fix: align tests and tool defs with SVC_STORAGE delegation

[chitcommit]

Summary

• Updates evidence search/retrieve tests to use SVC_STORAGE service binding mock instead of old AI_SEARCH_TOKEN / Vectorize API patterns
• Updates tool registry descriptions for chitty_evidence_search and chitty_evidence_retrieve to reflect ChittyStorage delegation
• Fixes SQL syntax error in credentials.js PUT route (unquoted string literal in INSERT)
• Removes duplicate doc comment opener in credentials.js

Fixes 5 test failures introduced by 8186f6d but not caught because the test file wasn't updated in that commit.

Test plan

• npx vitest run tests/mcp/tool-dispatcher.test.js — 82/82 pass locally

🤖 Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@chitcommit has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 31 minutes and 23 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b0bbd97b-ddcf-4309-973e-d0b0d09aa05c

📥 Commits

Reviewing files that changed from the base of the PR and between dd5eed0 and a75c6f7.

📒 Files selected for processing (3)

• src/api/routes/credentials.js
• src/mcp/server-factory.js
• src/mcp/tool-registry.js

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/storage-delegation-cleanup

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	chittyconnect	a75c6f7	May 05 2026, 06:17 PM

[Copilot]

Pull request overview

Updates MCP evidence tool tests and tool metadata to reflect the new ChittyStorage (SVC_STORAGE) delegation model, and fixes a SQL INSERT issue in the credentials PUT route audit logging.

Changes:

• Updated dispatchToolCall evidence-search/retrieve tests to mock and assert env.SVC_STORAGE.fetch(...) behavior (instead of prior AI search / Vectorize patterns).
• Refreshed MCP tool registry descriptions and input schemas for chitty_evidence_search and chitty_evidence_retrieve to match ChittyStorage-backed behavior.
• Fixed the credentials PUT route audit INSERT by parameterizing the type value and using a valid timestamp expression; removed a duplicate doc-comment opener.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
tests/mcp/tool-dispatcher.test.js	Aligns evidence tool tests with SVC_STORAGE binding and ChittyStorage response shapes/formatting.
src/mcp/tool-registry.js	Updates tool descriptions and schemas to reflect ChittyStorage delegation and new retrieve inputs.
src/api/routes/credentials.js	Fixes SQL INSERT syntax for audit logging in PUT route; cleans up duplicated comment opener.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 924db11c1d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Enforce a required lookup key in evidence_retrieve schema

This change switches chitty_evidence_retrieve to anyOf-based required fields, but in the ChatGPT/SDK path we register tools from MCP_TOOL_DEFS, and inputSchemaToZodShape only consumes top-level required (not anyOf). That means all three fields become optional during server-side validation, so {} can pass schema checks and only fail later in dispatchToolCall with a runtime error. Please either preserve an enforceable required field here or add anyOf handling in the schema converter so the tool contract is validated before execution.

Useful? React with 👍 / 👎.

[chitcommit]

@claude address feedback and resolve conversations

[claude]

Claude finished @chitcommit's task in 7m 46s —— View job

---

Addressed PR Feedback

• Read relevant files and understand the feedback
• Fix anyOf schema issue in chitty_evidence_retrieve tool definition
• Commit and push changes

---

What changed (commit e52f3f2):

The Codex reviewer correctly identified that inputSchemaToZodShape ignored anyOf: [{required: [key]}, ...] patterns, causing all three fields of chitty_evidence_retrieve to be optional — meaning {} could silently pass Zod validation in the ChatGPT/SDK path and only fail deep inside dispatchToolCall.

src/mcp/tool-registry.js — inputSchemaToZodShape now detects anyOf-required patterns and returns a z.object(shape).superRefine(...) instead of a plain shape when present. The refine checks that at least one of the required keys is non-null/non-empty and emits a structured Zod issue if not.

src/mcp/server-factory.js — adds z import and detects when def.schema is a ZodEffects (anyOf case). For those tools it:

1. Extracts the raw inner shape (_def.schema.shape) for server.tool() registration — the MCP SDK expects ZodRawShape, not a ZodEffects
2. Runs def.schema.safeParse(args) before calling dispatchToolCall, returning a structured error immediately if the anyOf constraint is violated

The existing dispatchToolCall runtime guard for {} is unchanged; the new layer fires earlier in the SDK handler path.
| Branch: fix/storage-delegation-cleanup

[github-actions]

⚠️ Unsigned Commits Detected

This PR contains unsigned commits. ChittyOS requires all commits to be cryptographically signed.

How to fix this:

Option 1: Sign with SSH key (Recommended)

# Configure Git to use SSH signing
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

# Re-sign your commits
git rebase --exec 'git commit --amend --no-edit -S' HEAD~N
git push --force-with-lease

Option 2: Sign with 1Password

1. Enable "Sign Git commits" in 1Password settings
2. Configure Git: git config --global gpg.program /path/to/op-ssh-sign

Option 3: Sign with GPG

git config --global commit.gpgsign true
git config --global user.signingkey YOUR_KEY_ID

📚 1Password SSH Signing Guide

[chitcommit]

@copilot resolve all comments, coversations and conflicts tyo unblcok merge/squash

[Copilot]

@claude address feedback and resolve conversations

The P2 feedback from chatgpt-codex-connector about anyOf enforcement in inputSchemaToZodShape was addressed in commit e52f3f2. That commit:

• Detects anyOf: [{required: [key]}, ...] patterns and returns a z.object(shape).superRefine(...) instead of a plain shape, so an empty {} no longer passes validation silently
• Updates server-factory.js to run safeParse before dispatching and return a structured error if no lookup key is supplied

All 437 tests pass and all CI checks are green on the latest merge commit (a75c6f7).

@copilot resolve all comments, coversations and conflicts tyo unblcok merge/squash

All review conversations are addressed:

• The anyOf enforcement P2 issue was fixed in e52f3f2 (already merged into this branch)
• No merge conflicts — branch is up to date with main (merge commit a75c6f7)
• All CI checks pass (compliance, governance, PR checks, ChittyConnect CI all green)
• 437/437 tests pass locally

The PR is ready to merge/squash.