Ataraxy-Labs/weave

Review signals: 1 connection review, 17 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; package managers (rustup-init) downloaded dependencies over HTTPS; resolver address lookups that send no data; wrote only to its own open file handles.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 8 distinct locations. 2 attributed processes.

OSV reports a known vulnerability in this dependency version. 7 distinct locations. 17 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Configure Git to use weave for supported file types.: Real input produced the expected result: Configured git merge driver

  Source: This configures Git to use weave for all supported file types.

  Input: weave setup

  Expected: Configured git merge driver

  Command: <guest-path> setup --local

  Observed: Configured git merge driver: <guest-path> %O %A %B %L %P ✓ .git/info/attributes already configured Done! Weave is ready. Merge conflicts will now be resolved at the entity level.

Examples

• Configure Git merge driver: command completed successfully

  Source: README.md Setup

  Input: weave setup

  Expected: Git is configured to use weave

  Command: <guest-path> setup --local

  Observed: ✓ Configured git merge driver: <guest-path> %O %A %B %L %P ✓ .git/info/attributes already configured Done! Weave is ready. Merge conflicts will now be resolved at the entity level.

Local or hosted: local

weave setup --local

pwd && rg --files -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'Makefile' -g 'Dockerfile*' -g 'AGENTS.md' -g '.github/**' | head -80 && sed -n '1,240p' README.md && python3 --version && id -u
sed -n '240,520p' README.md; find . -maxdepth 3 -type f | head -80; command -v cargo; cargo --version; uname -a
rustc --version; cargo --version; cat package.json; sed -n '1,180p' .github/workflows/ci.yml; git status --short
sudo apt-get -o DPkg::Lock::Timeout=300 update && sudo apt-get -o DPkg::Lock::Timeout=300 install -y rustc cargo git build-essential pkg-config libssl-dev
cargo install --path crates/weave-cli --root <guest-path> --locked
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
export PATH=/var<guest-path>; cargo install --path crates/weave-cli --root <guest-path> --locked
export PATH=/var<guest-path>; cargo install --path crates/weave-driver --root <guest-path> --locked
git init -q; git config user.name coldpass; git config user.email <email>; git add README.md; git commit -qm init; PATH=<guest-path> weave setup; git status --short; git config --get merge.weave.driver
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","setup","--local"],"cwd":"<guest-path>","expected_text":"Configured git merge driver"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Configure Git to use weave for supported file types.","source":"This configures Git to use weave for all supported file types.","input":"weave setup","expected":"Configured git merge driver","probe_kind":"cli","argv":["<guest-path>","setup","--local"],"expected_text":"Configured git merge driver","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Configure Git merge driver","source":"README.md Setup","input":"weave setup","expected":"Git is configured to use weave","argv":["<guest-path>","setup","--local"],"cwd":"<guest-path>","expected_text":"Configured git merge driver"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README commands and entry points; weave runs on explicit Git merge/setup commands and documents no scheduler or recurring cycle.","checks":[]}
EOF

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"weave setup --local","operation_scope":"Configure Git's local merge driver and supported file type rules; requires current Rust stable for source installation.","steps":["Installed system build prerequisites with apt-get.","Updated Rust using the supplied rustup installer after system Rust 1.75 could not parse lockfile v4.","cargo install --path crates/weave-cli --root <guest-path> --locked","cargo install --path crates/weave-driver --root <guest-path> --locked","Ran <guest-path> setup in the initialized repository.","Validated and replayed probe, README claim, example, and cycle record successfully."],"deviations":["Initial cargo install with system Rust 1.75 failed: lock file version 4 requires -Znext-lockfile-bump; installed stable Rust 1.99.1 using rustup.","README's bare weave setup was exercised in the repository; replay uses documented weave setup --local to provide isolated per-repository configuration."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF