tmp: RSR oracle compile repro (delete after use)

Temporary issue used to relay CI compile output into an API-readable channel (GitHub log blobs are unreachable from the sandbox). Will be closed after the investigation.

Oracle repro — Elixir 1.19.4 / OTP 28.3

elixir/otp: 1.19.4 / 28.3
runner: Ubuntu 26.04.1 LTS
pr head sha: a6ac05447898910c3d8fbe8ef3cfc8d3ca638c0c
===== mix deps.get =====
** (Mix) Could not find a Mix.Project, please ensure you are running Mix in a directory with a mix.exs file
deps_get_exit=1
===== mix compile =====
** (Mix) Could not find a Mix.Project, please ensure you are running Mix in a directory with a mix.exs file
compile_exit=1

Oracle repro — Elixir 1.19.4 / OTP 27.3

elixir/otp: 1.19.4 / 27.3
runner: Ubuntu 26.04.1 LTS
pr head sha: a6ac05447898910c3d8fbe8ef3cfc8d3ca638c0c
===== mix deps.get =====
** (Mix) Could not find a Mix.Project, please ensure you are running Mix in a directory with a mix.exs file
deps_get_exit=1
===== mix compile =====
** (Mix) Could not find a Mix.Project, please ensure you are running Mix in a directory with a mix.exs file
compile_exit=1

Oracle repro — Elixir 1.19.4 / OTP 28.3

elixir/otp: 1.19.4 / 28.3
runner: Ubuntu 26.04.1 LTS
pr head sha: 7533f9eacbdd78ae3b2263eff570de69c565b6b1
mix.exs elixir constraint: elixir: "~> 1.14"
os: Linux runnervmr9t6g 7.0.0-1017-azure #17-Ubuntu SMP PREEMPT Thu Sep 24 15:54:51 UTC 2026 x86_64 GNU/Linux
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.026s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-19-otp-28/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
==> hypatia
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
     error: cannot invoke remote function :erlang.=:=/2 inside a match
     │
 170 │           version in @supported_versions ->
     │           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     │
     └─ lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3


== Compilation error in file lib/rules/actions_lock.ex ==
** (CompileError) lib/rules/actions_lock.ex: cannot compile module Hypatia.Rules.ActionsLock (errors have been logged)
    (elixir 1.19.4) expanding macro: Kernel.in/2
    lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3
compile_exit=1
===== mix compile (second pass, deps compiled) =====
Compiling 142 files (.ex)
     error: cannot invoke remote function :erlang.=:=/2 inside a match
     │
 170 │           version in @supported_versions ->
     │           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     │
     └─ lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3


== Compilation error in file lib/rules/actions_lock.ex ==
** (CompileError) lib/rules/actions_lock.ex: cannot compile module Hypatia.Rules.ActionsLock (errors have been logged)
    (elixir 1.19.4) expanding macro: Kernel.in/2
    lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3
compile_exit2=1
===== mix compile --warnings-as-errors =====
Compiling 142 files (.ex)
     error: cannot invoke remote function :erlang.=:=/2 inside a match
     │
 170 │           version in @supported_versions ->
     │           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     │
     └─ lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3


== Compilation error in file lib/rules/actions_lock.ex ==
** (CompileError) lib/rules/actions_lock.ex: cannot compile module Hypatia.Rules.ActionsLock (errors have been logged)
    (elixir 1.19.4) expanding macro: Kernel.in/2
    lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3
warnings_as_errors_exit=1
===== MIX_ENV=test mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
==> hypatia
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
Generated phoenix app
==> hypatia
Compiling 143 files (.ex)
     error: cannot invoke remote function :erlang.=:=/2 inside a match
     │
 170 │           version in @supported_versions ->
     │           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     │
     └─ lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3


== Compilation error in file lib/rules/actions_lock.ex ==
** (CompileError) lib/rules/actions_lock.ex: cannot compile module Hypatia.Rules.ActionsLock (errors have been logged)
    (elixir 1.19.4) expanding macro: Kernel.in/2
    lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3
test_compile_exit=1

Oracle repro — Elixir 1.19.4 / OTP 27.3

elixir/otp: 1.19.4 / 27.3
runner: Ubuntu 26.04.1 LTS
pr head sha: 7533f9eacbdd78ae3b2263eff570de69c565b6b1
mix.exs elixir constraint: elixir: "~> 1.14"
os: Linux runnervmr9t6g 7.0.0-1017-azure #17-Ubuntu SMP PREEMPT Thu Sep 24 15:54:51 UTC 2026 x86_64 GNU/Linux
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.017s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-19-otp-27/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
==> hypatia
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
     error: cannot invoke remote function :erlang.=:=/2 inside a match
     │
 170 │           version in @supported_versions ->
     │           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     │
     └─ lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3


== Compilation error in file lib/rules/actions_lock.ex ==
** (CompileError) lib/rules/actions_lock.ex: cannot compile module Hypatia.Rules.ActionsLock (errors have been logged)
    (elixir 1.19.4) expanding macro: Kernel.in/2
    lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3
compile_exit=1
===== mix compile (second pass, deps compiled) =====
Compiling 142 files (.ex)
     error: cannot invoke remote function :erlang.=:=/2 inside a match
     │
 170 │           version in @supported_versions ->
     │           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     │
     └─ lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3


== Compilation error in file lib/rules/actions_lock.ex ==
** (CompileError) lib/rules/actions_lock.ex: cannot compile module Hypatia.Rules.ActionsLock (errors have been logged)
    (elixir 1.19.4) expanding macro: Kernel.in/2
    lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3
compile_exit2=1
===== mix compile --warnings-as-errors =====
Compiling 142 files (.ex)
     error: cannot invoke remote function :erlang.=:=/2 inside a match
     │
 170 │           version in @supported_versions ->
     │           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     │
     └─ lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3


== Compilation error in file lib/rules/actions_lock.ex ==
** (CompileError) lib/rules/actions_lock.ex: cannot compile module Hypatia.Rules.ActionsLock (errors have been logged)
    (elixir 1.19.4) expanding macro: Kernel.in/2
    lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3
warnings_as_errors_exit=1
===== MIX_ENV=test mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
==> hypatia
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
Generated phoenix app
==> hypatia
Compiling 143 files (.ex)
     error: cannot invoke remote function :erlang.=:=/2 inside a match
     │
 170 │           version in @supported_versions ->
     │           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     │
     └─ lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3


== Compilation error in file lib/rules/actions_lock.ex ==
** (CompileError) lib/rules/actions_lock.ex: cannot compile module Hypatia.Rules.ActionsLock (errors have been logged)
    (elixir 1.19.4) expanding macro: Kernel.in/2
    lib/rules/actions_lock.ex:170: Hypatia.Rules.ActionsLock.consume_line/3
test_compile_exit=1

Verify — Elixir 1.17.3 / OTP 27.0

elixir/otp: 1.17.3 / 27.0
sha: abd8faffb889b09a87da1094c0a3d5a95ae87470
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.022s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-17/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
     warning: this check/guard will always yield the same result
     │
 301 │     if @requires_consolidation && config[:consolidate_protocols] do
     │     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:301

     warning: this check/guard will always yield the same result
     │
 414 │       @requires_consolidation && status == :ok && config[:consolidate_protocols] ->
     │       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:414

Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
     warning: undefined module attribute @hostname, please remove access to @hostname or explicitly set it before access
     │
 266 │           Regex.match?(@hostname, hostname) ->
     │           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/rules/actions_lock.ex:266: Hypatia.Rules.ActionsLock (module)

     warning: key :hostname will be overridden in map
     │
 406 │       stored = %{
     │                ~
     │
     └─ lib/rules/actions_lock.ex:406:16

     warning: variable "hostname" is unused (if the variable is not meant to be used, prefix it with an underscore)
     │
 390 │     hostname = Map.get(dependency, :hostname)
     │     ~~~~~~~~
     │
     └─ lib/rules/actions_lock.ex:390:5: Hypatia.Rules.ActionsLock.finalize_dependency/1

Generated hypatia app
compile_exit=0
===== mix compile --warnings-as-errors (clean) =====
     warning: undefined module attribute @hostname, please remove access to @hostname or explicitly set it before access
     │
 266 │           Regex.match?(@hostname, hostname) ->
     │           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/rules/actions_lock.ex:266: Hypatia.Rules.ActionsLock (module)

     warning: key :hostname will be overridden in map
     │
 406 │       stored = %{
     │                ~
     │
     └─ lib/rules/actions_lock.ex:406:16

     warning: variable "hostname" is unused (if the variable is not meant to be used, prefix it with an underscore)
     │
 390 │     hostname = Map.get(dependency, :hostname)
     │     ~~~~~~~~
     │
     └─ lib/rules/actions_lock.ex:390:5: Hypatia.Rules.ActionsLock.finalize_dependency/1

Compilation failed due to warnings while using the --warnings-as-errors option
warnings_as_errors_exit=1
===== mix test (targeted) =====
     code:  assert parsed.dependencies["actions/checkout@v7.0.1"].hostname == "github.com"
     left:  nil
     right: "github.com"
     stacktrace:
       test/rules/actions_lock_test.exs:605: (test)

.

  7) test v0.0.3 hostname field v0.0.2 lockfiles default to github.com and may not carry a hostname (Hypatia.Rules.ActionsLockTest)
     test/rules/actions_lock_test.exs:616
     Assertion with == failed
     code:  assert parsed.dependencies["actions/checkout@v7.0.1"].hostname == "github.com"
     left:  nil
     right: "github.com"
     stacktrace:
       test/rules/actions_lock_test.exs:618: (test)

......
Finished in 0.2 seconds (0.2s async, 0.00s sync)
41 tests, 7 failures
test_exit=0
===== mix test rsr_conformance =====
19:37:29.851 [info] LearningScheduler started. Polling every 300s.

19:37:29.851 [info] SelfDiagnostics started. Health checks every 10 min.

19:37:29.851 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:37:29.857 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:37:29.863 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:37:29.864 [info] Kin.Contingency started -- emergency level: :normal

19:37:29.864 [info] Kin.Arbiter started -- bot conflict resolution active.

19:37:29.864 [info] Kin.Gate started -- all bot actions require Gate approval.

19:37:29.864 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:37:29.864 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

............
Finished in 1.4 seconds (1.4s async, 0.00s sync)
12 tests, 0 failures
rsr_test_exit=0
===== consumer oracle invocation (explicit SSOT) =====
     │
     └─ lib/rules/actions_lock.ex:406:16

     warning: variable "hostname" is unused (if the variable is not meant to be used, prefix it with an underscore)
     │
 390 │     hostname = Map.get(dependency, :hostname)
     │     ~~~~~~~~
     │
     └─ lib/rules/actions_lock.ex:390:5: Hypatia.Rules.ActionsLock.finalize_dependency/1

Generated hypatia app
RSR v2.0 scorecard — src  (spec 2.0.0-draft)
  tier=bronze  score=83.58%  coverage=73%  provisional=true  profile=false
  verdicts: pass=30  partial=0  fail=6  unverified=13  na=26
  failing (applicable): 1.2.4, 2.1.4, 2.2.1, 3.1.8, 3.2.2, 5.1.1
oracle_exit=0

Verify — Elixir 1.19.4 / OTP 28.3

elixir/otp: 1.19.4 / 28.3
sha: abd8faffb889b09a87da1094c0a3d5a95ae87470
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.023s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-19-otp-28/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
==> hypatia
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
     warning: undefined module attribute @hostname, please remove access to @hostname or explicitly set it before access
     │
 266 │           Regex.match?(@hostname, hostname) ->
     │           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/rules/actions_lock.ex:266: Hypatia.Rules.ActionsLock (module)

     warning: key :hostname will be overridden in map
     │
 406 │       stored = %{
     │                ~
     │
     └─ lib/rules/actions_lock.ex:406:16

     warning: variable "hostname" is unused (if the variable is not meant to be used, prefix it with an underscore)
     │
 390 │     hostname = Map.get(dependency, :hostname)
     │     ~~~~~~~~
     │
     └─ lib/rules/actions_lock.ex:390:5: Hypatia.Rules.ActionsLock.finalize_dependency/1

     warning: incompatible types given to Regex.match?/2:

         Regex.match?(nil, hostname)

     given types:

         -nil-, dynamic()

     but expected one of:

         dynamic(%Regex{}), dynamic()

     where "hostname" was given the type:

         # type: dynamic()
         # from: lib/rules/actions_lock.ex:260:23
         [_, hostname] = match

     typing violation found at:
     │
 266 │           Regex.match?(@hostname, hostname) ->
     │                 ~
     │
     └─ lib/rules/actions_lock.ex:266:17: Hypatia.Rules.ActionsLock.consume_line/3

Generated hypatia app
compile_exit=0
===== mix compile --warnings-as-errors (clean) =====
     warning: undefined module attribute @hostname, please remove access to @hostname or explicitly set it before access
     │
 266 │           Regex.match?(@hostname, hostname) ->
     │           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/rules/actions_lock.ex:266: Hypatia.Rules.ActionsLock (module)

     warning: key :hostname will be overridden in map
     │
 406 │       stored = %{
     │                ~
     │
     └─ lib/rules/actions_lock.ex:406:16

     warning: variable "hostname" is unused (if the variable is not meant to be used, prefix it with an underscore)
     │
 390 │     hostname = Map.get(dependency, :hostname)
     │     ~~~~~~~~
     │
     └─ lib/rules/actions_lock.ex:390:5: Hypatia.Rules.ActionsLock.finalize_dependency/1

     warning: incompatible types given to Regex.match?/2:

         Regex.match?(nil, hostname)

     given types:

         -nil-, dynamic()

     but expected one of:

         dynamic(%Regex{}), dynamic()

     where "hostname" was given the type:

         # type: dynamic()
         # from: lib/rules/actions_lock.ex:260:23
         [_, hostname] = match

     typing violation found at:
     │
 266 │           Regex.match?(@hostname, hostname) ->
     │                 ~
     │
     └─ lib/rules/actions_lock.ex:266:17: Hypatia.Rules.ActionsLock.consume_line/3

Compilation failed due to warnings while using the --warnings-as-errors option
warnings_as_errors_exit=1
===== mix test (targeted) =====
     code:  assert parsed.dependencies["actions/checkout@v7.0.1"].hostname == "github.com"
     left:  nil
     right: "github.com"
     stacktrace:
       test/rules/actions_lock_test.exs:605: (test)

.

  7) test v0.0.3 hostname field v0.0.2 lockfiles default to github.com and may not carry a hostname (Hypatia.Rules.ActionsLockTest)
     test/rules/actions_lock_test.exs:616
     Assertion with == failed
     code:  assert parsed.dependencies["actions/checkout@v7.0.1"].hostname == "github.com"
     left:  nil
     right: "github.com"
     stacktrace:
       test/rules/actions_lock_test.exs:618: (test)

......
Finished in 0.3 seconds (0.3s async, 0.00s sync)
41 tests, 7 failures
test_exit=0
===== mix test rsr_conformance =====
19:37:48.721 [info] LearningScheduler started. Polling every 300s.

19:37:48.721 [info] SelfDiagnostics started. Health checks every 10 min.

19:37:48.721 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:37:48.730 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:37:48.737 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:37:48.738 [info] Kin.Contingency started -- emergency level: :normal

19:37:48.738 [info] Kin.Arbiter started -- bot conflict resolution active.

19:37:48.739 [info] Kin.Gate started -- all bot actions require Gate approval.

19:37:48.739 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:37:48.739 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

............
Finished in 2.3 seconds (2.3s async, 0.00s sync)
12 tests, 0 failures
rsr_test_exit=0
===== consumer oracle invocation (explicit SSOT) =====
         # from: lib/rules/actions_lock.ex:260:23
         [_, hostname] = match

     typing violation found at:
     │
 266 │           Regex.match?(@hostname, hostname) ->
     │                 ~
     │
     └─ lib/rules/actions_lock.ex:266:17: Hypatia.Rules.ActionsLock.consume_line/3

Generated hypatia app
RSR v2.0 scorecard — src  (spec 2.0.0-draft)
  tier=bronze  score=83.58%  coverage=73%  provisional=true  profile=false
  verdicts: pass=30  partial=0  fail=6  unverified=13  na=26
  failing (applicable): 1.2.4, 2.1.4, 2.2.1, 3.1.8, 3.2.2, 5.1.1
oracle_exit=0

Verify — Elixir 1.17.3 / OTP 27.0

elixir/otp: 1.17.3 / 27.0
sha: 086f2caf3d2bd20e4c81f88f3c876a4486c37214
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.022s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-17/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
     warning: this check/guard will always yield the same result
     │
 301 │     if @requires_consolidation && config[:consolidate_protocols] do
     │     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:301

     warning: this check/guard will always yield the same result
     │
 414 │       @requires_consolidation && status == :ok && config[:consolidate_protocols] ->
     │       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:414

Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
Generated hypatia app
compile_exit=0
===== mix compile --warnings-as-errors (clean) =====
warnings_as_errors_exit=0
===== mix test (targeted) =====
     right: {:error,
             {:line, 13,
              {:unsupported_dependency_hostname, "acme.ghe.com"}}}
     stacktrace:
       test/rules/actions_lock_test.exs:469: (test)



  7) test scopes owner and repository identities to their v0.0.3 host (Hypatia.Rules.ActionsLockTest)
     test/rules/actions_lock_test.exs:506
     Assertion with == failed
     code:  assert lock.dependencies["acme/foo@v1"].hostname == nil
     left:  "github.com"
     right: nil
     stacktrace:
       test/rules/actions_lock_test.exs:529: (test)

............
Finished in 0.3 seconds (0.3s async, 0.00s sync)
41 tests, 7 failures
test_exit=0
===== mix test rsr_conformance =====
19:40:52.208 [info] LearningScheduler started. Polling every 300s.

19:40:52.208 [info] SelfDiagnostics started. Health checks every 10 min.

19:40:52.209 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:40:52.216 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:40:52.224 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:40:52.225 [info] Kin.Contingency started -- emergency level: :normal

19:40:52.225 [info] Kin.Arbiter started -- bot conflict resolution active.

19:40:52.225 [info] Kin.Gate started -- all bot actions require Gate approval.

19:40:52.225 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:40:52.225 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

............
Finished in 1.9 seconds (1.9s async, 0.00s sync)
12 tests, 0 failures
rsr_test_exit=0
===== consumer oracle invocation (explicit SSOT) =====
RSR v2.0 scorecard — src  (spec 2.0.0-draft)
  tier=bronze  score=83.58%  coverage=73%  provisional=true  profile=false
  verdicts: pass=30  partial=0  fail=6  unverified=13  na=26
  failing (applicable): 1.2.4, 2.1.4, 2.2.1, 3.1.8, 3.2.2, 5.1.1
oracle_exit=0

Verify — Elixir 1.19.4 / OTP 28.3

elixir/otp: 1.19.4 / 28.3
sha: 086f2caf3d2bd20e4c81f88f3c876a4486c37214
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.03s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-19-otp-28/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
==> hypatia
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
Generated hypatia app
compile_exit=0
===== mix compile --warnings-as-errors (clean) =====
warnings_as_errors_exit=0
===== mix test (targeted) =====
     right: {:error,
             {:line, 13,
              {:unsupported_dependency_hostname, "acme.ghe.com"}}}
     stacktrace:
       test/rules/actions_lock_test.exs:469: (test)



  7) test scopes owner and repository identities to their v0.0.3 host (Hypatia.Rules.ActionsLockTest)
     test/rules/actions_lock_test.exs:506
     Assertion with == failed
     code:  assert lock.dependencies["acme/foo@v1"].hostname == nil
     left:  "github.com"
     right: nil
     stacktrace:
       test/rules/actions_lock_test.exs:529: (test)

............
Finished in 0.3 seconds (0.3s async, 0.00s sync)
41 tests, 7 failures
test_exit=0
===== mix test rsr_conformance =====
19:40:59.163 [info] LearningScheduler started. Polling every 300s.

19:40:59.163 [info] SelfDiagnostics started. Health checks every 10 min.

19:40:59.163 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:40:59.173 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:40:59.182 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:40:59.183 [info] Kin.Contingency started -- emergency level: :normal

19:40:59.183 [info] Kin.Arbiter started -- bot conflict resolution active.

19:40:59.183 [info] Kin.Gate started -- all bot actions require Gate approval.

19:40:59.183 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:40:59.183 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

............
Finished in 2.2 seconds (2.2s async, 0.00s sync)
12 tests, 0 failures
rsr_test_exit=0
===== consumer oracle invocation (explicit SSOT) =====
RSR v2.0 scorecard — src  (spec 2.0.0-draft)
  tier=bronze  score=83.58%  coverage=73%  provisional=true  profile=false
  verdicts: pass=30  partial=0  fail=6  unverified=13  na=26
  failing (applicable): 1.2.4, 2.1.4, 2.2.1, 3.1.8, 3.2.2, 5.1.1
oracle_exit=0

Verify — Elixir 1.17.3 / OTP 27.0

elixir/otp: 1.17.3 / 27.0
sha: c617b32800695107d54595b7223ae6e074638711
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.016s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-17/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
     warning: this check/guard will always yield the same result
     │
 301 │     if @requires_consolidation && config[:consolidate_protocols] do
     │     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:301

     warning: this check/guard will always yield the same result
     │
 414 │       @requires_consolidation && status == :ok && config[:consolidate_protocols] ->
     │       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:414

Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
Generated hypatia app
compile_exit=0
===== mix compile --warnings-as-errors (clean) =====
warnings_as_errors_exit=0
===== mix test (targeted) =====
     right: {:error,
             {:line, 13,
              {:unsupported_dependency_hostname, "octocorp.ghe.com"}}}
     stacktrace:
       test/rules/actions_lock_test.exs:231: (test)



  3) test format v0.0.3 refuses a malformed, repeated, or v0.0.2 hostname (Hypatia.Rules.ActionsLockTest)
     test/rules/actions_lock_test.exs:235
     match (=) failed
     code:  assert {:error, {:line, _, {:hostname_requires_v0_0_3, "v0.0.2"}}} = ActionsLock.parse(v2)
     left:  {:error, {:line, _, {:hostname_requires_v0_0_3, "v0.0.2"}}}
     right: {:error, {:line, 11, {:hostname_not_in_version, "v0.0.2"}}}
     stacktrace:
       test/rules/actions_lock_test.exs:267: (test)

......................
Finished in 0.1 seconds (0.1s async, 0.00s sync)
41 tests, 3 failures
test_exit=0
===== mix test rsr_conformance =====
19:44:00.879 [info] LearningScheduler started. Polling every 300s.

19:44:00.880 [info] SelfDiagnostics started. Health checks every 10 min.

19:44:00.880 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:44:00.884 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:44:00.889 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:44:00.890 [info] Kin.Contingency started -- emergency level: :normal

19:44:00.890 [info] Kin.Arbiter started -- bot conflict resolution active.

19:44:00.890 [info] Kin.Gate started -- all bot actions require Gate approval.

19:44:00.890 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:44:00.890 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

............
Finished in 1.1 seconds (1.1s async, 0.00s sync)
12 tests, 0 failures
rsr_test_exit=0
===== consumer oracle invocation (explicit SSOT) =====
RSR v2.0 scorecard — src  (spec 2.0.0-draft)
  tier=bronze  score=83.58%  coverage=73%  provisional=true  profile=false
  verdicts: pass=30  partial=0  fail=6  unverified=13  na=26
  failing (applicable): 1.2.4, 2.1.4, 2.2.1, 3.1.8, 3.2.2, 5.1.1
oracle_exit=0

Verify — Elixir 1.19.4 / OTP 28.3

elixir/otp: 1.19.4 / 28.3
sha: c617b32800695107d54595b7223ae6e074638711
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.017s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-19-otp-28/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
==> hypatia
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
Generated hypatia app
compile_exit=0
===== mix compile --warnings-as-errors (clean) =====
warnings_as_errors_exit=0
===== mix test (targeted) =====
     right: {:error,
             {:line, 13,
              {:unsupported_dependency_hostname, "octocorp.ghe.com"}}}
     stacktrace:
       test/rules/actions_lock_test.exs:231: (test)



  3) test format v0.0.3 refuses a malformed, repeated, or v0.0.2 hostname (Hypatia.Rules.ActionsLockTest)
     test/rules/actions_lock_test.exs:235
     match (=) failed
     code:  assert {:error, {:line, _, {:hostname_requires_v0_0_3, "v0.0.2"}}} = ActionsLock.parse(v2)
     left:  {:error, {:line, _, {:hostname_requires_v0_0_3, "v0.0.2"}}}
     right: {:error, {:line, 11, {:hostname_not_in_version, "v0.0.2"}}}
     stacktrace:
       test/rules/actions_lock_test.exs:267: (test)

......................
Finished in 0.2 seconds (0.2s async, 0.00s sync)
41 tests, 3 failures
test_exit=0
===== mix test rsr_conformance =====
19:44:09.163 [info] LearningScheduler started. Polling every 300s.

19:44:09.163 [info] SelfDiagnostics started. Health checks every 10 min.

19:44:09.163 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:44:09.169 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:44:09.175 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:44:09.176 [info] Kin.Contingency started -- emergency level: :normal

19:44:09.176 [info] Kin.Arbiter started -- bot conflict resolution active.

19:44:09.176 [info] Kin.Gate started -- all bot actions require Gate approval.

19:44:09.176 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:44:09.176 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

............
Finished in 1.3 seconds (1.3s async, 0.00s sync)
12 tests, 0 failures
rsr_test_exit=0
===== consumer oracle invocation (explicit SSOT) =====
RSR v2.0 scorecard — src  (spec 2.0.0-draft)
  tier=bronze  score=83.58%  coverage=73%  provisional=true  profile=false
  verdicts: pass=30  partial=0  fail=6  unverified=13  na=26
  failing (applicable): 1.2.4, 2.1.4, 2.2.1, 3.1.8, 3.2.2, 5.1.1
oracle_exit=0

Verify — Elixir 1.17.3 / OTP 27.0

elixir/otp: 1.17.3 / 27.0
sha: 9f10aae62f7b08141121af6bead6fe20a17cbf40
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.024s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-17/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
     warning: this check/guard will always yield the same result
     │
 301 │     if @requires_consolidation && config[:consolidate_protocols] do
     │     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:301

     warning: this check/guard will always yield the same result
     │
 414 │       @requires_consolidation && status == :ok && config[:consolidate_protocols] ->
     │       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:414

Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
Generated hypatia app
compile_exit=0
===== mix compile --warnings-as-errors (clean) =====
warnings_as_errors_exit=0
===== mix test (targeted) =====
19:44:18.891 [info] SelfDiagnostics started. Health checks every 10 min.

19:44:18.891 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:44:18.891 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:44:18.894 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:44:18.894 [info] Kin.Contingency started -- emergency level: :normal

19:44:18.894 [info] Kin.Arbiter started -- bot conflict resolution active.

19:44:18.894 [info] Kin.Gate started -- all bot actions require Gate approval.

19:44:18.894 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:44:18.894 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

................

  1) test format v0.0.3 accepts and records the optional dependency hostname (GHE.com pins) (Hypatia.Rules.ActionsLockTest)
     test/rules/actions_lock_test.exs:182
     match (=) failed
     code:  assert {:ok, parsed} = ActionsLock.parse(tenant)
     left:  {:ok, parsed}
     right: {:error,
             {:line, 11,
              {:unsupported_dependency_hostname, "octocorp.ghe.com"}}}
     stacktrace:
       test/rules/actions_lock_test.exs:195: (test)



  2) test format v0.0.3 scopes owner/repo identity checks to the dependency's host (Hypatia.Rules.ActionsLockTest)
     test/rules/actions_lock_test.exs:202
     match (=) failed
     code:  assert {:ok, parsed} = ActionsLock.parse(cross_host)
     left:  {:ok, parsed}
     right: {:error,
             {:line, 13,
              {:unsupported_dependency_hostname, "octocorp.ghe.com"}}}
     stacktrace:
       test/rules/actions_lock_test.exs:231: (test)



  3) test format v0.0.3 refuses a malformed, repeated, or v0.0.2 hostname (Hypatia.Rules.ActionsLockTest)
     test/rules/actions_lock_test.exs:235
     match (=) failed
     code:  assert {:error, {:line, _, {:hostname_requires_v0_0_3, "v0.0.2"}}} = ActionsLock.parse(v2)
     left:  {:error, {:line, _, {:hostname_requires_v0_0_3, "v0.0.2"}}}
     right: {:error, {:line, 11, {:hostname_not_in_version, "v0.0.2"}}}
     stacktrace:
       test/rules/actions_lock_test.exs:267: (test)

......................
Finished in 0.3 seconds (0.3s async, 0.00s sync)
41 tests, 3 failures
test_exit=0
===== mix test rsr_conformance =====
19:44:19.851 [info] LearningScheduler started. Polling every 300s.

19:44:19.851 [info] SelfDiagnostics started. Health checks every 10 min.

19:44:19.851 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:44:19.857 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:44:19.864 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:44:19.865 [info] Kin.Contingency started -- emergency level: :normal

19:44:19.865 [info] Kin.Arbiter started -- bot conflict resolution active.

19:44:19.865 [info] Kin.Gate started -- all bot actions require Gate approval.

19:44:19.865 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:44:19.865 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

............
Finished in 1.6 seconds (1.6s async, 0.00s sync)
12 tests, 0 failures
rsr_test_exit=0
===== consumer oracle invocation (explicit SSOT) =====
RSR v2.0 scorecard — src  (spec 2.0.0-draft)
  tier=bronze  score=83.58%  coverage=73%  provisional=true  profile=false
  verdicts: pass=30  partial=0  fail=6  unverified=13  na=26
  failing (applicable): 1.2.4, 2.1.4, 2.2.1, 3.1.8, 3.2.2, 5.1.1
oracle_exit=0

Verify — Elixir 1.19.4 / OTP 28.3

elixir/otp: 1.19.4 / 28.3
sha: 9f10aae62f7b08141121af6bead6fe20a17cbf40
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.018s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-19-otp-28/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
==> hypatia
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
Generated hypatia app
compile_exit=0
===== mix compile --warnings-as-errors (clean) =====
warnings_as_errors_exit=0
===== mix test (targeted) =====
19:44:38.354 [info] SelfDiagnostics started. Health checks every 10 min.

19:44:38.354 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:44:38.357 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:44:38.360 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:44:38.361 [info] Kin.Contingency started -- emergency level: :normal

19:44:38.361 [info] Kin.Arbiter started -- bot conflict resolution active.

19:44:38.361 [info] Kin.Gate started -- all bot actions require Gate approval.

19:44:38.361 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:44:38.361 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

................

  1) test format v0.0.3 accepts and records the optional dependency hostname (GHE.com pins) (Hypatia.Rules.ActionsLockTest)
     test/rules/actions_lock_test.exs:182
     match (=) failed
     code:  assert {:ok, parsed} = ActionsLock.parse(tenant)
     left:  {:ok, parsed}
     right: {:error,
             {:line, 11,
              {:unsupported_dependency_hostname, "octocorp.ghe.com"}}}
     stacktrace:
       test/rules/actions_lock_test.exs:195: (test)



  2) test format v0.0.3 scopes owner/repo identity checks to the dependency's host (Hypatia.Rules.ActionsLockTest)
     test/rules/actions_lock_test.exs:202
     match (=) failed
     code:  assert {:ok, parsed} = ActionsLock.parse(cross_host)
     left:  {:ok, parsed}
     right: {:error,
             {:line, 13,
              {:unsupported_dependency_hostname, "octocorp.ghe.com"}}}
     stacktrace:
       test/rules/actions_lock_test.exs:231: (test)



  3) test format v0.0.3 refuses a malformed, repeated, or v0.0.2 hostname (Hypatia.Rules.ActionsLockTest)
     test/rules/actions_lock_test.exs:235
     match (=) failed
     code:  assert {:error, {:line, _, {:hostname_requires_v0_0_3, "v0.0.2"}}} = ActionsLock.parse(v2)
     left:  {:error, {:line, _, {:hostname_requires_v0_0_3, "v0.0.2"}}}
     right: {:error, {:line, 11, {:hostname_not_in_version, "v0.0.2"}}}
     stacktrace:
       test/rules/actions_lock_test.exs:267: (test)

......................
Finished in 0.2 seconds (0.2s async, 0.00s sync)
41 tests, 3 failures
test_exit=0
===== mix test rsr_conformance =====
19:44:39.252 [info] LearningScheduler started. Polling every 300s.

19:44:39.252 [info] SelfDiagnostics started. Health checks every 10 min.

19:44:39.252 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:44:39.258 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:44:39.265 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:44:39.266 [info] Kin.Contingency started -- emergency level: :normal

19:44:39.266 [info] Kin.Arbiter started -- bot conflict resolution active.

19:44:39.266 [info] Kin.Gate started -- all bot actions require Gate approval.

19:44:39.266 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:44:39.266 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

............
Finished in 1.7 seconds (1.7s async, 0.00s sync)
12 tests, 0 failures
rsr_test_exit=0
===== consumer oracle invocation (explicit SSOT) =====
RSR v2.0 scorecard — src  (spec 2.0.0-draft)
  tier=bronze  score=83.58%  coverage=73%  provisional=true  profile=false
  verdicts: pass=30  partial=0  fail=6  unverified=13  na=26
  failing (applicable): 1.2.4, 2.1.4, 2.2.1, 3.1.8, 3.2.2, 5.1.1
oracle_exit=0

Verify — Elixir 1.17.3 / OTP 27.0

elixir/otp: 1.17.3 / 27.0
sha: 3ad6ba5005f939597a08120dd43668ae6a0d07d7
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.02s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-17/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
     warning: this check/guard will always yield the same result
     │
 301 │     if @requires_consolidation && config[:consolidate_protocols] do
     │     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:301

     warning: this check/guard will always yield the same result
     │
 414 │       @requires_consolidation && status == :ok && config[:consolidate_protocols] ->
     │       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:414

Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
Generated hypatia app
compile_exit=0
===== mix compile --warnings-as-errors (clean) =====
warnings_as_errors_exit=0
===== mix test (targeted) =====
==> phoenix_template
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
==> jason
==> phoenix_pubsub
==> plug_crypto
==> hpax
==> plug
==> websock
==> bandit
==> websock_adapter
==> phoenix
     warning: this check/guard will always yield the same result
     │
 301 │     if @requires_consolidation && config[:consolidate_protocols] do
     │     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:301

     warning: this check/guard will always yield the same result
     │
 414 │       @requires_consolidation && status == :ok && config[:consolidate_protocols] ->
     │       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:414

==> hypatia

19:47:33.586 [info] Running Hypatia.Web.Router with Bandit 1.13.1 at 0.0.0.0:9099 (http)

19:47:33.596 [info] VCL Client initialized (built-in Elixir parser)

19:47:33.597 [info] Diagnostics monitor started - checking every 30s

19:47:33.608 [info] LearningScheduler started. Polling every 300s.

19:47:33.608 [info] SelfDiagnostics started. Health checks every 10 min.

19:47:33.608 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:47:33.608 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:47:33.611 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:47:33.611 [info] Kin.Contingency started -- emergency level: :normal

19:47:33.611 [info] Kin.Arbiter started -- bot conflict resolution active.

19:47:33.611 [info] Kin.Gate started -- all bot actions require Gate approval.

19:47:33.611 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:47:33.612 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

.........................................
Finished in 0.2 seconds (0.2s async, 0.00s sync)
41 tests, 0 failures
test_exit=0
===== mix test rsr_conformance =====
19:47:34.469 [info] LearningScheduler started. Polling every 300s.

19:47:34.470 [info] SelfDiagnostics started. Health checks every 10 min.

19:47:34.470 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:47:34.475 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:47:34.482 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:47:34.483 [info] Kin.Contingency started -- emergency level: :normal

19:47:34.483 [info] Kin.Arbiter started -- bot conflict resolution active.

19:47:34.483 [info] Kin.Gate started -- all bot actions require Gate approval.

19:47:34.483 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:47:34.483 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

............
Finished in 1.4 seconds (1.4s async, 0.00s sync)
12 tests, 0 failures
rsr_test_exit=0
===== consumer oracle invocation (explicit SSOT) =====
RSR v2.0 scorecard — src  (spec 2.0.0-draft)
  tier=bronze  score=83.58%  coverage=73%  provisional=true  profile=false
  verdicts: pass=30  partial=0  fail=6  unverified=13  na=26
  failing (applicable): 1.2.4, 2.1.4, 2.2.1, 3.1.8, 3.2.2, 5.1.1
oracle_exit=0

Verify — Elixir 1.19.4 / OTP 28.3

elixir/otp: 1.19.4 / 28.3
sha: 3ad6ba5005f939597a08120dd43668ae6a0d07d7
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.02s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-19-otp-28/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
==> hypatia
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
Generated hypatia app
compile_exit=0
===== mix compile --warnings-as-errors (clean) =====
warnings_as_errors_exit=0
===== mix test (targeted) =====
==> gen_stage
==> mime
==> jason
==> plug_crypto
==> hpax
==> phoenix_template
==> hypatia
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
==> phoenix_pubsub
==> plug
==> websock
==> bandit
==> websock_adapter
==> phoenix
==> hypatia

19:47:46.575 [info] Running Hypatia.Web.Router with Bandit 1.13.1 at 0.0.0.0:9099 (http)

19:47:46.577 [info] VCL Client initialized (built-in Elixir parser)

19:47:46.579 [info] Diagnostics monitor started - checking every 30s

19:47:46.582 [info] LearningScheduler started. Polling every 300s.

19:47:46.582 [info] SelfDiagnostics started. Health checks every 10 min.

19:47:46.582 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:47:46.585 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:47:46.588 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:47:46.589 [info] Kin.Contingency started -- emergency level: :normal

19:47:46.590 [info] Kin.Arbiter started -- bot conflict resolution active.

19:47:46.590 [info] Kin.Gate started -- all bot actions require Gate approval.

19:47:46.590 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:47:46.590 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

.........................................
Finished in 0.2 seconds (0.2s async, 0.00s sync)
41 tests, 0 failures
test_exit=0
===== mix test rsr_conformance =====
19:47:47.524 [info] LearningScheduler started. Polling every 300s.

19:47:47.524 [info] SelfDiagnostics started. Health checks every 10 min.

19:47:47.524 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:47:47.532 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:47:47.539 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:47:47.541 [info] Kin.Contingency started -- emergency level: :normal

19:47:47.541 [info] Kin.Arbiter started -- bot conflict resolution active.

19:47:47.541 [info] Kin.Gate started -- all bot actions require Gate approval.

19:47:47.541 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:47:47.541 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

............
Finished in 1.8 seconds (1.8s async, 0.00s sync)
12 tests, 0 failures
rsr_test_exit=0
===== consumer oracle invocation (explicit SSOT) =====
RSR v2.0 scorecard — src  (spec 2.0.0-draft)
  tier=bronze  score=83.58%  coverage=73%  provisional=true  profile=false
  verdicts: pass=30  partial=0  fail=6  unverified=13  na=26
  failing (applicable): 1.2.4, 2.1.4, 2.2.1, 3.1.8, 3.2.2, 5.1.1
oracle_exit=0

Verify — Elixir 1.19.4 / OTP 28.3

elixir/otp: 1.19.4 / 28.3
sha: b96d8aa93b308f462dba9350497fad476c155f71
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.02s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-19-otp-28/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
==> hypatia
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
Generated hypatia app
compile_exit=0
===== mix compile --warnings-as-errors (clean) =====
warnings_as_errors_exit=0
===== mix test (targeted) =====
==> gen_stage
==> mime
==> jason
==> plug_crypto
==> hpax
==> phoenix_template
==> hypatia
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
==> phoenix_pubsub
==> plug
==> websock
==> bandit
==> websock_adapter
==> phoenix
==> hypatia

19:47:48.074 [info] Running Hypatia.Web.Router with Bandit 1.13.1 at 0.0.0.0:9099 (http)

19:47:48.076 [info] VCL Client initialized (built-in Elixir parser)

19:47:48.077 [info] Diagnostics monitor started - checking every 30s

19:47:48.081 [info] LearningScheduler started. Polling every 300s.

19:47:48.081 [info] SelfDiagnostics started. Health checks every 10 min.

19:47:48.081 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:47:48.083 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:47:48.087 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:47:48.088 [info] Kin.Contingency started -- emergency level: :normal

19:47:48.088 [info] Kin.Arbiter started -- bot conflict resolution active.

19:47:48.088 [info] Kin.Gate started -- all bot actions require Gate approval.

19:47:48.088 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:47:48.088 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

.........................................
Finished in 0.2 seconds (0.2s async, 0.00s sync)
41 tests, 0 failures
test_exit=0
===== mix test rsr_conformance =====
19:47:48.960 [info] LearningScheduler started. Polling every 300s.

19:47:48.960 [info] SelfDiagnostics started. Health checks every 10 min.

19:47:48.960 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:47:48.967 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:47:48.973 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:47:48.974 [info] Kin.Contingency started -- emergency level: :normal

19:47:48.974 [info] Kin.Arbiter started -- bot conflict resolution active.

19:47:48.974 [info] Kin.Gate started -- all bot actions require Gate approval.

19:47:48.974 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:47:48.974 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

............
Finished in 1.7 seconds (1.7s async, 0.00s sync)
12 tests, 0 failures
rsr_test_exit=0
===== consumer oracle invocation (explicit SSOT) =====
RSR v2.0 scorecard — src  (spec 2.0.0-draft)
  tier=bronze  score=83.58%  coverage=73%  provisional=true  profile=false
  verdicts: pass=30  partial=0  fail=6  unverified=13  na=26
  failing (applicable): 1.2.4, 2.1.4, 2.2.1, 3.1.8, 3.2.2, 5.1.1
oracle_exit=0

Verify — Elixir 1.17.3 / OTP 27.0

elixir/otp: 1.17.3 / 27.0
sha: b96d8aa93b308f462dba9350497fad476c155f71
===== mix deps.get =====
* creating /home/runner/.mix/archives/hex-2.6.0
Resolving Hex dependencies...
Resolution completed in 0.018s
Unchanged:
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
* Getting jason (Hex package)
* Getting gen_stage (Hex package)
* Getting phoenix (Hex package)
* Getting bandit (Hex package)
* Getting plug (Hex package)
* Getting mime (Hex package)
* Getting plug_crypto (Hex package)
* Getting telemetry (Hex package)
* creating /home/runner/.mix/elixir/1-17/rebar3
* Getting hpax (Hex package)
* Getting thousand_island (Hex package)
* Getting websock (Hex package)
* Getting phoenix_pubsub (Hex package)
* Getting phoenix_template (Hex package)
* Getting websock_adapter (Hex package)
Found packages with security advisories, see above for details
deps_get_exit=0
===== mix compile =====
==> gen_stage
Compiling 10 files (.ex)
Generated gen_stage app
==> mime
Compiling 1 file (.ex)
Generated mime app
==> phoenix_template
Compiling 4 files (.ex)
Generated phoenix_template app
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
Compiling 18 files (.ex)
Generated thousand_island app
==> jason
Compiling 10 files (.ex)
Generated jason app
==> phoenix_pubsub
Compiling 12 files (.ex)
Generated phoenix_pubsub app
==> plug_crypto
Compiling 5 files (.ex)
Generated plug_crypto app
==> hpax
Compiling 4 files (.ex)
Generated hpax app
==> plug
Compiling 1 file (.erl)
Compiling 42 files (.ex)
Generated plug app
==> websock
Compiling 1 file (.ex)
Generated websock app
==> bandit
Compiling 54 files (.ex)
Generated bandit app
==> websock_adapter
Compiling 4 files (.ex)
Generated websock_adapter app
==> phoenix
Compiling 75 files (.ex)
     warning: this check/guard will always yield the same result
     │
 301 │     if @requires_consolidation && config[:consolidate_protocols] do
     │     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:301

     warning: this check/guard will always yield the same result
     │
 414 │       @requires_consolidation && status == :ok && config[:consolidate_protocols] ->
     │       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:414

Generated phoenix app
==> hypatia
Compiling 142 files (.ex)
Generated hypatia app
compile_exit=0
===== mix compile --warnings-as-errors (clean) =====
warnings_as_errors_exit=0
===== mix test (targeted) =====
==> phoenix_template
===> Analyzing applications...
===> Compiling telemetry
==> thousand_island
==> jason
==> phoenix_pubsub
==> plug_crypto
==> hpax
==> plug
==> websock
==> bandit
==> websock_adapter
==> phoenix
     warning: this check/guard will always yield the same result
     │
 301 │     if @requires_consolidation && config[:consolidate_protocols] do
     │     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:301

     warning: this check/guard will always yield the same result
     │
 414 │       @requires_consolidation && status == :ok && config[:consolidate_protocols] ->
     │       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     │
     └─ lib/phoenix/code_reloader/server.ex:414

==> hypatia

19:48:12.095 [info] Running Hypatia.Web.Router with Bandit 1.13.1 at 0.0.0.0:9099 (http)

19:48:12.096 [info] VCL Client initialized (built-in Elixir parser)

19:48:12.096 [info] Diagnostics monitor started - checking every 30s

19:48:12.098 [info] LearningScheduler started. Polling every 300s.

19:48:12.098 [info] SelfDiagnostics started. Health checks every 10 min.

19:48:12.098 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:48:12.099 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:48:12.102 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:48:12.102 [info] Kin.Contingency started -- emergency level: :normal

19:48:12.102 [info] Kin.Arbiter started -- bot conflict resolution active.

19:48:12.102 [info] Kin.Gate started -- all bot actions require Gate approval.

19:48:12.102 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:48:12.102 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

.........................................
Finished in 0.2 seconds (0.2s async, 0.00s sync)
41 tests, 0 failures
test_exit=0
===== mix test rsr_conformance =====
19:48:12.943 [info] LearningScheduler started. Polling every 300s.

19:48:12.943 [info] SelfDiagnostics started. Health checks every 10 min.

19:48:12.943 [info] Blackboard initialised (ETS tables: :hypatia_blackboard, :hypatia_blackboard_meta)

19:48:12.949 [info] Graph of Trust built: 0 nodes, 0 edges (0 cross-repo)

19:48:12.955 [info] Neural Coordinator initialised: blackboard architecture, 8 networks, 6 phases (RBF cold; trains on first learning cycle)

19:48:12.956 [info] Kin.Contingency started -- emergency level: :normal

19:48:12.956 [info] Kin.Arbiter started -- bot conflict resolution active.

19:48:12.956 [info] Kin.Gate started -- all bot actions require Gate approval.

19:48:12.956 [info] Kin.Coordinator started. Polling siblings every 5 min.

19:48:12.956 [info] Kin.Watchdog started. Monitoring 8 processes.
Running ExUnit with seed: 0, max_cases: 8
Excluding tags: [:verisim_data]

............
Finished in 1.4 seconds (1.4s async, 0.00s sync)
12 tests, 0 failures
rsr_test_exit=0
===== consumer oracle invocation (explicit SSOT) =====
RSR v2.0 scorecard — src  (spec 2.0.0-draft)
  tier=bronze  score=83.58%  coverage=73%  provisional=true  profile=false
  verdicts: pass=30  partial=0  fail=6  unverified=13  na=26
  failing (applicable): 1.2.4, 2.1.4, 2.2.1, 3.1.8, 3.2.2, 5.1.1
oracle_exit=0

Closed: this was a relay channel, not a defect. GitHub job-log blobs are unreachable from the environment where the investigation ran, so the failing step was reproduced in Actions with the gate toolchain (Elixir 1.19.4 / OTP 28.3) and its output posted here.

The reproduced error was cannot invoke remote function :erlang.=:=/2 inside a match at lib/rules/actions_lock.ex:170 — in/2 used as a case-clause pattern — plus two further defects in the same module. Fixed in #956, which adds the elixir-compile CI gate on the dogfood toolchain and a SHA-pinned reusable rsr-oracle.yml so consumers stop tracking main.

fix(actions_lock): repair the RSR oracle compile failure and pin the …

Navigation Menu

Repository navigation

tmp: RSR oracle compile repro (delete after use) #955

Oracle repro — Elixir 1.19.4 / OTP 28.3

Oracle repro — Elixir 1.19.4 / OTP 27.3

Oracle repro — Elixir 1.19.4 / OTP 28.3

Oracle repro — Elixir 1.19.4 / OTP 27.3

Verify — Elixir 1.17.3 / OTP 27.0

Verify — Elixir 1.19.4 / OTP 28.3

Verify — Elixir 1.17.3 / OTP 27.0

Verify — Elixir 1.19.4 / OTP 28.3

Verify — Elixir 1.17.3 / OTP 27.0

Verify — Elixir 1.19.4 / OTP 28.3

Verify — Elixir 1.17.3 / OTP 27.0

Verify — Elixir 1.19.4 / OTP 28.3

Verify — Elixir 1.17.3 / OTP 27.0

Verify — Elixir 1.19.4 / OTP 28.3

Verify — Elixir 1.19.4 / OTP 28.3

Verify — Elixir 1.17.3 / OTP 27.0

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

tmp: RSR oracle compile repro (delete after use) #955

Description

Activity

github-actions commented on Oct 25, 2026

Oracle repro — Elixir 1.19.4 / OTP 28.3

github-actions commented on Oct 25, 2026

Oracle repro — Elixir 1.19.4 / OTP 27.3

github-actions commented on Oct 25, 2026

Oracle repro — Elixir 1.19.4 / OTP 28.3

github-actions commented on Oct 25, 2026

Oracle repro — Elixir 1.19.4 / OTP 27.3

github-actions commented on Oct 25, 2026

Verify — Elixir 1.17.3 / OTP 27.0

github-actions commented on Oct 25, 2026

Verify — Elixir 1.19.4 / OTP 28.3

github-actions commented on Oct 25, 2026

Verify — Elixir 1.17.3 / OTP 27.0

github-actions commented on Oct 25, 2026

Verify — Elixir 1.19.4 / OTP 28.3

github-actions commented on Oct 25, 2026

Verify — Elixir 1.17.3 / OTP 27.0

github-actions commented on Oct 25, 2026

Verify — Elixir 1.19.4 / OTP 28.3

github-actions commented on Oct 25, 2026

Verify — Elixir 1.17.3 / OTP 27.0

github-actions commented on Oct 25, 2026

Verify — Elixir 1.19.4 / OTP 28.3

github-actions commented on Oct 25, 2026

Verify — Elixir 1.17.3 / OTP 27.0

github-actions commented on Oct 25, 2026

Verify — Elixir 1.19.4 / OTP 28.3

github-actions commented on Oct 25, 2026

Verify — Elixir 1.19.4 / OTP 28.3

github-actions commented on Oct 25, 2026

Verify — Elixir 1.17.3 / OTP 27.0

github-actions commented on Oct 25, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions