gridpin/gridpin

Review signals: 2 hardcoded secret, 1 outside write.

Gitleaks found a possible hardcoded secret; value withheld. prep/de_build.py 2 findings.

Repository processes attempted these writes outside documented output/cache paths. /dev/fd/9 4 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Forward lookup returns coordinates and address detail.: Real input produced the expected result: Rue de la Paix

  Source: $ gridpin query france.bin "1 rue de la Paix Paris" -k 3

  Input: 1 rue de la Paix Paris

  Expected: Rue de la <email>, 2.33031

  Command: gridpin/target/release/gridpin query /tmp/gridpin-home/v0.4.0/france.bin '1 rue de la Paix Paris' -k 1

  Observed: Rue de la Paix","housenumber":"1","commune":"Paris 2e Arrondissement","postcode":"75002","flags":["street_exact","commune_prefix","house_rep"]}

Examples

• README CLI forward geocoding quick start: command completed successfully

  Source: README.md / Quick start / CLI

  Input: 1 rue de la Paix Paris

  Expected: Rue de la Paix coordinates and address details

  Command: gridpin/target/release/gridpin query /tmp/gridpin-home/v0.4.0/france.bin '1 rue de la Paix Paris' -k 1

  Observed: {"lat":48.868546,"lon":2.33031,"precision":"house","score":0.08887005,"confidence":0.84,"street":"Rue de la Paix","housenumber":"1","commune":"Paris 2e Arrondissement","postcode":"75002","flags":["street_exact","commune_prefix","house_rep"]}

Local or hosted: both

Build the Rust CLI, download the France sheet, and forward-geocode a Paris address

pwd; vault-search 'gridpin README operation'; ls -la; rg --files -g 'AGENTS.md' -g 'README*' -g 'pyproject.toml' -g 'package.json' -g '*.md' | head -100; cat <host-path> 2>/dev/null; cat ~/.agents/skills/i-have-adhd/SKILL.md 2>/dev/null; cat ~/.agents/skills/ponytail/SKILL.md 2>/dev/null; cat ~/.agents/skills/p3-mode/SKILL.md 2>/dev/null
cat README.md; find .. -name AGENTS.md -o -name START-HERE.md; python3 --version; id -u; sed -n '1,160p' Makefile
find . -maxdepth 3 -type f | sort | head -150; ls -la .coldpass; git status --short; git rev-parse HEAD 2>/dev/null; python3 -m pip --version; command -v cargo; command -v curl
cat mcp/README.md; cat examples/README.md; cat gridpin/pyproject.toml; cat mcp/pyproject.toml; sudo -n apt-get update && sudo -n apt-get install -y python3-pip python3-venv cargo rustc;
python3 -m venv /tmp/gridpin-venv && /tmp/gridpin-venv/bin/python -m pip install gridpin gridpin-mcp
cd <guest-path> && GRIDPIN_HOME=/tmp/gridpin-home /tmp/gridpin-venv/bin/gridpin-fetch fr
cd <guest-path> && GRIDPIN_HOME=/tmp/gridpin-home /tmp/gridpin-venv/bin/python -c 'import gridpin; print(gridpin.Geocoder("/tmp/gridpin-home/v0.4.0/france.bin").geocode("1 rue de la Paix, Paris", 1))'
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/tmp/gridpin-venv/bin/python","-c","import gridpin; print(gridpin.Geocoder('/tmp/gridpin-home/v0.4.0/france.bin').geocode('1 rue de la Paix, Paris', 1))"],"cwd":"<guest-path>","expected_text":"Rue de la Paix"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The quick start geocodes a Paris address and returns its coordinate.","source":"g.geocode(\"1 rue de la Paix, Paris\", 1)","input":"1 rue de la Paix, Paris","expected":"Paris house result with latitude and longitude","probe_kind":"cli","argv":["/tmp/gridpin-venv/bin/python","-c","import gridpin; print(gridpin.Geocoder('/tmp/gridpin-home/v0.4.0/france.bin').geocode('1 rue de la Paix, Paris', 1))"],"expected_text":"Rue de la Paix","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"README Python quick start forward geocoding","source":"README.md / Quick start / Python","input":"1 rue de la Paix, Paris","expected":"Paris address coordinates","argv":["/tmp/gridpin-venv/bin/python","-c","import gridpin; print(gridpin.Geocoder('/tmp/gridpin-home/v0.4.0/france.bin').geocode('1 rue de la Paix, Paris', 1))"],"cwd":"<guest-path>","expected_text":"Rue de la Paix"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"GridPin is a request-driven geocoder; README entry points expose individual queries, and no product scheduler or cycle was found.","checks":[]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && /tmp/gridpin-venv/bin/gridpin-fetch --help; /tmp/gridpin-venv/bin/python -m gridpin --help; ls gridpin/target/release/gridpin
cd <guest-path> && cargo build --release --manifest-path gridpin/Cargo.toml
cd <guest-path> && /tmp/gridpin-venv/bin/pip show gridpin; /tmp/gridpin-venv/bin/python -m pip install maturin
cd <guest-path> && ls -l /tmp/gridpin-home/v0.4.0/france.bin && /tmp/gridpin-venv/bin/python -m maturin --version && rustc --version && cargo --version
curl -fsSL https://sh.rustup.rs -o /tmp/rustup-init.sh && sh /tmp/rustup-init.sh -y --profile minimal --default-toolchain stable
cd <guest-path> && PATH=<host-path> cargo build --release --manifest-path gridpin/Cargo.toml
cd <guest-path> && <host-path> --version; <host-path> --version; head -8 gridpin/Cargo.lock
find /tmp <host-path> -path '*/.cargo/bin/cargo' -o -path '*/.cargo/bin/rustc' 2>/dev/null; env | sort | grep -E 'HOME|RUSTUP|CARGO'
cd <guest-path> && PATH=<guest-path> cargo build --release --manifest-path gridpin/Cargo.toml
cd <guest-path> && gridpin/target/release/gridpin query /tmp/gridpin-home/v0.4.0/france.bin '1 rue de la Paix Paris' -k 1
cd <guest-path> && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["gridpin/target/release/gridpin","query","/tmp/gridpin-home/v0.4.0/france.bin","1 rue de la Paix Paris","-k","1"],"cwd":"<guest-path>","expected_text":"Rue de la Paix"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Forward lookup returns coordinates and address detail.","source":"$ gridpin query france.bin \"1 rue de la Paix Paris\" -k 3","input":"1 rue de la Paix Paris","expected":"Rue de la <email>, 2.33031","probe_kind":"cli","argv":["gridpin/target/release/gridpin","query","/tmp/gridpin-home/v0.4.0/france.bin","1 rue de la Paix Paris","-k","1"],"expected_text":"Rue de la Paix","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"README CLI forward geocoding quick start","source":"README.md / Quick start / CLI","input":"1 rue de la Paix Paris","expected":"Rue de la Paix coordinates and address details","argv":["gridpin/target/release/gridpin","query","/tmp/gridpin-home/v0.4.0/france.bin","1 rue de la Paix Paris","-k","1"],"cwd":"<guest-path>","expected_text":"Rue de la Paix"}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Build the Rust CLI, download the France sheet, and forward-geocode a Paris address","operation_scope":"Python 3.12.3 venv for documented gridpin/gridpin-mcp installation; stable Rust installed in the guest to support the README source-build command","steps":["Read README quick start and install instructions","Installed python3-pip, python3-venv, cargo and rustc with apt","Created /tmp/gridpin-venv and installed gridpin and gridpin-mcp with pip","Ran gridpin-fetch fr and verified the package returned the France sheet path","Installed stable Rust using the rustup installer after system Cargo 1.75 could not parse Cargo.lock format 4","Ran cargo build --release --manifest-path gridpin/Cargo.toml successfully","Ran the README CLI forward query; returned Rue de la Paix, house 1, Paris, lat 48.868546 lon 2.33031","Validated and replayed .coldpass/probe.json, claims.json, examples.json and cycles.json successfully"],"deviations":["Initial system Cargo 1.75 failed: lock file version 4 requires -Znext-lockfile-bump; installed stable Rust 1.99.1 and rebuilt successfully"],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
cat .coldpass/report.json; ls -la .coldpass