Bump sha2 from 0.10.9 to 0.11.0 - #2
Open
dependabot[bot] wants to merge 185 commits into
Open
dependabot[bot] wants to merge 185 commits into
dependabot[bot] wants to merge 185 commits into
Conversation
Fourteen tend2 loops under docs/tend2: the project loop carries integration and the owner's flagged decisions; twelve children carry the modules (the tilth-core seam, the pure core, SARIF, the check face, three rule loops, guard, harness hooks, scan, calibration, bite, garden fit). The garden law says nothing is built that is not a loop first, and the umbrella map holds fit while this map holds modules. AGENTS.md carries the conventions every worker reads: layout, dependency direction, engineering rules, voice, exit codes, toolchain. CLAUDE.md imports it so both harness files say one thing. scripts/check/run.sh is the evidence runner tend2 verify calls: a check cites its real test file and the runner maps it to the cargo command, so stamps key on test content rather than on a wrapper. plans/tilth-core.plan.json is the hand-authored pleach plan for the first milestone, the tilth-core extraction, which runs against a worktree of the tilth repository rather than this one; the tilth-core loop here records the result. docs/dogfood.md starts the running log of tend2, pleach and umbel experiences the owner asked for. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…d dogfood notes The evidence script runs tilth's CI trio in the extraction worktree and refuses a copied (rather than moved) file, so the tilth-core loop's first check has something the verifier can run. The questions file is for the tend2 agent, as the owner asked; the calls I made without an answer are listed there so they can be overruled. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
plans/weed.plan.json is what tend2 emit-plan produced from docs/tend2 with tend2 as the verify binary, scripts/check/run.sh as the runner, every node cast to claude/opus and audited by codex. plans/weed.wave1.plan.json is the same emission trimmed to core and sarif, the two loops that do not need tilth-core, so they can run while the extraction is conducted in tilth's worktree. schemas/sarif-schema-2.1.0.json is the official OASIS schema the sarif loop validates against, vendored so no test reaches the network. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Both loops build on the crate and the Finding type the core loop creates; without the edge the emitter put them in the first wave beside core, where a worker would have had no crate to build on. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
--strict never escalates warnings; the calibration bar is pooled across repos with per-repo counts shown; the tilth-core extraction is almaty's to implement and land, with weed supplying the surface and the acceptance test. The tilth worktree was cut from a stale local main and has been fast-forwarded to origin/main v0.10.1 before any work landed on it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Codex builds, opencode's free model audits by re-running the verifier; the provider-diversity rule holds either way. The audited variant is the one that runs; the no-audit variant is kept only as the fallback if the free auditor proves unusable. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
source: docs/tend2 goal: A static Rust binary that reads what an agent produced and refuses the growth that should not be there — deleted or weakened tests, skips, stubs, swallowed errors, secrets, guardrail edits, dependency-direction violations — in milliseconds, with zero tokens, every finding as SARIF 2.1.0. `weed check` judges a diff and may block; `weed scan` judges the tree and never blocks; `weed guard` is the law in git through hooks; `weed bite` proves a test fails without its change. For maintainers drowning in agent-authored pull requests who need a deterministic gate before they read, for teams running agents on several harnesses who want one law, and for the garden's own fleets through pleach. receipt-sha256: 49048b94166c07155d8d326ca0ddd4bb42aa966bb0169794200066fbfa5eb404
pleach's smoke gate (tend2 verify, all five checks stamped) passed; the node was quarantined only because the emitted audit command lacked the --runner template, a tend2 emit-plan bug recorded in docs/questions and docs/dogfood. The conductor's own review follows in the next commits. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… config key, layers for D2 Codex's core parsed diffs, classified files and read weed.toml well, but three things could not stand. A Rust file with a #[cfg(test)] module was classified as a test file, so a stub added to its production functions would never have been S1; it is now prod with a has_inline_tests flag for the rules that read tests. The config accepted two spellings for each of the scope, deps and guard keys, which is two homes for one idea; it is now one, and [deps] gained the layers map that maps a layer name to path globs, without which D2 cannot tell which layer a file belongs to. The promised fixture harness was not delivered because a Tried line is not a check; it is now spelled out on check-face, the first loop that needs it. The two checks whose evidence changed were re-stamped by tend2 verify. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
scripts/emit-plan.sh runs tend2 emit-plan with this repo's verifier and runner and appends the runner template to every audit command, which emit-plan omits today. sarif is cast to codex with an opencode audit while the Claude subscription's session window is spent; core is done and no longer emitted. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The subscription changed, so the session-limit workaround (codex building, opencode auditing) is withdrawn and its plan variants removed. opencode is too slow to sit on the audit path. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
source: docs/tend2 goal: A static Rust binary that reads what an agent produced and refuses the growth that should not be there — deleted or weakened tests, skips, stubs, swallowed errors, secrets, guardrail edits, dependency-direction violations — in milliseconds, with zero tokens, every finding as SARIF 2.1.0. `weed check` judges a diff and may block; `weed scan` judges the tree and never blocks; `weed guard` is the law in git through hooks; `weed bite` proves a test fails without its change. For maintainers drowning in agent-authored pull requests who need a deterministic gate before they read, for teams running agents on several harnesses who want one law, and for the garden's own fleets through pleach. receipt-sha256: b8dcd9a1cd4bd17d82db0b58468e4de96423cced5f2273811306835aaea304a3
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Per-tool incidents from the first waves, each with reproduction, cause, cost and the smallest fix visible from here. The running log stays chronological; this is the digest the tool owners can act on. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
source: docs/tend2 goal: A static Rust binary that reads what an agent produced and refuses the growth that should not be there — deleted or weakened tests, skips, stubs, swallowed errors, secrets, guardrail edits, dependency-direction violations — in milliseconds, with zero tokens, every finding as SARIF 2.1.0. `weed check` judges a diff and may block; `weed scan` judges the tree and never blocks; `weed guard` is the law in git through hooks; `weed bite` proves a test fails without its change. For maintainers drowning in agent-authored pull requests who need a deterministic gate before they read, for teams running agents on several harnesses who want one law, and for the garden's own fleets through pleach. receipt-sha256: 7da165100c5a813da8ec53fed29bc7f2f617c42e686e4e1e4e3ae0c90fa82c21
--scope had become a filter that dropped out-of-scope files from the judgement; the brief's X2 rule needs the opposite, every file judged and the ones outside the scope reported. My loop wording caused it. Trailers were read from git's COMMIT_EDITMSG, which at pre-commit time still holds the previous commit's message and lingers after it, so a Weed-allow could have silenced an unrelated later change; a pending message now arrives only through --message-file, and trailers otherwise count on the commits of a --base range. Under --strict a suppressed finding keeps its suppressions entry and gets its level back: reported, not honoured. The glob matcher gets its own test, since the scope test no longer exercises it. The checks whose evidence changed were re-stamped by tend2 verify on both the check-face and sarif loops. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The hooks refuse whatever weed check --strict blocks, and G1 blocks today, so their mechanism can be proven now and covers T1 the day it lands. garden-fit moves behind guard and hooks because SKILL.md must name every face the binary prints; the calibration metric's run stays calibration's check. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
source: docs/tend2 goal: A static Rust binary that reads what an agent produced and refuses the growth that should not be there — deleted or weakened tests, skips, stubs, swallowed errors, secrets, guardrail edits, dependency-direction violations — in milliseconds, with zero tokens, every finding as SARIF 2.1.0. `weed check` judges a diff and may block; `weed scan` judges the tree and never blocks; `weed guard` is the law in git through hooks; `weed bite` proves a test fails without its change. For maintainers drowning in agent-authored pull requests who need a deterministic gate before they read, for teams running agents on several harnesses who want one law, and for the garden's own fleets through pleach. receipt-sha256: 2db31889ebae8a4b2168522d0d8ba15f664bee94b3a498c6fc1c7b5f3b6c625f
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pleach verified it (five stamps, codex audit green) and published node/guard; pleach land refused the merge because the worker and the conductor had both appended to docs/dogfood.md, so the merge is by hand with both sides kept. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…learns what blocked it The hooks worker wrote BLOCKED.md and pleach's scoped staging of an ignored path failed catastrophically, taking the tree and the reason with it. The file is no longer ignored. Workers now write dogfood notes to docs/dogfood/<loop>.md so landings stop conflicting on the running log. The Gemini proof is a human check until the owner signs in, and the loop records that a nested Claude Code needs CLAUDECODE unset. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…hand pleach refused the node at its deletion gate: the ledger shrank by 327 lines, the entries of commits no longer blocked on the sharpened T1, and the worker did not restate the shrink. Reviewed and landed: 23 blocked of 635, 7 false positives under the finding's own sentence, 1.10 percent pooled and the same floor; the blind re-grade re-run on a fresh seed with forty real sessions agrees on 14 of 20 blocked commits and 20 of 20 recall cases, so the verdict stays qualified and says why. Both loops re-verified on the merged tree with every check stamped. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
audit-fairness.sh had stamped it without testing it. packet-cache-free.sh derives the packets from an empty cache and from the machine's and five T6 recall packets differ, so the claim is open again. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Gemini CLI's personal sign-in is retired and Antigravity has no hook surface; the Claude Code proof and the Codex note are enough for now. The hook's shapes stay proven by their suite. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
source: docs/tend2#calibration-audit goal: A static Rust binary that reads what an agent produced and refuses the growth that should not be there, deleted or weakened tests, skips, stubs, swallowed errors, secrets, guardrail edits, dependency-direction violations, in milliseconds, with zero tokens, every finding as SARIF 2.1.0. `weed check` judges a diff and may block; `weed scan` judges the tree and never blocks; `weed guard` is the law in git through hooks; `weed bite` proves a test fails without its change. For maintainers drowning in agent-authored pull requests who need a deterministic gate before they read, for teams running agents on several harnesses who want one law, and for the garden's own fleets through pleach. receipt-sha256: 69041fef934d3e912591f71f98f0cf5593c99a3ce1fb14458bdb4a108a684ee6
The audit node re-derived the packets without a cache and re-ran the blind sessions: 12 of 20 blocked commits, 19 of 20 recall cases, so the verdict stays qualified and the report says so. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
cape-town ruled that a blind reader can judge whether a rule's claim is true of the change and nothing else, so the audited agreement on a blocked commit is claim-true against claim-false and acceptable is a human label the audit never counts; a sighted re-grade is recorded beside the verdict and never pooled into it. Recorded in both audit files with the date before recomputing. On the responses already kept the blind re-grade agrees on 20 of 20 blocked commits and 19 of 20 recall cases, the three ledger calls the ruling makes claim-true are redone with the reason, and the report reads weed ships as a gate. CI fetches the whole history because the self-check judges the tree against its root commit. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
cape-town asked that the false-positive count and share under the classes before the 2026-09-06 ruling stay printed beside the count and share under it, so a reader sees a corrected question and not a moved goalpost. The record is docs/calibration/ruling-2026-09-06.toml, the generator prints it beside the floor and never types it, and scripts/check/ruling-record.sh holds the report to it. The wording probes now write blind audits, the only kind that counts, and the fairness evidence reads the bar off the audit instead of demanding the untrusted sentence unconditionally. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The budget tests built the release binary inside the debug job just to time it, so the same binary was timed on two shared runners and the slower one failed the build at 2131 ms against 2000. The budget is the spec and stays; it is measured in the release job the workflow already runs for it, and the worst case itself gets faster on the map. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
source: docs/tend2#rules-tests goal: A static Rust binary that reads what an agent produced and refuses the growth that should not be there, deleted or weakened tests, skips, stubs, swallowed errors, secrets, guardrail edits, dependency-direction violations, in milliseconds, with zero tokens, every finding as SARIF 2.1.0. `weed check` judges a diff and may block; `weed scan` judges the tree and never blocks; `weed guard` is the law in git through hooks; `weed bite` proves a test fails without its change. For maintainers drowning in agent-authored pull requests who need a deterministic gate before they read, for teams running agents on several harnesses who want one law, and for the garden's own fleets through pleach. receipt-sha256: 3a4d2da5c8e2bb83d79a9bea303b610a6bc394450fab6e47e21f16c794eaf0c2
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The T2 fix took three relocations out of the block set, 23 to 20, so the seeded samples moved; both re-grades were re-taken by script on a fresh seed, blind 19 of 20 and 20 of 20, sighted 40 of 40, and the report regenerated: weed ships as a gate, 4 false positives of 20 blocked, 0.63 percent, both sides of the ruling printed beside it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
source: docs/tend2#weed goal: A static Rust binary that reads what an agent produced and refuses the growth that should not be there, deleted or weakened tests, skips, stubs, swallowed errors, secrets, guardrail edits, dependency-direction violations, in milliseconds, with zero tokens, every finding as SARIF 2.1.0. `weed check` judges a diff and may block; `weed scan` judges the tree and never blocks; `weed guard` is the law in git through hooks; `weed bite` proves a test fails without its change. For maintainers drowning in agent-authored pull requests who need a deterministic gate before they read, for teams running agents on several harnesses who want one law, and for the garden's own fleets through pleach. receipt-sha256: 4b74e61d4c1c4d84a01061209f635bfb5bd330945f95e1019b9e174c8712f35e
pleach refused the merge on t2.rs, where the moved-assertion logic and the once-built mask met. Kept both. The worst case is 650 ms here as a median of five, down from 1.2 s, so the two-second budget has room on a GitHub-hosted runner. The runner had been building the latency test in debug, where its timing tests are compiled out, and stamping the claim on the four tests that were left; it now sends that file to the release profile, and question 13 for tend2 asks the verifier to notice a file that ran no tests. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
calibrate.sh writes a fresh report to a scratch path and compares it with the tree; the record had been printed only when no output path was given, so the two differed by one sentence. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The runner showed a step change, three runs at 2.5 s and then 1.3 s, with one warm-up run, and even here the first run of any case costs twice the settled time. The measurement now warms up until three runs agree within a tenth, bounded at eight, before it times five. The budget is unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…tions weed: the judge of the diff
Bumps [sha2](https://github.com/RustCrypto/hashes) from 0.10.9 to 0.11.0. - [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0) --- updated-dependencies: - dependency-name: sha2 dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
jahala
force-pushed
the
dependabot/cargo/sha2-0.11.0
branch
from
September 6, 2026 18:20
d0a465b to
8b02edc
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps sha2 from 0.10.9 to 0.11.0.
Commits
ffe0939Release sha2 0.11.0 (#806)8991b65Use the standard order of the[package]section fields (#807)3d2bc57sha2: refactor backends (#802)faa55fbsha3: bumpkeccakto v0.2 (#803)d3e6489sha3 v0.11.0-rc.9 (#801)bbf6f51sha2: tweak backend docs (#800)155dbbfsha3: add default value for theDSgeneric parameter onTurboShake128/256...ed514f2Use published version ofkeccakv0.2 (#799)702bcd8Migrate to closure-basedkeccak(#796)827c043sha3 v0.11.0-rc.8 (#794)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)