feat(cartridges): sync bug-filing-mcp adapter/ into the bundled snapshot by hyperpolymath · Pull Request #286 · hyperpolymath/boj-server

hyperpolymath · 2026-07-17T15:00:31Z

Summary

Syncs the bundled bug-filing-mcp cartridge to match the canonical cartridge's new adapter/ completion (companion PR in boj-server-cartridges), and documents the ABI=Idris2/FFI=Zig/Adapter=Zig baseline in .claude/CLAUDE.md.

Changes

cartridges/bug-filing-mcp/adapter/ (new) — verbatim sync of the unified protocol-bridge adapter (ADR-0004 internal-only, transaction-gated, REST/SSE/GraphQL/gRPC-compat).
cartridges/bug-filing-mcp/abi/BugFilingMcp/SafeBugFiling.idr — synced exposure-gate proof.
cartridges/bug-filing-mcp/ffi/bug_filing_mcp_ffi.zig — synced pub export fix (Zig 0.15 cross-module import requirement).
.claude/CLAUDE.md — the baseline documented, grounded in this repo's own cartridge conventions.

RSR Quality Checklist

Required

Tests pass (idris2 --typecheck clean; zig build test green for ffi + adapter; boot_smoke still OK — 68 tools)
Code is formatted
Linter is clean (no new warnings or errors)
No banned language patterns (no TypeScript, no npm/bun, no Go/Python)
No unsafe blocks without // SAFETY: comments
No banned functions (believe_me, unsafeCoerce, Obj.magic, Admitted, sorry) — SafeBugFiling.idr remains %default total with zero escape hatches
SPDX license headers present on all new/modified source files
No secrets, credentials, or .env files included

As Applicable

.machine_readable/STATE.a2ml — no project-state change (catalogue content only)
.machine_readable/ECOSYSTEM.a2ml — no integration change
TOPOLOGY.md — no architecture change
CHANGELOG — deferring to the squash-merge summary
New dependencies reviewed — none added
ABI/FFI changes validated (src/abi/ and ffi/zig/ consistent) — this PR only touches the bundled cartridge snapshot, not the server's own core ABI/FFI

Testing

Verified independently, not just copied: idris2 --typecheck clean (0.7.0); zig build test green for both ffi/ and adapter/ (0.15.2); deno run mcp-bridge/tests/boot_smoke.js still OK: serverInfo.name=boj-server, tools=68, exit=0.

Refs

Companion PR in boj-server-cartridges (canonical adapter completion, extends #85). Part of #274.

🤖 Generated with Claude Code

https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq

Generated by Claude Code

Verbatim sync from the canonical boj-server-cartridges cartridge (companion PR there): adds the missing adapter/ (unified protocol bridge, ADR-0004 internal-only, transaction-gated), the exposure-gate proof in abi/BugFilingMcp/SafeBugFiling.idr, and the pub export fix in ffi/bug_filing_mcp_ffi.zig needed for Zig 0.15 cross-module import. Also documents the ABI=Idris2/FFI=Zig/Adapter=Zig baseline in .claude/CLAUDE.md, grounded in this repo's own cartridge conventions (gossamer-mcp template, k9iser-mcp reference implementation). Verified independently (not just copied): idris2 --typecheck clean; zig build test green for both ffi and adapter (0.15.2); boot_smoke still OK (68 tools) confirming the bundle change doesn't affect bridge boot. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq

hyperpolymath · 2026-07-17T15:01:17Z

Same SonarQube failure as #285/#90 — scanner bootstrap 403s (SONAR_TOKEN invalid/expired), not this PR's content. Needs the same owner-side token rotation across the repo.

Generated by Claude Code

@@ -0,0 +1,299 @@
+// SPDX-License-Identifier: MPL-2.0


github-actions · 2026-07-17T15:01:31Z

🔍 Hypatia Security Scan

Findings: 218 issues detected

Severity	Count
🔴 Critical	15
🟠 High	137
🟡 Medium	66

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages-deploy.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in build.yml",
    "type": "missing_timeout_minutes",
    "file": "build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in pages-deploy.yml",
    "type": "missing_timeout_minutes",
    "file": "pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard-enforcer.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath · 2026-07-17T15:01:49Z

CI triage:

Hypatia (zig_ptr_cast, 3 occurrences in bug_filing_mcp_adapter.zig) — same as the companion boj-server-cartridges PR: identical dispatch line to the mirrored k9iser-mcp reference adapter, array/slice-pointer-to-many-pointer decay required for the Zig↔C-ABI call boundary, not a new/divergent pattern.
Hypatia bot-comment (218 findings) — pre-existing repo-wide baseline (workflow hygiene, unrelated .ts adapter files), none introduced by this PR.
SonarQube — already noted above: repo-wide expired SONAR_TOKEN.

Generated by Claude Code

…r (CWE-704) Same fix as the companion boj-server-cartridges PR: the three @ptrCast calls at the adapter's dispatch call site were unnecessary — Zig's [*c] pointer parameters accept array/slice/scalar pointers via implicit C-pointer coercion. Verified: zig build test green. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq

github-actions · 2026-07-17T16:22:32Z

🔍 Hypatia Security Scan

Findings: 218 issues detected

Severity	Count
🔴 Critical	15
🟠 High	137
🟡 Medium	66

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages-deploy.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in build.yml",
    "type": "missing_timeout_minutes",
    "file": "build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in pages-deploy.yml",
    "type": "missing_timeout_minutes",
    "file": "pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard-enforcer.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath · 2026-07-17T16:23:41Z

Checked this directly: cartridges/bug-filing-mcp/adapter/bug_filing_mcp_adapter.zig at commit ae4a639 (fetched via the GitHub contents API, not just local state) has zero @ptrCast occurrences — the fix from the previous commit is genuinely in place. This "1 new alert" appears to be a stale re-report of the already-fixed finding (the review thread it's attached to is timestamped before the fix). No code change needed here; should clear on the next Hypatia analysis pass.

Generated by Claude Code

github-advanced-security AI found potential problems Jul 17, 2026

View reviewed changes

Comment thread cartridges/bug-filing-mcp/adapter/bug_filing_mcp_adapter.zig

@@ -0,0 +1,299 @@

// SPDX-License-Identifier: MPL-2.0

hyperpolymath marked this pull request as ready for review July 17, 2026 16:16

hyperpolymath enabled auto-merge (squash) July 17, 2026 16:17

hyperpolymath disabled auto-merge July 17, 2026 17:38

hyperpolymath merged commit 620eff1 into main Jul 17, 2026
16 of 18 checks passed

hyperpolymath deleted the claude/abi-ffi-adapter-baseline branch July 17, 2026 17:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(cartridges): sync bug-filing-mcp adapter/ into the bundled snapshot#286

feat(cartridges): sync bug-filing-mcp adapter/ into the bundled snapshot#286
hyperpolymath merged 2 commits into
mainfrom
claude/abi-ffi-adapter-baseline

hyperpolymath commented Jul 17, 2026

Uh oh!

hyperpolymath commented Jul 17, 2026

Uh oh!

github-actions Bot commented Jul 17, 2026

Uh oh!

hyperpolymath commented Jul 17, 2026

Uh oh!

github-actions Bot commented Jul 17, 2026

Uh oh!

hyperpolymath commented Jul 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

hyperpolymath commented Jul 17, 2026

Summary

Changes

RSR Quality Checklist

Required

As Applicable

Testing

Refs

Uh oh!

hyperpolymath commented Jul 17, 2026

Uh oh!

github-actions Bot commented Jul 17, 2026

🔍 Hypatia Security Scan

Uh oh!

hyperpolymath commented Jul 17, 2026

Uh oh!

github-actions Bot commented Jul 17, 2026

🔍 Hypatia Security Scan

Uh oh!

hyperpolymath commented Jul 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants