Claude/jolly ramanujan 7lww m#22
Merged
Merged
Conversation
The KNOWN-ISSUES.adoc entry for issue #6 predated the actual implementation. zkp.rs (367 LOC), zkp_bridge.rs (628 LOC), and sanctify_bridge.rs (413 LOC) are in place, wired through the VQL type checker and executor as first-class proof types. https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu
Resolves RUSTSEC-2026-0097 (rand 0.10.0 unsoundness): burn 0.21 brings a transitive rand bump to 0.10.1, the patched version. uuid 1.23.1 follows naturally. Cargo audit drops from 7 → 6 advisories; the remaining 6 are all transitive within the burn ML stack (bincode, core2, paste, rustls-pemfile, lru) and require upstream fixes. Workspace builds clean; verisim-tensor tests still pass. https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu
Addresses three GHSA advisories matching mix.lock entries: - bandit ≥ 1.11.1 — GHSA-rf5q-vwxw-gmrf (chunked-trailer DoS, High, CVSS 8.7). Affected: 1.6.0 ≤ x < 1.11.1; we were on 1.10.3. - plug ≥ 1.19.2 — GHSA-468c-vq7p-gh64 (multipart-header buffer exhaustion, High, CVSS 8.2). Affected: 1.19.0 ≤ x < 1.19.2; we were on 1.19.1. Pinned directly even though plug is transitive via bandit, so the constraint is explicit in mix.exs. - postgrex ≥ 0.22.2 — GHSA-r73h-97w8-m54h (channel-name SQL injection in Postgrex.Notifications.listen/3, High, CVSS 7.5). Affected: 0.16.0 ≤ x < 0.22.2; we were on 0.22.0. bandit 1.11.1 requires plug ~> 1.18, compatible with the new plug pin. Lockfile regeneration deferred: this container's network policy blocks repo.hex.pm so `mix deps.update bandit plug postgrex` cannot run here. Run that command in any environment with hex access to refresh mix.lock; mix.exs constraints guarantee resolution to safe versions. https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu
Brings the workspace to clippy-clean under --all-targets -D warnings, fixes broken benchmark targets, applies cargo fmt across the tree, and mirrors the existing GitLab security/lint/test stages as GitHub Actions so PR authors see the same checks before merge. Clippy/lint fixes (across 15+ crates): - Drop dead Node.level field in HNSW (level info lives in neighbors.len) - Replace x % 2 != 0 with !x.is_multiple_of(2) (zkp.rs, auth.rs) - Derive Default for PrivacyLevel, DriftPolicy, IsolationLevel - Add Default impl for TransactionId, QualityReconciliationStrategy - Rename TransactionId::from_str to from_string (avoids FromStr clash) - Annotate too_many_arguments on octad/drift APIs (refactor would be invasive without semantic gain) - Collapse nested ifs in vql.rs find_where_id, elide lifetimes - Use struct-update syntax in OctadInput / RegenerationConfig builders - Drop &h to h on Sha256::update (h is Copy) - Fix HTTP URL literals in doc comments and unclosed HTML tags Benchmark fixes: - Switch from OxiGraphStore (now feature-gated, KNOWN-ISSUES #24) to SimpleGraphStore — drop-in pure-Rust replacement - Add provenance + spatial stores to InMemoryOctadStore::new() calls (9 modalities now, was 7) - Add verisim-provenance + verisim-spatial path deps to benches/ - Replace black_box(unit_returning_call) with explicit black_box(()) Doc warnings: - Fix unresolved [`AdaptiveTuner`] link in profiler.rs - Backtick the generic in `Version<T>` doc to avoid HTML parse - Use backticks not quotes for example URLs GitHub Actions added (.github/workflows/): - rust-ci.yml: fmt, clippy (all-targets, -D warnings), test, doc (-D warnings via RUSTDOCFLAGS), cargo-audit, bench-compile - elixir-ci.yml: format check, compile --warnings-as-errors, mix test, mix hex.audit, mix deps.unlock --check-unused Dependabot fix: - Correct ecosystem "weeklymix" → "mix" (was a typo, never matched) - Point mix at /elixir-orchestration, npm at /playground (was scanning repo root, finding nothing) - Drop pip + nix entries (no Python or flake files exist) Verification: - cargo test --workspace: 567 passed, 0 failed, 6 ignored - cargo clippy --workspace --all-targets -- -D warnings: clean - cargo doc --workspace --no-deps: clean - cargo bench --no-run: clean https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu
Pre-flight for the new .github/workflows/elixir-ci.yml which runs mix format --check-formatted. 61 files were unformatted; this catches them up so the freshly-added CI workflow doesn't fail on first run. Pure whitespace/style — no semantic changes. https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu
🔍 Hypatia Security ScanFindings: 124 issues detected
View findings[
{
"reason": "Issue in quality.yml",
"type": "missing_workflow",
"file": "quality.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in security-policy.yml",
"type": "missing_workflow",
"file": "security-policy.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action actions/checkout@v4 needs attention",
"type": "unpinned_action",
"file": "elixir-ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action erlef/setup-beam@v1 needs attention",
"type": "unpinned_action",
"file": "elixir-ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action actions/cache@v4 needs attention",
"type": "unpinned_action",
"file": "elixir-ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action actions/checkout@v4 needs attention",
"type": "unpinned_action",
"file": "elixir-ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action erlef/setup-beam@v1 needs attention",
"type": "unpinned_action",
"file": "elixir-ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Action actions/checkout@v4 needs attention",
"type": "unpinned_action",
"file": "rust-ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action actions/checkout@v4 needs attention",
"type": "unpinned_action",
"file": "rust-ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.