open-standards/scripts
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Transaction Science f19e84f40f
Some checks failed
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Successful in 5s
wai-web reach builds / wai-web reach · does this change touch it (pull_request) Successful in 16s
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 18s
WAI conformance / does this change touch it (pull_request) Successful in 14s
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 17s
WAI JPEG-AI whole decode (pinned inputs, required) / does this change touch it (pull_request) Successful in 7s
WAI energy receipts / does this change touch it (pull_request) Successful in 8s
WAI neural sink gates / does this change touch it (pull_request) Successful in 6s
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Successful in 6s
wai-pack / wai-pack · does this change touch it (pull_request) Successful in 6s
wai-quantum studio and desktop / does this change touch it (pull_request) Successful in 6s
wai-quantum WebGPU member / does this change touch it (pull_request) Successful in 6s
WAI mbt2018_mean integer decode (regenerated vectors) / does this change touch it (pull_request) Successful in 6s
WAI conformance / cross-arch byte-equality · linux (pull_request) Successful in 33s
wai-web wasm32 / does this change touch it (pull_request) Successful in 6s
WAI conformance / cross-arch byte-equality · macos (pull_request) Successful in 1m18s
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Successful in 1m57s
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 33s
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Successful in 2m22s
joule-code conformance gate / joule-moq-relay, every target (pull_request) Successful in 2m49s
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Successful in 1m8s
joule-moq-room room service / joule-moq-room, every target (pull_request) Successful in 2m1s
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Has been cancelled
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Has been cancelled
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Successful in 2m44s
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Has been cancelled
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
wai-pack / wai-pack · linux (pull_request) Has been cancelled
wai-pack / wai-pack · linux-arm64 (pull_request) Has been cancelled
wai-pack / wai-pack · macos (pull_request) Has been cancelled
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
wai-quantum studio and desktop / studio · browser (pull_request) Has been cancelled
wai-quantum studio and desktop / desktop app · macos (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Has been cancelled
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness · MSRV (pull_request) Has been cancelled
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Has been cancelled
wai-quantum WebGPU member / member · Metal (macos) (pull_request) Has been cancelled
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Has been cancelled
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Has been cancelled
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Has been cancelled
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Has been cancelled
wai-quantum WebGPU member / member · discrete GPU, Vulkan (jetson-hub) (pull_request) Has been cancelled
wai-quantum WebGPU member / member · integrated GPU, Vulkan (framework-128gb) (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
wai-quantum WebGPU member / member · DX12 and Vulkan (cbio-windows) (pull_request) Has been cancelled
sec: zstd 0.14.3 for RUSTSEC-2026-0391, -0398, -0403 and -0410
Four advisories against the zstd crates, published October 2026, failed
the repository check on every pull request:
- RUSTSEC-2026-0391 (zstd < 0.14.3): data from an abandoned stream leaks
  into the next stream on a reused context;
- RUSTSEC-2026-0398 (zstd-safe < 8.2.0): Seekable::decompress sets a Vec
  length past its capacity;
- RUSTSEC-2026-0403 (zstd-safe < 8.2.0): uninitialised memory when a
  legacy frame's streaming decompression fails;
- RUSTSEC-2026-0410 (zstd-sys < 2.1.2): the wasm allocator shim corrupts
  memory on allocation failure.

Every direct use moves: wai (zstd 0.14.3, zstd-safe 8.2), jwp and
joule-moq-interop (zstd 0.14.3). Five lockfiles change exactly the three
zstd packages and nothing else: wai-rs, wai-rs/fuzz, joule-code-rs,
joule-moq-room and examples/transport-moqt.

The one copy left is wasmtime 49's, under wasmtime-internal-cache, which
compresses compiled modules for wasmtime's on-disk cache. sandbox-exec-wasm
builds its engine from Config::new() with fuel metering only and never
configures a cache, so zstd's code does not run in the sandbox. It is
allowed in scripts/check-advisories.py at those exact versions, so a
direct use regressing to them is not excused.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-26 11:32:36 -04:00
..
check-advisories-selftest.sh sec: answer the gate's first catch — two constant-time advisories, and pin an allowance to the version it excuses 2026-10-24 20:06:05 -04:00
check-advisories.py sec: zstd 0.14.3 for RUSTSEC-2026-0391, -0398, -0403 and -0410 2026-10-26 11:32:36 -04:00
check-comparative-prose.sh wai: restate the ranking phrases the retrofit left in research and extensions 2026-10-01 08:38:05 -04:00
check-fabric-errors.py jouleclaw-omni: metal compiles — 45 -> 0, write the 21 missing kernels 2026-10-20 04:33:42 -04:00
check-lockfiles-selftest.sh scripts: no pipe into grep -q under pipefail 2026-10-15 01:52:03 -04:00
check-lockfiles.sh joule-code: vendor wtransport 0.7.2 as published, patched in 2026-10-20 04:54:03 -04:00
check-metal-shaders.py check-metal-shaders: stop being coupled to raw-string style, and refuse to check almost nothing 2026-10-20 08:52:06 -04:00
check-no-vanity-metrics.sh docs + no-vanity-metrics: reword two counts, fix scanner false positive 2026-06-13 22:14:13 -04:00
check-orphan-sources.py jouleclaw-omni: declare 23 modules that were compiled by nothing 2026-10-18 07:19:24 -04:00
check-public-names.sh check-public-names: read file arguments from the caller's directory; name a file it cannot read 2026-10-21 15:19:18 -04:00
check-spec-refs-selftest.sh ci: a citation to a section that does not exist is now a failure 2026-10-13 03:07:23 -04:00
check-spec-refs.py ci: a citation to a section that does not exist is now a failure 2026-10-13 03:07:23 -04:00
check-tests-in-ci-selftest.sh scripts: no pipe into grep -q under pipefail 2026-10-15 01:52:03 -04:00
check-tests-in-ci.py ci: every wai-rs test file is run by a job or listed, and none can run empty 2026-10-13 01:20:48 -04:00
check-wai-section-refs.py check-wai-section-refs: read wai/SECURITY.md too 2026-10-09 17:15:06 -04:00
check-workflow-concurrency-selftest.sh ci: one job for the repository's script checks 2026-10-14 12:05:46 -04:00
check-workflow-concurrency.sh ci: guard the concurrency groups, and stop the dev Mac serving 13 of 21 contexts 2026-10-05 12:18:21 -04:00
install-hooks.sh ci: no-vanity-metrics scanner + pre-commit hook + CHARTER policy 2026-06-02 10:39:43 -04:00
pr-touches-paths-selftest.sh pr-touches-paths: a comment inside a path list no longer ends it 2026-10-14 04:21:43 -04:00
pr-touches-paths.py pr-touches-paths: a comment inside a path list no longer ends it 2026-10-14 04:21:43 -04:00
standards-touched-selftest.sh scripts: no pipe into grep -q under pipefail 2026-10-15 01:52:03 -04:00
standards-touched.py ci: the standards build builds the workspaces a change touches 2026-10-14 03:40:08 -04:00
test-public-text-checks.sh check-public-names: read file arguments from the caller's directory; name a file it cannot read 2026-10-21 15:19:18 -04:00
wai-quantum-webgpu-member.sh wai-quantum fabric: run meters, metered calibration, place_for, and the Fabric wrapper 2026-10-12 05:08:11 -04:00