[hyperpolymath]

Summary

Since #458, echidna's workflows run again, which exposed small reds on main and on every PR. This PR fixes them. Each was reproduced locally first, then shown fixed with the same tool CI uses.

Changes

• src/rust/proof_search.rs: cargo fmt with the repo's pinned 1.99.0 toolchain.
  • Rust CI on main (run 42351375993) fails only at the fmt step.
  • This is the only file the workspace-wide cargo fmt --all touches.
• Cargo.lock: rmcp and rmcp-macros 3.5.0 → 3.9.0 for RUSTSEC-2026-0457, -0461 and -0462. The newest was published 2026-11-05, after main last passed Dependency audit.
  • Ported from fix(ci): restore main's red checks (rmcp RustSec, rustfmt, Hypatia Zig casts) #465 so this PR doesn't wait on it: cargo update -p rmcp --precise 3.9.0, inside the existing "3" requirement.
  • The resulting Cargo.lock and proof_search.rs are byte-identical to fix(ci): restore main's red checks (rmcp RustSec, rustfmt, Hypatia Zig casts) #465's, so whichever merges first leaves the other a no-op.
• .github/workflows/workflow-linter.yml: rename authority_sha → standards_rev.
  • gitleaks generic-api-key read the 40-hex commit id as a key only because the variable name contains "auth".
  • The fix is at the source, so no .gitleaks.toml entry is added. An earlier commit on this branch added one, and Exemption ratchet rejected the ledger growth (2 → 3). That entry is gone.
• echidna-playground/ci-templates/governance.yml: the never-run template now names metadatastician/standards. It uses the same pin as root's live governance.yml (a797d30) instead of the old owner at 861b5e9.

RSR Quality Checklist

Required

• Tests pass:
  • cargo fmt --all -- --check passes;
  • cargo check -p echidna-mcp --locked passes against rmcp 3.9.0 (the crate has no tests).
• Code is formatted: cargo fmt --all -- --check passes.
• Linter is clean: actionlint 1.7.7 reports 0 findings on both workflow files.
• No banned language patterns
• No unsafe blocks: none added
• No banned functions: none
• SPDX license headers present: unchanged
• No secrets, credentials, or .env files included

As Applicable

Nothing in this list applies.

Testing

gitleaks. CI-pinned gitleaks 8.18.4 (checksum-verified), with the estate baseline staged at the root exactly as secret-scanner-reusable.yml stages it:

Tree	Findings
old name authority_sha, no .gitleaks.toml entry	1: generic-api-key at workflow-linter.yml:80
this branch (standards_rev, no entry)	0
this branch, plus a planted api_token=ghp_… beside it	1: the plant, so it is still detected

Dependency audit. scripts/ci/audit-dependencies.sh with cargo-audit 0.22.2:

• before: Cargo.lock: FAILED, with the three rmcp advisories;
• after: Cargo.lock and fuzz/Cargo.lock both PASSED.

Rust CI. I reproduced the fmt failure locally on main with toolchain 1.99.0; after this change cargo fmt --all -- --check passes.

Checks red here, and not caused by this PR

• Static Analysis / panic-attack assail has been red on main since audit: routing/rule-engine recon, Logtalk quarantine; Agda proofs re-checked under PROOF-POLICY §2.1 #455. Two causes:
  • The pinned scanner can't finish a scan of this tree, which fix(ci): pin panic-attack f2a6a70 so the static analysis scan can complete #478 fixes.
  • After that, the gate blocks on two deliberate sorry detector fixtures, which test(corpus): mark the two deliberate sorry fixtures as accepted detector inputs #480 handles together with feat(assail): line-anchor Lean/Isabelle sorry findings so inline markers apply panic-attack#278.

Observed, not changed here

• mirror.yml is back on the pre-transfer pin 3c00687.
  • audit: routing/rule-engine recon, Logtalk quarantine; Agda proofs re-checked under PROOF-POLICY §2.1 #455's merge restored it, with its old comment.
  • Main now pins standards at three SHAs: governance a797d30; hypatia, scorecard and spark d3e4b48; mirror 3c00687.
  • The lock still closes, and lock-sync and coordinates pass. But relock-standards-pin.sh refuses mixed pins, so the next estate repin will stop here until mirror moves too.
• Mirror failures on main are forge configuration, not code. The disroot, gitea and sourcehut jobs fail "Verify … SSH host" against the repo variables *_SSH_FINGERPRINT, and the bitbucket push fails.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JHfuPCv1pEiqkQGG5DQASb

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 22 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 8aea3c74-e8fa-4cb0-92f3-dbe3cfa5fd03

Commits

Reviewing files that changed from the base of the PR and between f385a6d and 5619eb5.

Files selected for processing: 2

• .github/workflows/workflow-linter.yml
• echidna-playground/ci-templates/governance.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[hyperpolymath]

CI status after 198622c:

• governance / Exemption ratchet (.gitleaks.toml: 2 -> 3): this PR's own failure, fixed in 08d74c8. The gitleaks false positive is now fixed at the source by renaming the variable, and the ledger entry is removed.
• Dependency audit: not this PR's. rmcp 3.5.0 picked up RUSTSEC-2026-0457, -0461 and -0462, and main fails on the same lockfile. I ported fix(ci): restore main's red checks (rmcp RustSec, rustfmt, Hypatia Zig casts) #465's bump in 198622c; the lockfile is byte-identical to fix(ci): restore main's red checks (rmcp RustSec, rustfmt, Hypatia Zig casts) #465's. The audit passes locally on both lockfiles.
• panic-attack assail: not this PR's. It has been red on main since audit: routing/rule-engine recon, Logtalk quarantine; Agda proofs re-checked under PROOF-POLICY §2.1 #455, because the pinned scanner can't finish a scan of this tree and then two deliberate fixture sorry lines block the gate. The fix spans fix(ci): pin panic-attack f2a6a70 so the static analysis scan can complete #478, test(corpus): mark the two deliberate sorry fixtures as accepted detector inputs #480 and feat(assail): line-anchor Lean/Isabelle sorry findings so inline markers apply panic-attack#278, which change files this PR doesn't touch, so I haven't ported it here. I don't have the means to re-run jobs from this session.

---

Generated by Claude Code

[hyperpolymath]

governance / Validate Hypatia Baseline is red here for a reason that isn't this PR's:

• What fails: Hypatia reports code_safety/zig_ptr_cast and zig_align_cast (high) on the nine @ptrCast(@alignCast(raw)) callback casts in src/zig_ffi/.
• Why it isn't this PR's: the same check is red on main for the same findings. This PR doesn't touch Zig.
• What I did: ported fix(ci): restore main's red checks (rmcp RustSec, rustfmt, Hypatia Zig casts) #465's fix in 5276657: one reasoned inline hypatia: allow per rule per line, comments only, no baseline entry. The two files are byte-identical to fix(ci): restore main's red checks (rmcp RustSec, rustfmt, Hypatia Zig casts) #465's, so whichever PR merges first leaves the other clean.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T22:55:08.998520Z	5619eb5	New commits
🔒 Security Review	❌ Failed 2026-11-09T22:53:52.660247Z We couldn’t complete this review. Comment @codex security review to try again.	5619eb5	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins.

[chatgpt-codex-connector]

This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud