vunreleasedIN REPO2026-10-26
3 groups shipped
Rust security engine: byte-compatible, verified, and wired in via a TypeScript adapter.
Rust security engine
crates/veylqorix-engine- New pure-Rust engine crate (crates/, workspace manifest at crates/Cargo.toml): deterministic policy resolution, gate evaluation, exit-code mapping (0 PASS / 1 FAIL / 2 INCOMPLETE, plus the strict variant), and an offline secret scanner — exposed over a bounded JSON-over-stdio protocol (PROTOCOL_VERSION 1, SCHEMA_VERSION 1; 8 MiB input / 16 MiB output caps; process exit 0/64/65/70, where a scanner failure inside a scan is a SKIPPED/ERROR result, never a non-zero exit).
- Byte-compatible with the TypeScript core: same stable finding ids (e.g. SECRETS-8C5562BA), same redaction format (AKIA…CDEF (20 chars, redacted)), and the same gate and exitCodeFor/strictExitCode mapping — cross-verified by 60 passing cargo tests, including golden vectors, gate differential tests, secret-parity tests, and protocol e2e tests that spawn the real binary.
- TypeScript adapter (packages/core/src/engine/) wires the engine into runAudit: the engine is authoritative for the secret scanner and the gate when it is available, a fresh adapter per audit honors VEYLQORIX_ENGINE, and when the binary is missing it degrades to the byte-compatible TypeScript scanner/policy with an honest compatibility note attached to the result — never a silent pass.
- Gitleaks delegation (preferGitleaks, opt-in; the built-in offline rule set stays the authoritative default) and cargo audit for Rust ecosystems (runCargoAudit); a missing tool or a missing lockfile is reported SKIPPED and a timeout ERROR — never a silent pass.
- CI (.github/workflows/ci.yml) now sets up the Rust toolchain and runs cargo fmt --check, cargo clippy -D warnings, cargo test, and a release build before the TypeScript suite; the engine-adapter tests spawn the real binary via its stdio protocol.
- Compatibility: CLI exit codes (0/1/2/64/65/70), the MCP tool contracts, API routes, the finding schema, and redaction behavior are unchanged. Status: on main — the engine + adapter are committed; the live path runs the engine when the binary is available and degrades to the labeled TypeScript compatibility path only when the binary is not built or not present.
Plugin SDK
packages/plugin- New packages/plugin (@veylqorix/plugin v0.1.0, MIT): the scanner extension SDK. definePlugin validates and freezes a plugin (custom scanners + quality checks; plugin scanners default to mandatory: false, so a missing optional plugin tool is not the same completeness gap as a missing built-in one); toAuditOptions / withPlugin / runPluginAudit hand its evidence to runAudit — findings pass through the core's normalizeFindings (deterministic ids, severity/confidence clamping, malformed entries dropped and counted), execution is shell-free (hard timeout, capped output; plugin authors never get a raw child_process handle), and the gate stays single-sourced (Rust engine when the binary is available, byte-compatible TypeScript engine otherwise) — plugins are purely additive and never re-implement the gate.
- @veylqorix/core: runAudit accepts optional externalScanners (ScannerDefinition[], executed under the same safe wrapper as the built-ins) and externalChecks (ExternalCheck[], run after the built-in checks and honoring skipQualityChecks); defaults are empty, so existing callers are unaffected. No silent passes: a runner that throws or overruns its timeout becomes an ERROR result that blocks the gate under the default policy (exit 1) and degrades coverage to INCOMPLETE (exit 2) — never a clean pass. Thresholds and exceptions stay with the committed policy file (no gate-weakening surface), and secret redaction is the plugin author's job (redactSecret is available from core; findings flagged secret: true are subject to blockOnSecrets).
- Tests: 20 in packages/plugin/src/plugin.test.ts (definePlugin validation, bridge mapping, finding normalization, and end-to-end runPluginAudit on both gate authorities) plus 7 regression tests in packages/core/src/audit-external.test.ts pinning the no-silent-pass invariant for the extension slots.
- Docs: docs/plugin.md (authoring guide + API reference, covering the guarantees — no silent passes, normalized findings, shell-free exec, redaction is the author's job, opt-in mandatory, additive not overriding); README gains a Plugin SDK section, a "Surfaces at a glance" row, and layout/docs entries. Not yet published to npm — consume from source (workspace:*) until publish, same as the CLI.
Supply chain & release readiness
- pnpm overrides in pnpm-workspace.yaml patch all 8 vulnerabilities pnpm audit found (3 moderate, 5 high — postcss 8.4.31 and sharp 0.34.5, both transitive via next@15.5.28 and confined to the web dashboard): postcss → 8.5.31, sharp → 0.35.5, both inside the ranges next accepts — proven by a standalone site repo building clean at the same next version. CLI, API, MCP server, and core engine trees: zero audit findings.
- cargo audit on the Rust engine: 37 crate dependencies, no vulnerabilities. The committed Cargo.lock carries a SHA-256 digest per crate; pnpm-lock.yaml carries full-tree SHA-512 SRI integrity, with --frozen-lockfile enforced in CI.
- Every GitHub Action in ci.yml, veylqorix-gate.yml, and release.yml is pinned to a commit SHA (the tag in a trailing comment). No curl | sh patterns anywhere in scripts, manifests, or engine source.
- Release workflow (new, opt-in): on v* tags only, builds, packs, and runs npm publish --provenance via GitHub OIDC trusted publishing — no NPM_TOKEN, no commit/tag push. Until the owner registers the trusted publisher for both packages, the publish step fails closed; nothing publishes untrusted.
- The engine binary is built from source only — no download path exists in code or CI. Consumers run cargo build --release or point VEYLQORIX_ENGINE at a binary they control; when it is absent, runAudit degrades to the labeled TypeScript compatibility path, never a silent pass. If a binary distribution is ever added, checksum/signature verification is a standing requirement.
- Packaging hardened and dry-run-validated: files set to ["dist"] on both packages, engines and publishConfig added, tarball contents checked (no src/, lockfiles, or test output). Nothing has been published to npm yet — owner actions remaining: trusted-publisher registration, first v* tag, and an engine-binary distribution story.
Engine status
- Cargo suite:60 tests passing
- Clippy -D warnings:clean
- Release binary:crates/target/release/veylqorix-engine
- On main:yes — engine + adapter committed
- Live path today:TypeScript engine + labeled compatibility note
Next up
- Engine + adapter on main — next: publish @veylqorix/cli so non-monorepo callers run the authoritative engine
- Engine-adapter tests run the real binary in CI
- Gitleaks (preferGitleaks) and cargo audit ship behind the engine