ppigazzini/valgebra

Review signals: 1 connection review, 6 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; package managers (cargo) downloaded dependencies over HTTPS; package managers (rustup-init) downloaded dependencies over HTTPS; resolver address lookups that send no data; wrote only to its own open file handles.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 8 distinct locations. 2 attributed processes.

OSV reports a known vulnerability in this dependency version. filelock 6 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Subtyping is set inclusion: bool is a subtype of int: Real input produced the expected result: checked 214 example(s), 0 failed

  Source: assert Validator(bool).is_subtype_of(int) # subtyping is set inclusion

  Input: Validator(bool).is_subtype_of(int)

  Expected: True, checked by the README example runner

  Command: uv run --no-sync --group examples python scripts/run_doc_examples.py

  Observed: checked 214 example(s), 0 failed

• load parses the JSON and returns the value: Real input produced the expected result: checked 214 example(s), 0 failed

  Source: assert Validator(list[int]).load("[1, 2, 3]") == [1, 2, 3] # and keep the value

  Input: [1, 2, 3]

  Expected: [1, 2, 3], checked by the README example runner

  Command: uv run --no-sync --group examples python scripts/run_doc_examples.py

  Observed: checked 214 example(s), 0 failed

Examples

• Every runnable Python example in README.md and docs/ executes cleanly against the built extension: command completed successfully

  Source: CONTRIBUTING.md (doc examples run)

  Input: none

  Expected: checked 214 example(s), 0 failed

  Command: uv run --no-sync --group examples python scripts/run_doc_examples.py

  Observed: checked 214 example(s), 0 failed

Local or hosted: local

Build valgebra from source per README 'Install' and run its documented Python examples (README + docs) through the repo's documented runner

cd <guest-path> && ls -la && id -u && python3 --version && (git status 2>&1 | head -3); cat README.md 2>/dev/null | head -150
cd <guest-path> && sed -n 150,400p README.md; ls .coldpass; grep -n "requires-python" pyproject.toml; ls python tests | head -30
cd <guest-path> && which uv cargo rustc maturin; cargo --version 2>&1; rustc --version 2>&1; uv --version 2>&1; cat /etc/os-release | head -2; sudo -n true && echo SUDO_OK; grep -n "maturin\|build-backend" pyproject.toml | head; grep -n "uv\|cargo\|rust" .github/workflows/*.yml 2>/dev/null | head -5
export NODE_USE_ENV_PROXY=1; (curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable 2>&1 | tail -5) ; . $HOME/.cargo/env; rustc --version; cargo --version
echo $HOME; ls -la $HOME/.cargo/bin 2>/dev/null | head; ls ~/.cargo 2>/dev/null; ls <host-path> 2>/dev/null | head -3
export RUSTUP_HOME=/tmp/rustup-home CARGO_HOME=/tmp/cargo-home; curl -sSf https://sh.rustup.rs -o /tmp/rustup-init.sh && sh /tmp/rustup-init.sh -y --profile minimal --default-toolchain stable 2>&1 | tail -3; /tmp/cargo-home/bin/rustc --version; /tmp/cargo-home/bin/cargo --version
cd <guest-path> && export PATH=/tmp/cargo-home/bin:$PATH RUSTUP_HOME=/tmp/rustup-home CARGO_HOME=/tmp/cargo-home && uv sync 2>&1 | tail -15; echo "SYNC_RC=$?"
cd <guest-path> && export PATH=/tmp/cargo-home/bin:$PATH RUSTUP_HOME=/tmp/rustup-home CARGO_HOME=/tmp/cargo-home && timeout 1500 uv run --no-sync maturin develop --uv 2>&1 | tail -15; echo "RC=${PIPESTATUS[0]}"
cd <guest-path> && grep -n "scripts\]" -A4 pyproject.toml; grep -rln "python -m\|valgebra \(check\|validate\)\|__main__" docs python README.md 2>/dev/null | head; ls docs | head -50; ls python/valgebra; ls scripts
cd <guest-path> && grep -rn "run_doc_examples\|check_doc_examples\|pytest " CONTRIBUTING.md AGENTS.md docs/00-installation.md docs/02-quickstart.md docs/01-tutorial.md | head -20; sed -n 1,40p scripts/run_doc_examples.py
cd <guest-path> && export PATH=/tmp/cargo-home/bin:$PATH RUSTUP_HOME=/tmp/rustup-home CARGO_HOME=/tmp/cargo-home && uv sync --group examples 2>&1 | tail -3; timeout 900 uv run --no-sync --group examples python scripts/run_doc_examples.py > /tmp/doc_examples.out 2>&1; echo RC=$?; tail -25 /tmp/doc_examples.out
cd <guest-path> && grep -nF 'assert Validator(bool).is_subtype_of(int)  # subtyping is set inclusion' README.md; grep -nF 'assert Validator(list[int]).load("[1, 2, 3]") == [1, 2, 3]  # and keep the value' README.md; grep -nF 'Validator(list[int]).is_valid_json(b"[1, 2, 3]")' README.md; mkdir -p .coldpass && ls -la .coldpass
cd <guest-path> && ARGV='["uv","run","--no-sync","--group","examples","python","scripts/run_doc_examples.py"]' && cat > probe.json <<EOF
{"kind":"cli","argv":$ARGV,"cwd":"<guest-path>","expected_text":"checked 214 example(s), 0 failed"}
EOF
cat > claims.json <<EOF
[
{"kind":"claim","claim":"Subtyping is set inclusion: bool is a subtype of int","source":"assert Validator(bool).is_subtype_of(int)  # subtyping is set inclusion","input":"Validator(bool).is_subtype_of(int)","expected":"True, checked by the README example runner","probe_kind":"cli","argv":$ARGV,"cwd":"<guest-path>","expected_text":"checked 214 example(s), 0 failed"},
{"kind":"claim","claim":"load parses the JSON and returns the value","source":"assert Validator(list[int]).load(\"[1, 2, 3]\") == [1, 2, 3]  # and keep the value","input":"[1, 2, 3]","expected":"[1, 2, 3], checked by the README example runner","probe_kind":"cli","argv":$ARGV,"cwd":"<guest-path>","expected_text":"checked 214 example(s), 0 failed"}
]
EOF
cat > examples.json <<EOF
[
{"kind":"example","claim":"Every runnable Python example in README.md and docs/ executes cleanly against the built extension","source":"CONTRIBUTING.md (doc examples run)","input":"none","expected":"checked 214 example(s), 0 failed","argv":$ARGV,"cwd":"<guest-path>","expected_text":"checked 214 example(s), 0 failed"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (pyproject.toml has no [project.scripts], no server, no scheduler, no --once/--now or webhook in README or docs). valgebra is a Python library imported by user code; there is no product cycle to trigger.","checks":[]}
EOF
cd .. && python3 -I -c 'import json;[json.load(open(f)) for f in [".coldpass/probe.json",".coldpass/claims.json",".coldpass/examples.json",".coldpass/cycles.json"]];print("json ok")'
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":"unknown","operation":"Build valgebra from source per README 'Install' and run its documented Python examples (README + docs) through the repo's documented runner","operation_scope":"Python library only (no CLI, server, or MCP entry point). Prerequisites: Python 3.12 (>=3.10 required), uv, stable Rust (MSRV 1.88, edition 2024). Guest has Ubuntu 24.04 and passwordless sudo.","steps":["uv sync","uv run --no-sync maturin develop --uv","uv sync --group examples","uv run --no-sync --group examples python scripts/run_doc_examples.py  (CONTRIBUTING.md 'doc examples run')"],"deviations":["Installed rustup stable (1.99.1) into /tmp/rustup-home and /tmp/cargo-home with the rustup-init script; system cargo 1.75.0 is below the README MSRV 1.88, so the build could not use it.","No product CLI/MCP/HTTP entry point exists, so the probe, claims and example run the documented repo example runner (scripts/run_doc_examples.py) that executes the README's Python blocks. This is partial evidence, not a direct product command.","Claims cite README lines whose code is checked by that runner, not by a standalone invocation of each line.","Cycles: no scheduler or webhook exists, so detected=false."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None for the build. Optional: provide a product CLI or runnable quickstart so a direct probe can exercise the library without the repo runner."}
EOF
python3 -I -c 'import json;json.load(open(".coldpass/report.json"));print("report ok")'; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40
cd <guest-path> && sed -i 's/"fault_owner":"unknown"/"fault_owner":null/' .coldpass/report.json && grep -o '"fault_owner":[^,]*' .coldpass/report.json && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c 'import sys,json; d=json.loads(sys.stdin.read()); print(d["valid"], d["problems"], d["replay"]["status"])'