Cora Review false positives: in-place mutation, error paths, and pre-existing code

[ajianaz]

Cora Review false positives: in-place mutation, error paths, and pre-existing issues

Problem

During PR reviews on codecoradev/uteke, Cora Review repeatedly produces false positives that — when SARIF is uploaded to GitHub Code Scanning — create blocking check-run failures (CodeCora: fail) on PRs where all 12 GA checks pass and the code is correct.

Three distinct false-positive patterns have been observed across 2 PRs (PR #909, PR #911).

Observed Patterns

Pattern 1: In-place mutation not understood (PR #911, 2 alerts)

Code:

Some(Ok(mut results)) => {
    results.retain(|r| { /* temporal filter */ });
    // Both paths below use the filtered `results`
    if api_version == Some(ApiVersion::V1) {
        let v1_results: Vec<_> = results.iter().map(to_v1_flat).collect();
        // ...
    } else {
        ctx.ok_response_for(req, &results)
    }
}

Cora reported:

"The temporal range post-filter is applied inside the Some(Ok(mut results)) arm before the if api_version == Some(ApiVersion::V1) check. However, the v1 path constructs v1_results..."

Reality: Vec::retain() mutates results in-place. Both the v1 and v2 branches read from the already-filtered results. The analysis failed to track that retain is a side-effecting mutation, not a pure function that returns a new collection.

Pattern 2: Error path treated as unprotected (PR #911, 1 alert)

Code:

match recall_result {
    Ok(mut results) => {
        // temporal filter applied here ✓
    }
    Err(e) => {
        return ctx.error_response_for(req, 500, "Internal server error")
    }
}

Cora reported:

"The temporal post-filter is only applied in the Some(Ok(mut results)) and Ok(mut results) arms. However, when unified_result is None and recall_result is..."

Reality: The Err path returns a 500 error response. Temporal filtering is irrelevant on an error path — no results are returned.

Pattern 3: Pre-existing code flagged as new (PR #909, 1 alert)

Code: let _ = (entity_filter, category_filter); — existed in the codebase before the PR diff.

Cora reported: Flagged as a new issue introduced by the PR.

Reality: The line was pre-existing. The diff scope was too wide (probably re-indentation or nearby changes caused it to appear in the diff).

Root Cause Analysis

Pattern	Root Cause
#1 In-place mutation	LLM-based analysis (gpt-4o-mini) does not perform Rust borrow/alias tracking. retain() is not recognized as a mutating method.
#2 Error path	No path sensitivity — the analysis does not distinguish happy path vs error/early-return path.
#3 Pre-existing	Diff scope too wide — changes in surrounding lines cause unchanged code to appear in diff.

Impact

• Merge blocked: CodeCora check-run reports fail with error-level annotations, which is a required status check in branch protection rules.
• Developer friction: Must manually verify each alert as false positive, adding review overhead.
• Trust erosion: Repeated false positives reduce confidence in Cora Review's true positive findings.

Proposed Improvements

Short-term (config-level)

1. Make SARIF upload non-blocking by default — add fail-on-error input to cora-review-action (default: false). When false, SARIF errors are posted as warnings, not blocking check-runs.
2. Filter pre-existing issues — compare diff lines against the base branch. If a flagged line was not actually changed (only re-indented/reformatted), suppress it.

Medium-term (analysis-level)

3. Rust mutation awareness — add a deterministic rule or LLM prompt enhancement that recognizes common in-place mutation patterns: retain(), append(), retain_mut(), splice(), dedup(), sort().
4. Path sensitivity — teach the analysis that Err / early-return paths don't need the same post-conditions as happy paths.

Long-term (engine-level)

5. Confidence scoring — attach a confidence score to each finding. Low-confidence findings are posted as note level in SARIF (not error), preventing them from blocking merges.
6. Feedback loop — allow "Dismiss" on SARIF annotations that records the dismissal as training signal for future reviews.

Environment

• Cora Code: v0.13.0 (installed via cora-review-action)
• Model: gpt-4o-mini (default)
• Action: cora-review-action with upload-sarif: 'true', severity: 'major'
• Target repo: codecoradev/uteke (Rust workspace)