2026-07-31 01:57:13 +02:00
|
|
|
# This file is automatically @generated by Cargo.
|
|
|
|
|
# It is not intended for manual editing.
|
|
|
|
|
version = 4
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "aho-corasick"
|
|
|
|
|
version = "1.1.4"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"memchr",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "anes"
|
|
|
|
|
version = "0.1.6"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "anstyle"
|
|
|
|
|
version = "1.0.14"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "autocfg"
|
|
|
|
|
version = "1.5.1"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "block-buffer"
|
|
|
|
|
version = "0.10.4"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"generic-array",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "cast"
|
|
|
|
|
version = "0.3.0"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "cb-events"
|
|
|
|
|
version = "0.1.0"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"cb-kernel",
|
|
|
|
|
"serde",
|
|
|
|
|
"serde_json",
|
|
|
|
|
"sha2",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "cb-game-runtime"
|
|
|
|
|
version = "0.1.0"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"cb-events",
|
|
|
|
|
"cb-kernel",
|
|
|
|
|
"serde",
|
|
|
|
|
"serde_json",
|
|
|
|
|
"serde_yaml",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "cb-kernel"
|
|
|
|
|
version = "0.1.0"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"rand_chacha",
|
|
|
|
|
"rand_core",
|
|
|
|
|
"serde",
|
|
|
|
|
]
|
|
|
|
|
|
CB-WP-0008-T02: cb-play — INTENT stage 0's CLI player
A human seat is a Policy like any bot, so the CLI adds no second driver:
HumanPolicy renders the projection, lists the legal commands and reads an
index or `pass`. `make play` runs it; `--all-bots` watches one.
K13's Project trait gains its first implementor after six passes with
none. Hidden: other seats' face-down selections until Reveal, hands and
deck (counts only), a face-down Problem's suit and value, and the seed —
not secret content, but a seat holding it can compute the deck.
A played session becomes an artifact: --record writes it as a scenario
the runner executes, --replay writes a .cbreplay bundle. record.rs is the
inverse of parse_command and its warrant is a round-trip test over every
command shape.
The acceptance test for the projection passed vacuously twice. First it
asserted the text contained "face-down", which every render does because
of Problems. Counted, it then reported zero inspected entries: seats are
asked in order, so a human at P1 is prompted before anyone has selected.
Seated at P3 it inspects ten entries and dies when the projection is
mutated to reveal everything. Counting what the harness examined caught
both, which is the second time that remedy has worked where a stronger
predicate would not have.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-01 14:43:53 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "cb-play"
|
|
|
|
|
version = "0.1.0"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"cb-events",
|
|
|
|
|
"cb-game-runtime",
|
|
|
|
|
"cb-kernel",
|
CB-WP-0012-T04: cb-render-html — stage 1 draws, and the browser is the toolkit
Delivers ADR-0007 Decision 1: visualization, drag-to-propose and hot-seat
play, at a measured marginal AM-4a cost of zero.
games-ground shipped: 23 third-party crates
cb-render-html: 23 third-party crates
new crates introduced: 0
Measured, not asserted — the survey's own lesson. AM-4a is unmoved at
246,250; own source is 7,636 -> 9,652.
What shipped:
crates/cb-render-html doc.rs (HTML/SVG emission, incl. the relationship
graph), input.rs (pointer facts -> commands),
serve.rs (Guard, Request, loopback bind)
tools/cb-play hotseat.rs + `--serve PORT`
Per ADR-0007 Decision 2 there is NO cb-render-api and NO cb-render-null.
The renderer targets the existing Project trait; the port waits for
stage 2's wgpu implementation to be its second use.
The six controls, all live, all mutation-checked (8 mutations, each red
for its stated reason):
1-3 token / Origin+Sec-Fetch-Site / explicit 127.0.0.1 bind
4 a token-less request is refused, in the unit AND over a real socket
5 JS may not construct commands — the page reports pointer facts, Rust
resolves them against the legal list the aggregate already offered,
and a test asserts the emitted script contains no game vocabulary
6 the coverage gate crosses the language boundary: it walks the
serialized view for leaf paths and requires each token to appear in
the PARSED emitted document, with a test that the parse really is a
parse (script/style contents must not count as rendered)
The gate fired on its author again, on its first run: ground_choices.*.
choice, ground_choices.*.problem and players.*.blame_from were in neither
list. The last is the one worth keeping — an EMPTY vector is a leaf path
of its own, and it now renders as an explicit absence.
Also, a mutation that did not go red: removing the Sec-Fetch-Site arm
alone left the cross-site test green, because the Origin check caught it
independently. Both had to be removed before the control bit. Recorded
because a control that passes for a reason you did not intend has not
been demonstrated.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-02 04:27:25 +02:00
|
|
|
"cb-render-html",
|
CB-WP-0008-T02: cb-play — INTENT stage 0's CLI player
A human seat is a Policy like any bot, so the CLI adds no second driver:
HumanPolicy renders the projection, lists the legal commands and reads an
index or `pass`. `make play` runs it; `--all-bots` watches one.
K13's Project trait gains its first implementor after six passes with
none. Hidden: other seats' face-down selections until Reveal, hands and
deck (counts only), a face-down Problem's suit and value, and the seed —
not secret content, but a seat holding it can compute the deck.
A played session becomes an artifact: --record writes it as a scenario
the runner executes, --replay writes a .cbreplay bundle. record.rs is the
inverse of parse_command and its warrant is a round-trip test over every
command shape.
The acceptance test for the projection passed vacuously twice. First it
asserted the text contained "face-down", which every render does because
of Problems. Counted, it then reported zero inspected entries: seats are
asked in order, so a human at P1 is prompted before anyone has selected.
Seated at P3 it inspects ten entries and dies when the projection is
mutated to reveal everything. Counting what the harness examined caught
both, which is the second time that remedy has worked where a stronger
predicate would not have.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-01 14:43:53 +02:00
|
|
|
"games-ground",
|
|
|
|
|
"serde_json",
|
|
|
|
|
"serde_yaml",
|
|
|
|
|
]
|
|
|
|
|
|
CB-WP-0012-T04: cb-render-html — stage 1 draws, and the browser is the toolkit
Delivers ADR-0007 Decision 1: visualization, drag-to-propose and hot-seat
play, at a measured marginal AM-4a cost of zero.
games-ground shipped: 23 third-party crates
cb-render-html: 23 third-party crates
new crates introduced: 0
Measured, not asserted — the survey's own lesson. AM-4a is unmoved at
246,250; own source is 7,636 -> 9,652.
What shipped:
crates/cb-render-html doc.rs (HTML/SVG emission, incl. the relationship
graph), input.rs (pointer facts -> commands),
serve.rs (Guard, Request, loopback bind)
tools/cb-play hotseat.rs + `--serve PORT`
Per ADR-0007 Decision 2 there is NO cb-render-api and NO cb-render-null.
The renderer targets the existing Project trait; the port waits for
stage 2's wgpu implementation to be its second use.
The six controls, all live, all mutation-checked (8 mutations, each red
for its stated reason):
1-3 token / Origin+Sec-Fetch-Site / explicit 127.0.0.1 bind
4 a token-less request is refused, in the unit AND over a real socket
5 JS may not construct commands — the page reports pointer facts, Rust
resolves them against the legal list the aggregate already offered,
and a test asserts the emitted script contains no game vocabulary
6 the coverage gate crosses the language boundary: it walks the
serialized view for leaf paths and requires each token to appear in
the PARSED emitted document, with a test that the parse really is a
parse (script/style contents must not count as rendered)
The gate fired on its author again, on its first run: ground_choices.*.
choice, ground_choices.*.problem and players.*.blame_from were in neither
list. The last is the one worth keeping — an EMPTY vector is a leaf path
of its own, and it now renders as an explicit absence.
Also, a mutation that did not go red: removing the Sec-Fetch-Site arm
alone left the cross-site test green, because the Origin check caught it
independently. Both had to be removed before the control bit. Recorded
because a control that passes for a reason you did not intend has not
been demonstrated.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-02 04:27:25 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "cb-render-html"
|
|
|
|
|
version = "0.1.0"
|
|
|
|
|
dependencies = [
|
CB-WP-0016: the drop target that was never there
Provenance (tier S, one paragraph in lieu of survey and ADR): the human
check that kept INTENT stage 1 open was run and the drag was broken.
Root cause, worth more than the instance: drop targets were ids, and an
id must be unique, so exactly one element could ever be seat-0. The
relationship-graph circle took it and the seat card that every action
card's own text points at -- 'drag Attack onto a seat' -- silently had
none. A seat is drawn twice and both drawings are the seat; the document
model could not express that.
Drop keys are now data-drop. Any number of elements may carry the same
key, so a seat is droppable on its card and on its graph node. Measured
on a live server: seat-0/1/2 each appear twice, id survives only on
cb-status which is the one element the script looks up, and
down=action-attack&up=seat-1 returns ok.
Second defect: a drop on nothing returned without posting and without
touching the status line, so a broken target was indistinguishable from
a working page. resolve already refuses rather than defaulting, which is
right; refusing SILENTLY is not. The page now reports the raw fact --
'took action-attack, let go over nothing droppable' -- which names
elements, not moves, so ADR-0007 control 5 holds.
And the honest part: the general check added here -- every offered
affordance names a key that exists, driven through Policy::choose over
four real bot games -- does NOT catch the reported defect. seat-0 did
exist, on the graph circle. It is kept because a wholly absent target is
a real class, and paired with a targeted regression test that does catch
it. Three mutations, each red for its stated reason, including the
reported defect reintroduced; only the targeted test fires on that one.
A cb-play assertion matched id="action-ground" as a substring while
describing itself as checking the page; rewritten through drop_keys.
make all exits 0. Stage 1 stays open: verified by tests, mutation and a
live server, not by a human dragging.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-02 20:48:18 +02:00
|
|
|
"cb-game-runtime",
|
CB-WP-0012-T04: cb-render-html — stage 1 draws, and the browser is the toolkit
Delivers ADR-0007 Decision 1: visualization, drag-to-propose and hot-seat
play, at a measured marginal AM-4a cost of zero.
games-ground shipped: 23 third-party crates
cb-render-html: 23 third-party crates
new crates introduced: 0
Measured, not asserted — the survey's own lesson. AM-4a is unmoved at
246,250; own source is 7,636 -> 9,652.
What shipped:
crates/cb-render-html doc.rs (HTML/SVG emission, incl. the relationship
graph), input.rs (pointer facts -> commands),
serve.rs (Guard, Request, loopback bind)
tools/cb-play hotseat.rs + `--serve PORT`
Per ADR-0007 Decision 2 there is NO cb-render-api and NO cb-render-null.
The renderer targets the existing Project trait; the port waits for
stage 2's wgpu implementation to be its second use.
The six controls, all live, all mutation-checked (8 mutations, each red
for its stated reason):
1-3 token / Origin+Sec-Fetch-Site / explicit 127.0.0.1 bind
4 a token-less request is refused, in the unit AND over a real socket
5 JS may not construct commands — the page reports pointer facts, Rust
resolves them against the legal list the aggregate already offered,
and a test asserts the emitted script contains no game vocabulary
6 the coverage gate crosses the language boundary: it walks the
serialized view for leaf paths and requires each token to appear in
the PARSED emitted document, with a test that the parse really is a
parse (script/style contents must not count as rendered)
The gate fired on its author again, on its first run: ground_choices.*.
choice, ground_choices.*.problem and players.*.blame_from were in neither
list. The last is the one worth keeping — an EMPTY vector is a leaf path
of its own, and it now renders as an explicit absence.
Also, a mutation that did not go red: removing the Sec-Fetch-Site arm
alone left the cross-site test green, because the Origin check caught it
independently. Both had to be removed before the control bit. Recorded
because a control that passes for a reason you did not intend has not
been demonstrated.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-02 04:27:25 +02:00
|
|
|
"cb-kernel",
|
|
|
|
|
"games-ground",
|
CB-WP-0014-T01/T02: execute the JavaScript — and find AM-4b blind
ADR-0009: embed quick-js; node is refused. Measured marginal cost against
the dev-toolchain graph, under the positive control:
boa_engine 896,410
rquickjs 69,985
quick-js 11,434
node 0 <- and that zero is the problem
ADR-0007 D3's acquisition rule biting its author. CI runs on rust:1.97,
which has no node, so the test would make our build fetch a JS runtime of
tens of millions of unaudited lines while scoring zero on the only
instrument that governs dependencies. A browser is exempt because a
developer has one regardless of us; a CI-installed runtime is not.
The loop is now closed: the real server serves the real page, QuickJS
runs that page's own scripts, the gesture goes over a real socket, and
the seat's Choice comes back. Before this, every link was tested and the
chain was not — a page whose JavaScript sent something else entirely
would have passed everything.
Three controls, each red for its stated reason: the JS posting a command
name instead of ids, the gesture not being delivered (EXPECT-VACUOUS),
and the token stripped from the endpoint.
A wrong assertion worth keeping: the first draft required the body not to
contain "attack". It legitimately does — action-attack is the id of an
element a finger landed on. An element may name an action; that is not
the page deciding. The real test is the shape: exactly two fields, down
and up, carrying two ids and nothing derived from them.
AND the ADR's own cost argument was wrong. It claimed 35% of AM-4b's
headroom; after landing AM-4b did not move at all. It measures
games-ground --edges normal — one package, no dev edges. Measured, the
workspace including dev edges is 725,258 lines against AM-4b's 317,021:
408,237 uncounted, MORE THAN THE TARGET ITSELF (criterion, clap,
ciborium, quick-js). The decision stands on the acquisition rule; the
affordability argument is withdrawn. Third defect in the AM-4 family.
Also fixed structurally rather than by raising a limit: `make status` had
grown past its 40-line readability gate as workplans accumulated. Closed
workplans now collapse to one line, so the report is fixed-size.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-02 07:56:02 +02:00
|
|
|
"quick-js",
|
CB-WP-0012-T04: cb-render-html — stage 1 draws, and the browser is the toolkit
Delivers ADR-0007 Decision 1: visualization, drag-to-propose and hot-seat
play, at a measured marginal AM-4a cost of zero.
games-ground shipped: 23 third-party crates
cb-render-html: 23 third-party crates
new crates introduced: 0
Measured, not asserted — the survey's own lesson. AM-4a is unmoved at
246,250; own source is 7,636 -> 9,652.
What shipped:
crates/cb-render-html doc.rs (HTML/SVG emission, incl. the relationship
graph), input.rs (pointer facts -> commands),
serve.rs (Guard, Request, loopback bind)
tools/cb-play hotseat.rs + `--serve PORT`
Per ADR-0007 Decision 2 there is NO cb-render-api and NO cb-render-null.
The renderer targets the existing Project trait; the port waits for
stage 2's wgpu implementation to be its second use.
The six controls, all live, all mutation-checked (8 mutations, each red
for its stated reason):
1-3 token / Origin+Sec-Fetch-Site / explicit 127.0.0.1 bind
4 a token-less request is refused, in the unit AND over a real socket
5 JS may not construct commands — the page reports pointer facts, Rust
resolves them against the legal list the aggregate already offered,
and a test asserts the emitted script contains no game vocabulary
6 the coverage gate crosses the language boundary: it walks the
serialized view for leaf paths and requires each token to appear in
the PARSED emitted document, with a test that the parse really is a
parse (script/style contents must not count as rendered)
The gate fired on its author again, on its first run: ground_choices.*.
choice, ground_choices.*.problem and players.*.blame_from were in neither
list. The last is the one worth keeping — an EMPTY vector is a leaf path
of its own, and it now renders as an explicit absence.
Also, a mutation that did not go red: removing the Sec-Fetch-Site arm
alone left the cross-site test green, because the Origin check caught it
independently. Both had to be removed before the control bit. Recorded
because a control that passes for a reason you did not intend has not
been demonstrated.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-02 04:27:25 +02:00
|
|
|
"serde_json",
|
|
|
|
|
]
|
|
|
|
|
|
2026-07-31 01:57:13 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "cb-sim"
|
|
|
|
|
version = "0.1.0"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"cb-game-runtime",
|
|
|
|
|
"games-ground",
|
|
|
|
|
]
|
|
|
|
|
|
CB-WP-0014-T01/T02: execute the JavaScript — and find AM-4b blind
ADR-0009: embed quick-js; node is refused. Measured marginal cost against
the dev-toolchain graph, under the positive control:
boa_engine 896,410
rquickjs 69,985
quick-js 11,434
node 0 <- and that zero is the problem
ADR-0007 D3's acquisition rule biting its author. CI runs on rust:1.97,
which has no node, so the test would make our build fetch a JS runtime of
tens of millions of unaudited lines while scoring zero on the only
instrument that governs dependencies. A browser is exempt because a
developer has one regardless of us; a CI-installed runtime is not.
The loop is now closed: the real server serves the real page, QuickJS
runs that page's own scripts, the gesture goes over a real socket, and
the seat's Choice comes back. Before this, every link was tested and the
chain was not — a page whose JavaScript sent something else entirely
would have passed everything.
Three controls, each red for its stated reason: the JS posting a command
name instead of ids, the gesture not being delivered (EXPECT-VACUOUS),
and the token stripped from the endpoint.
A wrong assertion worth keeping: the first draft required the body not to
contain "attack". It legitimately does — action-attack is the id of an
element a finger landed on. An element may name an action; that is not
the page deciding. The real test is the shape: exactly two fields, down
and up, carrying two ids and nothing derived from them.
AND the ADR's own cost argument was wrong. It claimed 35% of AM-4b's
headroom; after landing AM-4b did not move at all. It measures
games-ground --edges normal — one package, no dev edges. Measured, the
workspace including dev edges is 725,258 lines against AM-4b's 317,021:
408,237 uncounted, MORE THAN THE TARGET ITSELF (criterion, clap,
ciborium, quick-js). The decision stands on the acquisition rule; the
affordability argument is withdrawn. Third defect in the AM-4 family.
Also fixed structurally rather than by raising a limit: `make status` had
grown past its 40-line readability gate as workplans accumulated. Closed
workplans now collapse to one line, so the report is fixed-size.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-02 07:56:02 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "cc"
|
|
|
|
|
version = "1.4.0"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"find-msvc-tools",
|
|
|
|
|
"shlex",
|
|
|
|
|
]
|
|
|
|
|
|
2026-07-31 01:57:13 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "cfg-if"
|
|
|
|
|
version = "1.0.4"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "ciborium"
|
|
|
|
|
version = "0.2.2"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"ciborium-io",
|
|
|
|
|
"ciborium-ll",
|
|
|
|
|
"serde",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "ciborium-io"
|
|
|
|
|
version = "0.2.2"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "ciborium-ll"
|
|
|
|
|
version = "0.2.2"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"ciborium-io",
|
|
|
|
|
"half",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "clap"
|
|
|
|
|
version = "4.6.4"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "d91e0c145792ef73a6ad36d27c75ac09f1832222a3c209689d90f534685ee5b7"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"clap_builder",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "clap_builder"
|
|
|
|
|
version = "4.6.2"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"anstyle",
|
|
|
|
|
"clap_lex",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "clap_lex"
|
|
|
|
|
version = "1.1.0"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
|
|
|
|
|
|
CB-WP-0014-T01/T02: execute the JavaScript — and find AM-4b blind
ADR-0009: embed quick-js; node is refused. Measured marginal cost against
the dev-toolchain graph, under the positive control:
boa_engine 896,410
rquickjs 69,985
quick-js 11,434
node 0 <- and that zero is the problem
ADR-0007 D3's acquisition rule biting its author. CI runs on rust:1.97,
which has no node, so the test would make our build fetch a JS runtime of
tens of millions of unaudited lines while scoring zero on the only
instrument that governs dependencies. A browser is exempt because a
developer has one regardless of us; a CI-installed runtime is not.
The loop is now closed: the real server serves the real page, QuickJS
runs that page's own scripts, the gesture goes over a real socket, and
the seat's Choice comes back. Before this, every link was tested and the
chain was not — a page whose JavaScript sent something else entirely
would have passed everything.
Three controls, each red for its stated reason: the JS posting a command
name instead of ids, the gesture not being delivered (EXPECT-VACUOUS),
and the token stripped from the endpoint.
A wrong assertion worth keeping: the first draft required the body not to
contain "attack". It legitimately does — action-attack is the id of an
element a finger landed on. An element may name an action; that is not
the page deciding. The real test is the shape: exactly two fields, down
and up, carrying two ids and nothing derived from them.
AND the ADR's own cost argument was wrong. It claimed 35% of AM-4b's
headroom; after landing AM-4b did not move at all. It measures
games-ground --edges normal — one package, no dev edges. Measured, the
workspace including dev edges is 725,258 lines against AM-4b's 317,021:
408,237 uncounted, MORE THAN THE TARGET ITSELF (criterion, clap,
ciborium, quick-js). The decision stands on the acquisition rule; the
affordability argument is withdrawn. Third defect in the AM-4 family.
Also fixed structurally rather than by raising a limit: `make status` had
grown past its 40-line readability gate as workplans accumulated. Closed
workplans now collapse to one line, so the report is fixed-size.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-02 07:56:02 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "copy_dir"
|
|
|
|
|
version = "0.1.3"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "543d1dd138ef086e2ff05e3a48cf9da045da2033d16f8538fd76b86cd49b2ca3"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"walkdir",
|
|
|
|
|
]
|
|
|
|
|
|
2026-07-31 01:57:13 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "cpufeatures"
|
|
|
|
|
version = "0.2.17"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"libc",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "criterion"
|
|
|
|
|
version = "0.5.1"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "f2b12d017a929603d80db1831cd3a24082f8137ce19c69e6447f54f5fc8d692f"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"anes",
|
|
|
|
|
"cast",
|
|
|
|
|
"ciborium",
|
|
|
|
|
"clap",
|
|
|
|
|
"criterion-plot",
|
|
|
|
|
"is-terminal",
|
|
|
|
|
"itertools",
|
|
|
|
|
"num-traits",
|
|
|
|
|
"once_cell",
|
|
|
|
|
"oorandom",
|
|
|
|
|
"regex",
|
|
|
|
|
"serde",
|
|
|
|
|
"serde_derive",
|
|
|
|
|
"serde_json",
|
|
|
|
|
"tinytemplate",
|
|
|
|
|
"walkdir",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "criterion-plot"
|
|
|
|
|
version = "0.5.0"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "6b50826342786a51a89e2da3a28f1c32b06e387201bc2d19791f622c673706b1"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"cast",
|
|
|
|
|
"itertools",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "crunchy"
|
|
|
|
|
version = "0.2.4"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "crypto-common"
|
|
|
|
|
version = "0.1.7"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"generic-array",
|
|
|
|
|
"typenum",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "digest"
|
|
|
|
|
version = "0.10.7"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"block-buffer",
|
|
|
|
|
"crypto-common",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "either"
|
|
|
|
|
version = "1.17.0"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "equivalent"
|
|
|
|
|
version = "1.0.2"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
|
|
|
|
|
|
CB-WP-0014-T01/T02: execute the JavaScript — and find AM-4b blind
ADR-0009: embed quick-js; node is refused. Measured marginal cost against
the dev-toolchain graph, under the positive control:
boa_engine 896,410
rquickjs 69,985
quick-js 11,434
node 0 <- and that zero is the problem
ADR-0007 D3's acquisition rule biting its author. CI runs on rust:1.97,
which has no node, so the test would make our build fetch a JS runtime of
tens of millions of unaudited lines while scoring zero on the only
instrument that governs dependencies. A browser is exempt because a
developer has one regardless of us; a CI-installed runtime is not.
The loop is now closed: the real server serves the real page, QuickJS
runs that page's own scripts, the gesture goes over a real socket, and
the seat's Choice comes back. Before this, every link was tested and the
chain was not — a page whose JavaScript sent something else entirely
would have passed everything.
Three controls, each red for its stated reason: the JS posting a command
name instead of ids, the gesture not being delivered (EXPECT-VACUOUS),
and the token stripped from the endpoint.
A wrong assertion worth keeping: the first draft required the body not to
contain "attack". It legitimately does — action-attack is the id of an
element a finger landed on. An element may name an action; that is not
the page deciding. The real test is the shape: exactly two fields, down
and up, carrying two ids and nothing derived from them.
AND the ADR's own cost argument was wrong. It claimed 35% of AM-4b's
headroom; after landing AM-4b did not move at all. It measures
games-ground --edges normal — one package, no dev edges. Measured, the
workspace including dev edges is 725,258 lines against AM-4b's 317,021:
408,237 uncounted, MORE THAN THE TARGET ITSELF (criterion, clap,
ciborium, quick-js). The decision stands on the acquisition rule; the
affordability argument is withdrawn. Third defect in the AM-4 family.
Also fixed structurally rather than by raising a limit: `make status` had
grown past its 40-line readability gate as workplans accumulated. Closed
workplans now collapse to one line, so the report is fixed-size.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-02 07:56:02 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "find-msvc-tools"
|
|
|
|
|
version = "0.1.9"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
|
|
|
|
|
|
2026-07-31 01:57:13 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "games-ground"
|
|
|
|
|
version = "0.1.0"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"cb-events",
|
|
|
|
|
"cb-game-runtime",
|
|
|
|
|
"cb-kernel",
|
|
|
|
|
"criterion",
|
|
|
|
|
"serde",
|
CB-WP-0008-T02: cb-play — INTENT stage 0's CLI player
A human seat is a Policy like any bot, so the CLI adds no second driver:
HumanPolicy renders the projection, lists the legal commands and reads an
index or `pass`. `make play` runs it; `--all-bots` watches one.
K13's Project trait gains its first implementor after six passes with
none. Hidden: other seats' face-down selections until Reveal, hands and
deck (counts only), a face-down Problem's suit and value, and the seed —
not secret content, but a seat holding it can compute the deck.
A played session becomes an artifact: --record writes it as a scenario
the runner executes, --replay writes a .cbreplay bundle. record.rs is the
inverse of parse_command and its warrant is a round-trip test over every
command shape.
The acceptance test for the projection passed vacuously twice. First it
asserted the text contained "face-down", which every render does because
of Problems. Counted, it then reported zero inspected entries: seats are
asked in order, so a human at P1 is prompted before anyone has selected.
Seated at P3 it inspects ten entries and dies when the projection is
mutated to reveal everything. Counting what the harness examined caught
both, which is the second time that remedy has worked where a stronger
predicate would not have.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-01 14:43:53 +02:00
|
|
|
"serde_json",
|
|
|
|
|
"serde_yaml",
|
2026-07-31 01:57:13 +02:00
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "generic-array"
|
|
|
|
|
version = "0.14.7"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"typenum",
|
|
|
|
|
"version_check",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "half"
|
|
|
|
|
version = "2.7.1"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"cfg-if",
|
|
|
|
|
"crunchy",
|
|
|
|
|
"zerocopy",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "hashbrown"
|
|
|
|
|
version = "0.17.1"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "hermit-abi"
|
|
|
|
|
version = "0.5.2"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "indexmap"
|
|
|
|
|
version = "2.14.0"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"equivalent",
|
|
|
|
|
"hashbrown",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "is-terminal"
|
|
|
|
|
version = "0.4.17"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"hermit-abi",
|
|
|
|
|
"libc",
|
|
|
|
|
"windows-sys",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "itertools"
|
|
|
|
|
version = "0.10.5"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"either",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "itoa"
|
|
|
|
|
version = "1.0.18"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "libc"
|
|
|
|
|
version = "0.2.189"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
|
|
|
|
|
|
CB-WP-0014-T01/T02: execute the JavaScript — and find AM-4b blind
ADR-0009: embed quick-js; node is refused. Measured marginal cost against
the dev-toolchain graph, under the positive control:
boa_engine 896,410
rquickjs 69,985
quick-js 11,434
node 0 <- and that zero is the problem
ADR-0007 D3's acquisition rule biting its author. CI runs on rust:1.97,
which has no node, so the test would make our build fetch a JS runtime of
tens of millions of unaudited lines while scoring zero on the only
instrument that governs dependencies. A browser is exempt because a
developer has one regardless of us; a CI-installed runtime is not.
The loop is now closed: the real server serves the real page, QuickJS
runs that page's own scripts, the gesture goes over a real socket, and
the seat's Choice comes back. Before this, every link was tested and the
chain was not — a page whose JavaScript sent something else entirely
would have passed everything.
Three controls, each red for its stated reason: the JS posting a command
name instead of ids, the gesture not being delivered (EXPECT-VACUOUS),
and the token stripped from the endpoint.
A wrong assertion worth keeping: the first draft required the body not to
contain "attack". It legitimately does — action-attack is the id of an
element a finger landed on. An element may name an action; that is not
the page deciding. The real test is the shape: exactly two fields, down
and up, carrying two ids and nothing derived from them.
AND the ADR's own cost argument was wrong. It claimed 35% of AM-4b's
headroom; after landing AM-4b did not move at all. It measures
games-ground --edges normal — one package, no dev edges. Measured, the
workspace including dev edges is 725,258 lines against AM-4b's 317,021:
408,237 uncounted, MORE THAN THE TARGET ITSELF (criterion, clap,
ciborium, quick-js). The decision stands on the acquisition rule; the
affordability argument is withdrawn. Third defect in the AM-4 family.
Also fixed structurally rather than by raising a limit: `make status` had
grown past its 40-line readability gate as workplans accumulated. Closed
workplans now collapse to one line, so the report is fixed-size.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-02 07:56:02 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "libquickjs-sys"
|
|
|
|
|
version = "0.9.0"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "3f0b24e9bd171b75ae0295bd428fb8fe58410fb23156e5f34a4657a70c3cee96"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"cc",
|
|
|
|
|
"copy_dir",
|
|
|
|
|
]
|
|
|
|
|
|
2026-07-31 01:57:13 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "memchr"
|
|
|
|
|
version = "2.8.3"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "num-traits"
|
|
|
|
|
version = "0.2.19"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"autocfg",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "once_cell"
|
|
|
|
|
version = "1.21.4"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "oorandom"
|
|
|
|
|
version = "11.1.5"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "ppv-lite86"
|
|
|
|
|
version = "0.2.21"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"zerocopy",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "proc-macro2"
|
|
|
|
|
version = "1.0.107"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"unicode-ident",
|
|
|
|
|
]
|
|
|
|
|
|
CB-WP-0014-T01/T02: execute the JavaScript — and find AM-4b blind
ADR-0009: embed quick-js; node is refused. Measured marginal cost against
the dev-toolchain graph, under the positive control:
boa_engine 896,410
rquickjs 69,985
quick-js 11,434
node 0 <- and that zero is the problem
ADR-0007 D3's acquisition rule biting its author. CI runs on rust:1.97,
which has no node, so the test would make our build fetch a JS runtime of
tens of millions of unaudited lines while scoring zero on the only
instrument that governs dependencies. A browser is exempt because a
developer has one regardless of us; a CI-installed runtime is not.
The loop is now closed: the real server serves the real page, QuickJS
runs that page's own scripts, the gesture goes over a real socket, and
the seat's Choice comes back. Before this, every link was tested and the
chain was not — a page whose JavaScript sent something else entirely
would have passed everything.
Three controls, each red for its stated reason: the JS posting a command
name instead of ids, the gesture not being delivered (EXPECT-VACUOUS),
and the token stripped from the endpoint.
A wrong assertion worth keeping: the first draft required the body not to
contain "attack". It legitimately does — action-attack is the id of an
element a finger landed on. An element may name an action; that is not
the page deciding. The real test is the shape: exactly two fields, down
and up, carrying two ids and nothing derived from them.
AND the ADR's own cost argument was wrong. It claimed 35% of AM-4b's
headroom; after landing AM-4b did not move at all. It measures
games-ground --edges normal — one package, no dev edges. Measured, the
workspace including dev edges is 725,258 lines against AM-4b's 317,021:
408,237 uncounted, MORE THAN THE TARGET ITSELF (criterion, clap,
ciborium, quick-js). The decision stands on the acquisition rule; the
affordability argument is withdrawn. Third defect in the AM-4 family.
Also fixed structurally rather than by raising a limit: `make status` had
grown past its 40-line readability gate as workplans accumulated. Closed
workplans now collapse to one line, so the report is fixed-size.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-02 07:56:02 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "quick-js"
|
|
|
|
|
version = "0.4.1"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "19cb4cefcb00f4ab9b332664d06005a74f582ac16aa959c6ad5912957bd83e5f"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"libquickjs-sys",
|
|
|
|
|
"once_cell",
|
|
|
|
|
]
|
|
|
|
|
|
2026-07-31 01:57:13 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "quote"
|
|
|
|
|
version = "1.0.47"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"proc-macro2",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "rand_chacha"
|
|
|
|
|
version = "0.3.1"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"ppv-lite86",
|
|
|
|
|
"rand_core",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "rand_core"
|
|
|
|
|
version = "0.6.4"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "regex"
|
|
|
|
|
version = "1.13.1"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"aho-corasick",
|
|
|
|
|
"memchr",
|
|
|
|
|
"regex-automata",
|
|
|
|
|
"regex-syntax",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "regex-automata"
|
|
|
|
|
version = "0.4.16"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"aho-corasick",
|
|
|
|
|
"memchr",
|
|
|
|
|
"regex-syntax",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "regex-syntax"
|
|
|
|
|
version = "0.8.11"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "ryu"
|
|
|
|
|
version = "1.0.23"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "same-file"
|
|
|
|
|
version = "1.0.6"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"winapi-util",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "serde"
|
|
|
|
|
version = "1.0.229"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"serde_core",
|
|
|
|
|
"serde_derive",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "serde_core"
|
|
|
|
|
version = "1.0.229"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"serde_derive",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "serde_derive"
|
|
|
|
|
version = "1.0.229"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"proc-macro2",
|
|
|
|
|
"quote",
|
|
|
|
|
"syn 3.0.3",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "serde_json"
|
|
|
|
|
version = "1.0.151"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"itoa",
|
|
|
|
|
"memchr",
|
|
|
|
|
"serde",
|
|
|
|
|
"serde_core",
|
|
|
|
|
"zmij",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "serde_yaml"
|
|
|
|
|
version = "0.9.34+deprecated"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"indexmap",
|
|
|
|
|
"itoa",
|
|
|
|
|
"ryu",
|
|
|
|
|
"serde",
|
|
|
|
|
"unsafe-libyaml",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "sha2"
|
|
|
|
|
version = "0.10.9"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"cfg-if",
|
|
|
|
|
"cpufeatures",
|
|
|
|
|
"digest",
|
|
|
|
|
]
|
|
|
|
|
|
CB-WP-0014-T01/T02: execute the JavaScript — and find AM-4b blind
ADR-0009: embed quick-js; node is refused. Measured marginal cost against
the dev-toolchain graph, under the positive control:
boa_engine 896,410
rquickjs 69,985
quick-js 11,434
node 0 <- and that zero is the problem
ADR-0007 D3's acquisition rule biting its author. CI runs on rust:1.97,
which has no node, so the test would make our build fetch a JS runtime of
tens of millions of unaudited lines while scoring zero on the only
instrument that governs dependencies. A browser is exempt because a
developer has one regardless of us; a CI-installed runtime is not.
The loop is now closed: the real server serves the real page, QuickJS
runs that page's own scripts, the gesture goes over a real socket, and
the seat's Choice comes back. Before this, every link was tested and the
chain was not — a page whose JavaScript sent something else entirely
would have passed everything.
Three controls, each red for its stated reason: the JS posting a command
name instead of ids, the gesture not being delivered (EXPECT-VACUOUS),
and the token stripped from the endpoint.
A wrong assertion worth keeping: the first draft required the body not to
contain "attack". It legitimately does — action-attack is the id of an
element a finger landed on. An element may name an action; that is not
the page deciding. The real test is the shape: exactly two fields, down
and up, carrying two ids and nothing derived from them.
AND the ADR's own cost argument was wrong. It claimed 35% of AM-4b's
headroom; after landing AM-4b did not move at all. It measures
games-ground --edges normal — one package, no dev edges. Measured, the
workspace including dev edges is 725,258 lines against AM-4b's 317,021:
408,237 uncounted, MORE THAN THE TARGET ITSELF (criterion, clap,
ciborium, quick-js). The decision stands on the acquisition rule; the
affordability argument is withdrawn. Third defect in the AM-4 family.
Also fixed structurally rather than by raising a limit: `make status` had
grown past its 40-line readability gate as workplans accumulated. Closed
workplans now collapse to one line, so the report is fixed-size.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-02 07:56:02 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "shlex"
|
|
|
|
|
version = "2.0.1"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
|
|
|
|
|
|
2026-07-31 01:57:13 +02:00
|
|
|
[[package]]
|
|
|
|
|
name = "syn"
|
|
|
|
|
version = "2.0.119"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"proc-macro2",
|
|
|
|
|
"quote",
|
|
|
|
|
"unicode-ident",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "syn"
|
|
|
|
|
version = "3.0.3"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"proc-macro2",
|
|
|
|
|
"quote",
|
|
|
|
|
"unicode-ident",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "tinytemplate"
|
|
|
|
|
version = "1.2.1"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "be4d6b5f19ff7664e8c98d03e2139cb510db9b0a60b55f8e8709b689d939b6bc"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"serde",
|
|
|
|
|
"serde_json",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "typenum"
|
|
|
|
|
version = "1.20.1"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "unicode-ident"
|
|
|
|
|
version = "1.0.24"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "unsafe-libyaml"
|
|
|
|
|
version = "0.2.11"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "version_check"
|
|
|
|
|
version = "0.9.5"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "walkdir"
|
|
|
|
|
version = "2.5.0"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"same-file",
|
|
|
|
|
"winapi-util",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "winapi-util"
|
|
|
|
|
version = "0.1.11"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"windows-sys",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "windows-link"
|
|
|
|
|
version = "0.2.1"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "windows-sys"
|
|
|
|
|
version = "0.61.2"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"windows-link",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "zerocopy"
|
|
|
|
|
version = "0.8.55"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"zerocopy-derive",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "zerocopy-derive"
|
|
|
|
|
version = "0.8.55"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"proc-macro2",
|
|
|
|
|
"quote",
|
|
|
|
|
"syn 2.0.119",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[package]]
|
|
|
|
|
name = "zmij"
|
|
|
|
|
version = "1.0.23"
|
|
|
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
|
|
checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
|