Repository navigation
fix(ffi): annotate the audited Zig context-pointer casts for Hypatia - #468
Closed
hyperpolymath wants to merge 5 commits into
Closed
hyperpolymath wants to merge 5 commits into
hyperpolymath wants to merge 5 commits into
Conversation
cargo audit fails on rmcp 3.5.0 (crates/echidna-mcp) with RUSTSEC-2026-0457 (fixed >=3.7.0), RUSTSEC-2026-0461 (>=3.6.0) and RUSTSEC-2026-0462 (>=3.9.0), published after main last passed the Dependency audit check. `cargo update -p rmcp` moves rmcp and rmcp-macros to 3.9.0, inside the existing "3" requirement; no other entry changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
`cargo fmt --check` fails on main (2ab7574) in five places in src/rust/proof_search.rs, so rust-ci 'Cargo check + clippy + fmt' is red on every PR. Formatting only; no code change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Hypatia's code_safety/zig_ptr_cast and zig_align_cast now flag the nine `@ptrCast(@aligncast(raw))` lines in src/zig_ffi/chapel_bridge.zig and src/zig_ffi/runtime_owner.zig as high, and the governance Hypatia baseline gate is red on main (2ab7574) as a result. Each of those lines recovers a callback's own `*@this()` from the type-erased `*anyopaque` it was registered with (runtime_owner.Work .context, or a std.mem.Allocator vtable's ptr), so the cast restores the original type and alignment. Fixed at source with a reasoned inline `hypatia: allow` per rule on each line, as the scanner documents, rather than a baseline entry. No code change: comments only. Checked by simulating ScannerSuppression.inline_allowed?/4 and directive_re at hypatia 82396d81 (the CI pin): 18 unsuppressed findings on main, 0 with this change. The scanner itself could not be built here (hex.pm is unreachable). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 59 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Merged
6 tasks done
…oof-search' into claude/new-session-th4e9w-rustsec-rmcp
…st-audit' into claude/new-session-th4e9w-rustsec-rmcp
3 tasks done
Owner
Author
|
I've folded this into #465, which fixes all three checks that are red on Generated by Claude Code |
|
hyperpolymath
added a commit
that referenced
this pull request
Nov 9, 2026
…g casts) (#465) ## Summary Three checks fail on `main` (`2ab7574`), so every open PR is red on them. This PR fixes all three. It replaces #467 and #468, which carried the same commits and are now closed. | Check | Cause | Fix (commit) | |---|---|---| | `Dependency audit`, `rust-ci / Cargo audit` | `rmcp` 3.5.0 (`crates/echidna-mcp`) has RUSTSEC-2026-0457, -0461 and -0462, published after `main` last passed | `Cargo.lock` only: `rmcp` and `rmcp-macros` move to 3.9.0, inside the existing `"3"` requirement (`20dc691`) | | `rust-ci / Cargo check + clippy + fmt` | `cargo fmt --check` drift in `src/rust/proof_search.rs` | `cargo fmt`, formatting only (`17ebbb1`) | | `governance / Validate Hypatia Baseline` | Hypatia `code_safety/zig_ptr_cast` and `zig_align_cast` are high on the nine `@ptrCast(@aligncast(raw))` lines in `src/zig_ffi/` | A reasoned inline `hypatia: allow` per rule on each line, with no baseline entry (`f48fe0a`) | Every one of those casts gets a callback's own `*@this()` back from the type-erased `*anyopaque` it was registered with: `runtime_owner.Work.context`, or a `std.mem.Allocator` vtable's `ptr`. So each cast restores the pointer's original type and alignment. Order of preference: fix > inline directive > `.hypatia-ignore` > baseline. ## Changes - `Cargo.lock`: `rmcp` and `rmcp-macros` 3.5.0 → 3.9.0. - `src/rust/proof_search.rs`: `rustfmt` only. - `src/zig_ffi/chapel_bridge.zig` and `src/zig_ffi/runtime_owner.zig`: comments only. ## RSR Quality Checklist ### Required - [x] Code is formatted: `cargo fmt --all -- --check` passes. - [x] Linter is clean: `cargo clippy --all-targets --locked -- -D warnings` passes locally. - [x] No secrets, credentials or `.env` files. ## Testing - `cargo audit`: no vulnerabilities. - `cargo check -p echidna-mcp --locked`: passes. The crate has no tests. - Hypatia: the scanner could not be built here because hex.pm is unreachable. I simulated its suppression logic instead: `directive_re` and `ScannerSuppression.inline_allowed?/4` at hypatia `82396d81`, the CI pin. That reports 18 unsuppressed findings on `main` (9 casts × 2 rules) and 0 on this branch. - Zig isn't available here. The Zig change is comments only, so it can't affect the build. ## Checks still red, and not caused by this PR - **`Deposit findings for gitbot-fleet`, `Isabelle/HOL`, `scan / scan`:** also red on `main`. - **`panic-attack assail`:** fails with "Scanner completion receipt is missing, incomplete or inconsistent". It is also red on #462 and #463. - **`rust-ci / llvm-cov line coverage`** on `20dc691`: - **What failed:** `provers::chuffed::tests::version_requires_a_successful_help_response_and_closed_stdin` exited with `Text file busy (os error 26)`. - **Root cause:** `ETXTBSY`. A test writes its fake prover script and then executes it. If another test thread forks in between, the child inherits the still-open write descriptor, and the kernel refuses to execute the file while it is open for writing. The same pattern exists in the fixtures in `chuffed.rs`, `gpuverify.rs`, `faial.rs`, `version_probe.rs` and `proof_search.rs`. - **What I did:** re-ran the job once to confirm the failure is intermittent. - **Proposed fix (separate PR):** a shared test helper that retries the spawn on `io::ErrorKind::ExecutableFileBusy`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
governance / Validate Hypatia Baselineis red onmain(2ab7574). Hypatia'scode_safety/zig_ptr_castandzig_align_castrules now flag the nine@ptrCast(@alignCast(raw))lines insrc/zig_ffi/chapel_bridge.zigandsrc/zig_ffi/runtime_owner.zigas high.Each of those lines does the same thing: it gets a callback's own
*@This()back from the type-erased*anyopaqueit was registered with. The pointer comes fromruntime_owner.Work.contextor, for the allocator test fixture, from astd.mem.Allocatorvtable'sptr. So the cast restores the pointer's original type and alignment, and the pattern is sound.I've fixed it in the code rather than adding a baseline entry. Each line gets one reasoned inline
hypatia: allowdirective per rule, as the scanner documents (ScannerSuppression.inline_allowed?/4: a directive on the line or the line above). Order of preference: fix > inline directive >.hypatia-ignore> baseline.Changes
src/zig_ffi/chapel_bridge.zigandsrc/zig_ffi/runtime_owner.zig: comments only.// hypatia: allow code_safety/zig_ptr_cast -- <reason>.// hypatia: allow code_safety/zig_align_cast -- <reason>.RSR Quality Checklist
Required
zig build.Testing
I couldn't build the Hypatia scanner here: hex.pm is unreachable through this environment's proxy. Instead I simulated the scanner's suppression logic. That means
directive_reandinline_allowed?/4at hypatia82396d81, which is the CI pin, reimplemented in Perl. Results:main: 18 unsuppressed findings (9 casts × 2 rules), matching the gate's flagged files.Zig isn't available here either. The change is comments only, so the Chapel CI Zig build is unaffected. #464 has the same commit merged in; its gate run is the real check.
Generated by Claude Code