n-rodriguez

prometheus_exporter — Code Audit

Date: 2026-08-26 · Audited revision: ec4c481 (main)

Scope: whole repository, 102 tracked files — 75 production, 27 tests (audited as meta), 0 vendored. Coverage: 47/47 lib/ files read line by line · exe/, bench/, examples/ (3/3) · both GitHub workflows · all 5 gemfiles/ · 12 of the 14 root files. Not read, no audit surface: LICENSE.txt, CODE_OF_CONDUCT.md. README.md was read selectively (~330 lines out of 1060: CLI, Docker, TLS, requirements, examples, authentication sections), not in full — the documentation-drift findings cover those sections only. bin/appraisal, bin/rubocop, bin/stree are Bundler-generated binstubs (role: generated); only bin/rake was read.

86 findings: 4 CRITICAL, 22 HIGH, 38 MEDIUM, 17 LOW, 5 NIT.

n-rodriguez

crystal-pg — Road to 1.0: comprehensive audit

Multi-dimension audit of crystal-pg (pg shard, v0.30.0, crystal-db ~> 0.14.0) toward a 1.0 tag. Dimensions: correctness, concurrency / fiber-safety, error model, perf/memory/CPU, PostgreSQL protocol completeness, public API / SemVer surface, test coverage + unaudited files.

Headline findings (compile / wire-format / security) were verified by hand against the source. Citations are file:line.

ℹ️ Transparency: produced with Claude Opus 4.8 [1M] (multi-pass static review, 6 parallel agents), then the blockers were hand-verified.

The good news first

n-rodriguez

spider-gazelle/bindata — comprehensive audit (road to 1.0), produced with Claude Opus 4.8 [1M] and hand-verified

spider-gazelle/bindata — comprehensive audit (road to 1.0)

The foundations are good. The declarative macro DSL (field/bit_field/group/endian) is elegant, the CustomException hierarchy is clean, the generated ParseError/WriteError wrapping is exactly right, and the ASN.1/BER support is ambitious. The suite passes (50 examples, 0 failures). What follows is a constructive map of what stands between today and a 1.0 tag — and I'm offering to contribute the fixes, starting with the blockers.

ℹ️ Transparency: this audit was produced with Claude Opus 4.8 [1M] (multi-pass static review), then the headline findings were hand-verified by compiling/running repros against the source (Crystal 1.20.2). Items tagged VERIFIED have program output behind them.

Summary by tier

n-rodriguez

Road to 1.0 — Comprehensive audit of crystal-ldap

Audited against master. The core architecture is genuinely good — BER encoding cleanly delegated to bindata, request/response correlation by messageID over Promise, a dedicated read fiber decoupled from write, a real FilterParser, and a composable filter algebra (&/|/~). The bones are solid. This document maps what stands between today and a 1.0 tag, organized by severity tier with a suggested phased plan. Everything is cited file:line.

A short umbrella issue links here; per-tier child issues can track the work.

ℹ️ Produced with Claude Opus 4.8 [1M] (multi-pass static review); the headline RFC/wire-format findings were verified by hand against the source.

---

n-rodriguez

Road to 1.0 — Comprehensive audit of mcp.cr

Audited against main. The core architecture is genuinely good — capability-derived handler wiring, a clean transport abstraction, a real typed MCPError, and an ergonomic @[MCP::Tool] annotator. This document maps what stands between today and a 1.0 tag, organized by severity tier with a suggested phased plan. Everything is cited file:line.

A short umbrella issue links here; per-tier child issues track the work.

---

Tier 0 — Blockers (compile/break when the path is exercised)

n-rodriguez

/cache/nicolas/concerto/ruby-wip-sidekiq/ruby/3.4.0/gems/measured-3.2.0/lib/measured/parser.rb:36: [BUG] Segmentation fault at 0x0000000000000000
ruby 3.4.2 (2025-02-15 revision d2930f8e7a) +PRISM [x86_64-linux]

-- Control frame information -----------------------------------------------
c:0063 p:---- s:0329 e:000328 CFUNC  :captures
c:0062 p:0056 s:0325 e:000324 METHOD /cache/nicolas/concerto/ruby-wip-sidekiq/ruby/3.4.0/gems/measured-3.2.0/lib/measured/parser.rb:36
c:0061 p:0046 s:0319 e:000318 METHOD /cache/nicolas/concerto/ruby-wip-sidekiq/ruby/3.4.0/gems/measured-3.2.0/lib/measured/unit.rb:59
c:0060 p:0062 s:0314 e:000313 METHOD /cache/nicolas/concerto/ruby-wip-sidekiq/ruby/3.4.0/gems/measured-3.2.0/lib/measured/unit.rb:11 [FINISH]
c:0059 p:---- s:0305 e:000304 CFUNC  :new
c:0058 p:0041 s:0299 e:000298 METHOD /cache/nicolas/concerto/ruby-wip-sidekiq/ruby/3.4.0/gems/measured-3.2.0/lib/measured/unit.rb:18

n-rodriguez

```sh
/builds/concerto/concerto/lib/concerto/core_ext/sentry_patch.rb:31: [BUG] Segmentation fault at 0x0000000000000000
ruby 3.4.2 (2025-02-15 revision d2930f8e7a) +PRISM [x86_64-linux]

-- Control frame information -----------------------------------------------
c:0064 p:---- s:0335 e:000334 CFUNC  :prepend_features
c:0063 p:---- s:0332 e:000331 CFUNC  :prepend
c:0062 p:0020 s:0327 e:000326 TOP    /builds/concerto/concerto/lib/concerto/core_ext/sentry_patch.rb:31 [FINISH]
c:0061 p:---- s:0324 e:000323 CFUNC  :require
c:0060 p:0054 s:0319 e:000318 BLOCK  /home/nonroot/.asdf/installs/ruby/3.4.2/lib/ruby/3.4.0/bundled_gems.rb:82

n-rodriguez

# Traversing arrays and objects in CoffeeScript

# The array and object we use for testing
arr = [1, 2, 3, 4, 5]
obj = {a: 1, b: 2, c: 3, d: 4, e: 5}


# 'in' has a different meaning in CoffeeScript than in JavaScript
# CS: element in array -> JS: array.indexOf(element) >= 0
console.log '5 in arr: ' + (5 in arr)

n-rodriguez

diff --git a/init.rb b/init.rb
index 0d3028b..65f949c 100644
--- a/init.rb
+++ b/init.rb
@@ -18,7 +18,7 @@
 # along with redmine_checklists.  If not, see <http://www.gnu.org/licenses/>.
 
 require 'redmine'
-require 'redmine_checklists/redmine_checklists'
+require 'redmine_checklists'

n-rodriguez

diff --git a/init.rb b/init.rb
index 57ff0d8..c2d2bdb 100755
--- a/init.rb
+++ b/init.rb
@@ -107,6 +107,4 @@ Redmine::Plugin.register :redmine_contacts do

 end

-ActionDispatch::Callbacks.to_prepare do
-  require 'redmine_contacts'