chore: Wave 9 engineering cleanup and Wave E/11/13 delivery - #229
Conversation
Require explicit allow-insecure opt-in so missing signatures cannot pass silently. Align Go, Rust, and TypeScript verifiers and cross-lang tests with deployment trust guidance.
Tone down overstated capabilities so the landing README matches what the repo actually builds and tests today.
Extend rate limiting with tenant-aware risk scoring, throttles, and budgets so broker abuse is contained without hard-coding a single global limit.
Protect the MCP proxy with counters and a sliding-window limiter so noisy clients cannot starve legitimate traffic.
Ship a retry-aware HTTP client, clearer errors, and drop unused gRPC deps so the TypeScript SDK matches how callers actually integrate.
Restore reliable Redis-backed caching and fix DFA compilation edge cases that could mis-label transitions under load.
Simplify export tooling so DFA and labeler generation stay maintainable and match the current Lean runtime APIs.
Centralize ENFORCED ExtendedAdapter paths and drop orphaned Policy/ProofBench roots so the Lean workspace has one clear entrypoint.
Keep egress, telemetry, JWKS/sidecar, and mpc-fintech crates aligned with the workspace Cargo graph and current runtime entrypoints.
Trim multiarch/criterion/paper spend, clarify SWE-bench expectations, and add a Windows smoke workflow so expensive or flaky gates fail soft with clear signals.
Add preflight/sync scripts and workflow wiring so cross-region DR, publish updates, and revocation sync can run with real secrets when available.
Unify Make/just/compose install paths with check_wiring and pf-env validation so local bring-up matches CI expectations.
Factor setup composites and reusable Rust/Go/Node jobs so PR CI only builds what changed and respects root npm workspaces.
Record latency budgets and remediation progress so Wave E/9+ work stays measurable against CI inventory and placeholder burn-down.
Re-home outdated feature and audit docs under archive stubs and sharpen the docs index so newcomers land on a single getting-started path.
Remove unmaintained marketplace, ops terraform, on-ramps/recipes/figures, and related CI/binaries so the tree reflects the supported product surface.
Delete one-off installers, duplicate VS Code extensions, and unused tooling while keeping adapter/evidence READMEs oriented to the current layout.
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts. |
|
❌ Allowlist Sync Validation Failed The runtime allowlist is out of sync with Lean proofs. Please run: python3 tools/gen_allowlist_from_lean.py . runtime/sidecar-watcher/policy/allowlist.jsonThen commit the updated allowlist to ensure runtime configuration matches formal specifications. |
SBOM Security ReportTotal Packages: 3286 Language Distribution:
License Distribution:
✅ SBOM generated successfully |
|
Sample Replay
|
Policy Coverage ReportTools Coverage: 100% All policy gates passed successfully! |
Repair multiarch format()/SC2193, bump crossbeam-epoch, declare crate licenses, fix mkdocs strict off-tree links, drop missing Cargo.lock COPY, and keep redteam sidecar build at repo root.
|
Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts. |
The live docs/runbooks/rollback.md path was removed; link the archive GuardTrip triage page to runbook-rollback.md so mkdocs --strict stays honest.
|
❌ Allowlist Sync Validation Failed The runtime allowlist is out of sync with Lean proofs. Please run: python3 tools/gen_allowlist_from_lean.py . runtime/sidecar-watcher/policy/allowlist.jsonThen commit the updated allowlist to ensure runtime configuration matches formal specifications. |
|
Sample Replay
|
|
Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts. |
|
❌ Allowlist Sync Validation Failed The runtime allowlist is out of sync with Lean proofs. Please run: python3 tools/gen_allowlist_from_lean.py . runtime/sidecar-watcher/policy/allowlist.jsonThen commit the updated allowlist to ensure runtime configuration matches formal specifications. |
Policy Coverage ReportTools Coverage: 100% All policy gates passed successfully! |
SBOM Security ReportTotal Packages: 3286 Language Distribution:
License Distribution:
✅ SBOM generated successfully |
Policy Coverage ReportTools Coverage: 100% All policy gates passed successfully! |
Force real egress binary rebuild after dummy Cargo layer, bind 0.0.0.0:8081 with wget health tooling, add demo rate limits + log sanitization for CodeQL, and drop stale marketplace/ui install from CHANGELOG.
|
Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts. |
🔮 Stochastic Proof-Regression ResultsSuccess Rate: 100.0% (minimum: 95%) Perturbation Results:
✅ PASSED - Success rate meets minimum threshold. |
|
Sample Replay
|
SBOM Security ReportTotal Packages: 3286 Language Distribution:
License Distribution:
✅ SBOM generated successfully |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Policy Coverage ReportTools Coverage: 100% All policy gates passed successfully! |
Use express-rate-limit so CodeQL recognizes auth route limits, and switch egress-firewall reqwest to rustls-tls to avoid musl OpenSSL static linking failures in Docker/demo-e2e.
🔮 Stochastic Proof-Regression ResultsSuccess Rate: 100.0% (minimum: 95%) Perturbation Results:
✅ PASSED - Success rate meets minimum threshold. |
|
Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts. |
|
Sample Replay
|
SBOM Security ReportTotal Packages: 3288 Language Distribution:
License Distribution:
✅ SBOM generated successfully |
Policy Coverage ReportTools Coverage: 100% All policy gates passed successfully! |
wget --spider issues HEAD, which 404'd on a GET-only /health route and marked the container unhealthy in demo-e2e. Accept HEAD and probe with GET.
|
Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts. |
🔮 Stochastic Proof-Regression ResultsSuccess Rate: 100.0% (minimum: 95%) Perturbation Results:
✅ PASSED - Success rate meets minimum threshold. |
|
Sample Replay
|
SBOM Security ReportTotal Packages: 3288 Language Distribution:
License Distribution:
✅ SBOM generated successfully |
Policy Coverage ReportTools Coverage: 100% All policy gates passed successfully! |
The CLI oneshot (wasm-sandbox --help) exits 0 and breaks docker compose --profile full up --wait used by demo-up/demo-e2e. Move it to the tools profile for compose run usage.
|
Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts. |
🔮 Stochastic Proof-Regression ResultsSuccess Rate: 100.0% (minimum: 95%) Perturbation Results:
✅ PASSED - Success rate meets minimum threshold. |
|
Sample Replay
|
SBOM Security ReportTotal Packages: 3288 Language Distribution:
License Distribution:
✅ SBOM generated successfully |
Policy Coverage ReportTools Coverage: 100% All policy gates passed successfully! |
2 participants
Summary
Test plan