chore(dev→main): routine PR cadence for CodeRabbit review

[Snider]

Routine dev→main PR opened by Hephaestus PR-cadence task.

This PR exists to:

1. Trigger CodeRabbit auto-review of accumulated dev work
2. Surface any blocking review feedback before merge
3. Keep main current with dev once approved

ahead_by: 76 commit(s) (per gh api compare)

If CodeRabbit clears with no blocking comments, this PR is eligible for gh pr merge --merge (real merge commit, no force-push). Conflicts and review feedback should be addressed on the dev branch before merge.

Co-authored-by: Hephaestus hephaestus@cladius

[coderabbitai]

Warning

Rate limit exceeded

@Snider has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 6 minutes and 59 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 727f26c5-0b61-4d7c-b33d-1512eb82c544

📥 Commits

Reviewing files that changed from the base of the PR and between 2ad3b05 and 2d8fa57.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (12)

• CLAUDE.md
• cache.go
• cache_test.go
• docs/api-contract.md
• docs/architecture.md
• docs/development.md
• docs/index.md
• docs/security-attack-vector-mapping.md
• go.mod
• tests/cli/cache/Taskfile.yaml
• tests/cli/cache/main.go
• threats.md

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Snider]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Copilot]

Pull request overview

Routine dev→main sync that updates the go-cache module identity and documentation while introducing significant cache feature work (binary payload support, scoped caches, HTTP cache storage), plus security/threat-model artifacts and expanded tests.

Changes:

• Renames the module path to dappco.re/go/cache and updates docs accordingly.
• Adds security/threat-model documentation and broadens the test suite (including threat/regression tests).
• Introduces additional cache capabilities (binary sidecars, invalidation patterns, scoped caches, HTTP cache storage) and a small CLI driver under tests/cli.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
cache.go	Major implementation expansion (validation, scoped caches, invalidation, binary caching, HTTP cache storage).
cache_test.go	Large test suite expansion covering new behaviors and threat/regression cases.
go.mod	Module path rename and dependency updates.
go.sum	Dependency checksum updates (currently appears incomplete).
docs/index.md	Updates module path and examples; dependency table updated but currently inconsistent with go.mod.
docs/development.md	Updates example imports; currently may not match new go-io module path.
docs/architecture.md	Adds sections on scoped caches/invalidation/HTTP cache storage; contains a hash algorithm mismatch.
docs/api-contract.md	Updates exported API inventory; currently mismatches Entry.Data type vs code.
docs/security-attack-vector-mapping.md	Updates scope module path reference.
threats.md	Adds threat-model audit notes and references to tests/fixes.
tests/cli/cache/main.go	Adds a simple CLI driver to exercise cache round-trip.
tests/cli/cache/Taskfile.yaml	Adds a task to build/run the CLI driver.
CLAUDE.md	Updates module path reference.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The example imports dappco.re/go/core/io/store, but this module now depends on dappco.re/go/io (and cache.go imports dappco.re/go/io). If the store backend lives under the new module, this import path should likely be dappco.re/go/io/store; otherwise, consider adding the correct dependency (or clarifying why the core/io store path is still required).

Suggested change

	"dappco.re/go/core/io/store"
	"dappco.re/go/io/store"

[Copilot]

marshalPrettyJSON marshals the value twice (core.JSONMarshal for error checking, then core.JSONMarshalString again for the actual bytes). This adds avoidable CPU/allocs on every cache write. Consider using the already-produced result.Value.([]byte) (or a single marshal path) and indenting that buffer instead.

Suggested change

	return indentJSON([]byte(core.JSONMarshalString(value))), nil
	return indentJSON(result.Value.([]byte)), nil

[Copilot]

entryPaths reuses Path(key) (which enforces the no-symlink traversal check) for the .json file, but constructs the .bin sidecar path without any ensureNoSymlinkPath validation. On filesystem-backed media, an attacker could potentially pre-create <key>.bin as a symlink and have SetBinary/GetBinary follow it outside baseDir. Consider applying the same ensureNoSymlinkPath(baseDir, binaryPath) check before returning binaryPath.

Suggested change

	binaryPath := absolutePath(core.JoinPath(baseDir, key+".bin"))
	binaryPath := absolutePath(core.JoinPath(baseDir, key+".bin"))
	if err := ensureNoSymlinkPath(baseDir, binaryPath); err != nil {
	return "", "", core.E("cache.entryPaths", "invalid cache key: symlink escape attempt", err)
	}

[Copilot]

The Dependencies table lists dappco.re/go/core/io v0.4.1, but go.mod now requires dappco.re/go/io v0.8.0-alpha.1. Update this table (and any surrounding text that mentions go-io) to match the actual module path and version used by the package.

[Copilot]

This section says scoped origins are hashed with SHA-1, but scopePrefix() in cache.go uses SHA-256 (core.SHA256Hex). Update the documentation to reflect the actual hash algorithm so consumers don’t rely on the wrong key derivation.

Suggested change

	wrapper hashes the origin with SHA-1 and uses the result as a fixed namespace
	wrapper hashes the origin with SHA-256 and uses the result as a fixed namespace

[Copilot]

Entry.Data is an exported field but its type is the unexported rawJSON. This makes it impossible for external packages (including cache_test which is in package cache_test) to construct cache.Entry values with Data set (e.g. Data: []byte("...") won’t compile). Consider using encoding/json.RawMessage (it already has the same marshal/unmarshal behavior) or exporting the type / changing the field type to []byte so external users/tests can build.

[Copilot]

The API contract lists Entry as Data json.RawMessage, but cache.go currently defines Entry.Data as the unexported rawJSON type. Please update the contract table to match the actual exported API (or, preferably, switch Entry.Data back to json.RawMessage to keep the field usable by external callers).

Suggested change

	| `Entry` | `type Entry struct { Data json.RawMessage; CachedAt time.Time; ExpiresAt time.Time }` | `dappco.re/go/cache` | Cached item envelope with payload and timestamps. | no | no |
	| `Entry` | `type Entry struct { Data rawJSON; CachedAt time.Time; ExpiresAt time.Time }` | `dappco.re/go/cache` | Cached item envelope with payload and timestamps. | no | no |