cleanup(claude): update CLAUDE.md with latest project changes#694
cleanup(claude): update CLAUDE.md with latest project changes#694Molter73 wants to merge 1 commit into
Conversation
Add more detail about modules in the fact project. Small clarifications on the fact-ebpf module. Update event flow section. Add note on protobuf definitions living in a git submodule. Assisted-by: Claude Code (Opus 4.6) claude-code/1.0.53
📝 WalkthroughWalkthroughThis PR updates developer guidance in ChangesRepository Guidance Documentation
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
CLAUDE.md (1)
47-52: ⚡ Quick winConsider clarifying the event flow to distinguish parallel event sources.
The current step-by-step numbering suggests a purely linear flow, but step 4 (HostScanner) is described as "periodically scans," which implies it's a separate, parallel event source rather than a sequential step that processes events from step 3. This could be made clearer by restructuring to show that both kernel LSM events (steps 1-3) and HostScanner events (step 4) are independent sources that then converge at the rate limiting stage (step 5).
For example:
### Event Flow 1. Kernel LSM hooks trigger BPF programs (in `fact-ebpf/src/bpf/main.c`); `checks.c` runs kernel capability probes at startup 2. BPF programs write events to ring buffer 3. `Bpf` worker (in `fact/src/bpf/mod.rs`) reads from ring buffer, sends to channel 4. `HostScanner` (in `fact/src/host_scanner.rs`) independently and periodically scans monitored paths and handles userspace inode tracking, generating events 5. All events (from both kernel LSM hooks and HostScanner) pass through rate limiting (`fact/src/rate_limiter.rs`) 6. Output handlers (in `fact/src/output/`) send to gRPC or stdout as JSON🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CLAUDE.md` around lines 47 - 52, The flow description reads as strictly linear but HostScanner is a parallel event source; update the narrative in CLAUDE.md to explicitly state that kernel LSM→BPF→Bpf worker (refer to fact-ebpf/src/bpf/main.c, checks.c and fact/src/bpf/mod.rs) and HostScanner (refer to fact/src/host_scanner.rs) generate events independently and then converge into the shared rate limiter (fact/src/rate_limiter.rs) before reaching output handlers (fact/src/output/); reword the steps to mark HostScanner as an independent, periodic source and clearly state that steps 1–3 and step 4 are parallel sources that merge at step 5.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@CLAUDE.md`:
- Around line 47-52: The flow description reads as strictly linear but
HostScanner is a parallel event source; update the narrative in CLAUDE.md to
explicitly state that kernel LSM→BPF→Bpf worker (refer to
fact-ebpf/src/bpf/main.c, checks.c and fact/src/bpf/mod.rs) and HostScanner
(refer to fact/src/host_scanner.rs) generate events independently and then
converge into the shared rate limiter (fact/src/rate_limiter.rs) before reaching
output handlers (fact/src/output/); reword the steps to mark HostScanner as an
independent, periodic source and clearly state that steps 1–3 and step 4 are
parallel sources that merge at step 5.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Enterprise
Run ID: 31de1054-9821-47a9-b07a-aa4e0d62e5f6
📒 Files selected for processing (1)
CLAUDE.md
1 participant
Description
Add more detail about modules in the fact project. Small clarifications on the fact-ebpf module.
Update event flow section.
Add note on protobuf definitions living in a git submodule.
Assisted-by: Claude Code (Opus 4.6) claude-code/1.0.53
Checklist
Automated testing
If any of these don't apply, please comment below.
Testing Performed
Changes are documentation only.
Summary by CodeRabbit