wiki(ci): 3 is the expected reading — the deferrals are accepted waits at #406
#402 closed. Separates the two causes rather than filing both as 'waiting for
upstream': quick-xml's patch exists and is blocked on OUR crypto-backend choice,
while rsa genuinely has no fixed release.
States the number a reader should expect, because 'remaining vulnerabilities' with
no expected value invites the next person to read 3 as a regression.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wiki: noetl 5.1.1 published; #390 and #398 closed
Rule 0a four-page change set: Home (Last refreshed + Active-umbrella rows for
#390/#398 removed + Recently-closed rows added + Releases preview), Sessions-Log
(new 2026-10-04 later entry), Releases (three rows: pypi-v5.1.1, pypi-v5.1.0,
cli v5.0.3), Continuous-Integration (the advisory section resolved to 3, the apt
tier section rewritten to one tier, two fleet-table rows).
The through-line of the entry: a 3 is only a result if the scanner was shown able
to find 5. The previous shipped lock was scanned first as a positive control and
had to report exactly #402's five, because a low number from an instrument that
has never produced a positive is the same shape as an inert gate. Two of my own
measurements in that scan were themselves broken -- a glob for crates/*.toml
matches nothing (the advisories are .md with TOML front matter) and a grep -m1 in
my display of rustls-webpki's advisories truncated a two-element patched list so
the scanner looked like it was missing three hits.
Also records the finding nobody had reported in #390: without
dpkg-scanpackages --arch, every .deb lands in one index regardless of
architecture -- latent while only amd64 shipped, and it would have served arm64
binaries to amd64 clients the moment arm64 existed.
Refs noetl/ai-meta#390, noetl/ai-meta#398, noetl/ai-meta#402
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wiki: published noetl 5.1.0 — and two ways a clean result was not one
Rule 0a: Home (Last refreshed, #395 -> Recently closed, #400 + #402 added
to the open table), Sessions-Log and Continuous-Integration together.
- #395 CLOSED: noetl 5.1.0 is on PyPI, so the artifact finally carries the
crates the repo cleared. Arc 214 -> 31 -> 7 -> 0 in the repo -> 0 in the
artifact.
- ⚠⚠ Records that a green publish job is NOT evidence anything shipped:
twine --skip-existing plus no tag/version cross-check would have
published nothing and reported success (#400). Verified by upload/skip
counts instead.
- ⚠ Corrects an earlier claim here: the version line was never broken. I
had compared the ROOT pyproject (the retired distribution's carrier)
against the wheel's version, which lives in packaging/pypi.
- ⚠ Records that pypi.yml builds WITHOUT --locked, so a wheel's resolution
need not equal the committed lock -- 5.0.0 compiled BOTH rustls-webpki
0.102.8 and 0.103.13, which is how a strings probe briefly suggested the
old artifact was fine. Finding a patched copy is not evidence a
vulnerable one is absent.
- ⚠⚠ Records the sharpest finding: RustSec finds 5 patchable
vulnerabilities in the same shipped lock Dependabot reports as 0 (#402),
so #395's closure is scoped to the 7 alerts it tracked.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wiki: pinning the last two toolchains found ehdb already broken
Rule 0a: Home (Last refreshed), Sessions-Log and Continuous-Integration
together.
- All 7 Rust repos now pin a toolchain (#378's pin work complete).
- ⚠⚠ Records the live case the pinning found: ehdb's main was QUEUED TO
FAIL with no commit at fault. rustc 1.99.0 deprecated
Atomic::fetch_update; ehdb's last green run (10-01) installed 1.98.1 and
the action rolled to 1.99.0 on 10-03, against a -D warnings gate with no
allow-list to absorb it. Found by pinning, not by the build.
- Records why the fix is a scoped #[allow(deprecated)] rather than
try_update: the workspace declares rust-version 1.82, and raising a
declared MSRV by 17 releases to silence a pure rename is the owner's
call.
- ⚠ Records that a toolchain pin also fixes which rustfmt runs, so a repo
gating must be re-checked under the pin.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wiki: allow-lists 23 -> 2, and the finding one of them was hiding
Rule 0a: Home (Last refreshed, #361 + #385 moved to Recently closed, #395
added to the open table), Sessions-Log and Continuous-Integration together.
- #378: fleet clippy -A entries 23 -> 2; server and worker to zero, tools
pinned. Corrects the earlier figure of 27, which counted comment prose.
- ⚠⚠ Records that server's -A dead-code was HIDING #361 -- two tests that
carried no #[test] and had never run -- and that the entry which hid the
cause (duplicate_macro_attributes) sat adjacent to it. An allow-list
hides the next finding of the same kind.
- Records the mechanical test for a justified allow: remove it and see
whether the gate fails.
- ⚠⚠ Records that two of my own suppressions were inert: an #[allow] on a
macro invocation is silently ignored, and the first load-bearing battery
mis-labelled 2 of 4 because the shell split on the colon inside clippy::.
- Records that const-block asserts fail cargo build but not cargo check,
that a bare test-name filter matches nothing and still exits 0, and that
the toolchain action's banner is not the toolchain cargo used.
- #385 closed at 0 alerts, with the #395 caveat that the published wheel
still embeds all seven.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wiki: the wiki sweep closes #375 — and the gate that printed FAIL and exited 0
Rule 0a: Home (Last refreshed + #375 moved to Recently closed),
Sessions-Log and Continuous-Integration together.
- #375 CLOSED. Every repo that can host a PR gate has one; the 15 wikis
cannot host Actions at all, so a scheduled ai-meta sweep covers them
daily (243 markdown files, 1684 relative links).
- Records the 2 real broken links the sweep found on its first run, which
nothing had ever checked because the wikis have no runner.
- Records the sharpest instance of this arc's theme: the sweep's first
version printed RESULT: FAIL and exited 0, because a chained EXIT trap
made $? the status of the cleanup function. Caught only because the
control asserted the exit code rather than grepping the output.
General form: when testing a gate, assert what CI actually consumes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wiki: PR gates for ops, e2e and apt — and what each one caught
Rule 0a: Home (Last refreshed + the open table, now carrying #390),
Sessions-Log and Continuous-Integration move together.
- #375's three gateless repos now gate, all merged. Each measured green
first, each printing its denominator with a population floor proven to
fire against an empty repo.
- Records that a naive YAML gate on ops starts red 36 times (all Helm
templates), and that the exclusion is proven not to be a blind spot.
- Records the drift the e2e gate caught immediately: 144 committed vs 162
actual playbooks, 7 category pages never committed, and onBrokenLinks
set to 'warn' so a build could not fail on a broken link.
- Records #390: the apt index does not describe the pool, AND the correct
generator in ops/scripts/publish_apt.sh is never invoked.
- Records a third local-green-is-not-CI-evidence case, plus a stale-head
flaw in my own CI wait helper that reported a previous head's failure.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wiki: advisory backlog to 0, clippy gating on all five, and five lying measurements
Rule 0a: Home (Last refreshed + open/closed tables), Sessions-Log and the
Continuous-Integration page move together.
- #385: all 7 Rust advisories cleared (214 -> 31 -> 7 -> 0), with the
per-crate upstream path and what each breaking bump actually cost.
jsonwebtoken 10 broke at RUNTIME, not compile time. lru is still in the
tree and that is correct.
- #374 CLOSED: clippy gates on tools, gateway and cli. cli was 39 lints,
not the 15 a -D warnings run reports.
- Records the measurement failures: a gating run is not an inventory,
clippy serves cached warnings, clippy --fix introduced a worse lint,
an exit=127 proof looked clean, and git checkout reverted real fixes.
- Flags that tools/server/worker have no toolchain pin, so their lint set
floats; a local green is not evidence about CI.
- Fixes Home drift: #385 and #378 were open but absent from the table.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wiki: the advisory arc 214 -> 7, and two measurements that beat the obvious guess
Records what a lockfile refresh reached (183 pip + 24 npm) and what it cannot: the 7
Rust advisories are all transitive through a wrapper with two direct dependencies, so
each needs a breaking upstream bump.
Two corrections worth keeping:
* embedding the 5.x CLI cleared ZERO advisories -- the four crates are
byte-identical before and after, even though noetl-tools crossed a major version.
A major bump of an intermediate crate is not evidence its own deps moved.
* async-nats is NOT a dead transport. NATS-as-internal-bus died at T5; kind: nats
as a TOOL and as a subscription source is live and always compiled in. The cli
file the removal targeted mentions it in two doc comments only. The fix is
async-nats 0.38 -> 0.47+ (which requires rustls-webpki ^0.103.10), not removal.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wiki: noetl wrapper-only final numbers, and the ops knock-on
#701 final: Python 90 -> 3 files, +633 -19,095 across 104 files; uv.lock 241 -> 36
packages, addressing all 183 pip Dependabot alerts (164 packages gone, 19 fixed by
version). Residual 31 are npm + Rust lockfiles no uv refresh can reach.
Records that dropping scripts/ibkr broke a repos/ops playbook invoking it by
absolute local path, handled in noetl/ops#318 with a loud documented failure rather
than a silent break; disposition in noetl/ai-meta#383.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wiki: noetl/noetl is a Rust-CLI wrapper — 'no pytest' is by design
Corrects the fleet table: the audit listed noetl/noetl as 'no pytest anywhere' as
though it were a gap. The intended state is a thin wrapper around the Rust noetl CLI,
so there is almost no Python to test. #382 removed the residue (77 files, 90 -> 9,
-16,961 lines), keeping the maturin wrapper, the live schema_ddl.sql that ops
provisions from by path, and the test guarding that DDL. Its gate is scoped to those
plus the release prerequisites.
Records that the release-prereq guard exists because the removal itself broke
'uv version' -- exit 1 while still rewriting the version, so only the exit code
showed it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wiki: close out the CI arc — the gate had to be fixed twice, once by itself
CHECK 3 forbade correcting a CHECK 2 violation: moving a pointer off a side branch
onto the tracked branch is never a fast-forward, so the gate reported a defect and
then refused to let anyone fix it (#379). That is where #372 sat. Documented on the
CI page with the four controls, including that a genuine regression still fails.
Coverage is 31 of 31 with zero unverifiable after the two private submodules were
removed (#377), measured by the unauthenticated runner. #372 closed by re-pointing
repos/docs onto docs main (#381); re-bump after noetl/docs#188 is #380, with the
reasoning for re-pointing rather than merging that PR recorded.
clippy now gates on server and worker (#374): measuring first explained the
'|| true' — 22 errors/14 kinds on server, 15/7 on worker — so the debt is
allow-listed by name and swept under #378. cli/tools/gateway wait for their own
measurement. docs and doctor PR gates merged.
Home's Also-open table reconciled: 1 closed row dropped, 5 open issues added, 58
rows, 0 gap. Five had been referenced only in the previous Last-refreshed prose.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wiki: pointer coverage is now full — 31 of 31, zero unverifiable
The two private submodules (repos/noetl.io, references/chatui) were removed in
noetl/ai-meta#377 (merge 5bd14bdb). An unauthenticated runner could never fetch a
SHA from either, so they sat permanently 'unverifiable (no CI access)' — neither
pass nor fail — holding coverage at 31 of 33. Neither carried a live dependency.
Measured on main by the runner itself: declared 31, examined=31 of 31, check 1
31/31, unverifiable 0. The token decision is therefore MOOT — nothing is left for
a token to unlock.
CHECK 0 stays documented and in place: adding one private submodule would silently
reintroduce the false 'dangling, unpushed, or wrong SHA' verdict without it, and
the unverifiable count rising above zero is the signal that it happened.
Live counts updated 33 -> 31. The quoted RESULT blocks keep their original numbers
with a note, because rewriting a captured run's output would falsify the quote.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wiki: add Continuous-Integration — what the gate checks and how to fix a red one
ai-meta had zero workflow files, which is how #370 merged five submodule pointer
bumps with nothing checking them. A pointer is a 40-hex string and git validates
nothing about it: it need not exist, be pushed, or be on any branch.
The page covers what runs and when (PRs + pushes to main), each check in plain
terms — the 160000 gitlink pre-check, CHECK 0 remote reachability, CHECK 1 commit
reachable from a ref, CHECK 2 the detached-bump flag, CHECK 3 fast-forward, and
the docs fence/link gate — plus a failure->fix table and the correct gitlink-only
bump recipe for this repo's shared, usually-dirty checkout.
It also records which failures BLOCK (pointers your change touches) versus which
merely REPORT (the full 33-pointer sweep), because main carries legacy drift
(#372) and failing unrelated PRs on it would park main red.
Carries the fleet PR-gate table: ai-meta/docs/doctor added, ehdb + signal-mesh as
the shape to copy, clippy inert on five repos (#374), six repos that had no PR
trigger and the wikis that cannot host Actions at all (#375), and #232 corrected.
Every quoted example is captured output, not reconstructed — writing it that way
found a real defect: the docs gate printed each failure twice.
Linked from Home's Conventions section and from _Sidebar under Conventions.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>