flint-crew/jolly-roger

Review signals: 134 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. 10 distinct locations. 134 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• jolly-roger flags visibilities contaminated by the Sun on a measurement set: Real input produced the expected result: Finished processing ms_path=PosixPath('SB39400.RACS_0635-31.beam0.small.ms')

  Source: This package attempts to flag or modify visibilities that are contaminated by the Sun (or potentially some other bright source).

  Input: SB39400.RACS_0635-31.beam0.small.ms (test MS shipped in the package)

  Expected: flagger processes the MS and reports completion

  Command: <guest-path> SB39400.RACS_0635-31.beam0.small.ms --dry-run

  Observed: Finished processing ms_path=PosixPath('SB39400.RACS_0635-31.beam0.small.ms')

• The second mode applies a notch filter in delay space via jolly_tractor: Real input produced the expected result: Delay notch: removes about 10 ns of delay around each object.

  Source: The second mode is the application of a notch filter in delay space, where the nulling is applied to the expected delay of the Sun for each timestep and baseline.

  Input: SB39400.RACS_0635-31.beam0.small.ms with tukey subcommand, dry run

  Expected: tractor reports its delay notch settings without modifying visibilities

  Command: <guest-path> tukey SB39400.RACS_0635-31.beam0.small.ms --dry-run

  Observed: Delay notch: removes about 10 ns of delay around each object. Each channel can pick up at most 1% of the value of any other single channel, and channels up to about 100 MHz apart influence each other. INFO 2026-10-27 21:33:16.049: Spectral-line impact of nulling sun (Gaussian line profiles): lines narrower than one channel lose at most 1% of their peak brightness. No visibilities were modified.

Examples

• Documented flagger example with horizon and scale limits: command completed successfully

  Source: docs/flagging.md

  Input: SB39400.RACS_0635-31.beam0.small.ms --min-horizon-limit-deg -2 --max-horizon-limit-deg 30 --min-scale-deg 0.075 --dry-run

  Expected: flagger finishes processing the MS

  Command: <guest-path> SB39400.RACS_0635-31.beam0.small.ms --min-horizon-limit-deg -2 --max-horizon-limit-deg 30 --min-scale-deg 0.075 --dry-run

  Observed: 86.81% & elev. 100.00% = Applied 86.81% INFO 2026-10-27 21:33:20.429: ( 27, 30): uvw 100.00% & elev. 100.00% = Applied 100.00% INFO 2026-10-27 21:33:20.429: ( 28, 29): uvw 100.00% & elev. 100.00% = Applied 100.00% INFO 2026-10-27 21:33:20.430: ( 28, 34): uvw 79.28% & elev. 100.00% = Applied 79.28% INFO 2026-10-27 21:33:20.430: ( 32, 33): uvw 10.76% & elev. 100.00% = Applied 10.76% INFO 2026-10-27 21:33:20.430: INFO 2026-10-27 21:33:20.430: Finished processing ms_path=PosixPath('SB39400.RACS_0635-31.beam0.small.ms')

• Repository test suite run via noxfile tests session: command completed successfully

  Source: noxfile.py

  Input: pytest

  Expected: all tests pass

  Command: <guest-path> -q -p no:cacheprovider

  Observed: ........................................................................ [ 71%] ............................. [100%] Learn more about nbmake at https://github.com/treebeardtech/nbmake 101 passed in 36.35s

Local or hosted: local

Install jolly-roger from the pinned source and run the flagger (jolly_flagger) and nulling filter (jolly_tractor tukey) on a measurement set, plus the repository pytest suite

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md | head -200
ls /inputs 2>/dev/null; ls <guest-path>; echo CDP=$CDP_URL $<env-var>
cd <guest-path> && grep -n -i "requires-python\|scripts" -A3 pyproject.toml | head -30; ls docs tests; ls .coldpass; python3 -m venv --help >/dev/null 2>&1 && echo venv_ok || echo no_venv
cd <guest-path> && mkdir -p <guest-path> && python3 -m venv <guest-path> && <guest-path> install --quiet --upgrade pip && cd <guest-path> && <guest-path> install . 2>&1 | tail -5; echo rc=$?; ls <guest-path> | grep jolly
cd <guest-path> && git init -q && git remote add origin https://github.com/flint-crew/jolly-roger && git fetch --depth 1 origin 3d4727bec9108fd4ebb4a1a4c3cbedde2db37810 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; <guest-path> install . 2>&1 | tail -3; ls <guest-path> | grep jolly
cd <guest-path> && <guest-path> --help; echo rc=$?; <guest-path> --help; echo rc=$?
cd <guest-path> && cat docs/flagging.md | head -120; echo ----; cat docs/nulling.md | head -120
cd <guest-path> && cat tests/conftest.py | head -120; echo ----; grep -rn "ms\b\|\.ms\"" tests/test_package.py | head; ls <guest-path>; cat noxfile.py | head -60; ls .github/workflows; 
cd <guest-path> && Z=$(<guest-path> -I -c "import importlib.resources as r; print(r.files('jolly_roger.data').joinpath('tests','SB39400.RACS_0635-31.beam0.small.ms.zip'))") && echo $Z && ls -la "$Z" && mkdir -p <guest-path> && cd <guest-path> && <guest-path> -I -c "import shutil,sys; shutil.unpack_archive(sys.argv[1], sys.argv[2])" "$Z" <guest-path> && find <guest-path> -maxdepth 2 | head
cd <guest-path> && grep -n "test = \|\[dependency-groups\]" -A12 pyproject.toml | head -40
mkdir -p <guest-path> && cp -r <guest-path> <guest-path> && cd <guest-path> && <guest-path> SB39400.RACS_0635-31.beam0.small.ms --dry-run 2>&1 | grep -v Warning | tail -30; echo rc=${PIPESTATUS[0]}
cd <guest-path> && <guest-path> tukey --help 2>/dev/null | head -80
cd <guest-path> && <guest-path> install -q pytest pytest-cov nbmake 2>&1 | tail -3; echo rc=$?
cd <guest-path> && <guest-path> tukey SB39400.RACS_0635-31.beam0.small.ms --dry-run 2>&1 | grep -v -i warning | tail -15; echo rc=${PIPESTATUS[0]}
cd <guest-path> && timeout 1500 <guest-path> -q -p no:cacheprovider 2>&1 | tail -25; echo rc=${PIPESTATUS[0]}
cd <guest-path> && grep -rn -i "while True\|sleep(\|cron\|schedul\|--once\|--now\|webhook\|daemon" jolly_roger/*.py | head; echo rc=$?; grep -n "def cli\|__main__" jolly_roger/flagger.py jolly_roger/tractor.py
cd <guest-path> && J=<guest-path> && MS=SB39400.RACS_0635-31.beam0.small.ms && cat > probe.json <<EOF
{"kind":"cli","argv":["$J/jolly_flagger","$MS","--dry-run"],"cwd":"<guest-path>","expected_text":"Finished processing ms_path=PosixPath('$MS')"}
EOF
cat > claims.json <<EOF
[
{"kind":"claim","claim":"The flagger CLI help is documented as jolly_flagger --help","source":"jolly_flagger --help","input":"--help","expected":"flagger usage text","probe_kind":"cli","argv":["$J/jolly_flagger","--help"],"expected_text":"Flag a measurement set based on properties of the Sun","cwd":"<guest-path>"},
{"kind":"claim","claim":"The tractor CLI help is documented as jolly_tractor --help","source":"For the nulling filter run:","input":"--help","expected":"tractor usage text","probe_kind":"cli","argv":["$J/jolly_tractor","--help"],"expected_text":"Run the Jolly Roger Tractor","cwd":"<guest-path>"},
{"kind":"claim","claim":"jolly-roger flags visibilities contaminated by the Sun on a measurement set","source":"This package attempts to flag or modify visibilities that are contaminated by the Sun (or potentially some other bright source).","input":"$MS (test MS shipped in the package)","expected":"flagger processes the MS and reports completion","probe_kind":"cli","argv":["$J/jolly_flagger","$MS","--dry-run"],"expected_text":"Finished processing ms_path=PosixPath('$MS')","cwd":"<guest-path>"},
{"kind":"claim","claim":"The nulling filter is accessed through jolly_tractor","source":"The nulling approach can be accessed through \`jolly_tractor\`.","input":"$MS with tukey subcommand, dry run","expected":"tractor reports its delay notch settings without modifying visibilities","probe_kind":"cli","argv":["$J/jolly_tractor","tukey","$MS","--dry-run"],"expected_text":"Delay notch: removes about 10 ns of delay around each object.","cwd":"<guest-path>"}
]
EOF
cat > examples.json <<EOF
[
{"kind":"example","claim":"Documented flagger example with horizon and scale limits","source":"docs/flagging.md","input":"$MS --min-horizon-limit-deg -2 --max-horizon-limit-deg 30 --min-scale-deg 0.075 --dry-run","expected":"flagger finishes processing the MS","argv":["$J/jolly_flagger","$MS","--min-horizon-limit-deg","-2","--max-horizon-limit-deg","30","--min-scale-deg","0.075","--dry-run"],"cwd":"<guest-path>","expected_text":"Finished processing ms_path=PosixPath('$MS')"},
{"kind":"example","claim":"Repository test suite run via noxfile tests session","source":"noxfile.py","input":"pytest","expected":"all tests pass","argv":["$J/pytest","-q","-p","no:cacheprovider"],"cwd":"<guest-path>","expected_text":"101 passed"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points jolly_flagger and jolly_tractor (jolly_roger/flagger.py cli, jolly_roger/tractor.py cli) are one-shot CLIs with no scheduler, loop, cron, webhook or --once/--now trigger; grep found none.","checks":[]}
EOF
for f in probe.json claims.json examples.json cycles.json; do <guest-path> -I -m json.tool $f >/dev/null && echo "$f ok"; done; cat probe.json
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install jolly-roger from the pinned source and run the flagger (jolly_flagger) and nulling filter (jolly_tractor tukey) on a measurement set, plus the repository pytest suite","operation_scope":"Linux guest, Python 3.12.3, venv at <guest-path>; README requires Python >=3.11 (pyproject). Test MS shipped inside the package (SB39400.RACS_0635-31.beam0.small.ms.zip) used as input, copied to <guest-path>","steps":["git init; git remote add origin https://github.com/flint-crew/jolly-roger; git fetch --depth 1 origin 3d4727bec9108fd4ebb4a1a4c3cbedde2db37810; git reset --mixed FETCH_HEAD","python3 -m venv <guest-path>; <guest-path> install .","<guest-path> --help","<guest-path> --help","<guest-path> SB39400.RACS_0635-31.beam0.small.ms --dry-run","<guest-path> tukey SB39400.RACS_0635-31.beam0.small.ms --dry-run","<guest-path> (after pip install pytest pytest-cov nbmake)"],"deviations":["pip install . failed first with a metadata-generation error because the snapshot had no Git metadata (setuptools_scm); fixed by the Git init/fetch/reset steps given in the task, then install succeeded.","Test dependencies were installed with pip (pytest, pytest-cov, nbmake) instead of nox/uv, since nox is not required for the test run; pytest ran directly with pyproject's configuration (101 passed).","README's example dataset (scienceData.EMU_1141-55...ms) is not available in the guest; used the test MS shipped in the package instead, and ran with --dry-run so the input is not modified.","Tractor and flagger were run with --dry-run only; non-dry runs write FLAG/CORRECTED_DATA columns and were not exercised in replay."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for this run. Optional: the README could note that pip install from a source checkout needs Git metadata for version detection."}
EOF
<guest-path> -I -c "import json;json.load(open('report.json'));print('report ok')"; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo rc=${PIPESTATUS[0]}
cd <guest-path> && grep -n "nulling approach" README.md docs/*.md | head -3; python3 -c "import json;print(repr(json.load(open('.coldpass/claims.json'))[3]['source']))"; grep -c "" README.md; grep -n "nulling approach\|nulling filter run" README.md
cd <guest-path> && grep -n "second mode" README.md | cut -c1-400
cd <guest-path> && <guest-path> -I - <<'PY'
import json
c = json.load(open('claims.json'))
c[3]['claim'] = "The second mode applies a notch filter in delay space via jolly_tractor"
c[3]['source'] = "The second mode is the application of a notch filter in delay space, where the nulling is applied to the expected delay of the Sun for each timestep and baseline."
json.dump(c, open('claims.json','w'), indent=1)
print('ok')
PY
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo rc=${PIPESTATUS[0]}
cd <guest-path> && <guest-path> -I - <<'PY'
import json
c = json.load(open('claims.json'))
c = [x for x in c if 'help' not in x['claim'].lower()]
json.dump(c, open('claims.json','w'), indent=1)
print(len(c), [x['claim'] for x in c])
PY
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; <guest-path> -I -c "
import json,sys
d=json.load(open('<guest-path>'))
print('valid:',d.get('valid'),'problems:',d.get('problems'))
r=d.get('replay',{})
print('replay status:',r.get('status'))
det=r.get('details',{})
print('evidence_strength:',det.get('evidence_strength'))
for c in det.get('claims',[]): print('claim', c['verdict'], c['claim'][:60])
for c in det.get('example_checks',[]): print('example', c['verdict'], c['claim'][:60])
" 2>&1 | tail -20