Repository navigation
chore(hypatia): P1.1 — retire dead baseline acks, re-ack the 2026-10-21 cohort with live trackers - #1244
Merged
Conversation
… plan; fix four reds Adds docs/reorg/2026-10-14-tidy/: the plan (district-model execution, placement rules, single-source matrix, eight phases of bot packets, owner decision sheet D335 onward), every open issue's literal/golden/mischief record, the workflow audit, the sibling wiring audit (40 drifts) and a rulings ledger snapshot (D1 to D334) compiled from #787 and #1234 after the workstation wipe. Phase 0 fixes landed here: - standards-map.toml: map READINESS.md (Gate D red on main since #1235) - Debtfile: drop the resolved shell-scripts-missing-spdx entry whose acceptance expired 2026-10-01 (debt-measure red) - readme-derive-reusable.yml: remove the concurrency block that collided with every caller's group and cancelled the run before any job (README Derive red for 36 consecutive runs) - Justfile: v1-audit path, build/clean no longer name a missing dir, lint delegates to validate, llm-context reads the .adoc warm-ups - .github/funding.yml: remove the lower-case duplicate (case collision with FUNDING.yml; names another owner) Debt-exception: shell-scripts-missing-spdx — count reached 0 and the entry's acceptance expired 2026-10-01; entries leave the ledger by reaching zero (Debtfile preamble) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7
…n the tidy pack The governance docs gate rejects any file naming the retired .a2ml spelling of the launcher standard (four quotes in the appendices and the dispositions table), and the Hypatia baseline validator reported one new http_in_docs finding for a quoted plain-HTTP curl example. Both are evidence text; reworded so the gates read clean without a baseline ack. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7
…21 cohort with live trackers .hypatia-baseline.json: 188 entries -> 64. The 21 acks expiring 2026-10-21 were all dead: every one names a file that no longer exists, a construct that is gone from the file, or a workflow basename that the pinned scanner (hypatia 51ab649, #888) can never match. The pinned scanner's run on main@bf211558 emitted 59 findings, all acknowledged, and only 43 of the 188 entries matched any of them; replaying those 59 through scripts/apply-baseline.sh against the new baseline with the clock at 2026-10-22 keeps 0. Dispositions (each entry re-verified against the pinned rule source or the file, not against the issue text): - DELETE 124: 60 whose path is absent from the tree; 36 whose file exists but the construct is gone and which were expiring or pointed at a closed tracker; 28 whose construct is gone but were not yet expiring (deliberate widening of the packet: a dead ack is accepted risk that no longer exists; the CI replay proves none of them suppresses a live finding at the current pin). - RE-ACK 8, all to 2026-12-22 so they join the existing cohort: three content_patterns findings in the frozen archive (tracker #939 closed -> #493); four hardcoded_tmp findings in scripts/sweep-classifiers/ (tracker #936 closed -> #1243, opened for exactly these four); one CSA003 code-scanning echo (tracker #378 closed -> #957, the CSA tripwire issue), kept rather than deleted because CSA entries echo live alert state that cannot be re-verified from the tree. - KEEP 56. FIX 0 (nothing was mechanical enough to convert to an inline directive without a content judgement; 9-archive and outreach untouched). Acceptance (local): jq valid and byte-identical to `jq -a --indent 1`; zero path entries name a missing file; zero entries expire before 2026-11-15; every tracker is an open issue; apply-baseline-test 32/32, wave8-gates 11/11, exemption-ratchet 14/14, hypatia-blocking-gate pass. The hypatia-scan gate on the PR is the remaining acceptance. Refs #975 #1222 #1243. Packet: docs/reorg/2026-10-14-tidy/README.adoc P1.1. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7
…nge; keeps the remote fast-forwardable)
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 14 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/38496811344 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
hyperpolymath
marked this pull request as ready for review
October 14, 2026 01:42
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/38497165831 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
|
Owner
Author
|
Status on head What is failing. The ratchet compares the Debtfile against the base (all 7 entries The fix, verified. The same tree as one commit on top of Why it is not pushed. Rewriting
Two notes, no action needed. The earlier Generated by Claude Code |
hyperpolymath
added a commit
that referenced
this pull request
Oct 14, 2026
… sessions (#1252) ## What this is One new file, `docs/reorg/2026-10-14-tidy/HANDOVER.adoc`, alongside the plan merged in #1240. It is what a fresh packet session needs beyond the plan: - the session model (one packet, one branch, one PR; never restart a merged branch; the worker never merges or force-pushes); - which Phase 1 and 2 packets can run side by side (P1.5, P1.8), which are serial in one session (P1.4 → P1.10 → P1.7, all editing `.hypatia-baseline.json`; all of Phase 2, all editing the map), and which wait on the owner (P1.2/P1.3 on the dispositions table, P1.6 on D341 and the Pages cancel); - what P1.1 (#1244) taught: code-scanning acks are tripwires, trackers must be issues that stay open, verify against the file not the issue text, byte-exact baseline formatting, declared widening; - the cloud container's tooling gaps and the gates that bite by change type, including the Debt ratchet's trailer semantics; - the reviewer brief (opus tier, effort high) with its escalation list; - paste-ready prompts for the sonnet workers, the haiku passes and the opus reviewer. Authority: applied-unless-struck (D113); prose, CC-BY-SA-4.0 from birth. Refs #1234. ## Acceptance (local) ``` bash scripts/link-rot-guard.sh docs/reorg/2026-10-14-tidy -> all internal links resolve bash scripts/check-launcher-standard-currency.sh --root . -> no stale references bash scripts/check-standards-map.sh -> GATE D PASSED bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml -> passed, nothing breached bash scripts/check-canonical-names.sh origin/main -> no deprecated names reintroduced bash scripts/check-canon-lockstep.sh -> GATE A PASSED bash scripts/run-mustfile.sh …/Mustfile.a2ml -> 14 passed, 0 blocking git diff --check -> clean ``` The repo-wide link-rot guard also reports two broken `../discussions` links in issue templates untouched since #830; not this PR's. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7 --- _Generated by [Claude Code](https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7)_ Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Oct 19, 2026
…eep it that way (#1304) ## Summary `.hypatia-baseline.json` was valid I-JSON but not JCS: it had 516 indented lines and unsorted member names. `3-practice/JSON-POLICY.adoc` §6 left this file undecided. On 2026-10-19 the owner ruled that it must be converted. This PR has two commits. ### 1. `chore(json): canonicalise .hypatia-baseline.json` - I ran `ijson-jcs fix` with the binary built from the commit CI pins (`0fdeea71`). The file is now one sorted line ending in LF, which satisfies `.editorconfig`. Its parsed value is unchanged: `jq` reads `$old == $new` as true. - No tool rewrites this file in this repo. People and agents edit it by hand or with `jq` in PRs. Every reader parses it with `jq`, so the single-line layout breaks no consumer: - `apply-baseline.sh` - `filter-sarif-by-baseline.sh` - `check-exemption-ratchet.sh` - the banned-language lookup in `governance-reusable.yml` - `tests/test_secret_scanner_no_inherit.sh` - Docs: - `JSON-POLICY.adoc` §6 records the ruling. - `HYPATIA-BASELINE-FORMAT.adoc` tells editors to run `ijson-jcs fix .hypatia-baseline.json` after an edit. It also says the indented example there is for reading only. ### 2. `ci(json): block drift on converted JSON` (separate commit, so it can be dropped) - Adds the job **"Converted JSON stays canonical"** to `ijson-jcs.yml`. It runs `check-ijson-jcs.sh --enforce .hypatia-baseline.json` and nothing else. The repo-wide scan stays report-only. - Why it's needed: the baseline is edited often (#1239 and #1244 last week). A plain `jq` edit writes it back indented, and the report-only scan would not fail on that. This follows the precedent of `package.json` in LANGUAGE-POLICY §1.4, where the conversion comes with a job that fails if someone forgets to re-canonicalise. - ⚠ This makes one file blocking. Per JSON-POLICY §3, making the gate blocking is an owner decision. If you only want the conversion, drop this commit. ## Testing - `check-ijson-jcs.sh --enforce .hypatia-baseline.json` exits 0 on this branch and 1 on `origin/main`'s copy. - `apply-baseline.sh` gives **byte-identical output** on the old and new files, in both `advisory` and `blocking` modes. The input had 62 matching findings plus one planted finding that should not match: 62 were suppressed and 1 was kept, in both. - `check-exemption-ratchet.sh origin/main` passes, with `.hypatia-baseline.json` unchanged at 62 entries. - These tests pass: | Test | Result | |---|---| | `exemption-ratchet-test` | 14/14 | | `apply-baseline-test` | 52/52 | | `check-ijson-jcs-test` | 31/31 | | `hypatia-blocking-gate-test` | pass | | `test_secret_scanner_no_inherit` | pass | - Workflow checks: `actionlint` 1.7.7 is clean. `validate-sha-pins`, `validate-actions-lock`, `check-lock-sync`, `check-workflow-duplicate-keys`, `validate-permissions` and the actions-lock gate all pass. The pre-commit and commit-msg hooks pass. - `validate-spdx-workflows` fails when run across the whole repo. The failure is on `9-archive/rhodium-standard-repositories/satellites/rsr-deployer/.github/workflows/jekyll-gh-pages.yml`, which this PR does not touch. The staged-file run in pre-commit passes. ## Trade-off Because the file is now one line, every future edit shows in a diff as a whole-line change. To review a change, run `jq . <file>` on both sides and compare those, or use `git diff --word-diff`. --- _Generated by [Claude Code](https://claude.ai/code/session_014h2gFLLQibfB5N5hFz9ZCD)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Packet P1.1 of
docs/reorg/2026-10-14-tidy/README.adoc, executed by a Sonnet-class agent under supervision (every disposition re-checked by the supervisor against the file or the pinned rule; gates re-run before commit). Refs #975, #1222, #1243..hypatia-baseline.json: 188 entries → 64. One file changed.The 21 acks expiring 2026-10-21
All dead. Each names a file that no longer exists, a construct that is gone from the file (
innerHTML,.unwrap(),@ptrCast, pipe-to-shell,postulate), or a workflow basename the pinned scanner (hypatia51ab649, with #888's path qualification) can never match. Evidence: the pinned scanner's run onmain@bf211558emitted 59 findings, all acknowledged; only 43 of the 188 entries matched any of them; replaying those 59 throughscripts/apply-baseline.shagainst the new baseline with the clock set to 2026-10-22 keeps 0. So the 2026-10-22 cliff was never a real cliff, and the acks are removed rather than renewed.Dispositions
content_patternsfindings inside the frozen archive (tracker Hypatia shell-exec patterns: download_then_run_shell + eval_in_shell (13 instances) #939 closed → [carve-out 4/9] rhodium-standard-repositories/ cleanup: de-vendor satellites/, merge templates into rsr-template-repo, delete the lying .gitmodules #493); fourhardcoded_tmpfindings inscripts/sweep-classifiers/(tracker Hypatia content_patterns/hardcoded_tmp: /tmp paths without mktemp (30 instances) #936 closed → sweep-classifiers: four scripts default INPUT/BLOBS_DIR to a fixed /tmp/drift-survey path (hardcoded_tmp) #1243, opened for exactly these four, with options to fix or archive); oneCSA003code-scanning echo on an archive template (tracker Hypatia reusable SARIF converter can re-upload code-scanning mirror findings #378 closed → PAT-refresh tripwire: live HYPATIA_SCAN_PAT will arm 6 unackable CSA findings in both gates #957, the CSA tripwire issue), kept rather than deleted because CSA entries echo live alert state that cannot be re-verified from the tree.9-archive/and3-practice/outreach/untouched).Acceptance
Local, all green:
The remaining acceptance is
hypatia-scan.ymlandgovernance / Validate Hypatia Baselinegreen on this PR.Notes for later packets
9-archive/(15 live at the current pin). P1.4 (archive excluded from every gate) removes them; not done here by design.a2ml_to_deed.pyanddeed_lint.py; their two acks must go in that PR. P1.7 may deletecopilot/coding-agent.yml(one ack).LICENSES/MPL-2.0.txt(not editable); they wait on PAT-refresh tripwire: live HYPATIA_SCAN_PAT will arm 6 unackable CSA findings in both gates #957.mainis the one file above.🤖 Generated with Claude Code
https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7
Generated by Claude Code