Fix audit findings: soundness, coverage reporting, docs, and review follow-ups #1

Merged
trevon merged 18 commits from fix/audit-findings into master 2026-09-25 06:48:08 +00:00
3 changed files with 9 additions and 4 deletions
Showing only changes of commit f0fe006d6b - Show all commits

fix(docs,tests): correct the pre-push hook claim, a dead link, MCP cleanup

Problem: the README said setup enables "tracked ... OpenGrep pre-push
hooks", but only .githooks/pre-commit is tracked, so fresh clones get no
pre-push hook. docs/research/prior-art.md pointed to prior-art-full.md,
which has never been in the repository. test_mcp_stdio's TempDir
destructor called the throwing remove_all overload; a failure during
unwinding terminates the test binary and leaves .fold-mcp-test-*
directories behind.

Fix: the README names only the tracked pre-commit hook. The pre-push
hook is not committed: it runs `opengrep --config auto`, which needs the
network. The dead reference is removed. TempDir uses the error_code
remove_all overload. It stays under the working directory, because the
MCP server rejects paths outside its workspace root (moving it to
temp_directory_path broke three MCP tests).

Test: mcp_stdio passes.
trvon 2026-09-24 20:57:32 -06:00
Signed by: trevon
GPG key ID: 38686EA797D7A8A7

View file

@ -13,8 +13,7 @@ Requires system-installed LLVM/Clang 18+ and `libz3` development
headers; Conan handles the rest (spdlog, CLI11, nlohmann_json,
sqlite3, Catch2). **See [BUILD.md](BUILD.md) for per-platform
apt/brew install lines and a Docker validation harness.** Setup also enables
the tracked lint pre-commit and OpenGrep pre-push hooks; install
[OpenGrep](https://opengrep.dev/) before pushing.
the tracked lint pre-commit hook (`.githooks/pre-commit`).
## Usage

View file

@ -1,6 +1,6 @@
# Prior Art (condensed)
Key papers grounding fold's design. Full annotations in `prior-art-full.md`.
Key papers grounding fold's design.
## Buffer overflow
- **Xu et al. (2020)** *ELAID.* doi:10.1186/s42400-020-00058-2 — interprocedural call graph + SMT on Juliet sinks.

View file

@ -57,13 +57,19 @@ struct TempDir {
std::filesystem::path path;
TempDir()
// Must stay under the working directory: the MCP server rejects paths
// outside its workspace root.
: path(std::filesystem::current_path() /
(".fold-mcp-test-" +
std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()))) {
std::filesystem::create_directories(path);
}
~TempDir() { std::filesystem::remove_all(path); }
// Non-throwing: a destructor that throws during unwinding terminates.
~TempDir() {
std::error_code ec;
std::filesystem::remove_all(path, ec);
}
};
void writeFile(const std::filesystem::path& path, const std::string& content) {