Merge branch 'main' into dependabot/cargo/criterion-0.8.2

Author: hyperpolymath

.github/copilot/coding-agent.yml

@@ -0,0 +1,6 @@
+mcp_servers:
+  boj-server:
+    command: npx
+    args: ["-y", "@hyperpolymath/boj-server@latest"]
+    env:
+      BOJ_URL: http://localhost:7700

.github/workflows/chapel-ci.yml

@@ -27,6 +27,17 @@ concurrency:
 
 permissions: read-all
 
+# Pinned Chapel deb (Ubuntu 22.04 amd64; installs cleanly on the
+# ubuntu24 runner). SHA-256 verified against the GitHub Releases asset;
+# mismatch fails the install step. Bumped 2.3.0 -> 2.8.0 (issue #181)
+# to track sibling estate repos proven (#141) and panic-attack (#85),
+# both of which validated this URL+SHA combo against the same
+# `ubuntu-latest` runner image we use here.
+env:
+  CHAPEL_VERSION: '2.8.0'
+  CHAPEL_DEB_URL: 'https://github.com/chapel-lang/chapel/releases/download/2.8.0/chapel-2.8.0-1.ubuntu22.amd64.deb'
+  CHAPEL_DEB_SHA256: '944a454b8a791f344312fcd261b562871159b74f5ef41d81e11833eb21d85f60'
+
 jobs:
   # Job 1: Compile Chapel .chpl files into a static library.
   #
@@ -35,30 +46,35 @@ jobs:
   # compiling, the workflow fails.
   #
   # Why --static and not --dynamic:
-  #   The official apt deb (chapel-2.3.0-1.ubuntu24.amd64.deb) ships only
-  #   the CHPL_LIB_PIC=none runtime variant. Building a shared library
-  #   requires CHPL_LIB_PIC=pic runtime objects which are not in the
-  #   package; the linker rejects the non-PIC `libchpl.a` with
+  #   The official apt deb (chapel-${CHAPEL_VERSION}-1.ubuntu22.amd64.deb)
+  #   ships only the CHPL_LIB_PIC=none runtime variant. Building a shared
+  #   library requires CHPL_LIB_PIC=pic runtime objects which are not in
+  #   the package; the linker rejects the non-PIC `libchpl.a` with
   #   `relocation R_X86_64_TPOFF32 ... can not be used when making a
   #   shared object`. Until the CI image ships a PIC-enabled runtime
-  #   (or we adopt a from-source Chapel build), the metalayer is
+  #   (or we adopt a from-source Chapel build via the
+  #   `chapel-pic-from-source` Justfile recipe), the metalayer is
   #   distributed as `libechidna_chapel.a` and the Zig FFI links it
   #   statically.
   chapel-build:
     name: Compile Chapel Metalayer
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Install Chapel
+      - name: Install Chapel ${{ env.CHAPEL_VERSION }} (SHA-pinned .deb)
         run: |
-          # Install Chapel from official apt repository.
-          # SHA256 of the deb is pinned for supply-chain integrity; bump
-          # alongside the version tag when upgrading.
-          curl -fsSL --max-time 300 \
-            https://github.com/chapel-lang/chapel/releases/download/2.3.0/chapel-2.3.0-1.ubuntu24.amd64.deb \
-            -o /tmp/chapel.deb
-          sudo dpkg -i /tmp/chapel.deb || sudo apt-get install -f -y
+          set -euo pipefail
+          # libunwind-dev is a runtime link-time dep for chpl-built binaries
+          # on the ubuntu .deb path; sibling estate repo panic-attack (#85)
+          # established this preinstall as the working pattern, reused by
+          # proven (#141). Without it the chapel-build smoke link fails with
+          # `error while loading shared libraries: libunwind.so.8`.
+          sudo apt-get update -qq
+          sudo apt-get install -y libunwind-dev
+          curl -fsSL --max-time 300 --retry 3 -o /tmp/chapel.deb "$CHAPEL_DEB_URL"
+          echo "$CHAPEL_DEB_SHA256  /tmp/chapel.deb" | sha256sum --check
+          sudo apt-get install -y /tmp/chapel.deb
           chpl --version
 
       - name: Compile Chapel proof search library (static)
@@ -93,7 +109,7 @@ jobs:
   # `src/zig_ffi/build.zig`.
   zig-ffi:
     name: Build & Test Zig FFI Bridge
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -121,7 +137,7 @@ jobs:
   # Re-enable strict gating once #133's Chapel + FFI rehabilitation lands.
   rust-chapel-feature:
     name: Rust Build with Chapel Feature
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs: zig-ffi
     continue-on-error: true
     steps:
@@ -159,18 +175,20 @@ jobs:
   # and flip this job to strict.
   rust-chapel-real:
     name: Rust Build — Real Chapel Library (allow-fail, L2.3+ gate)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs: [chapel-build, zig-ffi]
     continue-on-error: true
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Install Chapel
+      - name: Install Chapel ${{ env.CHAPEL_VERSION }} (SHA-pinned .deb)
         run: |
-          curl -fsSL --max-time 300 \
-            https://github.com/chapel-lang/chapel/releases/download/2.3.0/chapel-2.3.0-1.ubuntu24.amd64.deb \
-            -o /tmp/chapel.deb
-          sudo dpkg -i /tmp/chapel.deb || sudo apt-get install -f -y
+          set -euo pipefail
+          sudo apt-get update -qq
+          sudo apt-get install -y libunwind-dev
+          curl -fsSL --max-time 300 --retry 3 -o /tmp/chapel.deb "$CHAPEL_DEB_URL"
+          echo "$CHAPEL_DEB_SHA256  /tmp/chapel.deb" | sha256sum --check
+          sudo apt-get install -y /tmp/chapel.deb
           chpl --version
 
       - name: Install Zig

.github/workflows/codeql.yml

@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC
 
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide

.github/workflows/mvp-smoke.yml

@@ -38,7 +38,7 @@ jobs:
         uses: Swatinem/rust-cache@65012b490220f477f20ab979e35ae732e6de4e68 # v2
 
       - name: Install just
-        uses: taiki-e/install-action@184183c2401be73c3bf42c2e61268aa5855379c1 # v2.78.1
+        uses: taiki-e/install-action@e49978b799e49ff429d162b7a30601a569ab6538 # v2.81.1
         with:
           # Governance R1 requires versioned family-tool pins
           # (just|must|trust|adjust|bust|dust|intend); bare `tool: just`

.github/workflows/scorecard-enforcer.yml

@@ -49,12 +49,12 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4
+        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
         with:
           sarif_file: results.sarif
 
       - name: Persist SARIF for downstream score-gate job
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: scorecard-results
           path: results.sarif
@@ -67,7 +67,7 @@ jobs:
       contents: read
     steps:
       - name: Download SARIF from scorecard job
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v5.0.0
         with:
           name: scorecard-results
 

.github/workflows/security-scan.yml

@@ -20,6 +20,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@ea88be7da68e07249ae7df8b948ecb8ecfb9664c # main 2026-05-20
+    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@4c8b800de1c2b95954043a42109b82b925cd30f3 # main 2026-05-20
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}

.machine_readable/6a2/STATE.a2ml

@@ -8,14 +8,46 @@ type = "state-file"
 
 [metadata]
 project = "echidna"
-version = "2.1.1"
-last-updated = "2026-05-19"
+version = "2.3.0"
+last-updated = "2026-06-02"
 status = "active"
+release-tag = "v2.3.0"
 
 [project-context]
 name = "echidna"
 completion-percentage = 100
-phase = "v1.6.0 Released — Phase 0 of comprehensive backend expansion landed"
+phase = "v2.3.0 Released — saturation+typing (#198) + GNN training wiring (#207) + dispatcher all-17-adapters (PR pending SPDX hook) + comprehensive contractile family (#214) + first owner-authorised GNN training run completed (best MRR 0.92)"
+
+[session-2026-06-02]
+description = "Major wave: 20+ PRs across echidna+echidnabot+gitbot-fleet+hyperpolymath"
+notable-pr-merges = [
+    "#176 panic-attack Critical bound (load_octads_jsonl)",
+    "#178 echo-types audit cross-doc",
+    "#179 6 SHA-pin bumps + proven manifest fix",
+    "#182 doc maxout (+wiki sync)",
+    "#183 Chapel 2.3 → 2.8 bump (ubuntu-22.04 .deb pin)",
+    "#184 v2.3.0 release reconcile (#173 Option B)",
+    "#185 mktemp swap for scripts/",
+    "#186 FFI audit §§9-11 (FLINT + Zig bridges + Zig overlay)",
+    "#188 GraphQL +3 ops (verifyProof/suggestTactics/proverStatus) closes #180",
+    "#189 nix purge per estate policy",
+    "#198 saturation+typing (corpus 4→17, 42-discipline embedding)",
+    "#199 a2ml-validate to 6bff6ec (s-expression form)",
+    "#206 wave3 CI/CD closeout (C001-C005)",
+    "#207 GNN training wiring (CorpusLoader)",
+    "#209 Palimpsest framework reference restored",
+    "#210 JSON dep fix (corpus_loader.jl)",
+    "#211 EchidnaML CUDA.version() fix + training doc skeleton",
+    "#212 training run 2026-06-02 results (MRR 0.92, 17 epochs coq, 16 lean)",
+    "#214 contractile family (5 files, 805 ins / 307 del — comprehensive A/B/D/T### error codes)",
+]
+new-issues-filed-as-trackers = [
+    "#177 panic-attack FFI follow-ups",
+    "#187 panic-attack classifications path mismatch (audits/ vs reports/audits/)",
+    "#190-197 long-tail roadmap trackers (OpenTheory/Dedukti/SPARK/AI-sketch/Cap'n Proto/Stage 5/L2.3/Verisim)",
+]
+known-blocker = "feat/corpus-dispatcher-all-17-adapters branch ready to wire 13 missing adapters into CLI dispatcher; blocked by src/rust/main.rs SPDX-FileCopyrightText hook requiring owner manual flip from 'ECHIDNA Project Team' to canonical 'Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>' before commit accepted"
+gnn-training-run = "models/neural/{best_model,final_model,gnn_ranker,checkpoint_epoch_{5,10,15}} — 952MB total; gnn_ranker production-deployable (162MB)"
 
 [expansion-roadmap]
 # 2026-04-26 — design landed; Phase 0 foundation pushed.  Goal: push prover