From 043a1d6753f5828d60b0cff2a34937088646ca72 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 12:14:01 +0000 Subject: [PATCH 1/9] docs(reorg): work orders for the first execution wave (2026-10-19) Eight work orders for a sonnet-tier executor, each with the facts measured against main at 75bd5994, the files, the steps, the acceptance commands and the conditions under which the executor stops and asks: WO-1 close out #1290 with the guard's negative test; WO-2 mirror honesty (P1.5); WO-3 community-health files (P1.8); WO-4 the archive is frozen (P1.4); WO-5 delete the Python deed tools (P1.10); WO-6 .github hygiene (P1.7); WO-7 follow the manifest rename through (#1272, with the D338 question for the owner); WO-8 the handover note after #1249. Plus the session mechanics for the wave and the owner items it depends on. Refs #1234 #1290. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7 --- .../WORK-ORDERS-2026-10-19.adoc | 443 ++++++++++++++++++ 1 file changed, 443 insertions(+) create mode 100644 docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc diff --git a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc new file mode 100644 index 000000000..4c7fe6e37 --- /dev/null +++ b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc @@ -0,0 +1,443 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) += Work orders, 2026-10-19: the first execution wave +Jonathan D.A. Jewell (hyperpolymath) +v1.0.0, 2026-10-19 +:toc: left +:toclevels: 2 +:sectnums: +:icons: font + +[.lead] +Eight work orders for a sonnet-tier executor, planned at the top tier so +the executor never has to rediscover a fact. Every fact below was measured +against `main` at `75bd5994` on 2026-10-19. Each order names its goal, its +authority, the files, the steps, the acceptance commands, and the exact +conditions under which the executor stops and asks instead of deciding. + +Read first: link:README.adoc[the plan] (_Guardrails for every packet_), +then link:HANDOVER.adoc[the handover note], then this file. Where the two +earlier documents say Deno is retired, this file wins: Deno is permitted +at tier 2 since #1249 (ruled 2026-10-14); A2ML remains retired. + +== Session mechanics for this wave + +* *Executor:* this session, switched to the sonnet tier. Effort *medium* + for WO-1, WO-3, WO-6 and WO-8; *high* for WO-2, WO-4, WO-5 and WO-7, + which edit validators, CI or many files. +* *One order, one branch, one PR.* Branch `tidy/wo-N-` from the + current `origin/main`. Never reuse a merged branch. The owner has to + grant this session permission to push to `tidy/*` branches once; until + then the executor stops before the first push and says so. +* *Never:* merge, force-push, admin-override, touch a licence file or + header, edit `9-archive/` content or `3-practice/outreach/`, create or + extend a `.a2ml`, edit a descriptile by hand (D313), or sweep. +* *Before every push, all of:* `bash scripts/check-standards-map.sh`, + `bash scripts/check-canon-lockstep.sh`, + `bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml`, + `bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml`, + `bash scripts/link-rot-guard.sh `, + `bash scripts/check-canonical-names.sh origin/main`, + `bash scripts/check-launcher-standard-currency.sh --root .`, + `git diff --check`, plus the order's own acceptance block. The + repo-wide link-rot guard reports two broken issue-template links that + predate this work (#830); they are not yours. +* *PR body:* the order id, the authority line per change, the acceptance + block with every result pasted verbatim, a "not done" list. Open as a + draft; mark ready when the acceptance block is green; watch CI; fix + reds; stop at merge. +* *Stop and ask* whenever an order's _Escalate if_ condition is met. A + stop is a one-paragraph message naming the order, the condition, both + arms with the elegant one first, and what you did meanwhile. +* *Order and concurrency* (at most three PRs open at once): + WO-1 first; then WO-2, WO-3 and WO-8 in parallel; then WO-4, WO-5 and + WO-6 strictly in that sequence (all three edit `.hypatia-baseline.json`); + WO-7 may run beside WO-4. P1.2, P1.3, P1.6 and P1.9 are not in this + wave: they wait on the owner items at the end. + +== WO-1: close out #1290 (lockfile self-SHA refs) + +*Goal.* Finish issue #1290 with evidence. The outage it describes is +already repaired on `main`; what remains is the guard's negative test and +the re-measurement the issue asks for. + +*Authority.* #1290 acceptance criteria 1 to 4, owner-filed. + +*Facts measured.* The four leaf entries now carry tag refs in +`.github/workflows/actions.lock`: `github/codeql-action` v4.38.0, +`goto-bus-stop/setup-zig` v2.2.1, `swatinem/rust-cache` v2.9.2, +`webfactory/ssh-agent` v0.10.0. No third-party entry's `ref:` equals its +own key SHA any more. `scripts/lock-selfcheck.sh` already reports such an +entry as POISON (its `self_sha_deps` pass, exit 1) and the Lock Self-Check +workflow is green on `main`. `scripts/tests/lock-selfcheck-test.sh` has a +positive control only; it has no fixture with a self-SHA ref. + +*Steps.* +. Find the commits that corrected the four refs: + `git log --format='%h %s' -8 -- .github/workflows/actions.lock`. +. Add one negative-control fixture to `scripts/tests/lock-selfcheck-test.sh` + in the style of the existing `expect` cases: a dependencies entry whose + `ref:` is its own 40-hex SHA; expect rc 1 and the text `self-SHA ref`. + Run the test file; it must pass, and it must fail if you revert the + guard lines in `lock-selfcheck.sh` (prove it once, then restore). +. Re-measure one caller: find any estate repository whose workflow pins a + standards reusable at or after the fixing commit and whose latest run + passed Set up job. Record repository, run id, pin. If none exists yet, + say so; do not push to a repository outside this session's scope. +. Comment on #1290 with a four-row table (entry, ref now, fixing commit) + plus the test and the re-measurement. Close the issue only if the owner + has given the P1.2 approval; otherwise leave it open with the evidence. + +*Acceptance.* +---- +bash scripts/tests/lock-selfcheck-test.sh -> all cases pass, new negative case present +bash scripts/lock-selfcheck.sh "$(git rev-parse origin/main)" -> SELF-CONSISTENT +---- + +*Escalate if* any entry other than the four still carries a self-SHA ref +(then the guard is not catching it, which is a second bug), or if the +re-measured caller is still dying at Set up job. + +== WO-2: mirror honesty (P1.5; #950, #1002) + +*Goal.* The Mirror to Git Forges run on `main` is green or honestly +skipped, and the reusable can no longer hide a failure. + +*Authority.* Plan row P1.5; D261 for the destinations; applied-unless-struck (D113). + +*Facts measured.* Run 39242703018 on `75bd5994`: all seven forge jobs ran, +so all seven `*_MIRROR_ENABLED` repository variables are `true`. GitLab +and Radicle succeeded. Sourcehut, Disroot and Gitea failed at their +"Verify SSH host" step. Codeberg and Bitbucket passed the host +check and failed at the push step. The reusable is +`.github/workflows/mirror-reusable.yml` (445 lines). The GitLab job +(lines 78 to 140) is the pattern the others copy. Line 441 is +`rad sync --announce || echo "Radicle sync attempted"`, which turns a +failed sync into a green step. The caller in this repository is +`.github/workflows/mirror.yml`, pinned to the reusable at `427eb35c`. + +*Steps.* +. Read the failing steps' logs for the five red jobs and record the + reason per forge in the PR body (fingerprint variable absent, host key + mismatch, destination repository missing, key refused). +. Remove the `|| echo` on line 441. A failed Radicle sync fails the step. +. Add a destination probe to each forge job, before its push step: a + `git ls-remote --exit-code HEAD` guarded by the same key + presence check. A missing destination emits a `::notice::` naming the + forge and D261 and skips the push. A present destination that refuses + the push stays red. +. Add an empty-host guard: when the resolved mirror organisation or host + is empty, skip with a `::notice::`, never push to an empty path. +. Keep the SSH fingerprint verification exactly as strict as it is. +. Do not edit `actions.lock` unless a `uses:` line changed; if one did, + regenerate with the repository's own relock tooling, never by hand. +. In the PR body, list the five variables the owner flips to `false` on + this repository until D261 provisions the forges: + `SOURCEHUT_MIRROR_ENABLED`, `DISROOT_MIRROR_ENABLED`, + `GITEA_MIRROR_ENABLED`, `CODEBERG_MIRROR_ENABLED`, + `BITBUCKET_MIRROR_ENABLED`. Variables are not in the tree; the executor + cannot set them. + +*Acceptance.* +---- +grep -c '|| *echo' .github/workflows/mirror-reusable.yml -> 0 +bash scripts/check-workflow-duplicate-keys.sh -> clean +bash scripts/lock-selfcheck.sh "$(git rev-parse HEAD)" -> SELF-CONSISTENT (after push) +Mirror to Git Forges on main after merge: GitLab and Radicle green; every +other forge skipped with a notice (once the variables are flipped) or red +with a named reason, never green on a failure. +---- + +*Escalate if* any forge fails on a host-key fingerprint mismatch (a +security condition the owner decides), or if making a step honest would +turn `main` permanently red before the owner can flip the variables; in +that case open the PR as a draft and say so. + +== WO-3: community health files (P1.8) + +*Goal.* GitHub's community profile shows a code of conduct, contributing +guide and citation file, each pointing at the canonical source. + +*Authority.* Plan row P1.8; the docs rule that GitHub-required files are +Markdown; applied-unless-struck (D113). + +*Facts measured.* Root has `SECURITY.md` and `READINESS.md`. Root has no +`CODE_OF_CONDUCT.md`, `CONTRIBUTING.md` or `CITATION.cff`. The sources are +`3-practice/CODE_OF_CONDUCT.adoc` and `3-practice/CONTRIBUTING.adoc`. +`standards-map.toml` has `entry_count = 129`. The Debtfile probe +`docs-md-not-adoc` counts only `docs/`, so root Markdown does not move it. + +*Steps.* +. Write `CODE_OF_CONDUCT.md` and `CONTRIBUTING.md`: a title, two or three + sentences, and a link to the `3-practice/` source. No duplicated + content. SPDX comment at the top as `SECURITY.md` does it. +. Write `CITATION.cff` (`cff-version: 1.2.0`): title, the owner as author, + `repository-code`, `license: MPL-2.0`, `date-released` today, and a + `version` taken from `canon.lock`. +. Add three `[[entry]]` blocks to `standards-map.toml` after the + `SECURITY.md` block, `district = "root"`, `kind = "onramp"`, + `lifecycle = "versioned"`, `canonical = false`, and raise `entry_count` + by three. + +*Acceptance.* +---- +bash scripts/check-standards-map.sh -> GATE D PASSED +bash scripts/link-rot-guard.sh . -> only the two pre-existing #830 findings +bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml -> docs-md-not-adoc unchanged +GitHub community profile after merge: all items present. +---- + +*Escalate if* the map's root district refuses a new `kind`, or if the +docs-format workflow rejects a root `.md`; both would mean the rule in +the plan is wrong, which is the owner's to settle. + +== WO-4: the archive is frozen (P1.4) + +*Goal.* Nothing scans `9-archive/`, and no baseline ack points into it. + +*Authority.* Plan row P1.4; applied-unless-struck (D113). + +*Facts measured.* No `.hypatia-ignore` exists in this repository. +Eighteen baseline entries have a path under `9-archive/`. There is no +`9-archive/README.adoc`; the district holds `REORGANIZATION-PLAN.adoc` and +`rhodium-standard-repositories/`, both mapped. The scanner's ignore-file +reader is `lib/hypatia/scanner_suppression.ex` in the hypatia checkout +(around line 544; the format comment is just below it): one entry per +line, `#` comments. The banned-language rule is unsuppressible by design. +In `ci-pipeline.yml` the `detect` job counts files with a `count` helper +built on git pathspecs (around line 129); the per-language jobs reuse the +same pathspecs. + +*Steps.* +. Read the ignore-file format in the scanner source, then create + `.hypatia-ignore` with one entry excluding `9-archive/` in the form the + parser accepts, with a comment naming P1.4. +. In `ci-pipeline.yml`, add `':!9-archive/**'` to the `count` pathspecs + and to every per-language job pathspec that mirrors them, so archive + files cannot flip a `has_` output or feed a job. +. Create `9-archive/README.adoc` with one paragraph: frozen, not scanned, + not edited; pointers to the plan and the map entries. +. Remove the eighteen archive entries from `.hypatia-baseline.json`. Keep + the file byte-identical under `jq -a --indent 1 .`. Any entry whose rule + is the banned-language rule cannot be ignored and stays; list it in the + PR body for the owner. + +*Acceptance.* +---- +jq '[.[] | select((.file // .path // "") | startswith("9-archive/"))] | length' .hypatia-baseline.json -> 0 +jq -a --indent 1 . .hypatia-baseline.json | cmp - .hypatia-baseline.json -> identical +bash scripts/tests/apply-baseline-test.sh; bash scripts/tests/wave8-gates-test.sh; bash scripts/tests/exemption-ratchet-test.sh -> all pass +On the PR: hypatia-scan, Validate Hypatia Baseline, Exemption ratchet and ci-pipeline green. +---- + +*Escalate if* the ignore file does not stop a finding (then the format +or the rule is not what the comment says), or if any archive ack is on +the banned-language rule. + +== WO-5: delete the Python deed tools (P1.10; D313, #944) + +*Goal.* `deed_lint.js` is the only validator; no Python in the tree. + +*Authority.* D313 (conversion is kyX's first front end; Python is +banned); plan row P1.10. + +*Facts measured.* `1-formats/deed/tools/` holds `a2ml_to_deed.py`, +`deed_lint.py`, `migrate_a2ml_to_deed.sh`, `deed_lint.js`, +`deed_lint.test.js`, `fixtures/`, `README.adoc`. The README describes the +Python tools at lines 10 to 18, 45, 51 to 68 and 84. The baseline carries +one ack each for `a2ml_to_deed.py` and `deed_lint.py`. These are the only +`.py` files outside the archive. + +*Steps.* +. `git rm` the two `.py` files and the migration shell script in one + commit; no content change in that commit. +. In a second commit, rewrite the README: `deed_lint.js` is the sole + validator; conversion is deferred to kyX (D313); drop the Python usage + blocks and the fixture note that referred to `deed_lint.py`. +. Remove the two acks from the baseline, byte-identical formatting. +. Run the JS tests the way the README says; if it does not say, run + `bun 1-formats/deed/tools/deed_lint.test.js` and record the command. + +*Acceptance.* +---- +git ls-files '*.py' | grep -v '^9-archive/' -> empty +bun 1-formats/deed/tools/deed_lint.js 0-AI-MANIFEST.deed -> OK +bash scripts/check-inline-python.sh -> clean +bash scripts/tests/apply-baseline-test.sh -> pass +On the PR: deed-conformance, language policy and Validate Hypatia Baseline green. +---- + +*Escalate if* anything outside this directory imports or calls the +deleted files (grep the tree for their names first), or if a test +fixture only the Python linter understood would be orphaned. + +== WO-6: `.github/` hygiene (P1.7) + +*Goal.* No never-filed issue drafts, no unpinned agent config, a correct +CODEOWNERS, and a pull-request template with the lockfile checkbox. + +*Authority.* Plan row P1.7; applied-unless-struck (D113). + +*Facts measured.* `.github/ISSUES/` holds seven Markdown drafts dated +2026-06-05, never filed. `.github/copilot/coding-agent.yml` configures a +Copilot coding agent with an unpinned `npx … @latest` and a plain-HTTP +localhost URL; the baseline carries one ack for it. `CODEOWNERS` line 2 +reads `SPFX-License-Identifier: CC-SA-BY-4.0` (two typos); it names a +`Makefile` (banned) and `3-practice/SECURITY.md` (GitHub reads only the +root file); `1-formats/contractiles/` exists, keep it. `dependabot.yml` +has a long HOLD comment on `codeql-action`; nothing in it contradicts the +weekly interval on a first reading. There is no pull-request template. + +*Steps.* +. `git rm -r .github/ISSUES/`. Before that, list the seven titles in the + PR body; any item still live is re-filed by the owner through the + campaign template, not by the executor. +. `coding-agent.yml`: delete it and its baseline ack, unless the owner + says the Copilot coding agent is in use; then pin the package to a + version and keep the ack. Default is delete. +. `CODEOWNERS`: fix line 2 to `SPDX-License-Identifier: CC-BY-SA-4.0`; + drop the `Makefile` and `3-practice/SECURITY.md` lines; add + `SECURITY.md @hyperpolymath`. +. `dependabot.yml`: compare every comment with the schedule it sits next + to; correct a comment only where it states something the file does not + do. If nothing is wrong, write that in the PR body and change nothing. +. Add `.github/PULL_REQUEST_TEMPLATE.md`: What and why; Authority + (ruling id, map target, or applied-unless-struck D113 with the arm + named); Acceptance block; a checklist with "actions.lock regenerated + with the repo tooling if any workflow changed", "no licence text + touched", "no .a2ml created or extended". + +*Acceptance.* +---- +test ! -d .github/ISSUES && test -f .github/PULL_REQUEST_TEMPLATE.md +bash scripts/tests/apply-baseline-test.sh -> pass +On the PR: labels and label-triage workflows green; Validate Hypatia Baseline green. +---- + +*Escalate if* any of the seven drafts describes work that is still open +and unfiled (list them; the owner decides), or if the owner has not +answered the Copilot question by the time the rest is ready: push +everything else and leave that file for a second commit. + +== WO-7: follow the manifest rename through (after #1272) + +*Goal.* The repository's own references to its machine front door name +the file that exists. + +*Authority.* #1272 renamed `0-AI-MANIFEST.a2ml` to `0-AI-MANIFEST.deed` +by hand on 2026-10-17; the file lints clean as a deed and the Mustfile +already expects the new name. Path repairs that a move makes necessary +are allowed by the plan's guardrails. Everything estate-facing is the +owner's (see the escalation). + +*Facts measured.* Sixty-three files outside `9-archive/` still name the +old file. They fall into three buckets. + +* *Bucket A, fix now: this repository's own pointers.* `Justfile` lines + 139 and 140 (the fallback `cat` now names a missing file), + `AGENTS.adoc` 4, `EXPLAINME.adoc` 11 (a link), `ROADMAP.adoc` 103, + `QUICKSTART-DEV.adoc`, `llm-warmup-dev.adoc` 4, `llm-warmup-user.adoc` + 4, `3-practice/ai-instruction/README.adoc` 73 (a link), + `docs/wikis/README.adoc` 27, `docs/wikis/users/index.adoc`, + `TOPOLOGY.adoc`, `0-canon/GOVERNANCE.adoc` 56, + `component-readiness-grades/*.adoc`, `toolchain-readiness-grades/*.adoc`. +* *Bucket B, do not touch; put to the owner as the D338 follow-through:* + rules and tools that tell the whole estate what file to have: + `0-canon/rsr/rsr-criteria-v2.a2ml` criterion 2.3.1, + `.machine_readable/template-capability-gates.toml`, + `scripts/registry-readiness.sh`, `scripts/check-manifest-ply.sh` and its + test, `0-canon/TEMPLATE-APPLICABILITY-POLICY.adoc`, + `3-practice/immaculate-guide/IMMACULATE-GUIDE.adoc`, + `3-practice/TEST-NEEDS.adoc`, + `3-practice/testing-and-benchmarking/TESTING-TAXONOMY.adoc`, + `2-protocols/overlay/scripts/check-conformance.sh`, + `2-protocols/k9-coordination/README.adoc` and its spec table, + `.machine_readable/MUST.contractile` line 66, + `.machine_readable/contractiles/dust/Dustfile.a2ml` line 28, and every + `AGENTIC.a2ml` descriptile (D313 forbids hand edits). The question for + the owner: accept both names estate-wide during the transition, or + revert #1272 until the manifest family has its ruling (D338 proposed + manifest clauses on the repo deed, not a standalone file). +* *Bucket C, leave: historical and spec text.* The AI-gatekeeper protocol + documents and examples, the ensaid specification, the overlay + specification, `docs/reorg/` (dated records), `docs/archive/`, + `.machine_readable/archive/`, `standards-update/`. + +*Steps.* +. Edit bucket A only. In `Justfile`, the fallback becomes + `cat 0-AI-MANIFEST.deed` and the echo names the deed. Links point at `0-AI-MANIFEST.deed`. +. In the PR body, paste bucket B as a table (file, line, what it asserts) + under the heading "D338 follow-through, owner decision". +. Post the same table as one comment on #1234, booking no id, with the + two arms. + +*Acceptance.* +---- +for f in ; do git grep -c '0-AI-MANIFEST\.a2ml' -- "$f"; done -> every count 0 +bash scripts/link-rot-guard.sh . -> only the two #830 findings +bash scripts/check-launcher-standard-currency.sh --root . -> no stale references +bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml -> 14 passed +---- + +*Escalate if* a bucket A file turns out to state an estate rule rather +than a self-reference (move it to bucket B), or if any bucket B tool +is red on `main` because of the rename (then the owner's answer is +urgent, and the PR body says which gate is red). + +== WO-8: the handover note after #1249 + +*Goal.* The handover note and the plan stop telling workers that Deno is +retired. + +*Authority.* #1249, ruled 2026-10-14: Bun > Deno > pnpm > npm; Deno tier +2; A2ML unchanged. + +*Facts measured.* `HANDOVER.adoc` lines 205, 224 and 281 say Deno is +retired or that "Deno first" is wrong because Deno is retired. The plan's +`README.adoc` has rows whose premise was the Deno ban (the P2.3 +acceptance line, the contradictions register). +The Debtfile probe `deno-residue` is BREACHED on `main` (3 against a +ceiling of 1) since #1249 re-permitted Deno: the probe was written for +the ban, so every Debtfile measure on `main` and on every PR is red until +it is re-scoped. `deno-artefacts` was written for the same ban. + +*Steps.* +. Rewrite the three handover lines: A2ML is retired; Deno is permitted at + tier 2 by #1249, Bun stays first, so "Deno first" in the briefing + files is still wrong, for a different reason. +. In the plan, do not rewrite history: add a dated one-line note under + each affected row ("2026-10-19: Deno is tier 2 since #1249; this row's + Deno clause is withdrawn"). +. Grep both files for "Deno" and list every hit with its disposition in + the PR body. +. Re-scope the two Debtfile probes to what is still banned: authoring a + `deno.json` (#1249 keeps the §1.3 ban on authoring). Rewrite each + probe's description and command so it counts authored `deno.json` + files, re-measure, and set the ceiling to the new count. Lowering a + ceiling needs nothing; if the re-scope removes an entry or raises a + ceiling, declare it with a `Debt-exception: — re-scoped after + #1249` line in the commit message. Default is re-scope, not delete. + +*Acceptance.* +---- +grep -n -i 'deno' docs/reorg/2026-10-14-tidy/HANDOVER.adoc -> no line says retired or banned +bash scripts/link-rot-guard.sh docs/reorg/2026-10-14-tidy -> all links resolve +bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml -> 0 breached (deno-residue re-scoped) +---- + +*Escalate if* a plan row's whole purpose was the Deno ban (not just a +clause); then the row is struck with a note, and the owner is told. + +== Owner items this wave depends on + +. Grant this session permission to push `tidy/*` branches, one line. +. Flip the five mirror variables to `false` on this repository (WO-2), or + provision the forges under D261. +. Answer the Copilot coding-agent question (WO-6): delete, or pin and + keep. +. Answer the D338 follow-through (WO-7): both manifest names estate-wide + during the transition, or revert #1272. +. Approve the dispositions table so P1.2, P1.3 and P1.9 can run, and so + WO-1 may close #1290. +. Post the decision sheet (plan, _Owner decision sheet_) to #1234. +. Close #1287 and #1288 (probes) and #1289 (its PR merged on 2026-10-19). From 3c56159c8a573ed6e8d4453caa3bbbc67457b484 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 12:37:58 +0000 Subject: [PATCH 2/9] docs(reorg): work orders v1.1.0 after the first review Corrections from the Codex review of #1298, each verified against main: WO-1 drops the negative test that already exists; WO-2 also removes the two GitLab continue-on-error suppressions and probes destinations without requiring HEAD; WO-3 takes the citation version and date from canon.lock together; WO-4 no longer creates a directory entry in .hypatia-ignore (the exemption contract forbids it), keeps the archive acks, enumerates the eleven local validators and leaves the secret scanners alone; WO-5 also updates the launcher mapping specification that runs deed_lint.py; WO-6 leaves the CODEOWNERS SPDX header to the owner and makes silence on the Copilot config mean defer; WO-7 moves the estate-wide readiness and wiki references to bucket B; WO-8 retires the two Deno Debtfile probes instead of re-scoping them, and runs first so the Debtfile gate stops blocking the wave. Also corrects the link-rot baseline: the repo-wide guard reports 684 broken internal links on main (680 before #1272), not two. The earlier figure was truncated output. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7 --- .../WORK-ORDERS-2026-10-19.adoc | 406 +++++++++++------- 1 file changed, 244 insertions(+), 162 deletions(-) diff --git a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc index 4c7fe6e37..6a0bddc12 100644 --- a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc +++ b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc @@ -2,7 +2,7 @@ // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) = Work orders, 2026-10-19: the first execution wave Jonathan D.A. Jewell (hyperpolymath) -v1.0.0, 2026-10-19 +v1.1.0, 2026-10-19 :toc: left :toclevels: 2 :sectnums: @@ -11,37 +11,47 @@ v1.0.0, 2026-10-19 [.lead] Eight work orders for a sonnet-tier executor, planned at the top tier so the executor never has to rediscover a fact. Every fact below was measured -against `main` at `75bd5994` on 2026-10-19. Each order names its goal, its -authority, the files, the steps, the acceptance commands, and the exact -conditions under which the executor stops and asks instead of deciding. +against `main` at `75bd5994` on 2026-10-19, and re-checked against the +first review of this file. Each order names its goal, its authority, the +files, the steps, the acceptance commands, and the exact conditions under +which the executor stops and asks instead of deciding. Read first: link:README.adoc[the plan] (_Guardrails for every packet_), then link:HANDOVER.adoc[the handover note], then this file. Where the two earlier documents say Deno is retired, this file wins: Deno is permitted -at tier 2 since #1249 (ruled 2026-10-14); A2ML remains retired. +at tier 2 since #1249 (ruled 2026-10-14); A2ML remains retired. Where the +handover note says the repo-wide link-rot guard reports two findings, this +file wins too: it reports 684 on `main` (see _Session mechanics_). == Session mechanics for this wave * *Executor:* this session, switched to the sonnet tier. Effort *medium* - for WO-1, WO-3, WO-6 and WO-8; *high* for WO-2, WO-4, WO-5 and WO-7, + for WO-8, WO-1, WO-3 and WO-6; *high* for WO-2, WO-4, WO-5 and WO-7, which edit validators, CI or many files. * *One order, one branch, one PR.* Branch `tidy/wo-N-` from the current `origin/main`. Never reuse a merged branch. The owner has to grant this session permission to push to `tidy/*` branches once; until then the executor stops before the first push and says so. -* *Never:* merge, force-push, admin-override, touch a licence file or - header, edit `9-archive/` content or `3-practice/outreach/`, create or - extend a `.a2ml`, edit a descriptile by hand (D313), or sweep. +* *Never:* merge, force-push, admin-override, touch a licence file or an + SPDX header (a typo in one is still the owner's to fix), edit + `9-archive/` content or `3-practice/outreach/`, create or extend a + `.a2ml`, edit a descriptile by hand (D313), or sweep. * *Before every push, all of:* `bash scripts/check-standards-map.sh`, `bash scripts/check-canon-lockstep.sh`, `bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml`, `bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml`, - `bash scripts/link-rot-guard.sh `, + `bash scripts/link-rot-guard.sh `, `bash scripts/check-canonical-names.sh origin/main`, `bash scripts/check-launcher-standard-currency.sh --root .`, - `git diff --check`, plus the order's own acceptance block. The - repo-wide link-rot guard reports two broken issue-template links that - predate this work (#830); they are not yours. + `git diff --check`, plus the order's own acceptance block. +* *Two known reds on `main` that are not yours to sweep.* The Debtfile + probe `deno-residue` is BREACHED (3 against a ceiling of 1) since #1249; + WO-8 retires it and runs first, and until WO-8 merges every other order + records that breach in its PR body instead of being blocked by it. The + repo-wide link-rot guard reports 684 broken internal links on `main` + (680 before #1272 added four; 285 under `docs/`, 241 under + `9-archive/`); that is a packet of its own, so run the guard only on + the directories you touched and leave the rest alone. * *PR body:* the order id, the authority line per change, the acceptance block with every result pasted verbatim, a "not done" list. Open as a draft; mark ready when the acceptance block is green; watch CI; fix @@ -50,16 +60,72 @@ at tier 2 since #1249 (ruled 2026-10-14); A2ML remains retired. stop is a one-paragraph message naming the order, the condition, both arms with the elegant one first, and what you did meanwhile. * *Order and concurrency* (at most three PRs open at once): - WO-1 first; then WO-2, WO-3 and WO-8 in parallel; then WO-4, WO-5 and - WO-6 strictly in that sequence (all three edit `.hypatia-baseline.json`); - WO-7 may run beside WO-4. P1.2, P1.3, P1.6 and P1.9 are not in this - wave: they wait on the owner items at the end. + WO-8 first, because it unblocks the Debtfile gate; then WO-1; then WO-2 + and WO-3 in parallel; then WO-4, WO-5 and WO-6 strictly in that + sequence (all three edit `.hypatia-baseline.json`); WO-7 may run beside + WO-4. P1.2, P1.3, P1.6 and P1.9 are not in this wave: they wait on the + owner items at the end. + +== WO-8: the handover note and the Debtfile after #1249 + +*Goal.* The handover note, the plan and the Debtfile stop treating Deno +as banned, and the Debtfile measure is green again. + +*Authority.* #1249, ruled 2026-10-14: Bun > Deno > pnpm > npm; Deno tier +2, "notice only" for a repository that authors in Deno; the refusal +ledger retired; A2ML unchanged. + +*Facts measured.* `HANDOVER.adoc` lines 205, 224 and 281 say Deno is +retired or that "Deno first" is wrong because Deno is retired; its +_Session model_ section also claims the repo-wide link-rot guard reports +two findings (it reports 684). The plan's `README.adoc` has rows whose +premise was the Deno ban (the P2.3 acceptance line, the contradictions +register). In `.machine_readable/Debtfile.a2ml`, `deno-residue` (line 92) +counts `denoland/setup-deno`, `deno run`, `deno test`, `deno fmt` and +`deno lint` in workflows and scripts; it measures 3 against a ceiling of +1 because #1249 added exactly those uses, which the ruling permits. +`deno-artefacts` (line 102) counts Deno-named files and was written for +the same ban. `ci-pipeline.yml` (lines 454 to 482) treats `deno.json(c)` +as permitted tier-2 configuration and only emits a notice. + +*Steps.* +. Rewrite the three handover lines: A2ML is retired; Deno is permitted at + tier 2 by #1249, Bun stays first, so "Deno first" in the briefing files + is still wrong, for a different reason. Replace the "two findings" + sentence with the 684 figure and the rule that the guard runs only on + touched directories. +. In the plan, do not rewrite history: add a dated one-line note under + each affected row ("2026-10-19: Deno is tier 2 since #1249; this row's + Deno clause is withdrawn"). +. Retire both Debtfile entries, `deno-residue` and `deno-artefacts`: the + condition they measured is no longer debt. Do not re-scope them to + `deno.json`, which #1249 permits. Do not delete + `scripts/check-ts-allowlist.deno.js`; pinned consumers still invoke it, + and its fate is task #59, not this order. Removing an entry needs a + declaration in the commit message, one line per entry: + `Debt-exception: deno-residue — retired, Deno is tier 2 since #1249` + and the same for `deno-artefacts`. +. Grep both prose files for "Deno" and list every hit with its + disposition in the PR body. + +*Acceptance.* +---- +grep -n -i 'deno' docs/reorg/2026-10-14-tidy/HANDOVER.adoc -> no line says retired or banned +bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml -> 0 breached, 0 broken-probe +bash scripts/check-debtfile-structure.sh .machine_readable/Debtfile.a2ml -> structure OK +bash scripts/link-rot-guard.sh docs/reorg/2026-10-14-tidy -> all links resolve +On the PR: governance / Debt ratchet green (it reads the declarations). +---- + +*Escalate if* a plan row's whole purpose was the Deno ban (not just a +clause); then the row is struck with a note, and the owner is told. == WO-1: close out #1290 (lockfile self-SHA refs) *Goal.* Finish issue #1290 with evidence. The outage it describes is -already repaired on `main`; what remains is the guard's negative test and -the re-measurement the issue asks for. +already repaired on `main`, and the guard and its negative test already +exist; what remains is the re-measurement the issue asks for and the +evidence comment. *Authority.* #1290 acceptance criteria 1 to 4, owner-filed. @@ -67,31 +133,33 @@ the re-measurement the issue asks for. `.github/workflows/actions.lock`: `github/codeql-action` v4.38.0, `goto-bus-stop/setup-zig` v2.2.1, `swatinem/rust-cache` v2.9.2, `webfactory/ssh-agent` v0.10.0. No third-party entry's `ref:` equals its -own key SHA any more. `scripts/lock-selfcheck.sh` already reports such an -entry as POISON (its `self_sha_deps` pass, exit 1) and the Lock Self-Check -workflow is green on `main`. `scripts/tests/lock-selfcheck-test.sh` has a -positive control only; it has no fixture with a self-SHA ref. +own key SHA any more. `scripts/lock-selfcheck.sh` reports such an entry +as POISON (its `self_sha_deps` pass, exit 1) and the Lock Self-Check +workflow is green on `main`. `scripts/tests/lock-selfcheck-test.sh` +already carries the negative control: the case named "self-SHA ref in +dependencies is POISON (standards#1271)" builds a dependency whose `ref:` +is its own SHA and expects exit 1 with the text `self-SHA ref`. *Steps.* . Find the commits that corrected the four refs: `git log --format='%h %s' -8 -- .github/workflows/actions.lock`. -. Add one negative-control fixture to `scripts/tests/lock-selfcheck-test.sh` - in the style of the existing `expect` cases: a dependencies entry whose - `ref:` is its own 40-hex SHA; expect rc 1 and the text `self-SHA ref`. - Run the test file; it must pass, and it must fail if you revert the - guard lines in `lock-selfcheck.sh` (prove it once, then restore). +. Run `bash scripts/tests/lock-selfcheck-test.sh` and confirm the + self-SHA case passes. Prove the guard once: comment out the + `self_sha_deps` block in `lock-selfcheck.sh`, watch that case fail, + restore the file, run again. Nothing in the tree changes. . Re-measure one caller: find any estate repository whose workflow pins a standards reusable at or after the fixing commit and whose latest run passed Set up job. Record repository, run id, pin. If none exists yet, say so; do not push to a repository outside this session's scope. -. Comment on #1290 with a four-row table (entry, ref now, fixing commit) - plus the test and the re-measurement. Close the issue only if the owner - has given the P1.2 approval; otherwise leave it open with the evidence. +. Comment on #1290 with a four-row table (entry, ref now, fixing commit), + the name of the existing negative test, and the re-measurement. Close + the issue only if the owner has given the P1.2 approval; otherwise leave + it open with the evidence. *Acceptance.* ---- -bash scripts/tests/lock-selfcheck-test.sh -> all cases pass, new negative case present -bash scripts/lock-selfcheck.sh "$(git rev-parse origin/main)" -> SELF-CONSISTENT +bash scripts/tests/lock-selfcheck-test.sh -> all cases pass +bash scripts/lock-selfcheck.sh "$(git rev-parse origin/main)" -> SELF-CONSISTENT ---- *Escalate if* any entry other than the four still carries a self-SHA ref @@ -111,21 +179,31 @@ and Radicle succeeded. Sourcehut, Disroot and Gitea failed at their "Verify SSH host" step. Codeberg and Bitbucket passed the host check and failed at the push step. The reusable is `.github/workflows/mirror-reusable.yml` (445 lines). The GitLab job -(lines 78 to 140) is the pattern the others copy. Line 441 is -`rad sync --announce || echo "Radicle sync attempted"`, which turns a -failed sync into a green step. The caller in this repository is -`.github/workflows/mirror.yml`, pinned to the reusable at `427eb35c`. +(lines 78 to 140) is the pattern the others copy, and it carries two +failure suppressions: `continue-on-error: true` on the job (line 80) and +on its push step (line 126), so a GitLab failure shows green with a +warning. Line 441 is `rad sync --announce || echo "Radicle sync +attempted"`, which turns a failed sync into a green step. The caller in +this repository is `.github/workflows/mirror.yml`, pinned to the +reusable at `427eb35c`. *Steps.* . Read the failing steps' logs for the five red jobs and record the reason per forge in the PR body (fingerprint variable absent, host key mismatch, destination repository missing, key refused). . Remove the `|| echo` on line 441. A failed Radicle sync fails the step. -. Add a destination probe to each forge job, before its push step: a - `git ls-remote --exit-code HEAD` guarded by the same key - presence check. A missing destination emits a `::notice::` naming the - forge and D261 and skips the push. A present destination that refuses - the push stays red. +. Remove both GitLab `continue-on-error: true` lines (80 and 126). The + comment above line 126 explains that GitLab branch protection may block + the force-push; that is a real failure and must show red, with the + owner action the comment already names. GitLab passes today, so this + does not redden `main` by itself. +. Add a destination probe to each forge job, before its push step, + guarded by the same key-presence check: `git ls-remote "$REMOTE_URL"` + with no ref argument. Exit 0 means reachable, including an empty + repository awaiting its first push, so the push proceeds. A non-zero + exit means unreachable or missing: emit a `::notice::` naming the forge + and D261 and skip the push. A reachable destination that refuses the + push stays red. . Add an empty-host guard: when the resolved mirror organisation or host is empty, skip with a `::notice::`, never push to an empty path. . Keep the SSH fingerprint verification exactly as strict as it is. @@ -140,9 +218,10 @@ failed sync into a green step. The caller in this repository is *Acceptance.* ---- -grep -c '|| *echo' .github/workflows/mirror-reusable.yml -> 0 -bash scripts/check-workflow-duplicate-keys.sh -> clean -bash scripts/lock-selfcheck.sh "$(git rev-parse HEAD)" -> SELF-CONSISTENT (after push) +grep -c '|| *echo' .github/workflows/mirror-reusable.yml -> 0 +grep -c 'continue-on-error' .github/workflows/mirror-reusable.yml -> 0 +bash scripts/check-workflow-duplicate-keys.sh -> clean +bash scripts/lock-selfcheck.sh "$(git rev-parse HEAD)" -> SELF-CONSISTENT (after push) Mirror to Git Forges on main after merge: GitLab and Radicle green; every other forge skipped with a notice (once the variables are flipped) or red with a named reason, never green on a failure. @@ -166,14 +245,16 @@ Markdown; applied-unless-struck (D113). `3-practice/CODE_OF_CONDUCT.adoc` and `3-practice/CONTRIBUTING.adoc`. `standards-map.toml` has `entry_count = 129`. The Debtfile probe `docs-md-not-adoc` counts only `docs/`, so root Markdown does not move it. +`canon.lock` records `version = "2.1.2"` and `released = "2026-09-30"`. *Steps.* . Write `CODE_OF_CONDUCT.md` and `CONTRIBUTING.md`: a title, two or three sentences, and a link to the `3-practice/` source. No duplicated content. SPDX comment at the top as `SECURITY.md` does it. . Write `CITATION.cff` (`cff-version: 1.2.0`): title, the owner as author, - `repository-code`, `license: MPL-2.0`, `date-released` today, and a - `version` taken from `canon.lock`. + `repository-code`, `license: MPL-2.0`, and `version` and + `date-released` copied together from `canon.lock` (2.1.2 and + 2026-09-30), never today's date, so the citation names a real release. . Add three `[[entry]]` blocks to `standards-map.toml` after the `SECURITY.md` block, `district = "root"`, `kind = "onramp"`, `lifecycle = "versioned"`, `canonical = false`, and raise `entry_count` @@ -182,7 +263,7 @@ Markdown; applied-unless-struck (D113). *Acceptance.* ---- bash scripts/check-standards-map.sh -> GATE D PASSED -bash scripts/link-rot-guard.sh . -> only the two pre-existing #830 findings +bash scripts/link-rot-guard.sh . -> no new finding beyond the 684 on main (compare counts) bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml -> docs-md-not-adoc unchanged GitHub community profile after merge: all items present. ---- @@ -193,50 +274,72 @@ the plan is wrong, which is the owner's to settle. == WO-4: the archive is frozen (P1.4) -*Goal.* Nothing scans `9-archive/`, and no baseline ack points into it. - -*Authority.* Plan row P1.4; applied-unless-struck (D113). - -*Facts measured.* No `.hypatia-ignore` exists in this repository. -Eighteen baseline entries have a path under `9-archive/`. There is no -`9-archive/README.adoc`; the district holds `REORGANIZATION-PLAN.adoc` and -`rhodium-standard-repositories/`, both mapped. The scanner's ignore-file -reader is `lib/hypatia/scanner_suppression.ex` in the hypatia checkout -(around line 544; the format comment is just below it): one entry per -line, `#` comments. The banned-language rule is unsuppressible by design. -In `ci-pipeline.yml` the `detect` job counts files with a `count` helper -built on git pathspecs (around line 129); the per-language jobs reuse the -same pathspecs. +*Goal.* No policy validator or language job scans `9-archive/`, and the +archive carries a banner saying so. Security scanners keep scanning it: +a leaked secret is a leak wherever it sits. + +*Authority.* Plan row P1.4; the exemption contract in +`docs/EXEMPTION-MECHANISMS.adoc`; applied-unless-struck (D113). + +*Facts measured.* No `.hypatia-ignore` exists in this repository, and the +exemption contract forbids creating one with a directory or wildcard +line: `docs/EXEMPTION-MECHANISMS.adoc` (_Anti-patterns to reject_) +requires one full path per line, and `scripts/check-exemption-ratchet.sh` +treats the file as a migration ledger that may only shrink. Eighteen +baseline entries have a path under `9-archive/`; under that contract they +are the correct Layer 2 mechanism and stay. The Hypatia scan workflow +offers no path-exclusion input. There is no `9-archive/README.adoc`; the +district holds `REORGANIZATION-PLAN.adoc` and +`rhodium-standard-repositories/`, both mapped. In `ci-pipeline.yml` the +`detect` job counts files with a `count` helper built on git pathspecs +(around line 129); the per-language jobs reuse the same pathspecs. Eleven +local gate scripts walk the tree without an archive exclusion: +`check-canon-lockstep.sh`, `check-descriptile-policy.sh`, +`check-inline-python.sh`, `check-launcher-standard-currency.sh`, +`check-licence-consistency.sh`, `check-trusted-base.sh`, +`check-ts-allowlist.sh`, `fix-workflow-duplicates.sh`, +`kyaml-migrate.sh`, `registry-readiness.sh`, `verify-claims.sh`. The +secret scanners (`secret-scanner-reusable.yml`, the security policy step +in `governance-reusable.yml`) also walk the whole tree, by design. *Steps.* -. Read the ignore-file format in the scanner source, then create - `.hypatia-ignore` with one entry excluding `9-archive/` in the form the - parser accepts, with a comment naming P1.4. +. Do not create `.hypatia-ignore`. Leave the eighteen archive acks in the + baseline. . In `ci-pipeline.yml`, add `':!9-archive/**'` to the `count` pathspecs and to every per-language job pathspec that mirrors them, so archive files cannot flip a `has_` output or feed a job. -. Create `9-archive/README.adoc` with one paragraph: frozen, not scanned, - not edited; pointers to the plan and the map entries. -. Remove the eighteen archive entries from `.hypatia-baseline.json`. Keep - the file byte-identical under `jq -a --indent 1 .`. Any entry whose rule - is the banned-language rule cannot be ignored and stays; list it in the - PR body for the owner. +. Create `9-archive/README.adoc` with one paragraph: frozen, not edited, + excluded from policy validators, still secret-scanned; pointers to the + plan and the map entries. +. Run each of the eleven scripts against `main`. Where one reports a + finding whose path is under `9-archive/`, add the exclusion in that + script's own idiom (a `:!9-archive/**` pathspec, or a prune on the + `find`) and record it. Where one reports nothing under the archive, + leave it alone and record that too. Put the eleven-row table in the PR + body. Never touch the secret scanners. +. In the PR body, draft the follow-up for the owner: a hypatia-side order + (opus tier, separate PR in `hyperpolymath/hypatia`) that adds the + `9-archive/` district to the scanner's built-in exclusions in + `lib/hypatia/scanner_suppression.ex`, after which the eighteen acks can + be dropped under the exemption contract. *Acceptance.* ---- -jq '[.[] | select((.file // .path // "") | startswith("9-archive/"))] | length' .hypatia-baseline.json -> 0 -jq -a --indent 1 . .hypatia-baseline.json | cmp - .hypatia-baseline.json -> identical -bash scripts/tests/apply-baseline-test.sh; bash scripts/tests/wave8-gates-test.sh; bash scripts/tests/exemption-ratchet-test.sh -> all pass -On the PR: hypatia-scan, Validate Hypatia Baseline, Exemption ratchet and ci-pipeline green. +jq '[.[] | select((.file // .path // "") | startswith("9-archive/"))] | length' .hypatia-baseline.json -> 18 (unchanged) +test ! -f .hypatia-ignore +bash scripts/check-workflow-duplicate-keys.sh -> clean +On the PR: ci-pipeline, hypatia-scan, Validate Hypatia Baseline and Exemption ratchet green; +the eleven-row validator table in the body. ---- -*Escalate if* the ignore file does not stop a finding (then the format -or the rule is not what the comment says), or if any archive ack is on -the banned-language rule. +*Escalate if* any of the eleven scripts reports an archive finding that +its idiom cannot exclude without changing what it checks elsewhere, or +if a per-language job's pathspec is shared with a consumer input. == WO-5: delete the Python deed tools (P1.10; D313, #944) -*Goal.* `deed_lint.js` is the only validator; no Python in the tree. +*Goal.* `deed_lint.js` is the only validator; no Python in the tree; no +live document tells anyone to run the Python one. *Authority.* D313 (conversion is kyX's first front end; Python is banned); plan row P1.10. @@ -246,14 +349,24 @@ banned); plan row P1.10. `deed_lint.test.js`, `fixtures/`, `README.adoc`. The README describes the Python tools at lines 10 to 18, 45, 51 to 68 and 84. The baseline carries one ack each for `a2ml_to_deed.py` and `deed_lint.py`. These are the only -`.py` files outside the archive. +`.py` files outside the archive. The mapping specification +`1-formats/deed/mappings/launcher-standard-to-praxis-deed.adoc` names +`deed_lint.py` at lines 46, 211, 271 and 316, including a runnable +`python3 … deed_lint.py` verification command at line 271 and mutant +evidence measured with the Python tool. *Steps.* . `git rm` the two `.py` files and the migration shell script in one commit; no content change in that commit. -. In a second commit, rewrite the README: `deed_lint.js` is the sole +. In a second commit, rewrite the tools README: `deed_lint.js` is the sole validator; conversion is deferred to kyX (D313); drop the Python usage blocks and the fixture note that referred to `deed_lint.py`. +. In the same commit, update the mapping specification: the verification + command at line 271 becomes the `bun 1-formats/deed/tools/deed_lint.js` + form and is re-run so its "OK" is a measured result; the mutant + sentences at lines 46, 211 and 316 are either re-measured against + `deed_lint.js` or marked as historical evidence from the retired tool. + Never claim the JS validator was mutated unless you ran the mutant. . Remove the two acks from the baseline, byte-identical formatting. . Run the JS tests the way the README says; if it does not say, run `bun 1-formats/deed/tools/deed_lint.test.js` and record the command. @@ -261,15 +374,17 @@ one ack each for `a2ml_to_deed.py` and `deed_lint.py`. These are the only *Acceptance.* ---- git ls-files '*.py' | grep -v '^9-archive/' -> empty +git grep -n 'deed_lint\.py' -- . ':!9-archive' ':!docs/reorg' -> only lines marked historical bun 1-formats/deed/tools/deed_lint.js 0-AI-MANIFEST.deed -> OK bash scripts/check-inline-python.sh -> clean bash scripts/tests/apply-baseline-test.sh -> pass On the PR: deed-conformance, language policy and Validate Hypatia Baseline green. ---- -*Escalate if* anything outside this directory imports or calls the -deleted files (grep the tree for their names first), or if a test -fixture only the Python linter understood would be orphaned. +*Escalate if* anything outside the tools directory and the mapping +specification imports or calls the deleted files (grep the tree for +their names first), or if a test fixture only the Python linter +understood would be orphaned. == WO-6: `.github/` hygiene (P1.7) @@ -282,42 +397,44 @@ CODEOWNERS, and a pull-request template with the lockfile checkbox. 2026-06-05, never filed. `.github/copilot/coding-agent.yml` configures a Copilot coding agent with an unpinned `npx … @latest` and a plain-HTTP localhost URL; the baseline carries one ack for it. `CODEOWNERS` line 2 -reads `SPFX-License-Identifier: CC-SA-BY-4.0` (two typos); it names a -`Makefile` (banned) and `3-practice/SECURITY.md` (GitHub reads only the -root file); `1-formats/contractiles/` exists, keep it. `dependabot.yml` -has a long HOLD comment on `codeql-action`; nothing in it contradicts the -weekly interval on a first reading. There is no pull-request template. +reads `SPFX-License-Identifier: CC-SA-BY-4.0` (two typos in an SPDX +header, which the executor does not edit); it names a `Makefile` +(banned) and `3-practice/SECURITY.md` (GitHub reads only the root file); +`1-formats/contractiles/` exists, keep it. `dependabot.yml` has a long +HOLD comment on `codeql-action`; nothing in it contradicts the weekly +interval on a first reading. There is no pull-request template. *Steps.* . `git rm -r .github/ISSUES/`. Before that, list the seven titles in the PR body; any item still live is re-filed by the owner through the campaign template, not by the executor. -. `coding-agent.yml`: delete it and its baseline ack, unless the owner - says the Copilot coding agent is in use; then pin the package to a - version and keep the ack. Default is delete. -. `CODEOWNERS`: fix line 2 to `SPDX-License-Identifier: CC-BY-SA-4.0`; - drop the `Makefile` and `3-practice/SECURITY.md` lines; add - `SECURITY.md @hyperpolymath`. +. `coding-agent.yml`, by the owner's answer: "not in use" means delete it + and its baseline ack; "in use" means pin the package to a version and + keep the ack; no answer by the time the rest is ready means push + everything else, leave the file and its ack untouched, and say so. The + default on silence is defer, never delete. +. `CODEOWNERS`: drop the `Makefile` and `3-practice/SECURITY.md` lines; + add `SECURITY.md @hyperpolymath`. Leave line 2 as it is and list it for + the owner: an SPDX header is the owner's to correct, typo or not. . `dependabot.yml`: compare every comment with the schedule it sits next to; correct a comment only where it states something the file does not do. If nothing is wrong, write that in the PR body and change nothing. . Add `.github/PULL_REQUEST_TEMPLATE.md`: What and why; Authority (ruling id, map target, or applied-unless-struck D113 with the arm named); Acceptance block; a checklist with "actions.lock regenerated - with the repo tooling if any workflow changed", "no licence text - touched", "no .a2ml created or extended". + with the repo tooling if any workflow changed", "no licence text or + SPDX header touched", "no .a2ml created or extended". *Acceptance.* ---- test ! -d .github/ISSUES && test -f .github/PULL_REQUEST_TEMPLATE.md +git diff origin/main -- .github/CODEOWNERS | grep -c 'License-Identifier' -> 0 bash scripts/tests/apply-baseline-test.sh -> pass On the PR: labels and label-triage workflows green; Validate Hypatia Baseline green. ---- *Escalate if* any of the seven drafts describes work that is still open -and unfiled (list them; the owner decides), or if the owner has not -answered the Copilot question by the time the rest is ready: push -everything else and leave that file for a second commit. +and unfiled (list them; the owner decides). == WO-7: follow the manifest rename through (after #1272) @@ -328,28 +445,31 @@ the file that exists. by hand on 2026-10-17; the file lints clean as a deed and the Mustfile already expects the new name. Path repairs that a move makes necessary are allowed by the plan's guardrails. Everything estate-facing is the -owner's (see the escalation). +owner's (see bucket B). *Facts measured.* Sixty-three files outside `9-archive/` still name the -old file. They fall into three buckets. - -* *Bucket A, fix now: this repository's own pointers.* `Justfile` lines - 139 and 140 (the fallback `cat` now names a missing file), - `AGENTS.adoc` 4, `EXPLAINME.adoc` 11 (a link), `ROADMAP.adoc` 103, - `QUICKSTART-DEV.adoc`, `llm-warmup-dev.adoc` 4, `llm-warmup-user.adoc` - 4, `3-practice/ai-instruction/README.adoc` 73 (a link), - `docs/wikis/README.adoc` 27, `docs/wikis/users/index.adoc`, - `TOPOLOGY.adoc`, `0-canon/GOVERNANCE.adoc` 56, - `component-readiness-grades/*.adoc`, `toolchain-readiness-grades/*.adoc`. +old file. The rename also added four broken links to the repo-wide +link-rot count. They fall into three buckets. + +* *Bucket A, fix now: this repository's own pointers to its own file.* + `Justfile` lines 139 and 140 (the fallback `cat` now names a missing + file), `AGENTS.adoc` 4, `EXPLAINME.adoc` 11 (a link), `ROADMAP.adoc` + 103, `QUICKSTART-DEV.adoc` 10, 62 and 113, `llm-warmup-dev.adoc` 4, + `llm-warmup-user.adoc` 4, `3-practice/ai-instruction/README.adoc` 73 (a + link), `docs/wikis/README.adoc` 27, `TOPOLOGY.adoc` 18 (a link). * *Bucket B, do not touch; put to the owner as the D338 follow-through:* - rules and tools that tell the whole estate what file to have: - `0-canon/rsr/rsr-criteria-v2.a2ml` criterion 2.3.1, + anything that tells the estate what file to have or grades it on + having one: `0-canon/rsr/rsr-criteria-v2.a2ml` criterion 2.3.1, + `0-canon/GOVERNANCE.adoc` 56, `0-canon/TEMPLATE-APPLICABILITY-POLICY.adoc`, `.machine_readable/template-capability-gates.toml`, `scripts/registry-readiness.sh`, `scripts/check-manifest-ply.sh` and its - test, `0-canon/TEMPLATE-APPLICABILITY-POLICY.adoc`, - `3-practice/immaculate-guide/IMMACULATE-GUIDE.adoc`, + test, `3-practice/immaculate-guide/IMMACULATE-GUIDE.adoc`, `3-practice/TEST-NEEDS.adoc`, `3-practice/testing-and-benchmarking/TESTING-TAXONOMY.adoc`, + `component-readiness-grades/COMPONENT-READINESS-GRADES.adoc` 210, + `component-readiness-grades/SELF-ASSESSMENT.adoc` 41, + `toolchain-readiness-grades/TOOLCHAIN-READINESS-GRADES.adoc` 198 and + 470, `docs/wikis/users/index.adoc` 28, `2-protocols/overlay/scripts/check-conformance.sh`, `2-protocols/k9-coordination/README.adoc` and its spec table, `.machine_readable/MUST.contractile` line 66, @@ -365,7 +485,8 @@ old file. They fall into three buckets. *Steps.* . Edit bucket A only. In `Justfile`, the fallback becomes - `cat 0-AI-MANIFEST.deed` and the echo names the deed. Links point at `0-AI-MANIFEST.deed`. + `cat 0-AI-MANIFEST.deed` and the echo names the deed. Links point at + `0-AI-MANIFEST.deed`. . In the PR body, paste bucket B as a table (file, line, what it asserts) under the heading "D338 follow-through, owner decision". . Post the same table as one comment on #1234, booking no id, with the @@ -374,7 +495,7 @@ old file. They fall into three buckets. *Acceptance.* ---- for f in ; do git grep -c '0-AI-MANIFEST\.a2ml' -- "$f"; done -> every count 0 -bash scripts/link-rot-guard.sh . -> only the two #830 findings +bash scripts/link-rot-guard.sh . | grep -c '^BROKEN' -> 680 or fewer (the four from #1272 gone) bash scripts/check-launcher-standard-currency.sh --root . -> no stale references bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml -> 14 passed ---- @@ -384,60 +505,21 @@ than a self-reference (move it to bucket B), or if any bucket B tool is red on `main` because of the rename (then the owner's answer is urgent, and the PR body says which gate is red). -== WO-8: the handover note after #1249 - -*Goal.* The handover note and the plan stop telling workers that Deno is -retired. - -*Authority.* #1249, ruled 2026-10-14: Bun > Deno > pnpm > npm; Deno tier -2; A2ML unchanged. - -*Facts measured.* `HANDOVER.adoc` lines 205, 224 and 281 say Deno is -retired or that "Deno first" is wrong because Deno is retired. The plan's -`README.adoc` has rows whose premise was the Deno ban (the P2.3 -acceptance line, the contradictions register). -The Debtfile probe `deno-residue` is BREACHED on `main` (3 against a -ceiling of 1) since #1249 re-permitted Deno: the probe was written for -the ban, so every Debtfile measure on `main` and on every PR is red until -it is re-scoped. `deno-artefacts` was written for the same ban. - -*Steps.* -. Rewrite the three handover lines: A2ML is retired; Deno is permitted at - tier 2 by #1249, Bun stays first, so "Deno first" in the briefing - files is still wrong, for a different reason. -. In the plan, do not rewrite history: add a dated one-line note under - each affected row ("2026-10-19: Deno is tier 2 since #1249; this row's - Deno clause is withdrawn"). -. Grep both files for "Deno" and list every hit with its disposition in - the PR body. -. Re-scope the two Debtfile probes to what is still banned: authoring a - `deno.json` (#1249 keeps the §1.3 ban on authoring). Rewrite each - probe's description and command so it counts authored `deno.json` - files, re-measure, and set the ceiling to the new count. Lowering a - ceiling needs nothing; if the re-scope removes an entry or raises a - ceiling, declare it with a `Debt-exception: — re-scoped after - #1249` line in the commit message. Default is re-scope, not delete. - -*Acceptance.* ----- -grep -n -i 'deno' docs/reorg/2026-10-14-tidy/HANDOVER.adoc -> no line says retired or banned -bash scripts/link-rot-guard.sh docs/reorg/2026-10-14-tidy -> all links resolve -bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml -> 0 breached (deno-residue re-scoped) ----- - -*Escalate if* a plan row's whole purpose was the Deno ban (not just a -clause); then the row is struck with a note, and the owner is told. - == Owner items this wave depends on . Grant this session permission to push `tidy/*` branches, one line. . Flip the five mirror variables to `false` on this repository (WO-2), or provision the forges under D261. . Answer the Copilot coding-agent question (WO-6): delete, or pin and - keep. + keep. Silence means the file stays. +. Fix the SPDX header typo on `CODEOWNERS` line 2 yourself (WO-6 flags + it; agents do not edit SPDX headers). . Answer the D338 follow-through (WO-7): both manifest names estate-wide during the transition, or revert #1272. . Approve the dispositions table so P1.2, P1.3 and P1.9 can run, and so WO-1 may close #1290. . Post the decision sheet (plan, _Owner decision sheet_) to #1234. . Close #1287 and #1288 (probes) and #1289 (its PR merged on 2026-10-19). +. Decide whether the 684 broken internal links on `main` become a packet + of their own (241 are inside the frozen archive and cannot be fixed + there). From e25ca5466b32f94a4d65df60d32f349b49933cc4 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 13:06:49 +0000 Subject: [PATCH 3/9] docs(reorg): work orders v1.2.0 after the second review Eight corrections, each verified against the tree before it was written in: - The link-rot baseline is 443 on main from a checkout named `standards` (the guard prunes 9-archive/ only under that basename); 684 was measured from a differently named directory. Every count, threshold and the WO-8 handover correction now say so. - WO-4 discovery is non-mutating: registry-readiness.sh is a licence rewriter for other repositories and is now on the never-list; kyaml-migrate.sh runs with --check only; fix-workflow-duplicates.sh is read, not run; `git status --porcelain` must be empty before editing. - WO-4 gains the governance language-policy walker: an opt-in `policy_exclude_pathspec` input on the reusable, passed by the local caller, default a no-op for every other repository. - The archive README is granted as the one explicit exception to the never-edit-9-archive rule. - WO-2's destination probe skips only on a confirmed not-found message; every other non-zero exit (auth, transport, DNS) stays red. - WO-3's CITATION.cff lists the required `message` key and checks the four required keys. - WO-7 names the nested README's correct target, ../../0-AI-MANIFEST.deed. - WO-1 is issue-only: no branch, no PR; its transcript goes on #1290. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7 --- .../WORK-ORDERS-2026-10-19.adoc | 201 +++++++++++++----- 1 file changed, 148 insertions(+), 53 deletions(-) diff --git a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc index 6a0bddc12..0aeb1ebfb 100644 --- a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc +++ b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc @@ -2,7 +2,7 @@ // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) = Work orders, 2026-10-19: the first execution wave Jonathan D.A. Jewell (hyperpolymath) -v1.1.0, 2026-10-19 +v1.2.0, 2026-10-19 :toc: left :toclevels: 2 :sectnums: @@ -12,7 +12,7 @@ v1.1.0, 2026-10-19 Eight work orders for a sonnet-tier executor, planned at the top tier so the executor never has to rediscover a fact. Every fact below was measured against `main` at `75bd5994` on 2026-10-19, and re-checked against the -first review of this file. Each order names its goal, its authority, the +first two reviews of this file. Each order names its goal, its authority, the files, the steps, the acceptance commands, and the exact conditions under which the executor stops and asks instead of deciding. @@ -21,7 +21,8 @@ then link:HANDOVER.adoc[the handover note], then this file. Where the two earlier documents say Deno is retired, this file wins: Deno is permitted at tier 2 since #1249 (ruled 2026-10-14); A2ML remains retired. Where the handover note says the repo-wide link-rot guard reports two findings, this -file wins too: it reports 684 on `main` (see _Session mechanics_). +file wins too: it reports 443 on `main` from a checkout named `standards`, +which is what CI uses (see _Session mechanics_ for why the name matters). == Session mechanics for this wave @@ -31,11 +32,18 @@ file wins too: it reports 684 on `main` (see _Session mechanics_). * *One order, one branch, one PR.* Branch `tidy/wo-N-` from the current `origin/main`. Never reuse a merged branch. The owner has to grant this session permission to push to `tidy/*` branches once; until - then the executor stops before the first push and says so. + then the executor stops before the first push and says so. WO-1 is the + one exception: it changes nothing in the tree, so it has no branch and + no PR, and its acceptance transcript goes into the issue comment. * *Never:* merge, force-push, admin-override, touch a licence file or an - SPDX header (a typo in one is still the owner's to fix), edit - `9-archive/` content or `3-practice/outreach/`, create or extend a - `.a2ml`, edit a descriptile by hand (D313), or sweep. + SPDX header (a typo in one is still the owner's to fix), edit anything + under `9-archive/` (one exception, granted here: WO-4 creates the new + index file `9-archive/README.adoc`, which describes the district and is + not archived content) or `3-practice/outreach/`, create or extend a + `.a2ml`, edit a descriptile by hand (D313), run + `scripts/registry-readiness.sh` (it rewrites licence text and SPDX + headers; it is a remediation for other repositories, not a check), or + sweep. * *Before every push, all of:* `bash scripts/check-standards-map.sh`, `bash scripts/check-canon-lockstep.sh`, `bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml`, @@ -48,10 +56,15 @@ file wins too: it reports 684 on `main` (see _Session mechanics_). probe `deno-residue` is BREACHED (3 against a ceiling of 1) since #1249; WO-8 retires it and runs first, and until WO-8 merges every other order records that breach in its PR body instead of being blocked by it. The - repo-wide link-rot guard reports 684 broken internal links on `main` - (680 before #1272 added four; 285 under `docs/`, 241 under - `9-archive/`); that is a packet of its own, so run the guard only on - the directories you touched and leave the rest alone. + repo-wide link-rot guard reports 443 broken internal links on `main` + (439 before #1272 added four; 285 under `docs/`) when run from a + checkout whose directory is named `standards`, as CI's is: the guard + prunes `9-archive/` only under that basename (`link-rot-guard.sh` line + 31), and from a directory of any other name it reports 684, the extra + 241 being inside the frozen archive. Measure from a checkout named + `standards`, or compare before-and-after counts within one checkout, + never across the two. The 443 are a packet of their own, so run the + guard only on the directories you touched and leave the rest alone. * *PR body:* the order id, the authority line per change, the acceptance block with every result pasted verbatim, a "not done" list. Open as a draft; mark ready when the acceptance block is green; watch CI; fix @@ -60,7 +73,8 @@ file wins too: it reports 684 on `main` (see _Session mechanics_). stop is a one-paragraph message naming the order, the condition, both arms with the elegant one first, and what you did meanwhile. * *Order and concurrency* (at most three PRs open at once): - WO-8 first, because it unblocks the Debtfile gate; then WO-1; then WO-2 + WO-8 first, because it unblocks the Debtfile gate; then WO-1 (issue + only, it holds no PR slot); then WO-2 and WO-3 in parallel; then WO-4, WO-5 and WO-6 strictly in that sequence (all three edit `.hypatia-baseline.json`); WO-7 may run beside WO-4. P1.2, P1.3, P1.6 and P1.9 are not in this wave: they wait on the @@ -78,7 +92,8 @@ ledger retired; A2ML unchanged. *Facts measured.* `HANDOVER.adoc` lines 205, 224 and 281 say Deno is retired or that "Deno first" is wrong because Deno is retired; its _Session model_ section also claims the repo-wide link-rot guard reports -two findings (it reports 684). The plan's `README.adoc` has rows whose +two findings (it reports 443 from a checkout named `standards`; see +_Session mechanics_). The plan's `README.adoc` has rows whose premise was the Deno ban (the P2.3 acceptance line, the contradictions register). In `.machine_readable/Debtfile.a2ml`, `deno-residue` (line 92) counts `denoland/setup-deno`, `deno run`, `deno test`, `deno fmt` and @@ -92,8 +107,9 @@ as permitted tier-2 configuration and only emits a notice. . Rewrite the three handover lines: A2ML is retired; Deno is permitted at tier 2 by #1249, Bun stays first, so "Deno first" in the briefing files is still wrong, for a different reason. Replace the "two findings" - sentence with the 684 figure and the rule that the guard runs only on - touched directories. + sentence with the 443 figure, the checkout-name caveat from _Session + mechanics_, and the rule that the guard runs only on touched + directories. . In the plan, do not rewrite history: add a dated one-line note under each affected row ("2026-10-19: Deno is tier 2 since #1249; this row's Deno clause is withdrawn"). @@ -125,7 +141,9 @@ clause); then the row is struck with a note, and the owner is told. *Goal.* Finish issue #1290 with evidence. The outage it describes is already repaired on `main`, and the guard and its negative test already exist; what remains is the re-measurement the issue asks for and the -evidence comment. +evidence comment. This order is issue-only: no branch, no push, no PR. +The acceptance transcript is pasted into the #1290 comment instead of a +PR body. *Authority.* #1290 acceptance criteria 1 to 4, owner-filed. @@ -152,14 +170,16 @@ is its own SHA and expects exit 1 with the text `self-SHA ref`. passed Set up job. Record repository, run id, pin. If none exists yet, say so; do not push to a repository outside this session's scope. . Comment on #1290 with a four-row table (entry, ref now, fixing commit), - the name of the existing negative test, and the re-measurement. Close - the issue only if the owner has given the P1.2 approval; otherwise leave - it open with the evidence. + the name of the existing negative test, the re-measurement, and the + acceptance transcript below pasted verbatim. Close the issue only if + the owner has given the P1.2 approval; otherwise leave it open with the + evidence. *Acceptance.* ---- bash scripts/tests/lock-selfcheck-test.sh -> all cases pass bash scripts/lock-selfcheck.sh "$(git rev-parse origin/main)" -> SELF-CONSISTENT +git status --porcelain -> empty (the tree is as it was) ---- *Escalate if* any entry other than the four still carries a self-SHA ref @@ -198,12 +218,23 @@ reusable at `427eb35c`. owner action the comment already names. GitLab passes today, so this does not redden `main` by itself. . Add a destination probe to each forge job, before its push step, - guarded by the same key-presence check: `git ls-remote "$REMOTE_URL"` - with no ref argument. Exit 0 means reachable, including an empty - repository awaiting its first push, so the push proceeds. A non-zero - exit means unreachable or missing: emit a `::notice::` naming the forge - and D261 and skip the push. A reachable destination that refuses the - push stays red. + guarded by the same key-presence check: run `git ls-remote "$REMOTE_URL"` + with no ref argument and capture its stderr. Exit 0 means reachable, + including an empty repository awaiting its first push (do not add + `--exit-code`, which fails on an empty repository), so the push + proceeds. The probe skips the push, with a `::notice::` naming the + forge and D261, in exactly one case: a non-zero exit whose stderr says + the repository does not exist (match, case-insensitively, `not found`, + `does not exist` or `could not be found`; those are the forms GitLab, + the Gitea family and Bitbucket use, so confirm each forge's wording from + the logs read in the first step and add any form that is missing, with + the log line quoted in the PR body). Every other + non-zero exit, a refused or revoked key, a host-key problem, a + transport failure, a DNS miss, prints the captured stderr and fails the + job red. `git ls-remote` returns the same status (128) for all of + these, so only the message can tell a missing destination from a broken + credential, and the default on an unrecognised message is red. A + reachable destination that refuses the push stays red. . Add an empty-host guard: when the resolved mirror organisation or host is empty, skip with a `::notice::`, never push to an empty path. . Keep the SSH fingerprint verification exactly as strict as it is. @@ -251,7 +282,10 @@ Markdown; applied-unless-struck (D113). . Write `CODE_OF_CONDUCT.md` and `CONTRIBUTING.md`: a title, two or three sentences, and a link to the `3-practice/` source. No duplicated content. SPDX comment at the top as `SECURITY.md` does it. -. Write `CITATION.cff` (`cff-version: 1.2.0`): title, the owner as author, +. Write `CITATION.cff` (`cff-version: 1.2.0`): `message` (one sentence + asking readers to cite the canon; CFF 1.2.0 requires the key, and + GitHub does not render "Cite this repository" for a file that fails + its schema), `title`, the owner as the one entry under `authors`, `repository-code`, `license: MPL-2.0`, and `version` and `date-released` copied together from `canon.lock` (2.1.2 and 2026-09-30), never today's date, so the citation names a real release. @@ -263,9 +297,11 @@ Markdown; applied-unless-struck (D113). *Acceptance.* ---- bash scripts/check-standards-map.sh -> GATE D PASSED -bash scripts/link-rot-guard.sh . -> no new finding beyond the 684 on main (compare counts) +grep -c -E '^(cff-version|message|title|authors):' CITATION.cff -> 4 (the keys CFF 1.2.0 requires) +bash scripts/link-rot-guard.sh . | grep -c '^BROKEN' -> the same count as on origin/main in this checkout (443 when it is named standards) bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml -> docs-md-not-adoc unchanged -GitHub community profile after merge: all items present. +GitHub community profile after merge: all items present, and the repository +page shows "Cite this repository" (GitHub renders it only for a valid file). ---- *Escalate if* the map's root district refuses a new `kind`, or if the @@ -292,15 +328,30 @@ offers no path-exclusion input. There is no `9-archive/README.adoc`; the district holds `REORGANIZATION-PLAN.adoc` and `rhodium-standard-repositories/`, both mapped. In `ci-pipeline.yml` the `detect` job counts files with a `count` helper built on git pathspecs -(around line 129); the per-language jobs reuse the same pathspecs. Eleven -local gate scripts walk the tree without an archive exclusion: +(around line 129); the per-language jobs reuse the same pathspecs. Ten +local gate scripts walk this tree without an archive exclusion: `check-canon-lockstep.sh`, `check-descriptile-policy.sh`, `check-inline-python.sh`, `check-launcher-standard-currency.sh`, `check-licence-consistency.sh`, `check-trusted-base.sh`, `check-ts-allowlist.sh`, `fix-workflow-duplicates.sh`, -`kyaml-migrate.sh`, `registry-readiness.sh`, `verify-claims.sh`. The -secret scanners (`secret-scanner-reusable.yml`, the security policy step -in `governance-reusable.yml`) also walk the whole tree, by design. +`kyaml-migrate.sh`, `verify-claims.sh`. Two of the ten write: +`kyaml-migrate.sh` rewrites every YAML file it reformats unless given +`--check`, and `fix-workflow-duplicates.sh` generates wrapper workflows +under every nested `.github/workflows/` it finds, with no dry-run flag. +An earlier revision of this order listed `scripts/registry-readiness.sh` +as an eleventh; it is not a validator of this tree but a licence-rewriting +remediation meant to be run inside a Julia package (its header says so), +and the never-list forbids running it here. The `language-policy` job of +`governance-reusable.yml` also gathers candidates repo-wide: `git +ls-files` for the banned languages at lines 609 to 638, `find` for the +package anti-patterns at lines 662 to 665. It is a reusable workflow, so +an exclusion written into its body would apply to every estate +repository that calls it; this repository calls it by local path from +`governance.yml`. The archive holds no file either block matches today, +so the job is green and the exclusion is prospective: it exists so that a +later policy expansion cannot be failed by frozen content. The secret +scanners (`secret-scanner-reusable.yml`, the security policy step in +`governance-reusable.yml`) walk the whole tree, by design. *Steps.* . Do not create `.hypatia-ignore`. Leave the eighteen archive acks in the @@ -308,15 +359,42 @@ in `governance-reusable.yml`) also walk the whole tree, by design. . In `ci-pipeline.yml`, add `':!9-archive/**'` to the `count` pathspecs and to every per-language job pathspec that mirrors them, so archive files cannot flip a `has_` output or feed a job. -. Create `9-archive/README.adoc` with one paragraph: frozen, not edited, - excluded from policy validators, still secret-scanned; pointers to the - plan and the map entries. -. Run each of the eleven scripts against `main`. Where one reports a - finding whose path is under `9-archive/`, add the exclusion in that - script's own idiom (a `:!9-archive/**` pathspec, or a prune on the - `find`) and record it. Where one reports nothing under the archive, - leave it alone and record that too. Put the eleven-row table in the PR - body. Never touch the secret scanners. +. Create `9-archive/README.adoc`, the one write under the archive this + wave permits (granted in the never-list above), with one paragraph: + frozen, not edited, excluded from policy validators, still + secret-scanned; pointers to the plan and the map entries. The link-rot + guard prunes the archive in CI, so check that file's links by eye. +. Discover without mutating. Run the eight check-only scripts against + `main`: `check-canon-lockstep.sh`, `check-descriptile-policy.sh`, + `check-inline-python.sh`, `check-launcher-standard-currency.sh --root .`, + `check-licence-consistency.sh`, `check-trusted-base.sh`, + `check-ts-allowlist.sh`, `verify-claims.sh`. Run + `bash scripts/kyaml-migrate.sh --check` and nothing else from that + script. Do not run `fix-workflow-duplicates.sh`; read its `find` (the + function near line 60 that lists nested `.github/workflows/` + directories) and judge from the text whether it reaches the archive. + Then `git status --porcelain` must be empty before you edit anything. + Where a script reports a finding whose path is under `9-archive/`, or + the generator's walk reaches it, add the exclusion in that script's own + idiom (a `:!9-archive/**` pathspec, or a prune on the `find`) and + record it. Where one reports nothing under the archive, leave it alone + and record that too. Put the ten-row table in the PR body. Never touch + the secret scanners. +. Give `governance-reusable.yml` an opt-in input, + `policy_exclude_pathspec` (type string, default empty), and append it + to each `git ls-files` call of the banned-language block (lines 609 to + 638). The empty default keeps every other caller exactly as strict as + today. In `governance.yml`, which calls the reusable by local path so + both halves land in one PR, pass + `policy_exclude_pathspec: ':!9-archive/**'`. Leave the three `find` + calls of the package anti-pattern block (lines 662 to 665) as they are: + they match only lockfile names, the frozen archive holds none, and a + second idiom for the same input is not worth its lines; record them in + the table. Leave the hygiene walks later in the same workflow + (`.git/config`, executable scripts, large files) untouched and list + them. The elegant arm is this input; the other arm, leaving the + workflow alone because the archive matches nothing today, is named in + the PR body for the owner to prefer if they wish. . In the PR body, draft the follow-up for the owner: a hypatia-side order (opus tier, separate PR in `hyperpolymath/hypatia`) that adds the `9-archive/` district to the scanner's built-in exclusions in @@ -327,14 +405,20 @@ in `governance-reusable.yml`) also walk the whole tree, by design. ---- jq '[.[] | select((.file // .path // "") | startswith("9-archive/"))] | length' .hypatia-baseline.json -> 18 (unchanged) test ! -f .hypatia-ignore +git status --porcelain (right after the discovery step, before any edit) -> empty bash scripts/check-workflow-duplicate-keys.sh -> clean -On the PR: ci-pipeline, hypatia-scan, Validate Hypatia Baseline and Exemption ratchet green; -the eleven-row validator table in the body. +grep -c 'policy_exclude_pathspec' .github/workflows/governance-reusable.yml -> at least 2 (the input and its use) +grep -c "policy_exclude_pathspec: ':!9-archive/\*\*'" .github/workflows/governance.yml -> 1 +On the PR: ci-pipeline, hypatia-scan, Validate Hypatia Baseline, Exemption ratchet and +governance / Language / package anti-pattern policy green; the ten-row validator table in the body. ---- -*Escalate if* any of the eleven scripts reports an archive finding that -its idiom cannot exclude without changing what it checks elsewhere, or -if a per-language job's pathspec is shared with a consumer input. +*Escalate if* any of the ten scripts reports an archive finding that +its idiom cannot exclude without changing what it checks elsewhere, if a +per-language job's pathspec is shared with a consumer input, or if the +new reusable input changes any job's behaviour for a caller that does +not pass it (the default must be a no-op; a second consumer in the tree +that calls the reusable proves it). == WO-5: delete the Python deed tools (P1.10; D313, #944) @@ -456,7 +540,9 @@ link-rot count. They fall into three buckets. file), `AGENTS.adoc` 4, `EXPLAINME.adoc` 11 (a link), `ROADMAP.adoc` 103, `QUICKSTART-DEV.adoc` 10, 62 and 113, `llm-warmup-dev.adoc` 4, `llm-warmup-user.adoc` 4, `3-practice/ai-instruction/README.adoc` 73 (a - link), `docs/wikis/README.adoc` 27, `TOPOLOGY.adoc` 18 (a link). + link whose target must become `../../0-AI-MANIFEST.deed`: the file sits + two directories down, and its present `../` target never resolved), + `docs/wikis/README.adoc` 27, `TOPOLOGY.adoc` 18 (a link). * *Bucket B, do not touch; put to the owner as the D338 follow-through:* anything that tells the estate what file to have or grades it on having one: `0-canon/rsr/rsr-criteria-v2.a2ml` criterion 2.3.1, @@ -486,7 +572,10 @@ link-rot count. They fall into three buckets. *Steps.* . Edit bucket A only. In `Justfile`, the fallback becomes `cat 0-AI-MANIFEST.deed` and the echo names the deed. Links point at - `0-AI-MANIFEST.deed`. + `0-AI-MANIFEST.deed` by the relative path that resolves from each file; + a rename alone is not enough for the nested one, which needs + `../../0-AI-MANIFEST.deed`. Run the link-rot guard on each touched + directory and confirm the manifest link resolves. . In the PR body, paste bucket B as a table (file, line, what it asserts) under the heading "D338 follow-through, owner decision". . Post the same table as one comment on #1234, booking no id, with the @@ -495,7 +584,8 @@ link-rot count. They fall into three buckets. *Acceptance.* ---- for f in ; do git grep -c '0-AI-MANIFEST\.a2ml' -- "$f"; done -> every count 0 -bash scripts/link-rot-guard.sh . | grep -c '^BROKEN' -> 680 or fewer (the four from #1272 gone) +bash scripts/link-rot-guard.sh . | grep -c '^BROKEN' -> 439 or fewer from a checkout named standards (the four from #1272 gone; 680 or fewer from any other name) +bash scripts/link-rot-guard.sh . | grep -c '0-AI-MANIFEST' -> 0 bash scripts/check-launcher-standard-currency.sh --root . -> no stale references bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml -> 14 passed ---- @@ -520,6 +610,11 @@ urgent, and the PR body says which gate is red). WO-1 may close #1290. . Post the decision sheet (plan, _Owner decision sheet_) to #1234. . Close #1287 and #1288 (probes) and #1289 (its PR merged on 2026-10-19). -. Decide whether the 684 broken internal links on `main` become a packet - of their own (241 are inside the frozen archive and cannot be fixed - there). +. Decide whether the 443 broken internal links on `main` outside the + archive become a packet of their own (241 more sit inside the frozen + archive, where the guard prunes them in CI and nothing can be fixed). +. Prefer an arm for the archive carve-out in `governance-reusable.yml` + (WO-4): the opt-in `policy_exclude_pathspec` input, a new surface on a + reusable every estate repository calls but a no-op by default, or no + change because the archive matches nothing today. The order ships the + input unless you say otherwise. From c932c96ec48868342cd90af12062b21383c5ae77 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 15:44:59 +0000 Subject: [PATCH 4/9] docs(reorg): tighten work-order checks and mirror absence evidence --- .../WORK-ORDERS-2026-10-19.adoc | 59 +++++++++++-------- 1 file changed, 34 insertions(+), 25 deletions(-) diff --git a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc index 0aeb1ebfb..5c2785fad 100644 --- a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc +++ b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc @@ -48,6 +48,7 @@ which is what CI uses (see _Session mechanics_ for why the name matters). `bash scripts/check-canon-lockstep.sh`, `bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml`, `bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml`, + `bash scripts/link-rot-guard.sh .`, `bash scripts/link-rot-guard.sh `, `bash scripts/check-canonical-names.sh origin/main`, `bash scripts/check-launcher-standard-currency.sh --root .`, @@ -56,15 +57,17 @@ which is what CI uses (see _Session mechanics_ for why the name matters). probe `deno-residue` is BREACHED (3 against a ceiling of 1) since #1249; WO-8 retires it and runs first, and until WO-8 merges every other order records that breach in its PR body instead of being blocked by it. The - repo-wide link-rot guard reports 443 broken internal links on `main` + repo-wide link-rot guard reports 443 broken internal links (exit 1) on `main` (439 before #1272 added four; 285 under `docs/`) when run from a checkout whose directory is named `standards`, as CI's is: the guard prunes `9-archive/` only under that basename (`link-rot-guard.sh` line 31), and from a directory of any other name it reports 684, the extra 241 being inside the frozen archive. Measure from a checkout named `standards`, or compare before-and-after counts within one checkout, - never across the two. The 443 are a packet of their own, so run the - guard only on the directories you touched and leave the rest alone. + never across the two. Record the repository-wide output, finding count + and exit status in the PR body against that baseline, alongside the + touched-directory results; investigate any new findings. The 443 are + a packet of their own; leave those existing broken links alone. * *PR body:* the order id, the authority line per change, the acceptance block with every result pasted verbatim, a "not done" list. Open as a draft; mark ready when the acceptance block is green; watch CI; fix @@ -108,8 +111,8 @@ as permitted tier-2 configuration and only emits a notice. tier 2 by #1249, Bun stays first, so "Deno first" in the briefing files is still wrong, for a different reason. Replace the "two findings" sentence with the 443 figure, the checkout-name caveat from _Session - mechanics_, and the rule that the guard runs only on touched - directories. + mechanics_, and the rule that the guard runs repository-wide, recording + the known baseline, alongside checks on touched directories. . In the plan, do not rewrite history: add a dated one-line note under each affected row ("2026-10-19: Deno is tier 2 since #1249; this row's Deno clause is withdrawn"). @@ -223,17 +226,21 @@ reusable at `427eb35c`. including an empty repository awaiting its first push (do not add `--exit-code`, which fails on an empty repository), so the push proceeds. The probe skips the push, with a `::notice::` naming the - forge and D261, in exactly one case: a non-zero exit whose stderr says - the repository does not exist (match, case-insensitively, `not found`, - `does not exist` or `could not be found`; those are the forms GitLab, - the Gitea family and Bitbucket use, so confirm each forge's wording from - the logs read in the first step and add any form that is missing, with - the log line quoted in the PR body). Every other - non-zero exit, a refused or revoked key, a host-key problem, a - transport failure, a DNS miss, prints the captured stderr and fails the - job red. `git ls-remote` returns the same status (128) for all of - these, so only the message can tell a missing destination from a broken - credential, and the default on an unrecognised message is red. A + forge and D261, in exactly one case: a non-zero exit accompanied by + forge-specific evidence that the repository is absent. Record that + evidence and its source in the PR body; for example, an authenticated + forge API check with access sufficient to distinguish an absent + repository from a private one. Generic stderr such as `not found`, + `does not exist` or GitLab's `could not be found` is insufficient: + GitLab can use the same wording for a missing repository and denied + access. An API 404 alone is likewise insufficient if the forge masks + denied access that way. If the probe cannot distinguish absence from + denied access, print the captured stderr and fail the job red. Every + other non-zero exit, including a refused or revoked key, a host-key + problem, a transport failure or a DNS miss, also prints the captured + stderr and fails the job red. `git ls-remote` returns the same status + (128) for all of these; neither that status nor ambiguous wording + proves absence, and the default without conclusive evidence is red. A reachable destination that refuses the push stays red. . Add an empty-host guard: when the resolved mirror organisation or host is empty, skip with a `::notice::`, never push to an empty path. @@ -249,8 +256,8 @@ reusable at `427eb35c`. *Acceptance.* ---- -grep -c '|| *echo' .github/workflows/mirror-reusable.yml -> 0 -grep -c 'continue-on-error' .github/workflows/mirror-reusable.yml -> 0 +test "$(grep -c '|| *echo' .github/workflows/mirror-reusable.yml)" -eq 0 -> no matches (exit 0) +test "$(grep -c 'continue-on-error' .github/workflows/mirror-reusable.yml)" -eq 0 -> no matches (exit 0) bash scripts/check-workflow-duplicate-keys.sh -> clean bash scripts/lock-selfcheck.sh "$(git rev-parse HEAD)" -> SELF-CONSISTENT (after push) Mirror to Git Forges on main after merge: GitLab and Radicle green; every @@ -298,7 +305,8 @@ Markdown; applied-unless-struck (D113). ---- bash scripts/check-standards-map.sh -> GATE D PASSED grep -c -E '^(cff-version|message|title|authors):' CITATION.cff -> 4 (the keys CFF 1.2.0 requires) -bash scripts/link-rot-guard.sh . | grep -c '^BROKEN' -> the same count as on origin/main in this checkout (443 when it is named standards) +link_rot="$(bash scripts/link-rot-guard.sh .)" || test "$?" -eq 1 +printf '%s\n' "$link_rot" | awk '/^BROKEN/ {n++} END {print n+0}' -> the same count as on origin/main in this checkout (443 when it is named standards) bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml -> docs-md-not-adoc unchanged GitHub community profile after merge: all items present, and the repository page shows "Cite this repository" (GitHub renders it only for a valid file). @@ -457,8 +465,8 @@ evidence measured with the Python tool. *Acceptance.* ---- -git ls-files '*.py' | grep -v '^9-archive/' -> empty -git grep -n 'deed_lint\.py' -- . ':!9-archive' ':!docs/reorg' -> only lines marked historical +git ls-files '*.py' | awk '!/^9-archive\// {print; found=1} END {exit found}' -> empty (exit 0) +git grep -n 'deed_lint\.py' -- . ':!9-archive' ':!docs/reorg' || test "$?" -eq 1 -> empty or only lines marked historical bun 1-formats/deed/tools/deed_lint.js 0-AI-MANIFEST.deed -> OK bash scripts/check-inline-python.sh -> clean bash scripts/tests/apply-baseline-test.sh -> pass @@ -512,7 +520,7 @@ interval on a first reading. There is no pull-request template. *Acceptance.* ---- test ! -d .github/ISSUES && test -f .github/PULL_REQUEST_TEMPLATE.md -git diff origin/main -- .github/CODEOWNERS | grep -c 'License-Identifier' -> 0 +git diff --unified=0 origin/main -- .github/CODEOWNERS | awk '/^[+-].*License-Identifier/ {print; found=1} END {exit found}' -> empty (exit 0) bash scripts/tests/apply-baseline-test.sh -> pass On the PR: labels and label-triage workflows green; Validate Hypatia Baseline green. ---- @@ -583,9 +591,10 @@ link-rot count. They fall into three buckets. *Acceptance.* ---- -for f in ; do git grep -c '0-AI-MANIFEST\.a2ml' -- "$f"; done -> every count 0 -bash scripts/link-rot-guard.sh . | grep -c '^BROKEN' -> 439 or fewer from a checkout named standards (the four from #1272 gone; 680 or fewer from any other name) -bash scripts/link-rot-guard.sh . | grep -c '0-AI-MANIFEST' -> 0 +for f in ; do test "$(grep -c '0-AI-MANIFEST\.a2ml' "$f")" -eq 0 || exit 1; done -> no old-name references (exit 0) +link_rot="$(bash scripts/link-rot-guard.sh .)" || test "$?" -eq 1 +printf '%s\n' "$link_rot" | awk '/^BROKEN/ {n++} END {print n+0}' -> 439 or fewer from a checkout named standards (the four from #1272 gone; 680 or fewer from any other name) +test "$(printf '%s\n' "$link_rot" | grep -c '0-AI-MANIFEST')" -eq 0 -> no broken manifest links (exit 0) bash scripts/check-launcher-standard-currency.sh --root . -> no stale references bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml -> 14 passed ---- From e4f555d832b8aed5c4f27c0b69cac62011062eb9 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:27:12 +0000 Subject: [PATCH 5/9] docs(reorg): work orders v1.3.0 after the third and fourth reviews Fifteen findings from CodeRabbit and Codex on e25ca546, 71587d12 and 8eae5ad0, each verified against the tree before it was written in: - The pre-push gate is the locally runnable part of an acceptance block; "after push", "On the PR" and "after merge" lines are recorded as they land. The repository-wide link-rot run is the gate for root-level touches (exit 1 at the 443 baseline is accepted; the count must equal origin/main's in the same checkout) and for the archive README (the archive is never scanned on its own: 272 old findings). - A third known red on main: the Hypatia gate rejects actions.lock format v0.0.3 since #1300; the fix is hyperpolymath/hypatia#927 or #928 and needs nothing here. Never acknowledge it in the baseline. - WO-2's probe is a diagnostic only, never a skip: a deploy key cannot tell an absent repository from a forbidden one, and the *_MIRROR_ENABLED variable is the one legitimate skip. - WO-4 gains check-package-policy.sh (an eleventh validator, run for every caller, whose find_first would accept an archive manifest), the standards-map files count (1136 -> 1137), and a non-empty guard on the reusable input (git rejects an empty pathspec) with a default-arm proof. - WO-5's fallback test runs under `bun test` (the file imports bun:test). - WO-6 never deletes the seven drafts on its own judgement: all seven call themselves draft, to-do or in progress; the owner disposes of each. - WO-7 drops TOPOLOGY.adoc (frozen, archived by P2.4) and ROADMAP.adoc 103 (the AI Gatekeeper Protocol row) from bucket A; the count goes to 440. - WO-8 rewrites the plan's "Deno and Python banned" definition at README line 69 and greps both prose files. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7 --- .../WORK-ORDERS-2026-10-19.adoc | 250 ++++++++++++------ 1 file changed, 165 insertions(+), 85 deletions(-) diff --git a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc index 5c2785fad..0f717671b 100644 --- a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc +++ b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc @@ -2,7 +2,7 @@ // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) = Work orders, 2026-10-19: the first execution wave Jonathan D.A. Jewell (hyperpolymath) -v1.2.0, 2026-10-19 +v1.3.0, 2026-10-19 :toc: left :toclevels: 2 :sectnums: @@ -11,8 +11,8 @@ v1.2.0, 2026-10-19 [.lead] Eight work orders for a sonnet-tier executor, planned at the top tier so the executor never has to rediscover a fact. Every fact below was measured -against `main` at `75bd5994` on 2026-10-19, and re-checked against the -first two reviews of this file. Each order names its goal, its authority, the +against `main` at `75bd5994` on 2026-10-19, and re-checked against every +review posted on this file's pull request. Each order names its goal, its authority, the files, the steps, the acceptance commands, and the exact conditions under which the executor stops and asks instead of deciding. @@ -48,17 +48,26 @@ which is what CI uses (see _Session mechanics_ for why the name matters). `bash scripts/check-canon-lockstep.sh`, `bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml`, `bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml`, - `bash scripts/link-rot-guard.sh .`, - `bash scripts/link-rot-guard.sh `, + `bash scripts/link-rot-guard.sh .` from a checkout named `standards` + (its exit status is 1 at the baseline, which is accepted; what must + hold is that the BROKEN count equals the count on `origin/main` in the + same checkout, 443 today, and that no BROKEN line names a file you + touched), `bash scripts/link-rot-guard.sh ` for each directory you + touched other than the root and `9-archive/` (a root-level touch is + covered by the repository-wide run; the archive is pruned by that run + and is never scanned on its own, see WO-4), `bash scripts/check-canonical-names.sh origin/main`, `bash scripts/check-launcher-standard-currency.sh --root .`, - `git diff --check`, plus the order's own acceptance block. -* *Two known reds on `main` that are not yours to sweep.* The Debtfile + `git diff --check`, plus the locally runnable lines of the order's own + acceptance block. Lines marked "after push", "On the PR" or "after + merge" are not part of the pre-push gate: they are checked once that + state exists and pasted into the PR body as they land. +* *Three known reds on `main` that are not yours to sweep.* The Debtfile probe `deno-residue` is BREACHED (3 against a ceiling of 1) since #1249; WO-8 retires it and runs first, and until WO-8 merges every other order records that breach in its PR body instead of being blocked by it. The repo-wide link-rot guard reports 443 broken internal links (exit 1) on `main` - (439 before #1272 added four; 285 under `docs/`) when run from a + (440 before #1272 added three; 285 under `docs/`) when run from a checkout whose directory is named `standards`, as CI's is: the guard prunes `9-archive/` only under that basename (`link-rot-guard.sh` line 31), and from a directory of any other name it reports 684, the extra @@ -67,11 +76,20 @@ which is what CI uses (see _Session mechanics_ for why the name matters). never across the two. Record the repository-wide output, finding count and exit status in the PR body against that baseline, alongside the touched-directory results; investigate any new findings. The 443 are - a packet of their own; leave those existing broken links alone. + a packet of their own; leave those existing broken links alone. The + Hypatia gate (`scan / Hypatia Neurosymbolic Analysis` and `governance / + Validate Hypatia Baseline`) is red on `main` since #1300 regenerated + `actions.lock` in `gh actions-lock` format v0.0.3, which the scanner + rejects (`invalid_actions_lock`, two findings, severity high): the fix + is in hyperpolymath/hypatia (#927 or #928), the governance job resolves + the scanner at hypatia `HEAD` on every run, so nothing in this + repository changes for it. Until one of them merges, record the red in + the PR body; never acknowledge it in the baseline. * *PR body:* the order id, the authority line per change, the acceptance block with every result pasted verbatim, a "not done" list. Open as a - draft; mark ready when the acceptance block is green; watch CI; fix - reds; stop at merge. + draft; mark ready when every locally runnable acceptance line is green + and the post-push lines are recorded; watch CI; fix reds; stop at + merge. * *Stop and ask* whenever an order's _Escalate if_ condition is met. A stop is a one-paragraph message naming the order, the condition, both arms with the elegant one first, and what you did meanwhile. @@ -98,7 +116,9 @@ _Session model_ section also claims the repo-wide link-rot guard reports two findings (it reports 443 from a checkout named `standards`; see _Session mechanics_). The plan's `README.adoc` has rows whose premise was the Deno ban (the P2.3 acceptance line, the contradictions -register). In `.machine_readable/Debtfile.a2ml`, `deno-residue` (line 92) +register), and one statement outside any row: line 69, in the definition +of the _Golden_ reading, lists "Deno and Python banned" among the current +facts. In `.machine_readable/Debtfile.a2ml`, `deno-residue` (line 92) counts `denoland/setup-deno`, `deno run`, `deno test`, `deno fmt` and `deno lint` in workflows and scripts; it measures 3 against a ceiling of 1 because #1249 added exactly those uses, which the ruling permits. @@ -115,7 +135,9 @@ as permitted tier-2 configuration and only emits a notice. the known baseline, alongside checks on touched directories. . In the plan, do not rewrite history: add a dated one-line note under each affected row ("2026-10-19: Deno is tier 2 since #1249; this row's - Deno clause is withdrawn"). + Deno clause is withdrawn"). Line 69 is not a row but a live definition, + so it is rewritten in place: "Python banned, Deno permitted at tier 2 + since #1249". . Retire both Debtfile entries, `deno-residue` and `deno-artefacts`: the condition they measured is no longer debt. Do not re-scope them to `deno.json`, which #1249 permits. Do not delete @@ -130,6 +152,7 @@ as permitted tier-2 configuration and only emits a notice. *Acceptance.* ---- grep -n -i 'deno' docs/reorg/2026-10-14-tidy/HANDOVER.adoc -> no line says retired or banned +grep -n -i 'deno' docs/reorg/2026-10-14-tidy/README.adoc -> no line says retired or banned except inside a dated withdrawal note bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml -> 0 breached, 0 broken-probe bash scripts/check-debtfile-structure.sh .machine_readable/Debtfile.a2ml -> structure OK bash scripts/link-rot-guard.sh docs/reorg/2026-10-14-tidy -> all links resolve @@ -220,28 +243,25 @@ reusable at `427eb35c`. the force-push; that is a real failure and must show red, with the owner action the comment already names. GitLab passes today, so this does not redden `main` by itself. -. Add a destination probe to each forge job, before its push step, - guarded by the same key-presence check: run `git ls-remote "$REMOTE_URL"` - with no ref argument and capture its stderr. Exit 0 means reachable, - including an empty repository awaiting its first push (do not add - `--exit-code`, which fails on an empty repository), so the push - proceeds. The probe skips the push, with a `::notice::` naming the - forge and D261, in exactly one case: a non-zero exit accompanied by - forge-specific evidence that the repository is absent. Record that - evidence and its source in the PR body; for example, an authenticated - forge API check with access sufficient to distinguish an absent - repository from a private one. Generic stderr such as `not found`, - `does not exist` or GitLab's `could not be found` is insufficient: - GitLab can use the same wording for a missing repository and denied - access. An API 404 alone is likewise insufficient if the forge masks - denied access that way. If the probe cannot distinguish absence from - denied access, print the captured stderr and fail the job red. Every - other non-zero exit, including a refused or revoked key, a host-key - problem, a transport failure or a DNS miss, also prints the captured - stderr and fails the job red. `git ls-remote` returns the same status - (128) for all of these; neither that status nor ambiguous wording - proves absence, and the default without conclusive evidence is red. A - reachable destination that refuses the push stays red. +. Add a destination probe to each forge job that pushes with git, before + its push step and guarded by the same key-presence check: run + `git ls-remote "$REMOTE_URL"` with no ref argument (no `--exit-code`: + an empty repository awaiting its first push has no refs and must count + as reachable) and print its captured stderr into the log. The probe is + a diagnostic, never a gate: it names the failure at the top of the job + and the job proceeds to the push whatever the probe returned. It never + skips the push. A deploy key cannot tell an absent repository from one + it is not allowed to see (GitLab says `could not be found` in both + cases, and `git ls-remote` exits 128 for both, as it does for a refused + key, a host-key problem or a transport failure), so there is no honest + skip to write. A missing destination stays red until D261 provisions + it or the owner flips that forge's `*_MIRROR_ENABLED` variable to + `false`, which is the one legitimate skip and already exists. An + earlier revision of this step skipped on a matched `not found` message + and a later one asked for forge-specific evidence of absence; both are + withdrawn, the first because the message is ambiguous, the second + because it needs a second credential per forge for a question the + variable already answers. . Add an empty-host guard: when the resolved mirror organisation or host is empty, skip with a `::notice::`, never push to an empty path. . Keep the SSH fingerprint verification exactly as strict as it is. @@ -259,10 +279,11 @@ reusable at `427eb35c`. test "$(grep -c '|| *echo' .github/workflows/mirror-reusable.yml)" -eq 0 -> no matches (exit 0) test "$(grep -c 'continue-on-error' .github/workflows/mirror-reusable.yml)" -eq 0 -> no matches (exit 0) bash scripts/check-workflow-duplicate-keys.sh -> clean +grep -c 'git ls-remote' .github/workflows/mirror-reusable.yml -> one per forge job that pushes with git bash scripts/lock-selfcheck.sh "$(git rev-parse HEAD)" -> SELF-CONSISTENT (after push) Mirror to Git Forges on main after merge: GitLab and Radicle green; every -other forge skipped with a notice (once the variables are flipped) or red -with a named reason, never green on a failure. +other forge skipped by its variable (once the variables are flipped) or +red with the probe's stderr naming the reason, never green on a failure. ---- *Escalate if* any forge fails on a host-key fingerprint mismatch (a @@ -336,20 +357,27 @@ offers no path-exclusion input. There is no `9-archive/README.adoc`; the district holds `REORGANIZATION-PLAN.adoc` and `rhodium-standard-repositories/`, both mapped. In `ci-pipeline.yml` the `detect` job counts files with a `count` helper built on git pathspecs -(around line 129); the per-language jobs reuse the same pathspecs. Ten +(around line 129); the per-language jobs reuse the same pathspecs. Eleven local gate scripts walk this tree without an archive exclusion: `check-canon-lockstep.sh`, `check-descriptile-policy.sh`, `check-inline-python.sh`, `check-launcher-standard-currency.sh`, -`check-licence-consistency.sh`, `check-trusted-base.sh`, -`check-ts-allowlist.sh`, `fix-workflow-duplicates.sh`, -`kyaml-migrate.sh`, `verify-claims.sh`. Two of the ten write: -`kyaml-migrate.sh` rewrites every YAML file it reformats unless given -`--check`, and `fix-workflow-duplicates.sh` generates wrapper workflows -under every nested `.github/workflows/` it finds, with no dry-run flag. -An earlier revision of this order listed `scripts/registry-readiness.sh` -as an eleventh; it is not a validator of this tree but a licence-rewriting -remediation meant to be run inside a Julia package (its header says so), -and the never-list forbids running it here. The `language-policy` job of +`check-licence-consistency.sh`, `check-package-policy.sh`, +`check-trusted-base.sh`, `check-ts-allowlist.sh`, +`fix-workflow-duplicates.sh`, `kyaml-migrate.sh`, `verify-claims.sh`. +Two of the eleven write: `kyaml-migrate.sh` rewrites every YAML file it +reformats unless given `--check`, and `fix-workflow-duplicates.sh` +generates wrapper workflows under every nested `.github/workflows/` it +finds, with no dry-run flag. `check-package-policy.sh` is the one the +governance job "Enforce Guix-only packaging policy" copies into every +caller and runs against the caller's root; its `find` walks prune `.git`, +`node_modules`, `deps`, `.lake` and `vendor` (the `PRUNE` array near +line 103) but not the archive, and the archive holds ten `manifest.scm`, +`guix.scm` and `Containerfile` files that could satisfy the policy on +the root's behalf if the root artefact ever went missing. An earlier +revision of this order listed `scripts/registry-readiness.sh` instead; +it is not a validator of this tree but a licence-rewriting remediation +meant to be run inside a Julia package (its header says so), and the +never-list forbids running it here. The `language-policy` job of `governance-reusable.yml` also gathers candidates repo-wide: `git ls-files` for the banned languages at lines 609 to 638, `find` for the package anti-patterns at lines 662 to 665. It is a reusable workflow, so @@ -370,30 +398,50 @@ scanners (`secret-scanner-reusable.yml`, the security policy step in . Create `9-archive/README.adoc`, the one write under the archive this wave permits (granted in the never-list above), with one paragraph: frozen, not edited, excluded from policy validators, still - secret-scanned; pointers to the plan and the map entries. The link-rot - guard prunes the archive in CI, so check that file's links by eye. -. Discover without mutating. Run the eight check-only scripts against + secret-scanned; pointers to the plan and the map entries. In + `standards-map.toml`, raise `files` on the `9-archive` district entry + from 1136 to 1137: Gate D does not count files, but the map must stay + true. Never run the link-rot guard on `9-archive/` itself: the prune + keys on the root's basename, so a scoped run from that directory scans + the whole archive and reports its 272 old findings. The gate for this + write is the repository-wide run from a checkout named `standards`, + which prunes the archive, plus the new file's links checked by eye. +. Discover without mutating. Run the nine check-only scripts against `main`: `check-canon-lockstep.sh`, `check-descriptile-policy.sh`, `check-inline-python.sh`, `check-launcher-standard-currency.sh --root .`, - `check-licence-consistency.sh`, `check-trusted-base.sh`, - `check-ts-allowlist.sh`, `verify-claims.sh`. Run - `bash scripts/kyaml-migrate.sh --check` and nothing else from that + `check-licence-consistency.sh`, `check-package-policy.sh .`, + `check-trusted-base.sh`, `check-ts-allowlist.sh`, `verify-claims.sh`. + Run `bash scripts/kyaml-migrate.sh --check` and nothing else from that script. Do not run `fix-workflow-duplicates.sh`; read its `find` (the function near line 60 that lists nested `.github/workflows/` directories) and judge from the text whether it reaches the archive. Then `git status --porcelain` must be empty before you edit anything. Where a script reports a finding whose path is under `9-archive/`, or - the generator's walk reaches it, add the exclusion in that script's own - idiom (a `:!9-archive/**` pathspec, or a prune on the `find`) and - record it. Where one reports nothing under the archive, leave it alone - and record that too. Put the ten-row table in the PR body. Never touch - the secret scanners. + a walk of its could be satisfied by an archive file (the generator's + directory listing; `check-package-policy.sh`'s `find_first`, which + would accept an archive manifest in place of a missing root one), add + the exclusion in that script's own idiom (a `:!9-archive/**` pathspec, + or `-o -name 9-archive` in the `PRUNE` array) and record it. Where one + reports nothing under the archive and no walk can be satisfied there, + leave it alone and record that too. Put the eleven-row table in the PR + body. The `check-package-policy.sh` prune is estate-wide, since the + governance job copies the script into every caller; a directory named + `9-archive` is frozen history by this repository's own convention, so + say so in the PR body. Never touch the secret scanners. . Give `governance-reusable.yml` an opt-in input, - `policy_exclude_pathspec` (type string, default empty), and append it - to each `git ls-files` call of the banned-language block (lines 609 to - 638). The empty default keeps every other caller exactly as strict as - today. In `governance.yml`, which calls the reusable by local path so - both halves land in one PR, pass + `policy_exclude_pathspec` (type string, default empty), and add it to + each `git ls-files` call of the banned-language block (lines 609 to + 638) only when it is non-empty: git rejects an empty string as a + pathspec (`fatal: empty string is not a valid pathspec`), so appending + the quoted default verbatim would fail every caller that does not pass + the input. Use a bash array (`excl=(); [ -n "$POLICY_EXCLUDE" ] && + excl=("$POLICY_EXCLUDE")`, then `"${excl[@]}"` at the end of each + call), with the input exported to `POLICY_EXCLUDE` through `env:`. + Prove the default arm before pushing: run the block's `git ls-files` + lines locally with `POLICY_EXCLUDE` empty and with the archive + pathspec, and paste both listings; the empty run must equal plain + `git ls-files` with the same patterns. In `governance.yml`, which calls + the reusable by local path so both halves land in one PR, pass `policy_exclude_pathspec: ':!9-archive/**'`. Leave the three `find` calls of the package anti-pattern block (lines 662 to 665) as they are: they match only lockfile names, the frozen archive holds none, and a @@ -417,11 +465,16 @@ git status --porcelain (right after the discovery step, before any edit) -> emp bash scripts/check-workflow-duplicate-keys.sh -> clean grep -c 'policy_exclude_pathspec' .github/workflows/governance-reusable.yml -> at least 2 (the input and its use) grep -c "policy_exclude_pathspec: ':!9-archive/\*\*'" .github/workflows/governance.yml -> 1 -On the PR: ci-pipeline, hypatia-scan, Validate Hypatia Baseline, Exemption ratchet and -governance / Language / package anti-pattern policy green; the ten-row validator table in the body. +grep -c '9-archive' scripts/check-package-policy.sh -> 1 (the PRUNE entry) +grep -c 'files *= *1137' standards-map.toml -> 1 +bash scripts/check-standards-map.sh -> GATE D PASSED +The two git ls-files listings (empty input, archive input) pasted in the PR body; the empty one identical to plain git ls-files. +On the PR: ci-pipeline, hypatia-scan, Validate Hypatia Baseline, Exemption ratchet, +governance / Language / package anti-pattern policy and governance / Enforce Guix-only +packaging policy green; the eleven-row validator table in the body. ---- -*Escalate if* any of the ten scripts reports an archive finding that +*Escalate if* any of the eleven scripts reports an archive finding that its idiom cannot exclude without changing what it checks elsewhere, if a per-language job's pathspec is shared with a consumer input, or if the new reusable input changes any job's behaviour for a caller that does @@ -460,8 +513,11 @@ evidence measured with the Python tool. `deed_lint.js` or marked as historical evidence from the retired tool. Never claim the JS validator was mutated unless you ran the mutant. . Remove the two acks from the baseline, byte-identical formatting. -. Run the JS tests the way the README says; if it does not say, run - `bun 1-formats/deed/tools/deed_lint.test.js` and record the command. +. Run the JS tests the way the README says (line 16 today: + `bun test 1-formats/deed/tools/`); if the rewrite drops that line, run + `bun test 1-formats/deed/tools/deed_lint.test.js` and record the + command. The file imports `describe` from `bun:test`, so it runs only + under Bun's test runner; `bun ` fails before any test runs. *Acceptance.* ---- @@ -486,7 +542,11 @@ CODEOWNERS, and a pull-request template with the lockfile checkbox. *Authority.* Plan row P1.7; applied-unless-struck (D113). *Facts measured.* `.github/ISSUES/` holds seven Markdown drafts dated -2026-06-05, never filed. `.github/copilot/coding-agent.yml` configures a +2026-06-05, never filed: the roadmap at the top marks itself `DRAFT`, +`001` and `006` under `cicd-optimization/` mark themselves `IN PROGRESS`, +and `002` to `005` mark themselves `TODO`. Every one therefore describes +work it calls unfinished, which is the owner's call, not the executor's. +`.github/copilot/coding-agent.yml` configures a Copilot coding agent with an unpinned `npx … @latest` and a plain-HTTP localhost URL; the baseline carries one ack for it. `CODEOWNERS` line 2 reads `SPFX-License-Identifier: CC-SA-BY-4.0` (two typos in an SPDX @@ -497,9 +557,13 @@ HOLD comment on `codeql-action`; nothing in it contradicts the weekly interval on a first reading. There is no pull-request template. *Steps.* -. `git rm -r .github/ISSUES/`. Before that, list the seven titles in the - PR body; any item still live is re-filed by the owner through the - campaign template, not by the executor. +. The seven drafts, by the owner's answer, draft by draft: list them in + the PR body (file, status line, title) and in the owner items; "discard" + means `git rm` that file; "file" means the owner files it through the + campaign template and then it is removed too; no answer by the time the + rest is ready means push everything else, leave the directory as it is, + and say so. The default on silence is defer, never delete. The + directory goes only when its last draft has. . `coding-agent.yml`, by the owner's answer: "not in use" means delete it and its baseline ack; "in use" means pin the package to a version and keep the ack; no answer by the time the rest is ready means push @@ -519,14 +583,16 @@ interval on a first reading. There is no pull-request template. *Acceptance.* ---- -test ! -d .github/ISSUES && test -f .github/PULL_REQUEST_TEMPLATE.md +test -f .github/PULL_REQUEST_TEMPLATE.md +test ! -d .github/ISSUES -> only once the owner has disposed of all seven; otherwise the directory is unchanged and the PR body says which drafts wait git diff --unified=0 origin/main -- .github/CODEOWNERS | awk '/^[+-].*License-Identifier/ {print; found=1} END {exit found}' -> empty (exit 0) bash scripts/tests/apply-baseline-test.sh -> pass On the PR: labels and label-triage workflows green; Validate Hypatia Baseline green. ---- -*Escalate if* any of the seven drafts describes work that is still open -and unfiled (list them; the owner decides). +*Escalate if* a draft's disposition is ambiguous (the owner's answer names +a draft that does not exist, or names fewer than seven); the defer rule +above covers silence without a stop. == WO-7: follow the manifest rename through (after #1272) @@ -540,20 +606,29 @@ are allowed by the plan's guardrails. Everything estate-facing is the owner's (see bucket B). *Facts measured.* Sixty-three files outside `9-archive/` still name the -old file. The rename also added four broken links to the repo-wide -link-rot count. They fall into three buckets. +old file. The repo-wide link-rot guard, from a checkout named +`standards`, reports four BROKEN lines naming the manifest: +`QUICKSTART-DEV.adoc`, `EXPLAINME.adoc` and `TOPOLOGY.adoc`, which #1272 +broke, and `3-practice/ai-instruction/README.adoc`, whose `../` target +never resolved. They fall into three buckets. * *Bucket A, fix now: this repository's own pointers to its own file.* `Justfile` lines 139 and 140 (the fallback `cat` now names a missing - file), `AGENTS.adoc` 4, `EXPLAINME.adoc` 11 (a link), `ROADMAP.adoc` - 103, `QUICKSTART-DEV.adoc` 10, 62 and 113, `llm-warmup-dev.adoc` 4, + file), `AGENTS.adoc` 4, `EXPLAINME.adoc` 11 (a link), + `QUICKSTART-DEV.adoc` 10, 62 and 113, `llm-warmup-dev.adoc` 4, `llm-warmup-user.adoc` 4, `3-practice/ai-instruction/README.adoc` 73 (a link whose target must become `../../0-AI-MANIFEST.deed`: the file sits two directories down, and its present `../` target never resolved), - `docs/wikis/README.adoc` 27, `TOPOLOGY.adoc` 18 (a link). + `docs/wikis/README.adoc` 27. Not `TOPOLOGY.adoc` 18: `AGENTS.adoc` + lines 15 to 17 declare it a frozen snapshot never to be edited directly, + and plan row P2.4 moves it into the archive, so its broken link leaves + with the file (bucket C). Not `ROADMAP.adoc` 103: that row describes the + AI Gatekeeper Protocol's manifest enforcement, an estate-facing claim + the protocol's own specification still makes in the old name (bucket B). * *Bucket B, do not touch; put to the owner as the D338 follow-through:* anything that tells the estate what file to have or grades it on - having one: `0-canon/rsr/rsr-criteria-v2.a2ml` criterion 2.3.1, + having one: `ROADMAP.adoc` 103 (the protocol row), + `0-canon/rsr/rsr-criteria-v2.a2ml` criterion 2.3.1, `0-canon/GOVERNANCE.adoc` 56, `0-canon/TEMPLATE-APPLICABILITY-POLICY.adoc`, `.machine_readable/template-capability-gates.toml`, `scripts/registry-readiness.sh`, `scripts/check-manifest-ply.sh` and its @@ -572,7 +647,8 @@ link-rot count. They fall into three buckets. the owner: accept both names estate-wide during the transition, or revert #1272 until the manifest family has its ruling (D338 proposed manifest clauses on the repo deed, not a standalone file). -* *Bucket C, leave: historical and spec text.* The AI-gatekeeper protocol +* *Bucket C, leave: historical, frozen and spec text.* `TOPOLOGY.adoc` + (frozen snapshot, archived by P2.4), the AI-gatekeeper protocol documents and examples, the ensaid specification, the overlay specification, `docs/reorg/` (dated records), `docs/archive/`, `.machine_readable/archive/`, `standards-update/`. @@ -593,8 +669,8 @@ link-rot count. They fall into three buckets. ---- for f in ; do test "$(grep -c '0-AI-MANIFEST\.a2ml' "$f")" -eq 0 || exit 1; done -> no old-name references (exit 0) link_rot="$(bash scripts/link-rot-guard.sh .)" || test "$?" -eq 1 -printf '%s\n' "$link_rot" | awk '/^BROKEN/ {n++} END {print n+0}' -> 439 or fewer from a checkout named standards (the four from #1272 gone; 680 or fewer from any other name) -test "$(printf '%s\n' "$link_rot" | grep -c '0-AI-MANIFEST')" -eq 0 -> no broken manifest links (exit 0) +printf '%s\n' "$link_rot" | awk '/^BROKEN/ {n++} END {print n+0}' -> 440 from a checkout named standards (three manifest links repaired; 681 from any other name) +printf '%s\n' "$link_rot" | grep '0-AI-MANIFEST' -> exactly one line, TOPOLOGY.adoc (frozen; leaves with P2.4) bash scripts/check-launcher-standard-currency.sh --root . -> no stale references bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml -> 14 passed ---- @@ -611,6 +687,10 @@ urgent, and the PR body says which gate is red). provision the forges under D261. . Answer the Copilot coding-agent question (WO-6): delete, or pin and keep. Silence means the file stays. +. Dispose of the seven drafts in `.github/ISSUES/` (WO-6), each as "file" + or "discard"; all seven call themselves draft, to-do or in progress, + so none can be deleted on the executor's judgement. Silence means they + stay. . Fix the SPDX header typo on `CODEOWNERS` line 2 yourself (WO-6 flags it; agents do not edit SPDX headers). . Answer the D338 follow-through (WO-7): both manifest names estate-wide From 559d3a8e9d44417bfe1b3363f943fec5ce97dd53 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:40:07 +0000 Subject: [PATCH 6/9] docs(reorg): work orders v1.4.0 after Codex's review of #1303 Five findings on 7406ac7d, each verified against the tree: - The Hypatia gate will not clear itself when hypatia merges its fix: both reusables pin `hypatia-ref` to a vetted SHA (51ab6496 in the governance reusable) and neither local caller overrides it, so the defaults must advance afterwards. The known-red paragraph says so and the pin bump is a new owner item. - The repository-wide link-rot gate compares sets, not counts: save the guard's output before the first edit and require no new BROKEN line. Repairs (WO-7's three) show as removals, and a touched file may keep the old broken links it already had (ai-instruction's README has six). - The package-policy exclusion is opt-in: one reusable input, `policy_exclude_dir`, feeds both the language block's pathspec and a `PKG_PRUNE_DIRS` hook in check-package-policy.sh, so the copy every other caller runs is unchanged. - WO-6's `test ! -d .github/ISSUES` leaves the pre-push gate until the owner has disposed of all seven drafts; until then the gate is that the directory is untouched. - WO-8's plan check allows the issue-triage rows that record Deno's history (#706, #919, #923) and forbids only live claims. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7 --- .../WORK-ORDERS-2026-10-19.adoc | 112 +++++++++++------- 1 file changed, 68 insertions(+), 44 deletions(-) diff --git a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc index 0f717671b..d26ad2c89 100644 --- a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc +++ b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc @@ -2,7 +2,7 @@ // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) = Work orders, 2026-10-19: the first execution wave Jonathan D.A. Jewell (hyperpolymath) -v1.3.0, 2026-10-19 +v1.4.0, 2026-10-19 :toc: left :toclevels: 2 :sectnums: @@ -49,10 +49,15 @@ which is what CI uses (see _Session mechanics_ for why the name matters). `bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml`, `bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml`, `bash scripts/link-rot-guard.sh .` from a checkout named `standards` - (its exit status is 1 at the baseline, which is accepted; what must - hold is that the BROKEN count equals the count on `origin/main` in the - same checkout, 443 today, and that no BROKEN line names a file you - touched), `bash scripts/link-rot-guard.sh ` for each directory you + (its exit status is 1 at the baseline, which is accepted; before your + first edit save its output, `before=$(mktemp)` then + `bash scripts/link-rot-guard.sh . > "$before" || true`, and the gate is + that `diff "$before" <(bash scripts/link-rot-guard.sh . || true) | + grep '^>'` prints nothing: no new BROKEN line anywhere; lines that + disappear are repairs, listed in the PR body; a touched file may keep + the old broken links it already had, as + `3-practice/ai-instruction/README.adoc` does with six others beside the + manifest one), `bash scripts/link-rot-guard.sh ` for each directory you touched other than the root and `9-archive/` (a root-level touch is covered by the repository-wide run; the archive is pruned by that run and is never scanned on its own, see WO-4), @@ -80,11 +85,17 @@ which is what CI uses (see _Session mechanics_ for why the name matters). Hypatia gate (`scan / Hypatia Neurosymbolic Analysis` and `governance / Validate Hypatia Baseline`) is red on `main` since #1300 regenerated `actions.lock` in `gh actions-lock` format v0.0.3, which the scanner - rejects (`invalid_actions_lock`, two findings, severity high): the fix - is in hyperpolymath/hypatia (#927 or #928), the governance job resolves - the scanner at hypatia `HEAD` on every run, so nothing in this - repository changes for it. Until one of them merges, record the red in - the PR body; never acknowledge it in the baseline. + rejects (`invalid_actions_lock`, two findings, severity high). The fix + takes two steps: hyperpolymath/hypatia#927 or #928 merges, and then the + `hypatia-ref` default in both `governance-reusable.yml` and + `hypatia-scan-reusable.yml` advances to a commit at or after that fix. + Both defaults are vetted SHAs (`51ab6496` in the governance reusable at + this baseline); neither local caller overrides them, and only an + explicit `HEAD` floats, so the scanner stays on the rejecting commit + until the pins move. The pin bump is a two-line pull request in this + repository that changes no `uses:` line and so leaves `actions.lock` + alone. Until both steps have happened, record the red in the PR body; + never acknowledge it in the baseline. * *PR body:* the order id, the authority line per change, the acceptance block with every result pasted verbatim, a "not done" list. Open as a draft; mark ready when every locally runnable acceptance line is green @@ -152,7 +163,7 @@ as permitted tier-2 configuration and only emits a notice. *Acceptance.* ---- grep -n -i 'deno' docs/reorg/2026-10-14-tidy/HANDOVER.adoc -> no line says retired or banned -grep -n -i 'deno' docs/reorg/2026-10-14-tidy/README.adoc -> no line says retired or banned except inside a dated withdrawal note +grep -n -i 'deno' docs/reorg/2026-10-14-tidy/README.adoc -> no live claim that Deno is banned or retired (line 69 rewritten); issue-triage rows such as #706, #919 and #923 keep their recorded titles, and each affected row carries its dated withdrawal note bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml -> 0 breached, 0 broken-probe bash scripts/check-debtfile-structure.sh .machine_readable/Debtfile.a2ml -> structure OK bash scripts/link-rot-guard.sh docs/reorg/2026-10-14-tidy -> all links resolve @@ -326,8 +337,7 @@ Markdown; applied-unless-struck (D113). ---- bash scripts/check-standards-map.sh -> GATE D PASSED grep -c -E '^(cff-version|message|title|authors):' CITATION.cff -> 4 (the keys CFF 1.2.0 requires) -link_rot="$(bash scripts/link-rot-guard.sh .)" || test "$?" -eq 1 -printf '%s\n' "$link_rot" | awk '/^BROKEN/ {n++} END {print n+0}' -> the same count as on origin/main in this checkout (443 when it is named standards) +diff "$before" <(bash scripts/link-rot-guard.sh . || true) | grep '^>' -> nothing (no new BROKEN line; $before saved before the first edit, see Session mechanics) bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml -> docs-md-not-adoc unchanged GitHub community profile after merge: all items present, and the repository page shows "Cite this repository" (GitHub renders it only for a valid file). @@ -420,29 +430,38 @@ scanners (`secret-scanner-reusable.yml`, the security policy step in a walk of its could be satisfied by an archive file (the generator's directory listing; `check-package-policy.sh`'s `find_first`, which would accept an archive manifest in place of a missing root one), add - the exclusion in that script's own idiom (a `:!9-archive/**` pathspec, - or `-o -name 9-archive` in the `PRUNE` array) and record it. Where one - reports nothing under the archive and no walk can be satisfied there, - leave it alone and record that too. Put the eleven-row table in the PR - body. The `check-package-policy.sh` prune is estate-wide, since the - governance job copies the script into every caller; a directory named - `9-archive` is frozen history by this repository's own convention, so - say so in the PR body. Never touch the secret scanners. -. Give `governance-reusable.yml` an opt-in input, - `policy_exclude_pathspec` (type string, default empty), and add it to - each `git ls-files` call of the banned-language block (lines 609 to - 638) only when it is non-empty: git rejects an empty string as a + the exclusion in that script's own idiom (a `:!9-archive/**` pathspec + on a `git ls-files`, a prune on a `find` that only this repository + runs) and record it. For `check-package-policy.sh` the idiom is the + opt-in hook in the next step, never a bare `-o -name 9-archive` in its + shared `PRUNE` array: the governance job copies that script into every + caller, and a caller with a live directory of that name would lose its + packaging checks beneath it (a `flake.nix` there would stop being a + violation). Where one reports nothing under the archive and no walk can + be satisfied there, leave it alone and record that too. Put the + eleven-row table in the PR body. Never touch the secret scanners. +. Give `governance-reusable.yml` one opt-in input, `policy_exclude_dir` + (type string, default empty: the name of one directory at the caller's + root), and consume it in two places. In the banned-language block + (lines 609 to 638) derive a pathspec and add it to each `git ls-files` + call only when the input is non-empty: git rejects an empty string as a pathspec (`fatal: empty string is not a valid pathspec`), so appending - the quoted default verbatim would fail every caller that does not pass - the input. Use a bash array (`excl=(); [ -n "$POLICY_EXCLUDE" ] && - excl=("$POLICY_EXCLUDE")`, then `"${excl[@]}"` at the end of each - call), with the input exported to `POLICY_EXCLUDE` through `env:`. - Prove the default arm before pushing: run the block's `git ls-files` - lines locally with `POLICY_EXCLUDE` empty and with the archive - pathspec, and paste both listings; the empty run must equal plain - `git ls-files` with the same patterns. In `governance.yml`, which calls - the reusable by local path so both halves land in one PR, pass - `policy_exclude_pathspec: ':!9-archive/**'`. Leave the three `find` + a quoted default verbatim would fail every caller that does not pass + the input. Use a bash array (`excl=(); [ -n "$POLICY_EXCLUDE_DIR" ] && + excl=(":!$POLICY_EXCLUDE_DIR/**")`, then `"${excl[@]}"` at the end of + each call), with the input exported to `POLICY_EXCLUDE_DIR` through + `env:`. In the "Enforce Guix-only packaging policy" step, export the + same input as `PKG_PRUNE_DIRS` to `check-package-policy.sh`, and teach + the script to add `-o -name "$d"` to `PRUNE` for each name in that + variable and nothing when it is unset, so the copy every other caller + runs behaves exactly as today. Prove both default arms before pushing: + run the block's `git ls-files` lines locally with `POLICY_EXCLUDE_DIR` + empty and set, and run `bash scripts/check-package-policy.sh .` with + `PKG_PRUNE_DIRS` unset and set to `9-archive`; paste all four results. + The empty runs must equal plain `git ls-files` with the same patterns + and `main`'s script respectively. In `governance.yml`, which calls the + reusable by local path so both halves land in one PR, pass + `policy_exclude_dir: 9-archive`. Leave the three `find` calls of the package anti-pattern block (lines 662 to 665) as they are: they match only lockfile names, the frozen archive holds none, and a second idiom for the same input is not worth its lines; record them in @@ -463,12 +482,13 @@ jq '[.[] | select((.file // .path // "") | startswith("9-archive/"))] | length' test ! -f .hypatia-ignore git status --porcelain (right after the discovery step, before any edit) -> empty bash scripts/check-workflow-duplicate-keys.sh -> clean -grep -c 'policy_exclude_pathspec' .github/workflows/governance-reusable.yml -> at least 2 (the input and its use) -grep -c "policy_exclude_pathspec: ':!9-archive/\*\*'" .github/workflows/governance.yml -> 1 -grep -c '9-archive' scripts/check-package-policy.sh -> 1 (the PRUNE entry) +grep -c 'policy_exclude_dir' .github/workflows/governance-reusable.yml -> at least 3 (the input and its two uses) +grep -c 'policy_exclude_dir: 9-archive' .github/workflows/governance.yml -> 1 +grep -c 'PKG_PRUNE_DIRS' scripts/check-package-policy.sh -> at least 2 (read, then applied to PRUNE) +test "$(grep -c '9-archive' scripts/check-package-policy.sh)" -eq 0 -> nothing hard-coded in the shared script (exit 0) grep -c 'files *= *1137' standards-map.toml -> 1 bash scripts/check-standards-map.sh -> GATE D PASSED -The two git ls-files listings (empty input, archive input) pasted in the PR body; the empty one identical to plain git ls-files. +The four default-arm results (git ls-files with the input empty and set; check-package-policy.sh with PKG_PRUNE_DIRS unset and set) pasted in the PR body; the empty runs identical to today's behaviour. On the PR: ci-pipeline, hypatia-scan, Validate Hypatia Baseline, Exemption ratchet, governance / Language / package anti-pattern policy and governance / Enforce Guix-only packaging policy green; the eleven-row validator table in the body. @@ -584,7 +604,8 @@ interval on a first reading. There is no pull-request template. *Acceptance.* ---- test -f .github/PULL_REQUEST_TEMPLATE.md -test ! -d .github/ISSUES -> only once the owner has disposed of all seven; otherwise the directory is unchanged and the PR body says which drafts wait +git diff --quiet origin/main -- .github/ISSUES -> exit 0 while any draft awaits the owner (the directory is untouched and the PR body says which drafts wait) +After the owner has disposed of all seven, and not part of the pre-push gate before then: test ! -d .github/ISSUES git diff --unified=0 origin/main -- .github/CODEOWNERS | awk '/^[+-].*License-Identifier/ {print; found=1} END {exit found}' -> empty (exit 0) bash scripts/tests/apply-baseline-test.sh -> pass On the PR: labels and label-triage workflows green; Validate Hypatia Baseline green. @@ -668,9 +689,8 @@ never resolved. They fall into three buckets. *Acceptance.* ---- for f in ; do test "$(grep -c '0-AI-MANIFEST\.a2ml' "$f")" -eq 0 || exit 1; done -> no old-name references (exit 0) -link_rot="$(bash scripts/link-rot-guard.sh .)" || test "$?" -eq 1 -printf '%s\n' "$link_rot" | awk '/^BROKEN/ {n++} END {print n+0}' -> 440 from a checkout named standards (three manifest links repaired; 681 from any other name) -printf '%s\n' "$link_rot" | grep '0-AI-MANIFEST' -> exactly one line, TOPOLOGY.adoc (frozen; leaves with P2.4) +diff "$before" <(bash scripts/link-rot-guard.sh . || true) -> exactly three '<' lines (the repaired manifest links) and no '>' line; 440 BROKEN in all from a checkout named standards +bash scripts/link-rot-guard.sh . | grep '0-AI-MANIFEST' -> exactly one line, TOPOLOGY.adoc (frozen; leaves with P2.4) bash scripts/check-launcher-standard-currency.sh --root . -> no stale references bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml -> 14 passed ---- @@ -703,7 +723,11 @@ urgent, and the PR body says which gate is red). archive become a packet of their own (241 more sit inside the frozen archive, where the guard prunes them in CI and nothing can be fixed). . Prefer an arm for the archive carve-out in `governance-reusable.yml` - (WO-4): the opt-in `policy_exclude_pathspec` input, a new surface on a + (WO-4): the opt-in `policy_exclude_dir` input with its + `PKG_PRUNE_DIRS` hook in `check-package-policy.sh`, a new surface on a reusable every estate repository calls but a no-op by default, or no change because the archive matches nothing today. The order ships the input unless you say otherwise. +. After hyperpolymath/hypatia#927 or #928 merges, advance the + `hypatia-ref` defaults in both reusables (or say which session does + it); until then the Hypatia gate stays red on every pull request here. From 5d5c7bbce37274aecf5224f1915e76fa7e7e5888 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:46:26 +0000 Subject: [PATCH 7/9] docs(reorg): work orders v1.4.1, the no-new-links gate exits 0 on success MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Codex on 559d3a8e: `diff … | grep '^>'` exits 1 when there is no added line, which is the desired state, so as a pre-push gate it blocked every compliant order. The three uses (session mechanics, WO-3, WO-7) now read `! diff "$before" <(…) | grep -q '^>'`, exit 0 exactly when no new BROKEN line exists; WO-7 counts its three repairs with `grep -c '^<'`. Proved locally on synthetic output: unchanged 0, one repair 0, one new line 1. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7 --- .../2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc index d26ad2c89..671655c3f 100644 --- a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc +++ b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc @@ -52,9 +52,11 @@ which is what CI uses (see _Session mechanics_ for why the name matters). (its exit status is 1 at the baseline, which is accepted; before your first edit save its output, `before=$(mktemp)` then `bash scripts/link-rot-guard.sh . > "$before" || true`, and the gate is - that `diff "$before" <(bash scripts/link-rot-guard.sh . || true) | - grep '^>'` prints nothing: no new BROKEN line anywhere; lines that - disappear are repairs, listed in the PR body; a touched file may keep + `! diff "$before" <(bash scripts/link-rot-guard.sh . || true) | + grep -q '^>'`, which exits 0 exactly when no `>` line exists, that is, + no new BROKEN line anywhere (a bare `grep '^>'` would exit 1 in the + desired state); lines that disappear are repairs, listed in the PR + body; a touched file may keep the old broken links it already had, as `3-practice/ai-instruction/README.adoc` does with six others beside the manifest one), `bash scripts/link-rot-guard.sh ` for each directory you @@ -337,7 +339,7 @@ Markdown; applied-unless-struck (D113). ---- bash scripts/check-standards-map.sh -> GATE D PASSED grep -c -E '^(cff-version|message|title|authors):' CITATION.cff -> 4 (the keys CFF 1.2.0 requires) -diff "$before" <(bash scripts/link-rot-guard.sh . || true) | grep '^>' -> nothing (no new BROKEN line; $before saved before the first edit, see Session mechanics) +! diff "$before" <(bash scripts/link-rot-guard.sh . || true) | grep -q '^>' -> exit 0 (no new BROKEN line; $before saved before the first edit, see Session mechanics) bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml -> docs-md-not-adoc unchanged GitHub community profile after merge: all items present, and the repository page shows "Cite this repository" (GitHub renders it only for a valid file). @@ -689,7 +691,8 @@ never resolved. They fall into three buckets. *Acceptance.* ---- for f in ; do test "$(grep -c '0-AI-MANIFEST\.a2ml' "$f")" -eq 0 || exit 1; done -> no old-name references (exit 0) -diff "$before" <(bash scripts/link-rot-guard.sh . || true) -> exactly three '<' lines (the repaired manifest links) and no '>' line; 440 BROKEN in all from a checkout named standards +! diff "$before" <(bash scripts/link-rot-guard.sh . || true) | grep -q '^>' -> exit 0 (no new BROKEN line) +diff "$before" <(bash scripts/link-rot-guard.sh . || true) | grep -c '^<' -> 3 (the repaired manifest links; 440 BROKEN in all from a checkout named standards) bash scripts/link-rot-guard.sh . | grep '0-AI-MANIFEST' -> exactly one line, TOPOLOGY.adoc (frozen; leaves with P2.4) bash scripts/check-launcher-standard-currency.sh --root . -> no stale references bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml -> 14 passed From 15fb14d905301477126d104ddeaf22790d601d45 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:54:51 +0000 Subject: [PATCH 8/9] docs(reorg): work orders v1.4.2, the link gate holds under pipefail MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Codex on 5d5c7bbc: under `set -o pipefail` the gate `! diff … | grep -q '^>'` returned 0 whether or not a new BROKEN line was added, because diff's own exit 1 (the outputs differ) replaced grep's verdict as the pipeline status, and WO-7's `diff … | grep -c '^<'` printed the expected count but returned 1. All four uses (session mechanics, WO-3, WO-7 twice) now wrap diff as `{ diff … || true; }` so grep alone decides. Proved under pipefail on synthetic output: unchanged 0, three repairs 0 (count 3, exit 0), one new line 1, mixed 1; the same results without pipefail. The revision line is bumped to v1.4.2 (v1.4.1 left it at v1.4.0). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7 --- .../WORK-ORDERS-2026-10-19.adoc | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc index 671655c3f..eb6fa0a6d 100644 --- a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc +++ b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc @@ -2,7 +2,7 @@ // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) = Work orders, 2026-10-19: the first execution wave Jonathan D.A. Jewell (hyperpolymath) -v1.4.0, 2026-10-19 +v1.4.2, 2026-10-19 :toc: left :toclevels: 2 :sectnums: @@ -52,12 +52,14 @@ which is what CI uses (see _Session mechanics_ for why the name matters). (its exit status is 1 at the baseline, which is accepted; before your first edit save its output, `before=$(mktemp)` then `bash scripts/link-rot-guard.sh . > "$before" || true`, and the gate is - `! diff "$before" <(bash scripts/link-rot-guard.sh . || true) | + `! { diff "$before" <(bash scripts/link-rot-guard.sh . || true) || true; } | grep -q '^>'`, which exits 0 exactly when no `>` line exists, that is, no new BROKEN line anywhere (a bare `grep '^>'` would exit 1 in the - desired state); lines that disappear are repairs, listed in the PR - body; a touched file may keep - the old broken links it already had, as + desired state, and without the `|| true` on `diff`, whose own status is + 1 whenever the two outputs differ, `set -o pipefail` would report that + 1 in place of grep's verdict, so the inverted gate would pass a new + BROKEN line); lines that disappear are repairs, listed in the PR body; + a touched file may keep the old broken links it already had, as `3-practice/ai-instruction/README.adoc` does with six others beside the manifest one), `bash scripts/link-rot-guard.sh ` for each directory you touched other than the root and `9-archive/` (a root-level touch is @@ -339,7 +341,7 @@ Markdown; applied-unless-struck (D113). ---- bash scripts/check-standards-map.sh -> GATE D PASSED grep -c -E '^(cff-version|message|title|authors):' CITATION.cff -> 4 (the keys CFF 1.2.0 requires) -! diff "$before" <(bash scripts/link-rot-guard.sh . || true) | grep -q '^>' -> exit 0 (no new BROKEN line; $before saved before the first edit, see Session mechanics) +! { diff "$before" <(bash scripts/link-rot-guard.sh . || true) || true; } | grep -q '^>' -> exit 0 (no new BROKEN line; $before saved before the first edit, see Session mechanics) bash scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml -> docs-md-not-adoc unchanged GitHub community profile after merge: all items present, and the repository page shows "Cite this repository" (GitHub renders it only for a valid file). @@ -691,8 +693,8 @@ never resolved. They fall into three buckets. *Acceptance.* ---- for f in ; do test "$(grep -c '0-AI-MANIFEST\.a2ml' "$f")" -eq 0 || exit 1; done -> no old-name references (exit 0) -! diff "$before" <(bash scripts/link-rot-guard.sh . || true) | grep -q '^>' -> exit 0 (no new BROKEN line) -diff "$before" <(bash scripts/link-rot-guard.sh . || true) | grep -c '^<' -> 3 (the repaired manifest links; 440 BROKEN in all from a checkout named standards) +! { diff "$before" <(bash scripts/link-rot-guard.sh . || true) || true; } | grep -q '^>' -> exit 0 (no new BROKEN line) +{ diff "$before" <(bash scripts/link-rot-guard.sh . || true) || true; } | grep -c '^<' -> 3, exit 0 (the repaired manifest links; 440 BROKEN in all from a checkout named standards) bash scripts/link-rot-guard.sh . | grep '0-AI-MANIFEST' -> exactly one line, TOPOLOGY.adoc (frozen; leaves with P2.4) bash scripts/check-launcher-standard-currency.sh --root . -> no stale references bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml -> 14 passed From 8aa2e177e5c5f68c44d31d0156757d5a6c674f42 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 17:16:12 +0000 Subject: [PATCH 9/9] docs(reorg): work orders v1.4.3, the key skip stays and the guard is neutralised MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Codex on 15fb14d9, two findings, both verified against the tree: WO-2: each forge job in mirror-reusable.yml ends in a notice-only `Skipped (_SSH_KEY not configured)` step (seven in all) that runs when the variable is true but the secret is empty, so the acceptance claim "skipped by its variable or red" was false for that case. The order now names it as the second legitimate skip and keeps it: the reusable's own Radicle comment calls the secret the second switch, and the regularisation design (line 107) counts 142 estate callers skipping this way with the question marked OWNER?. Whether it should fail red is a new owner item, with red labelled as the elegant arm and the reasons for departing from it. Acceptance gains `grep -c 'not configured)' -> 7`. WO-7: `bash scripts/link-rot-guard.sh . | grep '0-AI-MANIFEST'` returned 1 under pipefail even with the TOPOLOGY line found, because the guard itself exits 1 at 440; it is now `{ … || true; } | grep …` (proved: old form 1, new form 0). Also found while re-reading WO-2's acceptance: `grep -c 'continue-on-error'` would count the comment at line 121, which the order keeps because it names the owner action; the check is now anchored to the key (`^[[:space:]]*continue-on-error:`), 2 on the tree today, 0 after the order. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7 --- .../WORK-ORDERS-2026-10-19.adoc | 42 ++++++++++++++++--- 1 file changed, 36 insertions(+), 6 deletions(-) diff --git a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc index eb6fa0a6d..c292082a0 100644 --- a/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc +++ b/docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc @@ -2,7 +2,7 @@ // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) = Work orders, 2026-10-19: the first execution wave Jonathan D.A. Jewell (hyperpolymath) -v1.4.2, 2026-10-19 +v1.4.3, 2026-10-19 :toc: left :toclevels: 2 :sectnums: @@ -246,7 +246,19 @@ on its push step (line 126), so a GitLab failure shows green with a warning. Line 441 is `rad sync --announce || echo "Radicle sync attempted"`, which turns a failed sync into a green step. The caller in this repository is `.github/workflows/mirror.yml`, pinned to the -reusable at `427eb35c`. +reusable at `427eb35c`. Each forge job also ends in a notice-only +`Skipped (_SSH_KEY not configured)` step (seven in all, GitLab's +at lines 135 to 138, Radicle's at 442) that runs when the variable is +`true` but the secret is empty, so an enabled forge without its key is +green with a `::notice::`. The reusable's own comment on the Radicle job +calls the secret the second switch (the variable asks whether the mirror +is wanted, the secret whether it is configured), and +`docs/superpowers/specs/2026-09-02-cicd-regularisation-design.adoc` line +107 counts 142 estate callers skipping this way, with the question +marked `OWNER?`. On this repository the six git forges' keys are +present (their host-verify or push steps, gated on the key, ran); +Radicle's job succeeded, which either path produces, so read which step +ran from the run. *Steps.* . Read the failing steps' logs for the five red jobs and record the @@ -279,6 +291,11 @@ reusable at `427eb35c`. variable already answers. . Add an empty-host guard: when the resolved mirror organisation or host is empty, skip with a `::notice::`, never push to an empty path. +. Keep the seven `Skipped (_SSH_KEY not configured)` steps as + they are. An enabled forge without its key is the second legitimate + skip, visible as a `::notice::` on the run. Whether it should fail red + instead is an estate decision (the 142 callers above) and a new owner + item, not this order's. . Keep the SSH fingerprint verification exactly as strict as it is. . Do not edit `actions.lock` unless a `uses:` line changed; if one did, regenerate with the repository's own relock tooling, never by hand. @@ -292,13 +309,16 @@ reusable at `427eb35c`. *Acceptance.* ---- test "$(grep -c '|| *echo' .github/workflows/mirror-reusable.yml)" -eq 0 -> no matches (exit 0) -test "$(grep -c 'continue-on-error' .github/workflows/mirror-reusable.yml)" -eq 0 -> no matches (exit 0) +test "$(grep -c '^[[:space:]]*continue-on-error:' .github/workflows/mirror-reusable.yml)" -eq 0 -> no key left (exit 0; the comment at line 121 naming the owner action stays, and is not a key) +grep -c 'not configured)' .github/workflows/mirror-reusable.yml -> 7 (the key skips stay) bash scripts/check-workflow-duplicate-keys.sh -> clean grep -c 'git ls-remote' .github/workflows/mirror-reusable.yml -> one per forge job that pushes with git bash scripts/lock-selfcheck.sh "$(git rev-parse HEAD)" -> SELF-CONSISTENT (after push) Mirror to Git Forges on main after merge: GitLab and Radicle green; every -other forge skipped by its variable (once the variables are flipped) or -red with the probe's stderr naming the reason, never green on a failure. +other forge skipped by its variable (once the variables are flipped), or +skipped by its absent key with the notice step (no git forge on this +repository is in that state today), or red with the probe's stderr +naming the reason; never green on a failure. ---- *Escalate if* any forge fails on a host-key fingerprint mismatch (a @@ -695,7 +715,7 @@ never resolved. They fall into three buckets. for f in ; do test "$(grep -c '0-AI-MANIFEST\.a2ml' "$f")" -eq 0 || exit 1; done -> no old-name references (exit 0) ! { diff "$before" <(bash scripts/link-rot-guard.sh . || true) || true; } | grep -q '^>' -> exit 0 (no new BROKEN line) { diff "$before" <(bash scripts/link-rot-guard.sh . || true) || true; } | grep -c '^<' -> 3, exit 0 (the repaired manifest links; 440 BROKEN in all from a checkout named standards) -bash scripts/link-rot-guard.sh . | grep '0-AI-MANIFEST' -> exactly one line, TOPOLOGY.adoc (frozen; leaves with P2.4) +{ bash scripts/link-rot-guard.sh . || true; } | grep '0-AI-MANIFEST' -> exactly one line, TOPOLOGY.adoc (frozen; leaves with P2.4; the guard's own exit 1 at 440 is neutralised so grep decides) bash scripts/check-launcher-standard-currency.sh --root . -> no stale references bash scripts/run-mustfile.sh .machine_readable/contractiles/must/Mustfile.a2ml -> 14 passed ---- @@ -736,3 +756,13 @@ urgent, and the PR body says which gate is red). . After hyperpolymath/hypatia#927 or #928 merges, advance the `hypatia-ref` defaults in both reusables (or say which session does it); until then the Hypatia gate stays red on every pull request here. +. Decide whether an enabled forge without its key (`*_MIRROR_ENABLED` + `true`, the `*_SSH_KEY` secret empty) stays a notice-only skip or + fails red (WO-2). The elegant arm is red: the variable is the one + switch, and `true` without a key is a misconfiguration. The order + departs from it and keeps the skip, because the reusable's own comment + names the secret as the second switch, the regularisation design (line + 107) counts 142 callers that skip this way and marks the question + `OWNER?`, and a caller that advances its pin would turn red without + having chosen to. Say "red" and WO-2 turns the seven notice steps into + `::error::` plus `exit 1`.