Develop#55
Open
MethodWhite wants to merge 18 commits into
Open
Conversation
…re and arca
- Add event: endpoint\ndata: /message to GET /sse handler so MCP SDK clients
(Claude Desktop, Cursor, Gemini CLI, OpenCode) can discover the POST endpoint
immediately on SSE connection
- Add [patch] overrides in Cargo.toml so local development uses sibling repos
directly without changing the public git dependencies:
[patch."https://github.com/MethodWhite/synapsis-core"] -> ../synapsis-core
[patch."https://github.com/MethodWhite/Arca"] -> ../arca
- Update CI workflow to checkout synapsis-core and arca as sibling directories
so the [patch] overrides resolve correctly on GitHub Actions runners
All 16 cross_platform_tests pass with --test-threads=1
PR #54 targets develop but CI only ran on PRs to main, so test/fmt/clippy never executed for the MCP SSE fix branch. Co-authored-by: Cursor <cursoragent@cursor.com>
actions/checkout cannot write outside the workspace (../synapsis-core), so use git clone to place deps where Cargo [patch] paths expect them. Co-authored-by: Cursor <cursoragent@cursor.com>
Use GITHUB_TOKEN for git clone (Arca is private), shell bash for cross-platform paths, and clone siblings in all cargo-dependent jobs. Co-authored-by: Cursor <cursoragent@cursor.com>
Rewrite [patch] paths to deps/* at runtime so actions/checkout can clone synapsis-core and private Arca within the GITHUB_WORKSPACE. Co-authored-by: Cursor <cursoragent@cursor.com>
…cal-deps fix: MCP SSE endpoint event + local [patch] overrides for synapsis-core and arca
- Arca repo is private; GITHUB_TOKEN lacks cross-repo access Remove Arca [patch] in CI; only patch synapsis-core (public) - Revert OSV-Scanner to v1.9.2 (v2 startup failure persists) - Fix clippy: collapsible_if in ollama.rs + auto-fixes in server/autoconfig
- SecDevOps: security gates, branch strategy, PR lifecycle - SMART goals: Specific, Measurable, Achievable, Relevant, Time-bound - MoSCoW+RICE priority system (P0-P3) - Scalability targets and architecture - Release flow and ecosystem layout
- Split Windows into separate `test-windows` job (continue-on-error, cargo check only) so it no longer blocks PR merge (~30min faster CI verdict) - Remove codeql job (75min, low value for Rust) - Extract repeated sibling checkout boilerplate into .github/actions/setup-synapsis composite action (DRY: 7 jobs → 1 definition) - Remove `cargo clean` from geiger job (was destroying Rust cache) - Remove release-drafter.yml (redundant with release-please) - Pin synapsis-core git dep to tag v0.6.0 - Update AGENTS.md security gates table
- Zero-trust framework: DilithiumVerifier (ML-DSA-87) + real challenge-response auth - PQC code extracted to external prusia-vault dependency (git) - synapsis-core re-exports PQC from prusia-vault - .cargo/config.toml + scripts/dev-setup.sh for automatic local patching - CI: split Windows test, removed codeql, composite setup action
- src/core/auth/*.rs now re-exports from ztf crate - Added ztf as git dependency with pqc feature - Updated .cargo/config.toml with ztf patch - All auth tests moved to ztf crate (21 tests)
- Add session_classifications map for per-session auth state - classify_session() runs classifier on session start - tool_permission() maps tool names to required Permission - check_tool_permission() gates every tool call - Permission denied returns MCP error code -32001
- Bumped synapsis-core dep from v0.8.0 to v0.9.0 - Added rag-core to dev-setup.sh siblings
- New graph_tools module with graph_search, entity_expand, graph_context - Wired into call_tool dispatch + tool_permission mapping - Tool descriptions in list_tools - Queries entities/relations tables via rusqlite
- New tool: agentic_search with query planning and multi-iteration - rag-agentic dependency + dev-setup update
- New audit-chain crate (v0.1.0) with AuditChain, verify_chain, optional PQC signing - Migration v7 adds prev_hash, data_hash, chain_hash columns to audit_log - log_audit() now computes chain hashes automatically - New MCP tool: audit_verify to check chain integrity - Database's verify_audit_chain() returns OK or error list
- deny.toml: license + copyleft + multiple-version bans - CI: SBOM generation job (CycloneDX + SPDX) - scripts/sbom.sh: local SBOM generation (deps, licenses, tree) - Supply chain gates in CI: cargo-audit, cargo-deny, gitleaks, SBOM - deny.toml synced to all ecosystem crates
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Type of change
Checklist
cargo build --releasesucceedscargo testpassescargo clippyhas no new warningscargo fmthas been runeprintln!noise underSYNAPSIS_QUIET=1errorfield, notresult.contentinputSchemawith types, defaults, descriptionsschema_versionDatabase changes
Related issues
Closes #...