diff --git a/Cargo.lock b/Cargo.lock index 1579b294..a80712dd 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -154,16 +154,7 @@ dependencies = [ [[package]] name = "thiserror-impl" -version = "2.0.17" Check warning - -Code scanning / Semgrep OSS - -Semgrep Finding: ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode - -Warning -'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'. -Show more details - +version = "2.0.17" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913" dependencies = [ diff --git a/ECOSYSTEM.scm b/ECOSYSTEM.scm index 5128535e..423b4f66 100644 --- a/ECOSYSTEM.scm +++ b/ECOSYSTEM.scm @@ -1,20 +1,33 @@ ;; SPDX-License-Identifier: AGPL-3.0-or-later ;; SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell -;; ECOSYSTEM.scm — template-repo +;; ECOSYSTEM.scm — Ephapax (ecosystem (version "1.0.0") - (name "template-repo") - (type "project") - (purpose "Project in the hyperpolymath ecosystem") + (name "ephapax") + (type "programming-language") + (purpose "Linear type system for safe memory management targeting WebAssembly") (position-in-ecosystem - "Part of hyperpolymath ecosystem. Follows RSR guidelines.") + "Core research language in the hyperpolymath ecosystem demonstrating linear types and region-based memory management. Follows RSR Gold guidelines.") (related-projects (project (name "rhodium-standard-repositories") (url "https://github.com/hyperpolymath/rhodium-standard-repositories") - (relationship "standard"))) + (relationship "standard")) + (project (name "linear-types-research") + (relationship "research-foundation")) + (project (name "wasm-ecosystem") + (relationship "target-platform"))) - (what-this-is "Project in the hyperpolymath ecosystem") - (what-this-is-not "- NOT exempt from RSR compliance")) + (what-this-is + "A research programming language exploring: + - Linear types for memory safety without garbage collection + - Region-based memory management for deterministic deallocation + - WebAssembly compilation for safe, portable execution + - Formal verification of type system soundness via Coq proofs") + + (what-this-is-not + "- NOT a general-purpose production language (yet) + - NOT exempt from RSR compliance + - NOT a garbage-collected language")) diff --git a/META.scm b/META.scm index 136c02a1..02489cd4 100644 --- a/META.scm +++ b/META.scm @@ -1,8 +1,8 @@ ;; SPDX-License-Identifier: AGPL-3.0-or-later ;; SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell -;;; META.scm — template-repo +;;; META.scm — Ephapax -(define-module (template-repo meta) +(define-module (ephapax meta) #:export (architecture-decisions development-practices design-rationale)) (define architecture-decisions @@ -10,15 +10,40 @@ (title . "RSR Compliance") (status . "accepted") (date . "2025-12-15") - (context . "Project in the hyperpolymath ecosystem") + (context . "Linear type system for safe memory management targeting WebAssembly") (decision . "Follow Rhodium Standard Repository guidelines") - (consequences . ("RSR Gold target" "SHA-pinned actions" "SPDX headers" "Multi-platform CI"))))) + (consequences . ("RSR Gold target" "SHA-pinned actions" "SPDX headers" "Multi-platform CI"))) + (adr-002 + (title . "Formal Verification with Coq") + (status . "accepted") + (date . "2025-12-17") + (context . "Type system correctness is critical for memory safety guarantees") + (decision . "Mechanize type system proofs in Coq") + (consequences . ("Type safety proven" "Progress and preservation theorems" "Coq 8.18+ dependency"))) + (adr-003 + (title . "WebAssembly Target") + (status . "accepted") + (date . "2025-12-17") + (context . "Need portable, sandboxed execution environment") + (decision . "Target WebAssembly as primary backend") + (consequences . ("Browser compatibility" "WASI support" "Region-based memory via linear memory"))))) (define development-practices - '((code-style (languages . ("unknown")) (formatter . "auto-detect") (linter . "auto-detect")) - (security (sast . "CodeQL") (credentials . "env vars only")) - (testing (coverage-minimum . 70)) + '((code-style + (languages . ("rust" "coq" "scheme")) + (formatter . "rustfmt") + (linter . "clippy")) + (security + (sast . "CodeQL") + (credentials . "env vars only") + (dependency-scanning . "dependabot")) + (testing + (coverage-minimum . 70) + (formal-proofs . "coq")) (versioning (scheme . "SemVer 2.0.0")))) (define design-rationale - '((why-rsr "RSR ensures consistency, security, and maintainability."))) + '((why-rsr "RSR ensures consistency, security, and maintainability.") + (why-linear-types "Linear types guarantee each value is used exactly once, enabling deterministic memory management without garbage collection.") + (why-regions "Regions provide scoped memory management, enabling safe bulk deallocation without runtime overhead.") + (why-wasm "WebAssembly provides a safe, portable, sandboxed execution environment with predictable performance."))) diff --git a/SECURITY.md b/SECURITY.md index 7dd7b29e..fc90a934 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,23 +1,5 @@ # Security Policy - - We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions. ## Table of Contents @@ -40,7 +22,7 @@ We take security seriously. We appreciate your efforts to responsibly disclose v The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature: -1. Navigate to [Report a Vulnerability](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) +1. Navigate to [Report a Vulnerability](https://github.com/hyperpolymath/ephapax/security/advisories/new) 2. Click **"Report a vulnerability"** 3. Complete the form with as much detail as possible 4. Submit — we'll receive a private notification @@ -52,28 +34,14 @@ This method ensures: - Coordinated disclosure tooling - Automatic credit when the advisory is published -### Alternative: Encrypted Email - -If you cannot use GitHub Security Advisories, you may email us directly: - -| | | -|---|---| -| **Email** | {{SECURITY_EMAIL}} | -| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) | -| **Fingerprint** | `{{PGP_FINGERPRINT}}` | +### Alternative: GitHub Issues (Non-Sensitive) -```bash -# Import our PGP key -curl -sSL {{PGP_KEY_URL}} | gpg --import +For non-sensitive security concerns (e.g., dependency updates, security best practices): -# Verify fingerprint -gpg --fingerprint {{SECURITY_EMAIL}} - -# Encrypt your report -gpg --armor --encrypt --recipient {{SECURITY_EMAIL}} report.txt -``` +- Open an issue at [GitHub Issues](https://github.com/hyperpolymath/ephapax/issues) +- Use the "security" label -> **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media. +> **⚠️ Important:** Do not report sensitive security vulnerabilities through public GitHub issues, pull requests, discussions, or social media. --- @@ -203,7 +171,7 @@ If we cannot reach agreement on disclosure timing, we default to 90 days from yo The following are within scope for security research: -- This repository (`{{OWNER}}/{{REPO}}`) and all its code +- This repository (`hyperpolymath/ephapax`) and all its code - Official releases and packages published from this repository - Documentation that could lead to security issues - Build and deployment configurations in this repository @@ -226,31 +194,24 @@ The following are **not** in scope: We're particularly interested in: - Remote code execution -- SQL injection, command injection, code injection -- Authentication/authorisation bypass -- Cross-site scripting (XSS) and cross-site request forgery (CSRF) -- Server-side request forgery (SSRF) -- Path traversal / local file inclusion -- Information disclosure (credentials, PII, secrets) -- Cryptographic weaknesses -- Deserialisation vulnerabilities +- Command injection, code injection - Memory safety issues (buffer overflows, use-after-free, etc.) +- Type system soundness bugs (violations of linear type guarantees) +- WASM sandbox escapes +- Cryptographic weaknesses +- Information disclosure (credentials, PII, secrets) - Supply chain vulnerabilities (dependency confusion, etc.) -- Significant logic flaws +- Significant logic flaws in the type checker ### Non-Qualifying Issues The following generally do not qualify as security vulnerabilities: - Missing security headers on non-sensitive pages -- Clickjacking on pages without sensitive actions -- Self-XSS (requires victim to paste code) -- Missing rate limiting (unless it enables a specific attack) -- Username/email enumeration (unless high-risk context) -- Missing cookie flags on non-sensitive cookies - Software version disclosure - Verbose error messages (unless exposing secrets) - Best practice deviations without demonstrable impact +- Performance issues (unless enabling DoS) --- @@ -322,7 +283,7 @@ Recognition includes: To stay informed about security updates: - **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts" -- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) +- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/hyperpolymath/ephapax/security/advisories) - **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md) ### Update Policy @@ -335,8 +296,6 @@ To stay informed about security updates: ### Supported Versions - - | Version | Supported | Notes | |---------|-----------|-------| | `main` branch | ✅ Yes | Latest development | @@ -348,7 +307,7 @@ To stay informed about security updates: ## Security Best Practices -When using {{PROJECT_NAME}}, we recommend: +When using Ephapax, we recommend: ### General @@ -370,8 +329,7 @@ When using {{PROJECT_NAME}}, we recommend: ## Additional Resources -- [Our PGP Public Key]({{PGP_KEY_URL}}) -- [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) +- [Security Advisories](https://github.com/hyperpolymath/ephapax/security/advisories) - [Changelog](CHANGELOG.md) - [Contributing Guidelines](CONTRIBUTING.md) - [CVE Database](https://cve.mitre.org/) @@ -383,9 +341,9 @@ When using {{PROJECT_NAME}}, we recommend: | Purpose | Contact | |---------|---------| -| **Security issues** | [Report via GitHub](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) or {{SECURITY_EMAIL}} | -| **General questions** | [GitHub Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) | -| **Other enquiries** | See [README](README.md) for contact information | +| **Security issues** | [Report via GitHub](https://github.com/hyperpolymath/ephapax/security/advisories/new) | +| **General questions** | [GitHub Discussions](https://github.com/hyperpolymath/ephapax/discussions) | +| **Other enquiries** | See [README](README.adoc) for contact information | --- @@ -399,8 +357,8 @@ This security policy may be updated from time to time. Significant changes will --- -*Thank you for helping keep {{PROJECT_NAME}} and its users safe.* 🛡️ +*Thank you for helping keep Ephapax and its users safe.* --- -Last updated: {{CURRENT_YEAR}} · Policy version: 1.0.0 +Last updated: 2025 · Policy version: 1.0.0 diff --git a/STATE.scm b/STATE.scm index c6fbcf18..092fea42 100644 --- a/STATE.scm +++ b/STATE.scm @@ -10,13 +10,13 @@ (define current-position '((phase . "v0.1 - Foundation") - (overall-completion . 35) + (overall-completion . 40) (components ((formal-semantics ((status . "complete") (completion . 100))) (type-system-design ((status . "complete") (completion . 100))) (syntax-crate ((status . "complete") (completion . 100))) (typing-crate ((status . "in-progress") (completion . 60))) - (wasm-codegen ((status . "in-progress") (completion . 40))) + (wasm-codegen ((status . "in-progress") (completion . 50))) (runtime ((status . "in-progress") (completion . 50))) (lexer ((status . "planned") (completion . 0))) (parser ((status . "planned") (completion . 0))) @@ -26,31 +26,111 @@ (define blockers-and-issues '((critical ()) (high-priority - (("Complete lexer implementation" . "Required for parsing") - ("Complete parser implementation" . "Required for type checking"))))) + (("Complete lexer implementation" . "Required for parsing Ephapax source files") + ("Complete parser implementation" . "Required for building AST from source"))) + (resolved + (("Cargo.lock corrupted" . "Fixed: Regenerated lock file") + ("SECURITY.md template placeholders" . "Fixed: Filled in project-specific values") + ("SCM files using template-repo name" . "Fixed: Updated to ephapax"))))) (define critical-next-actions '((immediate - (("Implement lexer with logos" . high) - ("Implement parser with lalrpop or chumsky" . high))) + (("Implement lexer with logos crate" . high) + ("Implement parser with chumsky crate" . high))) (this-week (("Complete type checker implementation" . high) - ("Add WASM validation tests" . medium))) + ("Add WASM validation tests" . medium) + ("Add property-based tests with proptest" . medium))) (this-month - (("Implement REPL" . medium) + (("Implement REPL with wasmtime" . medium) ("Begin standard library" . medium) - ("Property-based testing" . medium))))) + ("Add fuzzing infrastructure" . low))))) + +(define roadmap + '((phase-1 + (name . "Foundation") + (status . "in-progress") + (completion . 40) + (target . "Q1 2026") + (components + ("Project structure" "CI/CD" "Documentation" "Formal semantics" "Rust skeleton"))) + (phase-2 + (name . "Language Frontend") + (status . "planned") + (completion . 0) + (target . "Q2 2026") + (components + ("Lexer (logos)" "Parser (chumsky)" "Error reporting (ariadne)"))) + (phase-3 + (name . "Type System") + (status . "planned") + (completion . 0) + (target . "Q2-Q3 2026") + (components + ("Linear context tracking" "Region checking" "Borrow checking" "Type inference"))) + (phase-4 + (name . "Code Generation") + (status . "planned") + (completion . 0) + (target . "Q3 2026") + (components + ("IR design" "WASM backend completion" "Memory management"))) + (phase-5 + (name . "Developer Tools") + (status . "planned") + (completion . 0) + (target . "Q4 2026") + (components + ("REPL" "CLI" "LSP server" "Interpreter"))) + (phase-6 + (name . "Standard Library") + (status . "planned") + (completion . 0) + (target . "2026-2027") + (components + ("Core types" "String operations" "Collections" "I/O" "Memory utilities"))) + (phase-7 + (name . "Frameworks") + (status . "planned") + (completion . 0) + (target . "2027") + (components + ("Web framework" "CLI framework" "Testing framework" "Serialization"))) + (phase-8 + (name . "Advanced Features") + (status . "research") + (completion . 0) + (target . "2027+") + (components + ("Typestate" "Fractional permissions" "Concurrency" "Metaprogramming"))))) + +(define milestones + '((v0.1.0 (target . "Q1 2026") (features . "Foundation complete")) + (v0.2.0 (target . "Q2 2026") (features . "Lexer + Parser")) + (v0.3.0 (target . "Q3 2026") (features . "Type checker complete")) + (v0.4.0 (target . "Q4 2026") (features . "WASM codegen complete")) + (v0.5.0 (target . "Q4 2026") (features . "REPL + basic stdlib")) + (v0.6.0 (target . "Q1 2027") (features . "LSP support")) + (v0.7.0 (target . "Q2 2027") (features . "Core stdlib complete")) + (v0.8.0 (target . "Q3 2027") (features . "Collections + I/O")) + (v0.9.0 (target . "Q4 2027") (features . "Frameworks")) + (v1.0.0 (target . "2028") (features . "Production ready")))) (define session-history '((snapshots ((date . "2025-12-17") (session . "initial-setup") - (notes . "Project structure created, Coq proofs, Rust crates, spec document"))))) + (notes . "Project structure created, Coq proofs, Rust crates, spec document")) + ((date . "2025-12-17") + (session . "scm-security-review") + (notes . "Fixed Cargo.lock corruption, updated SCM files, filled SECURITY.md template, fixed dead code warnings"))))) (define state-summary '((project . "ephapax") (tagline . "Linear types for safe memory management") - (completion . 35) + (completion . 40) (blockers . 0) (updated . "2025-12-17") - (next-milestone . "v0.2 - Lexer & Parser"))) + (next-milestone . "v0.2 - Lexer & Parser") + (tests-passing . #t) + (build-clean . #t))) diff --git a/src/ephapax-wasm/src/lib.rs b/src/ephapax-wasm/src/lib.rs index b854a5dc..82b897f9 100644 --- a/src/ephapax-wasm/src/lib.rs +++ b/src/ephapax-wasm/src/lib.rs @@ -43,9 +43,11 @@ pub const MAX_PAGES: u64 = 256; // 16MB max /// Code generator state pub struct Codegen { - /// Current bump pointer for allocations + /// Current bump pointer for allocations (reserved for future interpreter use) + #[allow(dead_code)] bump_ptr: u32, - /// Region stack for tracking active regions + /// Region stack for tracking active regions (reserved for future interpreter use) + #[allow(dead_code)] region_stack: Vec, /// Generated WASM module module: Module,