Skip to content

fix: complete PR #219 reconciliation and governance hardening - #242

Merged
hyperpolymath merged 6 commits into
mainfrom
arena/2adadc5d-metamanifold-webui
Oct 23, 2026
Merged

hyperpolymath merged 6 commits into
mainfrom
arena/2adadc5d-metamanifold-webui

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Oct 23, 2026 •

Copy link
Copy Markdown
Owner

Change and reason

Supersedes #219 and the earlier reconciliation attempt #228. The validated-statistics and CladeCumulus changes on those stale branches have already landed through later work on main; conflict comparison showed that taking either stale side would now revert newer strict I-JSON, streamed BigInt, read-only DuckDB, tree-rooting, and unplaced-read fixes. This branch is therefore based directly on current main and carries only changes that are still needed.

  • CladeCumulus: active non-root tips now use the same node-local PD convention before and after drag-and-drop reaggregation. Regression tests cover every fixture tip before and after an accepted move, plus exact nested-clade totals (0.60 and 1.40) that reject parent-side double-counting. This addresses the remaining Codex finding on fix: resolve PR #219 conflicts and address CladeCumulus & validated-statistics findings #228 and CodeRabbit's aggregation finding on fix: restore validated statistics and CladeCumulus CI #219.
  • CI: the full Julia job has a 60-minute hang bound, and validated-statistics diagnostics no longer use || true; the captured test exit status remains authoritative.
  • Frontend quality: SVG path fragments are batched and joined once rather than repeatedly concatenated, and PaneEditor uses the direct hook dependency.
  • Security and conformance: adds the missing security policy and EditorConfig, plus pinned OpenSSF Scorecard and full-history secret-scanning workflows. Scorecard retains least-privilege default-branch SARIF upload without a self-referential PR alert. The repository gitleaks config backports two upstream rules for biological-data false positives and allowlists only ten exact public schema/callback identifiers—no path or commit exclusions. The existing DEED lane is conformant and unchanged.

Validation

  • npx --yes bun@1.3.10 install --frozen-lockfile
  • npx --yes bun@1.3.10 run typecheck
  • npx --yes bun@1.3.10 test src — 72 passed, 0 failed (200 assertions)
  • npx --yes bun@1.3.10 run build
  • Parsed every workflow as YAML and every inline run block with bash -n
  • bash scripts/check-governance-contract.sh — all 20 checks passed
  • python3 test/references/check_high_precision_references.py --check test/unit/test_high_precision.jl
  • bash scripts/lint-sonar-reliability.sh
  • git diff --check
  • Reproduced the legacy gitleaks rules over all 188 reachable commits: 211,428 biological/generated-code false positives reduced to zero; synthetic AWS, Facebook, and generic credential canaries still produced exactly three findings
  • Fresh-head Secret history and working tree / gitleaks — passed with the CI-pinned gitleaks 8.18.4
  • CI run 39986326202 on ed24c9c — passed: Julia 1.12.5 tests, validated statistics, frontend build/tests, R/RCall checks, high-precision references, benchmarks, Agda, and both occupancy lanes

Deliberate review triage

  • No baseline or exclusion was added to hide Hypatia findings.
  • TypeScript remains the settled frontend stack and the independent Python numerical oracles remain in place; the banned-language findings are policy debt, not vulnerabilities introduced here.
  • XML namespace http://www.w3.org/... strings were not changed to HTTPS: they are identifiers, not network requests.
  • Existing licence headers were left unchanged as CONTRIBUTING.md requires.
  • No placeholder CodeQL, Hypatia, mirror, or AI-manifest files were added. CodeQL default setup and the Hypatia governance lane are already active; external mirroring and the legacy A2ML-to-DEED migration require explicit owner configuration/decisions.

Scope

  • Does not alter dependencies, lockfiles, generated assets, or vendored files
  • Secrets, local paths, and run outputs are not committed
  • Commits include Signed-off-by: (Developer Certificate of Origin)

hyperpolymath and others added 2 commits October 23, 2026 16:11
Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 23, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-23T16:25:14.764212Z ed24c9c New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
@coderabbitai

coderabbitai Bot commented Oct 23, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 51 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: b8ed483b-1f8d-445f-b445-d9f8d845afe5
📥 Commits

Reviewing files that changed from the base of the PR and between d69d4f9 and ed24c9c.

📒 Files selected for processing: 11
  • .editorconfig
  • .github/workflows/ci.yml
  • .github/workflows/scorecard.yml
  • .github/workflows/secret-scanner.yml
  • .gitignore
  • .gitleaks.toml
  • SECURITY.md
  • frontend/src/figure/PaneEditor.tsx
  • frontend/src/tree/TreeShapes.tsx
  • src/analysis/clade_cumulus.jl
  • test/unit/test_clade_cumulus.jl
✨ Finishing Touches: 💡 1
🛠️ Fix failing CI checks: 💡
  • Commit to this branch
  • Create a new PR
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 23, 2026 •

Copy link
Copy Markdown

Fork governance

Lane Status Run
DEED syntax (repo deed) 🟢 conformant run 39986326905
Hypatia verdict grid purple (job: success) same run

Hypatia grid purple

🟣 critical · commit ed24c9c17087 · run 39986326905

Reporter Status Critical High Medium Minor Since previous revision
Hypatia scan 🟣 critical 45 57 29 0 ↔ unchanged
panic-attack assail 🔴 high 0 6 11 0 ↔ unchanged
pons asinorum 🟡 medium 0 0 1 0 ↔ unchanged
rhodibot (RSR compliance) 🟠 indeterminate 0 0 0 0 — indeterminate
panicbot (panic recovery, error handling) 🟠 indeterminate 0 0 0 0 — indeterminate
echidnabot (formal verification: proofs/) 🟠 indeterminate 0 0 0 0 — indeterminate
seambot (integration health: API routes) 🟠 indeterminate 0 0 0 0 — indeterminate
finishingbot (release readiness) 🟠 indeterminate 0 0 0 0 — indeterminate
accessibilitybot (WCAG on the React UI) 🟠 indeterminate 0 0 0 0 — indeterminate
glambot (presentation quality) 🟠 indeterminate 0 0 0 0 — indeterminate
cipherbot ⚪ not applicable 0 0 0 0 ↔ unchanged
sustainabot ⚪ not applicable 0 0 0 0 ↔ unchanged
Hypatia scan: 131 finding(s)
  • critical cicd_rules/banned_language_file — frontend/src/views/run/parseFilterYaml.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/figure/encode.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/figure/charts.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/figure/export.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/figure/figure.test.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/figure/legend.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/figure/types.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/utils/download.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/utils/text.test.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/utils/timeago.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/utils/text.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/hooks/useUnsavedGuard.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/hooks/useApi.test.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/hooks/useApi.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/hooks/useAnalysis.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/hooks/useSSE.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/hooks/useTabParam.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/hooks/useNavRefresh.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/hooks/useJobEvents.ts — TypeScript file detected -- banned language
  • critical cicd_rules/banned_language_file — frontend/src/about.ts — TypeScript file detected -- banned language
  • 111 more; see the structured report in the artifact.
panic-attack assail: 17 finding(s)
  • high DynamicCodeExecution — src/pipeline/dada2/context.jl — eval/Meta.parse in src/pipeline/dada2/context.jl
  • high DynamicCodeExecution — src/analysis/analysis.jl — eval/Meta.parse in src/analysis/analysis.jl
  • high DynamicCodeExecution — src/analysis/differential.jl — eval/Meta.parse in src/analysis/differential.jl
  • high DynamicCodeExecution — src/core/provenance.jl — eval/Meta.parse in src/core/provenance.jl
  • high DynamicCodeExecution — scripts/check-julia-syntax.jl — eval/Meta.parse in scripts/check-julia-syntax.jl
  • high DynamicCodeExecution — test/unit/test_permanova.jl — eval/Meta.parse in test/unit/test_permanova.jl
  • medium UnsafeFFI — src/core/memory_probe.jl — 3 ccall/FFI calls in src/core/memory_probe.jl
  • medium InputBoundary — src/server/routes/runs.jl — 2 JSON3.read/JSON.parse call(s) with 0 try block(s) in src/server/routes/runs.jl — these throw on malformed input; wrap in try/catch
  • medium InputBoundary — src/server/routes/composition.jl — 6 JSON3.read/JSON.parse call(s) with 2 try block(s) in src/server/routes/composition.jl — these throw on malformed input; wrap in try/catch
  • medium InputBoundary — src/server/routes/studies.jl — 4 JSON3.read/JSON.parse call(s) with 2 try block(s) in src/server/routes/studies.jl — these throw on malformed input; wrap in try/catch
  • medium InputBoundary — src/server/routes/analysis.jl — 9 JSON3.read/JSON.parse call(s) with 4 try block(s) in src/server/routes/analysis.jl — these throw on malformed input; wrap in try/catch
  • medium UnsafeFFI — install.jl — 1 ccall/FFI calls in install.jl
  • medium ProofDrift — test/unit/test_occupancy_grade.jl — 2 `@test x isa Y` assertion(s) with no value check — type-only tests may substitute for an unwritten formal theorem in test/unit/test_occupancy_grade.jl
  • medium ProofDrift — test/unit/test_evidence.jl — 1 `@test x isa Y` assertion(s) with no value check — type-only tests may substitute for an unwritten formal theorem in test/unit/test_evidence.jl
  • medium InputBoundary — bench/advanced_zero_handling/benchmark.jl — 1 JSON3.read/JSON.parse call(s) with 0 try block(s) in bench/advanced_zero_handling/benchmark.jl — these throw on malformed input; wrap in try/catch
  • medium InputBoundary — frontend/src/figure/charts.ts — 1 JSON.parse call(s) with 0 try block(s) in frontend/src/figure/charts.ts — JSON.parse throws SyntaxError on malformed input; wrap in try-catch
  • medium InputBoundary — frontend/src/components/alphaMetrics.tsx — 1 JSON.parse call(s) with 0 try block(s) in frontend/src/components/alphaMetrics.tsx — JSON.parse throws SyntaxError on malformed input; wrap in try-catch
pons asinorum: 1 finding(s)
  • medium unreachable-after-jump — ./frontend/src/components/PublicationTablesPanel.tsx:208 — statement is unreachable after an unconditional jump (T0, HEURISTIC)
rhodibot (RSR compliance): not_run — enrolled, but no report-back was received
  • 🟠 indeterminate: enrolled, but no report-back was received
panicbot (panic recovery, error handling): not_run — enrolled, but no report-back was received
  • 🟠 indeterminate: enrolled, but no report-back was received
echidnabot (formal verification: proofs/): not_run — enrolled, but no report-back was received
  • 🟠 indeterminate: enrolled, but no report-back was received
seambot (integration health: API routes): not_run — enrolled, but no report-back was received
  • 🟠 indeterminate: enrolled, but no report-back was received
finishingbot (release readiness): not_run — enrolled, but no report-back was received
  • 🟠 indeterminate: enrolled, but no report-back was received
accessibilitybot (WCAG on the React UI): not_run — enrolled, but no report-back was received
  • 🟠 indeterminate: enrolled, but no report-back was received
glambot (presentation quality): not_run — enrolled, but no report-back was received
  • 🟠 indeterminate: enrolled, but no report-back was received
cipherbot: not_applicable — no cryptography is implemented in this repository
  • ⚪ not applicable: no cryptography is implemented in this repository
sustainabot: not_applicable — fleet adapter slot reserved; no adapter exists yet (gitbot-fleet README)
  • ⚪ not applicable: fleet adapter slot reserved; no adapter exists yet (gitbot-fleet README)

Scope: static findings reported by each row's tool at the named commit. Purple, red, yellow and blue grade the worst finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run.

Comment thread .github/workflows/scorecard.yml
@coderabbitai
coderabbitai Bot requested a review from JoshuaJewell October 23, 2026 16:13
hyperpolymath and others added 3 commits October 23, 2026 16:21
Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
@sonarqubecloud

Copy link
Copy Markdown

@hyperpolymath
hyperpolymath merged commit b656d2a into main Oct 23, 2026
23 checks passed
@hyperpolymath
hyperpolymath deleted the arena/2adadc5d-metamanifold-webui branch October 23, 2026 16:46
hyperpolymath added a commit that referenced this pull request Oct 23, 2026
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
hyperpolymath added a commit that referenced this pull request Oct 23, 2026
## Scope
Security/governance follow-up to #227. All four Codex findings on that
old PR already landed in #229/#234 and follow-ups; I answered/resolved
its threads and closed it as superseded, rather than merging a
conflicting branch that could undo newer fixes. CodeRabbit's remaining
notices are account limits/billing, not code questions.

## Changes
- Add pinned, least-privileged full-history/working-tree secret scanning
and default-branch Scorecard publication; no inherited secrets or new
alert suppressions.
- Add Dependabot, SECURITY.md, editor settings and a repository-specific
AI manifest without changing existing licensing/architecture.
- Add independent pinned K9 conformance and its artifact to the PR
verdict. The current empty corpus is explicitly grey, not a semantic
pass. Missing semantic evidence fails closed. Keep DEED syntax and
advisory Hypatia as separate evidence families.
- Bound Julia CI at 90 minutes and preserve producer **and** log-writer
failures. Add 8 negative/mutation tests and 4 exit-combination tests.
- Refresh the bun lockfile within current major ranges for real security
advisories, notably DOMPurify, Vite and transitive build dependencies;
raise minimum Vite to 6.4.5 and Router DOM to 6.30.6. This is why the
lockfile changes. No generated assets are included.
- Audit high/critical frontend dependencies in CI.

## Verification
Bun **1.3.10**: frozen install, TypeScript checking, **72 frontend tests
/ 200 assertions**, production build, and high/critical audit pass. Full
audit reduced from **31 advisories (1 critical, 13 high, 14 moderate, 3
low) to 2 moderate Router advisories**. This is not a zero-vulnerability
claim.

Canonical pinned DEED lint, all 39 governance contract checks, 8
weakening mutations, 4 pipeline-exit combinations, unique-key YAML
parsing, all embedded shell syntax, Sonar reliability lint, proof axiom
audit (7 modules), and git diff checks pass locally.

Julia/R/Agda/Nickel are not installed in this sandbox; hosted CI must
supply those results. No local runtime/semantic pass is claimed.

## Hosted wrapper fixes
The first run found two issues in the pinned standards wrappers.
Fork-local copies retain the same immutable standards
validator/renderer/config sources and all gates, but fix the terminal
optional-log copy for an empty K9 corpus and upgrade Gitleaks from
8.18.4 to 8.30.1 (upstream release-asset digest). The old rules falsely
matched historical DNA/FASTQ and schema labels; no history exclusions or
local rule suppressions were added. A synthetic AWS credential must
still fail in CI. Three K9 copy cases and a credential-sensitivity test
also pass locally. Hosted checks are rerunning.

## Remaining / intentionally not done
See `docs/release-notes/2026-10-23-governance-security.md` for the
source Hypatia run and complete triage. Two moderate React Router
advisories need a v7 migration review. Estate language bans conflict
with the settled React/TS stack and independent Python reference
oracles; W3C SVG namespace URIs are not HTTP requests. Do not fix those
by rewriting the architecture or breaking namespaces. No configured
mirror target exists. Existing upstream licensing headers remain
protected. Fleet bots without report-backs remain not_run. No fake
conformance reports have been added.

The integration returns 403 for code-scanning/Dependabot alert listing
and the sandbox blocks Actions artifact/log storage hosts; no alerts
have been dismissed. Published grids/check APIs are still readable.
Scorecard's default-branch publication can only be verified after
landing; K9 has no committed contracts and therefore cannot claim
substantive contract coverage yet.


## PR #228 security follow-up (`1be406d`)
Independent verification found that the recorded conflict-resolution
tree for #228 is identical to main; #228 is being closed as superseded,
not conflict-merged. Its valid leaf-PD finding is already implemented in
**unmerged** #242/#244 and is not duplicated here. #242's integration
run 39986326202 passed all six jobs; #244's Julia validation remains
pending at review time.

The R-evaluation warning was not dismissed as a language-detector false
positive. This follow-up validates metadata column identifiers before
they enter PERMANOVA's parsed R formula and validates package names
before provenance interpolates them into R source. Expressions,
quotes/escapes, controls and reserved formula terms are covered by
regression cases. Plain identifiers preserve the existing formula and
scientific tests; non-identifier metadata columns must be renamed, as
documented in the function contract.

Local verification for the new commit: 39 governance assertions, 8
weakening mutations, 3 K9 copy cases, 4 CI logging cases,
scanner-boundary tests, complete working-tree/history shell scanning,
git diff checks and syntax parsing of all four changed Julia files pass.
**Syntax parsing is not execution**: the new Julia/R regressions await
hosted CI. This does not certify all remaining R call sites or dismiss
outstanding advisory findings.

### Main advanced during review
#242 has now merged as `b656d2a99e53267108d51ad87d7eaee13222d368`
(16:46:42 UTC), after its full integration suite passed. The leaf-PD fix
is therefore on main. #228 is confirmed closed/unmerged. This PR (#243)
now has conflicts with the newly updated main and is **not
merge-ready**; no main-merge commit or unrequested history rewrite has
been made. The new R-boundary/scanner tests are running at `1be406d`;
earlier passing checks must not be mistaken for validation of a future
rebased head.

---------

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
hyperpolymath added a commit that referenced this pull request Oct 23, 2026
…I workflow

- Read req.body non-destructively in _statistics_body via copy(req.body),
  enforce MAX_STATISTICS_REQUEST_BYTES using UTF-8 byte length (ncodeunits)
  when req.body is already an AbstractString, and accept generic
  AbstractString payloads (e.g. SubString).
- Add regression tests in test_validated_statistics.jl covering repeated
  reads of the same HTTP.Request, multibyte UTF-8 size limits, and
  SubString payloads.
- Remove the duplicate timeout-minutes key in .github/workflows/ci.yml
  introduced by the PR #242/#243 merge, run validated_statistics first
  within the fast pre-flight CI step, and SHA-pin actions/checkout in
  .github/workflows/doi.yml.

Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
hyperpolymath added a commit that referenced this pull request Oct 23, 2026
Main moved while this branch was in review: #242 made tree path building
linear in `TreeShapes.tsx`, and #243 taught the cladistics builder the
node-local subtree-PD convention. Both are the fixes this branch carried,
so the merge keeps main's implementation and drops the duplicates rather
than shipping two spellings of the same change.

What remains branch-specific is what main does not have yet: the
`_request_json` guard for malformed bodies (and its Oxygen serializer
hook), the report-backs directory the deed declares, and the two type-only
test assertions panic-attack flagged.

Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants