{"id":49306905,"url":"https://github.com/stsoftwareau/neat-ai-core","last_synced_at":"2026-06-13T09:05:31.530Z","repository":{"id":352192968,"uuid":"1214098083","full_name":"stSoftwareAU/NEAT-AI-core","owner":"stSoftwareAU","description":"Rust core logic","archived":false,"fork":false,"pushed_at":"2026-04-26T04:05:18.000Z","size":218,"stargazers_count":1,"open_issues_count":3,"forks_count":0,"subscribers_count":0,"default_branch":"Develop","last_synced_at":"2026-04-26T05:16:23.453Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stSoftwareAU.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-04-18T05:47:17.000Z","updated_at":"2026-04-26T04:15:18.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/stSoftwareAU/NEAT-AI-core","commit_stats":null,"previous_names":["stsoftwareau/neat-ai-core"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/stSoftwareAU/NEAT-AI-core","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stSoftwareAU%2FNEAT-AI-core","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stSoftwareAU%2FNEAT-AI-core/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stSoftwareAU%2FNEAT-AI-core/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stSoftwareAU%2FNEAT-AI-core/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stSoftwareAU","download_url":"https://codeload.github.com/stSoftwareAU/NEAT-AI-core/tar.gz/refs/heads/Develop","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stSoftwareAU%2FNEAT-AI-core/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32292958,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-26T09:34:17.070Z","status":"ssl_error","status_checked_at":"2026-04-26T09:34:00.993Z","response_time":129,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-04-26T10:01:24.361Z","updated_at":"2026-06-13T09:05:31.525Z","avatar_url":"https://github.com/stSoftwareAU.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# NEAT-AI-core\n\n**Native shared Rust** for [NEAT-AI](https://github.com/stSoftwareAU/NEAT-AI): the **`neat-core`** crate (tests included) lives here as a Cargo workspace member.\n\n## Test-driven development\n\nDevelopment in this repository follows **TDD**: do not merge behaviour changes unless **`cargo test --workspace`** already covers them (extend tests first when fixing bugs or adding APIs). Run **`./quality.sh`** before every commit/PR.\n\n## WebAssembly\n\n**`wasm_activation`** and **`pkg/`** remain in the **NEAT-AI** repo on `Develop` — not in this repository.\n\n## Layout\n\n| Path | Role |\n|------|------|\n| `neat-core/` | Shared computation library; **140+** unit tests in `src/**/*.rs` plus integration tests in `neat-core/tests/` (\u003e350 total). |\n| `Cargo.toml` | Virtual workspace root; `[workspace.package]` holds semver for release automation. |\n| `deny.toml` | `cargo deny` (licences, advisories, bans). |\n| `quality.sh` | Local gate (fmt, clippy, tests, doc, deny, bats). |\n| `.github/workflows/ci.yml` | CI gate. The `rust-gates` job runs the lint (`cargo clippy -D warnings`) and compile/syntax (`cargo check --all-targets`) gates on **every push to `Develop` and every pull request**; the `quality` job is the full PR pipeline. |\n| `bump-deps.sh` | Cargo dep refresh + audit + native/WASM build (Vibe Coder hook). |\n| `.github/dependabot.yml` | Advisory-triggered security-update fast lane — raises a fix PR the moment a RustSec/OSV advisory lands, independent of the weekly bump. |\n| `tests/scripts/` | `bats` suites for shell helpers (e.g. `bump-deps.sh`). |\n| `LICENSE`, `.gitleaks.toml` | Inherited from NEAT-AI `Develop`. |\n\n## Build\n\n```bash\nexport RUSTFLAGS=\"-D warnings\"\ncargo test --workspace\n# or full gate:\n./quality.sh\n```\n\n## Related Repositories\n\nThe NEAT-AI project is split across seven public repositories. Each focuses on one concern and composes with the others as shown below.\n\n| Repository | Role |\n|------------|------|\n| [NEAT-AI](https://github.com/stSoftwareAU/NEAT-AI) | Primary Deno/TypeScript neural-network engine (evolution, training, WASM activation). |\n| [NEAT-AI-core](https://github.com/stSoftwareAU/NEAT-AI-core) | Shared native Rust library (`neat-core`) with numerics, topology helpers, and the chunked `.bin` training stream. |\n| [NEAT-AI-Discovery](https://github.com/stSoftwareAU/NEAT-AI-Discovery) | Rust discovery module invoked by NEAT-AI via Deno FFI to search architectures and hyper-parameters. |\n| [NEAT-AI-Snapshot](https://github.com/stSoftwareAU/NEAT-AI-Snapshot) | Creature/genome snapshot format and fixtures produced by NEAT-AI and consumed by downstream tools. |\n| [NEAT-AI-scorer](https://github.com/stSoftwareAU/NEAT-AI-scorer) | Production forward-only scoring application built on `neat-core` via a path dependency. |\n| [NEAT-AI-Explore](https://github.com/stSoftwareAU/NEAT-AI-Explore) | Visualiser for creatures that reads NEAT-AI-Snapshot data. |\n| [NEAT-AI-Examples](https://github.com/stSoftwareAU/NEAT-AI-Examples) | Worked examples and tutorials that depend on NEAT-AI. |\n\n### Dependency graph\n\n```mermaid\ngraph TD\n    Core[NEAT-AI-core\u003cbr/\u003eRust shared lib]\n    Main[NEAT-AI\u003cbr/\u003eDeno/TypeScript engine]\n    Discovery[NEAT-AI-Discovery\u003cbr/\u003eRust, via Deno FFI]\n    Snapshot[NEAT-AI-Snapshot\u003cbr/\u003ecreature data]\n    Scorer[NEAT-AI-scorer\u003cbr/\u003eRust scorer app]\n    Explore[NEAT-AI-Explore\u003cbr/\u003evisualiser]\n    Examples[NEAT-AI-Examples\u003cbr/\u003etutorials]\n\n    Main --\u003e|Deno FFI| Discovery\n    Main --\u003e|produces| Snapshot\n    Scorer --\u003e|path dependency| Core\n    Explore --\u003e|reads| Snapshot\n    Examples --\u003e|depends on| Main\n```\n\n## Propagation to downstream repositories\n\nOnce an enhancement merges to `Develop` here, it flows automatically to the\nnext pull request raised in either consumer repository — no manual SHA bump\nis required. The two consumer paths differ in mechanism but share the same\nVibe Coder hook (`bump-deps.sh` runs before `quality.sh` on every PR).\n\n### NEAT-AI (Deno + WASM consumer)\n\n- On every push to `Develop`, [`.github/workflows/wasm-bundle.yml`](.github/workflows/wasm-bundle.yml)\n  builds `wasm_activation-pkg.tar.gz` and publishes a per-commit GitHub\n  Release tagged `wasm-bundle-\u003cSHA\u003e`.\n- NEAT-AI's `bump-deps.sh` invokes `./build.sh`, which downloads the matching\n  bundle and updates `deno.json`'s `neatCore.rev` field in lock-step.\n- A fresh PR in NEAT-AI is therefore sufficient to pick up the latest\n  `Develop` of NEAT-AI-core.\n- The published bundle (and its CycloneDX SBOM) carries a Sigstore-backed\n  build-provenance attestation, so a consumer can cryptographically confirm\n  the tarball was produced by this workflow from the pinned commit before\n  trusting it. Verify in the bump flow with:\n\n  ```bash\n  gh attestation verify wasm_activation-pkg.tar.gz \\\n    --repo stSoftwareAU/NEAT-AI-core\n  ```\n\n  Pinning by SHA and the post-publish content re-verification prove the\n  bundle's *shape*; the attestation proves its *origin*, closing the\n  published-artefact-substitution attack class.\n\n### NEAT-AI-scorer (Rust + path dependency)\n\n- NEAT-AI-scorer's CI uses `actions/checkout` to clone\n  `stSoftwareAU/NEAT-AI-core@Develop` into the workspace on every PR.\n- `rust_scorer/Cargo.toml`'s `path = \"../../NEAT-AI-core/neat-core\"` resolves\n  against that fresh clone, so the next PR build always compiles against the\n  current tip of `Develop`.\n- No SHA pin or release artefact is involved on this path.\n\n### End-to-end flow\n\n```mermaid\nsequenceDiagram\n    actor Dev as Maintainer\n    participant Core as NEAT-AI-core/Develop\n    participant CI as wasm-bundle.yml\n    participant Rel as GitHub Release\u003cbr/\u003ewasm-bundle-{SHA}\n    participant Main as NEAT-AI PR\n    participant Scorer as NEAT-AI-scorer PR\n\n    Dev-\u003e\u003eCore: merge enhancement\n    Core-\u003e\u003eCI: push to Develop\n    CI-\u003e\u003eCI: attest build provenance (Sigstore, keyless)\n    CI-\u003e\u003eRel: build \u0026 publish wasm_activation-pkg.tar.gz\n    Dev-\u003e\u003eMain: open PR\n    Main-\u003e\u003eRel: bump-deps.sh -\u003e build.sh download\n    Main-\u003e\u003eRel: gh attestation verify (origin proof)\n    Note over Main: deno.json neatCore.rev advances\n    Dev-\u003e\u003eScorer: open PR\n    Scorer-\u003e\u003eCore: actions/checkout @Develop\n    Note over Scorer: path dep resolves fresh clone\n```\n\n### Wiring reference\n\n| Consumer | Trigger | Script / workflow |\n|----------|---------|-------------------|\n| NEAT-AI-core | push to `Develop` | [`.github/workflows/wasm-bundle.yml`](.github/workflows/wasm-bundle.yml) |\n| NEAT-AI | PR opened (Vibe Coder hook) | `NEAT-AI/bump-deps.sh` → `NEAT-AI/build.sh` |\n| NEAT-AI-scorer | PR opened (CI) | `NEAT-AI-scorer/.github/workflows/ci.yml` (`actions/checkout` of `NEAT-AI-core@Develop`) |\n\n### Race window\n\n`wasm-bundle.yml` typically takes ~30–60 seconds to build and publish the\nrelease after a merge to `Develop`. PRs raised in NEAT-AI inside that\nwindow may transiently fail the bundle download in `build.sh` because the\nrelease tag for the latest `Develop` SHA does not yet exist. Re-run the\nPR's checks once the bundle workflow has completed, or wait a minute\nbefore opening the PR.\n\n## Dependency updates: two channels\n\nDependency refresh runs on two complementary channels so the urgent\n\"patch this advisory now\" path is decoupled from the routine weekly bump:\n\n- **Routine bump** — [`.github/workflows/upgrade-dependencies.yml`](.github/workflows/upgrade-dependencies.yml)\n  runs `bump-deps.sh` every Monday (`cron \"0 6 * * 1\"`), applying the\n  `VIBE_BUMP_QUARANTINE_HOURS` release-age quarantine, `cargo audit`, and\n  dual native/WASM builds before raising a general upgrade PR.\n- **Security fast lane** — [`.github/dependabot.yml`](.github/dependabot.yml)\n  enables Dependabot's Cargo **security-updates** channel. When a\n  RustSec/OSV advisory lands against a crate already in `Cargo.lock`,\n  Dependabot raises a fix PR immediately — independent of the weekly window.\n\nAdvisory *detection* still lives in [`security.yml`](.github/workflows/security.yml)\nand the `ci.yml` `security` job (`cargo audit` / `rustsec/audit-check`); the\nnew channel is what *raises* the remediation PR rather than waiting for Monday.\n\nWhen an actively-exploited advisory's fix is newer than the\n`VIBE_BUMP_QUARANTINE_HOURS` window, an approver can take the documented\n**emergency quarantine override** — dispatch *Upgrade Cargo Dependencies* with\n`emergency_bypass: true` (or run `./bump-deps.sh --quarantine-hours 0`) and\nconfirm `cargo audit` is clean before merge. See\n[`SECURITY.md`](SECURITY.md#emergency-quarantine-override).\n\n```mermaid\nflowchart TD\n    Adv[RustSec/OSV advisory disclosed] --\u003e Detect[cargo audit detects\u003cbr/\u003esecurity.yml / ci.yml]\n    Detect --\u003e|fails PR / scheduled job| Alert[Maintainer alerted]\n    Adv --\u003e Dependabot[dependabot.yml\u003cbr/\u003esecurity-updates channel]\n    Dependabot --\u003e|immediate| FixPR[Advisory fix PR]\n    Cron[Weekly cron Mon 06:00] --\u003e Bump[upgrade-dependencies.yml\u003cbr/\u003ebump-deps.sh]\n    Bump --\u003e|general refresh| GenPR[Weekly upgrade PR]\n    FixPR --\u003e Develop[Develop]\n    GenPR --\u003e Develop\n```\n\n## License\n\nApache-2.0 — see `LICENSE`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstsoftwareau%2Fneat-ai-core","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstsoftwareau%2Fneat-ai-core","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstsoftwareau%2Fneat-ai-core/lists"}