ci: align the zero-leak check to the charter symbol set#449
Open
mfw78 wants to merge 1 commit into
Open
Conversation
Scan the runtime sources for the charter set only (nexum:intent, value-flow, VenueAdapter, synthesize_venue, nexum:adapter, PoolRouter), dropping the loose word-shape sweep that false-flagged the opaque extension-map fixtures; keep the crate-graph and WIT-leaf checks, and state the invariant in the nexum-runtime crate charter. The CI job stays advisory until the physical repo cut.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Narrows the venue-agnostic CI scan from a broad venue-vocabulary regex to the curated charter symbol set (
nexum:intent|value-flow|VenueAdapter|synthesize_venue|nexum:adapter|PoolRouter), scopes it tocrates/nexum-runtime/src, and documents the zero-leak charter in the crate's top-level rustdoc.Why
The old regex over-matched (
Cow,intentional, etc. needed manual carve-outs) and scanned the whole crate directory instead of just sources. A curated symbol set tied to the actual forbidden names keeps the scan precise and stops opaque extension payloads from false-flagging, per the M2 zero-leak invariant.Closes #384
Testing
./scripts/check-venue-agnostic.shpasses locally against the current tree.AI Assistance
Implemented with Claude Code assistance.