Parfii-bot 990f5e3711 fix(substrate): E1 — kei-atom-discovery shared crate + 4 critical security fixes ... Extracts authoritative atom discovery + frontmatter parsing into new crate _primitives/_rust/kei-atom-discovery/. kei-sage and kei-runtime now both consume the same implementation, eliminating Frontmatter drift. Resolved findings: - F-3/crit#3: path traversal via md_dir.join() — safe_join helper rejects absolute paths + .. components + post-canonicalise escapes (4 sites) - crit#6/architect P0-a: Frontmatter drift — single AtomMeta struct - SA supply-chain: serde_yaml archived — migrated to serde_yaml_ng 0.10 - crit#2: JSON Schema $ref SSRF — jsonschema 0.17→0.18 with resolve-file feature only, custom LocalFileResolver denies non-file:// schemes - F-4: symlink traversal — walkdir follow_links(false) explicit everywhere - F-5: YAML billion-laughs — 64 KiB pre-parse cap Tests: 9/9 new crate + 23/23 sage + 2/2 runtime + 7/7 kei-task = 41/41 green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-04-23 00:49:49 +08:00
..
discover_smoke.rs	fix(substrate): E1 — kei-atom-discovery shared crate + 4 critical security fixes	2026-04-23 00:49:49 +08:00
lint_smoke.rs	feat(stream-d): kei-runtime — discover + validate + lint (invoke stub)	2026-04-23 00:09:58 +08:00