Merge branch 'main' into claude/trufflehog-pin-82

Author: hyperpolymath

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: MPL-2.0
+# ClusterFuzzLite build environment for VeriSimDB
+FROM gcr.io/oss-fuzz-base/base-builder-rust
+
+COPY . $SRC/verisimdb
+WORKDIR $SRC/verisimdb
+COPY .clusterfuzzlite/build.sh $SRC/build.sh

.clusterfuzzlite/build.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# SPDX-License-Identifier: MPL-2.0
+# ClusterFuzzLite build script for VeriSimDB
+#
+# Builds both fuzz harnesses with libfuzzer instrumentation and copies the
+# resulting binaries to $OUT (where ClusterFuzzLite expects them).
+#
+# Required env vars (set by ClusterFuzzLite runner):
+#   $OUT             — output directory for built fuzzer binaries
+#   $SRC             — source root (typically /src/verisimdb)
+#   $SANITIZER       — address | undefined | memory  (we honour via RUSTFLAGS)
+
+set -euo pipefail
+
+# cargo-fuzz drives libfuzzer; install it if missing.
+if ! command -v cargo-fuzz &>/dev/null; then
+    cargo install cargo-fuzz --locked
+fi
+
+# ── fuzz_octad_id — top-level fuzz crate ─────────────────────────────────
+cd "${SRC}/verisimdb/fuzz"
+cargo fuzz build --release --sanitizer="${SANITIZER:-address}"
+cp target/*/release/fuzz_octad_id "${OUT}/"
+
+# ── fuzz_vql_parser — rust-core fuzz crate ───────────────────────────────
+cd "${SRC}/verisimdb/rust-core/fuzz"
+cargo fuzz build --release --sanitizer="${SANITIZER:-address}"
+cp target/*/release/fuzz_vql_parser "${OUT}/"
+
+# Optional seed corpora — empty for now, will populate as we discover
+# interesting inputs.  Comment in once corpora exist:
+# cp -r "${SRC}/verisimdb/fuzz/corpus/fuzz_octad_id" "${OUT}/fuzz_octad_id_seed_corpus" 2>/dev/null || true
+# cp -r "${SRC}/verisimdb/rust-core/fuzz/corpus/fuzz_vql_parser" "${OUT}/fuzz_vql_parser_seed_corpus" 2>/dev/null || true

.github/workflows/elixir-ci.yml

@@ -61,6 +61,7 @@ jobs:
         working-directory: elixir-orchestration
     steps:
       - uses: actions/checkout@v6
+
       - uses: erlef/setup-beam@v1
         with:
           elixir-version: "1.17"

.github/workflows/rust-ci.yml

@@ -71,6 +71,15 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
+  deny:
+    name: cargo deny
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check advisories bans licenses sources
+
   bench-compile:
     name: benchmarks compile
     runs-on: ubuntu-latest
@@ -79,3 +88,18 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo bench --no-run
+
+  fuzz-compile:
+    name: fuzz targets compile
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        manifest:
+          - fuzz/Cargo.toml
+          - rust-core/fuzz/Cargo.toml
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo check --manifest-path ${{ matrix.manifest }}
+

.gitignore

@@ -110,3 +110,7 @@ temp/
 
 # Crash recovery artifacts
 ai-cli-crash-capture/
+
+# Fuzz harness build artifacts
+fuzz/target/
+rust-core/fuzz/target/

.hypatia-ignore

@@ -0,0 +1,46 @@
+# .hypatia-ignore — file-level exemptions from estate-wide hypatia rules
+#
+# ReScript (.res) files are permitted in this repository per CLAUDE.md
+# language policy.  ReScript powers:
+#   - src/vql/         — VQL parser, type checker, circuits, subtyping
+#   - src/registry/    — federation registry (Kraft consensus, metadata log)
+#   - src/abi/         — Idris2/ReScript ABI bridge
+#   - playground/      — VQL Playground web UI
+#   - connectors/clients/rescript/ — ReScript client SDK
+#
+# Each file is whitelisted by absolute repo path.
+
+cicd_rules/banned_language_file:examples/SafeDOMExample.res
+cicd_rules/banned_language_file:src/vql/VQLContext.res
+cicd_rules/banned_language_file:src/vql/VQLParser_test.res
+cicd_rules/banned_language_file:src/vql/VQLSubtyping.res
+cicd_rules/banned_language_file:src/vql/VQLCircuit.res
+cicd_rules/banned_language_file:src/vql/VQLExplain.res
+cicd_rules/banned_language_file:src/vql/VQLTypes.res
+cicd_rules/banned_language_file:src/vql/VQLError.res
+cicd_rules/banned_language_file:src/vql/VQLParser.res
+cicd_rules/banned_language_file:src/vql/VQLBidir.res
+cicd_rules/banned_language_file:src/vql/VQLProofObligation.res
+cicd_rules/banned_language_file:src/vql/VQLTypeChecker.res
+cicd_rules/banned_language_file:src/registry/MetadataLog.res
+cicd_rules/banned_language_file:src/registry/KRaftSerializer.res
+cicd_rules/banned_language_file:src/registry/Registry.res
+cicd_rules/banned_language_file:src/registry/KRaftCluster.res
+cicd_rules/banned_language_file:debugger/examples/SafeDOMExample.res
+cicd_rules/banned_language_file:playground/src/Examples.res
+cicd_rules/banned_language_file:playground/src/Formatter.res
+cicd_rules/banned_language_file:playground/src/App.res
+cicd_rules/banned_language_file:playground/src/DemoExecutor.res
+cicd_rules/banned_language_file:playground/src/Linter.res
+cicd_rules/banned_language_file:playground/src/VqlKeywords.res
+cicd_rules/banned_language_file:playground/src/Highlighter.res
+cicd_rules/banned_language_file:playground/src/ApiClient.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimVql.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimFederation.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimProvenance.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimDrift.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimClient.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimHexad.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimTypes.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimSearch.res
+cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimError.res