fix(deps): complete sha2 0.11 upgrade

[seonghobae]

Summary

Completes the sha2 0.10.9 → 0.11.0 production dependency upgrade without changing the sampling-design provenance contract.

Closes #1693. Supersedes closed Dependabot PR #1683.

This branch also carries the non-competing implementation of the release-boundary decision tracked by #1715: mlsirm-core remains the internal Rust numerical owner and fast-mlsirm-py remains the internal PyO3 binding crate inside the released fast-mlsirm Maturin/PyPI product. Neither Cargo package is a separately published crates.io product.

Exact RED / RCA

Dependabot exact head c0b4427de3bf39d4dcd189d2f3a615c6d7ed0d97 is real hosted RED evidence. CI #7497 fails at crates/mlsirm-core/src/sampling_design.rs:156 with Rust E0277 because sha2 0.11 returns a hybrid-array digest output that no longer implements LowerHex; the predecessor helper used format!("{:x}", Sha256::digest(bytes)). ClusterFuzzLite #1425 and package/GPU/Python/fuzz compile failures are downstream of that same Rust compile boundary.

Fresh review exposed a second dependency-integrity defect: the workspace-excluded crates/fast-mlsirm-py/Cargo.lock and the independent fuzz/Cargo.lock still resolved the predecessor dependency graph after the core requirement moved to 0.11.0. Temporary diagnostic head 78e6d1904db7c5996bf7122b7f3c7e3420be5957 regenerated both independent locks successfully and produced the immutable sha2-standalone-locks artifact. Later commits did not change the relevant core/fuzz manifests. The PyO3 lock was committed earlier; exact commit 5128a2b0e9d13a43c8e1e1c3179950d00973b532 commits the artifact-identical fuzz lock as well. Its Git blob SHA 9e6cd1ac9565a7ccd9c78996c5c2d3ec101800c4 matches the downloaded diagnostic artifact and resolves sha2 0.11.0 with the same crates.io checksum as the PyO3 lock.

Current fail-closed regression tests/test_cargo_lock_dependency_contract.py requires all three committed lock roots (/, /crates/fast-mlsirm-py, /fuzz) to resolve the exact sha2 requirement declared by mlsirm-core.

For #1715, the first source-level RED is 9f522186b4f3055339ef2494bf2e88be1ad10723: tests/test_rust_distribution_boundary.py requires the Rust numerical core to be non-publishable, keeps fast-mlsirm as the published project, pins Maturin to crates/fast-mlsirm-py/Cargo.toml, requires the governed PyPI publisher, and rejects a cargo publish path. The preceding core manifest did not declare publish = false.

A second deterministic RED, 5f380567a9b1081ae53a4f23b24f0e4f82597bb8, closes the remaining release-boundary hole: the same contract now requires crates/fast-mlsirm-py/Cargo.toml to be non-publishable as well. Its parent tree still left the PyO3 implementation crate registry-publishable by Cargo default, so an organization-level registry credential could be mistaken for authority to create a second product surface.

Fix

• Retain the root sha2 = "0.11.0" dependency upgrade.
• Serialize the 32 digest bytes explicitly with a package-owned lowercase hexadecimal lookup table.
• Preserve the existing canonical byte inputs and exact 64-character lowercase SHA-256 wire format.
• Leave the existing deterministic input/output SHA golden tests unchanged so hosted CI proves identity stability across the dependency API change.
• Commit both independently regenerated standalone lock graphs; the repository regression prevents a future partial lock refresh from going green.
• Set crates/mlsirm-core/Cargo.toml publish = false at GREEN commit 441df12afce14f66189e1f1bb795a794ce8a7ebc.
• Set crates/fast-mlsirm-py/Cargo.toml publish = false at GREEN commit e6335d1174fa9fb8b2cecbb9d1bedb2b54383df2, so neither internal Rust implementation crate can become a crates.io product merely because Cargo registry credentials exist.
• Update accepted ADR-0027, Rust registry-boundary doctoring, the buyer/product-readiness boundary and changelog fragment so the executable test, manifests and product documentation all describe the same Maturin/PyPI release boundary.
• Feature PRs intentionally contribute the authoritative changelog fragment; the derived root CHANGELOG.md remains release-cut owned and is serialized at release time.

The release-boundary decision follows the current architecture and product-readiness authority: the sellable unit remains the local Python/Rust fast-mlsirm package, while a separately published Rust SDK/crate requires an independently versioned release cadence, compatibility policy, registry ownership, security/SBOM/provenance evidence, and clean downstream registry-install evidence. Credential availability alone is not such authority.

No sampling formula, finite-population interval, allocation, estimator, uncertainty, Python numerical ownership, branch protection, review gate, or psychometric release claim is changed.

Remaining #1715 acceptance

docs/product-technical-gap-baseline.md is a large point-in-time inventory and has not been safely rewritten on this branch because its current active owner is a different PR lane. #1715 therefore remains open; this PR does not claim that issue completed. The existing v0.9.2 release-cut PR #1471 also changes crates/mlsirm-core/Cargo.toml and the derived changelog, so it must be freshly reconciled after the upstream manifest decision rather than raced or silently overwritten.

Current landing authority

Protected main is b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c. The current branch head is 756cf889a111717725de806329e8e5a64bbb5bc0, a non-destructive reconciliation commit (chore(core): reconcile Rust distribution lane with protected main); GitHub reports the PR open, Ready, and mergeable with main as base. All currently visible review threads are resolved.

Exact-current required-workflow evidence is not green: organization-required CodeQL PR run 33634336124 terminated startup_failure; CI 33634327987 remains pending and OSV/Scorecard/ClusterFuzzLite/repository CodeQL/Security Scan/SAST Semgrep remain queued at the latest fresh read. Those states are non-passing, and predecessor checks are historical after the reconciliation.

The zero-job/startup and queue-liveness class is already on the canonical central .github owner path; this leaf does not churn source, weaken gates, or create a no-op retrigger commit. Exact-current Rust workspace, standalone PyO3 --locked, fuzz --locked, tests/test_rust_distribution_boundary.py, package/GPU/fuzz/security checks, unchanged deterministic sampling identity tests, changelog-fragment/ADR fitness, and committed-lock parity remain authoritative for landing. Protected-main independent approval/last-push policy remains mandatory. No self-approval, bypass, force push, destructive rebase, or predecessor-evidence transfer is authorized.

---

Summary by CodeRabbit

• Bug Fixes

  • Corrected SHA-256 hexadecimal output so digests always use the expected 64-character, lowercase format.
  • Added consistent zero-padding for digest bytes, preventing malformed or unexpectedly shortened hash values.

• Maintenance

  • Updated the cryptographic hashing component to a newer release for improved compatibility and reliability.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 1b4d7179-8bb7-4e1a-9160-113ed3a4a979

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 648c0aad-6459-49d3-8cbe-6c0259394d29

📥 Commits

Reviewing files that changed from the base of the PR and between 4562770 and 1981473.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• crates/mlsirm-core/Cargo.toml
• crates/mlsirm-core/src/sampling_design.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change upgrades sha2 to 0.11.0 and updates sha256_hex to produce fixed-length, lowercase 64-character SHA-256 strings through manual byte encoding.

Changes

SHA-256 compatibility and serialization

Layer / File(s)	Summary
SHA-2 upgrade and fixed-width encoding crates/mlsirm-core/Cargo.toml, crates/mlsirm-core/src/sampling_design.rs	The sha2 dependency changes to 0.11.0. The sha256_hex helper manually encodes every digest byte with two lowercase hexadecimal characters.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 19814

This change updates SHA-256 byte encoding for compatibility with sha2 0.11 while preserving the existing 64-character lowercase provenance format. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.
Linked Issues check	❓ Inconclusive	The dependency and sha256_hex changes address the linked issue. The helper preserves lowercase, fixed-length SHA-256 serialization. Cargo.lock is excluded by the !**/*.lock path filter, so coherent lo…	Review Cargo.lock and confirm that the sha2 0.11.0 dependency graph is coherent. Confirm the existing deterministic identity tests and required CI checks are green before landing.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The reported changes are limited to the sha2 dependency upgrade and the compatible SHA-256 hex serialization required by the linked issue. No unrelated changes are shown.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: completing the sha2 0.11.0 dependency upgrade and applying the required compatibility fix.

Full details: Linked Issues check

Explanation

The dependency and sha256_hex changes address the linked issue. The helper preserves lowercase, fixed-length SHA-256 serialization. Cargo.lock is excluded by the !**/*.lock path filter, so coherent lockfile updates cannot be verified from the available evidence.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/sha2-0.11-compat-1693

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cwl-noema-review]

Noema LLM review

The PR diff and additional context indicate a successful upgrade of the sha2 dependency to version 0.11.0, with no apparent issues or regressions. The review threads and CodeGraph context also do not reveal any significant concerns. Therefore, the PR can be approved as is.

Findings

• No blocking findings.

• Result: APPROVE

• Head SHA: 19814737f84d3ad294095b7ad7781770886479f9

• Reviewer credential: noema-review-github-app

• Actor: cwl-noema-review[bot]

[cwl-noema-review]

Noema LLM review

The PR is well-structured and the changes are correct, but there are some blocking issues that need to be addressed before the PR can be merged. The excluded locked builds no longer resolve due to stale lockfiles, and the independent manifest edits skip diagnostics due to missing paths. These issues need to be fixed before the PR can be merged.

Findings

• [high] crates/mlsirm-core/Cargo.toml:18: Excluded locked builds no longer resolve due to stale lockfiles.

• [high] .github/workflows/lockfile-diagnostic.yml:10: Independent manifest edits skip diagnostics due to missing paths.

• Result: REQUEST_CHANGES

• Head SHA: 65d1748ba258046c3038e277f48d61a6d726fb77

• Reviewer credential: noema-review-github-app

• Actor: cwl-noema-review[bot]

[cwl-noema-review]

Noema LLM review

The PR introduces a version bump of the sha2 crate to 0.11.0, but the lockfiles are not updated accordingly, which may cause issues with the build process. Additionally, the lockfile diagnostic workflow is not updated to handle the new version of sha2. The PR also introduces a new version of the const-oid crate, but the dependencies are not updated accordingly. The PR is missing a test case to verify the correctness of the updated lockfiles and the lockfile diagnostic workflow.

Findings

• [high] .github/workflows/lockfile-diagnostic.yml:1: The lockfile diagnostic workflow is not updated to handle the new version of sha2.

• [medium] Cargo.lock:1: The lockfiles are not updated accordingly, which may cause issues with the build process.

• [low] crates/mlsirm-core/Cargo.toml:1: The dependencies are not updated accordingly for the new version of const-oid.

• Result: REQUEST_CHANGES

• Head SHA: 78e6d1904db7c5996bf7122b7f3c7e3420be5957

• Reviewer credential: noema-review-github-app

• Actor: cwl-noema-review[bot]

[seonghobae]

Current-head note after the sha2 API compatibility fix: hosted head 19814737f84d3ad294095b7ad7781770886479f9 proved the source fix and unchanged sampling SHA golden identities across CI/Security/CodeQL/Semgrep/ClusterFuzz, but Devin correctly found that the two excluded workspaces still carry stale standalone lockfiles. A hosted resolver run has independently generated both replacement locks and verified cargo metadata --locked for crates/fast-mlsirm-py/Cargo.toml and fuzz/Cargo.toml; those generated files are not yet committed, so the lockfile finding remains unresolved and this PR must not land yet. Temporary diagnostic workflow code has been removed from the branch. The attempted Ready→Draft lifecycle mutation was blocked before execution by the connector GraphQL layer; the exact PR remained Ready, so treat this comment and the unresolved review thread as the explicit landing block rather than bypassing the lifecycle mutation.

[cwl-noema-review]

Noema LLM review

The PR diff and additional context indicate that the sha2 0.11 upgrade is complete and the lockfiles are up-to-date. The changes are correct and do not introduce any security, maintainability, or behavioral regressions. The only open issue is the excluded locked builds no longer resolving, but this is addressed in the prior review thread and does not affect the overall approval of the PR.

Findings

• [medium] crates/mlsirm-core/Cargo.toml:18: Excluded locked builds no longer resolve due to stale lockfiles.

• Result: APPROVE

• Head SHA: f0c358e48d2980a2897c5fe661b24cc807f740bb

• Reviewer credential: noema-review-github-app

• Actor: cwl-noema-review[bot]

[seonghobae]

Fresh exact-head blocker evidence for f0c358e48d2980a2897c5fe661b24cc807f740bb: crates/fast-mlsirm-py/Cargo.lock still pins sha2 0.10.9 even though this PR's root workspace graph and mlsirm-core manifest are on 0.11.0. Because pyproject.toml builds the extension from the excluded standalone PyO3 manifest, current package/wheel provenance is not yet a coherent 0.11 graph.

The underlying automation gap is now isolated as #1696: .github/dependabot.yml omitted /crates/fast-mlsirm-py as a Cargo update root. A test-first branch fix/dependabot-pyo3-lock-1696 adds that missing root and a regression over all three repository-owned Cargo lock roots. Its PR-create mutation was blocked before execution by the platform safety classifier, so no PR exists for that branch yet; do not infer repository permission or product completion from that tooling block.

Keep #1694 open but non-landing until the standalone PyO3 lock is updated to the exact 0.11 graph and exact-current package/GPU/fuzz/security evidence is rerun. The diagnostic artifact already generated a candidate lock, but I did not copy a broad/generated lock into the branch through an unsafe or lossy write path.

[seonghobae]

@opencode-agent Please review exact current head 5128a2b0e9d13a43c8e1e1c3179950d00973b532. The existing opencode-review failure started before central .github#1546 landed and is historical infrastructure evidence, not a current-head semantic verdict. Review only; do not update the branch, merge, or weaken gates.

[seonghobae]

@opencode-agent review

Fresh review-only request for exact current head a8e403bd578c9e258cb5bd3592536e6f5d90396a on protected main@45627700c26c29bca150896a9519a9b7426acb56. This head now includes the non-competing #1715 release-boundary decision (mlsirm-core internal numerical crate with publish = false, ADR-0027/doctoring/contract evidence) in the existing Cargo-manifest writer rather than creating a third competing manifest PR. All visible review threads are resolved; new CI/Security/CodeQL/Semgrep are pending/queued and predecessor review/check evidence must not transfer. Review only; no merge, branch update, or auto-fix requested by this invocation.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seonghobae]

Fresh landing-authority update (2026-09-07): the branch was non-force merge-forwarded onto protected main@493326f2de49ea1704da0ded19868ed05d2fe00f using merge commit 0e139c8542408252f3b00f52433f2c4572b57024; no history rewrite or predecessor-check transfer was used. The PR base was refreshed to main, and GitHub now reports the effective diff as the 13 sha2/distribution-boundary files only; docs/product-technical-gap-baseline.md is not in the current effective diff, so its separate canonical writer remains untouched.

The prior organization CodeQL PR startup_failure cannot be rerun because GitHub created no jobs for that attempt. The restack/Ready transition produced a fresh exact-head bundle instead: CI 34107143720 and repository CodeQL 34107130819 are in progress; required CodeQL PR 34107130807, Security 34107131013, Semgrep 34107130853, and ClusterFuzzLite 34107143777 are queued at this read. Draft-event skipped runs are lifecycle evidence only. No merge/approval/GA claim transfers to this new head.