feat(governance): promote the docs + package-policy gates from theatre to real (#505) - #513
Merged
Merged
Conversation
…e to real
Closes the two "cannot fail" jobs in governance-reusable.yml (standards#505),
each honestly and each with a red-team proof it CAN fail (wave8 doctrine).
Blast radius was measured before choosing anything, over the 412 real repo-root
callers of governance-reusable in the estate checkout — not guessed:
README 0/412 missing -> BLOCKING NOW (arming reds nobody)
LICENSE 0/412 missing -> BLOCKING NOW (arming reds nobody)
CONTRIBUTING 54/412 missing -> warn, BLOCKING from 2026-08-21
no guix/nix 70/412 -> warn, BLOCKING from 2026-08-21
Verified: 0 callers red today, on both gates. The grace window costs no new
red noise now, and it is a real date that flips itself — not a flag defaulting
to off, which would be the theatre this replaces.
- scripts/check-docs-presence.sh: split gate. README+LICENSE fail immediately;
CONTRIBUTING warns until the cutoff then fails. Never prints a pass claim
while a required file is absent ("NOT YET ENFORCED", not a green tick).
- scripts/check-package-policy.sh: replaces the echo-only job that ended in an
unconditional "Package policy check passed". Predicate tightened from "any
*.scm anywhere" (a stray Guile file satisfied it) to a genuine packaging
artefact, with vendored trees pruned so a dependency cannot satisfy the
policy on the caller's behalf. Tightening moved only 13 repos, so honesty
was nearly free. The inert `git diff HEAD~1` lockfile branch is dropped
rather than kept as a stub: it never resolved under `ref: github.sha`
without fetch-depth, and hypatia cicd_rules/nodejs_detected is the real rule.
- Both scripts refuse to run on a malformed cutoff. An unparseable date would
make the comparison pick the grace branch forever, silently restoring the
fake gate — so the gate declines to be accidentally disarmed.
- Removed the redundant advisory trufflehog step. It was continue-on-error so
it never gated, and it duplicated the real gitleaks gate from #500; the
secret-scanner header already claimed trufflehog was removed, so this
reconciles the estate with itself. Removing a never-failing step cannot
newly-red any caller.
- Fixed a SIGPIPE race found only by running against real repos: `find | head -1`
under `set -o pipefail` aborts on large trees, which red two estate repos for
no policy reason while all 20 unit fixtures passed. Regression test included
and confirmed to fail against the buggy form.
Tests: scripts/tests/governance-gates-505-test.sh (21 cases, `just
governance-gates-test`) — drives both gates on both sides of the cutoff, since
standards CI does not exercise the reusable (callers pin a SHA).
Refs: #505, #500
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>Reverted to `ref: main` before merge. Without this the new scripts are not on main yet, so the cp would fail for the wrong reason and hide whether the sparse-checkout -> RUNNER_TEMP -> run plumbing actually works. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
hyperpolymath
commented
Jul 21, 2026
OwnerAuthor
Remediation list — 74 repos to land before 2026-08-21Generated by running the final gate scripts against all 412 real repo-root callers with
Fixes are small:
|
The TEMP branch-ref commit proved the sparse-checkout -> RUNNER_TEMP -> run
plumbing end-to-end: run 29800699488, Governance green, with both gates
producing real output ('Core documentation present', 'Guix package management
detected'). Restoring `main` so this cannot merge a branch ref to the 396
callers that pin @main.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>hyperpolymath
commented
Jul 21, 2026
OwnerAuthor
✅ Plumbing proof (satisfies #505's consumer-branch checkbox)Commit That exercises the whole path the unit suite structurally cannot reach: Commit Therefore the Governance check on this head commit is expected to red — Also confirmed not mine
|
hyperpolymath
marked this pull request as ready for review
July 21, 2026 04:47
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Jul 21, 2026
hyperpolymath added a commit
to hyperpolymath/trope-checker
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#40) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/trope-particularity-workbench
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#38) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/vocarium
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#7) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `CONTRIBUTING + packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. ### `CONTRIBUTING.md` Markdown by estate rule (it is on the GitHub-required community-health list, unlike `README.adoc`). Content is derived from this repo, not boilerplate: the build section lists **only `just` recipes that actually exist here**, and the A2ML section appears only if `.machine_readable/` is present. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/action-trust-layers
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#22) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `CONTRIBUTING + packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just rust`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. ### `CONTRIBUTING.md` Markdown by estate rule (it is on the GitHub-required community-health list, unlike `README.adoc`). Content is derived from this repo, not boilerplate: the build section lists **only `just` recipes that actually exist here**, and the A2ML section appears only if `.machine_readable/` is present. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/0patch-lsa-sentinel
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#2) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/continuation-mesh
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#14) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `CONTRIBUTING` ### `CONTRIBUTING.md` Markdown by estate rule (it is on the GitHub-required community-health list, unlike `README.adoc`). Content is derived from this repo, not boilerplate: the build section lists **only `just` recipes that actually exist here**, and the A2ML section appears only if `.machine_readable/` is present. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/bebop-ffi
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#44) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/bgp-backbone-lab
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#76) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/candy-crash
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#68) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just deno`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/coord-tui
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#29) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `CONTRIBUTING + packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just rust`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. ### `CONTRIBUTING.md` Markdown by estate rule (it is on the GitHub-required community-health list, unlike `README.adoc`). Content is derived from this repo, not boilerplate: the build section lists **only `just` recipes that actually exist here**, and the A2ML section appears only if `.machine_readable/` is present. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/EchoTypes.jl
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#13) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `CONTRIBUTING + packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just julia`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. ### `CONTRIBUTING.md` Markdown by estate rule (it is on the GitHub-required community-health list, unlike `README.adoc`). Content is derived from this repo, not boilerplate: the build section lists **only `just` recipes that actually exist here**, and the A2ML section appears only if `.machine_readable/` is present. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/frayed-knot-toolkit
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#30) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/glyphbase
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#5) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/gnpl
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#5) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/hpm-crypto-rsr
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#5) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `CONTRIBUTING + packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. ### `CONTRIBUTING.md` Markdown by estate rule (it is on the GitHub-required community-health list, unlike `README.adoc`). Content is derived from this repo, not boilerplate: the build section lists **only `just` recipes that actually exist here**, and the A2ML section appears only if `.machine_readable/` is present. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/invariant-path
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#44) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just rust`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/ipv6-site-enforcer
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#78) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/julia-ecosystem
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#19) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `CONTRIBUTING` ### `CONTRIBUTING.md` Markdown by estate rule (it is on the GitHub-required community-health list, unlike `README.adoc`). Content is derived from this repo, not boilerplate: the build section lists **only `just` recipes that actually exist here**, and the A2ML section appears only if `.machine_readable/` is present. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/modshells
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#85) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/network-dashboard
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#78) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just elixir`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/not-so-serious-software
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#17) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `CONTRIBUTING + packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. ### `CONTRIBUTING.md` Markdown by estate rule (it is on the GitHub-required community-health list, unlike `README.adoc`). Content is derived from this repo, not boilerplate: the build section lists **only `just` recipes that actually exist here**, and the A2ML section appears only if `.machine_readable/` is present. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/oblibeny
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#101) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just ocaml`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/protocol-squisher
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#83) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `CONTRIBUTING` ### `CONTRIBUTING.md` Markdown by estate rule (it is on the GitHub-required community-health list, unlike `README.adoc`). Content is derived from this repo, not boilerplate: the build section lists **only `just` recipes that actually exist here**, and the A2ML section appears only if `.machine_readable/` is present. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/quandledb
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#75) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`none detected`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/technical-notes
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#17) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `CONTRIBUTING + packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`none detected`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. ### `CONTRIBUTING.md` Markdown by estate rule (it is on the GitHub-required community-health list, unlike `README.adoc`). Content is derived from this repo, not boilerplate: the build section lists **only `just` recipes that actually exist here**, and the A2ML section appears only if `.machine_readable/` is present. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/tentacles-agentic-syllabus
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#22) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `CONTRIBUTING + packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`none detected`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. ### `CONTRIBUTING.md` Markdown by estate rule (it is on the GitHub-required community-health list, unlike `README.adoc`). Content is derived from this repo, not boilerplate: the build section lists **only `just` recipes that actually exist here**, and the A2ML section appears only if `.machine_readable/` is present. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/verisimdb
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#187) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just rust`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to hyperpolymath/vext
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#27) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
hyperpolymath added a commit
to metadatastician/idaptik-ums
that referenced
this pull request
Jul 21, 2026
…05 gates bite (#13) Remediates this repo against the two governance gates promoted from advisory to blocking in [hyperpolymath/standards#513](hyperpolymath/standards#513) (closing standards#505). Those gates previously **could not fail**: the docs check only emitted `::warning::`, and the package-policy job ended in an unconditional `✅ Package policy check passed`. They are now real, with a grace window — they begin **blocking on 2026-08-21**. This repo was measured as non-compliant, so this PR lands the missing files ahead of that date. **Added here:** `CONTRIBUTING + packaging` ### `flake.nix` A **dev shell**, not a package build. Estate policy is Guix primary / Nix fallback; this is the fallback tier, and a `guix.scm` is welcome later to move to the primary. - Packages mirror the tooling **actually present in this repo** (`just`), not a generic default. - `nixpkgs` is pinned to an exact revision per the estate SHA-pinning rule. - **Verified**: `nix flake check` passes (nix 2.35.1). Every package name was confirmed to exist in the pinned revision before generation — nothing here is guessed. ### `CONTRIBUTING.md` Markdown by estate rule (it is on the GitHub-required community-health list, unlike `README.adoc`). Content is derived from this repo, not boilerplate: the build section lists **only `just` recipes that actually exist here**, and the A2ML section appears only if `.machine_readable/` is present. --- Part of an estate-wide sweep; 63 repos were identified as non-compliant. Third-party/forked repos (`HOL`, `awesome-*`, `lua-filters`) were **excluded** per the licence policy's do-not-touch rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes the two
governance-reusable.ymljobs that could not fail into real gates — tasks 1, 2 and 3 of #505.Blast radius was measured first, not guessed
Over the 412 real repo-root callers of
governance-reusablein the estate checkout (1,106 raw grep hits reduce to 412 once nested monorepo subdirs — whose.github/workflowsGitHub never reads — are excluded):Verified against all 412 callers with the final scripts: 0 red today on both gates. The grace window buys time without manufacturing red noise now — and it is a real date that flips itself, not a flag defaulting to off (which would be the theatre this replaces).
94 unique repos must land a
CONTRIBUTINGand/or packaging file before the cutoff. Full list attached as a comment below.What changed
scripts/check-docs-presence.sh(new) — replaces the::warning::-only step. Split gate: README+LICENSE fail immediately, CONTRIBUTING warns until the cutoff. Critically, it never prints a pass claim while a required file is absent — grace mode printsNOT YET ENFORCED, not a green tick.scripts/check-package-policy.sh(new) — replaces the job that ended in an unconditional✅ Package policy check passed. Two honesty fixes beyond addingexit 1:*.scmanywhere" (a stray Guile source file satisfied it) to a genuine packaging artefact (guix.scm/manifest.scm/channels.scm/.guix-channel). Tightening moved only 13 repos, so honesty was nearly free.node_modules/,deps/,.lake/,vendor/,.git/) are pruned, so a dependency can't satisfy the policy on the caller's behalf.git diff HEAD~1lockfile branch is dropped, not stubbed: it never resolved underref: github.shawithoutfetch-depth, so it was inert. hypatiacicd_rules/nodejs_detectedis the real rule. Broadening it beyondpackage-lock.jsonis follow-up, noted below.Redundant trufflehog removed (#505 task 3). It was
continue-on-error: trueso it never gated, and it duplicated the real gitleaks gate from #500.secret-scanner-reusable.yml's header already claimed "Trufflehog removed as redundant" — this reconciles the estate with itself. Removing a never-failing step cannot newly-red any caller.Both gates refuse to be disarmed. A malformed cutoff would make the date comparison pick the grace branch forever — silently restoring the fake gate. Both scripts validate their own cutoff format and hard-fail on garbage.
A real bug, found only by running against real repos
find … | head -1underset -o pipefailis a SIGPIPE race:headexits after line 1,findkeeps writing, takes SIGPIPE, andpipefailpropagates it — aborting underset -e. It only bites on trees large enough thatfindis still running, so all 20 unit fixtures passed while two real estate repos red intermittently for no policy reason. Fixed, with a regression test that was itself red-teamed: it fails against the buggy form and passes against the fix. (The first version of that test was a false-green — 3,000 non-matching files don't trigger it, becausefindemits one line; the fixture now creates 4,000 matching paths.)Verification
just governance-gates-test→ 21 cases, all green. Drives both gates on both sides of the cutoff (DOCS_TODAY/PKG_TODAYseams), plus alternate extensions, inclusive-cutoff boundary, vendored-tree pruning, stray-.scmrejection, malformed-cutoff refusal, and the SIGPIPE regression.This matters because #505 notes standards CI does not exercise the reusable for SHA-pinned callers — watching this repo go green proves nothing about them. Note however that 396 callers pin
@main, so they pick this up immediately on merge; the grace window is what makes that safe.standards calls this reusable on its own PRs (
governance.yml→./.github/workflows/governance-reusable.yml), and the script checkout is pinnedref: main. The new scripts are not onmainuntil this merges, so the final commit's governance run will red for that reason alone, not because the change is broken.To prove the plumbing (sparse-checkout →
cpto$RUNNER_TEMP→rm -rf .standards-checkout→ run) actually works end-to-end, this branch temporarily pointsref:at itself; that run is the evidence, and theref:is reverted tomainbefore merge. See the commit history.Rollback
Revert this PR, or re-pin callers to the previous
governance-reusableSHA. The two new scripts are additive — nothing else calls them.Follow-up (not in scope here)
cicd_rules/nodejs_detectedbeyondpackage-lock.json(yarn/Gemfile/Pipfile/poetry lockfiles), recovering the coverage the inert branch nominally claimed.Refs #505, #500