[M3gA-Mind]

Summary

Test-only. PairingGuard already clears the one-time pairing code after a successful pair and refuses a wrong code, but nothing pinned either:

• try_pair_wrong_code tried "000000" and discarded the result (let _ = result;), so it asserted nothing. It now derives a certainly-wrong code from the real one (same length, last character changed) and asserts it is refused, nothing is paired, and the code is kept.
• New a_pairing_code_is_single_use: pair once with the code, then the same code is refused and pairing_code() is None.

API Or Behavior Changes

None.

Tests

CARGO_INCREMENTAL=0 cargo test -p tinychannels-runtime --lib -- security::test::try_pair_wrong_code security::test::a_pairing_code_is_single_use

• Current code: ok. 2 passed; 0 failed.

• Break-check 1, code not cleared after pairing (*pairing_code = None removed): a_pairing_code_is_single_use FAILED.

• Break-check 2, any code accepted (comparison forced true): try_pair_wrong_code FAILED.

• Code restored after each break.

• cargo fmt --check (touched file)

• N/A: cargo clippy --all-targets -- -D warnings: left to CI

• N/A: cargo clippy --all-targets --all-features -- -D warnings: left to CI

• N/A: cargo build --all-targets: left to CI

• N/A: cargo build --all-targets --all-features: left to CI

• N/A: cargo test: only the two tests ran locally; CI runs the suite

• N/A: cargo test --all-features: left to CI

Documentation

N/A: tests only.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c7523c9e-b3e6-4038-96c4-a922a9398bcb

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Reviewed head: 39e79dfabdc0211c5d1b4a927abd796d9d8daf19

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 1 of 1 files.
Pull request purpose (title): test(security): pin…

Diagnostics and supporting details

Full summary

Pull request purpose (title): test(security): pin single-use pairing codes and wrong-code refusal. Tiny Sweeper completed its review; deterministic results follow.

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	1	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

`try_pair_wrong_code` now derives a wrong code from the actual `pairing_code()` by flipping its last character, guaranteeing it differs from the real code, then asserts `try_pair` returns `None`, `is_paired()` is false, and the pending code is retained. A new test `a_pairing_code_is_single_use` pairs once with the real code, asserts the same code is then refused, and asserts `pairing_code()` becomes `None`. Only test code in `crates/tinychannels-runtime/src/security/mod_tests.rs` is touched; no production code is modified.

Features

• Modified — Wrong-code refusal now actually asserted: Replaces a test that discarded its result (`let _ = result;`) with deterministic assertions that a same-length, last-character-flipped wrong code is rejected, nothing gets paired, and the pending pairing code survives the failed attempt. (crates/tinychannels-runtime/src/security/mod_tests.rs, crates/tinychannels-runtime/src/security/mod_tests.rs async fn try_pair_correct_code() {)
• Added — Single-use pairing code test: Pins existing `PairingGuard` behavior that a successful pairing consumes the code: the same code fails a second time and `pairing_code()` returns `None`. (crates/tinychannels-runtime/src/security/mod_tests.rs)

Tests

• new unit test — `a_pairing_code_is_single_use` pairs with the real code, asserts a second attempt with the same code is refused, and asserts the code is cleared.: Lanes confirmed it pins observable consume-on-success behavior of `try_pair_blocking` and would fail on regression; no new uncovered production branch is introduced. Local execution is claimed but not verified by trusted evidence. (crates/tinychannels-runtime/src/security/mod_tests.rs)

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Lane found the two new tests sound: the derived wrong code is guaranteed different and the single-use test correctly exercises `try_pair_blocking` consuming the code.
• Lane summary: The two new tests are sound: `try_pair_wrong_code` now derives a guaranteed-wrong code from the generated one (6-digit zero-padded, so the length-1 slice and last-character swap always produce a same-length wrong value), and `a_pairing_code_is_single_use` correctly exercises `try_pair_blocking` consuming the code and re-issuing nothing. No defects found in this file. _The code index is behind this pull request (indexed at `590de3c2c653`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Lane confirmed the change only strengthens existing pairing tests with no security-relevant defect introduced; the `#[test]` async pattern is pre-existing and not a regression.
• Lane summary: The change strengthens two pairing tests in mod_tests.rs: it derives a certainly-wrong code from the live code and asserts single-use consumption. The `#[test]` attributes on async fns are the pre-existing pattern in this file (and the original `try_pair_wrong_code` was already `#[test] async fn`), so this is not a regression introduced here. No security-relevant defect found. _The code index is behind this pull request (indexed at `590de3c2c653`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Lane confirmed the toothless test becomes real assertions, both tests are deterministic, and no behavioral source change or uncovered branch is introduced.
• Lane summary: The change strengthens a previously toothless test (try_pair_wrong_code, which only commented that it might succeed and asserted nothing) into real assertions: a guaranteed-wrong code returns None, leaves the guard unpaired, and preserves the pairing code. The new `a_pairing_code_is_single_use` test pins the single-use invariant that the code asserts in try_pair_blocking. Both tests are deterministic — the wrong code is derived from the actual code by flipping the last character — and each assertion would fail if the corresponding behaviour regressed. No behavioural source change, no uncovered branch, and no repository-rule violation introduced; this is test-only hardening. _The code index is behind this pull request (indexed at `590de3c2c653`), so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Lane reported no sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `590de3c2c653`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Test-only change that replaces a no-op wrong-code assertion with a real one and adds a single-use pairing code test; the tests match the behaviour of `try_pair_blocking` (it clears the code on success and keeps it on a wrong code) and the description accurately describes the diff. _The code index is behind this pull request (indexed at `590de3c2c653`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000273
• Tokens: 108164 input · 2508 output · 15872 cached · 85 embedding
• Updated: 2026-10-23T12:26:32Z

Head	State	Pass summary
2a676ca81561	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T02:28:15Z)
60bb7a1212e2	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T08:20:51Z)
95e0e9f6b466	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T09:10:44Z)
39e79dfabdc0	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T12:26:32Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0002