ci(splinter): drop 10 stale ore_cllw allowlist rows, add unused-row check (CIP-3489)

[freshtonic]

Closes CIP-3489.

The CLLW-OPE migration removed the ore_cllw surface from src/v3, but its tasks/test/splinter.sh allowlist rows survived — and nothing could ever catch them. The awk classifier only tested if (key in allow) per finding and never iterated allow[], so no allowlist row could ever be reported as unused. A future re-introduction of ore_cllw would arrive pre-waived.

Changes

• Remove 10 inert rows. eql_v3_internal.ore_cllw_{eq,neq,lt,lte,gt,gte} and eql_v3.{ore_cllw,has_ore_cllw} + eql_v3_internal.{ore_cllw,has_ore_cllw}. Confirmed 0 non-comment ore_cllw references remain in src/v3, so these rows waived nothing. The live ope_cllw and ore_block_256 comparator rows are untouched.
• Fix regressed prose on the 2 live rows that still described routing "via ore_cllw": eql_v3.lt (the jsonb_entry lt wrapper now routes ord_term → ope_cllw) and eql_v3.-> (the chained ste_vec recipe extracts via eq_term / ord_term).
• Add a for (k in allow) unused-row check (tobyhede's point on the thread). Allowlist rows that match no finding now fail the gate — with a diagnostic and a CI step-summary "Stale allowlist rows" section — enforcing the same "registered but referenced by nothing" invariant the known-failures gate applies to suppressed tests. Comment (#…) and blank heredoc lines are skipped so they are never counted as unused.

Verification (live install, splinter@55db5b1, PG17)

• Built + installed EQL fresh, ran the modified gate: raw=1180, allowlisted=1180, unmatched=0, unused=0, exit 0 — the 10 removed rows were genuinely inert and no other row became unused (so the new check won't break CI).
• RED test: injected a bogus eql_v3.bogus_nonexistent_fn allowlist row → gate reports it "matched NO finding" and exits 1.
• Also unit-tested the awk classifier in isolation (matched → allowlisted, unmatched finding → denied, unmatched row → unused, comment/blank skipped).

CI-only change, no changeset (per CLAUDE.md exclusions).

Summary by CodeRabbit

• Bug Fixes
  • CI now detects and reports stale allowlist entries that no longer match any findings.
  • Test summaries now include a dedicated section for stale allowlist rows.
  • Updated function-search-path mutability checks and related allowlist entries for encrypted JSONB operations.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1eb8073f-2dbd-447b-8dc1-ab3a2263d909

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The splinter test script now tracks allowlist rows that match no findings, reports stale rows in console and GitHub Actions summaries, and fails CI when stale rows or unmatched findings exist. Encrypted-JSONB allowlist entries and justification text were also updated.

Changes

Splinter allowlist validation

Layer / File(s)	Summary
Update encrypted-JSONB allowlist entries tasks/test/splinter.sh	The eql_v3 lt justification changed, and ORE-CLLW constructor and presence-check entries were removed from the encrypted-JSONB allowlist region.
Track and gate unused allowlist rows tasks/test/splinter.sh	Allowlist matching now records unused rows, reports them in console and GitHub Actions summaries, and fails when unmatched findings or stale rows exist.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• cipherstash/encrypt-query-language#221: Both changes modify the splinter allowlist and its handling of encrypted-query findings.

Suggested reviewers: coderdan, tobyhede

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the CI splinter allowlist cleanup and new unused-row check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch james/cip-3489-splintersh-10-stale-ore_cllw-allowlist-rows-and-no-unused

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}