docs(debt): record the estate CI/CD debt register - #598
Merged
Conversation
`Debtfile.adoc` — what the 2026-08-07 sweep found and did NOT fix, with the measurement behind each number and, for the two big items, the decision each is waiting on. Matching entries added to `.machine_readable/agent_instructions/debt.a2ml`, which is explicitly the next session's Phase 0 input, so none of this depends on a session's memory. Most of what remains is blocked on a ruling, not on effort: **D-1 — 545 Scorecard alerts cannot be closed by any code change.** `scorecard-reusable.yml` runs `results_format: json` with no `upload-sarif` step, so code scanning never receives a fresh run. Of 143 sampled alerts only 7 were updated within 31 days; 8 date to 2025-12-18. Proven end-to-end: minting `actions.lock` and re-running Scorecard left `PinnedDependenciesID` at 5 -> 5, `updated_at` frozen at 2026-05-17. The `code_scanning` rule gates 106 of 171 repositories on this. **D-2 — 15 repositories pin the reusables to @81dbf2dd**, predating the lockfile-aware pin check, so they report "Found unpinned actions" on repositories holding a complete lockfile. A caller pinned to an old reusable cannot be reached by any fix made IN the reusable, so repointing is unavoidable rather than tidy. Both were attempted and refused by the permission classifier — correctly, since each changes security gating across ~100 repositories. Also recorded: 1,629 genuine unacknowledged findings by rule (with an explicit warning not to sweep them, since every family examined so far has contained false positives better fixed in the rule); the 85-of-91 baseline gap; four test suites that fail and had never been run before #588; Deno CI still running after the move to Bun; and the six repositories the sweep guards deliberately left alone. Closed items are listed for the record, including the baseline/code-scanning split fixed in #597 (standards: 48 Hypatia alerts -> 0).
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review✅ ApprovedAdds the estate CI/CD debt register documenting unclosed Scorecard alerts, unpinned reusable actions, and baseline gaps awaiting future rulings. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
Uh oh!
There was an error while loading. Please reload this page.
hyperpolymath added a commit
that referenced
this pull request
Aug 7, 2026
… audit name (#601) **The rename first, because it was my error.** I added `Debtfile.adoc` at the repo root in #598. `.machine_readable/Debtfile.a2ml` already existed from #591 — a probe-backed, monotone-decreasing register with its own spec, runner, ratchet and 30 tests. Two files a directory apart, both called Debtfile, meaning different things, is exactly the drift this canon exists to prevent. The prose one is an **audit** and now says so: `docs/audits/2026-08-07-estate-cicd-debt.adoc`. **Then the part that matters.** Deno removal is now a *measured* entry, not a sentence. DEBTFILE-SPEC's own opening example is what happens otherwise: `standards#309` claimed ~45 banned `.py` files; measured, **176** — wrong by 4×, unchallenged for ten weeks. | entry | probe | count | |---|---|---:| | `deno-residue` | workflows/scripts that **invoke** deno | 4 | | `deno-artefacts` | files existing only to serve Deno | 6 | ⚠ The owner has ruled Deno removed and Bun permanent **three times**, yet `governance-reusable.yml:264` still runs `denoland/setup-deno` — **installing Deno on every estate repo on every run** — and `docs/migrations/npm-to-deno-template/` is a live recipe pointing repos *at* the retired runtime. That is why the ruling keeps needing repeating: the canon has been propagating the opposite. ⚠ Both probes deliberately **exclude `*/bindings/deno/`** — interop so *other people's* Deno code can call estate libraries, the same shape as the `proven` polyglot exception. "We do not use Deno" and "nobody may call us from Deno" are different statements; only the first has been made. **Verified**: structure OK (7 entries) · both probes HOLDING at 4 and 6 · structure tests 14/14 · runner tests 16/16. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Debtfile.adoc— what the 2026-08-07 sweep found and did not fix, with the measurement behind each number and, for the two big items, the decision each awaits. Matching entries in.machine_readable/agent_instructions/debt.a2ml, which is explicitly the next session's Phase 0 input.Most of what remains is blocked on a ruling, not effort:
D-1 — 545 Scorecard alerts cannot be closed by any code change.
scorecard-reusable.ymlrunsresults_format: jsonwith noupload-sarifstep, so code scanning never gets a fresh run. Of 143 sampled alerts only 7 were updated within 31 days; 8 date to 2025-12-18. Proven: mintingactions.lockand re-running Scorecard leftPinnedDependenciesIDat 5 → 5,updated_atfrozen at 2026-05-17.code_scanninggates 106 of 171 repos on this.D-2 — 15 repos pin the reusables to
@81dbf2dd, predating the lockfile-aware pin check, so they report "Found unpinned actions" on repos holding a complete lockfile. A caller pinned to an old reusable cannot be reached by any fix made in the reusable — repointing is unavoidable, not tidy.Both were attempted and refused by the permission classifier — correctly, since each changes security gating across ~100 repos.
Also recorded: 1,629 genuine findings by rule (with an explicit do not sweep warning); the 85-of-91 baseline gap; 4 test suites that fail and had never run before #588; Deno CI still running post-Bun; and the 6 repos the sweep guards deliberately left alone.
🤖 Generated with Claude Code