Repository navigation
docs(reorg): work orders v1.4.3 after the reviews on #1298 and #1303 - #1303
Merged
Merged
Conversation
Eight work orders for a sonnet-tier executor, each with the facts measured against main at 75bd599, the files, the steps, the acceptance commands and the conditions under which the executor stops and asks: WO-1 close out #1290 with the guard's negative test; WO-2 mirror honesty (P1.5); WO-3 community-health files (P1.8); WO-4 the archive is frozen (P1.4); WO-5 delete the Python deed tools (P1.10); WO-6 .github hygiene (P1.7); WO-7 follow the manifest rename through (#1272, with the D338 question for the owner); WO-8 the handover note after #1249. Plus the session mechanics for the wave and the owner items it depends on. Refs #1234 #1290. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7
Corrections from the Codex review of #1298, each verified against main: WO-1 drops the negative test that already exists; WO-2 also removes the two GitLab continue-on-error suppressions and probes destinations without requiring HEAD; WO-3 takes the citation version and date from canon.lock together; WO-4 no longer creates a directory entry in .hypatia-ignore (the exemption contract forbids it), keeps the archive acks, enumerates the eleven local validators and leaves the secret scanners alone; WO-5 also updates the launcher mapping specification that runs deed_lint.py; WO-6 leaves the CODEOWNERS SPDX header to the owner and makes silence on the Copilot config mean defer; WO-7 moves the estate-wide readiness and wiki references to bucket B; WO-8 retires the two Deno Debtfile probes instead of re-scoping them, and runs first so the Debtfile gate stops blocking the wave. Also corrects the link-rot baseline: the repo-wide guard reports 684 broken internal links on main (680 before #1272), not two. The earlier figure was truncated output. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7
Eight corrections, each verified against the tree before it was written in: - The link-rot baseline is 443 on main from a checkout named `standards` (the guard prunes 9-archive/ only under that basename); 684 was measured from a differently named directory. Every count, threshold and the WO-8 handover correction now say so. - WO-4 discovery is non-mutating: registry-readiness.sh is a licence rewriter for other repositories and is now on the never-list; kyaml-migrate.sh runs with --check only; fix-workflow-duplicates.sh is read, not run; `git status --porcelain` must be empty before editing. - WO-4 gains the governance language-policy walker: an opt-in `policy_exclude_pathspec` input on the reusable, passed by the local caller, default a no-op for every other repository. - The archive README is granted as the one explicit exception to the never-edit-9-archive rule. - WO-2's destination probe skips only on a confirmed not-found message; every other non-zero exit (auth, transport, DNS) stays red. - WO-3's CITATION.cff lists the required `message` key and checks the four required keys. - WO-7 names the nested README's correct target, ../../0-AI-MANIFEST.deed. - WO-1 is issue-only: no branch, no PR; its transcript goes on #1290. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7
Fifteen findings from CodeRabbit and Codex on e25ca54, 71587d1 and 8eae5ad, each verified against the tree before it was written in: - The pre-push gate is the locally runnable part of an acceptance block; "after push", "On the PR" and "after merge" lines are recorded as they land. The repository-wide link-rot run is the gate for root-level touches (exit 1 at the 443 baseline is accepted; the count must equal origin/main's in the same checkout) and for the archive README (the archive is never scanned on its own: 272 old findings). - A third known red on main: the Hypatia gate rejects actions.lock format v0.0.3 since #1300; the fix is hyperpolymath/hypatia#927 or #928 and needs nothing here. Never acknowledge it in the baseline. - WO-2's probe is a diagnostic only, never a skip: a deploy key cannot tell an absent repository from a forbidden one, and the *_MIRROR_ENABLED variable is the one legitimate skip. - WO-4 gains check-package-policy.sh (an eleventh validator, run for every caller, whose find_first would accept an archive manifest), the standards-map files count (1136 -> 1137), and a non-empty guard on the reusable input (git rejects an empty pathspec) with a default-arm proof. - WO-5's fallback test runs under `bun test` (the file imports bun:test). - WO-6 never deletes the seven drafts on its own judgement: all seven call themselves draft, to-do or in progress; the owner disposes of each. - WO-7 drops TOPOLOGY.adoc (frozen, archived by P2.4) and ROADMAP.adoc 103 (the AI Gatekeeper Protocol row) from bucket A; the count goes to 440. - WO-8 rewrites the plan's "Deno and Python banned" definition at README line 69 and greps both prose files. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7
#1298 squash-merged the work orders at v1.2.0 (plus CodeRabbit's agent edit) while v1.3.0 was being prepared; this merge carries the branch past that squash so the follow-up diff against main is the v1.3.0 delta alone. Where both sides added the file, the branch's v1.3.0 is kept. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7
hyperpolymath
marked this pull request as ready for review
October 19, 2026 16:29
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Docstring Coverage |  |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
| Title check | |
The title clearly identifies the work-order update and its review-driven context. It is specific and relevant to the changeset. |
| Description check | |
The description is detailed and directly explains the review findings, document updates, known failures, and acceptance checks. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7406ac7ddd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Five findings on 7406ac7, each verified against the tree: - The Hypatia gate will not clear itself when hypatia merges its fix: both reusables pin `hypatia-ref` to a vetted SHA (51ab6496 in the governance reusable) and neither local caller overrides it, so the defaults must advance afterwards. The known-red paragraph says so and the pin bump is a new owner item. - The repository-wide link-rot gate compares sets, not counts: save the guard's output before the first edit and require no new BROKEN line. Repairs (WO-7's three) show as removals, and a touched file may keep the old broken links it already had (ai-instruction's README has six). - The package-policy exclusion is opt-in: one reusable input, `policy_exclude_dir`, feeds both the language block's pathspec and a `PKG_PRUNE_DIRS` hook in check-package-policy.sh, so the copy every other caller runs is unchanged. - WO-6's `test ! -d .github/ISSUES` leaves the pre-push gate until the owner has disposed of all seven drafts; until then the gate is that the directory is untouched. - WO-8's plan check allows the issue-triage rows that record Deno's history (#706, #919, #923) and forbids only live claims. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 559d3a8e9d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…cess Codex on 559d3a8: `diff … | grep '^>'` exits 1 when there is no added line, which is the desired state, so as a pre-push gate it blocked every compliant order. The three uses (session mechanics, WO-3, WO-7) now read `! diff "$before" <(…) | grep -q '^>'`, exit 0 exactly when no new BROKEN line exists; WO-7 counts its three repairs with `grep -c '^<'`. Proved locally on synthetic output: unchanged 0, one repair 0, one new line 1. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5d5c7bbce3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex on 5d5c7bb: under `set -o pipefail` the gate `! diff … | grep -q '^>'` returned 0 whether or not a new BROKEN line was added, because diff's own exit 1 (the outputs differ) replaced grep's verdict as the pipeline status, and WO-7's `diff … | grep -c '^<'` printed the expected count but returned 1. All four uses (session mechanics, WO-3, WO-7 twice) now wrap diff as `{ diff … || true; }` so grep alone decides. Proved under pipefail on synthetic output: unchanged 0, three repairs 0 (count 3, exit 0), one new line 1, mixed 1; the same results without pipefail. The revision line is bumped to v1.4.2 (v1.4.1 left it at v1.4.0). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 15fb14d905
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…neutralised Codex on 15fb14d, two findings, both verified against the tree: WO-2: each forge job in mirror-reusable.yml ends in a notice-only `Skipped (<FORGE>_SSH_KEY not configured)` step (seven in all) that runs when the variable is true but the secret is empty, so the acceptance claim "skipped by its variable or red" was false for that case. The order now names it as the second legitimate skip and keeps it: the reusable's own Radicle comment calls the secret the second switch, and the regularisation design (line 107) counts 142 estate callers skipping this way with the question marked OWNER?. Whether it should fail red is a new owner item, with red labelled as the elegant arm and the reasons for departing from it. Acceptance gains `grep -c 'not configured)' -> 7`. WO-7: `bash scripts/link-rot-guard.sh . | grep '0-AI-MANIFEST'` returned 1 under pipefail even with the TOPOLOGY line found, because the guard itself exits 1 at 440; it is now `{ … || true; } | grep …` (proved: old form 1, new form 0). Also found while re-reading WO-2's acceptance: `grep -c 'continue-on-error'` would count the comment at line 121, which the order keeps because it names the owner action; the check is now anchored to the key (`^[[:space:]]*continue-on-error:`), 2 on the tree today, 0 after the order. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7
hyperpolymath
enabled auto-merge (squash)
October 19, 2026 17:19
|
hyperpolymath
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a1e2f2cc9d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+54
to
+55
| `bash scripts/link-rot-guard.sh . > "$before" || true`, and the gate is | ||
| `! { diff "$before" <(bash scripts/link-rot-guard.sh . || true) || true; } | |
There was a problem hiding this comment.
When a work order adds or removes files—WO-3 creates three root files, for example—the filesystem traversal order used by the unsorted find loops in scripts/link-rot-guard.sh can change without changing the set of broken links. A normal diff then emits > lines for reordered existing findings, so this mandatory gate rejects an otherwise compliant push as if it introduced link rot. Sort both snapshots before comparing them, or otherwise perform an order-independent set comparison.
Useful? React with 👍 / 👎.
Contributor
|
Add Carrot credits or activate Agent usage billing to use Autofix |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Follow-up to #1298, which merged the work orders at v1.2.0 plus CodeRabbit's agent edit (
c932c96e). Fifteen findings were posted on that PR after its last reviewed head and before the merge: three by CodeRabbit (applied by its agent inc932c96e, refined here) and twelve by Codex across three rounds. Each was verified against the tree before being written in. Same file, same authority (applied-unless-struck, D113; prose, CC-BY-SA-4.0).The branch is the designated one restarted after the squash; a clean restart needed a force-push this session may not make, so
7406ac7dmergesmainand keeps v1.3.0 where both sides added the file. The diff againstmainis the v1.3.0 to v1.4.3 deltas alone: one file.Dispositions (v1.3.0)
9-archive/scans the archive and reports 272 (Codex P1, line 366)standardsis the gate, plus the new file's links by eye. 272 verified.check-package-policy.shwalks the archive; ten manifests there could satisfy the policy (Codex P2, line 337)find_firstnoted. Verified: tenmanifest.scm/guix.scm/Containerfileunder the archive.files = 1136goes stale (Codex P2, line 366)bun test(Codex P2, line 456)bun:test.TOPOLOGY.adocis a frozen snapshot (Codex P2, line 545)ROADMAP.adoc103 describes the AI Gatekeeper Protocol (Codex P2, line 541)c932c96e; kept.could not be foundis ambiguous (CodeRabbit, lines 226–230; Codex P1 earlier)*_MIRROR_ENABLEDvariable is the one legitimate skip. CodeRabbit's "forge-specific evidence" rewrite is withdrawn too: it needs a second credential per forge for a question the variable already answers.Review rounds on this PR
v1.4.0 (
559d3a8e): Codex posted five findings on7406ac7d; all five verified and taken.hypatia-refto a vetted SHA; the upstream fix clears nothing by itself (P1)hypatia-refdefaults advance past it (a two-line PR here, nouses:change). New owner item. My "resolves at HEAD" claim was wrong and is corrected on #1298 too.origin/mainblocks WO-7's intended reduction (P1)-o -name 9-archiveincheck-package-policy.shweakens every caller (P2)policy_exclude_dir, feeds the language block's pathspec and aPKG_PRUNE_DIRShook in the script; the shared copy is unchanged by default; four default-arm runs required.test ! -d .github/ISSUESfails in the supported silence case (P2)v1.4.1 (
5d5c7bbc): Codex posted one finding on559d3a8e, verified and taken:diff … | grep '^>'exits 1 in the desired state, so the three gate lines now read! diff "$before" <(…) | grep -q '^>'(exit 0 when no new BROKEN line), proved on synthetic output.v1.4.2 (
15fb14d9): Codex posted one finding on5d5c7bbc, verified and taken: underset -o pipefail, diff's own exit 1 (the outputs differ) replaced grep's verdict as the pipeline status, so the inverted gate passed a new BROKEN line, and WO-7's count printed 3 but returned 1. All four uses now wrap diff as{ diff "$before" <(…) || true; }so grep alone decides; proved with and without pipefail (unchanged 0, repairs 0 with count 3 and exit 0, added 1, mixed 1). The revision line, which v1.4.1 had left at v1.4.0, now reads v1.4.2.v1.4.3 (
8aa2e177): Codex posted two findings on15fb14d9; both verified and taken.link-rot-guard.sh . | grep '0-AI-MANIFEST'returns 1 under pipefail, the guard exiting 1 at 440 (P2){ … || true; } | grep; proved on the tree (old form 1, new form 0). No other line pipes the guard raw.*_SSH_KEYsecret is empty hits a notice-only "Skipped" step and stays green, so "skipped by its variable or red" was false (P2)OWNER?. WO-2 records the facts, keeps the seven steps (grep -c 'not configured)' -> 7) and names three honest outcomes. New owner item: red is labelled the elegant arm, with the reasons the order departs from it.Found while re-reading WO-2's block:
grep -c 'continue-on-error'would have counted the comment at line 121, which the order keeps because it names the owner action. The check is now anchored to the key (^[[:space:]]*continue-on-error:): 2 on the tree today, 0 after the order.A third known red on
main, recorded for the executorscan / Hypatia Neurosymbolic Analysisandgovernance / Validate Hypatia Baselineare red onmainat every commit since #1300 regeneratedactions.lockingh actions-lockformat v0.0.3 (version:line 4, pluscommit/owner_id/repo_idon dependencies). Hypatia'slib/rules/actions_lock.exaccepts v0.0.2 only, so the gate sees twoinvalid_actions_lockfindings at severity high. The fix takes two steps: hyperpolymath/hypatia#927 or #928 merges, then thehypatia-refdefaults ingovernance-reusable.ymlandhypatia-scan-reusable.yml(vetted SHAs that the local callers do not override) advance past it. This PR shows the same red on its head, as its basea85aa8e7does onmain. The work orders say so, and say never to acknowledge it in the baseline.Acceptance (local, on
8aa2e177)Known reds that are not this PR's: the Debtfile
deno-residuebreach (WO-8 retires it) and the Hypatia gate above.🤖 Generated with Claude Code
https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7