Exact

Exact Union RegExp

Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Transaction Science 4e7fa646ed ci: gate on cargo-audit, so an advisory has to be read rather than accumulated ... The 142 vulnerability instances this branch started from were not the result of a decision. They accumulated because a vulnerable crate usually arrives transitively, in a lockfile nobody edited, and nothing in CI was looking. The fixes in this branch are worth little if the backlog can rebuild quietly. `scripts/check-advisories.py` runs `cargo audit --json` over every tracked Cargo.lock and fails on any advisory not named in its ALLOW table. It reads the advisory database and the lockfiles; it builds nothing. ALLOW is the substance. An advisory may be left in place — upstream has no fixed release, the vulnerable call is unreachable, it is dev-only — but only in writing, with the reason beside the id. Two rules keep that from rotting: - an unlisted advisory fails, so a new one gets looked at; - a listed advisory that no longer appears anywhere ALSO fails, so an excuse cannot outlive the exposure it was written for. An allow list that is never pruned stops describing the tree and starts hiding it. It currently allows 18, each with its reason: zip and rsa as unreachable, hpke-rs 0.2.0 as dev-only, and quick-xml/libcrux-kem/h2/hickory-proto/pyo3 as pinned by dependents that need an upstream release. The quick-xml 0.37.5 entry is marked as a known remaining exposure on the ISO 20022 ingestion path rather than a dismissal, so it reads as debt and not as a verdict. Warnings (unmaintained, unsound, yanked — 67 of them) are counted and printed but do not fail the run: gating on maintenance advice would bury the reachable defects in noise. Printing the count keeps the number visible instead of unknown. A lockfile that cannot be audited at all fails under its own heading, so an error is never read as "clean" — the same failure-closed shape as check-lockfiles.sh, and the mistake this sweep made by hand when a broken output parser reported "0 vulnerabilities" while criticals were printing. The self-test asserts the check passes a reviewed tree and fails each way it should: an unlisted advisory, an allowance matching nothing, and a document that does not parse. Co-Authored-By: Claude Opus 5 <[email protected]>		2026-10-22 12:49:04 -04:00
..
check-advisories-selftest.sh	ci: gate on cargo-audit, so an advisory has to be read rather than accumulated	2026-10-22 12:49:04 -04:00
check-advisories.py	ci: gate on cargo-audit, so an advisory has to be read rather than accumulated	2026-10-22 12:49:04 -04:00
check-comparative-prose.sh	wai: restate the ranking phrases the retrofit left in research and extensions	2026-10-01 08:38:05 -04:00
check-fabric-errors.py	jouleclaw-omni: metal compiles — 45 -> 0, write the 21 missing kernels	2026-10-20 04:33:42 -04:00
check-lockfiles-selftest.sh	scripts: no pipe into grep -q under pipefail	2026-10-15 01:52:03 -04:00
check-lockfiles.sh	joule-code: vendor wtransport 0.7.2 as published, patched in	2026-10-20 04:54:03 -04:00
check-metal-shaders.py	check-metal-shaders: stop being coupled to raw-string style, and refuse to check almost nothing	2026-10-20 08:52:06 -04:00
check-no-vanity-metrics.sh	docs + no-vanity-metrics: reword two counts, fix scanner false positive	2026-06-13 22:14:13 -04:00
check-orphan-sources.py	jouleclaw-omni: declare 23 modules that were compiled by nothing	2026-10-18 07:19:24 -04:00
check-public-names.sh	wai-quantum WebGPU member: CI review fixes	2026-10-10 23:29:10 -04:00
check-spec-refs-selftest.sh	ci: a citation to a section that does not exist is now a failure	2026-10-13 03:07:23 -04:00
check-spec-refs.py	ci: a citation to a section that does not exist is now a failure	2026-10-13 03:07:23 -04:00
check-tests-in-ci-selftest.sh	scripts: no pipe into grep -q under pipefail	2026-10-15 01:52:03 -04:00
check-tests-in-ci.py	ci: every wai-rs test file is run by a job or listed, and none can run empty	2026-10-13 01:20:48 -04:00
check-wai-section-refs.py	check-wai-section-refs: read wai/SECURITY.md too	2026-10-09 17:15:06 -04:00
check-workflow-concurrency-selftest.sh	ci: one job for the repository's script checks	2026-10-14 12:05:46 -04:00
check-workflow-concurrency.sh	ci: guard the concurrency groups, and stop the dev Mac serving 13 of 21 contexts	2026-10-05 12:18:21 -04:00
install-hooks.sh	ci: no-vanity-metrics scanner + pre-commit hook + CHARTER policy	2026-06-02 10:39:43 -04:00
pr-touches-paths-selftest.sh	pr-touches-paths: a comment inside a path list no longer ends it	2026-10-14 04:21:43 -04:00
pr-touches-paths.py	pr-touches-paths: a comment inside a path list no longer ends it	2026-10-14 04:21:43 -04:00
standards-touched-selftest.sh	scripts: no pipe into grep -q under pipefail	2026-10-15 01:52:03 -04:00
standards-touched.py	ci: the standards build builds the workspaces a change touches	2026-10-14 03:40:08 -04:00
test-public-text-checks.sh	wai: restate the ranking phrases the retrofit left in research and extensions	2026-10-01 08:38:05 -04:00
wai-quantum-webgpu-member.sh	wai-quantum fabric: run meters, metered calibration, place_for, and the Fabric wrapper	2026-10-12 05:08:11 -04:00