FormikaDesk/rada-fm

Review signals: 1 connection review, 1 hardcoded secret, 1 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; package managers (rustup-init) downloaded dependencies over HTTPS; resolver address lookups that send no data; wrote only to its own open file handles.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 8 distinct locations. 2 attributed processes.

Gitleaks found a possible hardcoded secret; value withheld. crates/core/src/platform/linux/devices.rs

OSV reports a known vulnerability in this dependency version. bincode

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The application is written in Rust.: Real input produced the expected result: "title": "OpRequest"

  Source: rada is written in Rust and driven by keyboard or mouse.

  Input: rada --schema request

  Expected: JSON schema titled OpRequest

  Command: <guest-path> --schema request

  Observed: "title": "OpRequest", "description": "A request to do something to files. All paths must be absolute.", "oneOf": [ { "description": "Copy items into a folder. Symlinks are copied as symlinks.", "type": "object", "properties": { "conflict": { "description": "What to do when a name already exists in the destination.", "$ref": "#/$defs/ConflictPolicy", "default": "skip" }, "destination": { "type": "string" }, "op": { "type": "string", "const": "copy" }, "so

Examples

• Print JSON Schema for requests: command completed successfully

  Source: README.md, Requests as data

  Input: request schema

  Expected: schema output with OpRequest title

  Command: <guest-path> --schema request

  Observed: { "type": "string", "const": "set" }, "tags": { "type": "array", "items": { "$ref": "#/$defs/Tag" } } }, "required": [ "how", "tags" ] } ] }, "TagColor": { "description": "The Finder's colours, as the menu lists them.", "type": "string", "enum": [ "red", "orange", "yellow", "green", "blue", "purple", "gray" ] } } }

Local or hosted: local

Build rada and print its request JSON Schema

pwd; id -u; rg --files -g 'README*' -g 'AGENTS.md' -g 'pyproject.toml' -g 'package.json' -g 'Makefile' -g '*.yml' -g '*.yaml' | head -80; python3 --version; git status --short --branch
ls -la; find . -maxdepth 3 -type f | head -80; cat README.md
rustc --version; cargo --version; cat docs/development.md; cat Makefile; cat Cargo.toml; sed -n '1,220p' docs/usage.md
command -v rustup || true; ls -la ~/.cargo/bin 2>/dev/null | head; sudo -n true; echo sudo_status:$?
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.90.0
export PATH=/var<guest-path>; cargo build -p rada --locked
sed -n '1,180p' crates/rada/src/main.rs
export PATH=/var<guest-path>; target/debug/rada --schema request
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","--schema","request"],"cwd":"<guest-path>","expected_text":"\"title\": \"OpRequest\""}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The request schema describes supported file operations.","source":"rada --schema request            # print the JSON Schema (also: plan)","input":"rada --schema request","expected":"JSON schema titled OpRequest","probe_kind":"cli","argv":["<guest-path>","--schema","request"],"expected_text":"\"title\": \"OpRequest\"","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Print JSON Schema for requests","source":"README.md, Requests as data","input":"request schema","expected":"schema output with OpRequest title","argv":["<guest-path>","--schema","request"],"cwd":"<guest-path>","expected_text":"\"title\": \"OpRequest\""}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README, usage, and binary entry point; rada performs user-triggered file operations and exposes no scheduling or recurring cycle trigger.","checks":[]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"JSON schema request output is available.","source":"rada --schema request            # print the JSON Schema (also: plan)","input":"rada --schema request","expected":"JSON schema titled OpRequest","probe_kind":"cli","argv":["<guest-path>","--schema","request"],"expected_text":"\"title\": \"OpRequest\"","cwd":"<guest-path>"}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat .coldpass/claims.json;
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The application is written in Rust.","source":"rada is written in Rust and driven by keyboard or mouse.","input":"rada --schema request","expected":"JSON schema titled OpRequest","probe_kind":"cli","argv":["<guest-path>","--schema","request"],"expected_text":"\"title\": \"OpRequest\"","cwd":"<guest-path>"}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Build rada and print its request JSON Schema","operation_scope":"Local Linux build using the documented Rust source workflow; Rust 1.90 installed in the guest","steps":["Installed Rust 1.90 with the README-referenced rustup installer.","Ran cargo build -p rada --locked.","Ran target/debug/rada --schema request; it printed the OpRequest JSON Schema.","Validated and replayed probe, claim, example, and cycle evidence successfully."],"deviations":["Initial system Rust was 1.75, below required 1.90; installed supported Rust 1.90 in the guest."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF