* fix(security): RUSTSEC advisories + clippy hardening in RuVector
- Replace all bare `partial_cmp().unwrap()` calls on f32/f64 with
`.unwrap_or(Ordering::Equal)` to prevent panics on NaN values in
sorting/max-by operations across ruvllm, ruvector-dag, prime-radiant,
and rvagent-wasm (12 sites in production code).
- Add input validation guards to the HTTP search endpoint: reject k=0,
k > 10_000, empty vectors, and vectors exceeding 65_536 dimensions,
preventing memory exhaustion via unbounded allocations.
- Harden LocalFsBackend::execute in rvagent-cli with env_clear() +
safe-env allowlist (SEC-005), deadline-based timeout enforcement, and
1 MB output truncation, matching the security posture of LocalShellBackend.
- Remove 129 occurrences of the deprecated `unused_unit = "allow"` lint
and 3 occurrences of the removed `clippy::match_on_vec_items` lint from
Cargo.toml files workspace-wide; both are no-ops in current Rust/Clippy.
- All 653+ tests across ruvector-core, ruvector-server, ruvector-dag,
rvagent-cli, and prime-radiant pass with zero failures.
Note: `bytes` is already at 1.11.1 (>= 1.10.0); `paste` 1.0.15 is a
transitive dependency with no semver fix available upstream; `cargo audit`
returns clean.
Co-Authored-By: claude-flow <ruv@ruv.net>
* fix(ci): cargo fmt + restore workspace unused_unit lint allow
- Run cargo fmt --all across all 9 files that drifted from rustfmt style
(prime-radiant/energy.rs, ruvector-dag/bottleneck.rs+reasoning_bank.rs,
ruvector-server/points.rs, ruvllm/pretrain_pipeline.rs+report.rs+registry.rs,
rvagent-cli/app.rs, rvagent-wasm/gallery.rs)
- Add [workspace.lints.clippy] unused_unit = "allow" to root Cargo.toml;
the per-crate entries removed in the security commit were still needed —
moving to workspace-level is cleaner and restores -D warnings CI pass
Co-Authored-By: claude-flow <ruv@ruv.net>
* fix(ci): remove unneeded unit return type in ruvix bench
Removes `-> ()` from the Fn bound in run_benchmark_with_kernel
(crates/ruvix/benches/src/ruvix.rs:50) — triggers clippy::unused_unit
under -D warnings. Clippy prefers `Fn(&mut Kernel)` without explicit
unit return.
Co-Authored-By: claude-flow <ruv@ruv.net>
* fix(ci): resolve rustfmt and clippy unused_unit failures
- Run cargo fmt --all to fix long closure formatting in 9 files
(energy.rs, bottleneck.rs, reasoning_bank.rs, points.rs,
pretrain_pipeline.rs, report.rs, registry.rs, app.rs, gallery.rs)
- Add unused_unit = "allow" to [lints.clippy] in ruvix-bench and
ruvector-mincut Cargo.toml files to suppress the unused_unit lint
that was previously suppressed globally and now fires on two
Fn(&mut T) -> () and FnMut() -> () function bounds
Co-Authored-By: claude-flow <ruv@ruv.net>
- Run cargo fmt --all to fix formatting in 362 files across the entire workspace
- Add PGDG repository for PostgreSQL 17 in CI test-all-features and benchmark jobs
- Add missing rvf dependency crates to standalone Dockerfile for domain-expansion
- Add sona-learning and domain-expansion features to standalone Dockerfile build
- Create npu.rs stub for ruvector-sparse-inference (fixes rustfmt resolution error)
Co-Authored-By: claude-flow <ruv@ruv.net>
- Updated ruqu-core README with 5 simulation backends, cost-model planner,
QEC control plane, OpenQASM 3.0, cryptographic witnesses, transpiler
- Fixed ruqu-wasm npm badge and imports to use @ruvector/ruqu-wasm scope
- Published to crates.io: ruqu-core, ruqu-algorithms, ruqu-exotic, ruqu-wasm
- Published to npm: @ruvector/ruqu-wasm@2.0.5
Co-Authored-By: claude-flow <ruv@ruv.net>
Published to crates.io: ruqu-core, ruqu-algorithms, ruqu-exotic, ruqu-wasm
Published to npm: @ruvector/ruqu-wasm@2.0.4
Co-Authored-By: claude-flow <ruv@ruv.net>
Complete proof of Deutsch's theorem with phase kickback lemma and
step-by-step derivation. Compares five major formulations:
- Deutsch (1985): original probabilistic version (p=1/2)
- Deutsch-Jozsa (1992): deterministic n-bit, 2 queries
- Cleve-Ekert-Macchiavello-Mosca (1998): deterministic, single query
- Nielsen-Chuang (2000): canonical textbook presentation
- Calude (2006): de-quantization using higher-dimensional classical bits
Includes de-quantization critique (Abbott et al.), classical wave
analogies, and analysis of when quantum advantage is genuine vs
artifactual.
Adds 6 verification tests to ruqu-algorithms confirming all four
oracles produce deterministic correct results via the ruqu-core
simulator, including a phase-kickback amplitude-level check.
https://claude.ai/code/session_01B1NkbLDWYPaacS9miKsnvW
Full Rust implementation of the quantum simulation engine as specified
in ADR-QE-001 through ADR-QE-012:
ruqu-core: State-vector simulator with 2^n complex amplitudes, single
and two-qubit gate kernels (H, X, Y, Z, S, T, Rx, Ry, Rz, CNOT, CZ,
SWAP, Rzz), projective measurement with collapse, expectation values
for Pauli strings and Hamiltonians, gate fusion optimizer, circuit
builder API, and multi-shot simulator with noise model support.
ruqu-algorithms: VQE with hardware-efficient ansatz and parameter-shift
gradients, Grover's search with optimal iteration count, QAOA MaxCut
with Rzz phase separation, and distance-3 rotated surface code with
syndrome extraction and lookup decoder.
ruqu-wasm: WebAssembly bindings via wasm-bindgen exposing circuit
construction, simulation, Grover search, and QAOA to browser clients
with 25-qubit memory limit.
257 tests passing across all crates. Criterion benchmarks included for
gate throughput, bell state preparation, algorithm scaling, and memory
allocation across 4-20 qubit systems.
https://claude.ai/code/session_01B1NkbLDWYPaacS9miKsnvW
