Fix CI: remove openssl dep, skip ORT init in ingestion tests, fix fmt

- Replace openssl with aes-gcm for AES-256-GCM decryption in rest.rs
- Remove openssl/openssl-sys from Cargo.toml and Cargo.lock
- Use ci_safe_config() in ingestion tests to skip ORT model loading
  (avoids Mutex poisoned panic on CI without libonnxruntime)
- Remove serial_test dependency (no longer needed)
- Fix cargo fmt issue in rest.rs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Cargo.lock

@@ -4287,8 +4287,6 @@ dependencies = [
  "nu-ansi-term 0.46.0",
  "nusb 0.2.3",
  "once_cell",
- "openssl",
- "openssl-sys",
  "opentelemetry",
  "opentelemetry-otlp",
  "opentelemetry_sdk",
@@ -4313,7 +4311,6 @@ dependencies = [
  "serde",
  "serde-big-array",
  "serde_json",
- "serial_test",
  "sha2 0.10.9",
  "shellexpand",
  "socketioxide",
@@ -4375,15 +4372,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
-[[package]]
-name = "openssl-src"
-version = "300.5.5+3.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f1787d533e03597a7934fd0a765f0d28e94ecc5fb7789f8053b1e699a56f709"
-dependencies = [
- "cc",
-]
-
 [[package]]
 name = "openssl-sys"
 version = "0.9.112"
@@ -4392,7 +4380,6 @@ checksum = "57d55af3b3e226502be1526dfdba67ab0e9c96fc293004e79576b2b9edb0dbdb"
 dependencies = [
  "cc",
  "libc",
- "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
@@ -5876,15 +5863,6 @@ dependencies = [
  "serde_json",
 ]
 
-[[package]]
-name = "scc"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
-dependencies = [
- "sdd",
-]
-
 [[package]]
 name = "schannel"
 version = "0.1.29"
@@ -5931,12 +5909,6 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1257cd4248b4132760d6524d6dda4e053bc648c9070b960929bf50cfb1e7add"
 
-[[package]]
-name = "sdd"
-version = "3.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
-
 [[package]]
 name = "sealed"
 version = "0.6.0"
@@ -6149,32 +6121,6 @@ dependencies = [
  "unsafe-libyaml",
 ]
 
-[[package]]
-name = "serial_test"
-version = "3.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
-dependencies = [
- "futures-executor",
- "futures-util",
- "log",
- "once_cell",
- "parking_lot",
- "scc",
- "serial_test_derive",
-]
-
-[[package]]
-name = "serial_test_derive"
-version = "3.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "serialport"
 version = "4.9.0"

Cargo.toml

@@ -83,8 +83,6 @@ opentelemetry_sdk = { version = "0.31", default-features = false, features = ["t
 opentelemetry-otlp = { version = "0.31", default-features = false, features = ["trace", "metrics", "http-proto", "reqwest-client", "reqwest-rustls-webpki-roots"] }
 tokio-stream = { version = "0.1.18", features = ["full"] }
 url = "2"
-openssl = "0.10"
-openssl-sys = { version = "0.9", features = ["vendored"] }
 socketioxide = { version = "0.15", features = ["extensions"] }
 
 matrix-sdk = { version = "0.16", optional = true, default-features = false, features = ["e2e-encryption", "rustls-tls", "markdown"] }
@@ -107,7 +105,6 @@ rppal = { version = "0.22", optional = true }
 
 [dev-dependencies]
 tempfile = "3"
-serial_test = "3"
 
 [features]
 sandbox-landlock = ["dep:landlock"]

src/api/rest.rs

@@ -388,15 +388,23 @@ pub fn decrypt_handoff_blob(b64_ciphertext: &str, key_str: &str) -> Result<Strin
     let tag = &combined[16..32];
     let ciphertext = &combined[32..];
 
-    let plain = openssl::symm::decrypt_aead(
-        openssl::symm::Cipher::aes_256_gcm(),
-        &key,
-        Some(iv),
-        &[],
-        ciphertext,
-        tag,
-    )
-    .map_err(|e| anyhow::anyhow!("AES-GCM decrypt failed: {e}"))?;
+    // aes-gcm expects ciphertext || tag
+    let mut ct_with_tag = Vec::with_capacity(ciphertext.len() + tag.len());
+    ct_with_tag.extend_from_slice(ciphertext);
+    ct_with_tag.extend_from_slice(tag);
+
+    use aes_gcm::aead::generic_array::typenum::U16;
+    use aes_gcm::aead::{Aead, KeyInit};
+    use aes_gcm::aes::Aes256;
+    use aes_gcm::AesGcm;
+    type Aes256Gcm16 = AesGcm<Aes256, U16>;
+
+    let cipher =
+        Aes256Gcm16::new_from_slice(&key).map_err(|e| anyhow::anyhow!("invalid AES key: {e}"))?;
+    let nonce = aes_gcm::aead::generic_array::GenericArray::from_slice(iv);
+    let plain = cipher
+        .decrypt(nonce, ct_with_tag.as_ref())
+        .map_err(|e| anyhow::anyhow!("AES-GCM decrypt failed: {e}"))?;
 
     String::from_utf8(plain).context("handoff plaintext is not UTF-8")
 }

src/openhuman/memory/ingestion.rs

@@ -1571,13 +1571,20 @@ mod tests {
     use serde_json::json;
     use tempfile::TempDir;
 
-    use serial_test::serial;
-
     use crate::openhuman::memory::{
         embeddings::NoopEmbedding, MemoryIngestionConfig, MemoryIngestionRequest,
         NamespaceDocumentInput, UnifiedMemory,
     };
 
+    /// Config that skips relex model loading (avoids ORT init which panics on
+    /// CI runners that lack libonnxruntime).  Heuristic extraction still runs.
+    fn ci_safe_config() -> MemoryIngestionConfig {
+        MemoryIngestionConfig {
+            model_name: "__test_no_model__".to_string(),
+            ..MemoryIngestionConfig::default()
+        }
+    }
+
     fn fixture(path: &str) -> String {
         let base = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
         std::fs::read_to_string(
@@ -1590,7 +1597,6 @@ mod tests {
     }
 
     #[tokio::test]
-    #[serial]
     async fn gmail_fixture_ingestion_recovers_required_signals() {
         let tmp = TempDir::new().unwrap();
         let memory = UnifiedMemory::new(tmp.path(), Arc::new(NoopEmbedding), None).unwrap();
@@ -1609,7 +1615,7 @@ mod tests {
                     session_id: None,
                     document_id: None,
                 },
-                config: MemoryIngestionConfig::default(),
+                config: ci_safe_config(),
             })
             .await
             .unwrap();
@@ -1685,7 +1691,6 @@ mod tests {
     }
 
     #[tokio::test]
-    #[serial]
     async fn notion_fixture_ingestion_recovers_required_signals() {
         let tmp = TempDir::new().unwrap();
         let memory = UnifiedMemory::new(tmp.path(), Arc::new(NoopEmbedding), None).unwrap();
@@ -1704,7 +1709,7 @@ mod tests {
                     session_id: None,
                     document_id: None,
                 },
-                config: MemoryIngestionConfig::default(),
+                config: ci_safe_config(),
             })
             .await
             .unwrap();