Restore a green CI run

.cargo/audit.toml

@@ -0,0 +1,16 @@
+# cargo-audit configuration.
+#
+# Advisories listed here are reviewed and deliberately not actionable. Each
+# entry records why, so the next person does not have to re-derive it.
+
+[advisories]
+ignore = [
+    # RUSTSEC-2026-0189 - DNS rebinding in rmcp's Streamable HTTP server
+    # transport. tempyr does not build or use that transport: the workspace
+    # enables only `features = ["transport-io"]`, and tempyr-mcp serves over
+    # `rmcp::transport::stdio` exclusively. Upgrading past 1.3 is a separate
+    # API migration (1.4 removes `handler::server::common::schema_for_input`
+    # and 1.8 additionally breaks `list_roots`), so it is tracked on its own
+    # rather than folded into a dependency refresh.
+    "RUSTSEC-2026-0189",
+]

crates/tempyr-cli/src/commands/journal_init.rs

@@ -101,17 +101,15 @@ fn git_remote_url(repo_root: &Path, remote: &str) -> Option<String> {
 pub fn parse_owner_repo_from_url(url: &str) -> Option<(String, String)> {
     let lower = url.to_ascii_lowercase();
     // Strip the host marker; whatever's left should be `<owner>/<repo>`.
-    let after_host = if let Some(rest) = lower.strip_prefix("https://github.com/") {
-        rest.to_string()
-    } else if let Some(rest) = lower.strip_prefix("http://github.com/") {
-        rest.to_string()
-    } else if let Some(rest) = lower.strip_prefix("git@github.com:") {
-        rest.to_string()
-    } else if let Some(rest) = lower.strip_prefix("ssh://git@github.com/") {
-        rest.to_string()
-    } else {
-        return None;
-    };
+    let after_host = [
+        "https://github.com/",
+        "http://github.com/",
+        "git@github.com:",
+        "ssh://git@github.com/",
+    ]
+    .into_iter()
+    .find_map(|prefix| lower.strip_prefix(prefix))?
+    .to_string();
     // Drop trailing `.git` and any trailing slash.
     let trimmed = after_host
         .trim_end_matches('/')

crates/tempyr-index/src/vector.rs

@@ -162,8 +162,10 @@ pub(crate) fn embedding_to_blob(embedding: &[f32]) -> Vec<u8> {
 
 /// Convert raw byte blob back to f32 vector.
 pub(crate) fn blob_to_embedding(blob: &[u8]) -> Vec<f32> {
-    blob.chunks_exact(4)
-        .map(|chunk| f32::from_le_bytes([chunk[0], chunk[1], chunk[2], chunk[3]]))
+    blob.as_chunks::<4>()
+        .0
+        .iter()
+        .map(|chunk| f32::from_le_bytes(*chunk))
         .collect()
 }
 

crates/tempyr-journal-index/src/embed.rs

@@ -241,8 +241,8 @@ pub fn bytes_to_vec(bytes: &[u8]) -> Result<Vec<f32>> {
         )));
     }
     let mut out = Vec::with_capacity(bytes.len() / 4);
-    for chunk in bytes.chunks_exact(4) {
-        out.push(f32::from_le_bytes([chunk[0], chunk[1], chunk[2], chunk[3]]));
+    for chunk in bytes.as_chunks::<4>().0 {
+        out.push(f32::from_le_bytes(*chunk));
     }
     Ok(out)
 }