From 01dd90ffd3741a77b64845d9cb867b03ecbfa147 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 17:52:31 +0000 Subject: [PATCH 1/5] fix(diagnostics): look for the .adoc docs, not the retired .md names docs/ambush-timeline.md and docs/panll-export.md were converted to .adoc (estate docs policy) but the self-diagnostics check still demanded the .md files, so `panic-attack diagnostics` exited non-zero and both diagnostics readiness tests failed. Point the check, README.adoc and the bridge module docs at the .adoc files that exist. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- README.adoc | 4 ++-- src/bridge/mod.rs | 2 +- src/bridge/registry.rs | 2 +- src/diagnostics.rs | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/README.adoc b/README.adoc index c7a3502..8509005 100644 --- a/README.adoc +++ b/README.adoc @@ -183,13 +183,13 @@ Consult `man/panic-attack.1` or `panic-attack help` for every command, and use ` === Automation readiness -`panic-attack diagnostics` validates AI manifests, VeriSimDB caches, Hypatia and gitbot-fleet watchers, and the docs PanLL expects (`docs/ambush-timeline.md`, `docs/panll-export.md`). `docs/patch-bridge-design.md` details how the patch-bridge subcommands plug into BoJ cartridges, CVE workflows, and the PanLL panel. +`panic-attack diagnostics` validates AI manifests, VeriSimDB caches, Hypatia and gitbot-fleet watchers, and the docs PanLL expects (`docs/ambush-timeline.adoc`, `docs/panll-export.adoc`). `docs/patch-bridge-design.adoc` details how the patch-bridge subcommands plug into BoJ cartridges, CVE workflows, and the PanLL panel. `just test-elixir` runs the Elixir harnesses that cover the CLI surface so documentation, help text, and automation flags stay aligned. == Integration & Groove -panic-attack can emit PanLL-friendly exports (event chains, system images, temporal diffs) per `docs/panll-export.md`, and it also advertises its static-analysis capability via the Gossamer groove protocol. Start the discovery endpoint with `panic-attack groove --port 7600` and check the JSON manifest by curling `http://localhost:7600/.well-known/groove` (the health endpoint sits at `/health`). +panic-attack can emit PanLL-friendly exports (event chains, system images, temporal diffs) per `docs/panll-export.adoc`, and it also advertises its static-analysis capability via the Gossamer groove protocol. Start the discovery endpoint with `panic-attack groove --port 7600` and check the JSON manifest by curling `http://localhost:7600/.well-known/groove` (the health endpoint sits at `/health`). The manifest follows the Idris-aligned semantics that live in `boj-server/src/interface/abi/Groove.idr` and the `gossamer` schema references. As a result, any groove-aware consumer—PanLL event-chain panels, the Burble voice platform, Hypatia, or other automation fabrics—sees the same capability vocabulary and can attach its own UI (Groove + Burble PanLL) confidently. diff --git a/src/bridge/mod.rs b/src/bridge/mod.rs index a39e3c9..66e5ee3 100644 --- a/src/bridge/mod.rs +++ b/src/bridge/mod.rs @@ -12,7 +12,7 @@ //! This module extends panic-attack with `bridge` subcommands. The core tool //! remains standalone — PanLL panel and BoJ cartridge are optional integrations. //! -//! Design document: docs/patch-bridge-design.md +//! Design document: docs/patch-bridge-design.adoc pub mod classify; pub mod intelligence; diff --git a/src/bridge/registry.rs b/src/bridge/registry.rs index 0e55eca..9749606 100644 --- a/src/bridge/registry.rs +++ b/src/bridge/registry.rs @@ -7,7 +7,7 @@ //! Phase 2 will add VeriSimDB hexad persistence and SCM format. //! //! Lifecycle: Applied → Active → Retiring → Retired -//! See docs/patch-bridge-design.md Section 8 for full lifecycle specification. +//! See docs/patch-bridge-design.adoc Section 8 for full lifecycle specification. use super::{AssessedCve, Classification}; use anyhow::{Context, Result}; diff --git a/src/diagnostics.rs b/src/diagnostics.rs index 18e004e..5a18891 100644 --- a/src/diagnostics.rs +++ b/src/diagnostics.rs @@ -41,11 +41,11 @@ pub fn run_self_diagnostics(manifest: &Manifest) -> Result<()> { checks.push(check_verisimdb(Path::new("verisimdb-data/verisimdb"))); checks.push(check_file( "ambush timeline spec", - Path::new("docs/ambush-timeline.md"), + Path::new("docs/ambush-timeline.adoc"), )); checks.push(check_file( "panll export guide", - Path::new("docs/panll-export.md"), + Path::new("docs/panll-export.adoc"), )); checks.push(check_watcher("Hypatia scanner", HYPATIA_ENV)); From 09f8fc86180e1d1b6641f02f34a8f131866a3a1e Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 17:58:34 +0000 Subject: [PATCH 2/5] fix(deps): bump crossbeam-epoch, rustls, webbrowser, memmap2, event-listener, wayland-scanner Lockfile-only, semver-compatible updates clearing RUSTSEC-2026-0204 (crossbeam-epoch), -0346/0347/0348/0349 (rustls 0.23.46), -0257 (webbrowser), the event-listener and memmap2 unsound notices, and moving wayland-scanner onto quick-xml 0.41. quick-xml 0.38 remains only via zbus_xml 5 under accesskit (eframe's GUI feature); no released accesskit or atspi-common moves off it yet. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- Cargo.lock | 68 ++++++++++++++++++++++++++---------------------------- 1 file changed, 33 insertions(+), 35 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 41664e2..fdeaef1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -847,7 +847,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -900,16 +900,6 @@ dependencies = [ "libc", ] -[[package]] -name = "core-foundation" -version = "0.10.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6" -dependencies = [ - "core-foundation-sys", - "libc", -] - [[package]] name = "core-foundation-sys" version = "0.8.7" @@ -923,7 +913,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c07782be35f9e1140080c6b96f0d44b739e2278479f64e02fdab4e32dfd8b081" dependencies = [ "bitflags 1.3.2", - "core-foundation 0.9.4", + "core-foundation", "core-graphics-types", "foreign-types", "libc", @@ -936,7 +926,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "45390e6114f68f718cc7a830514a96f903cccd70d02a8f6d9f643ac4ba45afaf" dependencies = [ "bitflags 1.3.2", - "core-foundation 0.9.4", + "core-foundation", "libc", ] @@ -1011,9 +1001,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d" dependencies = [ "crossbeam-utils", ] @@ -1150,7 +1140,7 @@ dependencies = [ "libc", "option-ext", "redox_users", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -1453,7 +1443,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -1473,11 +1463,10 @@ dependencies = [ [[package]] name = "event-listener" -version = "5.4.1" +version = "5.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab" +checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2" dependencies = [ - "concurrent-queue", "parking", "pin-project-lite", ] @@ -2308,9 +2297,9 @@ checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79" [[package]] name = "memmap2" -version = "0.9.9" +version = "0.9.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "744133e4a0e0a658e1374cf3bf8e415c4052a15a111acd372764c55b4177d490" +checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0" dependencies = [ "libc", ] @@ -3203,6 +3192,15 @@ dependencies = [ "serde", ] +[[package]] +name = "quick-xml" +version = "0.41.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1" +dependencies = [ + "memchr", +] + [[package]] name = "quote" version = "1.0.45" @@ -3448,14 +3446,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys 0.12.1", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "log", "once_cell", @@ -3890,7 +3888,7 @@ dependencies = [ "getrandom 0.4.3", "once_cell", "rustix 1.1.4", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -4443,12 +4441,12 @@ dependencies = [ [[package]] name = "wayland-scanner" -version = "0.31.8" +version = "0.31.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5423e94b6a63e68e439803a3e153a9252d5ead12fd853334e2ad33997e3889e3" +checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0" dependencies = [ "proc-macro2", - "quick-xml", + "quick-xml 0.41.0", "quote", ] @@ -4486,15 +4484,15 @@ dependencies = [ [[package]] name = "webbrowser" -version = "1.2.0" +version = "1.2.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fe985f41e291eecef5e5c0770a18d28390addb03331c043964d9e916453d6f16" +checksum = "62c35be770821a214dbc362fc26908c853e776c0004294d0b10b8a6bad582f94" dependencies = [ - "core-foundation 0.10.1", "jni", "log", "ndk-context", "objc2 0.6.4", + "objc2-app-kit 0.3.2", "objc2-foundation 0.3.2", "url", "web-sys", @@ -4720,7 +4718,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -4945,7 +4943,7 @@ dependencies = [ "calloop 0.13.0", "cfg_aliases", "concurrent-queue", - "core-foundation 0.9.4", + "core-foundation", "core-graphics", "cursor-icon", "dpi", @@ -5180,7 +5178,7 @@ version = "5.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "441a0064125265655bccc3a6af6bef56814d9277ac83fce48b1cd7e160b80eac" dependencies = [ - "quick-xml", + "quick-xml 0.38.4", "serde", "zbus_names", "zvariant", From cb067e21cf5f008b105fd77ca268b81079c9bb68 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 22:09:37 +0000 Subject: [PATCH 3/5] fix(deps): bump zbus_xml to 5.2.1 and zvariant to 5.15.1, dropping quick-xml 0.38 zbus_xml 5.2.1 builds on quick-xml 0.41, so the last copy of quick-xml 0.38.4 (RUSTSEC-2026-0194, RUSTSEC-2026-0195) leaves the lockfile. Lockfile only; semver-compatible: zbus_names 4.3.5, zbus_xml 5.2.1, zvariant 5.15.1, zvariant_derive 5.15.1, plus their new transitive deps winnow 1.0.4, zcheapstr 1.1.0, zvariant_utils 4.2.0. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- Cargo.lock | 82 ++++++++++++++++++++++++++++++++++-------------------- 1 file changed, 52 insertions(+), 30 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 5800f1c..5e0d690 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3214,16 +3214,6 @@ version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3" -[[package]] -name = "quick-xml" -version = "0.38.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c" -dependencies = [ - "memchr", - "serde", -] - [[package]] name = "quick-xml" version = "0.41.0" @@ -4036,7 +4026,7 @@ dependencies = [ "indexmap", "toml_datetime", "toml_parser", - "winnow", + "winnow 0.7.14", ] [[package]] @@ -4045,7 +4035,7 @@ version = "1.0.7+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "247eaa3197818b831697600aadf81514e577e0cba5eab10f7e064e78ae154df1" dependencies = [ - "winnow", + "winnow 0.7.14", ] [[package]] @@ -4465,7 +4455,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0" dependencies = [ "proc-macro2", - "quick-xml 0.41.0", + "quick-xml", "quote", ] @@ -5008,6 +4998,15 @@ dependencies = [ "memchr", ] +[[package]] +name = "winnow" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81" +dependencies = [ + "memchr", +] + [[package]] name = "wit-bindgen" version = "0.51.0" @@ -5135,7 +5134,7 @@ dependencies = [ "uds_windows", "uuid", "windows-sys 0.61.2", - "winnow", + "winnow 0.7.14", "zbus_macros", "zbus_names", "zvariant", @@ -5177,32 +5176,41 @@ dependencies = [ "syn 2.0.117", "zbus_names", "zvariant", - "zvariant_utils", + "zvariant_utils 3.3.0", ] [[package]] name = "zbus_names" -version = "4.3.1" +version = "4.3.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ffd8af6d5b78619bab301ff3c560a5bd22426150253db278f164d6cf3b72c50f" +checksum = "812a12be4ead7a59e18ea8f047d08add0066b73bc62fc1467066a2472ae088dd" dependencies = [ "serde", - "winnow", + "winnow 1.0.4", "zvariant", ] [[package]] name = "zbus_xml" -version = "5.1.0" +version = "5.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "441a0064125265655bccc3a6af6bef56814d9277ac83fce48b1cd7e160b80eac" +checksum = "d1586c021a01ca0a9216dcd874e546382e156a5cbab5fab6cb5f10087e22682a" dependencies = [ - "quick-xml 0.38.4", "serde", + "winnow 1.0.4", "zbus_names", "zvariant", ] +[[package]] +name = "zcheapstr" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d1afec51604565183aeb5c54c20aeab286120d4e4460f7f76e3e8bb8c0d99473" +dependencies = [ + "serde", +] + [[package]] name = "zerocopy" version = "0.8.39" @@ -5306,29 +5314,30 @@ dependencies = [ [[package]] name = "zvariant" -version = "5.10.0" +version = "5.15.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5708299b21903bbe348e94729f22c49c55d04720a004aa350f1f9c122fd2540b" +checksum = "80bf6d6cd6a4b601acb64cfb8284cdc643fcfa75ef26ae3c46ec8aa4e8a1fbb7" dependencies = [ "endi", "enumflags2", "serde", - "winnow", + "winnow 1.0.4", + "zcheapstr", "zvariant_derive", - "zvariant_utils", + "zvariant_utils 4.2.0", ] [[package]] name = "zvariant_derive" -version = "5.10.0" +version = "5.15.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b59b012ebe9c46656f9cc08d8da8b4c726510aef12559da3e5f1bf72780752c" +checksum = "ef2672456ba1cb54b5eaec136e63135b3c7495fb938e53b28a62e633496d486d" dependencies = [ "proc-macro-crate", "proc-macro2", "quote", - "syn 2.0.117", - "zvariant_utils", + "syn 3.0.3", + "zvariant_utils 4.2.0", ] [[package]] @@ -5341,5 +5350,18 @@ dependencies = [ "quote", "serde", "syn 2.0.117", - "winnow", + "winnow 0.7.14", +] + +[[package]] +name = "zvariant_utils" +version = "4.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bad0294361a320b694a328460dc73add56c306150f5cb6bfafc44446120008a3" +dependencies = [ + "proc-macro2", + "quote", + "serde", + "syn 3.0.3", + "winnow 1.0.4", ] From 8f2ceafc3a40764d907475ee176aaef3a0cf70ab Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 22:23:31 +0000 Subject: [PATCH 4/5] fix(tests): restore the stack's safe_path test helpers; the 0f68c62 merge left two unused CodeRabbit's hunk added an all_chars_safe helper beside this branch's is_safe_char, and the merge kept both with neither caller, which cargo clippy --all-targets -- -D warnings rejects as dead code in the lib test target. The file is the version CI passed at 5db5d90. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- src/safe_path.rs | 6 ------ 1 file changed, 6 deletions(-) diff --git a/src/safe_path.rs b/src/safe_path.rs index f60b699..ec06273 100644 --- a/src/safe_path.rs +++ b/src/safe_path.rs @@ -118,12 +118,6 @@ mod tests { use super::*; use proptest::prelude::*; - /// Property-test predicate kept separate from the sanitizer implementation. - fn all_chars_safe(s: &str) -> bool { - s.chars() - .all(|c| c.is_ascii_alphanumeric() || SAFE_PUNCT.contains(&c)) - } - // ───────────────────────────────────────────────────────────────── // has_traversal — concrete cases // ───────────────────────────────────────────────────────────────── From 8b6573969d8bf405d4def191a1d73b443a4e3914 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 20 Oct 2026 01:32:40 +0100 Subject: [PATCH 5/5] fix(deps): move zbus_xml to 5.2.1, clearing the quick-xml 0.38 advisories (#231) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Stacked on #222 (← #221 ← #220 ← #218). ## What Lockfile-only bump of `zbus_xml` 5.1.0 → 5.2.1. This removes the last `quick-xml 0.38.4` from `Cargo.lock` and clears: - RUSTSEC-2026-0194: quadratic attribute checking in quick-xml - RUSTSEC-2026-0195: unbounded namespace allocation in quick-xml ## Why no upstream PR or `[patch]` is needed The handoff plan assumed every `zbus_xml` 5.x release still used `quick-xml ^0.38`. crates.io shows otherwise: | zbus_xml | XML parser | |---|---| | 5.1.0 (was locked) | quick-xml ^0.38 | | 5.1.1 | quick-xml ^0.39 | | 5.2.0, 5.2.1 | winnow ^1.0 (no quick-xml) | `zbus-lockstep 0.5.2` (via `atspi-common 0.13`) requires `zbus_xml ^5.0.2`, so 5.2.1 is a semver-compatible resolution. The fix is already published upstream; the lockfile simply had not picked it up. ## Side effects in the lockfile All behind the opt-in `gui` feature. Default builds are unchanged. - `zvariant` / `zvariant_derive` 5.10.0 → 5.15.1 - `zbus_names` 4.3.1 → 4.3.5 - adds `winnow 1.0.4`, `zvariant_utils 4.2.0`, `zcheapstr 1.1.0`, `syn 3.0.3` (proc-macro only) Every new crate declares `rust-version` ≤ 1.87, the floor the previously locked `zvariant 5.10.0` already set. The `gui` MSRV does not move. ## Verification (local, Rust 1.99.0) - `cargo audit`: before, 2 vulnerabilities, exit 1. After, 0 vulnerabilities, exit 0, with zero ignores and no `audit.toml`. - The same five `unmaintained` warnings appear before and after: ttf-parser, unsafe-libyaml, zbus_names, zvariant, zvariant_derive. - `cargo check --all-features --all-targets`: pass - `cargo clippy --all-features --all-targets -- -D warnings`: pass - `cargo test --all-features`: all suites pass ## Follow-up (not in this PR) `zvariant`, `zvariant_derive` and `zbus_names` gained `unmaintained` notices on 2026-10-16 because they were folded into zbus 6. These are warnings, not failures. They clear only when accesskit/atspi move to zbus 6. --- _Generated by [Claude Code](https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u)_ Co-authored-by: Claude