Skip to content

fix(ci): green the 8-week ClusterFuzzLite red, correct a 2-major-version pin comment, re-key a stale audit path - #201

Merged
hyperpolymath merged 1 commit into
mainfrom
fix/tranche1-hygiene
Jul 28, 2026
Merged

fix(ci): green the 8-week ClusterFuzzLite red, correct a 2-major-version pin comment, re-key a stale audit path#201
hyperpolymath merged 1 commit into
mainfrom
fix/tranche1-hygiene

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

fix(ci): green the 8-week ClusterFuzzLite red, correct a 2-major-version pin comment, re-key a stale audit path

Four independent hygiene fixes, each measured rather than assumed.

ClusterFuzzLite batch fuzzing has failed every week since at least
2026-06-07
(06-07, 06-14, 06-21, 06-28, 07-05, 07-12, 07-19, 07-26).
It is schedule:-triggered, so it never appeared on the main-branch
push board and the 2026-07-21 sweep — which measured push-on-main only
— did not see it. The address leg passes; the undefined leg dies at
"Build Fuzzers (undefined)" with:

cargo fuzz build --release --sanitizer=undefined fuzz_octad_id
error: invalid value 'undefined' for '--sanitizer <SANITIZER>'
  [possible values: address, leak, memory, thread, none]

cargo-fuzz has no UBSan option, so this combination can never work for a
Rust project. cflite_pr.yml was already corrected to [address]; the
batch variant was missed. Dropping undefined is the honest fix —
thread/leak are valid for Rust and can be added deliberately later.

The CodeQL pin comment was wrong by two major versions. The pinned
SHA e4fba868 is real and is upstream tag v4.37.3, but both uses:
lines annotated it # v3.28.1. A pin comment that misstates the version
defeats the audit purpose of SHA pinning, since reviewers read the
comment, not the hash.

Note for the record: an unpushed local commit proposed re-pinning these
to 29b1f65c1f735799893313399435a59f54045865. That SHA does not exist
in github/codeql-action (the API returns 422), so it was dropped rather
than salvaged.

A stale audit key was re-firing the only High-severity finding in the
scan.
audits/assail-classifications.a2ml keyed
connectors/clients/rescript/src/VeriSimVql.res; the VCL rename moved
that file to VeriSimVcl.res and the classification never followed, so
its UnsafeDeserialization finding was unsuppressed. Every classification
key in the file now resolves to an existing path.

push-email-notify.yml removed per the estate ruling that retains
push-email only in 007, robodog-defensive-systems-lab and
defensive-multiplicity. It was already disabled_manually and no
variable or secret references it.

Also adds local-noise entries to .gitignore (db files, caches, agent
worktrees, export/build outputs). Deliberately does not ignore
.editorconfig: it is tracked, annotated in REUSE.toml, and checked
by the governance quality job's editorconfig-checker.

Verified: reuse lint 775/775 compliant, zero unused licences;
tests/doc-consonance-gate.sh passes; both edited workflows parse as
YAML. The one validate-a2ml.sh error on this file is pre-existing on
origin/main
— byte-identical output with and without this change.

…ion pin comment, re-key a stale audit path

Four independent hygiene fixes, each measured rather than assumed.

**ClusterFuzzLite batch fuzzing has failed every week since at least
2026-06-07** (06-07, 06-14, 06-21, 06-28, 07-05, 07-12, 07-19, 07-26).
It is `schedule:`-triggered, so it never appeared on the main-branch
push board and the 2026-07-21 sweep — which measured push-on-main only
— did not see it. The `address` leg passes; the `undefined` leg dies at
"Build Fuzzers (undefined)" with:

    cargo fuzz build --release --sanitizer=undefined fuzz_octad_id
    error: invalid value 'undefined' for '--sanitizer <SANITIZER>'
      [possible values: address, leak, memory, thread, none]

cargo-fuzz has no UBSan option, so this combination can never work for a
Rust project. `cflite_pr.yml` was already corrected to `[address]`; the
batch variant was missed. Dropping `undefined` is the honest fix —
`thread`/`leak` are valid for Rust and can be added deliberately later.

**The CodeQL pin comment was wrong by two major versions.** The pinned
SHA e4fba868 is real and is upstream tag **v4.37.3**, but both `uses:`
lines annotated it `# v3.28.1`. A pin comment that misstates the version
defeats the audit purpose of SHA pinning, since reviewers read the
comment, not the hash.

Note for the record: an unpushed local commit proposed re-pinning these
to 29b1f65c1f735799893313399435a59f54045865. That SHA **does not exist**
in github/codeql-action (the API returns 422), so it was dropped rather
than salvaged.

**A stale audit key was re-firing the only High-severity finding in the
scan.** `audits/assail-classifications.a2ml` keyed
`connectors/clients/rescript/src/VeriSimVql.res`; the VCL rename moved
that file to `VeriSimVcl.res` and the classification never followed, so
its `UnsafeDeserialization` finding was unsuppressed. Every classification
key in the file now resolves to an existing path.

**push-email-notify.yml removed** per the estate ruling that retains
push-email only in 007, robodog-defensive-systems-lab and
defensive-multiplicity. It was already `disabled_manually` and no
variable or secret references it.

Also adds local-noise entries to `.gitignore` (db files, caches, agent
worktrees, export/build outputs). Deliberately does **not** ignore
`.editorconfig`: it is tracked, annotated in `REUSE.toml`, and checked
by the governance `quality` job's editorconfig-checker.

Verified: `reuse lint` 775/775 compliant, zero unused licences;
`tests/doc-consonance-gate.sh` passes; both edited workflows parse as
YAML. The one `validate-a2ml.sh` error on this file is **pre-existing on
origin/main** — byte-identical output with and without this change.
@gitar-bot

gitar-bot Bot commented Jul 28, 2026

Copy link
Copy Markdown

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved

Fixes the ClusterFuzzLite UBSan failure, corrects CodeQL pin version comments, re-keys the stale audit path, and removes the deprecated push-email workflow. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact
gitar display:verbose         

Was this helpful? React with 👍 / 👎 | Gitar

@gitar-bot

gitar-bot Bot commented Jul 28, 2026

Copy link
Copy Markdown

⚠️ Gitar auto-approved this PR but could not enable auto-merge: auto-merge is disabled for this repository — enable "Allow auto-merge" in the repository settings.

@gitar-bot gitar-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gitar has auto-approved this PR and enabled auto-merge (configure)

@gitar-bot gitar-bot Bot added the gitar-approved Added by Gitar label Jul 28, 2026
@hyperpolymath
hyperpolymath marked this pull request as ready for review July 28, 2026 16:08
@hyperpolymath
hyperpolymath merged commit 9aef456 into main Jul 28, 2026
42 checks passed
@hyperpolymath
hyperpolymath deleted the fix/tranche1-hygiene branch July 28, 2026 16:09
@hyperpolymath

Copy link
Copy Markdown
Owner Author

Measured impact of the classification re-key

Scanned a pristine git archive origin/main export (781 files, no worktree
contamination) with panic-attack 2.5.5 assail, then cross-referenced every
finding against the (file, category) pairs in audits/assail-classifications.a2ml.

Before this PRorigin/main as it stands:

Live Suppressed
Critical 0 2
High 1 5
Medium 54 1
Low 50 0

The single live High is:

High  UnsafeDeserialization  connectors/clients/rescript/src/VeriSimVcl.res

It is live only because the classification key still says VeriSimVql.res.
The other five ReScript clients (Provenance, Search, Federation, Drift,
Hexad) carry the identical stringify -> parseExn pattern and are correctly
suppressed — this one was orphaned by the VCL rename.

After this PR's one-word change:

LIVE  High=0  Critical=0  Medium=54  Low=50

So the repo goes to zero live High and zero live Critical. Nothing is being
silenced that was not already audited under the same rationale six times over;
the entry was simply pointing at a path that no longer exists.

Worth noting for sequencing: this is what makes a real severity gate adoptable
here. panic-attack assail currently has no process::exit/ExitCode/--fail-on
anywhere in its 3,132-line main.rs, so it always exits 0 — the planned
fail_on_severity input for scan-and-report.yml would have had verisimdb
failing on day one at high. With this fix it passes cleanly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gitar-approved Added by Gitar

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant