PR67 CI — type-safe ambient namespace check

[LogicDuke]

Summary

Stacked child of PR #67 (rebuild/d3-clean-network-policy, exact parent head 5ac18be70be10d40ca4610b3bc826e81335e0435). Child head: 7f8f4119739adcbdb1d5800a82c7374b0269a6fd.

Fixes the exact-head CI failure of PR #67 only: TS2352 in tests/cockpit-host/support/d3-network-policy.ts(443,19) (Conversion of type 'Statement' to type 'Declaration').

Change

One changed file: tests/cockpit-host/support/d3-network-policy.ts (+3 / −3).

• isAmbient parameter widened from ts.Declaration to ts.Node (the function only ever walked its argument as a ts.Node).
• The invalid statement as ts.Declaration cast in isInstantiatedNamespace is replaced by statement.

Semantic behavior is preserved: the runtime-shadow probes (instantiated namespace fetch/WebSocket, runtime import = require, exported runtime import alias) remain ALLOW; ambient, type-only namespace, type-only import-equals and private type-alias namespace controls remain DENY. No other D3 logic changed.

Local validation

typecheck, focused D3 tests (438 passed), purity (319 passed / 8 skipped), lint, build and git diff --check all green locally.

Review status

Codex independently reviewed the repair substantially before its workspace credits were exhausted. The Commander explicitly waived only the unfinished final Codex POST/verdict formatting; all other gates remain in force.

This PR must remain DRAFT pending exact-head CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JPfL76suEiud2qfmrgUURL

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 9fb89211-ffa6-43c1-9133-15d9e102f6aa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[LogicDuke]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[LogicDuke]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[LogicDuke]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T19:06:06.815612Z	7f8f411	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 7f8f411973

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".