* fix(security): RUSTSEC advisories + clippy hardening in RuVector
- Replace all bare `partial_cmp().unwrap()` calls on f32/f64 with
`.unwrap_or(Ordering::Equal)` to prevent panics on NaN values in
sorting/max-by operations across ruvllm, ruvector-dag, prime-radiant,
and rvagent-wasm (12 sites in production code).
- Add input validation guards to the HTTP search endpoint: reject k=0,
k > 10_000, empty vectors, and vectors exceeding 65_536 dimensions,
preventing memory exhaustion via unbounded allocations.
- Harden LocalFsBackend::execute in rvagent-cli with env_clear() +
safe-env allowlist (SEC-005), deadline-based timeout enforcement, and
1 MB output truncation, matching the security posture of LocalShellBackend.
- Remove 129 occurrences of the deprecated `unused_unit = "allow"` lint
and 3 occurrences of the removed `clippy::match_on_vec_items` lint from
Cargo.toml files workspace-wide; both are no-ops in current Rust/Clippy.
- All 653+ tests across ruvector-core, ruvector-server, ruvector-dag,
rvagent-cli, and prime-radiant pass with zero failures.
Note: `bytes` is already at 1.11.1 (>= 1.10.0); `paste` 1.0.15 is a
transitive dependency with no semver fix available upstream; `cargo audit`
returns clean.
Co-Authored-By: claude-flow <ruv@ruv.net>
* fix(ci): cargo fmt + restore workspace unused_unit lint allow
- Run cargo fmt --all across all 9 files that drifted from rustfmt style
(prime-radiant/energy.rs, ruvector-dag/bottleneck.rs+reasoning_bank.rs,
ruvector-server/points.rs, ruvllm/pretrain_pipeline.rs+report.rs+registry.rs,
rvagent-cli/app.rs, rvagent-wasm/gallery.rs)
- Add [workspace.lints.clippy] unused_unit = "allow" to root Cargo.toml;
the per-crate entries removed in the security commit were still needed —
moving to workspace-level is cleaner and restores -D warnings CI pass
Co-Authored-By: claude-flow <ruv@ruv.net>
* fix(ci): remove unneeded unit return type in ruvix bench
Removes `-> ()` from the Fn bound in run_benchmark_with_kernel
(crates/ruvix/benches/src/ruvix.rs:50) — triggers clippy::unused_unit
under -D warnings. Clippy prefers `Fn(&mut Kernel)` without explicit
unit return.
Co-Authored-By: claude-flow <ruv@ruv.net>
* fix(ci): resolve rustfmt and clippy unused_unit failures
- Run cargo fmt --all to fix long closure formatting in 9 files
(energy.rs, bottleneck.rs, reasoning_bank.rs, points.rs,
pretrain_pipeline.rs, report.rs, registry.rs, app.rs, gallery.rs)
- Add unused_unit = "allow" to [lints.clippy] in ruvix-bench and
ruvector-mincut Cargo.toml files to suppress the unused_unit lint
that was previously suppressed globally and now fires on two
Fn(&mut T) -> () and FnMut() -> () function bounds
Co-Authored-By: claude-flow <ruv@ruv.net>
Pre-existing rustfmt drift across the workspace was blocking CI's
`Rustfmt` check on PR #373 + PR #377. Running plain `cargo fmt`
reformats 427 files; no semantic changes, no logic changes, no
behavior changes — just what rustfmt already wanted.
None of the touched files are in ruvector-rabitq, ruvector-rulake,
or the new mirror-rulake workflow — those were already fmt-clean
per the per-crate checks on commits 5a4b0d782, 5f32fd450, f5003bc7b.
Drift is in cognitum-gate-kernel, mcp-brain, nervous-system,
prime-radiant, ruqu-core, ruvector-attention, ruvector-mincut,
ruvix/* and sub-crates, plus several examples.
Verified post-fmt:
cargo check -p ruvector-rabitq -p ruvector-rulake → clean
cargo clippy -p ... -p ... --all-targets -- -D warnings → clean
cargo test -p ... -p ... --release → 82/82 pass
Intentionally does NOT touch clippy drift — many more warnings
(missing docs, precision-loss casts, too-many-args, unsafe-safety-
docs) spread across unrelated crates, each category a cross-cutting
design decision that deserves its own review.
With this commit Rustfmt CI goes green on PR #373 and PR #377.
Clippy will still fail — that's honest pre-existing state for a
separate dedicated PR.
Co-Authored-By: claude-flow <ruv@ruv.net>
run_on_cli.rs: --output-dir now writes all modules as .js files
- 1,029 Louvain-detected modules written to source/ directory
- Auto-balances braces, parens, brackets on each module
- Auto-fixes try-without-catch patterns
- Writes witness.json and metrics.json
- Writes tree hierarchy to tree/ subdirectory
Claude Code results: 722/863 modules parse (83.6%)
Remaining 141 failures mostly from paren imbalance in string edge cases.
Co-Authored-By: claude-flow <ruv@ruv.net>
Folder structure emerges from the dependency graph — not hardcoded keywords.
tree.rs (362 lines):
- Agglomerative clustering on inter-module edge weights
- TF-IDF naming: most discriminative strings name each folder
- Recursive depth control (configurable max_depth, min_folder_size)
inferrer.rs: infer_folder_name() with TF-IDF scoring
types.rs: ModuleTree struct, hierarchical config options
run_on_cli.rs: --output-dir prints folder tree to disk
module-splitter.js: JS-side tree builder with same approach
Key principle: tightly-coupled code shares a folder,
MinCut boundaries become folder boundaries, names from context.
59 tests passing, zero warnings.
Co-Authored-By: claude-flow <ruv@ruv.net>
Bottleneck 1 - Parser: 18.3s → 4.5s (4x faster)
- Single-pass body scanner replaces 3 regex passes per declaration
- scan_body_single_pass() collects strings, props, idents in one traversal
Bottleneck 2 - Partitioning: skipped → 33s (now works on 27K nodes)
- Louvain community detection for graphs ≥5K nodes
- Detects 1,029 modules in Claude Code (was 1 or skipped)
- Falls back to exact MinCut for <5K nodes
Bottleneck 3 - Memory: 592MB → 568MB (incremental, more needed)
- Pre-allocated output buffers in beautifier
- Direct write via format_declaration_into() / indent_braces_into()
Bottleneck 4 - Name inference: 5.2% → 5.2% HIGH (training data loaded)
- 50 domain-specific patterns in data/claude-code-patterns.json
- TrainingCorpus with compile-time embedding via include_str!()
- Runtime corpus loading via TrainingCorpus::from_json()
51 tests passing, zero warnings.
Co-Authored-By: claude-flow <ruv@ruv.net>
