fzaidi-dai/RAG_Wright

Review signals: 185 known vulnerability. 5 static matches retained as context.

OSV reports a known vulnerability in this dependency version. 27 distinct locations. 185 findings.

5 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Python dependency management uses uv.: Real input produced the expected result: reference pack loaded

  Source: Python with uv (never bare `python`/`pip`):

  Input: uv sync

  Expected: dependency environment installed

  Command: uv run python -c 'from rag_wright.api import load_reference_pack; load_reference_pack(); print('"'"'reference pack loaded'"'"')'

  Observed: reference pack loaded

Examples

• Load the bundled reference pack as documented.: command completed successfully

  Source: docs/quickstart.md, 1. Opt into a capability catalog

  Input: load_reference_pack()

  Expected: reference pack loads

  Command: uv run python -c 'from rag_wright.api import load_reference_pack; load_reference_pack(); print('"'"'reference pack loaded'"'"')'

  Observed: reference pack loaded

Local or hosted: local

README quickstart and reference pack load

pwd; ls -la; rg --files -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'requirements*.txt' -g 'uv.lock' -g '*.yml' -g '*.yaml' | head -80
cat README.md; python3 --version; python3 -m pip --version; cat pyproject.toml | head -100
cat docs/quickstart.md; cat docs/installation.md | head -100; command -v uv || true; ls .coldpass
cd <guest-path> && uv --version && uv sync
sed -n '1,120p' examples/quickstart.py; find <guest-path> -maxdepth 2 -type f -name '*preflight*' -o -name check.py
mkdir -p .coldpass; uv run python -c 'from rag_wright.api import load_reference_pack; load_reference_pack(); from rag_wright.api import __all__; print("reference pack loaded")'
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["uv","run","python","-c","from rag_wright.api import load_reference_pack; load_reference_pack(); print('reference pack loaded')"],"cwd":"<guest-path>","expected_text":"reference pack loaded"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The bundled reference pack registers its subgraphs for the quickstart.","source":"The quickstart opts into the bundled contract/compliance reference pack","input":"load_reference_pack()","expected":"reference pack loaded","probe_kind":"cli","argv":["uv","run","python","-c","from rag_wright.api import load_reference_pack; load_reference_pack(); print('reference pack loaded')"],"expected_text":"reference pack loaded","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Load the bundled reference pack as documented.","source":"docs/quickstart.md, 1. Opt into a capability catalog","input":"load_reference_pack()","expected":"reference pack loads","argv":["uv","run","python","-c","from rag_wright.api import load_reference_pack; load_reference_pack(); print('reference pack loaded')"],"cwd":"<guest-path>","expected_text":"reference pack loaded"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README quickstart and examples/quickstart.py; they describe a single explicit ingest/query run and no scheduled cycle, cron, loop, webhook, --once, or --now trigger."}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Python dependency management uses uv.","source":"Python with uv (never bare `python`/`pip`):","input":"uv sync","expected":"dependency environment installed","probe_kind":"cli","argv":["uv","run","python","-c","from rag_wright.api import load_reference_pack; load_reference_pack(); print('reference pack loaded')"],"expected_text":"reference pack loaded","cwd":"<guest-path>"}]
EOF
cat > .coldpass/report.json <<'EOF'
{"outcome":"blocked","fault_owner":"prerequisite","operation":"README quickstart and reference pack load","operation_scope":"Python 3.12, uv, ArcadeDB, and model provider","steps":["uv sync","uv run python examples/quickstart.py"],"deviations":["Dependency installation succeeded. Quickstart requires ArcadeDB and a model provider; neither was configured. Verified load_reference_pack() as a documented setup operation."],"stuck_step":"uv run python examples/quickstart.py","main_blocker":"ArcadeDB server and provider credentials are unavailable in this guest.","plain_failure":"The documented ingest-and-query walkthrough requires ArcadeDB and model provider configuration not available here.","suggested_fix":"Provide ArcadeDB and a model provider, then run uv run python examples/quickstart.py."}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay