Repository navigation
Sync main: register updates, doc corrections, and the unblocked hygiene items - #178
Merged
Merged
Conversation
…ty CVE (#173) GitHub raised 32 Dependabot alerts when main was brought current. Reviewed alert by alert rather than in aggregate, because the aggregate number is misleading. 31 of 32 are poetry.lock RESOLUTION, not declared dependencies: Pillow x13, GitPython x9, then geopandas, torch, pytest, paramiko, pywin32, diskcache, setuptools, python-dotenv one each. Every root is declared by views-pipeline-core 2.3.0, none by this repo, and none is imported by this repo's code. That is C-62 exactly, so C-62 gains the measurement rather than a new entry being filed. The 3.0.0 bump removes the roots and most of this surface with them. The 32nd is pyarrow, and it is the one that matters — registered as C-72. GHSA: use-after-free reading IPC files with pre-buffering vulnerable: >= 15.0.0, < 23.0.1 patched: 23.0.1 our pin: >= 16.1.0, < 17.0.0 <- inside the range, ceiling excludes the fix Not exploitable here, stated precisely rather than reassuringly: the defect is on the READ path, and production only writes arrow. The only vf_arrow.load calls in the repository are three byte-parity tests reading fixtures we generated. Where the exposure actually sits is views-faoapi, which reads these shards under the same platform-wide ceiling — our output is its input. The collision is the part worth understanding. The five byte-parity failures this repo has treated as "known local toolchain noise" all session are exactly this: local runs pyarrow 23.0.1 — the PATCHED version — while CI runs the pinned 16.1.x, and the two produce DIFFERENT BYTES for the same input. So upgrading to the patched pyarrow is not a dependency bump. It changes the ADR-013 §10 golden fixture, which the contract declares normative and which views-faoapi verifies against. Security remediation here is a CONTRACT EVENT and must be sequenced with the consumer, not applied as maintenance. Register: 72 concerns, 25 open. Integrity guard green. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
… now cites (#175) Filing the cross-repo issues produced evidence that corrects the entry written hours earlier. Recorded as corrections rather than quietly edited. (a) views-faoapi is NOT exposed. C-72 implied the consumer shared our pin; it does not — faoapi pins pyarrow==23.0.1, the patched version, and it is the repo that actually reads the wire. So nobody on the platform is exposed through this path, and the "<17 ceiling" pipeline-core#280 exists to lift binds the producers only. One consumer has already moved past it, in production. That is worth knowing before #280 is scoped as platform-wide work. (b) The re-vendor obligation is stronger than the entry said. ADR-013 §10 is explicit that all three repos vendor the fixture bytes and carry a pinned root-hash equality test, and that a fixture change IS a contract change. Verified faoapi's copy exists at tests/forecast/golden/wire_contract/SHA256SUMS. So the upgrade is a coordinated three-repo re-vendor carrying an undecided question: whether it bumps contract_version, since the payload schema does not change but the encoder's bytes do. Issues filed so the relocation is complete rather than assumed — the C-08 lesson, where a concern was closed here as "tracked upstream" and never opened there: views-postprocessing#174 the coordinating issue views-faoapi#348 heads-up + two questions only their seat can answer views-pipeline-core#280 comment: security dimension + non-uniform ceiling Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
… written today (#176) From /falsify on "there is nothing more to do in this repo", which the audit disproved. The finding itself is views-pipeline-core's C-241, relayed in #172 and unread here until the audit went looking. C-73 (Tier 2): pipeline-core's search_files_by_metadata was unpaged — Appwrite returns 25 rows by default and get_latest_file_id sorted THOSE, so with more than 25 matching documents it returned the newest of the oldest 25, staler every run. It reaches this repo because HOP_A_MANIFEST_FILTERS is broad by design and the store has no retention: every manifest ever published is a candidate. Shard lookups are name-scoped and resolve correctly FOR WHATEVER RUN WAS SELECTED, which is exactly why the failure is quiet — everything downstream of the selection is self-consistent. The partner receives a complete, valid, wrong-vintage delivery. Not this repo's defect and not its fix (it arrives with a pin bump, gated on pipeline-core #341). What IS ours: the register carried no record of it, and the broad-filter-newest-wins strategy is a choice this repo made. C-25 CORRECTED, not rewritten. I closed it earlier today as "superseded by mechanism" on the reasoning that "recency-based selection is not an operation the code can perform any more". That is false — source_selection.py:106 does exactly that. What manifest selection actually solved is the PRODUCER-IDENTITY half: the manifest declares its ensemble and every shard header is checked against it, so another producer's run cannot be selected. The RECENCY half was never solved; it moved from newest-payload-file to newest-manifest. The overclaim is left visible because it is more instructive than the conclusion. appwrite merged into C-07 rather than filed separately — same problem type (undeclared direct dependency arriving transitively), new location. But it is no longer "Tier 4-ish, resolve if the transitive guarantee is sufficient": pipeline- core is making appwrite an optional extra (#345), so the guarantee is being withdrawn deliberately, and this repo breaks at import when it lands. Register: 73 concerns, 26 open. Integrity guard green. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
#103, #104, #158 — each actionable with no external dependency, each known for days or weeks, each walked past. #103: deleted views_postprocessing/reconciliation/ — stale bytecode left when the module was retired in #62 (2026-06-26). Untracked, so nothing leaves history. It had already misled one in-session inspection into reporting the migration unfinished, which is what register C-47 exists to record. #104: the README's PROD_FORECASTS collection placeholder carried "TODO: verify against live Appwrite". The answer had been sitting in ADR-013 §7(b) since 2026-07-19 — the views-models seat verified the correct values (database file_metadata, collection production_forecasts) after the phantom-collection postmortem. Filled in from our own record. I rewrote that exact README section yesterday and left the TODO standing. #158: PLATFORM-001 is retired platform-wide; the seam contract is now "The Appwrite Seam Contract" at docs/ADRs/platform/appwrite_seam_contract.md. Renamed in this repo's citations — docs/CLONING.md, README.md, ADR-013. The risk register keeps the historical ID where entries describe what was true when written; the contract is referenced by URL at a pinned commit either way, never copied. None of these was blocked on anything. They surfaced because /falsify went looking at the issue list rather than at the state I had touched — which is how the audit disproved "there is nothing more to do". ruff clean; 305 passed, 5 known local pyarrow byte-parity failures (C-72). Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings
maincurrent after the 1.0.0 tag. Four merged PRs, all CI-green ondevelopment:/falsifyfound: a stale__pycache__, a README TODO whose answer had been in ADR-013 since July, and the PLATFORM-001 → Appwrite Seam Contract renameNo source behaviour change.
contract_versionunchanged; wire fixtures untouched.Does not publish — no GitHub release is created, and
publish_package.ymlfires only onrelease: published.🤖 Generated with Claude Code