From 3b264489e2593c09cb414a0f19e611b303ee0f1e Mon Sep 17 00:00:00 2001 From: Cody Kickertz Date: Wed, 16 Sep 2026 10:20:48 -0500 Subject: [PATCH 1/2] chore(repo): drop host topology from public config and docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The published contract is the software, not the machine it happens to build on. Four sites named a specific host, its core count, its resident services, or a local home-directory layout. - .kanon-ci.toml: strip the host name, core count, CPU class and resident service names from the concurrency pin's rationale, but keep the part that is a property of the build rather than of the machine — the ~25GB peak a single run holds under at 8 — so a reader still has the bar that tells them raising or dropping the pin is wrong. The pin itself is unchanged. - CLAUDE.md: the preamble deferred to two absolute home paths; it now states the rule (host and environment conventions live outside this repository) without naming either. - .kanon-orchestration-exceptions.toml: the justification keeps its substance — authored directly on main before the worktree convention — minus the host name and the era jargon. - standards/README.md: point at the standards path inside the kanon repository rather than at one checkout's home directory. --- .kanon-ci.toml | 15 +++++++++------ .kanon-orchestration-exceptions.toml | 2 +- CLAUDE.md | 2 +- standards/README.md | 2 +- 4 files changed, 12 insertions(+), 9 deletions(-) diff --git a/.kanon-ci.toml b/.kanon-ci.toml index 5e919c9..885b53d 100644 --- a/.kanon-ci.toml +++ b/.kanon-ci.toml @@ -6,12 +6,15 @@ # # Prepends the public Phase A contract check to the hardcoded default Rust # gate (fmt → check → clippy → nextest → lint), then pins per-stage build and -# test concurrency to 8. Without this -# cap, cargo defaults to num_cpus (64 on this Threadripper) and parallel -# rustc + nextest processes peak well over 100GB of RSS — enough to OOM -# menos when any other fleet work is running. 8 is the budget that keeps -# a single CI run under ~25GB peak, low enough that serial drains don't -# OOM even with aletheia.service and the dispatch fleet resident. +# test concurrency to 8. The pin is a memory bound, not a speed knob: this +# workspace's parallel rustc and nextest processes are RSS-heavy and peak +# memory scales with the job count. 8 is the calibrated value that holds a +# single run under ~25GB peak, which is what leaves headroom for anything +# else resident on the build machine. Raise it and peak RSS climbs past that +# bar; delete it and the job count follows cargo's num_cpus default — a +# property of whichever machine runs CI rather than of this build — and on a +# wide enough host the peak clears that bar by a multiple, enough to OOM the +# run and whatever else is resident alongside it. # # Keep in sync with `crates/archeion/src/ci_config.rs::default_rust_gate` # when the upstream default changes — only the `--jobs` / `--test-threads` diff --git a/.kanon-orchestration-exceptions.toml b/.kanon-orchestration-exceptions.toml index 651d8bf..56467f9 100644 --- a/.kanon-orchestration-exceptions.toml +++ b/.kanon-orchestration-exceptions.toml @@ -2,4 +2,4 @@ # Format: "<40-hex-sha>" = "" — justification required. [main_worktree_commit] -94a77ebb2a38a031c21b57c411a65e7e5509a628 = "T0 operator-session lockfile-only security fix (RUSTSEC-2026-0190, #56) authored during the 2026-07 boxless window before the worktree convention was re-established on metis; follow-ups on this branch are worktree-authored." +94a77ebb2a38a031c21b57c411a65e7e5509a628 = "T0 lockfile-only security fix (RUSTSEC-2026-0190, #56) authored directly on main in 2026-07, before the worktree convention was re-established; follow-ups on this branch are worktree-authored." diff --git a/CLAUDE.md b/CLAUDE.md index 6a0b85f..1eb769c 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,6 +1,6 @@ diff --git a/standards/README.md b/standards/README.md index fddd946..5f4aa3f 100644 --- a/standards/README.md +++ b/standards/README.md @@ -1,3 +1,3 @@ # Standards -Canonical fleet standards live in kanon at `~/dev/kanon/crates/basanos/standards/STANDARDS.md`. This pointer file replaces the per-repo standards copy that was drifting (D-049, kanon backlog). +Canonical fleet standards live in the kanon repository at `crates/basanos/standards/STANDARDS.md`. This pointer file replaces the per-repo standards copy that was drifting (D-049, kanon backlog). From 9577bf0e9cdc1dbcfa4c2abc3ed33391dde83a05 Mon Sep 17 00:00:00 2001 From: Cody Kickertz Date: Wed, 16 Sep 2026 15:09:52 -0500 Subject: [PATCH 2/2] fix(deps): update rustls to 0.23.45 for RUSTSEC-2026-0285 --- Cargo.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index c181b6b..141609a 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1161,9 +1161,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "log", "once_cell", @@ -1185,9 +1185,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "ring", "rustls-pki-types",