chore: bump 0.37.0 + hermetic adaptive_scaling test fix + rust-gym scorecard baseline (#4521)

[rysweet]

Summary

Version bump 0.36.0 → 0.37.0 plus a hermetic test fix and a new rust-competency-gym scorecard baseline. (Original workflow-generated title/body were inaccurate — corrected in Step 18b review feedback.)

Issue

Closes #4521

Changed files (4)

• Cargo.toml — version 0.36.0 → 0.37.0
• Cargo.lock — mirror of the simard package version bump (no dependency changes)
• tests/adaptive_scaling.rs — add scaler: None before ..OodaConfig::default() so the test no longer inherits a SIMARD_SCALING-derived default scaler that could override the explicit max_concurrent_actions cap under test (hermetic test fix)
• ooda/scorecard.json — new checked-in rust-gym calibration baseline (+353)

Diff stat

 Cargo.lock              |   2 +-
 Cargo.toml              |   2 +-
 ooda/scorecard.json     | 353 +++++++++++++++++++++++++++++++++++++++
 tests/adaptive_scaling.rs |   9 +-
 4 files changed, 363 insertions(+), 3 deletions(-)

Note on ooda/scorecard.json (Step 18b review feedback)

ooda/scorecard.json is a generated artifact, not a hand-authored file. It is produced by the simard-rust-gym binary:

# Regenerate the baseline (writes <OUTPUT_DIR>/scorecard.json; default OUTPUT_DIR = target/simard-rust-gym)
cargo run --bin simard-rust-gym -- ooda   # writes ooda/scorecard.json

The file has no trailing newline by design: it is serialized via serde_json::to_vec_pretty, which does not emit one. This is intentional and left as-is so the checked-in snapshot matches generator output exactly (adding a manual newline would create spurious diffs on every regeneration). The repo's pre-commit gate is Python-free (issue #3181) and runs only cargo fmt/clippy/rust-only gate — it has no end-of-file fixer, so the missing newline does not affect CI.

[rysweet]

Comprehensive Code Review — Step 17b

Scope reviewed: Cargo.toml/Cargo.lock (0.36.0 → 0.37.0), new ooda/scorecard.json (rust-expert calibration baseline), and the hermetic test fix in tests/adaptive_scaling.rs.

Verdict: Approve with minor nits — no blocking issues.

Checklist

• ✅ Code quality & standards — clean; no logic changes.
• ✅ Test coverage — the test change improves correctness (removes env-dependent flakiness).
• ✅ No TODOs, stubs, or swallowed exceptions.
• ✅ No unimplemented functions.
• ✅ Logic correctness — verified (see below).
• ✅ Edge-case handling — the fix specifically addresses the SIMARD_SCALING=auto host edge case.

Strengths

• tests/adaptive_scaling.rs is the substantive change and it is correct. Setting scaler: None before ..OodaConfig::default() makes scaler_current_max_can_override_config hermetic: OodaConfig::default() reads SIMARD_SCALING from the process env (src/ooda_loop/types.rs:368), so on a host with SIMARD_SCALING=auto the inherited default scaler (ceiling 24) would call scaler.adjust() and override the max_concurrent_actions cap under test. The explicit scaler: None matches the already-established pattern in src/ooda_loop/decide.rs:180,217,591 and its rationale comment (decide.rs:208-217). Well-documented via issue #2732.
• Version bump is routine; Cargo.lock kept in sync.

Non-blocking nits (see inline)

1. ooda/scorecard.json is a generated artifact (produced by src/bin/simard_rust_gym.rs, whose default output is target/simard-rust-gym/). Checking in a snapshot is reasonable as a #1241 calibration baseline, but risks staleness/churn; consider documenting the regeneration command near it.
2. ooda/scorecard.json has no trailing newline (serde_json::to_vec_pretty omits it). If a pre-commit end-of-file-fixer runs it will rewrite the file — note pre-commit is currently pending in CI. Consider emitting a trailing \n from the gym writer.
3. PR title mismatch: "Update documentation with 12 changed files (#4521)" does not describe this 4-file change (version bump + scorecard + test fix). Recommend retitling for accurate history.

None of these block merge.

[rysweet]

✅ Correct and consistent with the established pattern in src/ooda_loop/decide.rs:180,217,591. Explicit scaler: None overrides the env-derived default from OodaConfig::default() (types.rs:368 reads SIMARD_SCALING), keeping this test hermetic on SIMARD_SCALING=auto hosts. Good fix + clear rationale comment referencing #2732.

[rysweet]

Nit: no trailing newline (serde_json::to_vec_pretty in src/bin/simard_rust_gym.rs doesn't append one). A pre-commit end-of-file-fixer would rewrite this file — pre-commit is currently pending in CI. Also: this is a generated artifact (gym default output is target/simard-rust-gym/); if it is intended as a checked-in calibration baseline, consider a short note documenting how/when to regenerate it.

[rysweet]

🔒 Security Review — Step 17c (MANDATORY)

Scope: PR #4533 — 4 files, +363/-3 (Cargo.toml, Cargo.lock, ooda/scorecard.json, tests/adaptive_scaling.rs), head 0f77ce9.

Verdict: ✅ PASS — No high-confidence security issues found. No blocking items.

Checklist

• ✅ Security requirements met — change is a version bump, a checked-in benchmark scorecard, and a hermetic test fix. No auth/crypto/access-control surface touched.
• ✅ No new vulnerabilities — no injection, deserialization, path-traversal, or command-execution risk introduced. ooda/scorecard.json is a static committed artifact, not parsed from untrusted input in this diff; the test uses a hardcoded config struct.
• ✅ Sensitive data handling — full 353-line ooda/scorecard.json scanned. Contains only benign benchmark output: numeric pass rates, subskill counts, level labels, generic Rust-concept scenario IDs/grader strings, and opaque deterministic hash IDs (sem_*, proc_*). Automated scan for API keys, tokens, passwords, private-key blocks, bearer creds, absolute paths (/home/, /Users/, C:\), internal hostnames, emails/domains, and IPs matched nothing. No .env-style credentials committed.
• ✅ Authentication/authorization — N/A; no authn/authz code in scope. The scaler: None test change touches an adaptive concurrency-scaling knob (max_concurrent_actions ceiling), not a security control — it removes test dependence on the SIMARD_SCALING env var and does not weaken or disable any security-relevant behavior. Confirmed pure test-hermeticity fix.
• ✅ Injection vulnerabilities — none.

Supply chain

Cargo.lock diff contains exactly one change: simard version 0.36.0 → 0.37.0 (mirrored in Cargo.toml). No new/removed/re-pinned third-party dependencies; no registry/source/digest changes. No supply-chain surface introduced.

No remediation required. Security review cleared for merge.

[rysweet]

Philosophy Compliance Review — Step 17d

Scope: PR #4533 (4 files, +363/-3) — version bump 0.36.0→0.37.0, new checked-in ooda/scorecard.json calibration baseline, and a hermetic test fix in tests/adaptive_scaling.rs.

Compliance Checklist

• Ruthless simplicity achieved — The functional change is a single-line addition (scaler: None) that removes hidden env-dependent behavior. No abstractions added.
• Bricks & studs pattern followed — Change is contained to the test module; the OodaConfig struct-update "stud" (..OodaConfig::default()) is used correctly to pin one field explicitly.
• Zero-BS implementation — No stubs, no faked APIs, no swallowed exceptions, no unimplemented!/TODO. The test now asserts real behavior deterministically.
• No over-engineering — Minimal, targeted fix; no speculative generality or premature configuration surface.
• Clean module boundaries — No cross-module coupling introduced; test isolates its own config rather than depending on process env (SIMARD_SCALING).

Assessment

PASS — zero required changes.

The core change makes the test hermetic: setting scaler: None before ..OodaConfig::default() prevents OodaConfig::default() (which reads SIMARD_SCALING) from injecting a scaler that would override the max_concurrent_actions cap under test. This is a reduction in complexity/hidden state — squarely aligned with ruthless simplicity and the zero-BS principle (behavior is now explicit and deterministic).

Non-blocking observations (philosophy-adjacent, out of scope)

• ooda/scorecard.json is a generated artifact (gym default output dir is target/simard-rust-gym/). Checking in a generated snapshot slightly violates "single source of truth" — a regeneration note or make target would keep it honest. Not blocking.
• PR title ("Update documentation…") does not describe the change. A truthful title supports the philosophy of clarity. Not blocking.

Verdict: Philosophy-compliant. No implementation required.

[rysweet]

Step 18b — Review Feedback Implementation (MANDATORY)

Implemented the non-blocking suggestions from Steps 17b/17c/17d + 18a. No blocking issues existed, so no code re-work was required. Summary per feedback item:

#	Item	Action taken	Result
1	Test fix scaler: None correctness	None needed — confirmed correct by all 3 reviews	✅ No change
2	ooda/scorecard.json is a generated artifact (staleness risk)	Added a regeneration note to the PR description documenting the simard-rust-gym command that produces it	✅ Documented
3	scorecard.json missing trailing newline (potential pre-commit EOF conflict)	Investigated — the repo's pre-commit gate is Python-free (issue #3181) and runs only cargo fmt/clippy/rust-only-gate, with no end-of-file fixer. The missing newline is inherent to serde_json::to_vec_pretty and is intentionally left as-is to match generator output (adding one would cause spurious diffs on every regeneration). CI pre-commit is unaffected.	✅ No change (reasoned)
4	Misleading PR title/body ("Update documentation… 12 changed files")	Retitled to chore: bump 0.37.0 + hermetic adaptive_scaling test fix + rust-gym scorecard baseline (#4521) and corrected the body to reflect the actual 4-file change (was listing 12 unrelated files)	✅ Fixed
5	Sensitive-data scan	None needed — clean	✅ No change
6	Supply-chain (Cargo.lock version-bump only)	None needed — clean	✅ No change

Disagreement documented

• Item 3 (trailing newline): Declined to add a trailing newline. Rationale: (a) no EOF fixer exists in the current pre-commit configuration, so there is no CI conflict to resolve; (b) the file is a generated artifact — a manual newline would diverge from to_vec_pretty output and reintroduce churn on every regeneration. Leaving it as-is is the more correct choice.

No new issues introduced

Changes were metadata-only (PR title + description). No source, test, or dependency files were modified, so there is no risk of regressions. All non-pre-commit CI checks remain green.

Verdict: All actionable feedback addressed. PR #4533 is ready for merge review.