chore(toolchain): provision OCaml/wasmtime/Deno + migrate harnesses to Deno (#133/#253)#150
Merged
Merged
Conversation
…o Deno (#133/#253) Provisioning (tools/provision.sh, `just provision`/`setup`, wired into setup.sh): - Deno from the GitHub release assets (deno.land is denylisted by the network policy; github.com is reachable). - wasmtime via crates.io (the #132 capstone execution gate). - AffineScript built from hyperpolymath/affinescript with opam + dune at the SHA pinned in c5-regenerate.yml. AffineScript is an OCaml compiler, NOT an npm package (@hyperpolymath/affinescript 404s on npmjs). - Replace the stale `deps` recipe (ran `npm ci` against the package.json that #133 removed) with a real toolchain check. node -> Deno migration of the .mjs harnesses (deno.json + Justfile deno_run recipes + e2e.yml smoke/build-e2e jobs + tests/e2e.sh), scoped permissions (read/write/run/env/sys). The .mjs were already Deno-shaped (node: imports, import.meta.url-derived __dirname), so the change is mechanical. Cleanup: remove the ReScript-era deno.lock + package-lock.json and the stale rescript build / node_modules/@rescript references in the E2E script. Verified locally with deno 2.8.1: deno tasks, just deps, just test-aspect/proof, and E2E_BUILD=0 tests/e2e.sh (47 passed / 0 failed / 7 skipped) all green.
🔍 Hypatia Security ScanFindings: 79 issues detected
View findings[
{
"reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in c5-regenerate.yml",
"type": "missing_timeout_minutes",
"file": "c5-regenerate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in cargo-audit.yml",
"type": "missing_timeout_minutes",
"file": "cargo-audit.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath
marked this pull request as ready for review
June 1, 2026 13:08
hyperpolymath
enabled auto-merge (squash)
June 1, 2026 13:09
…npm refs - CLAUDE.md gains an 'Environment & Toolchain' section: Deno-first JS runtime, AffineScript=OCaml (not npm), provisioning via just provision, the network policy (github.com/crates.io/npmjs/apt reachable; deno.land/api.github.com/ wasmtime.dev denylisted), and the git-proxy ref-delete limitation. - docs/wiki/Home.md quick-start: ReScript/npm/node smoke -> AffineScript + Deno. - docs/wiki/Proof-Debt-Status.md: node -> deno for the proof regression. (Dated audit/maintenance reports under docs/reports/ are left as-is — historical records, not live instructions.)
🔍 Hypatia Security ScanFindings: 79 issues detected
View findings[
{
"reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in c5-regenerate.yml",
"type": "missing_timeout_minutes",
"file": "c5-regenerate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in cargo-audit.yml",
"type": "missing_timeout_minutes",
"file": "cargo-audit.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
…ed network The OCaml/AffineScript path failed in container/CI envs. Four real fixes, each surfaced by running it: - apt-get update returns 100 on denylisted 3rd-party PPAs (deadsnakes/ondrej 403) -> tolerate (`|| true`); opam is in universe, already indexed. - opam refuses to init as root -> export OPAMROOTISOK=1. - opam's bwrap sandbox fails in containers -> --disable-sandboxing. - opam.ocaml.org/index.tar.gz is denylisted (403) -> point the default repo at the github.com git mirror (github is reachable), same lesson as Deno. Also activate the switch env (eval opam env) and add a final binary check so the script can't report success without producing affinescript. Justfile deps-audit: drop the vacuous `npm audit` (no package.json since #133); use `cargo audit` (guarded) — the real dep audit for this Rust/Deno repo.
🔍 Hypatia Security ScanFindings: 79 issues detected
View findings[
{
"reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in c5-regenerate.yml",
"type": "missing_timeout_minutes",
"file": "c5-regenerate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in cargo-audit.yml",
"type": "missing_timeout_minutes",
"file": "cargo-audit.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two related estate-toolchain changes:
1. Durable provisioning —
tools/provision.sh(exposed asjust provision/just setup, wired intosetup.sh) installs:deno.land/dl.deno.landare denied by the network policy (x-deny-reason: host_not_allowed), butgithub.comrelease downloads are reachable — same channel that works for wasmtime/just.tw build→ run on Wasmtime → get an actionable violation message #132 capstone execution gate, via crates.io.hyperpolymath/affinescriptwith opam + dune at the SHA pinned inc5-regenerate.yml), not an npm package —@hyperpolymath/affinescript404s on npmjs.The stale
depsrecipe (which rannpm ciagainst thepackage.jsonthat #133 removed) is replaced with a real toolchain check.2. node → Deno harness migration (estate #133 / standards#253) — the
node tests/*.mjsrunners now run under Deno with scoped permissions (--allow-read --allow-write --allow-run --allow-env --allow-sys):deno.json(tasks + config), the Justfiledeno_runrecipes,e2e.yml(smoke + build-e2e jobs install Deno from the release assets), andtests/e2e.sh..mjswere already Deno-shaped (node:imports,import.meta.url-derived__dirname), so the change is mechanical — no source edits to the harnesses.Cleanup — removed the ReScript-era leftovers
deno.lock+package-lock.json, and the stalerescript build/node_modules/@rescriptreferences in the E2E script.Why
@hyperpolymath/affinescriptis OCaml, so it was never an npm/Deno/Bun package — there's nothing to "migrate" for the compiler. The only JS-runtime surface is the.mjsharnesses, and the estate standard is Deno (#133/#253), not Bun. This PR makes the toolchain reproducible and finishes the node→Deno harness move.Verification (local, deno 2.8.1)
deno task test-aspect/test-proof— greenjust deps(deno/cargo/wasmtime ok),just test-aspect/test-proof— greenE2E_BUILD=0 bash tests/e2e.sh— 47 passed / 0 failed / 7 skippedtools/provision.shruns clean (idempotent skip when tools present)The CI Deno-install steps + full
e2e.ymlflow are verified by this PR's own run.Note on AffineScript
provision.shcan build AffineScript here (github.comclone is reachable, opam is apt-installable) but it's a ~5-min OCaml build, so I didn't run it in this session — it's codified per the authoritativec5-regenerate.ymlrecipe. Building it is the unblock for the #127 front-end→IR seam.https://claude.ai/code/session_01Rq4da8i2uGnDUfanSB1Hx4
Generated by Claude Code