feat(bug-filing-mcp): add the unified adapter (ABI/FFI/Adapter baseline) by hyperpolymath · Pull Request #90 · hyperpolymath/boj-server-cartridges

hyperpolymath · 2026-07-17T15:00:21Z

Summary

bug-filing-mcp shipped v0.2 (#85) without an adapter/ directory — the estate's real per-cartridge contract is ABI=Idris2, FFI=Zig, Adapter=Zig, verified against the gossamer-mcp minting template and the k9iser-mcp reference implementation. This completes the cartridge to match every other real cartridge in the registry, and documents the baseline in .claude/CLAUDE.md.

Changes

abi/BugFilingMcp/SafeBugFiling.idr: added the Exposure/exposureSatisfied transaction-gate contract, mirroring K9iserMcp.SafeK9iser exactly (same encoding, same total function) — auth.method: "none" means this cartridge's requiredExposure is Public.
ffi/bug_filing_mcp_ffi.zig: marked the five ADR-0006 symbols pub export — required for Zig 0.15's cross-module import; k9iser's FFI already does this, mine hadn't (compile error caught by the toolchain, not by inspection).
adapter/bug_filing_mcp_adapter.zig (new): single loopback listener (127.0.0.1:9391), protocol-classified (REST /invoke, SSE /sse, GraphQL /graphql, gRPC-compat /grpc/<Svc>/<Method>), transaction-gated before dispatch, funneling into the one Zig ABI. Stateless, response-passthrough, internal-only (ADR-0004 — the only public ingress is http-capability-gateway).

Schema-validation note

This PR adds or modifies one or more cartridge.json manifests.
This PR does not touch any cartridge.json.

cd tools/validate-cartridges && deno task strict run locally: 142/142 manifests passing.

Testing

idris2 --typecheck bug-filing-mcp.ipkg (0.7.0): clean.
zig build test (0.15.2): green for both ffi/ and adapter/.
Live smoke test: built the adapter binary, ran it, and curl'd all four protocol surfaces directly — each correctly dispatches to the FFI's delegation notice; unknown tool and unknown route both 404 as expected.

Refs

Extends #85 (v0.2); part of hyperpolymath/boj-server#274. Companion PR in boj-server syncs the bundled snapshot.

🤖 Generated with Claude Code

https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq

Generated by Claude Code

The estate's real per-cartridge contract is ABI=Idris2, FFI=Zig, Adapter=Zig (protocol-bridge layer) — verified against the gossamer-mcp minting template and the k9iser-mcp reference implementation. bug-filing-mcp v0.2 shipped without an adapter/ directory; this completes it to match every other real cartridge in the registry. - abi/BugFilingMcp/SafeBugFiling.idr: added the Exposure/exposureSatisfied transaction-gate contract (mirrors K9iserMcp.SafeK9iser exactly — same encoding, same total function), since auth.method: none means this cartridge's requiredExposure is Public. - ffi/bug_filing_mcp_ffi.zig: marked the five ADR-0006 symbols pub export (required for Zig 0.15's cross-module import; k9iser's FFI already does this, mine hadn't). - adapter/bug_filing_mcp_adapter.zig: single loopback listener on 9391, protocol-classified (REST /invoke, SSE /sse, GraphQL /graphql, gRPC-compat /grpc/<Svc>/<Method>), transaction-gated before dispatch, funneling into the one Zig ABI. Stateless, response-passthrough, internal-only (ADR-0004 -- the only public ingress is http-capability-gateway). Verified with the real toolchain: idris2 --typecheck clean (0.7.0); zig build test green for both ffi and adapter (0.15.2); live smoke test against the built adapter binary confirms all four protocol surfaces (REST/gRPC/ GraphQL/SSE) dispatch correctly and 404 on unknown tool/route; strict cartridge-schema validation 142/142 passing. Also documents the baseline in .claude/CLAUDE.md, grounded in verified estate facts (not assumed): the Hexadeca-Connector naming lineage in hypatia/proven-servers, descended from a retired V-lang reference in developer-ecosystem, killed by the estate-wide V-lang ban (2026-04-10). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq

@@ -0,0 +1,299 @@
+// SPDX-License-Identifier: MPL-2.0


hyperpolymath · 2026-07-17T15:01:16Z

SonarQube fails the same way as on #85: scanner bootstrap 403s before any analysis runs (Please check the property sonar.token or the environment variable SONAR_TOKEN) — the repo-wide SONAR_TOKEN is still expired/revoked. Not caused by this PR; needs the same owner-side token rotation.

Generated by Claude Code

github-actions · 2026-07-17T15:01:17Z

🔍 Hypatia Security Scan

Findings: 282 issues detected

Severity	Count
🔴 Critical	44
🟠 High	134
🟡 Medium	104

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/auth-method-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/category-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/missing-fields-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/cartridge-minter/mint.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/code-quality/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/infrastructure/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath · 2026-07-17T15:01:46Z

CI triage:

Hypatia (zig_ptr_cast, 3 occurrences in bug_filing_mcp_adapter.zig) — this is the exact same dispatch line as the mirrored reference implementation, cartridges/domains/config/k9iser-mcp/adapter/k9iser_adapter.zig:99: ffi.boj_cartridge_invoke(@ptrCast(&tnbuf), @ptrCast(&abuf), @ptrCast(out.ptr), &len). All three casts are array/slice-pointer-to-many-pointer decay of same-element-type stack buffers, required to call across the Zig↔C-ABI boundary ([*c]const u8/[*c]u8 parameters) — not a reinterpretation across incompatible types. The alert fires because the file is new to this diff, not because the pattern is new to the estate.
Hypatia bot-comment (282 findings) — pre-existing repo-wide baseline (unrelated .ts adapter files already tracked, workflow hygiene items), none introduced by this PR.
SonarQube — already noted above: repo-wide expired SONAR_TOKEN.

Generated by Claude Code

github-actions · 2026-07-17T16:17:59Z

🔍 Hypatia Security Scan

Findings: 282 issues detected

Severity	Count
🔴 Critical	44
🟠 High	134
🟡 Medium	104

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/auth-method-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/category-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/missing-fields-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/cartridge-minter/mint.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/code-quality/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/infrastructure/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

…tch call (CWE-704) Follow-up to #89 (which fixed the FFI shim's internal ptrCasts) and #90 (which shipped the adapter with the old pattern, mirrored from k9iser-mcp before that cartridge's own equivalent was cleaned up). The three @ptrCast calls at the dispatch call site were unnecessary: Zig's [*c] pointer parameters accept array/slice/scalar pointers via implicit C-pointer coercion, verified by a standalone build-obj test before touching the real file. Re-verified with the real toolchain after the edit: zig build test green; rebuilt the binary and re-ran the live smoke test (REST dispatch + 404 on unknown route) to confirm no behavioral change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq

…tch call (CWE-704) (#91)  ## Summary Follow-up to #89 (fixed the FFI shim's internal `@ptrCast`s across all 116 cartridges) and #90 (shipped bug-filing-mcp's new adapter with the old pre-#89 dispatch pattern, mirrored from k9iser-mcp before its own equivalent was cleaned up). Drops the three now-unnecessary `@ptrCast` calls at the adapter's dispatch call site — the same CWE-704 finding class, one file further down the stack. Confirmed with a standalone `zig build-obj` test before touching the real file: Zig's `[*c]` pointer parameters accept array/slice/scalar pointers via implicit C-pointer coercion, so the explicit casts were doing nothing. ## Schema-validation note - [ ] This PR adds or modifies one or more `cartridge.json` manifests. - [x] This PR does not touch any `cartridge.json`. ## Testing - `zig build test` (0.15.2): green. - Rebuilt the binary and re-ran the live smoke test (REST dispatch to `/invoke?tool=submit_feedback`, 404 on unknown route) — confirmed no behavioral change. ## Refs Follow-up to #89/#90. Part of #274. Same fix will be applied to the bundled snapshot in `boj-server`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq --- _Generated by [Claude Code](https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq)_ Co-authored-by: Claude <noreply@anthropic.com>

github-advanced-security AI found potential problems Jul 17, 2026

View reviewed changes

Comment thread cartridges/domains/development/bug-filing-mcp/adapter/bug_filing_mcp_adapter.zig

@@ -0,0 +1,299 @@

// SPDX-License-Identifier: MPL-2.0

Merge branch 'main' into claude/abi-ffi-adapter-baseline

156b97e

hyperpolymath marked this pull request as ready for review July 17, 2026 16:17

hyperpolymath merged commit d0d89f6 into main Jul 17, 2026
27 of 29 checks passed

hyperpolymath deleted the claude/abi-ffi-adapter-baseline branch July 17, 2026 16:18

hyperpolymath mentioned this pull request Jul 17, 2026

fix(bug-filing-mcp): drop unnecessary @ptrCast from the adapter dispatch call (CWE-704) #91

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(bug-filing-mcp): add the unified adapter (ABI/FFI/Adapter baseline)#90

feat(bug-filing-mcp): add the unified adapter (ABI/FFI/Adapter baseline)#90
hyperpolymath merged 2 commits into
mainfrom
claude/abi-ffi-adapter-baseline

hyperpolymath commented Jul 17, 2026

Uh oh!

hyperpolymath commented Jul 17, 2026

Uh oh!

github-actions Bot commented Jul 17, 2026

Uh oh!

hyperpolymath commented Jul 17, 2026

Uh oh!

github-actions Bot commented Jul 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

hyperpolymath commented Jul 17, 2026

Summary

Changes

Schema-validation note

Testing

Refs

Uh oh!

hyperpolymath commented Jul 17, 2026

Uh oh!

github-actions Bot commented Jul 17, 2026

🔍 Hypatia Security Scan

Uh oh!

hyperpolymath commented Jul 17, 2026

Uh oh!

github-actions Bot commented Jul 17, 2026

🔍 Hypatia Security Scan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants