Audit sweep: 30 verified fixes across client, server, daemon, orchestrator, growth, seed, MCP#24
Merged
Conversation
…onformance gate Points DEFAULT_REGISTRY_URL at the -api host that actually serves the registry API. Wires the CLI's explicit persona activation into the existing local selection-history log and the opt-in-gated telemetry sender, matching the activation contract shared by every client surface; both calls are best-effort and never fail the command. Adds RegressionGate::evaluate_cross_version with a typed CrossVersionDecision (Pass, Regression, IntegrityFailure, MissingBaseline, InvalidScore), leaving evaluate_upgrade untouched. Client::install evaluates it before overwriting an installed persona and records the outcome on InstallReport as an additive optional field; the CLI prints a warning for non-clean outcomes. All outcomes are warn-only -- installs are never blocked. Also corrects selection.rs and lib.rs docs that claimed the history log feeds intelligent selection; that learning lives in the orchestrator's preferences store.
The watch channel's sender was created and immediately discarded, so the shutdown method returned its canned reply and closed that one connection while the accept loop ran forever. The sender is now threaded into serve() and cloned into each connection; a shutdown RPC flips the flag and the accept loop exits. Covered by an end-to-end socket test.
PersonaProfile::from_source dropped anti-pattern and general-pattern text from the keyword corpus entirely. High-signal section extraction ignored heading levels and its output was deduplicated away against the prepended full body, making the weighting inert; signal sections now lead the corpus so extraction order matters.
The structured JSONL growth layer existed with zero callers. append() now dual-writes: markdown first (unchanged behavior), then a best-effort structured entry; a JSONL failure after a successful markdown write propagates as the call's error. frameshift migrate gains a growth-log pass (idempotent per persona), and grow log / grow summary expose the structured history. The silent chmod failure on the growth file now logs.
The persona gate required persona.toml or AGENTS.md, skipping every curated pack.toml-only directory; pack.toml is now a sufficient marker. Curated manifests ship a placeholder author_pubkey that the strict parser rejects, so the seeder repairs it in place with the real signing key via a surgical single-line rewrite that preserves comments, key order, and every other byte of the hand-written file. Marketplace metadata now comes from pack.toml description/tags first, with the legacy persona.toml/AGENTS.md derivation as fallback.
The stdio MCP server had no registry-search parity with the CLI's search command. Adds a frameshift_search tool (query required, limit optional with a default of 20 and a client-side cap of 100) backed by Client::search_registry.
…te versions /healthz previously passed backend detail strings (filesystem roots, pool counts, raw driver errors) verbatim to an unauthenticated endpoint; detail is now a fixed ok/degraded string and the rich detail goes to server-side tracing only. Publish validation errors no longer leak tempdir paths. GET /v1/authors exposes the already-implemented catalog listing with limit/offset, the versions route gains the same pagination (default 100), and the downloads rustdoc now matches the status codes the handlers actually return.
Documents all 27 server config vars from config.rs, adds a Downloads subsection explaining direct vs signed delivery, corrects the MSRV noted in the CI workflow comment to the declared rust-version 1.86, and drops preflight's reference to a mirror job that no longer exists.
A shipped baseline whose declared bundle hash does not match the bundle the pack actually ships means the conformance evidence cannot be trusted -- unlike a score regression, this indicates tampering or a broken publish pipeline, so the install-over-existing now fails with ConformanceIntegrityFailure instead of warning. The previously installed version is left untouched. Operators can consciously proceed with FRAMESHIFT_ALLOW_CONFORMANCE_INTEGRITY_FAILURE=1, in which case the CLI warning names the override. Regression, MissingBaseline, and InvalidScore stay warn-only. Also fills in missing doc comments across the client library surface.
POST /v1/admin/packs/{name}/{version}/tombstone exposes the
previously-unwired catalog tombstone (one-way Active -> Tombstone,
idempotent per the Postgres adapter). Auth reuses the Ed25519
signed-request middleware plus a new FRAMESHIFT_ADMIN_PUBKEYS
allowlist (comma-separated base64url keys); an empty allowlist
disables the endpoint entirely and answers 404 so its existence is
not revealed, a verified non-admin signer gets a generic 403. Body
carries the tombstone reason (author-request, tos-violation, dmca).
Covered by six integration tests through the real router.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the FrameShift half of the two-repo audit sweep: every adversarially verified finding from the full-workspace audit, fixed in eight logical commits.
Verification