feat!: retire the bundled cartridges/ tree — boj-server-cartridges registry is canonical

[hyperpolymath]

PR A of the BoJ 0.16 campaign

Executes the June cartridge-extraction endgame (handover cartridge-05): deletes the bundled 128-cartridge tree (1,721 files, −190k lines). Prereqs long satisfied: #158 (catalog fallback chain) merged 2026-05-26 and burned in; scripts/fetch-cartridges.sh already supplies the flat-cache fetch from the canonical registry (release.yml has used it all along — untouched here).

What changed

• E2E now runs against a tracked fixture catalog (tests/fixtures/cartridges): 22 builtin manifests + buildable feedback-mcp FFI + local-coord-mcp manifest for the bridge contract test.
• nickel-validator / generate-offline-menu resolve through BOJ_CARTRIDGES_PATH (flat cache), old in-repo path kept as graceful fallback.
• zig-test gates the core ffi/zig tree only; per-cartridge FFI gating lives in boj-server-cartridges.
• abi-drift + lsp-dap-bsp gates retired via run=false in the detector — skipped jobs report success, so no phantom required contexts. Their subject matter (per-cartridge iseriser drift, LSP/DAP/BSP conformance) should be ported to the cartridges repo, then these workflows + required contexts can be deleted (follow-up).
• proofs/truthfulness/e2e/fuzz filters narrowed; Justfile fmt/fmt-check/build-watch fixed (find over the missing dir hard-fails); status/README text repointed at the registry; CLAUDE.md TS-exemption table updated (the 6 exempted adapters left with the tree).
• version 0.4.7 → 0.5.0.

Verified locally

• All 26 workflows YAML-parse; Justfile parses.
• Fixture feedback-mcp FFI: zig build test 15/15 green on CI's Zig 0.15.2; .so lands at the manifest's so_path.
• Bridge contract: fixture manifest's 23/23 coord_* tools exposed by buildToolList().

⚠ Operator action before disk cleanup

The live local-coord-mcp.service systemd unit runs the adapter built inside the (now untracked) cartridges/ leftovers, and the Nickel contracts fallback also resolves there. Migrate the unit + set BOJ_CARTRIDGES_PATH (via scripts/fetch-cartridges.sh) before deleting the leftover directory. This PR deliberately does not touch disk state outside git.

Next in the campaign: PR B ports ffi/zig + the canonical shim to Zig 0.16.0.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 110 issues detected

Severity	Count
🔴 Critical	7
🟠 High	42
🟡 Medium	61

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in build.yml",
    "type": "missing_timeout_minutes",
    "file": "build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in pages-deploy.yml",
    "type": "missing_timeout_minutes",
    "file": "pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "believe_me undermines formal verification (4 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/boj-server/boj-server/src/abi/Boj/SafetyLemmas.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/nickel-validator.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "eval() -- arbitrary code execution (2 occurrences, CWE-94)",
    "type": "js_eval",
    "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/security.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Deno -A grants all permissions -- use specific --allow-* flags (1 occurrences, CWE-250)",
    "type": "js_deno_all_perms",
    "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/main.d.ts",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Zig @ptrCast performs unchecked pointer type conversion (1 occurrences, CWE-704)",
    "type": "zig_ptr_cast",
    "file": "/home/runner/work/boj-server/boj-server/ffi/zig/src/cartridge_shim.zig",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[github-actions]

🏁 path-claims bench

Commit 7a452b5

Numbers

path-claims bench  (node v22.23.1)

  scenario                                              iters       ms        ns/op          ops/s
  --------------------------------------------------------------------------------------------------------------
  register: 10 active claims, 3 new paths               50000 iters    208 ms      4.18 µs/op    239.3k ops/s
  register: 100 active claims, 3 new paths              20000 iters    343 ms     17.15 µs/op     58.3k ops/s
  register: 1000 active claims, 3 new paths              5000 iters    947 ms    189.55 µs/op      5.3k ops/s
  register: 100 active claims, 20 new paths              5000 iters    363 ms     72.75 µs/op     13.7k ops/s

  pathsOverlap: deep diverge at segment 4             1000000 iters    156 ms     156.6 ns/op     6.39M ops/s
  pathsOverlap: short prefix match                    1000000 iters    135 ms     135.2 ns/op     7.40M ops/s

  refresh (existing claim)                             100000 iters     11 ms     117.4 ns/op     8.52M ops/s
  list (100 active claims)                              50000 iters    289 ms      5.80 µs/op    172.4k ops/s

  (Bench numbers depend on host; use deltas across commits, not absolute values.)

Host-dependent — compare deltas across commits, not absolute values.

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved 1 resolved / 1 findings

Retires the bundled cartridges tree and bumps version to 0.5.0, establishing boj-server-cartridges as the canonical registry. Consider updating the generate-offline-menu usage comment to specify Deno instead of node.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

✅ 1 resolved

✅ Quality: generate-offline-menu usage says node but code requires Deno

📄 mcp-bridge/lib/generate-offline-menu.js:7 📄 mcp-bridge/lib/generate-offline-menu.js:21-22 📄 mcp-bridge/lib/generate-offline-menu.js:37
The updated usage comment still instructs running via node mcp-bridge/lib/generate-offline-menu.js, but the script now depends on Deno.env.get("BOJ_CARTRIDGES_PATH") (line 22) in addition to the existing Deno.exit(1) (line 37). Run under Node it throws ReferenceError: Deno is not defined; only the deno run shebang works. Fix the usage line to invoke deno (or read the env via process.env/node:process if Node support is intended) so the documented command actually runs.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

---

Important

Your trial ends in 6 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)

✅ All code review findings resolved.

_{Configure merge blocking}