From 20e471e6b740c8fdc8c68e12b2fa93f8f5cfab16 Mon Sep 17 00:00:00 2001 From: Sam Paniagua Date: Mon, 3 Aug 2026 17:29:46 +0200 Subject: [PATCH 1/3] fix(ci): resolve clippy and hygiene failures for ICP runtime Address clippy -D warnings in knolo-agent-icp (redundant_closure, field_reassign_with_default), reword FUTURE.md to clear the legacy identity ban, and make hygiene.sh work without ripgrep on CI runners. --- FUTURE.md | 2 +- crates/knolo-agent-icp/src/auth.rs | 6 ++++-- crates/knolo-agent-icp/src/definition.rs | 2 +- crates/knolo-agent-icp/src/stable_store.rs | 6 ++++-- scripts/hygiene.sh | 8 +++++++- 5 files changed, 17 insertions(+), 7 deletions(-) diff --git a/FUTURE.md b/FUTURE.md index fd26475..9d50eb2 100644 --- a/FUTURE.md +++ b/FUTURE.md @@ -255,7 +255,7 @@ examples, evaluation harnesses, and pre-1.0 API freeze work. Knolo Agents is deliberately **not** trying to become: -- A LangChain-style provider/orchestration framework with implicit tool discovery +- A provider/orchestration framework with implicit tool discovery or hidden network access. - A model provider, vector database, job queue, or application data layer. - A place that vendors, re-exports, or ships `@knolo/core` storage diff --git a/crates/knolo-agent-icp/src/auth.rs b/crates/knolo-agent-icp/src/auth.rs index c88a635..b7ce3f2 100644 --- a/crates/knolo-agent-icp/src/auth.rs +++ b/crates/knolo-agent-icp/src/auth.rs @@ -71,8 +71,10 @@ mod tests { #[test] fn allowlist_enforced() { - let mut limits = RuntimeLimitsV1::default(); - limits.allowed_callers = vec!["aaaaa-aa".into()]; + let limits = RuntimeLimitsV1 { + allowed_callers: vec!["aaaaa-aa".into()], + ..RuntimeLimitsV1::default() + }; let anon = Principal::anonymous(); assert!(require_run_access(anon, false, &limits).is_err()); assert!(require_run_access(anon, true, &limits).is_ok()); diff --git a/crates/knolo-agent-icp/src/definition.rs b/crates/knolo-agent-icp/src/definition.rs index bc0c908..8ef4b45 100644 --- a/crates/knolo-agent-icp/src/definition.rs +++ b/crates/knolo-agent-icp/src/definition.rs @@ -139,7 +139,7 @@ impl AgentDefinitionBundleV1 { let node_implementation_hash = format!("{:x}", Sha256::digest(bundle.implementation_id.as_bytes())); let policy = match &bundle.pack { - Some(pack) => Some(pack.compile().map_err(|e| CoreError::PackLoad(e))?), + Some(pack) => Some(pack.compile().map_err(CoreError::PackLoad)?), None => None, }; Ok(LoadedDefinition { diff --git a/crates/knolo-agent-icp/src/stable_store.rs b/crates/knolo-agent-icp/src/stable_store.rs index ff06fdd..281eeda 100644 --- a/crates/knolo-agent-icp/src/stable_store.rs +++ b/crates/knolo-agent-icp/src/stable_store.rs @@ -483,8 +483,10 @@ mod tests { ..RuntimeLimitsV1::default() }; persist_limits(&limits).unwrap(); - let mut budget = HostBudgetSnapshotV1::default(); - budget.tool_calls = 3; + let budget = HostBudgetSnapshotV1 { + tool_calls: 3, + ..HostBudgetSnapshotV1::default() + }; persist_budget(&budget).unwrap(); let snap = load_snapshot().unwrap(); assert_eq!(snap.limits.max_concurrent_executions, 4); diff --git a/scripts/hygiene.sh b/scripts/hygiene.sh index 53cfaa4..aee4edb 100755 --- a/scripts/hygiene.sh +++ b/scripts/hygiene.sh @@ -2,7 +2,12 @@ set -euo pipefail tracked=$(git ls-files) for pattern in '(^|/)(node_modules|target|dist|\.venv|coverage)(/|$)' '(^|/)(requirements[^/]*\.txt|Pipfile|poetry\.lock|pyproject\.toml|setup\.py|setup\.cfg)$' '\.(pem|key|p12|pfx)$' '(^|/)\.env($|\.)'; do - if printf '%s\n' "$tracked" | rg -i "$pattern"; then echo "forbidden tracked artifact" >&2; exit 1; fi + # Prefer rg when present; fall back to grep so CI runners without ripgrep still work. + if command -v rg >/dev/null 2>&1; then + if printf '%s\n' "$tracked" | rg -i "$pattern"; then echo "forbidden tracked artifact" >&2; exit 1; fi + else + if printf '%s\n' "$tracked" | grep -Eie "$pattern"; then echo "forbidden tracked artifact" >&2; exit 1; fi + fi done # Product comparisons are allowed in README prose; legacy integrations, # credentials, and source-level identity references remain forbidden. @@ -12,3 +17,4 @@ if find . -type l -print -quit | grep -q .; then echo "symlinks require explicit for dir in node_modules target dist .venv coverage; do if find . -type d -name "$dir" -not -path './.git/*' -print -quit | grep -q .; then echo "generated directory present: $dir" >&2; exit 1; fi done + From b928a064471789a9018d17a4a670e6737d9fe1e2 Mon Sep 17 00:00:00 2001 From: Sam Paniagua Date: Mon, 3 Aug 2026 17:34:06 +0200 Subject: [PATCH 2/3] fix(ci): repair setup-node pin and clippy question_mark lint Replace the corrupt actions/setup-node SHA (unresolvable on runners) with v4.4.0, and rewrite the executor match to use ? so clippy -D warnings passes on Rust 1.97. --- .github/workflows/ci.yml | 4 +-- .github/workflows/release.yml | 2 +- crates/knolo-agent/src/runtime/mod.rs | 47 ++++++++++++--------------- 3 files changed, 24 insertions(+), 29 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6cb002e..5666741 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: strategy: { matrix: { task: [format-lint, unit, conformance, package] } } steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - - uses: actions/setup-node@1e60f620b9541dca151540becc8114408c7e2c4a + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: { node-version: 20, cache: pnpm } - run: corepack enable && pnpm install --frozen-lockfile - run: | @@ -44,7 +44,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - - uses: actions/setup-node@1e60f620b9541dca151540becc8114408c7e2c4a + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: { node-version: 20 } - run: ./scripts/hygiene.sh - run: node scripts/check-links.mjs diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index aa02fc5..258c69e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,7 +12,7 @@ jobs: steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - uses: dtolnay/rust-toolchain@stable - - uses: actions/setup-node@1e60f620b9541dca151540becc8114408c7e2c4a + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: { node-version: 20, registry-url: https://registry.npmjs.org } - run: ./scripts/hygiene.sh - run: corepack enable && pnpm install --frozen-lockfile diff --git a/crates/knolo-agent/src/runtime/mod.rs b/crates/knolo-agent/src/runtime/mod.rs index ba33183..6a1d3b1 100644 --- a/crates/knolo-agent/src/runtime/mod.rs +++ b/crates/knolo-agent/src/runtime/mod.rs @@ -211,37 +211,32 @@ impl<'a, E: NodeExecutor, S: EventSink, C: Clock, K: CheckpointStore> Scheduler< EventKindV1::NodeStarted { attempt }, &mut events, )?; - match self.executor.execute(NodeRequest { + let x = self.executor.execute(NodeRequest { node_id: &node, state: &state, attempt, - }) { - Ok(x) => { - if let NodeOutcomeV1::Fail { - error, - retryable: true, - } = &x.outcome - { - if attempt <= self.policy.max_retries { - self.event( - &id, - Some(node.clone()), - &mut seq, - EventKindV1::Retrying { - attempt: attempt + 1, - }, - &mut events, - )?; - continue; - } - let error = error.clone(); - return self - .fail(id, node, state, events, seq, steps, tokens, cost, &error); - } - break x; + })?; + if let NodeOutcomeV1::Fail { + error, + retryable: true, + } = &x.outcome + { + if attempt <= self.policy.max_retries { + self.event( + &id, + Some(node.clone()), + &mut seq, + EventKindV1::Retrying { + attempt: attempt + 1, + }, + &mut events, + )?; + continue; } - Err(e) => return Err(e), + let error = error.clone(); + return self.fail(id, node, state, events, seq, steps, tokens, cost, &error); } + break x; }; steps += 1; tokens = tokens.saturating_add(execution.tokens); From a6a654b4d544bbd8765b126b316c0360e26084a5 Mon Sep 17 00:00:00 2001 From: Sam Paniagua Date: Mon, 3 Aug 2026 17:35:24 +0200 Subject: [PATCH 3/3] fix(ci): drop setup-node pnpm cache until corepack is enabled cache: pnpm requires pnpm on PATH before setup-node runs; this job enables pnpm via corepack afterward, so caching failed every TS matrix job. --- .github/workflows/ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5666741..12837b4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,8 @@ jobs: steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 - with: { node-version: 20, cache: pnpm } + with: { node-version: 20 } + # corepack provides pnpm; setup-node cache:pnpm requires pnpm on PATH already - run: corepack enable && pnpm install --frozen-lockfile - run: | case '${{ matrix.task }}' in