fix(deps): bump libp2p 0.56 -> 0.57 in personal-sysadmin (hickory 0.26)

[hyperpolymath]

Refs hyperpolymath/.git-private-farm#96 (owner ruling D138: accept the major bump and fix breakage).

What

• personal-sysadmin/Cargo.toml: libp2p 0.56 -> 0.57. libp2p 0.56 pulled hickory-proto 0.25.2 through libp2p-mdns 0.48 and libp2p-dns 0.44 -> hickory-resolver 0.25.2. libp2p 0.57 uses the hickory 0.26 line. personal-sysadmin/Cargo.lock now resolves hickory-proto, hickory-resolver and hickory-net at 0.26.3.
• No source change was needed: personal-sysadmin/src mentions libp2p only in comments (src/p2p/mod.rs).
• Pre-existing build break fixed: reqwest 0.13 gates RequestBuilder::query behind the query feature, so personal-sysadmin on origin/main (181076c) failed with 3x E0599 (src/storage/mod.rs:257,308, src/cache/mod.rs:128). This PR adds "query" to reqwest's features.

Resolves Dependabot alerts #88 (GHSA-3v94-mw7p-v465, >= 0.25.0-alpha.3, <= 0.25.2) and #89 (GHSA-q2qq-hmj6-3wpp, >= 0.3.1, <= 0.26.0). 0.26.3 is outside both ranges. #99 (ammonia, czech-file-knife) is out of scope.

Verification (local, personal-sysadmin/, rustc 1.97.1)

• cargo build: ok (only dead-code warnings). origin/main fails, see above.
• cargo test --locked: ok, 8 + 8 + 0 passed, 0 failed

Open Dependabot PRs

#382 (config) and #383 (libc) also edit personal-sysadmin/Cargo.lock. git merge-tree against this branch is clean for both. #384 only touches czech-file-knife/Cargo.lock.

Out of scope, noted: clinician's p2p feature uses libp2p::* but clinician/Cargo.toml declares no libp2p dependency (p2p = []), so --features p2p cannot build. Unchanged by this PR.

Deferred checks (red on main too, not caused by this PR)

• scan / gitleaks: fails identically on main 181076c. Deferred to scan / gitleaks fails on main (181076c), inherited by every PR #386
• rust-ci / Cargo check + clippy + fmt: rustfmt drift in clinician/src/** (this PR touches no .rs); also red on main. Deferred to main HEAD (8f75e31) is red: rust-ci, 4x mirror jobs, Hypatia, Codeac — inherited by any PR against main #378
• Codeac analyze results: "Codeac was not able to perform analysis" on main too. Deferred to main HEAD (8f75e31) is red: rust-ci, 4x mirror jobs, Hypatia, Codeac — inherited by any PR against main #378

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2d630d33-0977-4407-879a-0c316360b596

📥 Commits

Reviewing files that changed from the base of the PR and between 181076c and 48281d9.

⛔ Files ignored due to path filters (1)

• personal-sysadmin/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• personal-sysadmin/Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: Dogfooding compliance summary
• GitHub Check: rust-ci / Cargo check + clippy + fmt
• GitHub Check: semgrep-cloud-platform/scan
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: analyze (javascript-typescript, none)

⚠️ CI failures not shown inline (7)

GitHub Actions: Secret Scanner / 0_scan _ gitleaks.txt: fix(deps): bump libp2p 0.56 -> 0.57 in personal-sysadmin (hickory 0.26)

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# A repo-local baseline wins outright — it is expected to `[extend]`�[0m
 �[36;1m# the estate one, so "wins" still means "inherits". This mirrors what�[0m
 �[36;1m# the AsciiDoc pass below already did, which was inconsistent with�[0m
 �[36;1m# this step until now.�[0m
 �[36;1mCONFIG=".gitleaks-estate.toml"�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;1m  CONFIG=".gitleaks.toml"�[0m
 �[36;1m  echo "Using repository .gitleaks.toml (extending the estate baseline)."�[0m
 �[36;1melse�[0m
 �[36;1m  echo "Using estate baseline allowlist."�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m"$RUNNER_TEMP/gitleaks" detect \�[0m
 �[36;1m  --source . \�[0m
 �[36;1m  --no-git \�[0m
 �[36;1m  --redact \�[0m
 �[36;1m  --no-banner \�[0m
 �[36;1m  --verbose \�[0m
 �[36;1m  --config "$CONFIG" \�[0m
 �[36;1m  --exit-code 1�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Using estate baseline allowlist.
 Finding:     let line = "***REDACTED_SECRET_ASSIGNMENT***
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      generic-api-key
 Entropy:     4.321928
 File:        emergency-button/rust/src/capture.rs
 Line:        289
 Fingerprint: emergency-button/rust/src/capture.rs:generic-api-key:289
 Finding:     ...mem�s3cretValue123�[�[1;3;mREDACTED�[0m]�Contact user@examp...
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      aws-access-token
 Entropy:     3.684184
 File:        emergency-room/.zig-cache/z/4bf83d96360b1bfc3af471d7bfdb183e
 Line:        16
 Fingerprint: emergency-room/.zig-cache/z/4bf83d96360b1bfc3af471d7bfdb183e:aws-access-***REDACTED_SECRET_ASSIGNMENT***
 Finding:     ...mem�s3cretValue123�[�[1;3;mREDACTED�[0m]�Contact user@examp...
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      aws-access-token
 Entropy:     3.684184
 File:        emergency-room/.zig-cache/z/4bf83d96360b1bfc3af471d7bfdb183e
 Line:        16
 Fingerprint: emergency-room/.zig-cache/z/4bf83d96360b1bfc3af471d7bfdb183e:aws-access-***REDACTE...

---

GitHub Actions: Secret Scanner / scan _ gitleaks: fix(deps): bump libp2p 0.56 -> 0.57 in personal-sysadmin (hickory 0.26)

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# A repo-local baseline wins outright — it is expected to `[extend]`�[0m
 �[36;1m# the estate one, so "wins" still means "inherits". This mirrors what�[0m
 �[36;1m# the AsciiDoc pass below already did, which was inconsistent with�[0m
 �[36;1m# this step until now.�[0m
 �[36;1mCONFIG=".gitleaks-estate.toml"�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;1m  CONFIG=".gitleaks.toml"�[0m
 �[36;1m  echo "Using repository .gitleaks.toml (extending the estate baseline)."�[0m
 �[36;1melse�[0m
 �[36;1m  echo "Using estate baseline allowlist."�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m"$RUNNER_TEMP/gitleaks" detect \�[0m
 �[36;1m  --source . \�[0m
 �[36;1m  --no-git \�[0m
 �[36;1m  --redact \�[0m
 �[36;1m  --no-banner \�[0m
 �[36;1m  --verbose \�[0m
 �[36;1m  --config "$CONFIG" \�[0m
 �[36;1m  --exit-code 1�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Using estate baseline allowlist.
 Finding:     let line = "***REDACTED_SECRET_ASSIGNMENT***
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      generic-api-key
 Entropy:     4.321928
 File:        emergency-button/rust/src/capture.rs
 Line:        289
 Fingerprint: emergency-button/rust/src/capture.rs:generic-api-key:289
 Finding:     ...mem�s3cretValue123�[�[1;3;mREDACTED�[0m]�Contact user@examp...
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      aws-access-token
 Entropy:     3.684184
 File:        emergency-room/.zig-cache/z/4bf83d96360b1bfc3af471d7bfdb183e
 Line:        16
 Fingerprint: emergency-room/.zig-cache/z/4bf83d96360b1bfc3af471d7bfdb183e:aws-access-***REDACTED_SECRET_ASSIGNMENT***
 Finding:     ...mem�s3cretValue123�[�[1;3;mREDACTED�[0m]�Contact user@examp...
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      aws-access-token
 Entropy:     3.684184
 File:        emergency-room/.zig-cache/z/4bf83d96360b1bfc3af471d7bfdb183e
 Line:        16
 Fingerprint: emergency-room/.zig-cache/z/4bf83d96360b1bfc3af471d7bfdb183e:aws-access-***REDACTE...

---

GitHub Actions: Secret Scanner / 1_scan _ rust-secrets.txt: fix(deps): bump libp2p 0.56 -> 0.57 in personal-sysadmin (hickory 0.26)

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

---

GitHub Actions: Secret Scanner / scan _ rust-secrets: fix(deps): bump libp2p 0.56 -> 0.57 in personal-sysadmin (hickory 0.26)

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

---

GitHub Actions: Secret Scanner / 2_scan _ shell-secrets.txt: fix(deps): bump libp2p 0.56 -> 0.57 in personal-sysadmin (hickory 0.26)

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

---

GitHub Actions: Secret Scanner / scan _ shell-secrets: fix(deps): bump libp2p 0.56 -> 0.57 in personal-sysadmin (hickory 0.26)

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

---

Commit Status: Codeac analyze results: Codeac analyze results

Conclusion: failure

Codeac was not able to perform analysis.

🔇 Additional comments (1)

personal-sysadmin/Cargo.toml (1)

31-31: LGTM!

Also applies to: 36-37

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the networking foundation to support request query parameters and work with a newer networking stack. These are behind-the-scenes updates; no new screens or workflows are included. Existing features remain available.

Walkthrough

The Cargo manifest enables the reqwest query feature and updates the libp2p version requirement from 0.56 to 0.57. The existing libp2p feature set remains unchanged.

Changes

Dependency updates

Layer / File(s)	Summary
Update Rust dependencies personal-sysadmin/Cargo.toml	reqwest adds the query feature while retaining json. The libp2p version requirement changes to 0.57, with its existing feature set unchanged.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 48281

The dependency lockfile matches the requested versions, and the added query capability matches the existing storage behavior. No concrete merge-blocking risk is evident.

Architecture Summary

Architecture risk: 🔵 Low · up to 48281

The change affects 1 system.

Changed systems: personal-sysadmin

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — personal-sysadmin (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in personal-sysadmin/Cargo.toml: reqwest adds the query feature while retaining json. libp2p is upgraded from 0.56 to 0.57; its existing feature set is unchanged. A comment about the earlier 0.56 update remains, and a new comment describes the 0.57 update.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the libp2p dependency update from 0.56 to 0.57, which is the main change.
Description check	✅ Passed	The description explains the dependency update, the reqwest feature change, and the reported verification results. It is directly related to the changeset.

✨ Finishing Touches

🛠️ Fix failing CI checks

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the Cargo list,
query joins the features in the mix.
libp2p steps up a notch,
The manifest gets a tidy watch.
Then off I hop, content and quick!}

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Add Carrot credits or activate Agent usage billing to use Autopilot

[coderabbitai]

⚠️ Agent ran but produced no code changes.

The CI failures may require manual intervention.

View agent analysis

I made no changes. None of these failures come from this PR, and the fixes they need are outside what I'm allowed to change here.

**What I found:** `git diff origin/main..HEAD` is empty. The PR's content is already on `origin/main` as the squash-merged `78c7882` (#385), so the branch's tree is the same as main's. The PR only ever touched `personal-sysadmin/Cargo.toml` and `Cargo.lock`, and none of the failures point at those files.

- **`rust-ci / Cargo check + clippy + fmt`:** the formatter wants to reformat files the PR never touched: `clinician/src/**`, `contracts-rust/**` and `emergency-button/rust/**`. This drift is also on main (tracked in #378). Fixing it means running `cargo fmt` across several crates, which is a repo-wide reformat, not a targeted fix, and I'm not allowed to run the formatter here.
- **`Secret Scanner / gitleaks`:** the 5 hits are all on main too (tracked in #386):
  - fake secrets in test code in `emergency-button/rust/src/capture.rs:289` and `emergency-room/rust/src/capture.rs:289`
  - a `.zig-cache` build-artifact file under `emergency-room/` (two hits)
  - a fixture in `hybrid-automation-router/test/attestation/a2ml_test.exs:61`

  The proper fixes are a repo `.gitleaks.toml` allowlist (scanner config, which I'm not allowed to change) and removing the cached `.zig-cache` files from the repo. Both belong in #386.
- **`rust-secrets` / `shell-secrets` (and the `1_`/`2_` variants):** the log excerpts cut off before any findings, so I can't tell which files were flagged. They're in the same scanner family as gitleaks and the PR changed no `.sh` or `.rs` files, so they're almost certainly also on main.
- **Codeac:** "Codeac was not able to perform analysis" is a problem with the external service, not the code. It's also failing on main.

**What to do:** treat these as main-branch problems and fix them in #378 (one `cargo fmt --all` commit) and #386 (gitleaks allowlist plus removing `.zig-cache`), not in this PR.