Restore a green CI run

[cleak]

Why

CI last ran on master in May (e8c4d14, green). The workflow pins its toolchain with dtolnay/rust-toolchain@29eef33…, which resolves to stable, and cargo audit reads a database that keeps moving. Four months on, both the Clippy and Audit steps now fail on unmodified master — I reproduced each on a clean checkout before touching anything.

That means every new PR inherits two unrelated red checks. I hit it opening #48 and split the cleanup out so that PR reviews on its own merits.

Clippy

• chunks_exact(4) → as_chunks::<4>() in tempyr-index/src/vector.rs and tempyr-journal-index/src/embed.rs. Also lets f32::from_le_bytes(*chunk) take the array directly instead of rebuilding it index by index.
• parse_owner_repo_from_url collapses its four-branch strip_prefix chain into a find_map, so the trailing else { return None; } becomes the ? the lint was asking for. Same prefixes, same order, same None on no match.

Audit

Two are plain lockfile bumps:

Crate		Advisory
crossbeam-epoch	0.9.18 → 0.9.20	RUSTSEC-2026-0204
h2	0.4.13 → 0.4.19	RUSTSEC-2026-0258

The third, RUSTSEC-2026-0189, is DNS rebinding in rmcp's Streamable HTTP server transport — which this workspace never builds. Cargo.toml enables only features = ["transport-io"], tempyr-mcp serves over rmcp::transport::stdio, and there is no SSE, axum, or streamable-HTTP usage anywhere in crates/.

Upgrading is also not a lockfile bump. I tried both: 1.4.0 removes handler::server::common::schema_for_input (5 call sites fail to compile) and 1.8.0 additionally hits E0515 plus a deprecated list_roots. That is a real API migration and does not belong in a dependency refresh, so it is recorded in a new .cargo/audit.toml with the reasoning rather than silently carried.

Verification

All four CI steps, run locally with the exact workflow commands:

cargo fmt --check                                  PASS
cargo clippy --workspace --all-targets -- -D warnings   PASS
cargo test --workspace --locked                    670 passed, 0 failed, 12 ignored
cargo audit --file Cargo.lock                      PASS

Note

#48 is stacked behind this — it will stay red until this lands, through no fault of its own.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EwBDuaQS537MdX3GUtmhqj

Summary by CodeRabbit

• Refactor

  • Simplified GitHub repository URL recognition while preserving all previously supported formats.
  • Streamlined conversion of stored embedding data without changing results or behavior.

• Chores

  • Added security audit configuration and tracking information for a known advisory. Current application behavior remains unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Essentials

Run ID: 874a3df1-1578-4e26-8a08-5fd4b7c26910

📥 Commits

Reviewing files that changed from the base of the PR and between e8c4d14 and bafab89.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• .cargo/audit.toml
• crates/tempyr-cli/src/commands/journal_init.rs
• crates/tempyr-index/src/vector.rs
• crates/tempyr-journal-index/src/embed.rs

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The changes add cargo-audit configuration, simplify GitHub URL prefix matching, and replace indexed byte-chunk decoding with as_chunks::<4>() in two embedding paths.

Changes

Audit configuration

Layer / File(s)	Summary
Configure cargo-audit .cargo/audit.toml	Adds an ignored rmcp advisory with comments describing stdio-only transport usage and tracked upgrade incompatibilities.

Repository URL parsing

Layer / File(s)	Summary
Simplify URL prefix matching crates/tempyr-cli/src/commands/journal_init.rs	Uses an iterable lookup for HTTPS, HTTP, SCP-style SSH, and ssh:// GitHub URLs. Unsupported prefixes still return None.

Embedding byte decoding

Layer / File(s)	Summary
Decode fixed-width chunks crates/tempyr-index/src/vector.rs, crates/tempyr-journal-index/src/embed.rs	Uses as_chunks::<4>() for little-endian f32 decoding in both embedding paths.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to bafab

This maintenance change restores CI compatibility while preserving URL parsing and embedding decoding behavior; no current merge-blocking risk remains.

Poem

I am a rabbit with bytes in my burrow
Four-byte chunks now march in a row
URLs find their paths with a simpler tune
Audit notes watch the transport moon
Embeddings decode, neat as a carrot stew

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary objective: restoring passing CI checks through Clippy, audit, dependency, and compatibility fixes.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/ci-health

---

_{Comment @coderabbitai help to get the list of available commands.}