chore(deps): bump valibot from 1.0.0 to removed in /infrastructure/runtime in the npm_and_yarn group across 1 directory by dependabot[bot] · Pull Request #2 · forkwright/aletheia

dependabot · 2026-02-16T18:01:22Z

Bumps the npm_and_yarn group with 1 update in the /infrastructure/runtime directory: valibot.

Removes valibot

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 1 update in the /infrastructure/runtime directory: [valibot](https://github.com/open-circle/valibot). Removes `valibot` --- updated-dependencies: - dependency-name: valibot dependency-version: dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

sonarqubecloud · 2026-02-16T18:01:58Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot · 2026-02-16T18:06:43Z

None of your dependencies match this group anymore, you may need to update your configuration file to remove it or change its rules.

Aletheia is a portable static binary. Runs on any Linux + macOS. Three deployment methods: direct binary, Docker, Nix flake. NixOS module is an enhanced option, not a requirement. PROJECT.md: portability added to vision (#2), deployment methods in M5, G-18 updated for graceful degradation, G-19 reframed as one-of-three. Spec 24: portability principle added with per-platform capability matrix, design decision recorded. All sensors optional, degrade gracefully. Spec 43: deployment target expanded to show all three methods, NixOS bullet rewritten from 'target form' to 'enhanced option'.

…cture - Replace all personal facts in test fixtures with synthetic equivalents (Pitman arm → Widget torque, Baby #2 → Project Alpha, chrome-tanned → polymer) - Rename test username 'cody' → 'alice' across Rust, TypeScript, and Python - Depersonalize docs (emails → noreply, phone → placeholder, IPs → generic) - Remove .mailmap (connected pseudonym to real identity) - Remove Ardent Leatherworks references from UI CSS/HTML and specs - Replace entity resolver personal aliases with synthetic equivalents - Untrack operator-specific config (tools.yaml, activity_model.json) - Add pre-commit PII scanner and CI pii-scan job - Add test data policy to STANDARDS.md and CLAUDE.md Remaining: corpus JSON files, store.test.ts, pii.test.ts allowlist, digest.py weather location, spec 29 Ardent ref need follow-up pass.

…set (#629) Three fixes from TUI deployment testing on Metis: **1. StreamTurnRequest camelCase** (Issue #2 from deployment log) - TUI sends `agentId`/`sessionKey` (camelCase) but server's `StreamTurnRequest` had bare `agent_id`/`session_key` - Added `#[serde(alias = "agentId")]` and `#[serde(alias = "sessionKey")]` to accept both formats **2. `turn_complete` arriving before `text_delta` events** (Issue #3) - Two spawned tasks shared `webchat_tx`: a bridge task forwarding deltas and a turn task emitting completion - When `send_turn_streaming()` returned, the bridge could still have buffered events in `nous_rx` - Turn task now awaits the bridge `JoinHandle` before sending `TurnComplete`, guaranteeing all deltas are delivered first - Same fix applied to the error path **3. Input cursor offset** (visual bug) - `content_width` was calculated as `area.width - 1` "for possible border" but the input block only has `Borders::TOP` — no left/right borders - The off-by-one in modular arithmetic shifted the cursor 2-3 chars right - Fixed both the cursor calculation in `input.rs` and the matching height calculation in `mod.rs` Co-authored-by: Aletheia <syn@aletheia.local>

…set (#629) Three fixes from TUI deployment testing on Metis: **1. StreamTurnRequest camelCase** (Issue #2 from deployment log) - TUI sends `agentId`/`sessionKey` (camelCase) but server's `StreamTurnRequest` had bare `agent_id`/`session_key` - Added `#[serde(alias = "agentId")]` and `#[serde(alias = "sessionKey")]` to accept both formats **2. `turn_complete` arriving before `text_delta` events** (Issue #3) - Two spawned tasks shared `webchat_tx`: a bridge task forwarding deltas and a turn task emitting completion - When `send_turn_streaming()` returned, the bridge could still have buffered events in `nous_rx` - Turn task now awaits the bridge `JoinHandle` before sending `TurnComplete`, guaranteeing all deltas are delivered first - Same fix applied to the error path **3. Input cursor offset** (visual bug) - `content_width` was calculated as `area.width - 1` "for possible border" but the input block only has `Borders::TOP` — no left/right borders - The off-by-one in modular arithmetic shifted the cursor 2-3 chars right - Fixed both the cursor calculation in `input.rs` and the matching height calculation in `mod.rs`

…set (#629) Three fixes from TUI deployment testing on Metis: **1. StreamTurnRequest camelCase** (Issue #2 from deployment log) - TUI sends `agentId`/`sessionKey` (camelCase) but server's `StreamTurnRequest` had bare `agent_id`/`session_key` - Added `#[serde(alias = "agentId")]` and `#[serde(alias = "sessionKey")]` to accept both formats **2. `turn_complete` arriving before `text_delta` events** (Issue #3) - Two spawned tasks shared `webchat_tx`: a bridge task forwarding deltas and a turn task emitting completion - When `send_turn_streaming()` returned, the bridge could still have buffered events in `nous_rx` - Turn task now awaits the bridge `JoinHandle` before sending `TurnComplete`, guaranteeing all deltas are delivered first - Same fix applied to the error path **3. Input cursor offset** (visual bug) - `content_width` was calculated as `area.width - 1` "for possible border" but the input block only has `Borders::TOP` — no left/right borders - The off-by-one in modular arithmetic shifted the cursor 2-3 chars right - Fixed both the cursor calculation in `input.rs` and the matching height calculation in `mod.rs` Co-authored-by: Aletheia <syn@aletheia.local>

## Summary Adds operator-side tooling so coding agents (Claude Code, Cursor, Windsurf) get LSP-powered navigation across the 23-crate aletheia workspace, via an external Serena MCP server wrapping rust-analyzer. No aletheia crate changes, no new Cargo deps. - `scripts/serena-mcp.sh` - four subcommands (`register`, `register-user`, `start`, `check`) wrapping `claude mcp add` and the upstream `serena start-mcp-server` CLI with the `claude-code` context and the workspace root pinned. - `docs/MCP-SERVERS.md` - install, register, smoke test, tool surface, workspace acceptance checks, and the rationale for going external rather than vendoring into `diaporeia`. - `.gitignore` - ignore operator-local `.serena/` (LSP cache + project memories). - `AGENTS.md` - one-line pointer to the doc for agents that read it on cold start. ## Tool surface (claude-code context) 17 navigation/edit tools: `find_symbol`, `find_referencing_symbols`, `get_symbols_overview`, `rename_symbol`, `replace_symbol_body`, `insert_before_symbol`, `insert_after_symbol`, `safe_delete_symbol`, plus Serena's own memory tools. File I/O, shell, and pattern-search are suppressed because Claude Code already provides those. ## Why external, not vendored The integrating issue (#3355) originally proposed wiring Serena into the `diaporeia` tool bus. We chose external instead: - Zero aletheia crate changes, zero new `Cargo.toml` deps. - Serena releases often; operators upgrade via `uv tool upgrade serena-agent` with no aletheia release required. - Claude Code / Cursor / Windsurf already speak MCP natively - the agent's MCP client is the right integration point, not `diaporeia` (which exists for tools the aletheia process itself calls). - Sovereignty path preserved: a Rust-native MCP wrap of rust-analyzer under `crates/` remains on the table if the upstream trajectory diverges. ## Acceptance criteria (from #3355) - [x] Serena MCP server configured with rust-analyzer backend - [x] MCP tools available to aletheia's agents (external MCP, not diaporeia - see rationale above) - [ ] Verified: go-to-definition works across crate boundaries (requires agent-side test - documented as acceptance check #1) - [ ] Verified: find-references returns results from all workspace crates (acceptance check #2) - [x] Documentation: how to start/stop, which tools are available - [x] Consider: integrate into kanon dispatch (filed as follow-up; dispatch-side registration belongs in the kanon repo, not aletheia) ## Test plan - [x] `shellcheck --severity=warning` on `scripts/serena-mcp.sh`: clean - [x] `kanon lint` on both added files: clean - [x] `cargo fmt --check`: clean (no Rust changes) - [x] Smoke test: `printf '<initialize>' | ./scripts/serena-mcp.sh start` returns a valid JSON-RPC `initialize` result with `tools` + `prompts` + `resources` capabilities (Serena 1.26.0) - [ ] Reviewer: run `./scripts/serena-mcp.sh register` and exercise `find_symbol ToolExecutor` to confirm cross-crate navigation works end-to-end in Claude Code Closes #3355 Co-authored-by: Cody Kickertz <cody@forkwright.com>

Wires the substance-audit workflow introduced in forkwright/kanon PR #2 (`kanon audit substance <crate>`) into aletheia's operator + release docs. CLAUDE.md: new "Mutation testing" section under Commands. Documents installing cargo-mutants, the two common invocations (whole crate, diff against branch), and the rule — any missed mutation is a test gap that either needs a stronger assertion or a new test. docs/RELEASING.md: new "Substance audit gate" section. Lists the five security-/execution-critical crates to audit before merging the release-please PR and classifies findings: * blockers: symbolon, organon/sandbox, episteme/recall, episteme/conflict, krites/fixed_rule/algos * advisory: everything else (file an issue, do not hold the release) .gitignore: mutants.out/ and mutants-out/ for local baseline runs; release-branch baselines live outside the working copy. No Rust source touched; cargo fmt/clippy/test unaffected. Addresses #3509. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…3697) ## Summary Wires the new `kanon audit substance <crate>` subcommand (forkwright/kanon PR #2 on the forge) into aletheia's operator + release docs and documents the cargo-mutants install. - `CLAUDE.md` — new "Mutation testing" section documenting `cargo install cargo-mutants` and the two common invocations (whole crate, diff against branch). Any missed mutation is a test gap. - `docs/RELEASING.md` — new "Substance audit gate" section. Lists the five security-/execution-critical crates to audit before merging the release-please PR and classifies findings as blockers (symbolon, organon/sandbox, episteme/recall, episteme/conflict, krites/fixed_rule/algos) vs advisory (everything else, file issue but don't hold release). - `.gitignore` — `mutants.out/`, `mutants-out/`. No Rust source changes. `cargo fmt --all -- --check`, `cargo clippy --workspace -- -Dwarnings`, `cargo test --workspace` all unaffected. ## Test plan - [x] `cargo fmt --all -- --check` clean (no Rust source touched) - [x] `kanon lint . --summary` clean on kanon side (no open violations, 52 suppressed) - [x] 19 new substance-detector unit tests pass on kanon side - [x] `kanon audit substance crates/basanos --no-mutations` smoke-tests end to end on kanon self-audit - [x] First mutation baseline launched against `crates/symbolon/` — summary + filed issues to follow as a PR comment once the run completes ## Cross-repo Depends on forkwright/kanon PR #2 (forge-native) for the `kanon audit substance` subcommand. Landing this aletheia PR before the kanon subcommand ships is safe — the docs reference a CLI that does not yet exist on the machine; the release-time gate only runs once both PRs are merged and `kanon` is rebuilt. Closes #3509. --------- Co-authored-by: Cody Kickertz <cody@forkwright.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…enums + provider verify + self-prompting (closes #1 #2 #4) (#147) Manually merged via local validation (bypass of kanon CI gate). All gates verified locally: fmt + check + clippy + kanon lint (PR-scoped). Admin-Bypass: operator-blessed bypass during CI hygiene work (2026-05-09)

## Summary Adds operator-side tooling so coding agents (Claude Code, Cursor, Windsurf) get LSP-powered navigation across the 23-crate aletheia workspace, via an external Serena MCP server wrapping rust-analyzer. No aletheia crate changes, no new Cargo deps. - `scripts/serena-mcp.sh` - four subcommands (`register`, `register-user`, `start`, `check`) wrapping `claude mcp add` and the upstream `serena start-mcp-server` CLI with the `claude-code` context and the workspace root pinned. - `docs/MCP-SERVERS.md` - install, register, smoke test, tool surface, workspace acceptance checks, and the rationale for going external rather than vendoring into `diaporeia`. - `.gitignore` - ignore operator-local `.serena/` (LSP cache + project memories). - `AGENTS.md` - one-line pointer to the doc for agents that read it on cold start. ## Tool surface (claude-code context) 17 navigation/edit tools: `find_symbol`, `find_referencing_symbols`, `get_symbols_overview`, `rename_symbol`, `replace_symbol_body`, `insert_before_symbol`, `insert_after_symbol`, `safe_delete_symbol`, plus Serena's own memory tools. File I/O, shell, and pattern-search are suppressed because Claude Code already provides those. ## Why external, not vendored The integrating issue (#3355) originally proposed wiring Serena into the `diaporeia` tool bus. We chose external instead: - Zero aletheia crate changes, zero new `Cargo.toml` deps. - Serena releases often; operators upgrade via `uv tool upgrade serena-agent` with no aletheia release required. - Claude Code / Cursor / Windsurf already speak MCP natively - the agent's MCP client is the right integration point, not `diaporeia` (which exists for tools the aletheia process itself calls). - Sovereignty path preserved: a Rust-native MCP wrap of rust-analyzer under `crates/` remains on the table if the upstream trajectory diverges. ## Acceptance criteria (from #3355) - [x] Serena MCP server configured with rust-analyzer backend - [x] MCP tools available to aletheia's agents (external MCP, not diaporeia - see rationale above) - [ ] Verified: go-to-definition works across crate boundaries (requires agent-side test - documented as acceptance check #1) - [ ] Verified: find-references returns results from all workspace crates (acceptance check #2) - [x] Documentation: how to start/stop, which tools are available - [x] Consider: integrate into kanon dispatch (filed as follow-up; dispatch-side registration belongs in the kanon repo, not aletheia) ## Test plan - [x] `shellcheck --severity=warning` on `scripts/serena-mcp.sh`: clean - [x] `kanon lint` on both added files: clean - [x] `cargo fmt --check`: clean (no Rust changes) - [x] Smoke test: `printf '<initialize>' | ./scripts/serena-mcp.sh start` returns a valid JSON-RPC `initialize` result with `tools` + `prompts` + `resources` capabilities (Serena 1.26.0) - [ ] Reviewer: run `./scripts/serena-mcp.sh register` and exercise `find_symbol ToolExecutor` to confirm cross-crate navigation works end-to-end in Claude Code Closes #3355 Co-authored-by: Cody Kickertz <cody@forkwright.com>

…3697) ## Summary Wires the new `kanon audit substance <crate>` subcommand (forkwright/kanon PR #2 on the forge) into aletheia's operator + release docs and documents the cargo-mutants install. - `CLAUDE.md` — new "Mutation testing" section documenting `cargo install cargo-mutants` and the two common invocations (whole crate, diff against branch). Any missed mutation is a test gap. - `docs/RELEASING.md` — new "Substance audit gate" section. Lists the five security-/execution-critical crates to audit before merging the release-please PR and classifies findings as blockers (symbolon, organon/sandbox, episteme/recall, episteme/conflict, krites/fixed_rule/algos) vs advisory (everything else, file issue but don't hold release). - `.gitignore` — `mutants.out/`, `mutants-out/`. No Rust source changes. `cargo fmt --all -- --check`, `cargo clippy --workspace -- -Dwarnings`, `cargo test --workspace` all unaffected. ## Test plan - [x] `cargo fmt --all -- --check` clean (no Rust source touched) - [x] `kanon lint . --summary` clean on kanon side (no open violations, 52 suppressed) - [x] 19 new substance-detector unit tests pass on kanon side - [x] `kanon audit substance crates/basanos --no-mutations` smoke-tests end to end on kanon self-audit - [x] First mutation baseline launched against `crates/symbolon/` — summary + filed issues to follow as a PR comment once the run completes ## Cross-repo Depends on forkwright/kanon PR #2 (forge-native) for the `kanon audit substance` subcommand. Landing this aletheia PR before the kanon subcommand ships is safe — the docs reference a CLI that does not yet exist on the machine; the release-time gate only runs once both PRs are merged and `kanon` is rebuilt. Closes #3509. --------- Co-authored-by: Cody Kickertz <cody@forkwright.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…enums + provider verify + self-prompting (closes #1 #2 #4) (#147) Manually merged via local validation (bypass of kanon CI gate). All gates verified locally: fmt + check + clippy + kanon lint (PR-scoped). Admin-Bypass: operator-blessed bypass during CI hygiene work (2026-05-09)

… API) (#4149) ## Why The desktop app (`proskenion`) did **not compile** on `main`. It is excluded from the workspace (GTK/webkit2gtk system deps) and not built in CI, so two errors had drifted in undetected: 1. `state/connection.rs:118` (E0609) — the manual `Debug` impl referenced a removed `retry_backoff_ms` field. 2. `views/files/toolbar.rs:117` (E0599) — `document::eval(&js).is_err()`, but Dioxus `eval` returns an `Eval` future, not a `Result`. ## What 1. Dropped the stale `retry_backoff_ms` line from the `Debug` impl (field no longer exists; referenced nowhere else). 2. Added `.await` to the toolbar `eval` call so it matches the other call sites (`chat.rs`, `command_palette.rs`) and actually drives the clipboard-write before checking the result. ## Verification `cargo build -p proskenion --manifest-path crates/theatron/proskenion/Cargo.toml` now compiles cleanly (no errors, no warnings). The root-workspace `kanon gate --full` is green (tip carries the `Gate-Passed:` trailer); note the main-workspace gate does not cover `proskenion` since it is excluded. ## Review note Leaving this for maintainer review rather than auto-merging: change #2 alters desktop-app runtime behavior (the clipboard copy now awaits the eval). Separately, `proskenion` has accumulated a backlog of `clippy -D warnings` lint debt (it is outside CI) — out of scope here; flagged for a dedicated cleanup.

#4316) ## Summary Implements [B-002](https://github.com/forkwright/aletheia/tree/main/planning/poiesis-evolution/B-002-poiesis-theme-registry.md) from the poiesis-evolution planning cluster (kanon#985, merged 7199d54): the new `poiesis-theme` sub-crate that owns the brand-truth surface every poiesis render path consumes. The crate ships **one source → three sinks**: a `themes/<id>.toml` file resolves into a `ResolvedTheme`, which emits CSS custom properties, an OOXML `theme1.xml` `clrScheme`+`fontScheme`, and a Pandoc-shaped doc-vars map. Adding a brand is a new TOML file; no code change. ## What ships - **`ThemeId` newtype** — parse-don't-validate boundary. Registry-friendly, CSS-safe, URL-safe identifier with width 2..=64 and alphabet `[a-z][a-z0-9_-]*`. - **TOML token model** — `[color.{role,tone,surface}]`, `[type.{family,scale,role}]`, `[space]`, `[grid]`, `[table]`, `[chart]`. Components reference token names; the only place raw hex lives is `[color.role]`. - **`HexColor` newtype** — normalizes to canonical `#RRGGBB` so emission is byte-stable across hosts and runs. - **`Registry::load_dir`** — discovers `themes/<id>.toml`, enforces filename-stem ↔ `meta.id` agreement, sorts deterministically. - **`ResolvedTheme`** — dereferences tone and surface references to concrete hex values; unknown roles surface as `ThemeError::UnknownRole`. - **Three sinks** (all byte-stable, deterministic): - `sinks::css::emit_css` — `:root { --color-<role>; --tone-<name>: var(--color-<role>); --type-<role>-<slot>; … }`. - `sinks::ooxml::emit_theme_xml` — `<a:theme>` with `<a:clrScheme>` (dk1/lt1/dk2/lt2/accent1..6) + `<a:fontScheme>` (major=serif, minor=sans). Native PowerPoint charts bind to `accent1..3`, so recoloring the theme recolors charts. - `sinks::docvars::{emit_docvars_json, emit_docvars_yaml}` — Pandoc-friendly flat key→value map. - **Three `THEME/*` lint rule shapes** (`lint::{RawColorLiteralRule, RawFontLiteralRule, UnknownTokenRule}`) — each returns RFC-6901-pointer-carrying violations the QA gate consumes. - **Seed `summus` theme** — spec-03 brand palette (navy/teal/rose, Geist/Newsreader/Geist Mono, 1920×1080 type scale). ## Deferred (the stub-then-real plan) Per the B-002 acceptance gate carve-out (PR-body deferral path). Each deferred item has a named successor entry that owns the work; nothing here blocks because the missing pieces only land when the downstream crates land. | Deferred surface | Owner | Why deferred | |---|---|---| | Full `assets/<name>-base.pptx` raw-OOXML pack (slide master + per-component layouts) | [B-004](https://github.com/forkwright/aletheia/tree/main/planning/poiesis-evolution/B-004-poiesis-deck-pptx.md) | Pack/unpack pattern belongs with the PPTX emitter that owns the rest of the file shape. This PR emits the `theme1.xml` body the pack will embed. | | Reference assets generation (`reference.docx`, `reference.odt`, `template.typ`, `template.latex`) | [B-006](https://github.com/forkwright/aletheia/tree/main/planning/poiesis-evolution/B-006-poiesis-doc-pandoc.md) | The doc-vars map ships now; document-specific reference assets compose with the doc-pandoc pipeline. | | `Renderer` trait `&ResolvedTheme` parameter wiring | [B-001](https://github.com/forkwright/aletheia/tree/main/planning/poiesis-evolution/B-001-poiesis-model-registry.md) | The `Renderer` trait evolves in `poiesis-core` as part of B-001's envelope refactor; threading the `ThemeId` → `ResolvedTheme` through that interface lands there. | | `theme list/show/new/validate/compile` CLI verbs | [B-010](https://github.com/forkwright/aletheia/tree/main/planning/poiesis-evolution/B-010-poiesis-mcp-cli.md) | CLI surface aggregator. The registry API is ready; verbs are a thin wrap on top. | | Registering THEME/* rules with the basanos engine | [B-008](https://github.com/forkwright/aletheia/tree/main/planning/poiesis-evolution/B-008-poiesis-qa-moat.md) | Rule shapes (id, scan/check API, violation type) ship in this PR; engine registration is the QA-moat crate's job. | | Byte-stable CSS regression against the offsite deck | [B-003](https://github.com/forkwright/aletheia/tree/main/planning/poiesis-evolution/B-003-poiesis-deck-html-pdf.md) / [B-011](https://github.com/forkwright/aletheia/tree/main/planning/poiesis-evolution/B-011-poiesis-testing-substrate.md) | Need the deck artifact and the golden harness to assert against. | ## Acceptance gate coverage | B-002 acceptance criterion | This PR | |---|---| | #1 `theme compile summus` emits CSS, OOXML, doc-vars matching spec | CSS + OOXML `theme1.xml` + doc-vars all emit the spec-03 values; PPTX pack deferred to B-004. | | #2 swap `summus → ardent` restyles with zero spec edits | Architecturally enabled (tone refs + sink emission are theme-id-agnostic); end-to-end regression deferred to B-011 §theme-swap. | | #3 raw hex/font literal in a spec field fails `THEME/raw-color-literal`/`-font-literal` with JSON-pointer | Rule shapes + APIs ship; basanos engine registration deferred to B-008. | | #4 unknown token fails `THEME/unknown-token` at load time | `UnknownTokenRule::check` ships with pointer-carrying violations; runtime path also surfaces `ThemeError::UnknownRole` if a renderer asks for a missing tone. | ## Test plan - [x] `cargo test -p poiesis-theme` — 68 unit + 2 integration green - [x] `cargo clippy -p poiesis-theme --all-targets -- -D warnings` clean - [x] `cargo fmt -p poiesis-theme -- --check` clean - [x] `cargo check -p poiesis-core -p poiesis-lint` still passes (no neighbour breakage) - [x] `kanon lint` — 42 → 20 warnings; remaining 20 enumerated below - [x] `kanon name_check summus` — `status: free` - [x] Byte-stability tests across all three sinks (emit twice, assert equal) - [ ] Cross-target render proof (depends on B-003/B-004/B-006) ## Known kanon-lint warnings The remaining 20 warnings are documented intentional architecture or ambient project-wide: - **9 × `RUST/pub-visibility` (Info)** — public items intended for sibling-crate consumption by [B-001], [B-003], [B-004], [B-006], [B-008]. Documented in `crates/poiesis/theme/CLAUDE.md` §Status table. - **9 × `PERFORMANCE/clone-in-loop` (Warning)** in `sinks/docvars.rs` — building a `serde_json::Value` tree from `IndexMap<String, _>` requires owned `String` keys (serde_json's `Map` key type is `String`, not `&str`). Refactoring to `Cow` would need a parallel JSON-tree representation. - **1 × `RUST/primitive-for-domain-id` (Warning)** on `Violation.rule_id: String` — the rule id matches the basanos engine's string-keyed rule registry; a newtype here would not improve the boundary because the consumer carries the same shape. - **1 × `OPERATIONS/no-runbook` (Info)** — project-wide, ambient. ## GNOMON layer check - **`poiesis-theme` (crate)** — L1: 13-char identifier, pronounceable, grep-friendly. L2: matches `poiesis-{core,lint,sheet,…}` sibling convention. L3: English `theme` is the role; the Greek work (`poiesis = ποίησις, "making"`) lives at the family-name layer. L4: composes with siblings; no semantic collision; the crate sits at the brand-truth/registry slot the family was missing. - **`summus` (seed theme)** — L1: 6 chars, pronounceable, grep-friendly, `status: free` per `kanon name_check`. L2: brand/theme name in the `themes/<id>.toml` namespace; sibling slot to future themes (e.g. `ardent`). L3: Latin "highest, supreme"; indicates the flagship/canonical theme. Latin not Greek; locked by upstream apodeixis Phase-00 spec, not chosen here. L4: composes — future themes form a sibling palette. ## SonarCloud quality gate: spurious SCA finding The SonarCloud "C Security Rating on New Code" failure on this PR is a single SCA (dependency-analysis) annotation against the new crate's `Cargo.toml`: > Dependency versions are not predictable if the lock file (Cargo.lock) is missing. This is a **false positive** for a cargo-workspace member crate. Cargo workspaces produce one shared `Cargo.lock` at the workspace root; member crates do not (and should not) carry their own lockfile — see [The Cargo Book §Cargo.toml vs Cargo.lock](https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html) and the [Cargo workspace resolver](https://doc.rust-lang.org/cargo/reference/resolver.html). The repo's authoritative `Cargo.lock` lives at the workspace root (also touched by this PR for the new member's transitive deps), so every dependency *is* pinned to an exact version — Sonar's SCA simply does not walk back to the workspace root from a member `Cargo.toml`. **Operator decision:** marked spurious. Suggested durable fix (separate, repo-wide PR) is one of: - Add a `sonar-project.properties` at the repo root with `sonar.exclusions=crates/**/Cargo.toml` (excludes member manifests from SCA only — root `Cargo.toml` + `Cargo.lock` still drive dependency analysis), **or** - Wait for SonarCloud SCA to learn cargo-workspace lockfile inheritance (raised upstream at [SonarSource SCA troubleshooting](https://docs.sonarsource.com/sonarqube-cloud/advanced-security/troubleshooting-the-dependency-analysis)). Other checks on this PR are green (no AI attribution, gate-attestation with `Gate-Passed: kanon 0.1.0`, cargo deny, scan). The included refactor commit centralizes the spec-mandated XML namespace constant — orthogonal quality work, not a Sonar fix. --------- Co-authored-by: forkwright <forkwright@users.noreply.github.com>

…arget (#6601) ## Problem `update_working_checkpoint`'s tool description and module doc claimed checkpoint content is reinjected into "the next user message" as a `<key_info>` block. The turn-start hook actually appends it to the **system prompt** — not a synthesized user message. Since this description is exactly what the agent reads every turn to decide what's worth persisting, the wrong claim misrepresents how its own working memory actually surfaces back to it. ## Evidence - `crates/organon/src/builtins/working_checkpoint.rs:4` (module doc) and `:89` (`ToolDef.description`, agent-facing) both said "reinjected into the next user message". - `crates/nous/src/hooks/builtins/working_checkpoint.rs:1,4-6` — the actual injector — appends the `<key_info>` block to `context.pipeline.system_prompt`, and its own module doc already correctly says "system prompt". ## Fix Corrected both organon-side occurrences to say "system prompt", matching nous's actual behavior and its own accurate doc comment. ## Test Added `checkpoint_tool_description_names_the_real_injection_target` in `working_checkpoint.rs`'s existing test module: asserts `working_checkpoint_def().description` contains "system prompt" and does not contain "next user message". Fails on the pre-fix text, passes after. ## Scope note (issue #4757) This issue's evidence bundled four stale-doc findings. Two are already resolved on `main` and not touched here: - The `workspace.rs` timeout-default mismatch (120000ms/30000ms) is gone — `exec`'s timeout is no longer schema-defaulted; it derives from `ctx.tool_config.subprocess_timeout_secs`. - `docs/OBSERVABILITY-AUDIT.md`'s `GAP-SPAN-2` is already marked "Resolved" and matches `crates/organon/src/registry/mod.rs`'s `tool_execute` span. A third item (evidence #2: `exec`'s tool description still says "shell command" though `parse_command_args` explicitly avoids invoking a shell) is real but is a separate tool/file and out of scope for this PR. Refs #4757 Co-authored-by: Cody Kickertz <admin@forkwright>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 16, 2026

dependabot Bot closed this Feb 16, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/infrastructure/runtime/npm_and_yarn-d10da1b5f6 branch February 16, 2026 18:06

CKickertz mentioned this pull request Feb 26, 2026

chore: professional repo gap analysis — CI, tooling, and best-practice gaps #242

Closed

This was referenced Mar 2, 2026

mneme: architectural risks and pre-deployment blockers #409

Closed

mneme: knowledge lifecycle — extraction, conflict resolution, consolidation #411

Closed

chore: complete PII scrub — synthetic test data, prevention infrastructure #465

Closed

forkwright mentioned this pull request Mar 3, 2026

chore: PII scrub phase 1B — synthetic test data, prevention infrastructure #467

Merged

4 tasks

forkwright mentioned this pull request Mar 9, 2026

fix(pylon,tui): streaming race, camelCase deserialization, cursor offset #629

Merged

forkwright mentioned this pull request Apr 7, 2026

audit: background task failures are silent and unrecoverable #2724

Closed

forkwright mentioned this pull request Apr 19, 2026

feat(mcp): Serena LSP-based code navigation (closes #3355) #3684

Merged

11 tasks

forkwright mentioned this pull request Apr 19, 2026

feat: integrate cargo-mutants + substance audit gate (closes #3509) #3697

Merged

5 tasks

forkwright mentioned this pull request Apr 22, 2026

feat(nous): cached microcompact — checkpoint the distillation prefix #3781

Closed

4 tasks

github-actions Bot mentioned this pull request May 9, 2026

chore(main): release 0.22.0 #3774

Merged

This was referenced May 22, 2026

confirm aletheia.toml menos-chat (anubis) + menos-vlm (qwen3-vl) registrations are actually needed #3932

Closed

krites(naming): "judge" framing maps to Datalog engine; agent evaluation lives in dokimion/eval #3960

Closed

forkwright mentioned this pull request Aug 4, 2026

fix(organon): correct working_checkpoint tool description injection target #6601

Merged

Navigation Menu

chore(deps): bump valibot from 1.0.0 to removed in /infrastructure/runtime in the npm_and_yarn group across 1 directory - #2

chore(deps): bump valibot from 1.0.0 to removed in /infrastructure/runtime in the npm_and_yarn group across 1 directory#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/infrastructure/runtime/npm_and_yarn-d10da1b5f6

dependabot Bot commented on behalf of github Feb 16, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Feb 16, 2026

Uh oh!

dependabot Bot commented on behalf of github Feb 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud Bot commented Feb 16, 2026

Quality Gate passed

Uh oh!

dependabot Bot commented on behalf of github Feb 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Feb 16, 2026 •

edited

Loading