fix(zig): port the boj-invoke CLI to Zig 0.16 process.Init by hyperpolymath · Pull Request #355 · hyperpolymath/boj-server

hyperpolymath · 2026-10-07T11:19:10Z

Summary

Follow-up to #354 (the bench). Zig 0.16 also removed std.heap.GeneralPurposeAllocator and std.process.argsAlloc. Because of that, zig build invoke fails with src/boj_invoke_cli.zig:45:23: error: root source file struct 'heap' has no member named 'GeneralPurposeAllocator'. That takes down E2E — Full REST + MCP Bridge, which is red on main, and the Catalogue truthfulness --probe job. Plain zig build never builds the invoke step, which is why the local check on #354 missed it.

Changes

ffi/zig/src/boj_invoke_cli.zig: main now takes std.process.Init and uses init.gpa, init.io, and init.minimal.args.toSlice(arena). stdout/stderr are std.Io.File, written with writeStreamingAll(io, …). emitJson threads io through.
Docstrings added on main and emitJson (§5d).
zig fmt applied. The file was already failing zig fmt --check on main.

Type of change

Bug fix (build break under the pinned Zig 0.16.0 toolchain). No behaviour change: the verbs, JSON output and exit codes are the same.

📌 New pins

Head SHA: cfe5989. No action, lockfile or container pins are added or changed.

RSR Quality Checklist

Required

Tests pass: zig build test --summary all reports 41/41 steps succeeded and 316/316 tests passed.
Code is formatted: zig fmt --check ffi/zig/src/boj_invoke_cli.zig rc 0.
Linter is clean: zig compile has no warnings. The repo has no separate Zig linter.
No banned language patterns: Zig only.
No unsafe blocks without // SAFETY: comments. Not applicable: Zig, and no new unsafe constructs.
No banned functions.
SPDX license headers: the existing MPL-2.0 header is unchanged.
No secrets, credentials, or .env files.

As Applicable

.machine_readable/* updates. Not applicable: no project-state change. A2ML is retired estate-wide (D308).
Documentation. Not applicable: the CLI usage is unchanged.
TOPOLOGY.md. Not applicable.
CHANGELOG. Not applicable: an internal build fix, covered by the v0.5.0 release notes.
New dependencies. Not applicable: none.
ABI/FFI consistency: the five-symbol ADR-0006 calls are unchanged. The fixture cartridge probe passes.

Testing

Run locally with Zig 0.16.0:

zig build invoke: rc 0 (it failed on main).
boj-invoke libfeedback_mcp.so probe printed {"ok":true,"name":"feedback-mcp","version":"0.1.0"} with rc 0. The error paths were also checked: no args gives rc 2, a missing .so gives FileNotFound with rc 3, and an unknown verb gives rc 2.
bash tests/truthfulness_check.sh --probe: truthfulness: OK — 23 cartridges checked (probe=1).
zig build test: 316/316 tests pass.

Pre-existing red checks (deferred, not introduced here)

SonarQube: red on main, tracked in Three pre-existing red non-required checks on main: Allowlist Preflight (empty GH_TOKEN), Workflow security linter (duplicate with in abi-drift.yml), SonarQube (403) #338.
governance / UUID v7 conformance: red on main, tracked in governance / UUID v7 conformance is red on main: v5 UUID literal in .machine_readable/CLADE.a2ml #347.

🤖 Generated with Claude Code

https://claude.ai/code/session_019j8She9eTFx54r6aL6sCHP

Zig 0.16 removed std.heap.GeneralPurposeAllocator and std.process.argsAlloc, so `zig build invoke` failed and took down the E2E (Full REST + MCP Bridge) and catalogue-truthfulness probe jobs. main now takes std.process.Init for the allocator, Io runtime and argv; writes go through std.Io.File.writeStreamingAll. Also applies zig fmt, which the file already failed on main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019j8She9eTFx54r6aL6sCHP Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

coderabbitai · 2026-10-07T11:19:21Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 50 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 803d09b1-e7bc-4d5b-8e6e-9be2657e19b3

📥 Commits

Reviewing files that changed from the base of the PR and between 8b62444 and cfe5989.

📒 Files selected for processing (1)

ffi/zig/src/boj_invoke_cli.zig

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-07T11:19:36Z

🏁 path-claims bench

Commit 18cc872

Numbers

path-claims bench  (node v22.23.3)

  scenario                                              iters       ms        ns/op          ops/s
  --------------------------------------------------------------------------------------------------------------
  register: 10 active claims, 3 new paths               50000 iters    181 ms      3.62 µs/op    276.1k ops/s
  register: 100 active claims, 3 new paths              20000 iters    319 ms     15.99 µs/op     62.5k ops/s
  register: 1000 active claims, 3 new paths              5000 iters    955 ms    191.20 µs/op      5.2k ops/s
  register: 100 active claims, 20 new paths              5000 iters    360 ms     72.02 µs/op     13.9k ops/s

  pathsOverlap: deep diverge at segment 4             1000000 iters    180 ms     180.8 ns/op     5.53M ops/s
  pathsOverlap: short prefix match                    1000000 iters    135 ms     135.9 ns/op     7.36M ops/s

  refresh (existing claim)                             100000 iters     10 ms     109.9 ns/op     9.10M ops/s
  list (100 active claims)                              50000 iters    276 ms      5.52 µs/op    181.1k ops/s

  (Bench numbers depend on host; use deltas across commits, not absolute values.)

Host-dependent — compare deltas across commits, not absolute values.

github-actions · 2026-10-07T11:20:17Z

🔍 Hypatia Security Scan

Findings: 113 issues detected

Severity	Count
🔴 Critical	10
🟠 High	20
🟡 Medium	83

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Job `sonarqube` in build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sonarqube"
  },
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "reason": "Job `deploy` in pages-deploy.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "deploy"
  },
  {
    "reason": "Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
    "type": "secret_action_without_presence_gate",
    "file": ".github/workflows/instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high",
    "fix_recipe": "add_secret_presence_gate"
  },
  {
    "reason": "codeql.yml does not list `language: actions` in its matrix, but the repo has workflow files. CodeQL's `actions` language scans workflow YAML for injection and other CI/CD-specific weaknesses — every repo with workflows benefits. Add an entry to `matrix.include` with `language: actions` + `build-mode: none`.",
    "type": "codeql_missing_actions_language",
    "file": ".github/workflows/codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "fix_recipe": "add_codeql_actions_language"
  },
  {
    "line": 39,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 46,
    "reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 32,
    "reason": "job in .github/workflows/build.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/build.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 44,
    "reason": "job in .github/workflows/container-publish.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/container-publish.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

…-empty (#356) ## Summary This is the last red check on the Zig 0.16 path (#354 bench, #355 invoke CLI). With #355 merged, **E2E — Full REST + MCP Bridge** builds and runs: 38 of 39 pass. The one failure is `teranga tier has cartridges (expected '1', got '0')`. The bundled `cartridges/` tree was retired, so the E2E catalogue is now `tests/fixtures/cartridges`, and all 23 of its manifests declare `"tier": "Ayo"`. The assertion can never pass against that catalogue, so this is a stale test rather than a defect in the menu. ## Changes - `tests/e2e_full.sh` Step 3: the "Teranga is non-empty" check is replaced by: - for each tier (teranga, shield, ayo), the menu count equals the number of manifests under `$BOJ_CARTRIDGES_PATH` declaring that tier (case-folded, matching `router.ex`); - `tier_teranga + tier_shield + tier_ayo == summary.total`, so no cartridge can silently fall outside the three tiers. - The new assertions don't assume any tier is non-empty. Tier assignments are being re-audited under the trust-tier ruling, so adding a fake Teranga fixture would have pre-empted that work. ## Type of change Test fix. No production code changes. ## 📌 New pins Head SHA: **7c192f068f9b20d5e70fd722ebe6bc3d1f41f98b**. No action, lockfile or container pins are added or changed. ## RSR Quality Checklist ### Required - [x] Tests pass: `bash tests/e2e_full.sh` locally reports `Results: 42 passed, 0 failed, 0 skipped (of 42)` with rc 0. - [x] Code is formatted: `bash -n tests/e2e_full.sh` reports no syntax errors. The repo has no shell formatter gate. - [x] Linter is clean: no new warnings. - [x] No banned language patterns: shell and jq only. - [x] No `unsafe` blocks. Not applicable. - [x] No banned functions. - [x] SPDX headers: the existing header is unchanged. - [x] No secrets. ### As Applicable - [ ] `.machine_readable/*`. Not applicable: A2ML is retired (D308). - [ ] Documentation, TOPOLOGY, CHANGELOG. Not applicable: test-only change. - [ ] New dependencies. Not applicable: `jq` is already installed by the workflow. - [ ] ABI/FFI. Not applicable. ## Testing - Full suite locally on Zig 0.16.0 and the Elixir backend: 42/42 pass. The new checks report teranga 0, shield 0, ayo 23, total 23. - Mutant controls, run on the new block in isolation against the real fixtures: - correct menu: 4/4 pass; - one cartridge dropped from `tier_ayo`: 2 fail (the ayo count and the total); - a cartridge in the wrong tier: 2 fail (the teranga count and the ayo count). ## Pre-existing red checks (deferred, not introduced here) - `SonarQube`: red on main, tracked in #338. - `governance / UUID v7 conformance`: red on main, tracked in #347. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019j8She9eTFx54r6aL6sCHP Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

hyperpolymath enabled auto-merge (squash) October 7, 2026 11:19

hyperpolymath merged commit 8318558 into main Oct 7, 2026
56 of 59 checks passed

hyperpolymath deleted the fix/zig-invoke-0.16 branch October 7, 2026 11:19

hyperpolymath mentioned this pull request Oct 7, 2026

test(e2e): assert menu tiers match manifests, not that Teranga is non-empty #356

Merged

8 of 12 tasks

Navigation Menu

Repository navigation

fix(zig): port the boj-invoke CLI to Zig 0.16 process.Init - #355

fix(zig): port the boj-invoke CLI to Zig 0.16 process.Init#355
hyperpolymath merged 1 commit into
mainfrom
fix/zig-invoke-0.16

hyperpolymath commented Oct 7, 2026

Uh oh!

coderabbitai Bot commented Oct 7, 2026

Review limit reached

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

hyperpolymath commented Oct 7, 2026

Summary

Changes

Type of change

📌 New pins

RSR Quality Checklist

Required

As Applicable

Testing

Pre-existing red checks (deferred, not introduced here)

Uh oh!

coderabbitai Bot commented Oct 7, 2026

Review limit reached

Uh oh!

github-actions Bot commented Oct 7, 2026

🏁 path-claims bench

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026

🔍 Hypatia Security Scan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant