poem

A rabbit hops through pages bright,
A dated title lands just right.
One small change, neat and clear,
Marks the quality review here.
Nibble, commit, disappear!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the pull request as tracking code quality fixes, which matches the documented change.
Description check	✅ Passed	The description directly explains the documented code quality findings and their tracking purpose.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Code Intel change risk

Score	Percentile	Level
11/100	0th (vs last 49 commits)	🟢 low

Top signals

• Diff shape: 1 file(s), +1/-0 (max file share 1.0)
• Test asymmetry: source changed, tests touched
• Bug-magnet: 0 fix commit(s) in touched files (180d)
• Churn: 0 commit(s) touching these files (90d)

_{revspec: origin/main..HEAD · threshold: score >= 80 blocks unless labeled risk-accepted; percentile is reported, not gated (#201) · code-intel change risk}