2026 03 12 yq

.github/workflows/check-shell.yml

@@ -38,4 +38,5 @@ jobs:
       - run: nix develop --command flamegraph --help
       - run: nix develop --command graph --version
       - run: nix develop --command goldsky --version
+      - run: nix develop --command yq --version
       - run: nix develop .#tauri-shell --command tauri-shellhook-test

CLAUDE.md

@@ -19,7 +19,7 @@ The shell auto-sources `.env` if present and runs `npm ci --ignore-scripts` if `
 
 ## Build Tasks
 
-All tasks are Nix packages run via `nix run`. From a consuming repo (or `test/fixture/`):
+All tasks are Nix packages run via `nix run`. From a consuming repo use `..#` (e.g., `nix run ..#rainix-sol-test`); from `test/fixture/` use `../..#` (e.g., `nix run ../..#rainix-sol-test`). Examples below use the consuming-repo prefix:
 
 ### Solidity
 - `nix run ..#rainix-sol-prelude` — `forge install && forge build`
@@ -34,7 +34,7 @@ All tasks are Nix packages run via `nix run`. From a consuming repo (or `test/fi
 - `nix run ..#rainix-rs-static` — `cargo fmt --all -- --check && cargo clippy --all-targets --all-features -- -D clippy::all`
 - `nix run ..#rainix-rs-artifacts` — `cargo build --release`
 
-### Subgraph
+### Subgraph (dev shell only, not `nix run` targets)
 - `subgraph-build` — forge build + npm ci + graph codegen/build
 - `subgraph-test` — `docker compose up` in `./subgraph`
 - `subgraph-deploy` — requires `GOLDSKY_TOKEN` and `GOLDSKY_NAME_AND_VERSION`

audit/2026-03-12-01/triage.md

@@ -4,8 +4,8 @@
 | ID | Severity | Title | Status |
 |----|----------|-------|--------|
 | A01-1-p0 | LOW | Inaccurate CI platform description in CLAUDE.md | FIXED |
-| A01-2-p0 | LOW | Task path prefix varies by working directory | PENDING |
-| A01-3-p0 | LOW | Subgraph tasks not runnable via `nix run` | PENDING |
+| A01-2-p0 | LOW | Task path prefix varies by working directory | FIXED |
+| A01-3-p0 | LOW | Subgraph tasks not runnable via `nix run` | FIXED |
 
 ## Pass 1: Security
 No LOW+ findings.

flake.nix

@@ -373,7 +373,7 @@
         devShells.default = pkgs.mkShell {
           buildInputs = sol-build-inputs ++ rust-build-inputs
             ++ node-build-inputs ++ rainix-tasks ++ subgraph-tasks
-            ++ [ the-graph goldsky pkgs.sqlite ];
+            ++ [ the-graph goldsky pkgs.sqlite pkgs.yq-go ];
           shellHook = ''
             ${source-dotenv}
 

test/fixture/test/Counter.t.sol

@@ -18,6 +18,12 @@ contract CounterTest is Test {
         assertEq(counter.number(), 1);
     }
 
+    function test_IncrementOverflowReverts() public {
+        counter.setNumber(type(uint256).max);
+        vm.expectRevert();
+        counter.increment();
+    }
+
     function testFuzz_SetNumber(uint256 x) public {
         counter.setNumber(x);
         assertEq(counter.number(), x);