[hyperpolymath]

Change and reason

Follow-up to hyperpolymath/metamanifold-webui#296, from Codex's P2 finding on it after merge. The "Clear any checked-out fleet report-backs" step in the fork-local hypatia-scan-reusable.yml used find … -type f -delete, which skips symlinks. A committed *.json symlink under .gitbot-fleet/report-backs/ therefore survived the clear, and because the artifact download is tolerated as absent, the pinned renderer's *.json loop would follow the symlink and accept its target as evidence for an enrolled member.

• hypatia-scan-reusable.yml: every directory entry named *.json is removed whatever its type (-mindepth 1 -maxdepth 1 -name '*.json' -exec rm -rf -- {} +), with a comment saying why.
• scripts/check-governance-contract.sh: the contract asserts the new command.
• scripts/tests/test-governance-contract.sh: new mutation fleet-symlinked-evidence puts the -type f filter back and must be rejected. The first cut of that mutation had an unescaped * in its sed pattern and never mutated the fixture; the second commit fixes that, and the suite now reports it rejected.

The same change is prepared for upstream standards' hypatia-scan-reusable.yml (fork delta 4's source) and will land there with the rest of the report-backs change.

Validation

bash scripts/check-governance-contract.sh        # governance contract: all 92 checks passed
bash scripts/tests/test-governance-contract.sh   # 33 mutations rejected, incl. fleet-symlinked-evidence

Scope

• Fork-only files; no change to upstream code or CI.
• No lockfile in this repository.

Contribution checks

• I followed CONTRIBUTING.md.
• This branch starts at current main (6c0d893) and contains only the two follow-up commits.
• CI has run and passes.
• Existing licensing, citation and acknowledgement text is unchanged.

---

Generated by Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Report-back cleanup now removes top-level entries with a .json name whether they are files, directories or symbolic links, preventing those entries from being left behind.
• Tests
  • Governance checks now cover cleanup of directory and symbolic-link entries as well as committed evidence.

The report-back cleanup now removes matching top-level *.json entries, including directories and symlinks. The governance contract and mutation tests have been updated to check the cleanup command and a file-only cleanup mutation.

Changes: Report-back cleanup

Layer / File(s)	Summary
Cleanup command and validation .github/workflows/hypatia-scan-reusable.yml, scripts/check-governance-contract.sh, scripts/tests/test-governance-contract.sh	The workflow removes matching top-level *.json entries. The governance contract checks for recursive removal of matching directories. The mutation tests include a symlinked-evidence case and update the committed-evidence mutation.

Priority: Not assessed

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related PRs

• hyperpolymath/MetaManifold-WebUI#296: Adds the report-back artifact download that uses the directory cleaned by this change.
• hyperpolymath/MetaManifold-WebUI#244: Documents the report-back directory and its *.json filter.

Merge Risk: Minimal · up to 9736d

The report-back cleanup and its contract checks address the stated symlink case without leaving an established merge-blocking risk.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Fork governance

Lane	Status	Run
DEED syntax (repo deed)	🟢 conformant	run 40458407897
K9 conformance (L0–L2; L3 not verified)	green (job: success)	same run
Hypatia verdict grid	purple (job: success)	same run

🟣 critical · commit 9736d56da4f5 · run 40458407897

Reporter	Status	Critical	High	Medium	Minor	Since previous revision
Hypatia scan	🟣 critical	18	29	30	0	— no comparable baseline
panic-attack assail	🔴 high	0	7	2	0	— no comparable baseline
pons asinorum	🟢 clean	0	0	0	0	— no comparable baseline
accessibilitybot (WCAG on the React UI)	🔴 high	0	113	102	80	— no comparable baseline
echidnabot (formal verification: proofs/)	🟠 indeterminate	0	0	0	0	— no comparable baseline
finishingbot (release readiness)	🔴 high	0	14	96	2	— no comparable baseline
glambot (presentation quality)	🟡 medium	0	0	5	40	— no comparable baseline
panicbot (panic recovery, error handling)	🟡 medium	0	0	6	2	— no comparable baseline
rhodibot (RSR compliance)	🔴 high	0	18	0	0	— no comparable baseline
seambot (integration health: API routes)	🔴 high	0	1	0	0	— no comparable baseline
cipherbot	⚪ not applicable	0	0	0	0	— no comparable baseline
sustainabot	⚪ not applicable	0	0	0	0	— no comparable baseline

Hypatia scan: 77 finding(s)

• critical cicd_rules/banned_language_file — frontend/src/utils/text.test.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/cladistics/cumulativeLayout.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/cladistics/cumulativeLayout.test.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/api/ijsonJcs.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/api/ijsonJcs.test.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/components/ordinationModel.test.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/components/ordinationModel.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — scripts/tests/test_null_calibration_failures.py — Python file detected -- banned language
• critical cicd_rules/banned_language_file — scripts/tests/test_format_readiness.py — Python file detected -- banned language
• critical cicd_rules/banned_language_file — scripts/formats/process.py — Python file detected -- banned language
• critical cicd_rules/banned_language_file — scripts/formats/probe_kyq.py — Python file detected -- banned language
• critical cicd_rules/banned_language_file — scripts/formats/descendants.py — Python file detected -- banned language
• critical cicd_rules/banned_language_file — scripts/formats/inventory.py — Python file detected -- banned language
• critical cicd_rules/banned_language_file — scripts/formats/conformance.py — Python file detected -- banned language
• critical cicd_rules/banned_language_file — test/references/check_ordination_references.py — Python file detected -- banned language
• critical cicd_rules/banned_language_file — test/references/check_high_precision_references.py — Python file detected -- banned language
• critical cicd_rules/banned_language_file — test/references/exact_summary_reference.py — Python file detected -- banned language
• critical cicd_rules/banned_language_file — bench/null_calibration/report_failures.py — Python file detected -- banned language
• high code_scanning_alerts/CSA001 — frontend/src/utils/text.test.ts — Code scanning (Hypatia): hypatia/cicd_rules/banned_language_file -- Hypatia cicd_rules: banned_language_file -- 7 day(s) old
• high code_scanning_alerts/CSA001 — test/references/exact_summary_reference.py — Code scanning (Hypatia): hypatia/cicd_rules/banned_language_file -- Hypatia cicd_rules: banned_language_file -- 4 day(s) old
• 57 more; see the structured report in the artifact.

panic-attack assail: 9 finding(s)

• high DynamicCodeExecution — src/pipeline/dada2/context.jl — eval/Meta.parse in src/pipeline/dada2/context.jl
• high DynamicCodeExecution — src/analysis/analysis.jl — eval/Meta.parse in src/analysis/analysis.jl
• high DynamicCodeExecution — src/analysis/differential.jl — eval/Meta.parse in src/analysis/differential.jl
• high DynamicCodeExecution — src/analysis/ordination.jl — eval/Meta.parse in src/analysis/ordination.jl
• high DynamicCodeExecution — src/core/provenance.jl — eval/Meta.parse in src/core/provenance.jl
• high DynamicCodeExecution — scripts/check-julia-syntax.jl — eval/Meta.parse in scripts/check-julia-syntax.jl
• high DynamicCodeExecution — test/unit/test_permanova.jl — eval/Meta.parse in test/unit/test_permanova.jl
• medium UnsafeFFI — src/core/memory_probe.jl — 3 ccall/FFI calls in src/core/memory_probe.jl
• medium CommandInjection — scripts/check-governance-contract.sh — 21 potentially unquoted variable expansions in scripts/check-governance-contract.sh

accessibilitybot (WCAG on the React UI): 295 finding(s)

• high WCAG-3.3.2-input-no-label — frontend/src/views/run/TablesPanel.tsx:299 — <input type="file"> has no associated label. Every form input needs a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/views/TreeView.tsx:442 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/views/TreeView.tsx:442 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/views/TreeView.tsx:442 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/views/TreeView.tsx:442 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/views/TreeView.tsx:442 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/views/TreeView.tsx:442 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/views/TreeView.tsx:442 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/views/TreeView.tsx:442 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-input-no-label — frontend/src/views/TreeView.tsx:449 — <input type="text"> has no associated label. Every form input needs a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/views/ReferenceTreesView.tsx:123 — <textarea> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-input-no-label — frontend/src/views/DatabasesView.tsx:144 — <input type="text"> has no associated label. Every form input needs a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/figure/FigureEditor.tsx:120 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/figure/FigureEditor.tsx:120 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/figure/FigureEditor.tsx:120 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/figure/FigureEditor.tsx:120 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/figure/FigureEditor.tsx:120 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-3.3.2-element-no-label — frontend/src/figure/FigureEditor.tsx:120 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• high WCAG-2.1.1-onclick-no-keyboard — frontend/src/figure/FigureEditor.tsx:1 — <div> has onclick handler but no keyboard event handler. Click-only interactions are not keyboard accessible.
• high WCAG-3.3.2-element-no-label — frontend/src/figure/PaneEditor.tsx:77 — <select> has no associated label. Form elements need a <label>, aria-label, or aria-labelledby.
• 275 more; see the structured report in the artifact.

echidnabot (formal verification: proofs/): not_run — no ECHIDNA engine endpoint is configured for this repository (ECHIDNA_URL unset); echidnabot verifies proofs by dispatching to an engine and has no local mode

• 🟠 indeterminate: no ECHIDNA engine endpoint is configured for this repository (ECHIDNA_URL unset); echidnabot verifies proofs by dispatching to an engine and has no local mode

finishingbot (release readiness): 112 finding(s)

• high V1-LANG-py — bench/null_calibration/report_failures.py — Python files found (use Julia/Rust/AffineScript instead). Found 5 file(s).
• high V1-LANG-ts — frontend/vite.config.ts — TypeScript files found (use AffineScript instead). Found 5 file(s).
• high V1-DOC-ROADMAP.adoc — Required file ROADMAP.adoc not found (Project roadmap).
• high V1-DOC-README.adoc — Required file README.adoc not found (Main project documentation).
• high TOOL-001 — .tool-versions file not found for asdf/mise version management.
• high SCM-001-NEUROSYM.scm — Required SCM file NEUROSYM.scm not found (Neurosymbolic AI documentation).
• high SCM-001-AGENTIC.scm — Required SCM file AGENTIC.scm not found (Agentic AI integration documentation).
• high SCM-001-PLAYBOOK.scm — Required SCM file PLAYBOOK.scm not found (Operational playbooks and procedures).
• high SCM-001-ECOSYSTEM.scm — Required SCM file ECOSYSTEM.scm not found (Project's place in the ecosystem).
• high SCM-001-META.scm — Required SCM file META.scm not found (Meta-level information and architectural decisions).
• high SCM-001-STATE.scm — Required SCM file STATE.scm not found (Project state and progress tracking).
• high REL-008 — scripts/tests/test-scanner-boundaries.sh — Potential Password found in source file
• high REL-008 — scripts/tests/test-secret-scanner.sh — Potential AWS Access Key found in source file
• high PH-100 — Found 3 placeholders, exceeds maximum allowed (0)
• medium V1-COM-CODE_OF_CONDUCT.md — CODE_OF_CONDUCT.md file not found (Code of conduct).
• medium TEST-001 — Could not determine if this is a Rust or Deno project.
• medium CLM-006 — docs/security/colour-teams.md — Documentation references non-existent file: ultraplan-secure-private.md
• medium CLM-006 — docs/security/colour-teams.md — Documentation references non-existent file: recon-report.md
• medium CLM-006 — docs/security/colour-teams.md — Documentation references non-existent file: ultraplan-secure-private.md
• medium CLM-006 — docs/security/ultraplan-secure-private.md — Documentation references non-existent file: recon-report.md
• 92 more; see the structured report in the artifact.

glambot (presentation quality): 45 finding(s)

• medium ACC-003 — docs/security/ultraplan-secure-private.md:225 — Heading jumps from h1 to h3. Should not skip levels.
• medium ACC-003 — bench/null_calibration/README.md:110 — Heading jumps from h1 to h3. Should not skip levels.
• medium ACC-003 — README.md:884 — Heading jumps from h1 to h4. Should not skip levels.
• medium ACC-003 — README.md:656 — Heading jumps from h1 to h3. Should not skip levels.
• medium ACC-002 — README.md:6 — Alt text should be more descriptive (at least 3 characters).
• info GS-001 — Install git-seo for comprehensive SEO analysis: https://github.com/hyperpolymath/git-seo
• info MACH-007 — ECOSYSTEM.scm not found in .machine_readable/ directory.
• info MACH-007 — META.scm not found in .machine_readable/ directory.
• info MACH-007 — STATE.scm not found in .machine_readable/ directory.
• info MACH-005 — No robots.txt found. Consider adding one for crawler control.
• info VIS-005 — CONTRIBUTING.md:9 — Line 81 characters exceeds max length of 80.
• info VIS-005 — EXPLAINME.adoc:16 — Line 172 characters exceeds max length of 80.
• info VIS-005 — VALIDATED_STATISTICS.md:34 — Line 143 characters exceeds max length of 80.
• info VIS-005 — SECURITY.md:7 — Line 88 characters exceeds max length of 80.
• info VIS-005 — docs/occupancy-models.md:6 — Line 88 characters exceeds max length of 80.
• info VIS-005 — docs/occupancy-2026-10.adoc:2 — Line 94 characters exceeds max length of 80.
• info VIS-005 — docs/format-migration.md:11 — Line 143 characters exceeds max length of 80.
• info VIS-005 — docs/ijson-jcs.md:3 — Line 355 characters exceeds max length of 80.
• info VIS-005 — docs/security/colour-teams.md:2 — Line 100 characters exceeds max length of 80.
• info VIS-005 — docs/security/ultraplan-secure-private.md:2 — Line 100 characters exceeds max length of 80.
• 25 more; see the structured report in the artifact.

panicbot (panic recovery, error handling): 8 finding(s)

• medium PA018 — src/pipeline/dada2/context.jl — eval/Meta.parse in src/pipeline/dada2/context.jl
• medium PA018 — src/analysis/analysis.jl — eval/Meta.parse in src/analysis/analysis.jl
• medium PA018 — src/analysis/differential.jl — eval/Meta.parse in src/analysis/differential.jl
• medium PA018 — src/analysis/ordination.jl — eval/Meta.parse in src/analysis/ordination.jl
• medium PA018 — src/core/provenance.jl — eval/Meta.parse in src/core/provenance.jl
• medium PA018 — scripts/check-julia-syntax.jl — eval/Meta.parse in scripts/check-julia-syntax.jl
• info PA007 — src/core/memory_probe.jl — 3 ccall/FFI calls in src/core/memory_probe.jl
• info PA003 — scripts/check-governance-contract.sh — 21 potentially unquoted variable expansions in scripts/check-governance-contract.sh

rhodibot (RSR compliance): 18 finding(s)

• high 7.1.2 — LICENSES/ — reuse-compliant: missing — absent — expected LICENSES/
• high 3.2.2 — .machine_readable/rsr-profile.a2ml — rsr-profile: missing — absent — expected .machine_readable/rsr-profile.a2ml
• high 3.1.8 — ANCHOR.a2ml — anchor: missing — absent — expected ANCHOR.a2ml
• high 3.1.7 — PLAYBOOK.a2ml — playbook: missing — absent — expected PLAYBOOK.a2ml
• high 3.1.6 — NEUROSYM.a2ml — neurosym: missing — absent — expected NEUROSYM.a2ml
• high 3.1.5 — AGENTIC.a2ml — agentic: missing — absent — expected AGENTIC.a2ml
• high 3.1.4 — ECOSYSTEM.a2ml — ecosystem: missing — absent — expected ECOSYSTEM.a2ml
• high 3.1.3 — META.a2ml — meta: missing — absent — expected META.a2ml
• high 3.1.2 — STATE.a2ml — state: missing — absent — expected STATE.a2ml
• high 3.1.1 — .machine_readable/descriptiles/ — descriptiles-dir: missing — absent — expected .machine_readable/descriptiles/
• high 2.2.1 — .well-known/security.txt — wellknown-core: missing — absent — expected .well-known/security.txt or .well-known/ai.txt or .well-known/humans.txt
• high 2.1.10 — .gitattributes — gitignore: missing — absent — expected .gitattributes
• high 2.1.4 — CODE_OF_CONDUCT.md — coc-md: missing — absent — expected CODE_OF_CONDUCT.md
• high 2.1.2 — LICENSES/ — license-file: missing — absent — expected LICENSES/
• high 2.1.1 — README.adoc — readme-adoc: missing — absent — expected README.adoc; there is a .gitbot-fleet/report-backs/README.md, README.md, bench/advanced_zero_handling/README.md, bench/compositional_differential/README.md, bench/constrained_ordination/README.md, bench/null_calibration/README.md, docs/sec
• high 1.2.4 — .tool-versions — tool-versions: missing — absent — expected .tool-versions
• high 1.2.2 — .pre-commit-config.yaml — git-hooks: missing — absent — expected .pre-commit-config.yaml
• high 1.1.2 — Justfile — justfile: missing — absent — expected Justfile

seambot (integration health: API routes): 1 finding(s)

• high SEAM-register-exists — spec/seams/seam-register.json — Seam register not found at spec/seams/seam-register.json

cipherbot: not_applicable — no cryptography is implemented in this repository

• ⚪ not applicable: no cryptography is implemented in this repository

sustainabot: not_applicable — fleet adapter slot reserved; no adapter exists yet (gitbot-fleet README)

• ⚪ not applicable: fleet adapter slot reserved; no adapter exists yet (gitbot-fleet README)

Scope: static findings reported by each row's tool at the named commit. Purple, red, yellow and blue grade the worst finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run.

🟢 conformant · commit 9736d56da4f5 · run 40458407897 · validator hyperpolymath/standards@c6d78606f392

Category	Status	Pass	Fail	Indeterminate	N/A	Since previous revision
K9 contract typecheck	🟢 conformant	1	0	0	0	— no comparable baseline
K9 validator self-test	🟢 conformant	37	0	0	0	— no comparable baseline
K9 live corpus (L0–L2)	🟢 conformant	3	0	0	0	— no comparable baseline

Scope: K9 components L0–L2 against contract v1.0.0 at the named standards commit. L3 signature verification and routed coordination-dialect files are not certified. Green is limited to this scope. Orange is missing evidence; yellow is grandfathered debt or warnings; grey is an explicit scope exclusion. report.json, badge.json and the validator logs are in the k9-grid artifact on the linked run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T10:58:11.525092Z	9736d56	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9736d56da4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject a symlinked report-backs directory

A PR can replace .gitbot-fleet/report-backs itself with a symlink to another committed directory containing forged *.json envelopes. In that case mkdir -p accepts the symlink, while this find clears nothing because GNU find defaults to -P (“Never follow symbolic links”) and therefore does not descend through the command-line symlink; if the tolerated artifact download is then absent, the renderer follows the directory symlink and consumes the committed evidence. Remove and recreate the report-backs path as a real directory, or explicitly reject a symlink, before clearing its contents.

Useful? React with 👍 / 👎.