Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions 12

sec: hpke-rs 0.2 out of joule-code's tests; h2 0.4.20 in smart-byte; jouleclaw builds on quick-xml 0.41 #456

Closed
dcharlot wants to merge 2 commits from sec/after-443-b into main
pull from: sec/after-443-b
merge into: Transaction-Science:main
Conversation 0 Commits 2 Files changed 6 +100 -255
dcharlot commented 2026-10-24 19:59:20 -04:00
Owner
Copy link

What #443 left on main that has a fix on its own version line, plus the jouleclaw build it left red.

  • joule-code-collab moves its MLS keying test to openmls 0.9.1, matching joule-moq-mls. The old openmls 0.6 dev-dependencies were the only path to hpke-rs 0.2.0 and hpke-rs-rust-crypto 0.2.0 (RUSTSEC-2026-0069 to 0072), so both leave joule-code-rs/Cargo.lock. export_secret now takes provider.crypto().
  • smart-byte-rs: h2 0.4.14 → 0.4.20 (RUSTSEC-2026-0258).
  • jouleclaw: quick-xml 0.41 deprecates Attribute::unescape_value. The OpenVINO IR loader still called it, and that crate denies warnings, so jouleclaw-loader-gguf failed to compile in every build that includes it (the macOS energy-backends leg among them). The loader and the TRX parser now use normalized_value(XmlVersion::Implicit1_0). The TRX parser also drops four state flags and an initial assignment that nothing read since #443 changed how it gathers text.

Checked on the build host:

  • cargo test -p joule-code-collab: 11 unit tests, plus cluster_members_derive_a_shared_group_key.
  • cargo check --all-targets in smart-byte-rs.
  • RUSTFLAGS="-D warnings" cargo test -p jouleclaw-loader-gguf -p jouleclaw-transform-trx: 297 and 11 tests, plus the integration suites.
  • The CI step itself: cargo test -p jouleclaw-energy --features ioreport.

Based on main after #447, which fixed the joule-moq-room lockfile that failed --locked in #450's repository-checks and browser legs.

After this, cargo audit over all 49 lockfiles leaves only advisories that need a major-version move or an upstream release: zip < 9, pyo3 0.28, h2 0.3 (via hf-hub), hickory-proto 0.25 (via libp2p-mdns), quick-xml 0.37/0.39 (via open-payments-iso20022 and plist), libcrux-kem 0.0.9 (via hpke-rs-libcrux 0.7), rkyv 0.7 and rsa (which has no fix).

Supersedes #450.

🤖 Generated with Claude Code

Closed: Superseded by #449, which now carries the jouleclaw quick-xml 0.41 port (cherry-picked as 991e07723) alongside the same lockfile and allow-list changes. #456's last CI run had the macOS energy leg green with that commit; its only failure was the advisory gate #449 fixes.

What #443 left on main that has a fix on its own version line, plus the jouleclaw build it left red. - **joule-code-collab** moves its MLS keying test to openmls 0.9.1, matching joule-moq-mls. The old openmls 0.6 dev-dependencies were the only path to hpke-rs 0.2.0 and hpke-rs-rust-crypto 0.2.0 (RUSTSEC-2026-0069 to 0072), so both leave `joule-code-rs/Cargo.lock`. `export_secret` now takes `provider.crypto()`. - **smart-byte-rs**: h2 0.4.14 → 0.4.20 (RUSTSEC-2026-0258). - **jouleclaw**: quick-xml 0.41 deprecates `Attribute::unescape_value`. The OpenVINO IR loader still called it, and that crate denies warnings, so `jouleclaw-loader-gguf` failed to compile in every build that includes it (the macOS energy-backends leg among them). The loader and the TRX parser now use `normalized_value(XmlVersion::Implicit1_0)`. The TRX parser also drops four state flags and an initial assignment that nothing read since #443 changed how it gathers text. Checked on the build host: - `cargo test -p joule-code-collab`: 11 unit tests, plus `cluster_members_derive_a_shared_group_key`. - `cargo check --all-targets` in smart-byte-rs. - `RUSTFLAGS="-D warnings" cargo test -p jouleclaw-loader-gguf -p jouleclaw-transform-trx`: 297 and 11 tests, plus the integration suites. - The CI step itself: `cargo test -p jouleclaw-energy --features ioreport`. Based on main after #447, which fixed the joule-moq-room lockfile that failed `--locked` in #450's repository-checks and browser legs. After this, `cargo audit` over all 49 lockfiles leaves only advisories that need a major-version move or an upstream release: zip < 9, pyo3 0.28, h2 0.3 (via hf-hub), hickory-proto 0.25 (via libp2p-mdns), quick-xml 0.37/0.39 (via open-payments-iso20022 and plist), libcrux-kem 0.0.9 (via hpke-rs-libcrux 0.7), rkyv 0.7 and rsa (which has no fix). Supersedes #450. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- **Closed:** Superseded by #449, which now carries the jouleclaw quick-xml 0.41 port (cherry-picked as 991e07723) alongside the same lockfile and allow-list changes. #456's last CI run had the macOS energy leg green with that commit; its only failure was the advisory gate #449 fixes. 
What #443 left that has a fix on its own line:

- joule-code-collab's MLS keying test moves to openmls 0.9.1, matching
  joule-moq-mls. The old openmls 0.6 dev-dependencies were the only path to
  hpke-rs 0.2.0 and hpke-rs-rust-crypto 0.2.0 (RUSTSEC-2026-0069 to 0072),
  so both leave the lockfile. export_secret now takes the crypto provider.
- smart-byte-rs: h2 0.4.14 -> 0.4.20 (RUSTSEC-2026-0258).

After this, every advisory left in the workspaces needs a major-version
move or an upstream release: zip < 9, pyo3 0.28, h2 0.3 (via hf-hub),
hickory-proto 0.25 (via libp2p-mdns), quick-xml 0.37/0.39 (via
open-payments-iso20022 and plist), libcrux-kem 0.0.9 (via
hpke-rs-libcrux 0.7), rkyv 0.7 and rsa (no fix).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
jouleclaw: read attribute values with normalized_value, not the deprecated unescape_value
Some checks failed
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 6s
Details
jouleclaw public surface must stay documented / Public-surface audit (jouleclaw-rs) (pull_request) Successful in 1m6s
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Successful in 2m58s
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Successful in 5m14s
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 15s
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Successful in 1m48s
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Failing after 7m37s
Details
standards workspaces build + test / mesh-rs (mesh/mesh-rs, -p mesh-engine-gguf -p mesh-openai --features mesh-engine-gguf/gguf,mesh-openai/server, mesh-rs, linux-arm64) (pull_request) Successful in 2m3s
Details
standards workspaces build + test / jouleclaw-rs (-nodebug, jouleclaw/jouleclaw-rs, -p jouleclaw-energy --features rapl,nvml, jouleclaw-rs, linux-arm64, -C target-feature=+fp16) (pull_request) Successful in 10m14s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 10m6s
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 16m51s
Details
standards workspaces build + test / smart-byte-rs (smart-byte/smart-byte-rs, smart-byte-rs, linux) (pull_request) Successful in 5m14s
Details
standards workspaces build + test / macOS energy backends (pull_request) Successful in 10m38s
Details
standards workspaces build + test / jouledesk-rs (jouledesk/jouledesk-rs, jouledesk-rs, macos) (pull_request) Successful in 3m22s
Details
cfd341b057 
#443 moved jouleclaw to quick-xml 0.41, which deprecates
Attribute::unescape_value. The OpenVINO IR loader and the Maltego TRX parser
still called it, three times each, so every build that denies warnings (the
macOS energy-backends leg) failed to compile jouleclaw-loader-gguf. Both now
use normalized_value(XmlVersion::Implicit1_0), which unescapes the same way
and also normalizes attribute whitespace as XML 1.0 specifies.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
dcharlot closed this pull request 2026-10-24 20:45:55 -04:00
Some checks failed
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 6s
Details
jouleclaw public surface must stay documented / Public-surface audit (jouleclaw-rs) (pull_request) Successful in 1m6s
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Successful in 2m58s
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Successful in 5m14s
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 15s
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Successful in 1m48s
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Failing after 7m37s
Details
standards workspaces build + test / mesh-rs (mesh/mesh-rs, -p mesh-engine-gguf -p mesh-openai --features mesh-engine-gguf/gguf,mesh-openai/server, mesh-rs, linux-arm64) (pull_request) Successful in 2m3s
Details
standards workspaces build + test / jouleclaw-rs (-nodebug, jouleclaw/jouleclaw-rs, -p jouleclaw-energy --features rapl,nvml, jouleclaw-rs, linux-arm64, -C target-feature=+fp16) (pull_request) Successful in 10m14s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 10m6s
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 16m51s
Details
standards workspaces build + test / smart-byte-rs (smart-byte/smart-byte-rs, smart-byte-rs, linux) (pull_request) Successful in 5m14s
Details
standards workspaces build + test / macOS energy backends (pull_request) Successful in 10m38s
Details
standards workspaces build + test / jouledesk-rs (jouledesk/jouledesk-rs, jouledesk-rs, macos) (pull_request) Successful in 3m22s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Transaction-Science/open-standards!456
No description provided.