Repository navigation
chore(json): canonicalise .hypatia-baseline.json (I-JSON + JCS) and keep it that way - #1304
Conversation
The owner ruled that .hypatia-baseline.json must be J-1 canonical, as JSON-POLICY requires. The file was rewritten with ijson-jcs fix, built from the commit CI pins (0fdeea71). It is now one sorted line ending in LF, down from 516 indented lines. The parsed value is unchanged: jq reads both versions as equal. No tool rewrites the file here. It is edited by hand or with jq in PRs, and every reader parses it with jq, so the single-line layout breaks nothing: - apply-baseline.sh - filter-sarif-by-baseline.sh - check-exemption-ratchet.sh - the banned-language lookup in governance-reusable.yml - tests/test_secret_scanner_no_inherit.sh Docs: JSON-POLICY section 6 records the ruling. HYPATIA-BASELINE-FORMAT tells editors to run ijson-jcs fix after an edit. Checks: - apply-baseline.sh gives byte-identical output on the old and new files, in advisory and blocking mode. - exemption ratchet against origin/main: OK, .hypatia-baseline.json unchanged at 62. - Tests pass: exemption-ratchet, apply-baseline, hypatia-blocking-gate, check-ijson-jcs, secret-scanner-no-inherit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014h2gFLLQibfB5N5hFz9ZCD
The ijson-jcs scan is report-only. On its own it would let the next jq edit put the baseline back into an indented layout without failing anything. The baseline is edited often (#1239 and #1244 last week). The package.json ruling (LANGUAGE-POLICY 1.4) pairs its conversion with a job that fails on a forgotten re-canonicalise. This does the same for the baseline. New job in ijson-jcs.yml, "Converted JSON stays canonical": runs check-ijson-jcs.sh --enforce on .hypatia-baseline.json only. The repo-wide scan stays report-only. The job's checkout and the ijson-jcs commit are pinned the same as the existing job. Verified: enforce exits 0 on this branch and 1 on origin/main's copy. actionlint 1.7.7 is clean. validate-sha-pins, validate-actions-lock, check-lock-sync, duplicate-keys, permissions and the actions-lock gate pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014h2gFLLQibfB5N5hFz9ZCD
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly and concisely identifies the main change: canonicalising .hypatia-baseline.json as I-JSON and JCS, with CI enforcement. |
| Description check | |
The description is directly related to the changeset. It explains the canonicalisation, documentation updates, CI enforcement, testing, and known unrelated workflow failure. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
|
Both gates keep the same two findings and nothing else, on #1300 (the Dependabot actions bump) moved Why this PR didn't cause it:
No fix exists yet. I'm not re-running either check. The scanner is pinned and the failure is deterministic, so a re-run would fail the same way. Once a pin bump lands on Generated by Claude Code |
|
Add Carrot credits or activate Agent usage billing to use Autofix |
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f30d35def8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # BLOCKING, for converted files only (JSON-POLICY §6). A file listed here was | ||
| # canonicalised under an owner ruling and must not drift back to an indented | ||
| # layout on its next jq edit. The report-only scan above cannot catch that. | ||
| # Fix a failure with `ijson-jcs fix <file>`. | ||
| converted-stay-canonical: |
There was a problem hiding this comment.
This job can report red but cannot block a merge as claimed: the repository derives required status contexts exclusively from the workflow files listed in config/rulesets/gates.json, and ijson-jcs.yml is not among them. Consequently, a PR that rewrites .hypatia-baseline.json non-canonically can still merge. Put this enforcement in an already-required workflow or add this workflow to the gate configuration and apply the updated ruleset.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
2 participants
Summary
.hypatia-baseline.jsonwas valid I-JSON but not JCS: it had 516 indented lines and unsorted member names.3-practice/JSON-POLICY.adoc§6 left this file undecided. On 2026-10-19 the owner ruled that it must be converted. This PR has two commits.1.
chore(json): canonicalise .hypatia-baseline.jsonijson-jcs fixwith the binary built from the commit CI pins (0fdeea71). The file is now one sorted line ending in LF, which satisfies.editorconfig. Its parsed value is unchanged:jqreads$old == $newas true.jqin PRs. Every reader parses it withjq, so the single-line layout breaks no consumer:apply-baseline.shfilter-sarif-by-baseline.shcheck-exemption-ratchet.shgovernance-reusable.ymltests/test_secret_scanner_no_inherit.shJSON-POLICY.adoc§6 records the ruling.HYPATIA-BASELINE-FORMAT.adoctells editors to runijson-jcs fix .hypatia-baseline.jsonafter an edit. It also says the indented example there is for reading only.2.
ci(json): block drift on converted JSON(separate commit, so it can be dropped)ijson-jcs.yml. It runscheck-ijson-jcs.sh --enforce .hypatia-baseline.jsonand nothing else. The repo-wide scan stays report-only.jqedit writes it back indented, and the report-only scan would not fail on that. This follows the precedent ofpackage.jsonin LANGUAGE-POLICY §1.4, where the conversion comes with a job that fails if someone forgets to re-canonicalise.Testing
check-ijson-jcs.sh --enforce .hypatia-baseline.jsonexits 0 on this branch and 1 onorigin/main's copy.apply-baseline.shgives byte-identical output on the old and new files, in bothadvisoryandblockingmodes. The input had 62 matching findings plus one planted finding that should not match: 62 were suppressed and 1 was kept, in both.check-exemption-ratchet.sh origin/mainpasses, with.hypatia-baseline.jsonunchanged at 62 entries.These tests pass:
exemption-ratchet-testapply-baseline-testcheck-ijson-jcs-testhypatia-blocking-gate-testtest_secret_scanner_no_inheritWorkflow checks:
actionlint1.7.7 is clean.validate-sha-pins,validate-actions-lock,check-lock-sync,check-workflow-duplicate-keys,validate-permissionsand the actions-lock gate all pass. The pre-commit and commit-msg hooks pass.validate-spdx-workflowsfails when run across the whole repo. The failure is on9-archive/rhodium-standard-repositories/satellites/rsr-deployer/.github/workflows/jekyll-gh-pages.yml, which this PR does not touch. The staged-file run in pre-commit passes.Trade-off
Because the file is now one line, every future edit shows in a diff as a whole-line change. To review a change, run
jq . <file>on both sides and compare those, or usegit diff --word-diff.Generated by Claude Code