None of the 11 files under src/lotus/ have a colocated *.test.ts/*.test.tsx, and grep -rl "lotus" src --include="*.test.ts*" returns nothing — no existing suite imports or exercises any lotus module. vitest.config.ts would pick up such tests automatically (include: ["src/**/*.test.ts", "src/**/*.test.tsx"]), so the gap is pure absence of tests, not a config exclusion. This is the module that implements every io.lotus.* widget action (deafen, audio-inject including the previously-fixed double-publish race, focus/spotlight, quality caps, decorations, ML denoise) — i.e. all of the fork's actual behavioral surface — with no automated regression protection, and (per the finding above) CI wouldn't even run the tests if they existed.
Lead review note: the cinny audit's fix round added unit tests alongside every fix; the same pattern (colocated *.test.ts, run in CI) is the ask here.
How to trigger
N/A (absence of coverage, not a specific repro).
Suggested fix
Add unit tests for at least the action encode/decode + gating logic in lotusActions.ts, lotusAudioInject.ts (the double-publish race that was already fixed once), and lotusDeafen.ts; wire pnpm test:unit into CI (see finding above) so they're enforced.
Filed from the September 2026 audit (branch lotus).
**Severity:** high · **Type:** tech-debt · **Confidence:** high
**Location:** `src/lotus/lotusActions.ts`, `lotusAudioInject.ts`, `lotusCallState.ts`, `lotusDeafen.ts`, `lotusDecorations.ts`, `lotusDenoise.ts`, `lotusDenoiseProcessor.ts`, `lotusFocus.ts`, `lotusQuality.ts`, `lotusSpotlight.ts`, `lotusWidget.ts` (all 11 files)
### Problem
None of the 11 files under `src/lotus/` have a colocated `*.test.ts`/`*.test.tsx`, and `grep -rl "lotus" src --include="*.test.ts*"` returns nothing — no existing suite imports or exercises any lotus module. `vitest.config.ts` would pick up such tests automatically (`include: ["src/**/*.test.ts", "src/**/*.test.tsx"]`), so the gap is pure absence of tests, not a config exclusion. This is the module that implements every `io.lotus.*` widget action (deafen, audio-inject including the previously-fixed double-publish race, focus/spotlight, quality caps, decorations, ML denoise) — i.e. all of the fork's actual behavioral surface — with no automated regression protection, and (per the finding above) CI wouldn't even run the tests if they existed.
**Lead review note:** the cinny audit's fix round added unit tests alongside every fix; the same pattern (colocated `*.test.ts`, run in CI) is the ask here.
### How to trigger
N/A (absence of coverage, not a specific repro).
### Suggested fix
Add unit tests for at least the action encode/decode + gating logic in `lotusActions.ts`, `lotusAudioInject.ts` (the double-publish race that was already fixed once), and `lotusDeafen.ts`; wire `pnpm test:unit` into CI (see finding above) so they're enforced.
---
_Filed from the September 2026 audit (branch `lotus`)._
jared
added this to the EC fork audit 2026-09 · High milestone 2026-09-12 02:12:59 -04:00
Closed by the 0.25.0-lotus.2 fix round. src/lotus/ now has 11 colocated vitest files (lotusActions, lotusAudioConstraints, lotusAudioInject, lotusCallState, lotusDeafen, lotusDecorations, lotusDenoise, lotusDenoiseProcessor, lotusQuality, lotusSpotlight, lotusWidget — lotusFocus's payload parser is covered from lotusSpotlight.test.ts), 696 unit tests project-wide, and CI hard-gates pnpm test:unit (#5). Remaining thin spot: no end-to-end call test; tracked on the cinny side by the Playwright smoke test (cinny#90).
Closed by the 0.25.0-lotus.2 fix round. `src/lotus/` now has 11 colocated vitest files (lotusActions, lotusAudioConstraints, lotusAudioInject, lotusCallState, lotusDeafen, lotusDecorations, lotusDenoise, lotusDenoiseProcessor, lotusQuality, lotusSpotlight, lotusWidget — lotusFocus's payload parser is covered from lotusSpotlight.test.ts), 696 unit tests project-wide, and CI hard-gates `pnpm test:unit` (#5). Remaining thin spot: no end-to-end call test; tracked on the cinny side by the Playwright smoke test (cinny#90).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: high · Type: tech-debt · Confidence: high
Location:
src/lotus/lotusActions.ts,lotusAudioInject.ts,lotusCallState.ts,lotusDeafen.ts,lotusDecorations.ts,lotusDenoise.ts,lotusDenoiseProcessor.ts,lotusFocus.ts,lotusQuality.ts,lotusSpotlight.ts,lotusWidget.ts(all 11 files)Problem
None of the 11 files under
src/lotus/have a colocated*.test.ts/*.test.tsx, andgrep -rl "lotus" src --include="*.test.ts*"returns nothing — no existing suite imports or exercises any lotus module.vitest.config.tswould pick up such tests automatically (include: ["src/**/*.test.ts", "src/**/*.test.tsx"]), so the gap is pure absence of tests, not a config exclusion. This is the module that implements everyio.lotus.*widget action (deafen, audio-inject including the previously-fixed double-publish race, focus/spotlight, quality caps, decorations, ML denoise) — i.e. all of the fork's actual behavioral surface — with no automated regression protection, and (per the finding above) CI wouldn't even run the tests if they existed.Lead review note: the cinny audit's fix round added unit tests alongside every fix; the same pattern (colocated
*.test.ts, run in CI) is the ask here.How to trigger
N/A (absence of coverage, not a specific repro).
Suggested fix
Add unit tests for at least the action encode/decode + gating logic in
lotusActions.ts,lotusAudioInject.ts(the double-publish race that was already fixed once), andlotusDeafen.ts; wirepnpm test:unitinto CI (see finding above) so they're enforced.Filed from the September 2026 audit (branch
lotus).Closed by the 0.25.0-lotus.2 fix round.
src/lotus/now has 11 colocated vitest files (lotusActions, lotusAudioConstraints, lotusAudioInject, lotusCallState, lotusDeafen, lotusDecorations, lotusDenoise, lotusDenoiseProcessor, lotusQuality, lotusSpotlight, lotusWidget — lotusFocus's payload parser is covered from lotusSpotlight.test.ts), 696 unit tests project-wide, and CI hard-gatespnpm test:unit(#5). Remaining thin spot: no end-to-end call test; tracked on the cinny side by the Playwright smoke test (cinny#90).