Repository navigation
governance / Validate Hypatia Baseline is red on main: 28 findings not covered by the baseline #80
Description
Problem
governance / Validate Hypatia Baseline is red on main. It was measured at 2cc3088 in run 37864612160 (job 113608485491). The scan found 31 findings. Three are acknowledged by .hypatia-baseline.json. The remaining 28 are not covered by the baseline, so the gate fails: Gate failed: 28 unfiltered finding(s) at or above 'info'.
Every pull request inherits this red. It is not a required check here; the only required context on main is scan / gitleaks. #79 removes the two findings in release.yml, which leaves 26 on its head (job 113764445362).
| Severity | Count | Rule module | Files |
|---|---|---|---|
| critical | 6 | structural_drift (SD004, "descriptile in retired location") |
.machine_readable/6a2/{STATE,META,ECOSYSTEM,AGENTIC,NEUROSYM,PLAYBOOK}.a2ml |
| high | 3 | structural_drift (SD024, "CI policy requires a retired descriptile path") |
Justfile |
| high | 1 | workflow_audit (secret_action_without_presence_gate) |
.github/workflows/instant-sync.yml: FARM_DISPATCH_TOKEN is used with no presence gate |
| medium | 5 | workflow_hardening |
dependabot-automerge.yml, labels.yml, label-triage.yml, mirror.yml, secret-scanner.yml |
| medium | 5 | research_extensions |
dependabot-automerge.yml, instant-sync.yml, labels.yml, label-triage.yml, push-email-notify.yml |
| medium | 4 | structural_drift |
0-AI-MANIFEST.a2ml, ABI-FFI-README.adoc, docs/AI-CONVENTIONS.adoc, PLACEHOLDERS.adoc |
| medium | 2 | workflow_audit |
labels.yml, label-triage.yml |
| medium | 2 | content_patterns, research_extensions |
release.yml (fixed by #79) |
The full list, with the reason for each finding, is printed by the "Run Hypatia scan (Baseline validation)" step of the run named above.
Acceptance criteria
- Every finding is either fixed or given a
.hypatia-baseline.jsonentry. Each entry needs a reason, an expiry and a tracking issue, in the format inhyperpolymath/standardsdocs/HYPATIA-BASELINE-FORMAT.adoc. - The six
.machine_readable/6a2/*.a2mlfindings and the threeJustfileSD024 findings are resolved by the estate's descriptile migration (A2ML is retired), not by a baseline entry with no expiry. - The
instant-sync.ymldispatch step skips cleanly whenFARM_DISPATCH_TOKENis absent. -
governance / Validate Hypatia Baselinepasses onmain.
🤖 Filed with Claude Code as the deferral for the red check on #79.
Activity
fix(ci): replace the scaffold release workflow with a working one (#79)