Repository navigation
fix(gates): Q-pass — ten quick fixes, two latent gate defects, canon 2.1.3 - #1344
Conversation
…2.1.3 Works the quick-fix tier from docs/triage/2026-10-24-issue-classification.adoc. Every change is verified by a fixture, the repo's own suite, or a re-measured run — not by the issue text. Gate table (canon 2.1.2 -> 2.1.3, PATCH: detection rules corrected, no criterion added, removed, re-tiered or re-graded): * #1228 `src/**/*.rs` was root-anchored, so a cargo WORKSPACE posted a permanent MISSING it could never clear (oikos: 4 crates, 20+ files under <crate>/src/). Now `**/src/**/*.rs`, and the manifest rows gain depth-anchored alternatives to depth 2. * #1227 `[baseline].paths` had no reader at all: a repo could pass while missing its LICENSE. check-rsr-profile.sh now enforces it, and the `.well-known/` row accepts the post-migration `www/.well-known/`. * #1229 the baseline demanded `0-AI-MANIFEST.a2ml` after the template retired that spelling; either `.a2ml` or `.deed` conforms. * #1125 `flake.nix` no longer counts as a reproducible build (Nix retired); * #894 `manifest.scm` (the estate's Guix convention) now does. Two latent defects surfaced while wiring the baseline, both worse than the issue that uncovered them: * the [carrier] and [canon] exempt lists are MULTI-LINE arrays read with a single-line reader, so no carrier exemption had ever applied to either role — the spine's own "I ship this, I do not run it" case included; * a MISSING row ignored the carrier list entirely, so a carrier that did declare the capability was still failed for not running its own gift. Scripts: * #907 the lock gate exempted actions/github-script unconditionally (carried over from the grep it replaced), so `@main` passed a gate whose whole purpose is to refuse it. The one call site is already pin-pinned. * #908 `root-allow.txt` was a ratchet ledger that does not exist here: 0 at base, 0 at HEAD, so it could never fire. Removed, with the real control (standards-map.toml) named. * #1079 the UUID checker pulled only the LAST UUID off each line, so `<v4> <v7>` passed. Now every literal on the line is checked. * #1219 `printf | grep -q` under `pipefail` SIGPIPEs the printf, so a touched K9 file was reported as untouched and passed as advisory. Here-string. * #930 two remedies named a path inside the standards checkout, which no consumer repo has; they now name the command to run. * #1223 two refs to `rhodium-standard-repositories/RSR.adoc`, a path that existed in no revision of this tree, now point at the real spec. Tests: scripts/tests/check-rsr-profile-test.sh is new (13 fixtures: workspace vs single crate, baseline missing/present in both spellings, vestigial, both carrier roles, both setup errors). The triage suite's column check is now header-driven instead of hardcoding 12. Measured, not assumed: #1015, #1000 and #1081 are already fixed (the pin resolver reads workflows through yq; all 37 *.k9.ncl carry the sentinel except the deliberately invalid fixtures; ruleset 23787415 has no SonarCloud context). #727 is an upstream `gh actions-lock` behaviour, not work in this repo. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 15 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
Fork governance
Scope: the three lanes below are static checks at the named commit. A K9-DEED conformance🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: K9 components L0–L2 against contract v1.0.0 at the named standards commit. L3 signature verification and routed coordination-dialect files are not certified. Green is limited to this scope. Orange is missing evidence; yellow is grandfathered debt or warnings; grey is an explicit scope exclusion. report.json, badge.json and the validator logs are in the k9-grid artifact on the linked run. Hypatia verdict grid🟢 clean · commit Advisory: 2 row(s), worst 🟡 medium (0 critical, 0 high) — reported, never grading the change.
Hypatia scan: 49 finding(s)
panic-attack assail: 42 finding(s)
pons asinorum: 22 finding(s)
Scope: static findings reported by each row's tool at the named commit. The table grades only findings in files this change touches, so the colour answers "does this change introduce anything?", not "what does the whole repository still carry?". Standing findings are counted in each accordion and in report.json; the baseline filter remains the place where acknowledged debt is recorded. The lane state is the worst GATING row; advisory rows are listed and counted but never set it. Purple, red, yellow and blue grade the worst GRADED finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run. |
…ng the canon
hyperpolymath/standards moved to metadatastician/standards. GitHub redirects the
old path, so nothing broke loudly — except check-workflow-staleness.sh, which
decides whether it is running INSIDE the canon by literal comparison:
if [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ]; then
After the rename that is FALSE in the canon itself, so every PR self-scan ran
the consumer-only structural rules against standards' own reusable workflows.
.github/workflows/scorecard-reusable.yml — the file that publishes Scorecard
SARIF FOR the estate — was reported as a consumer-owned direct publisher, and
the gate failed on three unrelated PRs (#1338, #1344, #1336-adjacent) while
passing on main, because the check is evaluated per PR head.
Match both spellings, in the env comparison and in the git-remote fallback, and
keep exact matching: a repo whose owner merely resembles an estate org must stay
a consumer, or the consumer-only rules silently stop applying to it.
Tests: 24/24 (was 20). Four new cases: canon under the new name, canon under the
legacy name, a lookalike owner still held to the consumer rule, and the canon
itself exempt from it — both directions of the same switch, asserted
behaviourally rather than by grepping the script.
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 75b150eb58
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "Cargo.toml|*/Cargo.toml|*/*/Cargo.toml" = "rust" | ||
| "Cargo.lock|*/Cargo.lock|*/*/Cargo.lock" = "rust" |
There was a problem hiding this comment.
The new alternatives also match common vendored layouts such as vendor/foo/Cargo.toml, while **/src/**/*.rs matches vendored Rust sources at any depth. Consequently, a repository that does not itself use Rust but vendors a Rust dependency now fails with VESTIGIAL (no 'rust' capability). This contradicts the adjacent rationale that the bounded manifest patterns avoid vendored trees; the presence check needs to exclude vendor/archive directories or use paths that identify first-party workspaces.
Useful? React with 👍 / 👎.
| # (#851); the root spelling is kept for repos that have not moved. | ||
| # * 3-practice/: hyperpolymath/standards keeps its own contributing and | ||
| # conduct guides in a district, not at the root of a 45-directory monorepo. | ||
| paths = ["README.adoc", "EXPLAINME.adoc|docs/EXPLAINME.adoc", "LICENSE", "SECURITY.md|.github/SECURITY.md", "CONTRIBUTING.md|.github/CONTRIBUTING.md|CONTRIBUTING.adoc|3-practice/CONTRIBUTING.adoc", "CODE_OF_CONDUCT.md|.github/CODE_OF_CONDUCT.md|CODE_OF_CONDUCT.adoc|3-practice/CODE_OF_CONDUCT.adoc", "CHANGELOG.adoc|CHANGELOG.md", "0-AI-MANIFEST.a2ml|0-AI-MANIFEST.deed", ".machine_readable/descriptiles/|machine-readable/descriptiles/", ".machine_readable/rsr-profile.a2ml|machine-readable/rsr-profile.a2ml", ".well-known/|www/.well-known/", ".gitignore", "Justfile"] |
There was a problem hiding this comment.
These baseline and gate changes leave 0-canon/TEMPLATE-APPLICABILITY-POLICY.adoc stale: its declared human mirror still lists only 0-AI-MANIFEST.a2ml and root .well-known/, still shows root-only Cargo paths, and still describes build/guix.scm rather than the new reproducible-build alternatives. The policy explicitly says disagreement is a synchronization defect, so readers now receive different applicability rules from the normative table and its human-facing documentation.
Useful? React with 👍 / 👎.
| # prior major's criteria file is copied to 0-canon/rsr/archive/ and pinned | ||
| # there; a freeze guard fails any PR that mutates a frozen major. | ||
| version = "2.1.2" | ||
| version = "2.1.3" |
There was a problem hiding this comment.
Bumping the lock identity to 2.1.3 without changing the nearby tag = "canon-v2.1.2" makes the lock internally inconsistent. The file documents the tag as part of the full ref that realizes the canon, so a consumer following the advertised tag gets the previous gate table even though the version and hashes describe 2.1.3.
Useful? React with 👍 / 👎.
| reason="not planned" | ||
| case "$note" in | ||
| *verified*|*Verified*|*green*|*"no longer"*|*superseded*|*"already fixed"*) reason="completed" ;; |
There was a problem hiding this comment.
When --apply processes the current CSV, this substring heuristic marks completed work as not planned: issue #1289 says its merge “has happened” and “merged on 2026-10-24,” while #1222 says the expiry behavior is now implemented, but neither note matches the listed tokens. GitHub will therefore record the wrong close reason for resolved issues; the disposition should be stored explicitly in the classification or the matching logic must cover these notes.
Useful? React with 👍 / 👎.
| @scanner(type="file-tree"): | ||
| target_repo: "standards" | ||
| reference: "rhodium-standard-repositories/RSR.adoc" | ||
| reference: "0-canon/rsr/RSR-SPEC-v2.adoc" # was rhodium-standard-repositories/RSR.adoc — a path that never existed here (#1223) |
There was a problem hiding this comment.
After this change points HYP-S004 at the real RSR specification, its executable @required_files block still requires flake.nix and halts on violations. This repository has no flake.nix, and the same commit explicitly removes it from the reproducible-build gate because Nix is retired, so running the now-valid self-compliance rule necessarily emits a critical false finding. Update the rule's required files to the same Guix alternatives as the gate table.
Useful? React with 👍 / 👎.
| if is_carrier "$path"; then | ||
| echo " served for downstream (no local '$cap' module needed): $(row_label "$path")" |
There was a problem hiding this comment.
For a spine or canon profile that actually declares a capability, this new branch turns an absent gated module into success whenever its path appears in the carrier list. For example, a spine declaring rust can delete .github/workflows/rust-ci.yml and still pass. The carrier table is defined as permission to carry a present downstream module without declaring its capability, not permission to omit modules required by declared capabilities; the canon's differently named reusable workflow should be represented as a path alternative rather than disabling the MISSING check for every carrier role.
Useful? React with 👍 / 👎.
| baseline_checked=0 | ||
| while IFS= read -r key; do | ||
| [ -n "$key" ] || continue | ||
| baseline_checked=$((baseline_checked + 1)) | ||
| present "$key" || { echo " MISSING BASELINE: $(row_label "$key")"; fail=1; } | ||
| done < <(section baseline "$GATES" | array_on_key paths) |
There was a problem hiding this comment.
If [baseline] is absent, its paths key is misspelled, or a future syntax change makes array_on_key return no entries, this loop performs no checks and the script exits successfully with “0 baseline path(s) present.” That silently recreates the exact unenforced-baseline condition this change is intended to fix. Since baseline_checked is already counted, zero parsed rows should be treated as a malformed gate table and return setup error 2.
Useful? React with 👍 / 👎.
The 2.1.3 gate-table release changed canon.lock's gates sha256. Two files carry
a copy of the live pin on purpose:
* 1-formats/deed/tools/fixtures/valid/canon-clause_chora.deed — the vocabulary's
own example, and the test asserts it stays on the LIVE canon, because a
vocabulary page that documents a pin nobody can use is worse than no page;
* 1-formats/deed/vocabulary/canon.adoc — the example block quoting it.
Both now read 2.1.3 / 2f31f46d. check-canon-lockstep-deed-test 11/11.
Full local suite compared against pristine main (8e48b1c) in a separate
worktree: 18 failing test files on main, the same 18 here, byte-identical sets.
Every one needs a tool this sandbox lacks (mikefarah yq v4, cargo, deno), so
this branch introduces no new failures and CI runs them properly.
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c6ea203267
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "Cargo.toml|*/Cargo.toml|*/*/Cargo.toml" = "rust" | ||
| "Cargo.lock|*/Cargo.lock|*/*/Cargo.lock" = "rust" |
There was a problem hiding this comment.
When a Rust repository's only crate is located three or more directories below the root (for example, tools/team/crate/Cargo.toml), the new source glob finds its .rs files but neither manifest row can match, so a profile declaring rust incorrectly fails with MISSING Cargo.toml/Cargo.lock. Cargo does not impose this two-level limit, and this repository itself contains first-party manifests below that depth, so the manifest detection needs to handle arbitrary first-party nesting while excluding known vendor/archive trees.
Useful? React with 👍 / 👎.
| exempt_ref() { | ||
| case "$1" in | ||
| ./* | docker://* | actions/github-script* | hyperpolymath/standards/*) return 0 ;; | ||
| ./* | docker://* | hyperpolymath/standards/*) return 0 ;; | ||
| *) return 1 ;; |
There was a problem hiding this comment.
When actions.lock is absent, this exemption still accepts every hyperpolymath/standards/* ref, including @main or a tag, even though there is then no lockfile ref: entry to pin it as the preceding comment claims. The test fixture itself includes hyperpolymath/standards/...@main in its nominally pinned case, so a mutable reusable ref reaches the grace-window or missing-lock verdict instead of the unpinned-ref failure; restrict this exemption to 40-hex refs (or remove it) just like the other third-party refs.
Useful? React with 👍 / 👎.
| rc=$? | ||
| if [ "$rc" -ne 0 ]; then | ||
| echo "::error::actions-lock gate: lockfile verification FAILED (exit $rc). Regenerate with scripts/update-actions-lock.sh in the same PR as the uses: change." | ||
| echo "::error::actions-lock gate: lockfile verification FAILED (exit $rc). Regenerate the lockfile in the same PR as the uses: change: run \`gh actions-lock\` (or the standards checkout's scripts/update-actions-lock.sh, which wraps it) from YOUR repository root — the path in this message is inside the standards repo that runs this gate, not a file your repository has (#930)." |
There was a problem hiding this comment.
When a consumer follows this new remediation, bare gh actions-lock runs rewrite mode rather than making a lock-only repair. The repository's own repair contract documents that this mode can de-pin inline SHAs and invent local refs (scripts/regen-dependabot-locks.sh:25-34), while the recorded acceptance for #930 requires --no-narrow --no-migrate-local-actions and verification that workflow YAML remains unchanged (docs/reorg/2026-10-14-tidy/issue-triage-911-1037.adoc:239-246). Recommend that safe invocation here and in the other newly changed messages so fixing a lock failure does not also rewrite the caller's workflows.
Useful? React with 👍 / 👎.
| IS_STANDARDS=true | ||
| fi | ||
| case "${GITHUB_REPOSITORY:-}" in | ||
| hyperpolymath/standards|metadatastician/standards) IS_STANDARDS=true ;; |
There was a problem hiding this comment.
Recognizing metadatastician/standards here only fixes the self-scan branch; server-side pin verification still defaults STANDARDS_NWO to hyperpolymath/standards. The change explicitly relies on GitHub redirecting that old name, but api_compare invokes curl without -L and treats every non-200/404/422 response as unreachable (curl --help all documents -L, --location as “Follow redirects”). In the partial clone used by governance-reusable.yml, a forged or known-bad pin therefore degrades to a warning whenever the old API endpoint redirects; update the API default to the transferred owner or follow the redirect.
Useful? React with 👍 / 👎.
|
Add Carrot credits or activate Agent usage billing to use Autofix |
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7809753eb6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if [ "$IS_STANDARDS" = "false" ] && [ -d "$REPO_ROOT/.git" ]; then | ||
| # Fallback: check Git remote origin URL (either owner spelling). | ||
| REMOTE_URL=$(git -C "$REPO_ROOT" remote get-url origin 2>/dev/null || echo "") | ||
| if [[ "$REMOTE_URL" =~ (hyperpolymath|metadatastician)/standards ]]; then |
There was a problem hiding this comment.
When GITHUB_REPOSITORY is absent or noncanonical, this substring regex also accepts origins such as https://github.com/hyperpolymath/standards-consumer.git and https://example.com/metadatastician/standards.git. Those consumers are consequently classified as the canon and skip the retired-enforcer and direct-SARIF structural checks; the newly added regression cases demonstrate this by expecting exit 1 but receiving 0. Remove this broad preliminary match and rely on the exact URL cases below.
Useful? React with 👍 / 👎.
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Works the quick-fix tier from
docs/triage/2026-10-24-issue-classification.adoc(merged as #1333). Every claim below is verified by a fixture, the repo's own suite, or a re-measured run — none by the issue text.The gate table (canon 2.1.2 → 2.1.3, PATCH)
src/**/*.rswas root-anchored, so a cargo workspace posted a permanent MISSING it could never clear (oikos: 4 crates, 20+ files under<crate>/src/)**/src/**/*.rs; manifest rows gained depth-anchored alternatives (depth 2, so vendored trees aren't swept in)[baseline].pathshad no reader at all — a repo could pass while missing its LICENSEcheck-rsr-profile.shenforces it; the.well-known/row accepts the post-migrationwww/.well-known/0-AI-MANIFEST.a2mlafter the template retired that spelling.a2mlor.deedconformsflake.nixcounted as a reproducible build after Nix was retiredmanifest.scm, the estate's Guix convention, was missing from the rowPATCH is the rule-patch category: detection rules corrected, no criterion added, removed, re-tiered or re-graded. The
canon.lockchangelog block names both directions each row can flip in, including the one that turns conforming into non-conforming.Two latent defects, worse than the issue that uncovered them
[carrier]and[canon]are multi-line arrays and were read with a single-line reader, so no carrier exemption had ever applied to either role — including the spine's genuine "I ship this, I do not run it" case.Both fixed; both covered by fixtures.
Scripts
actions/github-scriptunconditionally (carried over from the grep it replaced), so@mainpassed a gate whose purpose is to refuse it. The one call site is already SHA-pinned.root-allow.txtwas a ratchet ledger that does not exist here — 0 at base, 0 at HEAD, so it could never fire. Removed;standards-map.tomlis the real control.<v4> <v7>passed. Every literal is now checked.rhodium-standard-repositories/RSR.adoc, a path that existed in no revision of this tree, now point at the real spec.Two more defects, found by this PR's own CI
The repository renamed and the staleness gate never noticed.
hyperpolymath/standards→metadatastician/standards; GitHub redirects the old path, so nothing broke loudly — exceptcheck-workflow-staleness.sh, which decides whether it is running inside the canon by literal comparison against the old owner. After the rename that is FALSE in the canon, so every PR self-scan ran the consumer-only structural rules against standards' own workflows and failed on.github/workflows/scorecard-reusable.yml— the file that publishes Scorecard SARIF for the estate. It passed onmainand failed on unrelated PRs (#1338, this one), because the check is per PR head. Both spellings now match, still exactly: a lookalike owner stays a consumer, or the consumer-only rules would quietly stop applying to it.The canon release moved the deed pin.
2.1.2 → 2.1.3changes the gate table's hash, so the vocabulary's own example fixture — which a test asserts stays on the live canon — moved with it.Tests
scripts/tests/check-rsr-profile-test.shis new: 13 fixtures covering workspace vs single crate, baseline missing/present in both spellings, vestigial detection, both carrier roles, and both setup errors.check-workflow-staleness-testis 24/24 (was 20). The triage suite's column check is now header-driven rather than hardcoding 12.The whole
scripts/testssuite was compared against pristinemainin a separate worktree: 18 failing test files on main, the same 18 here, byte-identical sets — every one needs a tool this sandbox lacks (mikefarah yq v4, cargo, deno). CI runs them properly: 58 checks pass, 4 skipped, 0 failures.Measured, not assumed — three were already fixed
yq; prose cannot be scanned.*.k9.nclcarry theK9!sentinel except the deliberately invalid fixtures.#727 is upstream: the banner is emitted by the
gh actions-lockextension, not by this repo.The 14 tier-C closures
I could not apply them directly: this session's GitHub connection has no
issues: write— comment and close both return403 Resource not accessible by integration, and the repoadminflag comes from themaintainpermission rather than the issue scopes. Rather than hand-click nothing, they are wired here so the merge closes them. The reason for each is indocs/triage/2026-10-24-issue-classification.adoc(tier C) and in the CSV'snotecolumn.Closes #443, closes #668, closes #750, closes #808, closes #887, closes #911, closes #929, closes #935, closes #1137, closes #1172, closes #1222, closes #1287, closes #1288, closes #1289