Repository navigation
First-run start point: identity, echidna.prove.result/1 consumer, template shape - #102
Merged
Merged
Conversation
affinescript/ (616 tracked files) was copied in when the repository was scaffolded from another checkout. No workspace member, build recipe, test or workflow references it (checked: Cargo.toml members, Justfile, .github/workflows/*, crates/, src/, scripts/, tools/), and it carried the only remaining .machine_readable/6a2/ copy in the tree. AffineScript lives upstream at hyperpolymath/affinescript. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
burrower attempt now asks echidna for the shared prove-result contract (`echidna prove ... --output json`) when the installed binary advertises the flag, and validates the single stdout object as I-JSON that is byte-identical to its RFC 8785 canonical form (hyperpolymath/ijson-jcs, git dependency pinned by rev). A verified result carries a ProofReceipt (prover, axioms, confidence, echidna version) into the ledger's extra.receipt; a success read from legacy text markers carries none and is labelled a warrant, not a receipt. The text-marker path is kept only for an echidna that lacks the flag (detected from `prove --help`, or clap rejecting `--output` with exit 2). A malformed or non-canonical object is a contract violation and is never re-read as text. Spawns retry briefly on ETXTBSY, and a binary that cannot be run is not cached as legacy. Also: --echidna defaults to `echidna` on PATH instead of a developer's absolute path; the oracle doc names tropical-types (formerly tropical-resource-typing); ledger::new_id is documented as the single id minting site. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e shape - README.adoc described PseudoScript; rewritten for Proof Burrower. - ARCHITECTURE.adoc was the untouched template; replaced by docs/ARCHITECTURE.adoc describing the real crates. - Root docs move under docs/ and docs/status/ (ROADMAP, READINESS, PROOF-*, TEST-NEEDS, AUDIT, GOVERNANCE, MAINTAINERS, EXPLAINME), with their consumers (Mustfile, Trustfile, validate-template.sh, Justfile) updated. Duplicate root SECURITY.adoc / MAINTAINERS removed in favour of .github/SECURITY.md and .github/MAINTAINERS. - Add proof-burrower_chora.deed (identity, clade, status, maturity, ecosystem); deed_lint OK. - Descriptiles describe proof-burrower rather than the template copy. - mise.toml: drop banned tools (python, node, go, java, make, deno...), lockfile = true, add mise.lock. - dependabot.yml: only ecosystems present (github-actions, cargo), cap actions PRs at 2 (folded from chore/dependabot-pr-caps-2026-09-08); KYAML. - settings.yml: squash only, wiki on; KYAML. - Well-known workflow: take the template version, which reads the canonical www/.well-known/security.txt (main was red on every scheduled run because it only looked at the root). security.txt loses its unrendered Encryption placeholder and bogus Hiring line. - docs/wikis/: forge wiki source (Home, Using, ECHIDNA contract, Maintaining) and scripts/sync-wiki.sh to publish it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Important Review skippedToo many files! This PR contains 689 files, which is 589 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. Usage-priced reviews support at most 300 files. ⚙️ Run configuration
⛔ Files ignored due to path filters (4)
📒 Files selected for processing (689)
You can disable this status message by setting the
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
gh actions-lock prepends its own header line, so every workflow fails a first-line-only SPDX check. Take the template's check, which looks for the licence anywhere in the leading comment block. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
hyperpolymath/ijson-jcs is private, so CI on this public repo (and anyone who downloads it) cannot fetch the git dependency: every Rust job failed at dependency resolution. Use serde_json_canonicalizer instead. Byte equality with the canonical form still rejects duplicate keys and integers beyond 2^53-1, now as NotCanonical; tests updated and a lone surrogate plus ECMAScript number-form cases added. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
New crates/burrower-core/src/ids.rs is the only minting site: new_record_id() = UUIDv7 via the uuid crate API (ledger record ids, via the ledger::new_id alias), content_id(value) = UUIDv8 per RFC 9562 Appendix B.2 over SHA-256 of the JCS bytes. Ledger records gain an optional goal_id and receipts an optional result_id (both v8). goal_hash is unchanged for the wasm ABI and existing ledgers. v7 is gated off wasm32-unknown-unknown, which has no clock or entropy. Documented in docs/ECHIDNA-INTEGRATION.adoc § Identifiers; tests cover v8 determinism, version/variant bits and v7 ordering. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
… SD022) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
hyperpolymath
enabled auto-merge (squash)
October 5, 2026 16:22
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First-run start point for proof-burrower: restore its identity, consume echidna's shared prove-result contract, and move part of the way toward the rsr-template-repo shape.
Integration:
echidna.prove.result/1burrower attemptrunsechidna prove ... --output jsonwhen the installed echidna lists--outputinprove --help. It parses the single stdout object and requires it to be byte-identical to its RFC 8785 canonical form, which also rejects duplicate keys and integers beyond ±(2^53−1). Canonicalisation uses the publishedserde_json_canonicalizercrate: the estate cratehyperpolymath/ijson-jcsis private, so the earlier git dependency could not be fetched by CI on this public repo (that was the cause of the red Rust checks).A
verifiedresult producesSucceeded { receipt: Some(ProofReceipt) }, and the receipt (prover, axioms, confidence, echidna version) is written to the ledger'sextra.receipt.Burrower falls back to the legacy text markers in two cases only:
prove --help;--output(exit 2,unexpected argument '--output').A legacy success carries no receipt, and the ledger labels it "a warrant, not a receipt".
Malformed or non-canonical output counts as a contract violation and fails the attempt. Burrower never re-reads it as text.
Tests use fake echidna binaries to cover every status, a planted non-canonical mutant, a binary that prints legacy text after advertising the flag, a legacy binary, and a binary that advertises the flag and then rejects it.
The full contract and the mapping table are in
docs/ECHIDNA-INTEGRATION.adoc.Horizon: the live e2e test (
Burrower proof safety) uses the echidna build pinned inproof-safety.yml. That build predates the flag, so CI exercises the legacy path live and the contract path only through the fakes. The contract path is implemented and unit-tested; it has not been tested against a real echidna.echidna corpus overlap: the recommendation is in
docs/ECHIDNA-INTEGRATION.adoc#corpus-overlap. Burrower keeps its own indexer as the zero-dependency fallback and later gains an optionalechidna corpus nearbackend, once echidna defines a JSON contract for it. That backend is not implemented here.Identity and template shape
affinescript/(616 files) is removed. A search of Cargo members, the Justfile, workflows,crates/,src/,scripts/andtools/found no reference to it. It also held the last.machine_readable/6a2/in the tree.docs/anddocs/status/, and the files that referenced them are updated.proof-burrower_chora.deed. It passesdeed_lintand the deed-ecosystem validator.mise.tomlno longer lists banned tools and now has a lockfile.dependabot.ymlandsettings.ymlare KYAML;settings.ymlsets squash-only merges and turns the wiki on.www/.well-known/.docs/wikis/andscripts/sync-wiki.sh.ID minting
crates/burrower-core/src/ids.rsis the only minting module (owner policy 2026-10-05):new_record_id(): UUIDv7 from theuuidcrate API. Used for ledger recordidthroughledger::new_id, a thin alias. Callers:attempt::run_playbook,oracle::record_to_ledger,ledger::record_reading.content_id(value): UUIDv8 per RFC 9562 Appendix B.2. It takes SHA-256 over the JCS bytes, keeps the first 16 bytes and sets version 8 and variant10.goal_content_id(text)fills the new optional ledgergoal_id, andProofReceipt::from_resultfills the new optionalresult_id.goal_hashis unchanged, because the wasm ABI (16-byte buffer) and existing ledgers depend on it. Corpus entries carry no id yet.wasm32-unknown-unknown, which has no clock or entropy.docs/ECHIDNA-INTEGRATION.adoc§ Identifiers.Stale local branches (folded or left)
chore/dependabot-pr-caps-2026-09-08: the github-actions cap is folded in. The other caps applied to ecosystems that no longer exist.codex/live-proof-stack-20260907,codex/postmerge-mirror-20260907: already landed as fix(proof): preserve complete goals and require live Isabelle controls #83 and fix(ci): repair published mirror workflow revision #85.fix/token-permissions-id-20260911,chore/bump-standards-pins, localmain(+2): older pinning and ruleset attempts that main has superseded (fix(ci): reconcile actions.lock so the lockfile validates #99 actions.lock). Left untouched.Not done in this PR (reduced increment, §5b)
0-AI-MANIFEST.a2ml(still read by rhodibot),Containerfile/container/,.gitlab-ci.yml/.pre-commit-config.yaml(moving them needs a GitLab project setting),contractile.just,coordination.k9,setup.sh,stapeln.toml,selur-compose.toml,.guix-channel,agents/,audits/,tools/,.bot_directives/. Still missing: a generatedCLAUDE.md,launcher.sh,build/,ci/. No root-shape gate runs on this repo yet.openssf-compliance.yml, the contractiles andvalidate-template.shstill read them.Test plan
cargo fmt --all -- --check,cargo clippy --all-targets --locked -- -D warnings,cargo test --locked --workspace(all green locally; 25 repeated runs of the lib suite with no flakes)gh actions-lock --no-fixcleankyaml-format.sh --checkon the edited YAMLdocstring-scan.sh --staged --check(100%)deed_lint.pyOK; deed-ecosystemvalidate-a2ml.sh: 0 errors (8 pre-existing SPDX warnings)🤖 Generated with Claude Code