Release Spectraplex 1.0.0

.cargo/audit.toml

@@ -1,41 +1,14 @@
-# Ignore advisories for transitive dependencies we cannot directly upgrade.
-# These come from solana-sdk and sqlx crate trees.
-
+# Narrow upstream exceptions; review when the dependency tree changes.
 [advisories]
 ignore = [
-    # rsa 0.9.9 (via sqlx-mysql): no fix available upstream.
-    # We use PostgreSQL, not MySQL -- sqlx-mysql is pulled in by the sqlx
-    # macros crate unconditionally.
+    # Optional sqlx-mysql resolution only. `cargo tree -i rsa --target all`
+    # has no active path: this PostgreSQL-only application does not build RSA.
+    # No patched rsa 0.9 release is available.
     "RUSTSEC-2023-0071",
 
-    # time 0.3.44 (via solana-*, alloy, x509-parser): stack exhaustion DoS.
-    # Transitive dependency pinned by solana-sdk 3.x; cannot upgrade independently.
-    "RUSTSEC-2026-0009",
-
-    # keccak 0.1.5 (via solana-zk-sdk/merlin/sha3): unsound ARMv8 assembly.
-    # Transitive dependency pinned by solana-zk-sdk; cannot upgrade independently.
-    "RUSTSEC-2026-0012",
-
-    # rand 0.8.5 (via alloy-signer-local, governor, solana-*): unsound when a
-    # CUSTOM `log::Log` implementation calls `rand::rng()` / ThreadRng methods
-    # and triggers a reseed mid-log. Affects rand `>= 0.7, < 0.9.3`; fix is
-    # rand 0.9.3+, which is a major-version bump the transitive deps above
-    # have not yet taken.
-    #
-    # Not exploitable in this workspace:
-    # - We do not implement `log::Log`. We use `tracing_subscriber::fmt` (a
-    #   tracing Layer, not a `log::Log` impl).
-    # - No code in this repo calls `rand::rng()` or `rand::thread_rng()` from
-    #   inside a logger. Transitive crates that use `rand` do so outside of
-    #   logging paths (key generation, jitter, QUIC connection IDs, etc.).
-    # Revisit when alloy / governor / solana-* bump past rand 0.9.3.
-    #
-    # We also run `cargo update -p rand` to keep the rand 0.9.x line on the
-    # latest 0.9.x (currently 0.9.4, past the advisory cutoff of 0.9.3).
-    "RUSTSEC-2026-0097",
+    # alloy-provider 1.7.1 uses lru 0.16.4 with u64 and B256 keys.
+    # Neither key has a Drop implementation. The advisory requires a key's
+    # Drop to panic during pop(), followed by catch_unwind and cache reuse.
+    # Revisit when Alloy adopts lru >=0.18.2; do not add panicking cache keys.
+    "RUSTSEC-2026-0253",
 ]
-
-[yanked]
-# keccak 0.1.5 is yanked but pinned transitively by solana-zk-sdk/merlin.
-# Cannot be upgraded without a new solana-sdk release.
-enabled = false

.dockerignore

@@ -1,6 +1,9 @@
 .git
 target/
-node_modules/
+**/node_modules/
+**/__pycache__/
+web-tests/artifacts/
+*.log
 .smithers/
 .claude/
 .entire/
@@ -12,3 +15,6 @@ bun.lock
 
 *.md
 .env
+spectraplex.toml
+exports/
+.local/

.github/workflows/audit.yml

@@ -6,10 +6,14 @@ on:
   pull_request:
     paths:
       - "Cargo.lock"
+      - "**/Cargo.toml"
+      - ".cargo/audit.toml"
   push:
     branches: [main]
     paths:
       - "Cargo.lock"
+      - "**/Cargo.toml"
+      - ".cargo/audit.toml"
 
 permissions:
   contents: read
@@ -21,6 +25,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Verify unused-RSA exception remains valid
+        run: |
+          tree=$(cargo tree --locked -i rsa --target all)
+          test -z "$tree"
       - uses: rustsec/audit-check@v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci.yml

@@ -66,7 +66,20 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - run: cargo test --workspace
+      - run: cargo test --locked --workspace
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: web-tests/package-lock.json
+      - run: npm ci --prefix web-tests
+      - run: cd web-tests && npx playwright install --with-deps chromium
+      - run: ./scripts/smoke-test.sh --browser
+      - uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: browser-failure-artifacts
+          path: web-tests/artifacts
 
   build:
     name: Build (release)
@@ -75,4 +88,32 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - run: cargo build --release --workspace
+      - run: cargo build --locked --release --workspace
+
+  docker:
+    name: Docker first run
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - name: Build and boot
+        run: |
+          ./scripts/setup.sh
+          docker compose up --build -d --wait --wait-timeout 120
+          curl -fsS http://127.0.0.1:3000/ready
+          test "$(docker compose exec -T api id -u)" != 0
+      - name: Check pipeline and persistence
+        run: |
+          set -a; source .env; set +a
+          export SPECTRAPLEX_TEST_URL=http://127.0.0.1:3000
+          export SPECTRAPLEX_TEST_KEY="$SPECTRAPLEX_API_KEY"
+          python3 scripts/container_test.py prepare .local/container-check.json
+          docker compose down
+          docker compose up -d --wait --wait-timeout 120
+          python3 scripts/container_test.py verify .local/container-check.json
+      - name: Container logs
+        if: failure()
+        run: docker compose logs --tail 100
+      - name: Stop
+        if: always()
+        run: docker compose down -v

.gitignore

@@ -1,14 +1,20 @@
 /target
+/.env
+/spectraplex.toml
+/exports/
+/.local/
 n*.md
 p*.md
 docs/
 design/
 /workflow.tsx
 /.smithers/
-node_modules/*
+node_modules/
+__pycache__/
+/web-tests/artifacts/
 .claude/*
 .entire/*
 AGENTS.md
 CLAUDE.md
 bun.lock
-package.json
+/package.json