Skip to content

feat: implement RPC transport, WASM inspection, analysis and config APIs - #133

Merged
Ayinkx01 merged 58 commits into
mainfrom
feat/complete-devkit-workstreams
Oct 28, 2026
Merged

Ayinkx01 merged 58 commits into
mainfrom
feat/complete-devkit-workstreams

Conversation

@Ayinkx01

@Ayinkx01 Ayinkx01 commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

Summary

This PR combines the original implementation and security-hardening work and includes follow-up work to close the remaining integration gaps.

  • RPC transport: bounded HTTP JSON-RPC, finite configurable timeout, redirects disabled, response cap before JSON parsing, JSON-RPC version/ID validation, and structured errors.
  • WASM and contract spec: bounded non-executing WASM validation, import/export metadata, and bounded decoding of the contractspecv0 stream using official Stellar ScSpecEntry XDR types. Results include XDR-JSON definitions, variant kinds, and best-effort names; entry count is capped.
  • Analysis: deterministic structural findings with stable rule IDs, evidence, and SARIF 2.1.0 output.
  • SARIF integration: manual workflow dispatch can analyze a repository-relative WASM artifact and upload the SARIF result to GitHub code scanning, subject to repository permissions.
  • Configuration: strict TOML config is wired into rpc-health, with a 1 MiB config cap, 100–120000 ms timeout validation, environment overrides, and endpoint precedence (CLI > environment > file).
  • CI/security: pinned actions, locked dependencies, Linux/Windows/macOS tests, Rust 1.91.0 MSRV tests, and RustSec audit.
  • Docs/release: refreshed CLI docs, changelog, project status, release checklist, and Drips application/readiness drafts.

Validation

A fresh CI and RustSec audit run is in progress for the final code head: CI run #40682851353 · audit run #40682851349.

Earlier CI exposed and we fixed two issues in the follow-up work: malformed WASM bytes in the regression fixture and an unnecessary mut rejected by Clippy. The latest run must be green before merge.

Remaining limitation

The analysis rules remain structural heuristics, not a comprehensive vulnerability detector. The XDR definitions are decoded but not yet normalized into a versioned ABI schema. Do not present these checks as proof of security.

The changes are for review; this PR has not been merged yet. No Drips appeal has been submitted.

@Ayinkx01 Ayinkx01 closed this Oct 28, 2026
@Ayinkx01 Ayinkx01 reopened this Oct 28, 2026
@Ayinkx01 Ayinkx01 closed this Oct 28, 2026
@Ayinkx01 Ayinkx01 reopened this Oct 28, 2026
@Ayinkx01
Ayinkx01 merged commit aec759c into main Oct 28, 2026
7 checks passed
Ayinkx01 added a commit that referenced this pull request Oct 28, 2026
PR #127 and #133 merged into main on 2026-10-28, but the status, readiness, audit, changelog, roadmap, architecture, getting-started, and build-report docs still described the work as unmerged. This commit makes the documentation match main and prepares the Drips appeal.

- mark PR #127/#133 merged and link the post-merge CI and RustSec runs
- update README, architecture, getting started, capabilities, roadmap, and build report
- regenerate the issue audit, backlog, and quality audit from live issue numbers
- rebuild the Wave board with 20 open, independent, unimplemented issues (3,050 pts)
- add APPEAL.md, WHY_DEVKIT.md, and CONFIGURATION.md
- add CODEOWNERS and a bug report template
- fix stale RPC transport and CLI doctor comments

Co-authored-by: Ayinkx <199975741+Ayinkx@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant