Merge branch 'main' into dependabot/cargo/nom-8.0.0

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

Author: hyperpolymath

.github/workflows/chapel-ci.yml

@@ -27,6 +27,17 @@ concurrency:
 
 permissions: read-all
 
+# Pinned Chapel deb (Ubuntu 22.04 amd64; installs cleanly on the
+# ubuntu24 runner). SHA-256 verified against the GitHub Releases asset;
+# mismatch fails the install step. Bumped 2.3.0 -> 2.8.0 (issue #181)
+# to track sibling estate repos proven (#141) and panic-attack (#85),
+# both of which validated this URL+SHA combo against the same
+# `ubuntu-latest` runner image we use here.
+env:
+  CHAPEL_VERSION: '2.8.0'
+  CHAPEL_DEB_URL: 'https://github.com/chapel-lang/chapel/releases/download/2.8.0/chapel-2.8.0-1.ubuntu22.amd64.deb'
+  CHAPEL_DEB_SHA256: '944a454b8a791f344312fcd261b562871159b74f5ef41d81e11833eb21d85f60'
+
 jobs:
   # Job 1: Compile Chapel .chpl files into a static library.
   #
@@ -35,30 +46,35 @@ jobs:
   # compiling, the workflow fails.
   #
   # Why --static and not --dynamic:
-  #   The official apt deb (chapel-2.3.0-1.ubuntu24.amd64.deb) ships only
-  #   the CHPL_LIB_PIC=none runtime variant. Building a shared library
-  #   requires CHPL_LIB_PIC=pic runtime objects which are not in the
-  #   package; the linker rejects the non-PIC `libchpl.a` with
+  #   The official apt deb (chapel-${CHAPEL_VERSION}-1.ubuntu22.amd64.deb)
+  #   ships only the CHPL_LIB_PIC=none runtime variant. Building a shared
+  #   library requires CHPL_LIB_PIC=pic runtime objects which are not in
+  #   the package; the linker rejects the non-PIC `libchpl.a` with
   #   `relocation R_X86_64_TPOFF32 ... can not be used when making a
   #   shared object`. Until the CI image ships a PIC-enabled runtime
-  #   (or we adopt a from-source Chapel build), the metalayer is
+  #   (or we adopt a from-source Chapel build via the
+  #   `chapel-pic-from-source` Justfile recipe), the metalayer is
   #   distributed as `libechidna_chapel.a` and the Zig FFI links it
   #   statically.
   chapel-build:
     name: Compile Chapel Metalayer
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Install Chapel
+      - name: Install Chapel ${{ env.CHAPEL_VERSION }} (SHA-pinned .deb)
         run: |
-          # Install Chapel from official apt repository.
-          # SHA256 of the deb is pinned for supply-chain integrity; bump
-          # alongside the version tag when upgrading.
-          curl -fsSL --max-time 300 \
-            https://github.com/chapel-lang/chapel/releases/download/2.3.0/chapel-2.3.0-1.ubuntu24.amd64.deb \
-            -o /tmp/chapel.deb
-          sudo dpkg -i /tmp/chapel.deb || sudo apt-get install -f -y
+          set -euo pipefail
+          # libunwind-dev is a runtime link-time dep for chpl-built binaries
+          # on the ubuntu .deb path; sibling estate repo panic-attack (#85)
+          # established this preinstall as the working pattern, reused by
+          # proven (#141). Without it the chapel-build smoke link fails with
+          # `error while loading shared libraries: libunwind.so.8`.
+          sudo apt-get update -qq
+          sudo apt-get install -y libunwind-dev
+          curl -fsSL --max-time 300 --retry 3 -o /tmp/chapel.deb "$CHAPEL_DEB_URL"
+          echo "$CHAPEL_DEB_SHA256  /tmp/chapel.deb" | sha256sum --check
+          sudo apt-get install -y /tmp/chapel.deb
           chpl --version
 
       - name: Compile Chapel proof search library (static)
@@ -93,7 +109,7 @@ jobs:
   # `src/zig_ffi/build.zig`.
   zig-ffi:
     name: Build & Test Zig FFI Bridge
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -121,7 +137,7 @@ jobs:
   # Re-enable strict gating once #133's Chapel + FFI rehabilitation lands.
   rust-chapel-feature:
     name: Rust Build with Chapel Feature
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs: zig-ffi
     continue-on-error: true
     steps:
@@ -159,18 +175,20 @@ jobs:
   # and flip this job to strict.
   rust-chapel-real:
     name: Rust Build — Real Chapel Library (allow-fail, L2.3+ gate)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs: [chapel-build, zig-ffi]
     continue-on-error: true
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Install Chapel
+      - name: Install Chapel ${{ env.CHAPEL_VERSION }} (SHA-pinned .deb)
         run: |
-          curl -fsSL --max-time 300 \
-            https://github.com/chapel-lang/chapel/releases/download/2.3.0/chapel-2.3.0-1.ubuntu24.amd64.deb \
-            -o /tmp/chapel.deb
-          sudo dpkg -i /tmp/chapel.deb || sudo apt-get install -f -y
+          set -euo pipefail
+          sudo apt-get update -qq
+          sudo apt-get install -y libunwind-dev
+          curl -fsSL --max-time 300 --retry 3 -o /tmp/chapel.deb "$CHAPEL_DEB_URL"
+          echo "$CHAPEL_DEB_SHA256  /tmp/chapel.deb" | sha256sum --check
+          sudo apt-get install -y /tmp/chapel.deb
           chpl --version
 
       - name: Install Zig

.github/workflows/codeql.yml

@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC
 
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
@@ -23,6 +23,7 @@ permissions:
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     permissions:
       contents: read
       security-events: write

.github/workflows/hypatia-scan.yml

@@ -25,5 +25,6 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4f07382468f045cdaf75e0bbdb1886a0579d83e3 # main 2026-05-30 (erlef/setup-beam v1.24.0 consolidation #289)
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242
+    timeout-minutes: 10
     secrets: inherit

.machine_readable/6a2/STATE.a2ml

@@ -8,14 +8,46 @@ type = "state-file"
 
 [metadata]
 project = "echidna"
-version = "2.1.1"
-last-updated = "2026-05-19"
+version = "2.3.0"
+last-updated = "2026-06-02"
 status = "active"
+release-tag = "v2.3.0"
 
 [project-context]
 name = "echidna"
 completion-percentage = 100
-phase = "v1.6.0 Released — Phase 0 of comprehensive backend expansion landed"
+phase = "v2.3.0 Released — saturation+typing (#198) + GNN training wiring (#207) + dispatcher all-17-adapters (PR pending SPDX hook) + comprehensive contractile family (#214) + first owner-authorised GNN training run completed (best MRR 0.92)"
+
+[session-2026-06-02]
+description = "Major wave: 20+ PRs across echidna+echidnabot+gitbot-fleet+hyperpolymath"
+notable-pr-merges = [
+    "#176 panic-attack Critical bound (load_octads_jsonl)",
+    "#178 echo-types audit cross-doc",
+    "#179 6 SHA-pin bumps + proven manifest fix",
+    "#182 doc maxout (+wiki sync)",
+    "#183 Chapel 2.3 → 2.8 bump (ubuntu-22.04 .deb pin)",
+    "#184 v2.3.0 release reconcile (#173 Option B)",
+    "#185 mktemp swap for scripts/",
+    "#186 FFI audit §§9-11 (FLINT + Zig bridges + Zig overlay)",
+    "#188 GraphQL +3 ops (verifyProof/suggestTactics/proverStatus) closes #180",
+    "#189 nix purge per estate policy",
+    "#198 saturation+typing (corpus 4→17, 42-discipline embedding)",
+    "#199 a2ml-validate to 6bff6ec (s-expression form)",
+    "#206 wave3 CI/CD closeout (C001-C005)",
+    "#207 GNN training wiring (CorpusLoader)",
+    "#209 Palimpsest framework reference restored",
+    "#210 JSON dep fix (corpus_loader.jl)",
+    "#211 EchidnaML CUDA.version() fix + training doc skeleton",
+    "#212 training run 2026-06-02 results (MRR 0.92, 17 epochs coq, 16 lean)",
+    "#214 contractile family (5 files, 805 ins / 307 del — comprehensive A/B/D/T### error codes)",
+]
+new-issues-filed-as-trackers = [
+    "#177 panic-attack FFI follow-ups",
+    "#187 panic-attack classifications path mismatch (audits/ vs reports/audits/)",
+    "#190-197 long-tail roadmap trackers (OpenTheory/Dedukti/SPARK/AI-sketch/Cap'n Proto/Stage 5/L2.3/Verisim)",
+]
+known-blocker = "feat/corpus-dispatcher-all-17-adapters branch ready to wire 13 missing adapters into CLI dispatcher; blocked by src/rust/main.rs SPDX-FileCopyrightText hook requiring owner manual flip from 'ECHIDNA Project Team' to canonical 'Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>' before commit accepted"
+gnn-training-run = "models/neural/{best_model,final_model,gnn_ranker,checkpoint_epoch_{5,10,15}} — 952MB total; gnn_ranker production-deployable (162MB)"
 
 [expansion-roadmap]
 # 2026-04-26 — design landed; Phase 0 foundation pushed.  Goal: push prover