[vitali87]

Summary

• sqlite_graph runs a program of node batches, relationship batches and walks on an in-memory database with the engine's schema (EG_SCHEMA_SQL), and keeps a model of the graph.
• merge_nodes and merge_relationships leave the database equal to the model after every batch. They fail exactly when the model says they do (malformed property JSON, a SET that moves a node onto another node's key), and a failed batch changes nothing. The relationship count is the number of distinct matched row indexes.
• walk returns the recursive CTE's rows in its order, as the walk module documents them. path and to_json agree with those rows. parse_seeds reads back json_group_array's rendering. Graph::load reads the model's graph.

Demo

No user-visible change: fuzz targets only. Nothing in the package, CI or the wheel builds rust/cgr_graph_rs/fuzz.

Type of Change

• CI/CD or tooling

Related Issues

None.

Test plan

Run on the whole stack, since the package builds once its manifest lands in the last PR:

• Red: each property in these targets goes red under a one-line change to the library. The property's comment names the change and the input that aborts; each was run against the mutated library, and the property it documents is the one that fired.
• Green: the unmutated library runs each target with no abort, for 10 minutes from the seed corpus after the shorter runs that built it.
• Negative tests: every check here is a negative test by construction. It aborts on output the library must not produce, and its mutant shows the abort happens.
• Coverage: a minimized seed corpus runs every API call and every property check in each target (cargo fuzz coverage).
• cargo +nightly-2025-07-16 check --bins passes, as well as the current nightly.

Files changed

• rust/cgr_graph_rs/fuzz/fuzz_targets/sqlite_graph.rs

Diff stats

+710 additions, -0 deletions (710 LOC)

Dependencies

This PR depends on: pr-2

Dependency graph

Merge in this order:

pr-1: test(graph-rs): add the fuzz input decoder and the Cypher and JSON fuzz targets
└── pr-2: test(graph-rs): add the graph procedures fuzz target
    └── pr-3: test(graph-rs): add the bulk writer and walk fuzz target  <-- this PR
        └── pr-4: test(graph-rs): add the fuzz package manifest

Summary by CodeRabbit

• Tests
  • Added automated coverage for SQLite-backed graph operations, including node and relationship batches, graph walks, properties, version tracking, ordering, adjacency, and JSON output.
  • Tests also verify that invalid or conflicting batch operations leave graph state unchanged.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: vitali87/code-graph-rag
• Branch: pr-split/claude-cgr-graph-rs-fuzz/pr-3
• File: .coderabbit.yaml
• Commit: e23ecc6
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Advanced
• Run ID: e369448d-bcff-4100-a3eb-20a36861a4aa

Commits

Reviewing files that changed from the base of the PR and between 2869e6d and e23ecc6.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: vitali87/code-graph-rag
• Branch: pr-split/claude-cgr-graph-rs-fuzz/pr-3
• File: .coderabbit.yaml
• Commit: afc7b93
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Advanced
• Run ID: 713352b3-9656-419f-b165-ba4b61e2057a

Commits

Reviewing files that changed from the base of the PR and between 2e1b11c and afc7b93.

Files selected for processing: 1

• rust/cgr_graph_rs/fuzz/fuzz_targets/sqlite_graph.rs

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 5 remain after this review.

Walkthrough

The pull request adds a Rust fuzz target for SQLite graph operations. It generates node and relationship batches, compares database results with a graph model, and checks loaded graph ordering, adjacency, walk results, and JSON output.

Changes: SQLite graph fuzzing

Layer / File(s)	Summary
Generate and model graph batches rust/cgr_graph_rs/fuzz/fuzz_targets/sqlite_graph.rs	The target generates node and relationship batches, models expected outcomes, and updates its model when operations succeed. It checks model state after each operation.
Check persisted graph state rust/cgr_graph_rs/fuzz/fuzz_targets/sqlite_graph.rs	The target compares ordered database rows, properties, merge keys, graph version, and loaded graph ordering and adjacency with the model.
Check walk results rust/cgr_graph_rs/fuzz/fuzz_targets/sqlite_graph.rs	The target checks seed parsing and rendering, bounded walk rows and paths, JSON output, and modeled traversal order.

Priority: Low

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Other

Suggested reviewers: claude

Merge Risk: Minimal · previous review afc7b

No concrete issue remains that would prevent merging this fuzz target after normal checks.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly describes the addition of the bulk writer and walk fuzz target and follows Conventional Commits format.
Description check		The description is mostly complete. It includes the summary, demo statement, change type, related issues, detailed test plan, changed files, dependencies, and dependency order. The template checklist …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description is mostly complete. It includes the summary, demo statement, change type, related issues, detailed test plan, changed files, dependencies, and dependency order. The template checklist is omitted, but the main required change and validation information are present.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T23:18:28.662939Z	afc7b93	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[greptile-apps]

Confidence Score: 5/5

[Low impact] Appears safe to merge as part of the stack, with PR #3445 providing the fuzz package manifest.

Summary

Adds sqlite_graph, a fuzz target that compares bulk writes and graph walks against a small in-memory model.

• Fuzz inputs check bulk graph writes against a model.
• Fuzz walks are checked against expected rows and paths.
• The fuzz target checks loaded graphs against its model.

_{Reviews (1) · Last reviewed commit: "test(graph-rs): add the bulk writer and ..." · Reviewed by Greptile}

[vitali87]

CI Ran At Head failed on 2869e6d for a reason outside this PR (fixed by re-run)

The job's first gh API call got HTTP 403 API rate limit exceeded for installation (request ID 2440:2D7663:1EDEADF:658470F:6AE0F5D4, 19:04:52 UTC). It never reached the check. The cause was the Actions backlog of about 85 queued runs draining at once and using up the token's hourly quota. #3445's CodeQL upload hit the same limit five minutes earlier. No code fix applies.

Update: once the backlog cleared, I re-ran the failed job once at 20:02 UTC and it passed (attempt 2). CI, Rust Wheels and every other check on 2869e6d are green.

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud