Feat/cesar verification suite - #276
kern-guard: 3 new issues (+3 on existing code) (+94 advisory)
ℹ️ Inline review comments — no changes.
Mode: ephemeral
Sources: ast
Changed files: 43
All findings: 117
New to this PR: 100
Shown: 6 (3 on changed code, 3 advisory)
Hidden: 94 (advisory or muted rules)
Excluded: 134 findings on paths matched by 18 install patterns
Fix suggestions: 5 shown findings
Confidence: 70%-82% on shown findings
Breakdown: ast=6
Advisory findings outside changed code (3)
3 findings listed here are outside the changed code for this PR — they appear in the summary because GitHub can't pin annotations off-diff. Advisory only; they do not affect the check conclusion.
packages/cli/src/commands/review.ts · 2 findings
Warning
L495 · sensitive-console-log (outside diff)
Runtime console log includes request/auth/body/PII-looking data — logs can leak credentials or personal data
Warning
L497 · sensitive-console-log (outside diff)
Runtime console log includes request/auth/body/PII-looking data — logs can leak credentials or personal data
packages/cli/src/kern/cesar/session.kern · 1 finding
Warning
L238 · file-too-monolithic (outside diff)
.kern file has 19 top-level concern declarations outside any module block (19 fns); limit is 10. Threshold tightened to 10 because 5 handlers in this file exceed the 30-line handler-size limit. G...
Annotations
Check warning on line 307 in packages/cli/src/commands/review.ts
kern-guard / kern-guard
sensitive-console-log
Runtime console log includes request/auth/body/PII-looking data — logs can leak credentials or personal data
Raw output
Confidence: 82%
Suggestion:
Log only non-sensitive metadata, or pass values through a redaction helper before logging.
Check warning on line 110 in packages/core/src/kern/signals/delegate-ledger.kern
kern-guard / kern-guard
file-too-monolithic
.kern file has 14 top-level concern declarations outside any `module` block (14 fns); limit is 12. Group related declarations under `module Name` blocks or split into separate files to keep the structural layer scannable.
Raw output
Confidence: 70%
Suggestion:
Wrap related declarations in `module Name` blocks — declarations inside modules don't count toward this limit. Example: `module name=domain` followed by indented `fn`/`route`/`handler` children.
Check warning on line 11 in packages/cli/src/kern/cesar/tool-render-probe.kern
kern-guard / kern-guard
secrets/high-entropy-string
A high-entropy string that looks like a random secret was committed here. If it is a credential, move it to an env var or secret store and rotate it. Matched value: `../b…(26 chars)`.
Raw output
Confidence: 72%