Repair audit findings: dependency security, errors, identity and template reads

jlxq0 commented

2026-10-24 02:14:48 +00:00

Owner

Implements fleet t_9d164f0d; acceptance criteria read from its first comment. Audit source a6c8bd5dd0 (v0.4.4); canonical fetch unchanged, no open PRs. Prior audit t_3bc636f4 has no board attachment; its handoff and fresh source/advisory/live checks supply evidence.

Clear dependency advisories/yanked chacha20 with Rust 1.93-compatible targeted lockfile updates.
Preserve HTTP status and bounded, key-redacted JSON diagnostics; classify auth, missing/conflicting resources via audit::class_for_code.
Report application name/version in initialize and /health; remove account-specific instructions.
Bound per-key template cache memory/lifetime, invalidate on create, never cache partial lists or errors.
Wiremock write bodies, multi-page search, history/folders; retain auth/host/rate-limit regressions.
Remove dead Matrix URL-safety module.
Full fmt, Clippy 1.98, tests, deny/audit, Rust 1.93; independent pre-PR review, max two reworks.
Exact-head CI, protected merge and versioned release, preserve gates.
Real valid-key Claude read-only proof; access/deployment gap assigned Clark board t_7c4c63ff. Dummy probe is not proof.
Task closeout lessons/docs lint.

No real workout writes authorized. No auth/protection weakening. Historical CI does not supersede fresh advisory failure. Quinn absent default runtime graph; TLS trust dependencies protect bearer-bearing outbound requests. Direct AsyncFd use not found; not claiming exploitability of every advisory.

Published v0.5.0 at merge 4444b987bb, image digest sha256:f30eaba555f7535c43082874f823ce25ec93c6337c3182a89768809ed5437e98. Source fixes, independent review, full checks, exact-head PR CI, main/release CI and closeout are complete. Keep this issue open for Clark rollout/real client proof; no credential was supplied to this worker and Claude has no configured Hevy MCP server.

Implements fleet t_9d164f0d; acceptance criteria read from its first comment. Audit source a6c8bd5dd0913bd3739785140520116b8efb4ee9 (v0.4.4); canonical fetch unchanged, no open PRs. Prior audit t_3bc636f4 has no board attachment; its handoff and fresh source/advisory/live checks supply evidence. - [x] Clear dependency advisories/yanked chacha20 with Rust 1.93-compatible targeted lockfile updates. - [x] Preserve HTTP status and bounded, key-redacted JSON diagnostics; classify auth, missing/conflicting resources via audit::class_for_code. - [x] Report application name/version in initialize and /health; remove account-specific instructions. - [x] Bound per-key template cache memory/lifetime, invalidate on create, never cache partial lists or errors. - [x] Wiremock write bodies, multi-page search, history/folders; retain auth/host/rate-limit regressions. - [x] Remove dead Matrix URL-safety module. - [x] Full fmt, Clippy 1.98, tests, deny/audit, Rust 1.93; independent pre-PR review, max two reworks. - [x] Exact-head CI, protected merge and versioned release, preserve gates. - [ ] Real valid-key Claude read-only proof; access/deployment gap assigned Clark board t_7c4c63ff. Dummy probe is not proof. - [x] Task closeout lessons/docs lint. No real workout writes authorized. No auth/protection weakening. Historical CI does not supersede fresh advisory failure. Quinn absent default runtime graph; TLS trust dependencies protect bearer-bearing outbound requests. Direct AsyncFd use not found; not claiming exploitability of every advisory. Published v0.5.0 at merge 4444b987bba8abec0b975d72176d7fd046fa3623, image digest sha256:f30eaba555f7535c43082874f823ce25ec93c6337c3182a89768809ed5437e98. Source fixes, independent review, full checks, exact-head PR CI, main/release CI and closeout are complete. Keep this issue open for Clark rollout/real client proof; no credential was supplied to this worker and Claude has no configured Hevy MCP server.

jlxq0 commented

2026-10-24 02:16:08 +00:00

Author

Owner

Candidate validation: cargo +1.98.0 fmt --all --check, Clippy --all-targets --all-features --locked -D warnings, 54/54 tests, cargo +1.93.0 check --all-features --locked, cargo audit and cargo deny check pass. Baseline 59 tests included 12 tests in the removed dead Matrix URL module; 7 new behavior tests added. New tests drive real MCP error/identity envelopes, all workout/routine write bodies through wiremock, template multi-page search/cache key isolation/expiry/create invalidation/partial-error nonretention, history/folder requests. Independent fresh read-only reviewer is examining the candidate before PR creation. No real writes performed. Clark access card t_7c4c63ff pending; request queued to Clark:hermes.

jlxq0 referenced this issue

2026-10-24 02:19:02 +00:00

fix: repair Hevy audit findings and dependency security (v0.5.0) #17

jlxq0 commented

2026-10-24 02:19:02 +00:00

Author

Owner

Reviewed candidate committed/pushed as b877732; PR #17 opened after independent pre-PR review. One rework closed normalization/redaction and empty nonfinal-page cache findings; reviewer independently ran 58 passing tests. Final full fmt/Clippy 1.98/test/audit/deny/Rust 1.93 gates all pass. Main protections unchanged (CI / cargo*, apply_to_admins true, no direct push). CI single cache exporter preserved. Old merged fix/clamp-pagination remote branch removed after ancestry check; fix/session-reclaim was already gone. Closeout: added two root-cause/cache conventions and linted repository docs; no state file added. Exact-head CI/release and Clark valid-key Claude proof remain pending.

Reviewed candidate committed/pushed as b877732; PR #17 opened after independent pre-PR review. One rework closed normalization/redaction and empty nonfinal-page cache findings; reviewer independently ran 58 passing tests. Final full fmt/Clippy 1.98/test/audit/deny/Rust 1.93 gates all pass. Main protections unchanged (CI / cargo*, apply_to_admins true, no direct push). CI single cache exporter preserved. Old merged fix/clamp-pagination remote branch removed after ancestry check; fix/session-reclaim was already gone. Closeout: added two root-cause/cache conventions and linted repository docs; no state file added. Exact-head CI/release and Clark valid-key Claude proof remain pending.

jlxq0 commented

2026-10-24 02:25:31 +00:00

Author

Owner

Protected merge completed after exact-head cargo/docker CI run 51 passed (cargo 3m6s; actual docker task 1m35s). PR #17 merged to 4444b987bb. Verified merge tree byte-identical to reviewed/tested b8777321c4. Publishing annotated v0.5.0 at the merge commit; watching main/tag CI and genuine docker tasks. No branch protection or workflow changes. Real valid-key Claude client proof remains Clark card t_7c4c63ff; current live image is still v0.4.4, not assumed updated by tag publication.

Protected merge completed after exact-head cargo/docker CI run 51 passed (cargo 3m6s; actual docker task 1m35s). PR #17 merged to 4444b987bba8abec0b975d72176d7fd046fa3623. Verified merge tree byte-identical to reviewed/tested b8777321c4d812808c1c200a56e629222daa9ce2. Publishing annotated v0.5.0 at the merge commit; watching main/tag CI and genuine docker tasks. No branch protection or workflow changes. Real valid-key Claude client proof remains Clark card t_7c4c63ff; current live image is still v0.4.4, not assumed updated by tag publication.

jlxq0 commented

2026-10-24 02:32:18 +00:00

Author

Owner

Release complete: https://forge.oddie.app/jlxq0/hevy-mcp/releases/tag/v0.5.0 at 4444b987bb; registry manifest readback verified sha256:f30eaba555f7535c43082874f823ce25ec93c6337c3182a89768809ed5437e98. CI run 52 main and 53 tag: all four genuine cargo/docker tasks passed. Docker windows (UTC, observed current task timestamps): main task 27459 02:28:14–02:29:53; tag task 27460 02:28:15–02:29:37, overlap 82s. This supplies the overlap evidence missing from v0.4.0 for the single buildcache exporter fix; it is not inferred from green statuses alone. Protections read back unchanged. Closeout: two pitfall/convention bullets and README behavior docs, commands checked and docs linted. Remaining gate: Clark card t_7c4c63ff for GitOps rollout and actual valid-key Claude read-only proof; current deploy still v0.4.4 at prior readback. Source repair card can close under its explicit missing-key-to-Clark alternative while this issue remains open for operational proof.

Release complete: https://forge.oddie.app/jlxq0/hevy-mcp/releases/tag/v0.5.0 at 4444b987bba8abec0b975d72176d7fd046fa3623; registry manifest readback verified sha256:f30eaba555f7535c43082874f823ce25ec93c6337c3182a89768809ed5437e98. CI run 52 main and 53 tag: all four genuine cargo/docker tasks passed. Docker windows (UTC, observed current task timestamps): main task 27459 02:28:14–02:29:53; tag task 27460 02:28:15–02:29:37, overlap 82s. This supplies the overlap evidence missing from v0.4.0 for the single buildcache exporter fix; it is not inferred from green statuses alone. Protections read back unchanged. Closeout: two pitfall/convention bullets and README behavior docs, commands checked and docs linted. Remaining gate: Clark card t_7c4c63ff for GitOps rollout and actual valid-key Claude read-only proof; current deploy still v0.4.4 at prior readback. Source repair card can close under its explicit missing-key-to-Clark alternative while this issue remains open for operational proof.

jlxq0 commented

2026-10-24 02:34:08 +00:00

Author

Owner

Coordination correction: fleet lead has linked Clark card t_7c4c63ff as a prerequisite of t_9d164f0d. Native completion correctly refused while that parent is running. Preserve the final rollout and actual authenticated Claude-client gate; do not use the earlier missing-key fallback wording to close the gated card. Source fixes/review/checks/release and digest readback are complete, but current live deployment remains v0.4.4 and the final proof is still pending. No override or dependency removal attempted.

Rows
Columns

Repair audit findings: dependency security, errors, identity and template reads #16