wickra-lib/wickra-feature-store

Review signals: 1 connection review, 13 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; package managers (rustup-init) downloaded dependencies over HTTPS; resolver address lookups that send no data; wrote only to its own open file handles.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 8 distinct locations. 2 attributed processes.

OSV reports a known vulnerability in this dependency version. 2 distinct locations. 13 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Quickstart computes a feature matrix from per-symbol CSV files.: Real input produced the expected result: symbol,ts,Sma(2),price.close,fwd_return(1) AAA,1,,10,0.1 AAA,2,10.5,11,0.09090909 AAA,3,11.5,12, BBB,1,,20,0.1 BBB,2,21,22,0.09090909 BBB,3,23,24,

  Source: Build a matrix from a directory of per-symbol CSV files (`<SYMBOL>.csv`, header

  Input: examples/data/specs/momentum.json and examples/data/universe

  Expected: CSV matrix contains symbol, timestamp, SMA, close, and forward return columns.

  Command: /var<guest-path> run --offline -p wickra-feature-store -- --spec examples/data/specs/momentum.json --data examples/data/universe --format csv

  Observed: symbol,ts,Sma(2),price.close,fwd_return(1) AAA,1,,10,0.1 AAA,2,10.5,11,0.09090909 AAA,3,11.5,12, BBB,1,,20,0.1 BBB,2,21,22,0.09090909 BBB,3,23,24, Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.53s Running `target/debug/wickra-feature-store --spec examples/data/specs/momentum.json --data examples/data/universe --format csv`

Examples

• Quickstart CSV matrix build: command completed successfully

  Source: README.md / Quickstart

  Input: examples/data/specs/momentum.json; examples/data/universe/*.csv

  Expected: CSV feature matrix on stdout

  Command: /var<guest-path> run --offline -p wickra-feature-store -- --spec examples/data/specs/momentum.json --data examples/data/universe --format csv

  Observed: symbol,ts,Sma(2),price.close,fwd_return(1) AAA,1,,10,0.1 AAA,2,10.5,11,0.09090909 AAA,3,11.5,12, BBB,1,,20,0.1 BBB,2,21,22,0.09090909 BBB,3,23,24, Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.53s Running `target/debug/wickra-feature-store --spec examples/data/specs/momentum.json --data examples/data/universe --format csv`

Local or hosted: local

Build a feature matrix from CSV candle inputs

pwd && rg --files -g 'README*' -g 'pyproject.toml' -g 'requirements*' -g 'setup.py' -g 'package.json' -g 'AGENTS.md' | head -60 && git status --short --branch
ls -la
cat README.md
python3 --version; cargo --version; rustc --version; sed -n '1,240p' crates/feature-store-cli/src/main.rs; find examples -maxdepth 3 -type f | head -30
cat crates/feature-store-cli/src/args.rs; cat examples/data/specs/momentum.json; head -5 examples/data/universe/AAA.csv; cat Cargo.toml
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.86.0
export PATH=/var<guest-path>; rustc --version; cargo build -p wickra-feature-store-cli
cat crates/feature-store-cli/Cargo.toml; sed -n '1,120p' crates/feature-store-cli/src/run.rs
export PATH=/var<guest-path>; cargo build -p wickra-feature-store
export PATH=/var<guest-path>; target/debug/wickra-feature-store --spec examples/data/specs/momentum.json --data examples/data/universe --format csv
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/var<guest-path>","run","--offline","-p","wickra-feature-store","--","--spec","examples/data/specs/momentum.json","--data","examples/data/universe","--format","csv"],"cwd":"<guest-path>","expected_text":"symbol,ts,Sma(2),price.close,fwd_return(1)\nAAA,1,,10,0.1\nAAA,2,10.5,11,0.09090909\nAAA,3,11.5,12,\nBBB,1,,20,0.1\nBBB,2,21,22,0.09090909\nBBB,3,23,24,\n"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Quickstart computes a feature matrix from per-symbol CSV files.","source":"Build a matrix from a directory of per-symbol CSV files (`<SYMBOL>.csv`, header","input":"examples/data/specs/momentum.json and examples/data/universe","expected":"CSV matrix contains symbol, timestamp, SMA, close, and forward return columns.","probe_kind":"cli","argv":["/var<guest-path>","run","--offline","-p","wickra-feature-store","--","--spec","examples/data/specs/momentum.json","--data","examples/data/universe","--format","csv"],"expected_text":"symbol,ts,Sma(2),price.close,fwd_return(1)\nAAA,1,,10,0.1\nAAA,2,10.5,11,0.09090909\nAAA,3,11.5,12,\nBBB,1,,20,0.1\nBBB,2,21,22,0.09090909\nBBB,3,23,24,\n","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Quickstart CSV matrix build","source":"README.md / Quickstart","input":"examples/data/specs/momentum.json; examples/data/universe/*.csv","expected":"CSV feature matrix on stdout","argv":["/var<guest-path>","run","--offline","-p","wickra-feature-store","--","--spec","examples/data/specs/momentum.json","--data","examples/data/universe","--format","csv"],"cwd":"<guest-path>","expected_text":"symbol,ts,Sma(2),price.close,fwd_return(1)\nAAA,1,,10,0.1\nAAA,2,10.5,11,0.09090909\nAAA,3,11.5,12,\nBBB,1,,20,0.1\nBBB,2,21,22,0.09090909\nBBB,3,23,24,\n"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README CLI quickstart, crate entrypoint and examples; the CLI performs one requested matrix build and exposes no product scheduler, cron loop, webhook or repeat trigger."}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Build a feature matrix from CSV candle inputs","operation_scope":"Rust CLI quickstart with the checked-in example spec and sample universe; Rust 1.86+","steps":["Read README.md Quickstart and Requirements.","Installed Rust 1.86.0 using rustup because the guest initially had Rust 1.75.","Built CLI with cargo build -p wickra-feature-store.","Ran CSV matrix operation and replayed it successfully through the independent checker."],"deviations":["Initial cargo build used the README-inconsistent package selector wickra-feature-store-cli and failed; corrected to the actual package name wickra-feature-store.","The existing cargo/rustc 1.75 toolchain was below the README requirement; installed 1.86.0."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF