Wave 1 follow-up: CORS + npm-policy CI fixes, docs/reality alignment, FFI cleanup by hyperpolymath · Pull Request #20 · hyperpolymath/gv-clade-index

hyperpolymath · 2026-06-20T18:30:17Z

Why

Follow-up to #19 (merged). Its CI surfaced issues that landed on main because the merge happened before the fixes; this PR resolves them and continues the in-repo Wave 1 hygiene that needs no external credentials.

CI fixes (the blockers on main)

🔴 Critical — wildcard CORS (CWE-942 / Hypatia js_wildcard_cors)

Replaced the hardcoded Access-Control-Allow-Origin: * with an env-configurable allowlist (CORS_ALLOW_ORIGIN), defaulting to the portal origin. CORS is applied centrally in fetch(); the request Origin is echoed only when allowlisted; no wildcard in source. +3 CORS tests.

🟥 Governance — npm-avoidant policy (standards JS-RUNTIME-POLICY)

A tracked package-lock.json is forbidden (devDependencies-only package.json is tolerated). Untracked the lockfile (gitignored), pinned devDependencies to exact versions, switched CI to npm install.

🟡 Workflow hygiene (Hypatia workflow_audit)

Added timeout-minutes to worker-ci, worker-deploy, boj-build.

Docs / reality alignment & cleanup

ROADMAP.adoc — replaced the generic template with the real 8-phase plan (mirrors STATE.a2ml).
TEST-NEEDS.md — corrected false claims (Zig FFI tests / cargo test); documents the actual Vitest suite (33 tests) + CI gating.
README.adoc — Phase 3 → In progress (~60%); Phase 4 → ReScript (per ADR-004).
src/interface/ffi/ — removed non-compiling {{project}} Zig template stubs (no FFI surface in this JS/data project); kept the RSR dirs with an explanatory README.
Filled load-bearing placeholders in .envrc and .well-known/security.txt.

Verified locally

33/33 tests pass · eslint + prettier --check clean · wrangler deploy --dry-run OK (top-level + staging) · no tracked package-lock.json.

Not in this PR (deferred, noted in the plan)

Broad placeholder sweep across build/dev-env files — many remaining {{...}} tokens live in intentional templates (k9 template-*.k9.ncl, ADR 0000-template.adoc, issue templates), so a blanket sweep is unsafe; needs a careful per-file pass.
Wiring Justfile recipes to the npm scripts (CI already calls npm directly; deferred since just isn't available here to verify).

Still needs you (external)

Add CLOUDFLARE_API_TOKEN → unlocks auto-deploy to staging.
Phase 2: stand up VeriSimDB on the VPS → live data backing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

…idant policy Follow-up fixes for CI findings on PR #19: - Security (CWE-942 / Hypatia js_wildcard_cors, critical): replace the hardcoded wildcard Access-Control-Allow-Origin with an env-configurable allowlist (CORS_ALLOW_ORIGIN), defaulting to the portal origin. CORS headers are now applied centrally in fetch(); request Origin is echoed only when allowlisted. Added 3 CORS tests (default origin, echo-allowed, never-wildcard). - Governance (npm-avoidant policy / standards JS-RUNTIME-POLICY): stop tracking worker/package-lock.json (now gitignored) and pin devDependencies to exact versions for reproducibility; CI uses `npm install` instead of `npm ci`. - Workflows: add timeout-minutes to worker-ci, worker-deploy and boj-build (Hypatia workflow_audit). Verified: 33/33 tests pass, eslint + prettier clean, wrangler dry-run OK, no tracked package-lock.json. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

…l FFI stubs In-repo Wave 1 hygiene (no external credentials needed): - ROADMAP.adoc: replace the generic template with the real 8-phase plan (mirrors .machine_readable/6a2/STATE.a2ml). - TEST-NEEDS.md: correct false claims ("Zig FFI integration tests", `cargo test`, "CRG C achieved"); document the actual Vitest suite (33 tests) + CI gating. - README.adoc: Phase 3 -> "In progress (~60%)"; Phase 4 label -> ReScript/typed-WASM (aligns with ADR-004 and the overview). - .envrc, .well-known/security.txt: fill load-bearing template placeholders. - src/interface/ffi: remove non-compiling {{project}} Zig template stubs (main.zig, build.zig, integration_test.zig) — this project has no FFI surface; keep the RSR dirs with an explanatory README (cf. PROOF-NEEDS.md). No functional Worker changes; 33/33 tests still pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

github-actions · 2026-06-20T19:30:59Z

🔍 Hypatia Security Scan

Findings: 71 issues detected

Severity	Count
🔴 Critical	1
🟠 High	11
🟡 Medium	59

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dependabot-automerge.yml",
    "type": "missing_timeout_minutes",
    "file": "dependabot-automerge.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "missing_timeout_minutes",
    "file": "instant-sync.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

… setup.sh, .envrc (#27) Addresses the actionable subset of the Hypatia advisory findings surfaced by the scanner upgrade in #26. The remaining ~7 are scanner false-positives (WF017 two-step gate, SC-013 comment stripping, SC-014 codeql substring) for an upstream fix. Docs (structural_drift SD022 x6 — stale path after #20's FFI removal): - correct `src/abi/` -> the real RSR slot `src/interface/abi/` in AI-CONVENTIONS, RSR_OUTLINE, QUICKSTART-DEV, MAINTENANCE-CHECKLIST, INTENT.contractile - replace the unfilled-template docs/developer/ABI-FFI-README.adoc (it still carried a `{{project}}` placeholder and a template-instruction line and described a non-existent FFI surface) with an honest "no FFI surface" stub pointing at the RSR placeholders and PROOF-NEEDS.md setup.sh (code_safety shell_download_then_run / CWE-494): - replace `curl ... just.systems/install.sh | bash` with a download-then-run helper (no pipe-to-shell), with opt-in JUST_VERSION pin and JUST_INSTALL_SHA256 verify; native package managers (incl. nix/guix) are still tried first - update the header usage example to the download-then-run form .envrc (secret_detected "Generic API key" — false-positive, commented placeholder): - remove the residual `# export DATABASE_URL=...` / `# export API_KEY=...` lines (re-lands the fix intended in #25 that never reached main) This does not by itself turn the hypatia check green — that needs the upstream reusable to restore `--exit-zero`/`|| true` on the scan step so it follows its documented advisory ("warn but don't fail") policy. Claude-Session: https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR Co-authored-by: Claude <noreply@anthropic.com>

hyperpolymath changed the title ~~fix(worker): restrict CORS, comply with npm-avoidant policy, add workflow timeouts~~ Wave 1 follow-up: CORS + npm-policy CI fixes, docs/reality alignment, FFI cleanup Jun 20, 2026

hyperpolymath marked this pull request as ready for review June 20, 2026 19:21

hyperpolymath enabled auto-merge (squash) June 20, 2026 19:21

claude added 2 commits June 20, 2026 19:29

hyperpolymath force-pushed the claude/awesome-gauss-7sccs9 branch from bcbd5c2 to bafdd4e Compare June 20, 2026 19:30

hyperpolymath disabled auto-merge June 20, 2026 19:30

hyperpolymath merged commit 66fb176 into main Jun 20, 2026
20 checks passed

hyperpolymath deleted the claude/awesome-gauss-7sccs9 branch June 20, 2026 19:30

This was referenced Jun 21, 2026

ci(hypatia): interim revert to working reusable pin (standards@5a93d9d cache pin is broken) #23

Merged

chore: clear genuine Hypatia findings (stale src/abi docs, setup.sh, .envrc) #27

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Wave 1 follow-up: CORS + npm-policy CI fixes, docs/reality alignment, FFI cleanup - #20

Wave 1 follow-up: CORS + npm-policy CI fixes, docs/reality alignment, FFI cleanup#20
hyperpolymath merged 2 commits into
mainfrom
claude/awesome-gauss-7sccs9

hyperpolymath commented Jun 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Jun 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

hyperpolymath commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

CI fixes (the blockers on main)

Docs / reality alignment & cleanup

Verified locally

Not in this PR (deferred, noted in the plan)

Still needs you (external)

Uh oh!

Uh oh!

github-actions Bot commented Jun 20, 2026

🔍 Hypatia Security Scan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hyperpolymath commented Jun 20, 2026 •

edited

Loading