INT-14 — Add a dedicated `benchmark` CI job to .gitea/workflows/ci.yml.
On pushes to main it saves a Criterion baseline. On pull requests it
loads the baseline and fails the job if Criterion reports a regression.
INT-15 — Add EmbeddingAnomalyDetector to anomaly.rs.
Uses Welford's online algorithm to maintain a running mean and per-
dimension variance. Evaluates each new embedding via diagonal
Mahalanobis distance (mean squared z-score); embeddings that exceed
the threshold are returned as EmbeddingVerdict::Quarantine with a
reason string, signalling the caller to store them in a quarantine
dataset rather than the primary store.
Includes a warmup phase (always Accept) to seed statistics before
the detector becomes meaningful.
Added 5 unit tests covering warmup, in-distribution, outlier,
dimension-mismatch, and count tracking.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
INT-02: Add [profile.release.package.clawhdf5-format] overflow-checks=true to
root Cargo.toml — provides defense-in-depth for untrusted byte offset
arithmetic in the HDF5 format parser.
INT-03: Install cargo-audit in Gitea CI workflow and call it from ci-test.sh
with --deny warnings. The script gracefully skips the step if cargo-audit is
not installed locally, so developer machines are unaffected.
INT-05: Add three cycle-safety tests for KnowledgeCache:
- test_bfs_neighbors_cycle_terminates: A→B→C→A, verifies b and c appear once
- test_bfs_neighbors_self_loop_terminates: self-loop A→A, verifies empty result
- test_spreading_activation_cycle_converges: cyclic graph with decay_factor 0.5,
verifies finite convergence and all nodes receive activation
The BFS visited-set guard was already present; these tests lock it in as a
regression boundary so future refactors cannot silently remove it.
- Add .gitea/workflows/ci.yml running scripts/ci-test.sh (fmt, clippy,
test, no_std check) on push/PR to main.
- Fix stale rustyhdf5-py/rustyhdf5-format package names in
ci-test.sh/check-nostd.sh, which had been silently no-op'ing those
checks (cargo warns but doesn't fail on an unknown --exclude/-p
target).
- With those checks actually running, fix the real issues they surface:
- clippy: useless_conversion in chunked_write.rs, byte_char_slices in
global_heap.rs/object_header.rs.
- cargo fmt: apply formatting across the workspace (whitespace only).
- no_std (thumbv7em-none-eabihf) build errors in clawhdf5-format:
core::sync::atomic::AtomicU64 doesn't exist on that target (no
native 64-bit atomics) — switch profiling.rs's counters to
portable-atomic, which falls back to a CAS-based emulation there
and is a no-op wrapper elsewhere. Add missing alloc imports for
Box (filters.rs), Vec (filters_szip.rs), and format! (dict_encoding.rs)
on no_std paths. Replace f64::powi (std/libm-only) with a small
local exponentiation-by-squaring helper in the scale-offset filter.