Repository navigation
ci(server): server boot gate — convert 'compiles' into 'boots' - #258
Merged
Merged
Conversation
Builds the echidna binary, starts the server, and curls /api/health,
/api/provers, and a session {id} route on every push/PR to main.
The axum 0.8 route-panic shipped precisely because nothing in CI
started the server. This gate makes that class of regression
permanently visible.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
hyperpolymath
marked this pull request as ready for review
June 14, 2026 01:08
2 tasks done
hyperpolymath
added a commit
that referenced
this pull request
Nov 10, 2026
## Summary The Static Analysis Gate fails in two different ways, depending on the branch. 1. **On PR branches behind main (for example #474):** `panic-attack assail` exits 2 with `incomplete coverage (partial)`. Then `deposit` fails with "Incomplete scanner evidence". The branch still pins panic-attack `410a8f8`, which predates panic-attack #258. That version has no adapter for TOML, YAML, JSON, Containerfile, Justfile, HTML, CSS or Forth, so it marks 190 of echidna's 908 candidate files "unsupported". **main already fixes this**: it pins `f2a6a70`, which includes #258. Those branches need main merged in. 2. **On main:** coverage is complete and `deposit` passes. But the `panic-attack assail` job fails with "Critical scanner findings block merge". The only 2 critical findings are PA021 ProofDrift: one open `sorry` each, in `tests/corpus_fixtures/isabelle/Smoke.thy` and `tests/corpus_fixtures/minif2f/algebra.lean`. This PR fixes item 2. ## Changes - `audits/assail-classifications.a2ml`: add 2 entries, one per fixture, with category `ProofDrift`. The `sorry`s are deliberate: `tests/corpus_hazard_fixtures.rs` checks that the corpus adapters flag them as hazards, and those tests fail if they are removed. Each entry names its test. - This is an addition only. No existing entry and no licence header changes. ## RSR Quality Checklist ### Required - [x] No banned functions added. The 2 `sorry`s are existing fixtures; this PR only classifies them. - [x] No secrets, credentials, or `.env` files included ## Testing I built panic-attack main (`4f51cca`, `--locked --features http`) and ran it on echidna main with this change: - `assail --fail-on-incomplete`: exit 0, coverage `complete` 913/913, unsuppressed findings: 0 critical, 43 high, 65 medium, 1 low. - The report meets `scripts/ci/static-analysis-evidence.sh`'s panic-attack contract (schema `2.6`). - `bridge triage`: exit 0, schema `0.3.0`, `vulnerability_data: queried`. This matches the Patch Bridge contract. - Without this change, the same scan has 2 unsuppressed critical findings: exactly the 2 fixtures. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/server-boot-gate.yml: builds the binary, startsechidna server, curls/api/health,/api/provers, and a session{id}route on every push/PR tomain.The axum 0.8 route-panic shipped because nothing in CI started the server. This gate permanently closes that gap.
What's NOT in this PR (blockers)
Three additional fixes from the close-out work order are ready but blocked by pre-existing SPDX header drift on the affected source files. The pre-commit hook checks every staged
.rs/.adocfile forJonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>and rejects files that have:src/rust/server.rs2025 ECHIDNA Project Team2025 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>src/interfaces/rest/main.rsQUICKSTART-USER.adocCopyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>(hyperpolymath)from between name and<Once you fix those three headers manually, the following changes are ready to commit (diffs saved to
~/dev-notes/echidna-closeout-patches/):(assert (> x 0))(satisfiable, always returnssuccess:false) with(assert (and (> x 0) (< x 0)))→ unsat →success:true.with_verisim_writer(VERISIM_URL)to the dispatcher at startup; routeprove_handlerthroughdispatcher.verify_proof()when compiled--features verisim.Note on Task 1a (route syntax)
The axum 0.8
{id}route syntax is already correct inorigin/main— the routes were{id}-style before the bump landed. The boot-gate will now permanently verify this on every PR.Test plan
Server Boot GateCI job passesfeat/verisim-prove-pathPR