sashiko-dev/sashiko

[
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "<host-path>",
        "--version"
      ],
      "kind": "cli",
      "returncode": 0,
      "stdout": "sashiko 0.6.1",
      "stderr": "",
      "needs_credentials": false,
      "needs_browser": false,
      "scope": "partial: install"
    },
    "check": "install",
    "optional": false
  },
  {
    "status": "FAIL",
    "details": {
      "working": false,
      "argv": [
        "<host-path>",
        "review"
      ],
      "kind": "cli",
      "returncode": 3,
      "stdout": "\nError: patch 1: Permission denied (reason: Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.): {\n  \"error\": {\n    \"code\": 403,\n    \"message\": \"Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.\",\n    \"status\": \"PERMISSION_DENIED\"\n  }\n}\n\n\nCaused by:\n    0: Permission denied (reason: Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.): {\n[excerpt truncated]",
      "stderr": "Reviewing: HEAD\nUsing prompts: <host-path>\nRunning review for 1 patch\n      [Patch 1] mm: change add | Queued\n      [Patch 1] mm: change add | Pre-screening guides...\n2026-10-18T03:07:47.649333Z ERROR sashiko::ai::gemini: Gemini Permission Denied (403) (reason: Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.): {\n  \"error\": {\n    \"code\": 403,\n    \"message\": \"Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.\",\n    \"status\": \"PERMISSION_DENIED\"\n  }\n}\n[excerpt truncated]",
      "needs_credentials": false,
      "needs_browser": false,
      "blocker": "product did not produce a clear credential error: {\"returncode\": 3, \"stdout\": \"\\nError: patch 1: Permission denied (reason: Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.): {\\n  \\\"error\\\": {\\n    \\\"code\\\": 403,\\n    \\\"message\\\": \\\"Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.\\\",\\n    \\\"status\\\": \\\"PERMISSION_DENIED\\\"\\n  }\\n}\\n\\n\\nCaused by:\\n    0: Permission denied (reason: Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.): {\\n         \\\"error\\\": {\\n           \\\"code\\\": 403,\\n           \\\"message\\\": \\\"Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.\\\",\\n           \\\"status\\\": \\\"PERMISSION_DENIED\\\"\\n         }\\n       }\\n       \\n    1: Permission denied (reason: Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.): {\\n         \\\"error\\\": {\\n           \\\"code\\\": 403,\\n           \\\"message\\\": \\\"Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.\\\",\\n           \\\"status\\\": \\\"PERMISSION_DENIED\\\"\\n         }\\n       }\\n       \\n\", \"stderr\": \"Reviewing: HEAD\\nUsing prompts: <host-path>\\nRunning review for 1 patch\\n      [Patch 1] mm: change add | Queued\\n      [Patch 1] mm: change add | Pre-screening guides...\\n2026-10-18T03:07:47.649333Z ERROR sashiko::ai::gemini: Gemini Permission Denied (403) (reason: Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.): {\\n  \\\"error\\\": {\\n    \\\"code\\\": 403,\\n    \\\"message\\\": \\\"Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.\\\",\\n    \\\"status\\\": \\\"PERMISSION_DENIED\\\"\\n  }\\n}\\n\\n2026-10-18T03:07:47.649578Z ERROR sashiko::local_review: AI review for patch 1 failed with exception: Permission denied (reason: Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.): {\\n  \\\"error\\\": {\\n    \\\"code\\\": 403,\\n    \\\"message\\\": \\\"Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.\\\",\\n    \\\"status\\\": \\\"PERMISSION_DENIED\\\"\\n  }\\n}\\n\\n2026-10-18T03:07:47.726371Z ERROR sashiko::ai::gemini: Gemini Permission Denied (403) (reason: Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.): {\\n  \\\"error\\\": {\\n    \\\"code\\\": 403,\\n    \\\"message\\\": \\\"Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.\\\",\\n    \\\"status\\\": \\\"PERMISSION_DENIED\\\"\\n  }\\n}\\n\\n2026-10-18T03:07:47.726505Z ERROR sashiko::local_review: AI review for patch 1 failed with exception: Permission denied (reason: Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.): {\\n  \\\"error\\\": {\\n    \\\"code\\\": 403,\\n    \\\"message\\\": \\\"Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.\\\",\\n    \\\"status\\\": \\\"PERMISSION_DENIED\\\"\\n  }\\n}\\n\\n2026-10-18T03:07:47.805048Z ERROR sashiko::ai::gemini: Gemini Permission Denied (403) (reason: Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.): {\\n  \\\"error\\\": {\\n    \\\"code\\\": 403,\\n    \\\"message\\\": \\\"Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.\\\",\\n    \\\"status\\\": \\\"PERMISSION_DENIED\\\"\\n  }\\n}\\n\\n2026-10-18T03:07:47.805187Z ERROR sashiko::local_review: AI review for patch 1 failed with exception: Permission denied (reason: Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.): {\\n  \\\"error\\\": {\\n    \\\"code\\\": 403,\\n    \\\"message\\\": \\\"Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.\\\",\\n    \\\"status\\\": \\\"PERMISSION_DENIED\\\"\\n  }\\n}\\n\\n      [Patch 1] mm: change add | Incomplete\\nReview incomplete\\n\", \"needs_credentials\": false, \"needs_browser\": false}"
    },
    "check": "credentials_error",
    "optional": false
  }
]

Built sashiko from the pinned checkout (target/debug/sashiko) and ran `sashiko review` (README 'Quick Start > 3. Review Your Patches') on a scratch git repo with one commit at /tmp/kscratch. The full review reached the LLM provider (gemini, default) and was rejected with exit 3.

cd <host-path> && ls -la && cat README* 2>/dev/null | head -300
ls -la <host-path> 2>/dev/null; echo "CDP_URL=$CDP_URL <env-var>=$<env-var>"; which python3 uv pip pipx cargo go node 2>&1; python3 --version
cd <host-path> && cat rust-toolchain.toml; which cargo rustc rustup; grep -n "^[a-z-]*:" Makefile | head -40; grep -n "validate\|kind\|argv" <host-path> | head -80
cd <host-path> && sed -n 1,60p Makefile; ls ~/.cargo/bin 2>/dev/null; sudo -n true && echo SUDO_OK
sudo apt-get update -qq && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq build-essential pkg-config libssl-dev git curl ca-certificates >/tmp/apt.log 2>&1; echo apt=$?; curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.90.0 >/tmp/rustup.log 2>&1; echo rustup=$?; tail -3 /tmp/rustup.log
cd <host-path> && source ~/.cargo/env && cargo --version && (timeout 3000 cargo build --release --all-features > /tmp/build.log 2>&1; echo build_exit=$? >> /tmp/build.log) ; tail -5 /tmp/build.log
free -m; nproc; dmesg 2>/dev/null | tail -3; cd <host-path> && source ~/.cargo/env && (timeout 3000 cargo build --release --all-features -j 1 > /tmp/build.log 2>&1; echo build_exit=$? >> /tmp/build.log); tail -4 /tmp/build.log | cut -c1-400
cd <host-path> && source ~/.cargo/env && (timeout 3000 cargo build -j 1 > /tmp/build.log 2>&1; echo build_exit=$? >> /tmp/build.log); tail -4 /tmp/build.log | cut -c1-300; ls -la target/debug/sashiko 2>/dev/null
cd <host-path> && grep -v "^\s*$" /tmp/build.log | grep -i "error\|killed\|signal\|warning: unused" | head -20 | cut -c1-300; grep -c . /tmp/build.log
cd <host-path> && grep -o "signal: [0-9]*[^)]*)" /tmp/build.log | head; sed -n 1,20p /tmp/build.log | cut -c1-200; ulimit -a | head -20; cat /sys/fs/cgroup/memory.max 2>/dev/null; cat /sys/fs/cgroup/memory.events 2>/dev/null
cd <host-path> && source ~/.cargo/env && (cargo build -j 1 > /tmp/build2.log 2>&1; echo build_exit=$? >> /tmp/build2.log) & for i in $(seq 1 40); do sleep 15; echo "$(date +%T) $(free -m | awk 'NR==2{print $3"MB used"}') $(ps -eo rss,comm --sort=-rss | sed -n 2p)"; if grep -q build_exit /tmp/build2.log 2>/dev/null; then break; fi; done 2>&1 | tail -30
cd <host-path> && source ~/.cargo/env && setsid nohup bash -c 'cargo build -j 1 > /tmp/build2.log 2>&1; echo build_exit=$? >> /tmp/build2.log' >/dev/null 2>&1 & sleep 5; for i in $(seq 1 16); do sleep 20; echo "$(date +%T) used=$(free -m | awk 'NR==2{print $3}')MB $(ps -eo rss,args --sort=-rss | sed -n 2p | cut -c1-80)"; grep -q build_exit /tmp/build2.log && break; done; tail -2 /tmp/build2.log | cut -c1-200
cd /tmp && source ~/.cargo/env && echo 'fn main(){println!("hi");}' > /tmp/h.rs && rustc -o /tmp/h /tmp/h.rs && /tmp/h; cat /proc/self/cgroup; ls /sys/fs/cgroup | head -30; cat /proc/meminfo | head -3; sudo dmesg 2>/dev/null | grep -i -E "kill|oom" | tail -5
sudo fallocate -l 6G /swapfile && sudo chmod 600 /swapfile && sudo mkswap /swapfile >/dev/null && sudo swapon /swapfile && free -m && cd <host-path> && source ~/.cargo/env && setsid nohup bash -c 'cargo build -j 1 > /tmp/build3.log 2>&1; echo build_exit=$? >> /tmp/build3.log' >/dev/null 2>&1 & sleep 3; echo started
for i in $(seq 1 14); do sleep 20; grep -q build_exit /tmp/build3.log && break; done; echo "$(date +%T) swap=$(free -m | awk 'NR==3{print $3}')MB"; tail -3 /tmp/build3.log | cut -c1-250
for i in $(seq 1 14); do sleep 20; grep -q build_exit /tmp/build3.log && break; done; echo "$(date +%T) swap=$(free -m | awk 'NR==3{print $3}')MB"; tail -3 /tmp/build3.log | cut -c1-250
for i in $(seq 1 14); do sleep 20; grep -q build_exit /tmp/build3.log && break; done; echo "$(date +%T)"; tail -3 /tmp/build3.log | cut -c1-250; ls -la <host-path> 2>/dev/null
cd <host-path> && B=./target/debug/sashiko; $B --version; $B --help 2>&1 | head -40; echo ---; $B review --help 2>&1 | head -30; echo ---; ls -la ~/.config/sashiko.toml 2>&1; git -C . status 2>&1 | head -2
cd /tmp && B=<host-path>; $B init 2>&1 | tail -5; echo "init=$?"; ls -la ~/.config/sashiko.toml; grep -n -i "api_key\|LLM_API_KEY\|provider\|telemetry" ~/.config/sashiko.toml | head -20
rm -rf /tmp/kscratch && mkdir /tmp/kscratch && cd /tmp/kscratch && git init -q && git config user.email <email> && git config user.name tester && printf 'int add(int a, int b)\n{\n\treturn a + b;\n}\n' > a.c && git add a.c && git commit -qm base && printf 'int add(int a, int b)\n{\n\tint *p = 0;\n\treturn a + b + *p;\n}\n' > a.c && git commit -qam "mm: change add" && B=<host-path> && timeout 600 $B review --no-ai 2>&1 | tail -20; echo "exit=${PIPESTATUS[0]}"
cd /tmp/kscratch && env -u LLM_API_KEY timeout 600 <host-path> review 2>&1 | tail -15; echo "exit=${PIPESTATUS[0]}"
cd <host-path> && mkdir -p .coldpass && rm -f .coldpass/probe.json .coldpass/report.json && cat > .coldpass/probe.json <<'EOF'
{"checks":[
 {"kind":"cli","check":"install","argv":["<host-path>","expected_returncode":0,"expected_text":"sashiko 0.6.1"},
 {"kind":"cli","check":"credentials_error","argv":["<host-path>","env":{},"expected_returncode":3,"expected_text":"Method doesn't allow unregistered callers"}
]}
EOF
cat > .coldpass/report.json <<'EOF'
{"outcome":"needs_credentials",
 "operation":"Built sashiko from the pinned checkout (target/debug/sashiko) and ran `sashiko review` (README 'Quick Start > 3. Review Your Patches') on a scratch git repo with one commit at /tmp/kscratch. The full review reached the LLM provider (gemini, default) and was rejected with exit 3.",
 "operation_scope":"Verified: build, `sashiko --version`, `sashiko init`, `sashiko review --no-ai` (patch extraction/application only, no AI). Not verified: AI review. Unmet prerequisite: LLM_API_KEY (or a configured provider credential) is not set in the VM; the Gemini API returned 403 PERMISSION_DENIED 'Method doesn't allow unregistered callers'. Browser not needed.",
 "steps":[
  "README 'Quick Start > 1. Install': README says `cargo install sashiko` (crates.io). Not used; instead installed Rust toolchain 1.90.0 via rustup (rust-toolchain.toml pins 1.90.0) and ran `cargo build` in the pinned checkout so the evaluated source is what ran. Also `cargo build --release --all-features` (Makefile build target) was attempted and failed (see deviations).",
  "README 'Quick Start > 2. Configure': `sashiko init` -> wrote ~/.config/sashiko.toml (provider=gemini). `export LLM_API_KEY` not done: no credentials available.",
  "README 'Quick Start > 3. Review Your Patches': `sashiko review --no-ai` in /tmp/kscratch -> 'Review complete', exit 0 (patch extraction only).",
  "README 'Quick Start > 3. Review Your Patches': `sashiko review` in /tmp/kscratch with LLM_API_KEY unset -> exit 3, Gemini PERMISSION_DENIED 403."
 ],
 "deviations":[
  "`cargo install sashiko` (README Quick Start 1) not run: it would install the crates.io release, not the pinned commit. Ran `cargo build` in <host-path> instead.",
  "Guest had no Rust: installed build-essential, pkg-config, libssl-dev, git, curl via apt; installed rustup with 1.90.0 toolchain (curl|sh rustup installer, as required for the toolchain).",
  "`cargo build --release --all-features` (Makefile `build`) and `cargo build -j 1` both failed with rustc SIGKILL. Kernel log confirmed global OOM kill; guest has ~470MB RAM. Fix: added a 6G /swapfile (swapon) in the disposable guest, then `cargo build -j 1` (dev profile) succeeded in ~9m38s. Release build was not retried after adding swap.",
  "Workspace is not a git repository, so `sashiko review` on the workspace is impossible; used a scratch repo /tmp/kscratch (outside the product tree). No product source files were changed.",
  "`sashiko review --no-ai` is partial evidence only (no AI review); the full review was blocked by missing LLM credentials."
 ],
 "stuck_step":"README Quick Start 3: `sashiko review` (AI review) needs an LLM provider credential.",
 "main_blocker":"No LLM API key in the VM. Gemini (default provider) returned 403 PERMISSION_DENIED for unauthenticated calls.",
 "suggested_fix":"Export a valid provider key (e.g. `export LLM_API_KEY=...` for gemini, or configure another provider per docs/llm-providers.md) in the VM, then rerun `<host-path> review` in a git checkout. For a faster build on low-memory guests, use >=4GB RAM or add swap, and `cargo build -j 1`."
}
EOF
python3 -m json.tool .coldpass/probe.json >/dev/null && python3 -m json.tool .coldpass/report.json >/dev/null && echo json_ok; <env-var>=<host-path> python3 -I <host-path> --validate