Repository navigation
fix: complete PR #219 reconciliation and governance hardening - #242
Conversation
Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 51 minutes. View limit details
✨ Finishing Touches: 💡 1
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Fork governance
🟣 critical · commit
Hypatia scan: 131 finding(s)
panic-attack assail: 17 finding(s)
pons asinorum: 1 finding(s)
rhodibot (RSR compliance): not_run — enrolled, but no report-back was received
panicbot (panic recovery, error handling): not_run — enrolled, but no report-back was received
echidnabot (formal verification: proofs/): not_run — enrolled, but no report-back was received
seambot (integration health: API routes): not_run — enrolled, but no report-back was received
finishingbot (release readiness): not_run — enrolled, but no report-back was received
accessibilitybot (WCAG on the React UI): not_run — enrolled, but no report-back was received
glambot (presentation quality): not_run — enrolled, but no report-back was received
cipherbot: not_applicable — no cryptography is implemented in this repository
sustainabot: not_applicable — fleet adapter slot reserved; no adapter exists yet (gitbot-fleet README)
Scope: static findings reported by each row's tool at the named commit. Purple, red, yellow and blue grade the worst finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run. |
Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
|
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
## Scope Security/governance follow-up to #227. All four Codex findings on that old PR already landed in #229/#234 and follow-ups; I answered/resolved its threads and closed it as superseded, rather than merging a conflicting branch that could undo newer fixes. CodeRabbit's remaining notices are account limits/billing, not code questions. ## Changes - Add pinned, least-privileged full-history/working-tree secret scanning and default-branch Scorecard publication; no inherited secrets or new alert suppressions. - Add Dependabot, SECURITY.md, editor settings and a repository-specific AI manifest without changing existing licensing/architecture. - Add independent pinned K9 conformance and its artifact to the PR verdict. The current empty corpus is explicitly grey, not a semantic pass. Missing semantic evidence fails closed. Keep DEED syntax and advisory Hypatia as separate evidence families. - Bound Julia CI at 90 minutes and preserve producer **and** log-writer failures. Add 8 negative/mutation tests and 4 exit-combination tests. - Refresh the bun lockfile within current major ranges for real security advisories, notably DOMPurify, Vite and transitive build dependencies; raise minimum Vite to 6.4.5 and Router DOM to 6.30.6. This is why the lockfile changes. No generated assets are included. - Audit high/critical frontend dependencies in CI. ## Verification Bun **1.3.10**: frozen install, TypeScript checking, **72 frontend tests / 200 assertions**, production build, and high/critical audit pass. Full audit reduced from **31 advisories (1 critical, 13 high, 14 moderate, 3 low) to 2 moderate Router advisories**. This is not a zero-vulnerability claim. Canonical pinned DEED lint, all 39 governance contract checks, 8 weakening mutations, 4 pipeline-exit combinations, unique-key YAML parsing, all embedded shell syntax, Sonar reliability lint, proof axiom audit (7 modules), and git diff checks pass locally. Julia/R/Agda/Nickel are not installed in this sandbox; hosted CI must supply those results. No local runtime/semantic pass is claimed. ## Hosted wrapper fixes The first run found two issues in the pinned standards wrappers. Fork-local copies retain the same immutable standards validator/renderer/config sources and all gates, but fix the terminal optional-log copy for an empty K9 corpus and upgrade Gitleaks from 8.18.4 to 8.30.1 (upstream release-asset digest). The old rules falsely matched historical DNA/FASTQ and schema labels; no history exclusions or local rule suppressions were added. A synthetic AWS credential must still fail in CI. Three K9 copy cases and a credential-sensitivity test also pass locally. Hosted checks are rerunning. ## Remaining / intentionally not done See `docs/release-notes/2026-10-23-governance-security.md` for the source Hypatia run and complete triage. Two moderate React Router advisories need a v7 migration review. Estate language bans conflict with the settled React/TS stack and independent Python reference oracles; W3C SVG namespace URIs are not HTTP requests. Do not fix those by rewriting the architecture or breaking namespaces. No configured mirror target exists. Existing upstream licensing headers remain protected. Fleet bots without report-backs remain not_run. No fake conformance reports have been added. The integration returns 403 for code-scanning/Dependabot alert listing and the sandbox blocks Actions artifact/log storage hosts; no alerts have been dismissed. Published grids/check APIs are still readable. Scorecard's default-branch publication can only be verified after landing; K9 has no committed contracts and therefore cannot claim substantive contract coverage yet. ## PR #228 security follow-up (`1be406d`) Independent verification found that the recorded conflict-resolution tree for #228 is identical to main; #228 is being closed as superseded, not conflict-merged. Its valid leaf-PD finding is already implemented in **unmerged** #242/#244 and is not duplicated here. #242's integration run 39986326202 passed all six jobs; #244's Julia validation remains pending at review time. The R-evaluation warning was not dismissed as a language-detector false positive. This follow-up validates metadata column identifiers before they enter PERMANOVA's parsed R formula and validates package names before provenance interpolates them into R source. Expressions, quotes/escapes, controls and reserved formula terms are covered by regression cases. Plain identifiers preserve the existing formula and scientific tests; non-identifier metadata columns must be renamed, as documented in the function contract. Local verification for the new commit: 39 governance assertions, 8 weakening mutations, 3 K9 copy cases, 4 CI logging cases, scanner-boundary tests, complete working-tree/history shell scanning, git diff checks and syntax parsing of all four changed Julia files pass. **Syntax parsing is not execution**: the new Julia/R regressions await hosted CI. This does not certify all remaining R call sites or dismiss outstanding advisory findings. ### Main advanced during review #242 has now merged as `b656d2a99e53267108d51ad87d7eaee13222d368` (16:46:42 UTC), after its full integration suite passed. The leaf-PD fix is therefore on main. #228 is confirmed closed/unmerged. This PR (#243) now has conflicts with the newly updated main and is **not merge-ready**; no main-merge commit or unrequested history rewrite has been made. The new R-boundary/scanner tests are running at `1be406d`; earlier passing checks must not be mistaken for validation of a future rebased head. --------- Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
…I workflow - Read req.body non-destructively in _statistics_body via copy(req.body), enforce MAX_STATISTICS_REQUEST_BYTES using UTF-8 byte length (ncodeunits) when req.body is already an AbstractString, and accept generic AbstractString payloads (e.g. SubString). - Add regression tests in test_validated_statistics.jl covering repeated reads of the same HTTP.Request, multibyte UTF-8 size limits, and SubString payloads. - Remove the duplicate timeout-minutes key in .github/workflows/ci.yml introduced by the PR #242/#243 merge, run validated_statistics first within the fast pre-flight CI step, and SHA-pin actions/checkout in .github/workflows/doi.yml. Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Main moved while this branch was in review: #242 made tree path building linear in `TreeShapes.tsx`, and #243 taught the cladistics builder the node-local subtree-PD convention. Both are the fixes this branch carried, so the merge keeps main's implementation and drops the duplicates rather than shipping two spellings of the same change. What remains branch-specific is what main does not have yet: the `_request_json` guard for malformed bodies (and its Oxygen serializer hook), the report-backs directory the deed declares, and the two type-only test assertions panic-attack flagged. Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>



Change and reason
Supersedes #219 and the earlier reconciliation attempt #228. The validated-statistics and CladeCumulus changes on those stale branches have already landed through later work on
main; conflict comparison showed that taking either stale side would now revert newer strict I-JSON, streamedBigInt, read-only DuckDB, tree-rooting, and unplaced-read fixes. This branch is therefore based directly on currentmainand carries only changes that are still needed.|| true; the captured test exit status remains authoritative.PaneEditoruses the direct hook dependency.Validation
npx --yes bun@1.3.10 install --frozen-lockfilenpx --yes bun@1.3.10 run typechecknpx --yes bun@1.3.10 test src— 72 passed, 0 failed (200 assertions)npx --yes bun@1.3.10 run buildrunblock withbash -nbash scripts/check-governance-contract.sh— all 20 checks passedpython3 test/references/check_high_precision_references.py --check test/unit/test_high_precision.jlbash scripts/lint-sonar-reliability.shgit diff --checkSecret history and working tree / gitleaks— passed with the CI-pinned gitleaks 8.18.4ed24c9c— passed: Julia 1.12.5 tests, validated statistics, frontend build/tests, R/RCall checks, high-precision references, benchmarks, Agda, and both occupancy lanesDeliberate review triage
http://www.w3.org/...strings were not changed to HTTPS: they are identifiers, not network requests.CONTRIBUTING.mdrequires.Scope
Signed-off-by:(Developer Certificate of Origin)