feat(scripts): reusable registry-readiness remediation - #105
Merged
Conversation
Codifies the burble#39 lesson estate-wide so a runner-layer version skew can never again masquerade for months as an inner-layer failure. - TOOLING-VERSION-INTEGRITY-POLICY.adoc: 5 rules + post-mortem. Pin family tools; declare the min-version floor; gates prove execution not exit-0; every soft-gate explained (dated suppression OR by-design); resolve at source. - tasks/tooling-integrity-lint.sh: R0 just>=1.19.0 floor (blocking when just present — the execution-proof check an in-file guard cannot do), R1 unversioned family-tool install (blocking), R4 unexplained continue-on-error (advisory-first per the estate gating doctrine; --strict to enforce). Self-tested vs standards/burble/hypatia. - contractiles/must/Mustfile: canonical 'tooling-version-integrity' check (dependency-free inline floor assertion) — propagates to every repo adopting the canonical must contract on contractile regen. - Mustfile: live repo dogfoods the full lint. - Justfile: Rule-2 'requires: just >= 1.19.0' annotation. NOTE: the contractile generator repo is out-of-band; contractiles/ source is edited here, regen + propagation tracked in the estate sweep issue. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…tate trufflehog soft-gate P3 propagation: the estate-wide workflow_call reusable now enforces R0 (just>=1.19.0 floor, blocking when just present) and R1 (unversioned family-tool install, blocking) inline and dependency-free, so every repo invoking governance-reusable inherits the burble#39 guard with one existing `uses:` line — no per-repo PR, no script vendoring. R4 stays advisory via the standards lint. Also dogfoods Rule 4: the pre-existing bare continue-on-error on the trufflehog step now carries a by-design rationale, so the canonical template is itself policy-clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ation Relicense→MPL-2.0 + REUSE + SPDX-normalise + de-LLM + manifest sanity. Battle-hardened across Axiom/AcceleratorGate/KnotTheory/KRLAdapter/Skein. Idempotent, branch-only, no fabrication (flags ambiguous). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Uh oh!
There was an error while loading. Please reload this page.
🔍 Hypatia Security ScanFindings: 100 issues detected
View findings[
{
"reason": "Issue in quality.yml",
"type": "missing_workflow",
"file": "quality.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in security-policy.yml",
"type": "missing_workflow",
"file": "security-policy.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
"type": "unpinned_action",
"file": "governance-reusable.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
"type": "believe_me",
"file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
"type": "js_wildcard_cors",
"file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (1 occurrences, CWE-79)",
"type": "js_innerhtml",
"file": "/home/runner/work/standards/standards/axel-protocol/src/Tea.res.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath added a commit
that referenced
this pull request
Jun 2, 2026
…#344) ## Summary First in a per-subdir series for standards PMPL→**AGPL-3.0-or-later** source-SPDX alignment. **Note the direction**: standards is category 3 (son-shared per [[standards-agpl-intentional]]), so source SPDX flips to `AGPL-3.0-or-later`, **not** MPL-2.0 (which is the sole-owner default for repos like dev-ecosystem and neurophone). ## Repo state confirmed - Root LICENSE: AGPL-3.0-or-later ✓ - Source SPDX: 3,553 files carry `PMPL-1.0-or-later` from legacy carve-out era - consent-aware-http subdir has its own special hybrid (MPL-2.0 source + CC-BY-4.0 spec + PMPL-2.0-or-later reference) — EXCLUDED from this PR ## Phase 1 scope (this PR) **700 files** flipped `PMPL-1.0-or-later` → `AGPL-3.0-or-later`: | Area | Files | |---|---| | Repo root | 28 | | `docs/` | 319 | | `.machine_readable/` | 57 | | ~30 small subdirs with no own LICENSE (meta-a2ml, session-management-standards, agentic-a2ml, anchor-a2ml, k9-coordination-protocol, standards-update, scripts, state-a2ml, ecosystem-a2ml, playbook-a2ml, neurosym-a2ml, toolchain-readiness-grades, overlay-protocol, a2ml-templates, .verisimdb, inline-annotations, hooks, launcher, contractiles, adoption-readiness-grades, panll-panels, hypatia-rules, foundations-readiness-grades, component-readiness-grades, publication-pre-flight, ensaid-config, ai-instruction, tasks, standards, release-pre-flight, tools, testing-and-benchmarking, .meta, immaculate-guide, .github, accessibility) | ~296 | ## Explicitly EXCLUDED | Path | Reason | Files | |---|---|---| | `a2ml/` | Own PMPL LICENSE — Phase 2 (LICENSE+SPDX to AGPL combined) | 1,171 | | `k9-svc/` | Own PMPL LICENSE — Phase 2 | 1,160 | | `rhodium-standard-repositories/` | Own PMPL LICENSE — Phase 2 | 122 | | `0-ai-gatekeeper-protocol/` | Own PMPL LICENSE — Phase 2 | 107 | | `lol/` | Own PMPL LICENSE — Phase 2 | 105 | | `avow-protocol/` | Own PMPL LICENSE + check-in copy of standalone `hyperpolymath/avow-protocol` — skip (fix in standalone) | 90 | | `axel-protocol/` | Own PMPL LICENSE — Phase 2 | 49 | | `consent-aware-http/` | **Special hybrid** licensing (MPL-2.0 src + CC-BY-4.0 spec + PMPL-2.0-or-later ref) per owner directive 2026-06-02 | 39 | | `outreach/` | Own LICENSE — Phase 2 review | 10 | ## Pattern this PR follows - `hyperpolymath/neurophone#102` for SPDX-flip mechanics - `hyperpolymath/developer-ecosystem#103/#105` for per-subdir scoping - **First time** the destination is AGPL not MPL — be aware ## Verification ```sh grep -rl 'SPDX-License-Identifier: PMPL-1.0-or-later' <phase-1-paths> # returns: 0 files ``` ## Why draft License sweep + first-of-kind AGPL destination; owner sight before merge. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hyperpolymath added a commit
that referenced
this pull request
Aug 7, 2026
…y fall (#591) ## Why A GitHub issue is a **boolean**. Much of what this estate tracks in issues is an **integer that changes every week**. An audit of the 697 open estate issues on 2026-08-07 found what that costs: | Issue | Claimed | Measured 2026-08-07 | | |---|---|---|---| | `standards#309` | ~45 banned `.py` files | **176** | ~4× wrong, unchallenged for ten weeks | | `standards#308` | ~12,000 PMPL headers | **4,968** | 59% paid down, unrecorded | | `reposystem#138` | Nix in 63 repos | **67** | grew, unnoticed | The purest case is `.git-private-farm`, where a bot mints the same measurement as a **new issue** on every run: ``` #104 07-05 rustsec: 138 open advisories (34 high/critical) #105 07-06 rustsec: 136 open advisories (34 high/critical) #107 07-07 rustsec: 139 open advisories (34 high/critical) #117 08-01 rustsec: 156 open advisories (54 high/critical) #119 08-02 rustsec: 156 open advisories (54 high/critical) #120 08-03 rustsec: 155 open advisories (53 high/critical) ``` Six issues carrying one number, plus three more for mirror drift. This PR adds a register that holds the integer, so the tracker can go back to holding booleans. ## What | File | Role | |---|---| | `.machine_readable/Debtfile.a2ml` | the register — same `### <id>` block shape as `Mustfile.a2ml` | | `scripts/check-debtfile-structure.sh` | structural half — rejects a **hollow entry** (a number with no probe) | | `scripts/run-debtfile.sh` | executable half — re-measures every probe; `--write` lowers ceilings | | `scripts/check-debt-ratchet.sh` | ceilings may fall, never rise silently | | `.github/workflows/debt-measure.yml` | weekly re-measure → opens **one PR**, never an issue | ## Why not a contractile The name fits the convention exactly (`Mustfile`, `Trustfile`, `Bustfile`, `Dustfile`, `Intentfile`). The placement does not: 1. **The contractile CLI does not exist.** `reposystem/contractiles/cli/` is an *empty directory*; five of six verbs have no runner. 2. **Only `must` executes**, via hand-written bash — the pattern copied here. 3. **`EXEMPTION-MECHANISMS.adoc` already rejects declarations with no reader** (`.hypatia-ignore`: *"never read by anything. Reject."*). A seventh verb would be exactly that. 4. **No verb fits** — `bust` is fault-injection drills, `dust` is exnovation, `intend` is roadmap. If the CLI is ever built, this absorbs as the `debt` verb with no rename. ## Why not a sixth exemption mechanism It **absorbs two conventions the estate already invented**: - `debt.a2ml` (`gitbot-fleet`, `flat-mate`, `rpa-elysium`, `chronicles-of-slavia`; ADR-002) - Exemption **Layer 4b** — debt stored as a Markdown table inside `.claude/CLAUDE.md`, rows `\| glob \| count \| rationale \| unblock-condition \|`, regex-parsed, in **19 repos** Sibling to the exemption ratchet, governing a different population: - `check-exemption-ratchet.sh` — debt you **excused**: *"did you quietly excuse more?"* - `check-debt-ratchet.sh` — debt you **measured**: *"did the number go up?"* ## Probe discipline — all learned the hard way in this PR - **No fallback.** A probe that fails is a hard failure. A counter returning 0 on error is indistinguishable from zero debt, and zero is the state that passes. - **Three candidate probes were rejected for manufacturing debt.** Two matched **comments** (usage examples in `codeql-reusable.yml`; a comment explaining why a script does *not* use `python3`); one counted the test files themselves. - **The register must not count itself.** The first live run breached on `todo-fixme-markers` (278 > 277) and `pmpl-licence-headers` (590 > 589) *purely because writing the entries down created the strings they search for*. Licensing debt is `policy: flag-only` — measured and reported, **never acted on**, per the standing owner directive in `.claude/CLAUDE.md`. ## Verification ``` debtfile-structure-test.sh 14 passed, 0 failed run-debtfile-test.sh 16 passed, 0 failed debt-ratchet-test.sh 12 passed, 0 failed just debt-measure · HOLDING [low ] docs-md-not-adoc 309 · HOLDING [high ] gate-scripts-without-tests 31 · HOLDING [medium ] shell-scripts-missing-spdx 2 · HOLDING [low ] todo-fixme-markers 277 · HOLDING [medium ] pmpl-licence-headers 589 ``` Each suite proves its gate **can fail** and was mutation-tested. The runner suite was itself found to be a fake gate during authoring — piping into `expect` ran it in a subshell, so counters were discarded and a real failure would still have exited 0 — and fixed. Workflows re-verified as parsing (`debt-measure.yml` initially did **not**: a multi-line `git commit -m` put continuation lines at column 1 and ended the YAML block scalar — the estate's own broken-workflow class, caught before merge). `actions.lock` updated; duplicate-key linter clean across 39 files. ## Rollout Wired as job `debt-ratchet` in `governance-reusable.yml`, so **every caller picks it up on next run with no per-repo PR**. Tier **🟡 CHECK** — MUST NOT be a required status check. Promotion to 🔴 GATE only after two clean weekly measure cycles. Adoption is opt-in: a repo with no `Debtfile.a2ml` is not in violation; a repo that has one must have a well-formed one. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Canonical home for the remediation proven across the Julia chain (Axiom/AcceleratorGate/KnotTheory/KRLAdapter/Skein PRs). Idempotent, branch-only, no fabrication. Licensing→MPL-2.0/REUSE, SPDX-normalise, de-LLM, manifest sanity. 🤖 Generated with Claude Code