From 8481ac2e64e94c2ac73672bbf0115a051932ff12 Mon Sep 17 00:00:00 2001 From: Sonic Shih Date: Sat, 1 Aug 2026 10:49:56 +0800 Subject: [PATCH 1/4] fix(security): bump ruint past RUSTSEC-2026-0220 in prediction-markets lockfile PR #522 updated only the main workspace lock; ploy-ci's Dependency audit scans rust_hft/prediction-markets/Cargo.lock and now fails repo-wide on lanes that trigger it. Closes #561 --- rust_hft/prediction-markets/Cargo.lock | 21 ++++----------------- 1 file changed, 4 insertions(+), 17 deletions(-) diff --git a/rust_hft/prediction-markets/Cargo.lock b/rust_hft/prediction-markets/Cargo.lock index 61d9e8aac..788bf1597 100644 --- a/rust_hft/prediction-markets/Cargo.lock +++ b/rust_hft/prediction-markets/Cargo.lock @@ -1449,7 +1449,7 @@ version = "3.9.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6dee98b0db6a962de883bf5d20362dee4d7ca0d12fe39a7c6c73c844e1cd7c1f" dependencies = [ - "darling 0.23.0", + "darling 0.20.11", "ident_case", "prettyplease", "proc-macro2", @@ -4460,7 +4460,7 @@ dependencies = [ "js-sys", "log", "wasm-bindgen", - "windows-core 0.62.2", + "windows-core 0.57.0", ] [[package]] @@ -7372,9 +7372,9 @@ dependencies = [ [[package]] name = "ruint" -version = "1.19.0" +version = "1.20.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "45caf26f647c19115bf9c453c70ffe4a4a3a6390dceebd942610584f99b8ddce" +checksum = "f5e99bff0393163bb25029a6af25d3d8d202ba5b5438a74d1bd8789f5c822970" dependencies = [ "alloy-rlp", "ark-ff 0.3.0", @@ -9901,19 +9901,6 @@ dependencies = [ "windows-strings 0.4.2", ] -[[package]] -name = "windows-core" -version = "0.62.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb" -dependencies = [ - "windows-implement 0.60.2", - "windows-interface 0.59.3", - "windows-link 0.2.1", - "windows-result 0.4.1", - "windows-strings 0.5.1", -] - [[package]] name = "windows-future" version = "0.2.1" From 5a8e57f6104376234c8391a2c1fa1ec083d4b341 Mon Sep 17 00:00:00 2001 From: Sonic Shih Date: Sat, 1 Aug 2026 10:35:36 +0800 Subject: [PATCH 2/4] test(ploy): update tape config pins for Binance kinds and tick-level sampling The scope-gated CI let #550/#548 merge without running workspace_runtime_retirement; its pinned include_kinds and quote_sample_ms went stale. Refs #540 Refs #539 --- .../prediction-markets/tests/workspace_runtime_retirement.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rust_hft/prediction-markets/tests/workspace_runtime_retirement.rs b/rust_hft/prediction-markets/tests/workspace_runtime_retirement.rs index 7ff3bd46a..6d03c169c 100644 --- a/rust_hft/prediction-markets/tests/workspace_runtime_retirement.rs +++ b/rust_hft/prediction-markets/tests/workspace_runtime_retirement.rs @@ -1676,8 +1676,8 @@ fn monday_polymarket_data_service_is_read_only_and_fail_closed() { "strategy_variant = \"noop\"", "market_data_source = \"external_direct\"", "record_market_updates_to = \"/data/monday/spool/polymarket/market-updates.ndjson\"", - "record_market_updates_include_kinds = [\"quote\", \"event_discovered\", \"event_expired\", \"reference_price\"]", - "record_market_updates_quote_sample_ms = 1000", + "record_market_updates_include_kinds = [\"quote\", \"event_discovered\", \"event_expired\", \"reference_price\", \"spot_price\", \"agg_trade\", \"l2\"]", + "record_market_updates_quote_sample_ms = 0", "record_market_updates_event_scoped_quotes = true", "symbols = [\"BTCUSDT\", \"ETHUSDT\", \"SOLUSDT\", \"XRPUSDT\", \"DOGEUSDT\", \"HYPEUSDT\", \"BNBUSDT\"]", ] { From 89db183bb08b81a764245fa29364f8367a303e19 Mon Sep 17 00:00:00 2001 From: Sonic Shih Date: Sat, 1 Aug 2026 11:42:41 +0800 Subject: [PATCH 3/4] fix(research): refresh checked-in Linux policy graph for ruint bump The build.rs graph validator requires input:Cargo.lock to hash the workspace lockfile exactly; the ruint bump changed it. ruint itself is not in the Linux policy package set, so only the input line and the canonical fingerprint need refreshing. Refs #561 --- .../ploy-research/prediction-policy-dependencies.linux.sha256 | 2 +- .../ploy-research/prediction-policy-dependencies.linux.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rust_hft/prediction-markets/crates/ploy-research/prediction-policy-dependencies.linux.sha256 b/rust_hft/prediction-markets/crates/ploy-research/prediction-policy-dependencies.linux.sha256 index a5cf720e5..65b910bad 100644 --- a/rust_hft/prediction-markets/crates/ploy-research/prediction-policy-dependencies.linux.sha256 +++ b/rust_hft/prediction-markets/crates/ploy-research/prediction-policy-dependencies.linux.sha256 @@ -1 +1 @@ -sha256:3a34b6921bca1f258953c5c2690e3ecab4e13b9d0cf8956b9b0a71b07f9aff3a +sha256:557b94facd8dcd85ae0cc8bec99a74ac1c5157c80737f52c5f23dc395de4d107 diff --git a/rust_hft/prediction-markets/crates/ploy-research/prediction-policy-dependencies.linux.txt b/rust_hft/prediction-markets/crates/ploy-research/prediction-policy-dependencies.linux.txt index 06b1eb54d..5852843ef 100644 --- a/rust_hft/prediction-markets/crates/ploy-research/prediction-policy-dependencies.linux.txt +++ b/rust_hft/prediction-markets/crates/ploy-research/prediction-policy-dependencies.linux.txt @@ -1,7 +1,7 @@ prediction-policy-dependencies.v5 target=x86_64-unknown-linux-gnu profile=default,db -input:Cargo.lock=sha256:c3346b8cd700b030d8f9a106ad7c3b6a8e776b8cdaf8d7aaa10f57b9d83b95ad +input:Cargo.lock=sha256:0ec363051667a229f6d51e27f0fddf503bf45b63784a9ed64613ebdcdb5f32d2 input:Cargo.toml=sha256:fbcd5c33c246ade9700e461e9fd62c1f56f3af262ac67d8206a29b4d0bf626f9 input:crates/ploy-research/Cargo.toml=sha256:6ca7b4b9068c6eee63e2d766399b7d79b9b0d300391149eb43b0905c8adfa957 input:crates/ploy-feed-loaders/Cargo.toml=sha256:abf8f1b8adec93b1ad84a66294cb58eb65f9cbca33c701cc81c7635eb9b35e2c From 779f85ead10db3a8e247d1f0d64c9f0e95c80364 Mon Sep 17 00:00:00 2001 From: Sonic Shih Date: Sat, 1 Aug 2026 11:50:42 +0800 Subject: [PATCH 4/4] test(research): re-pin mission templates to refreshed policy snapshot id The policy snapshot id is derived from the dependency fingerprint; the ruint lockfile refresh changed it, so the checked-in BTC/SOL mission templates must be re-pinned. Refs #561 --- .../config/research_missions/polymarket-btc-5m.example.json | 2 +- .../config/research_missions/polymarket-sol-5m.example.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rust_hft/prediction-markets/config/research_missions/polymarket-btc-5m.example.json b/rust_hft/prediction-markets/config/research_missions/polymarket-btc-5m.example.json index 507a061b1..3c919920f 100644 --- a/rust_hft/prediction-markets/config/research_missions/polymarket-btc-5m.example.json +++ b/rust_hft/prediction-markets/config/research_missions/polymarket-btc-5m.example.json @@ -15,7 +15,7 @@ "horizon": "5m", "time_cohort_boundary_ms": 0, "prompt_snapshot_id": "sha256:2b55ba0e724dfc9f5a040911e397058a09c6229e42064e4998739d617b368dcb", - "search_policy_snapshot_id": "sha256:7f7843c1345dce4c722e1ca1a93e99b134ae15197a77de8c38a99ba22eacc5a5", + "search_policy_snapshot_id": "sha256:9da8d89272797d2cb124d7bc38f5287c226fa4787f6b3f59e3b6cd6fc1f145ef", "search_budget": { "max_candidates": 6, "max_llm_calls": 2, diff --git a/rust_hft/prediction-markets/config/research_missions/polymarket-sol-5m.example.json b/rust_hft/prediction-markets/config/research_missions/polymarket-sol-5m.example.json index 4ab02ff49..5a9590a02 100644 --- a/rust_hft/prediction-markets/config/research_missions/polymarket-sol-5m.example.json +++ b/rust_hft/prediction-markets/config/research_missions/polymarket-sol-5m.example.json @@ -15,7 +15,7 @@ "horizon": "5m", "time_cohort_boundary_ms": 0, "prompt_snapshot_id": "sha256:0816ebccf4c75ee6bdcfe315b253c84ddf1808a38687ebe3b924b87bd72a52a9", - "search_policy_snapshot_id": "sha256:7f7843c1345dce4c722e1ca1a93e99b134ae15197a77de8c38a99ba22eacc5a5", + "search_policy_snapshot_id": "sha256:9da8d89272797d2cb124d7bc38f5287c226fa4787f6b3f59e3b6cd6fc1f145ef", "search_budget": { "max_candidates": 6, "max_llm_calls": 2,