fix(ci): keep one cargo-audit suppression, and record v0.2.1 as live #17

Merged

jlxq0 merged 2 commits from chore/one-audit-suppression into main

2026-08-26 05:38:16 +00:00

jlxq0 commented

2026-08-26 05:20:35 +00:00

Owner

Two things, both measured rather than reasoned about.

One cargo-audit suppression, in the file

cargo audit ran with --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195 while
.cargo/audit.toml listed the same two. Those copies were not redundant: --ignore
appends to the configured ignore list rather than being read from it, so the flags
suppressed the advisories whatever the file said.

Measured 2026-08-26 by emptying the file's ignore list:

command	exit
`cargo audit --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195` (the old line)	0
`cargo audit` (the new line)	1, `1 vulnerability found!`

So deleting the documented, commented, reviewable entry from .cargo/audit.toml would
have changed nothing anyone could observe, and the next quick-xml bump would have kept a
live advisory suppressed with no way to tell. A suppression that two places grant is a
suppression neither place can remove.

Verified by removal in the new arrangement: dropping RUSTSEC-2026-0194 alone from
.cargo/audit.toml takes cargo audit from exit 0 to exit 1 on
RUSTSEC-2026-0194 quick-xml — Quadratic run time when checking a start tag for duplicate attribute names (7.5 high). Restored, exit 0.

The advisory set CI accepts is unchanged. Confirmed by cross-engine review (Codex,
read-only) against cargo-audit's config discovery: the step has no working-directory,
so it runs at the checkout root; discovery constructs and tests ./.cargo/audit.toml
before consulting Cargo home, so CARGO_HOME cannot divert it.

The second commit is Codex's one finding: the cargo-audit binary is restored from cache
and only built when absent, so a green audit never recorded which version produced it.
Now printed.

Pitfall added to AGENTS.md.

docs/release-evidence.md described a release that is no longer live

It said v0.2.0 and carried the v0.2.0 digest. Production has run v0.2.1 since 2026-08-25.
Verified 2026-08-26:

/health reports version 0.2.1, four templates, 1/1 Ready, zero restarts
the pod's app container runs
sha256:0b3da4c968bd91f470fd74f2225682da3b922845d6fa2dc91bb844f5bad216cb
the registry resolves both v0.2.1 and latest to that same digest
Argo CD Synced/Healthy at 75e84c08f09a9d45b98f5a6dc01aaa94529f469f

Two things changed beyond the numbers:

Measurements not repeated for v0.2.1 are now marked inherited, with their dates,
instead of being restated as current. The 279-test figure and the v0.2.0 soak's RSS
numbers were measured on 2026-08-22/23 and have not been re-run; saying so is the
difference between evidence and a copied paragraph.
The RFC 8252 loopback fix (#2) is recorded with the production probe table, driven
at the allowlist read off the container environment rather than an in-repo copy. It
includes the four near-misses it refuses (127.0.0.1 for localhost, a wrong path,
https against an http entry, a non-loopback host), because three acceptances alone
would also be produced by a matcher that accepts everything.

The note about reading the digest from the app container is there because the obvious
query — selecting a container named typst-mcp — prints a pod name and an empty field
rather than an error, which is invisible in a terminal. It cost me one wrong reading.

Not in this PR

No Rust changes. The full local gate has cargo fmt --all --check and clippy green;
cargo test has two failures on this machine
(a_runaway_document_times_out_and_the_server_keeps_serving,
the_big_five_exercises_five_uploaded_jpegs_end_to_end), both wall-clock assertions
against a 3 s and a 30 s compile deadline, taken while the load average was 964 on 16
cores from a concurrent Xcode build and a running simulator. The diff touches no Rust, and
Forge run 76 was green on this commit's parent earlier today. CI on this branch is the
gate, not my local run.

Two things, both measured rather than reasoned about. ## One cargo-audit suppression, in the file `cargo audit` ran with `--ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195` while `.cargo/audit.toml` listed the same two. Those copies were **not** redundant: `--ignore` appends to the configured ignore list rather than being read from it, so the flags suppressed the advisories whatever the file said. Measured 2026-08-26 by emptying the file's `ignore` list: | command | exit | |---|---| | `cargo audit --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195` (the old line) | **0** | | `cargo audit` (the new line) | **1**, `1 vulnerability found!` | So deleting the documented, commented, reviewable entry from `.cargo/audit.toml` would have changed nothing anyone could observe, and the next `quick-xml` bump would have kept a live advisory suppressed with no way to tell. A suppression that two places grant is a suppression neither place can remove. Verified by removal in the new arrangement: dropping `RUSTSEC-2026-0194` alone from `.cargo/audit.toml` takes `cargo audit` from exit 0 to exit 1 on `RUSTSEC-2026-0194 quick-xml — Quadratic run time when checking a start tag for duplicate attribute names (7.5 high)`. Restored, exit 0. The advisory set CI accepts is unchanged. Confirmed by cross-engine review (Codex, read-only) against cargo-audit's config discovery: the step has no `working-directory`, so it runs at the checkout root; discovery constructs and tests `./.cargo/audit.toml` before consulting Cargo home, so `CARGO_HOME` cannot divert it. The second commit is Codex's one finding: the cargo-audit binary is restored from cache and only built when absent, so a green audit never recorded which version produced it. Now printed. Pitfall added to `AGENTS.md`. ## docs/release-evidence.md described a release that is no longer live It said v0.2.0 and carried the v0.2.0 digest. Production has run v0.2.1 since 2026-08-25. Verified 2026-08-26: - `/health` reports version `0.2.1`, four templates, `1/1` Ready, zero restarts - the pod's **`app`** container runs `sha256:0b3da4c968bd91f470fd74f2225682da3b922845d6fa2dc91bb844f5bad216cb` - the registry resolves both `v0.2.1` and `latest` to that same digest - Argo CD Synced/Healthy at `75e84c08f09a9d45b98f5a6dc01aaa94529f469f` Two things changed beyond the numbers: - **Measurements not repeated for v0.2.1 are now marked inherited, with their dates**, instead of being restated as current. The 279-test figure and the v0.2.0 soak's RSS numbers were measured on 2026-08-22/23 and have not been re-run; saying so is the difference between evidence and a copied paragraph. - **The RFC 8252 loopback fix (#2) is recorded with the production probe table**, driven at the allowlist read off the container environment rather than an in-repo copy. It includes the four near-misses it refuses (`127.0.0.1` for `localhost`, a wrong path, `https` against an `http` entry, a non-loopback host), because three acceptances alone would also be produced by a matcher that accepts everything. The note about reading the digest from the `app` container is there because the obvious query — selecting a container named `typst-mcp` — prints a pod name and an empty field rather than an error, which is invisible in a terminal. It cost me one wrong reading. ## Not in this PR No Rust changes. The full local gate has `cargo fmt --all --check` and clippy green; `cargo test` has two failures on this machine (`a_runaway_document_times_out_and_the_server_keeps_serving`, `the_big_five_exercises_five_uploaded_jpegs_end_to_end`), both wall-clock assertions against a 3 s and a 30 s compile deadline, taken while the load average was 964 on 16 cores from a concurrent Xcode build and a running simulator. The diff touches no Rust, and Forge run 76 was green on this commit's parent earlier today. CI on this branch is the gate, not my local run.

jlxq0 added 2 commits

2026-08-26 05:20:35 +00:00

fix(ci): keep one cargo-audit suppression, in the file 4c60da584c

`cargo audit` ran with `--ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195`
while `.cargo/audit.toml` listed the same two. The copies were not redundant:
`--ignore` suppresses independently of the file rather than being read from it.

Measured 2026-08-26 by emptying the file's `ignore` list: the old workflow line
still exited 0, a bare `cargo audit` exited 1 with "1 vulnerability found!".
So deleting the documented, commented, reviewable entry would have changed
nothing anyone could observe, and the next quick-xml bump would have kept a
live advisory suppressed with no way to tell.

Drop the flags. `.cargo/audit.toml` is now the only grant, verified by removal:
dropping RUSTSEC-2026-0194 from it takes the gate from exit 0 to exit 1.

Also correct docs/release-evidence.md, which still described v0.2.0 and the
v0.2.0 digest while production has run v0.2.1 since 2026-08-25. Live check:
`/health` reports 0.2.1, the pod's `app` container runs
sha256:0b3da4c9..., and the registry resolves both `v0.2.1` and `latest` to it.
Measurements not repeated for v0.2.1 are now marked inherited with their dates
instead of being restated as current, and the RFC 8252 loopback fix is recorded
with the production probe table that shows it refusing the four near-misses.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018CXx4uyuDhqwungt4SMN4S

ci(audit): print the cargo-audit version that ran

CI / cargo (pull_request) Successful in 1m57s

Details

CI / docker (pull_request) Successful in 23s

Details

e1a6c864f7

The binary is restored from cache and only built when absent, so a green audit
never recorded which version produced it. Raised by cross-engine review.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018CXx4uyuDhqwungt4SMN4S

jlxq0 referenced this pull request

2026-08-26 05:24:58 +00:00

Two http tests assert on wall-clock deadlines and fail under machine load #19

jlxq0 merged commit 0366d5bc29 into main

2026-08-26 05:38:16 +00:00

jlxq0 referenced this pull request from a commit

2026-08-26 05:38:18 +00:00

Merge pull request 'fix(ci): keep one cargo-audit suppression, and record v0.2.1 as live' (#17) from chore/one-audit-suppression into main

jlxq0 referenced this pull request

2026-08-27 02:01:27 +00:00

docs(agents): record why CI / docker is not a required status #20