Skip to content

ci(server): server boot gate — convert 'compiles' into 'boots' - #258

Merged
hyperpolymath merged 3 commits into
mainfrom
fix/axum-08-week1-fixes
Jun 14, 2026
Merged

hyperpolymath merged 3 commits into
mainfrom
fix/axum-08-week1-fixes

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

  • Adds .github/workflows/server-boot-gate.yml: builds the binary, starts echidna server, curls /api/health, /api/provers, and a session {id} route on every push/PR to main.

The axum 0.8 route-panic shipped because nothing in CI started the server. This gate permanently closes that gap.

What's NOT in this PR (blockers)

Three additional fixes from the close-out work order are ready but blocked by pre-existing SPDX header drift on the affected source files. The pre-commit hook checks every staged .rs / .adoc file for Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> and rejects files that have:

File Current header (wrong) Needed
src/rust/server.rs 2025 ECHIDNA Project Team 2025 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
src/interfaces/rest/main.rs (no SPDX-FileCopyrightText at all) add one
QUICKSTART-USER.adoc Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> remove (hyperpolymath) from between name and <

Once you fix those three headers manually, the following changes are ready to commit (diffs saved to ~/dev-notes/echidna-closeout-patches/):

  1. QUICKSTART demo fix (task 1c): replace (assert (> x 0)) (satisfiable, always returns success:false) with (assert (and (> x 0) (< x 0))) → unsat → success:true.
  2. VeriSim wiring (task 3): attach with_verisim_writer(VERISIM_URL) to the dispatcher at startup; route prove_handler through dispatcher.verify_proof() when compiled --features verisim.

Note on Task 1a (route syntax)

The axum 0.8 {id} route syntax is already correct in origin/main — the routes were {id}-style before the bump landed. The boot-gate will now permanently verify this on every PR.

Test plan

  • Merge this PR; verify Server Boot Gate CI job passes
  • Apply the SPDX header fixes to the three files above (manual)
  • Apply the QUICKSTART demo patch
  • Apply the VeriSim wiring patch and open feat/verisim-prove-path PR

Builds the echidna binary, starts the server, and curls /api/health,
/api/provers, and a session {id} route on every push/PR to main.

The axum 0.8 route-panic shipped precisely because nothing in CI
started the server.  This gate makes that class of regression
permanently visible.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@hyperpolymath
hyperpolymath marked this pull request as ready for review June 14, 2026 01:08
@hyperpolymath
hyperpolymath merged commit 6feec89 into main Jun 14, 2026
11 of 20 checks passed
@hyperpolymath
hyperpolymath deleted the fix/axum-08-week1-fixes branch June 14, 2026 01:09
hyperpolymath added a commit that referenced this pull request Nov 10, 2026
## Summary

The Static Analysis Gate fails in two different ways, depending on the
branch.

1. **On PR branches behind main (for example #474):** `panic-attack
assail` exits 2 with `incomplete coverage (partial)`. Then `deposit`
fails with "Incomplete scanner evidence". The branch still pins
panic-attack `410a8f8`, which predates panic-attack #258. That version
has no adapter for TOML, YAML, JSON, Containerfile, Justfile, HTML, CSS
or Forth, so it marks 190 of echidna's 908 candidate files
"unsupported". **main already fixes this**: it pins `f2a6a70`, which
includes #258. Those branches need main merged in.
2. **On main:** coverage is complete and `deposit` passes. But the
`panic-attack assail` job fails with "Critical scanner findings block
merge". The only 2 critical findings are PA021 ProofDrift: one open
`sorry` each, in `tests/corpus_fixtures/isabelle/Smoke.thy` and
`tests/corpus_fixtures/minif2f/algebra.lean`.

This PR fixes item 2.

## Changes

- `audits/assail-classifications.a2ml`: add 2 entries, one per fixture,
with category `ProofDrift`. The `sorry`s are deliberate:
`tests/corpus_hazard_fixtures.rs` checks that the corpus adapters flag
them as hazards, and those tests fail if they are removed. Each entry
names its test.
- This is an addition only. No existing entry and no licence header
changes.

## RSR Quality Checklist

### Required

- [x] No banned functions added. The 2 `sorry`s are existing fixtures;
this PR only classifies them.
- [x] No secrets, credentials, or `.env` files included

## Testing

I built panic-attack main (`4f51cca`, `--locked --features http`) and
ran it on echidna main with this change:

- `assail --fail-on-incomplete`: exit 0, coverage `complete` 913/913,
unsuppressed findings: 0 critical, 43 high, 65 medium, 1 low.
- The report meets `scripts/ci/static-analysis-evidence.sh`'s
panic-attack contract (schema `2.6`).
- `bridge triage`: exit 0, schema `0.3.0`, `vulnerability_data:
queried`. This matches the Patch Bridge contract.
- Without this change, the same scan has 2 unsuppressed critical
findings: exactly the 2 fixtures.

---
_Generated by [Claude
Code](https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4)_

Co-authored-by: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant