Audit #8: fix 32 findings across 27 files (2C/10H/12M/8L)

Comprehensive API audit pass addressing security, correctness, and
enterprise-readiness gaps across core Parquet, crypto, AI/compliance,
Thrift, and interop layers. 779/779 tests pass.

Author: Johnson-Ogundeji

CMakePresets.json

@@ -176,6 +176,11 @@
             "cacheVariables": {
                 "CMAKE_BUILD_TYPE": "Debug",
                 "SIGNET_BUILD_TESTS": "ON",
+                "SIGNET_ENABLE_COMMERCIAL": "ON",
+                "SIGNET_ENABLE_CRYPTO": "ON",
+                "SIGNET_ENABLE_ZSTD": "ON",
+                "SIGNET_ENABLE_LZ4": "ON",
+                "SIGNET_ENABLE_GZIP": "ON",
                 "CMAKE_CXX_FLAGS": "-fprofile-instr-generate -fcoverage-mapping",
                 "CMAKE_EXE_LINKER_FLAGS": "-fprofile-instr-generate"
             }

README.md

@@ -3,11 +3,11 @@
 **Standalone C++20 Parquet library with AI-native extensions.**
 Zero mandatory dependencies. Header-mostly. Interoperable with Arrow, DuckDB, Spark, and Polars.
 
-[![CI](https://github.com/SIGNETSTACK/signet-forge/actions/workflows/ci.yml/badge.svg)](https://github.com/SIGNETSTACK/signet-forge/actions)
+[![CI](https://github.com/SIGNETSTACK/SIGNET_FORGE/actions/workflows/ci.yml/badge.svg)](https://github.com/SIGNETSTACK/SIGNET_FORGE/actions)
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![C++20](https://img.shields.io/badge/C%2B%2B-20-blue.svg)](https://en.cppreference.com/w/cpp/20)
 [![Python](https://img.shields.io/badge/Python-3.10%2B-blue.svg)](python/)
-[![codecov](https://codecov.io/gh/SIGNETSTACK/signet-forge/graph/badge.svg)](https://codecov.io/gh/SIGNETSTACK/signet-forge)
+[![codecov](https://codecov.io/gh/SIGNETSTACK/SIGNET_FORGE/graph/badge.svg)](https://codecov.io/gh/SIGNETSTACK/SIGNET_FORGE)
 
 [**Try it in your browser — drag & drop any .parquet file**](https://signetstack.github.io/SIGNET_FORGE/demo/) | [**API Reference**](https://signetstack.github.io/SIGNET_FORGE/)
 

include/signet/ai/audit_chain.hpp

@@ -115,9 +115,10 @@ inline int64_t now_ns() {
     // R-5: system_clock provides UTC traceability per MiFID II RTS 25 Art.2.
     auto ns = std::chrono::duration_cast<std::chrono::nanoseconds>(
                   std::chrono::system_clock::now().time_since_epoch()).count();
-    int64_t expected = last_ns.load(std::memory_order_relaxed);
+    int64_t expected = last_ns.load(std::memory_order_acquire);
     while (ns <= expected) { ns = expected + 1; }
-    while (!last_ns.compare_exchange_weak(expected, ns, std::memory_order_relaxed)) {
+    while (!last_ns.compare_exchange_weak(expected, ns,
+                std::memory_order_release, std::memory_order_acquire)) {
         if (ns <= expected) ns = expected + 1;
     }
     return ns;

include/signet/ai/column_batch.hpp

@@ -177,7 +177,8 @@ class ColumnBatch {
     [[nodiscard]] std::span<const double> column_span(size_t col_idx) const {
         if (col_idx >= columns_.size())
             return {};
-        return {columns_[col_idx].data(), num_rows_};
+        return {columns_[col_idx].data(),
+                std::min(num_rows_, columns_[col_idx].size())};
     }
 
     // -------------------------------------------------------------------------
@@ -236,8 +237,11 @@ class ColumnBatch {
 
         // CWE-190: Integer Overflow or Wraparound — check row count fits in
         // uint32_t before narrowing cast into the serialization header.
-        if (num_rows_ > static_cast<size_t>(UINT32_MAX))
-            return StreamRecord{}; // silently return empty record for oversized batch
+        if (num_rows_ > static_cast<size_t>(UINT32_MAX)) {
+            throw std::overflow_error(
+                "ColumnBatch::to_stream_record: num_rows exceeds UINT32_MAX ("
+                + std::to_string(num_rows_) + ") — batch too large for WAL serialization");
+        }
         const auto ncols = static_cast<uint32_t>(schema_.size());
         const auto nrows = static_cast<uint32_t>(num_rows_);
 
@@ -250,11 +254,15 @@ class ColumnBatch {
         {
             const size_t ncols_sz = static_cast<size_t>(ncols);
             const size_t nrows_sz = static_cast<size_t>(nrows);
-            if (ncols_sz > 0 && nrows_sz > SIZE_MAX / ncols_sz)
-                return StreamRecord{}; // overflow
+            if (ncols_sz > 0 && nrows_sz > SIZE_MAX / ncols_sz) {
+                throw std::overflow_error(
+                    "ColumnBatch::to_stream_record: ncols*nrows overflows size_t");
+            }
             const size_t cells = ncols_sz * nrows_sz;
-            if (cells > SIZE_MAX / sizeof(double))
-                return StreamRecord{}; // overflow
+            if (cells > SIZE_MAX / sizeof(double)) {
+                throw std::overflow_error(
+                    "ColumnBatch::to_stream_record: payload size overflows size_t");
+            }
             payload_bytes += sizeof(double) * cells;
         }
 

include/signet/ai/compliance/eu_ai_act_reporter.hpp

@@ -107,6 +107,7 @@ class EUAIActReporter {
         std::vector<InferenceRecord> records;
         bool        chain_ok = true;
         std::string chain_id;
+        int         read_errors = 0;
 
         for (const auto& path : inference_log_files) {
             auto rdr_result = InferenceLogReader::open(path);
@@ -124,7 +125,7 @@ class EUAIActReporter {
                 if (meta) chain_id = meta->chain_id;
             }
             auto all = rdr.read_all();
-            if (!all) continue;
+            if (!all) { ++read_errors; continue; }
             for (auto& rec : *all)
                 if (rec.timestamp_ns >= opts.start_ns &&
                     rec.timestamp_ns <= opts.end_ns)
@@ -142,6 +143,11 @@ class EUAIActReporter {
         ComplianceReport report = make_report_skeleton(
             ComplianceStandard::EU_AI_ACT_ART12, opts,
             static_cast<int64_t>(records.size()), chain_ok, chain_id);
+        if (read_errors > 0) {
+            report.incomplete_data = true;
+            report.read_errors.push_back("Art.12: failed to read " + std::to_string(read_errors)
+                + " of " + std::to_string(inference_log_files.size()) + " inference log files");
+        }
 
         report.content = format_article12_json(records, opts, report);
         return report;
@@ -171,6 +177,7 @@ class EUAIActReporter {
         std::vector<InferenceRecord> records;
         bool        chain_ok = true;
         std::string chain_id;
+        int         read_errors = 0;
 
         for (const auto& path : inference_log_files) {
             auto rdr_result = InferenceLogReader::open(path);
@@ -187,7 +194,7 @@ class EUAIActReporter {
                 if (meta) chain_id = meta->chain_id;
             }
             auto all = rdr.read_all();
-            if (!all) continue;
+            if (!all) { ++read_errors; continue; }
             for (auto& rec : *all)
                 if (rec.timestamp_ns >= opts.start_ns &&
                     rec.timestamp_ns <= opts.end_ns)
@@ -201,6 +208,11 @@ class EUAIActReporter {
         ComplianceReport report = make_report_skeleton(
             ComplianceStandard::EU_AI_ACT_ART13, opts,
             static_cast<int64_t>(records.size()), chain_ok, chain_id);
+        if (read_errors > 0) {
+            report.incomplete_data = true;
+            report.read_errors.push_back("Art.13: failed to read " + std::to_string(read_errors)
+                + " of " + std::to_string(inference_log_files.size()) + " inference log files");
+        }
 
         report.content = format_article13_json(records, opts, report);
         return report;
@@ -234,6 +246,7 @@ class EUAIActReporter {
         std::vector<DecisionRecord> dec_records;
         bool dec_chain_ok = true;
         std::string dec_chain_id;
+        int dec_read_errors = 0;
 
         for (const auto& path : decision_log_files) {
             auto rdr_result = DecisionLogReader::open(path);
@@ -250,7 +263,7 @@ class EUAIActReporter {
                 if (meta) dec_chain_id = meta->chain_id;
             }
             auto all = rdr.read_all();
-            if (!all) continue;
+            if (!all) { ++dec_read_errors; continue; }
             for (auto& rec : *all)
                 if (rec.timestamp_ns >= opts.start_ns &&
                     rec.timestamp_ns <= opts.end_ns)
@@ -261,6 +274,7 @@ class EUAIActReporter {
         std::vector<InferenceRecord> inf_records;
         bool inf_chain_ok = true;
         std::string inf_chain_id;
+        int inf_read_errors = 0;
 
         for (const auto& path : inference_log_files) {
             auto rdr_result = InferenceLogReader::open(path);
@@ -277,7 +291,7 @@ class EUAIActReporter {
                 if (meta) inf_chain_id = meta->chain_id;
             }
             auto all = rdr.read_all();
-            if (!all) continue;
+            if (!all) { ++inf_read_errors; continue; }
             for (auto& rec : *all)
                 if (rec.timestamp_ns >= opts.start_ns &&
                     rec.timestamp_ns <= opts.end_ns)
@@ -309,6 +323,16 @@ class EUAIActReporter {
         ComplianceReport report = make_report_skeleton(
             ComplianceStandard::EU_AI_ACT_ART19, opts, total, chain_ok,
             dec_chain_id.empty() ? inf_chain_id : dec_chain_id);
+        if (dec_read_errors > 0) {
+            report.incomplete_data = true;
+            report.read_errors.push_back("Art.19: failed to read " + std::to_string(dec_read_errors)
+                + " of " + std::to_string(decision_log_files.size()) + " decision log files");
+        }
+        if (inf_read_errors > 0) {
+            report.incomplete_data = true;
+            report.read_errors.push_back("Art.19: failed to read " + std::to_string(inf_read_errors)
+                + " of " + std::to_string(inference_log_files.size()) + " inference log files");
+        }
 
         report.content = format_article19_json(
             dec_records, inf_records, opts, report,
@@ -553,7 +577,7 @@ class EUAIActReporter {
             o += ind2 + "\"level\":" + sp + std::to_string(opts.risk_level) + "," + nl;
             const char* risk_labels[] = {"","minimal","limited","high","unacceptable"};
             o += ind2 + "\"label\":" + sp + "\""
-               + std::string(opts.risk_level <= 4 ? risk_labels[opts.risk_level] : "unknown")
+               + std::string((opts.risk_level >= 0 && opts.risk_level <= 4) ? risk_labels[opts.risk_level] : "unknown")
                + "\"" + nl;
             o += ind + "}," + nl;
         }

include/signet/ai/decision_log.hpp

@@ -402,9 +402,12 @@ struct DecisionRecord {
         return true;
     }
 
+    static constexpr uint32_t MAX_STRING_LEN = 16u * 1024u * 1024u; // 16 MB
+
     static inline bool read_string(const uint8_t* data, size_t size, size_t& offset, std::string& out) {
         uint32_t len = 0;
         if (!read_le32_u(data, size, offset, len)) return false;
+        if (len > MAX_STRING_LEN) return false;
         if (offset + len > size) return false;
         out.assign(reinterpret_cast<const char*>(data + offset), len);
         offset += len;

include/signet/ai/feature_reader.hpp

@@ -120,8 +120,7 @@ class FeatureReader {
             total_rows_       = o.total_rows_;
             failed_file_count_= o.failed_file_count_;
             readers_          = std::move(o.readers_);
-            std::lock_guard<std::mutex> lk(rg_cache_mutex_);
-            std::lock_guard<std::mutex> lk2(o.rg_cache_mutex_);
+            std::scoped_lock lk(rg_cache_mutex_, o.rg_cache_mutex_);
             rg_cache_         = std::move(o.rg_cache_);
         }
         return *this;

include/signet/ai/inference_log.hpp

@@ -337,9 +337,12 @@ struct InferenceRecord {
         return true;
     }
 
+    static constexpr uint32_t MAX_STRING_LEN = 16u * 1024u * 1024u; // 16 MB
+
     static inline bool read_string(const uint8_t* data, size_t size, size_t& offset, std::string& out) {
         uint32_t len = 0;
         if (!read_le32_u(data, size, offset, len)) return false;
+        if (len > MAX_STRING_LEN) return false;
         if (offset + len > size) return false;
         out.assign(reinterpret_cast<const char*>(data + offset), len);
         offset += len;

include/signet/ai/tensor_bridge.hpp

@@ -238,8 +238,11 @@ class TensorView {
     }
 
     /// Total byte size of the tensor data (num_elements * element_size).
+    /// Returns 0 if num_elements() is non-positive (empty or error shape).
     [[nodiscard]] size_t byte_size() const noexcept {
-        return static_cast<size_t>(num_elements()) * element_size();
+        const int64_t n = num_elements();
+        if (n <= 0) return 0;
+        return static_cast<size_t>(n) * element_size();
     }
 
     /// Effective stride in bytes along the first dimension.

include/signet/ai/vector_type.hpp

@@ -260,13 +260,15 @@ class VectorWriter {
     }
 
     /// Add a batch of vectors (num_vectors vectors, each `dimension` elements, row-major).
-    inline void add_batch(const float* data, size_t num_vectors) {
+    /// @return true on success, false on overflow (batch rejected entirely).
+    inline bool add_batch(const float* data, size_t num_vectors) {
         const size_t dim = spec_.dimension;
-        // Overflow check: num_vectors * dim must not overflow size_t
-        if (num_vectors > 0 && dim > 0 && num_vectors > SIZE_MAX / dim) return;
+        if (dim == 0 || num_vectors == 0) return true;
+        if (num_vectors > SIZE_MAX / dim) return false;
         for (size_t i = 0; i < num_vectors; ++i) {
             add(data + i * dim);
         }
+        return true;
     }
 
     /// Flush the buffered vectors and return the encoded page bytes.