From a3a42d5d9d31751ede38a601958da257c06a1cf7 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 11:17:49 +0000 Subject: [PATCH 1/2] fix(arrival-pack): print the deed's typed identity, not a uuid5 hex literal The standards re-pin brings governance's `UUID v7 conformance` job, which since owner ruling D320 runs check-uuid-v8.sh --strict: version 8 only. It failed on CLAUDE.md alone ("non-v8 UUID literal 241f1c29-..."): the arrival pack printed the repo uuid as computed hex, a uuidv5. The deed itself never stores that hex; it stores the typed literal #u5"github.com/hyperpolymath/resource-algebra". extract.sh now hands the pack that typed literal. It says what the identifier is, as ADR-008 asks of legacy ids, and becomes #u8"..." without another change once the deed grammar admits version 8 and gv-clade-index moves to profile C (ADR-008, D320). A :repo-uuid that is not a typed literal stops the generator. Verified: check-uuid-v8.sh --strict passes on this tree; verify.sh reports the pack in sync. The same change goes to rsr-template-repo, whose own CLAUDE.md carries the same literal class. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01LiQzWJdcPfRU6YMDGRG8Xi --- .machine_readable/arrival-pack/extract.sh | 12 ++++++++++-- CLAUDE.md | 2 +- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.machine_readable/arrival-pack/extract.sh b/.machine_readable/arrival-pack/extract.sh index 20367d3..906f9ea 100755 --- a/.machine_readable/arrival-pack/extract.sh +++ b/.machine_readable/arrival-pack/extract.sh @@ -49,10 +49,18 @@ items() { # hash12 -> short content hash of stdin (drift provenance) hash12() { sha256sum | cut -c1-12; } -# The uuid is derived from the header :repo-uuid name, never stored (deed.abnf). +# The identity is the deed's own TYPED literal (#u5"", later #u8""), +# never a computed hex uuid. The uuid is derived from that name and never +# stored (deed.abnf); printing its hex form put a version-5 literal in +# CLAUDE.md, which ADR-008's strict gate (owner ruling D320, standards +# governance job uuid-v7-conformance) rejects in every minted repo. The +# typed literal says what the identifier is, as ADR-008 asks of legacy ids, +# and follows the deed when it moves to version 8. uuid_name="$(field '' repo-uuid)" uuid="" -[ -z "$uuid_name" ] || uuid="$(bash "$READ" --uuid "$DEED")" +[ -z "$uuid_name" ] || uuid="$(sed -n -E 's/^ :repo-uuid (#u[0-9]+"[^"]*").*/\1/p' "$DEED" | head -1)" +[ -z "$uuid_name" ] || [ -n "$uuid" ] \ + || { echo "extract.sh: $(basename "$DEED") :repo-uuid is not a typed #u\"...\" literal" >&2; exit 2; } # read_clauses -> the clauses this pack reads, one token per line. Hashing only # these keeps an unrelated deed edit (say a canon-pin bump) from reading as drift. diff --git a/CLAUDE.md b/CLAUDE.md index ea94d07..6fc3d6f 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -62,7 +62,7 @@ Put every question that needs the owner's decision through the selector (the Ask # This repo: `resource-algebra` · clade `fv-resource-algebra` -- **Identity** — uuid `241f1c29-0838-5033-b654-7f4c5e279ebc`; clade `fv` (secondary ``); born 2026-10-12; forge `hyperpolymath/resource-algebra`. +- **Identity** — uuid `#u5"github.com/hyperpolymath/resource-algebra"`; clade `fv` (secondary ``); born 2026-10-12; forge `hyperpolymath/resource-algebra`. - **IS** — Parametric resource algebra in Agda, with Loss, MaxPlus, HWM and MinMax instances and strict/lax morphisms. - **IS-NOT** — a repository template · the K-CUT statement, which belongs in choreographic-types · occupancy-types' own algebra, for which HWM is a proposal - **Where it sits** — pipeline position **kernel**; chain `resource-algebra → hyperpolymath type family`; coordination = `standards`. From 9240142f4ed7bfb15072494a78f28e6fb235e3b9 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 11:17:49 +0000 Subject: [PATCH 2/2] fix(ci): re-pin the standards reusables to 934b879, which reads lock v0.0.3 At ae36881 the Actions lockfile verify job installs gh-actions-lock v0.1.6, which cannot read this lockfile: "lockfile version v0.0.3 is newer than this binary supports (v0.0.2)" (exit 2). Dependabot (#5) regenerates actions.lock as format v0.0.3. Standards main since #1249 pins v0.2.0 and keeps sha-as-ref advisory, so the pins move to 934b879 (standards main, 2026-10-14). Done with standards' propagate-workflow-pins.sh as patched in hyperpolymath/standards#1254, which now relocks actions.lock itself (RELOCKED): the six entries re-keyed, the standards record rebuilt for 934b879, and the two records its reusables newly need (denoland/setup-deno@22d081f v2.0.5, oven-sh/setup-bun@0c5077e v2.2.0) copied from standards' own lock. Both scripts/check-lock-sync.sh and standards main's copy pass. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01LiQzWJdcPfRU6YMDGRG8Xi --- .github/workflows/actions.lock | 30 +++++++++++++++++++--------- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 7 files changed, 27 insertions(+), 15 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 36346cb..403b20e 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -31,13 +31,13 @@ workflows: '.github/workflows/estate-rules.yml': - 'actions/checkout@v7.0.1' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3' + - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82' '.github/workflows/groove-check.yml': - 'actions/checkout@v7.0.1' '.github/workflows/guix-policy.yml': - 'actions/checkout@v7.0.1' '.github/workflows/hypatia-scan.yml': - - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3' + - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82' '.github/workflows/k9-validate.yml': - 'actions/checkout@v7.0.1' - 'hyperpolymath/k9-ecosystem@main' @@ -47,7 +47,7 @@ workflows: '.github/workflows/main-estate-audit.yml': - 'hyperpolymath/cicd-suite@55556cf5ba71ba744695861503c13148d3915a5d' '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3' + - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82' '.github/workflows/ossf-best-practices.yml': - 'actions/checkout@v7.0.1' '.github/workflows/pages.yml': @@ -74,11 +74,11 @@ workflows: '.github/workflows/runtime-policy.yml': - 'actions/checkout@v7.0.1' '.github/workflows/rust-ci.yml': - - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3' + - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3' + - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3' + - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82' '.github/workflows/security-policy.yml': - 'actions/checkout@v7.0.1' '.github/workflows/sonarqube.yml': @@ -162,6 +162,11 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed': + ref: 'v2.0.5' + commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' + owner_id: 42048915 + repo_id: 356423100 'dependabot/fetch-metadata@v3.1.0': ref: 'v3.1.0' commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98' @@ -235,21 +240,23 @@ dependencies: commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef' owner_id: 6759885 repo_id: 1352485172 - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3': - ref: 'ae36881b5ff4b469fb904b66542ac226a15107f3' - commit: 'sha1-ae36881b5ff4b469fb904b66542ac226a15107f3' + 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82': + ref: '934b879f6068295e42dac20d80e010d555ebec82' + commit: 'sha1-934b879f6068295e42dac20d80e010d555ebec82' owner_id: 6759885 repo_id: 1116521501 uses: - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' + - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' + - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': @@ -257,6 +264,11 @@ dependencies: commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' owner_id: 67707773 repo_id: 421101922 + 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6': + ref: 'v2.2.0' + commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6' + owner_id: 108928776 + repo_id: 512644635 'oven-sh/setup-bun@v2.2.0': ref: 'v2.2.0' commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6' diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 45ab7dd..8ef98da 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -18,4 +18,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 394053d..e95d4ed 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -27,4 +27,4 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 268185a..c118db0 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -13,7 +13,7 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82 # Explicit secrets map — no `secrets: inherit` (Hypatia WH008, alert #131). # All seven are the callee's complete optional contract (standards # mirror-reusable.yml@da2c748); behaviour is unchanged, future secrets diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 45a2b08..4f27132 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -16,4 +16,4 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3 + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 5ce1f8f..ff00f43 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -16,7 +16,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82 # Reusable called-workflow permissions are CAPPED by the caller's grants; # without security-events: write here the scorecard SARIF upload fails with # startup_failure (hypatia WF018). id-token: write enables OIDC publish. diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 606b5c1..403f0b3 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -26,4 +26,4 @@ jobs: # is therefore the cap GitHub applies to the called workflow. permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82