ci: clear post-#35 failures (sha2/criterion adaptations) + SchemaRegistry tests (#37)

## Summary

Follow-up to PR #35 (squash-merged with several CI failures still red).
This PR brings the workspace fully green under every gate added in that
PR, plus adds the next slice of test gap fill.

## Verification gates (all green locally after rebase off main)

| Gate | Status |
|---|---|
| `cargo test --workspace` | 592 / 0 fail / 6 ignored |
| `cargo clippy --workspace --all-targets -- -D warnings` | clean |
| `cargo fmt --all -- --check` | clean |
| `cargo doc --workspace --no-deps` (RUSTDOCFLAGS=`-D warnings`) | clean
|
| `cargo bench --no-run` | clean |
| `cargo deny check` (advisories, bans, licenses, sources) | clean |
| Both fuzz crates `cargo check` | clean |
| `mix format --check-formatted` | clean |
| Elixir `--warnings-as-errors` | clean |

## Corrective fixes (this is what PR #35 missed)

**Adaptive to upstream dep bumps merged via dependabot during PR #35:**
- `sha2 0.11` removed `LowerHex` from `GenericArray` — replaced
`format!("{:x}", digest)` with per-byte hex format in
`verisim-provenance::lib::compute_hash` / `genesis_hash` and
`verisim-api::federation::sha256_hex`.
- `criterion 0.8` deprecated `criterion::black_box` — switched the
benchmark import to `std::hint::black_box`.

**Elixir warnings caught by `mix compile --warnings-as-errors`:**
- `lib/verisim/federation/adapters/duckdb.ex:175` — `fts_index` unused →
renamed to `_fts_index`.
- `lib/verisim/consensus/kraft_node.ex:47` — `@tick_interval 10` set but
never referenced; dead module attribute removed.
- `lib/verisim/rust_client.ex:483` — `status` extracted in pattern but
unused → renamed to `_status`.
- `lib/verisim/query/vql_bridge.ex:418,425` — `parse_select/1` and
`take_modalities/2` superseded by `parse_select_extended/1`; removed.
`strip_comma/1` kept (still used by the extended parser).

**CI workflow hardening:**
- Added explicit `permissions: contents: read` to both `rust-ci.yml` and
`elixir-ci.yml` — closes the governance "Workflow security linter"
finding.

## Perfective — test gap fill (5 of 9 modules done)

Adds 22-test `SchemaRegistry` coverage. Cumulative coverage of the
modules flagged in the test-gap audit:

| Module | Tests added |
|---|---|
| `DriftMonitor` | ✓ (in PR #35) |
| `EntityServer` | ✓ (in PR #35) |
| `QueryRouter` | ✓ (in PR #35) |
| `SchemaRegistry` | **this PR (22 tests)** |
| `vql_executor` | TODO |
| `vql_bridge` | TODO |
| `kraft_supervisor` | TODO |
| `telemetry/collector` | TODO |
| `telemetry/reporter` | TODO |

## Test plan

- [ ] rust-ci.yml all jobs green
- [ ] elixir-ci.yml both jobs green
- [ ] governance / Workflow security linter green
- [ ] pr-fuzzing green

https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu

---
_Generated by [Claude
Code](https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.hypatia-ignore

@@ -10,37 +10,37 @@
 #
 # Each file is whitelisted by absolute repo path.
 
-cicd_rules/banned_language_file:examples/SafeDOMExample.res
-cicd_rules/banned_language_file:src/vql/VQLContext.res
-cicd_rules/banned_language_file:src/vql/VQLParser_test.res
-cicd_rules/banned_language_file:src/vql/VQLSubtyping.res
-cicd_rules/banned_language_file:src/vql/VQLCircuit.res
-cicd_rules/banned_language_file:src/vql/VQLExplain.res
-cicd_rules/banned_language_file:src/vql/VQLTypes.res
-cicd_rules/banned_language_file:src/vql/VQLError.res
-cicd_rules/banned_language_file:src/vql/VQLParser.res
-cicd_rules/banned_language_file:src/vql/VQLBidir.res
-cicd_rules/banned_language_file:src/vql/VQLProofObligation.res
-cicd_rules/banned_language_file:src/vql/VQLTypeChecker.res
-cicd_rules/banned_language_file:src/registry/MetadataLog.res
-cicd_rules/banned_language_file:src/registry/KRaftSerializer.res
-cicd_rules/banned_language_file:src/registry/Registry.res
-cicd_rules/banned_language_file:src/registry/KRaftCluster.res
-cicd_rules/banned_language_file:debugger/examples/SafeDOMExample.res
-cicd_rules/banned_language_file:playground/src/Examples.res
-cicd_rules/banned_language_file:playground/src/Formatter.res
-cicd_rules/banned_language_file:playground/src/App.res
-cicd_rules/banned_language_file:playground/src/DemoExecutor.res
-cicd_rules/banned_language_file:playground/src/Linter.res
-cicd_rules/banned_language_file:playground/src/VqlKeywords.res
-cicd_rules/banned_language_file:playground/src/Highlighter.res
-cicd_rules/banned_language_file:playground/src/ApiClient.res
-cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimVql.res
-cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimFederation.res
-cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimProvenance.res
-cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimDrift.res
-cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimClient.res
-cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimHexad.res
-cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimTypes.res
-cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimSearch.res
-cicd_rules/banned_language_file:connectors/clients/rescript/src/VeriSimError.res
+cicd_rules/banned_language_file:./connectors/clients/rescript/src/VeriSimClient.res
+cicd_rules/banned_language_file:./connectors/clients/rescript/src/VeriSimDrift.res
+cicd_rules/banned_language_file:./connectors/clients/rescript/src/VeriSimError.res
+cicd_rules/banned_language_file:./connectors/clients/rescript/src/VeriSimFederation.res
+cicd_rules/banned_language_file:./connectors/clients/rescript/src/VeriSimHexad.res
+cicd_rules/banned_language_file:./connectors/clients/rescript/src/VeriSimProvenance.res
+cicd_rules/banned_language_file:./connectors/clients/rescript/src/VeriSimSearch.res
+cicd_rules/banned_language_file:./connectors/clients/rescript/src/VeriSimTypes.res
+cicd_rules/banned_language_file:./connectors/clients/rescript/src/VeriSimVql.res
+cicd_rules/banned_language_file:./debugger/examples/SafeDOMExample.res
+cicd_rules/banned_language_file:./examples/SafeDOMExample.res
+cicd_rules/banned_language_file:./playground/src/ApiClient.res
+cicd_rules/banned_language_file:./playground/src/App.res
+cicd_rules/banned_language_file:./playground/src/DemoExecutor.res
+cicd_rules/banned_language_file:./playground/src/Examples.res
+cicd_rules/banned_language_file:./playground/src/Formatter.res
+cicd_rules/banned_language_file:./playground/src/Highlighter.res
+cicd_rules/banned_language_file:./playground/src/Linter.res
+cicd_rules/banned_language_file:./playground/src/VqlKeywords.res
+cicd_rules/banned_language_file:./src/registry/KRaftCluster.res
+cicd_rules/banned_language_file:./src/registry/KRaftSerializer.res
+cicd_rules/banned_language_file:./src/registry/MetadataLog.res
+cicd_rules/banned_language_file:./src/registry/Registry.res
+cicd_rules/banned_language_file:./src/vql/VQLBidir.res
+cicd_rules/banned_language_file:./src/vql/VQLCircuit.res
+cicd_rules/banned_language_file:./src/vql/VQLContext.res
+cicd_rules/banned_language_file:./src/vql/VQLError.res
+cicd_rules/banned_language_file:./src/vql/VQLExplain.res
+cicd_rules/banned_language_file:./src/vql/VQLParser.res
+cicd_rules/banned_language_file:./src/vql/VQLParser_test.res
+cicd_rules/banned_language_file:./src/vql/VQLProofObligation.res
+cicd_rules/banned_language_file:./src/vql/VQLSubtyping.res
+cicd_rules/banned_language_file:./src/vql/VQLTypeChecker.res
+cicd_rules/banned_language_file:./src/vql/VQLTypes.res

elixir-orchestration/test/verisim/consensus/kraft_supervisor_test.exs

@@ -0,0 +1,100 @@
+# SPDX-License-Identifier: MPL-2.0
+
+defmodule VeriSim.Consensus.KRaftSupervisorTest do
+  @moduledoc """
+  Tests for VeriSim.Consensus.KRaftSupervisor — the supervisor that
+  starts the local Registry and a configurable list of KRaftNode
+  processes.
+
+  The supervisor uses `name: __MODULE__`, so only one instance can be
+  running at a time.  These tests start it under a different name via
+  Supervisor.start_link directly so they don't conflict with any
+  app-managed instance.
+  """
+
+  use ExUnit.Case, async: false
+
+  alias VeriSim.Consensus.KRaftSupervisor
+
+  describe "start_link/1 — empty cluster" do
+    test "starts cleanly with no nodes" do
+      # Empty list: only the Registry child should be started.
+      # We test the init/1 callback's child-spec generation directly to
+      # avoid needing a unique supervisor name.
+      {:ok, children_specs} = KRaftSupervisor.init(nodes: [])
+      assert is_tuple(children_specs)
+    end
+  end
+
+  describe "child spec generation" do
+    test "init/1 returns a Supervisor child-spec tuple with one_for_one strategy" do
+      {:ok, {sup_flags, children}} = KRaftSupervisor.init(nodes: [])
+
+      assert sup_flags.strategy == :one_for_one
+      assert is_list(children)
+      assert length(children) == 1
+    end
+
+    test "the only child for an empty cluster is the consensus Registry" do
+      {:ok, {_flags, children}} = KRaftSupervisor.init(nodes: [])
+
+      [registry_spec] = children
+      # Children come back as %{id: Registry, start: {Registry, :start_link, [...]}}
+      assert registry_spec.id == Registry
+    end
+
+    test "one configured node yields Registry + one KRaftNode spec" do
+      {:ok, {_flags, children}} =
+        KRaftSupervisor.init(
+          nodes: [
+            [node_id: "n1", peers: []]
+          ]
+        )
+
+      assert length(children) == 2
+      [_registry, node_spec] = children
+      assert node_spec.id == {VeriSim.Consensus.KRaftNode, "n1"}
+    end
+
+    test "three configured nodes yield Registry + three KRaftNode specs" do
+      {:ok, {_flags, children}} =
+        KRaftSupervisor.init(
+          nodes: [
+            [node_id: "a", peers: ["b", "c"]],
+            [node_id: "b", peers: ["a", "c"]],
+            [node_id: "c", peers: ["a", "b"]]
+          ]
+        )
+
+      assert length(children) == 4
+
+      [_registry | node_specs] = children
+      node_ids = Enum.map(node_specs, & &1.id)
+      assert {VeriSim.Consensus.KRaftNode, "a"} in node_ids
+      assert {VeriSim.Consensus.KRaftNode, "b"} in node_ids
+      assert {VeriSim.Consensus.KRaftNode, "c"} in node_ids
+    end
+
+    test "child IDs are unique per node so the supervisor can manage them" do
+      {:ok, {_flags, children}} =
+        KRaftSupervisor.init(
+          nodes: [
+            [node_id: "x", peers: []],
+            [node_id: "y", peers: []],
+            [node_id: "z", peers: []]
+          ]
+        )
+
+      ids = Enum.map(children, & &1.id)
+      assert length(ids) == length(Enum.uniq(ids))
+    end
+  end
+
+  describe "missing :node_id" do
+    test "raises KeyError when a node opts is missing :node_id" do
+      assert_raise KeyError, fn ->
+        KRaftSupervisor.init(nodes: [[peers: ["other"]]])
+      end
+    end
+  end
+end